A.02 - ATC Cyber Engineering and RMF Performance Work Statement Final.docx

PERFORMANCE WORK STATEMENT (PWS)

Aberdeen Test Center (ATC) Cybersecurity Engineering and DoD Risk Management Framework (RMF) Support Services

27 July 2026

Part 1

General Information

1. GENERAL: This is a non-personnel services contract to provide Cybersecurity Engineering and DoD Risk Management Framework (RMF) Support Services. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Cybersecurity Engineering and DoD Risk Management Framework (RMF) Support Services as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background: The mission of ATC is to plan, conduct, analyze, and report the results of developmental tests, production tests, and other tests to include providing test and test support services for authorized customers, within Department of Defense (DOD) and outside DOD, including government and non-government organizations, domestic and foreign in the support of the warfighter. ATC is one of the DOD’s premier test and training ranges supporting both military and commercial materiel developers by testing a broad spectrum of equipment throughout the life cycle, from concept through deployment. ATC is a tenant on APG and encompasses land and water totaling approximately 70,000 acres with an extensive inventory of facilities. ATC is organized by Directorate competencies with approximately 2500 personnel that consists of government civilian, military, and contractors.

1.3 Scope: The Contractor shall provide all personnel and other items necessary to perform services as described in the PWS and associated contract documents, except for those items specified in Part 3 Government Property and Services. The Contractor shall perform to the standards and acceptable quality levels identified in this PWS and associated contract documents.

1.4.1 Period of Performance: 1 September 2026 – 31 August 2031, including one (1) Base Year of 12 months and four (4) 12-month option years. The Period of Performance reads as follows:

1.5 General Information

1.5.1 Quality Control: The contractor shall develop and maintain an effective Quality Control Program (QCP) to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s QCP is the means by which he assures himself that his work complies with the requirement of the contract. The QCP will be delivered within 30 days after contract award and three copies of a comprehensive written QCP shall be submitted to the KO and COR within 5 working days when changes are made thereafter. After acceptance of the QCP the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to his quality control system.

1.5.2 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.5.3 Recognized Holidays: Federal Holidays in each calendar year are identified below. When such holidays fall on Saturday, the preceding Friday will be considered a holiday. When such holidays fall on a Sunday, the succeeding Monday is considered a holiday.

• New Years’ Day, January 1(or observed)

• Martin Luther King’s Birthday, the third Monday in January

• Washington’s Birthday, the third Monday in February

• Memorial Day, the last Monday in May

• Juneteenth, June 19 (or observed)

• Independence Day, July 4 (or observed)

• Labor Day, the first Monday in September

• Columbus Day, the second Monday in October

• Veterans Day, November 11(or observed)

• Thanksgiving Day, the fourth Thursday in November

• Christmas Day, December 25 (or observed)

• Any other day designated by Federal law, Executive Order, or Presidential Proclamation

1.5.4 Hours of Operation: ATC is currently working an alternate work schedule as described in ATC regulation 690-9. The contractor shall be required to provide support during these hours, in addition, deviate from normal hours by providing sufficiently trained and qualified personnel to satisfy the work schedule for each particular test at designated ATC site locations. Notification to work outside normal hours of operation to support government requirements may be received with as little as one hour advance notice.

INSTALLATION CLOSURES. Inclement weather conditions may force a temporary shutdown of APG. The contractor shall call the Post Operation telephone (410-278-SNOW) to get APG operation status and report to work accordingly. In addition, the local radio stations will announce any such delays or closures.

TELEWORK.

For purposes of this contract, “telework” is defined as a work arrangement in which Contractor employees perform Contract requirements at an alternative duty location. No diminishment of Contract performance is allowed as a result of telework. Individual Contractor employee eligibility for telework should be determined on a case-by-case basis by the Contractor Project Manager (CPM).

“Situational telework” is telework performed on an occasional, one-time, or ad hoc basis. Contractor employees in positions not typically eligible for telework may be able to telework on a situational basis when feasible. Situational telework includes:

(a) Pandemic Health Crisis. Contractor employees may be asked to telework to prevent the spread of disease, viruses, or other health risks.

(b) Weather/Safety/Unplanned Closure or Event. When adverse weather is anticipated or the organization/installation is closed, situational telework may be authorized.

(c) Other case-by-case situations where a Contractor employee is temporarily unable to physically report to the normal duty station but is capable of performing their normal contract requirements from their telework location. This will be managed by the CPM and reported to the Contractor Officer’s Representative (COR) and the Technical Point of Contact (TPOC).

TELEWORK PLAN. The Contractor shall submit a telework plan to the COR for approval before any telework/situational telework is authorized. The Telework Plan should address the following:

(a) Positions eligible for telework/situational telework.

(b) Controls to ensure Contract requirements are being met (e.g., performance-based requirements/metrics, mechanisms to address performance issues, etc.)

(c) Information security measures to ensure protection of information accessible from telework locations, including measures to protect work records from unauthorized disclosure.

(d) Compatibility and availability of telework enhancing office tools (e.g., Microsoft Teams, teleconference, etc.).

(e) Parameters of telework (e.g., maximum number of days/week for telework, mechanisms for ensuring face-to-face meetings when necessary, etc.).

(f) Any additional conditions germane to contract performance under this Contract.

1.5.5 Place of Performance: The work to be performed under this contract will be performed at Aberdeen Test Center, APG MD 21005.

1.5.6 Type of Contract: The government will award a Firm Fixed-Price (FFP) contract.

1.5.7 Security Requirements: Contractor personnel performing work under this contract must have a Secret Security Clearance (favorably adjudicated Type 3 Investigation) at time of the bid submission, and must maintain the level of security required for the life of the contract. The security requirements are in accordance with the attached DD254. Contractor personnel must be able to maintain access to their assigned SIPRNet account. One of the positions for a surge effort will require a Top Secret Clearance (favorably adjudicated Type 5 Investigation).

1.5.7.1 PHYSICAL Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.5.7.2 Key Control. The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer.

1.5.7.2.1. In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.5.7.2.2. The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

1.5.7.3 Lock Combinations. The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s Quality Control Plan.

1.5.8 Special Qualifications: All contractor employees with access to a government information system must be registered in the Army Account Validation System (AVS) at commencement of services and must successfully complete the following requirements:

All contractor employees and associated sub-contractor employees must complete the DoD Cybersecurity Awareness Challenge training and sign the Army IT User Agreement before issuance of network access and thereafter as required.Per DoD 8570.01-M (Ch4), DFARS 252.239.7001 and AR 25-2, the contractor employees supporting Cybersecurity/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M (Ch4) must be completed upon contract award.

IT Solutions Architect Sr – must have CISSP certification and minimum 10 years of experience managing RMF lifecycle reporting with at least 5 years of progressive requirements for network expansion and cloud/enclaves.

The other IT Certified Professionals should have CASP+ (now called Security X) or equivalent certification and minimum 5 years of experience supporting RMF lifecycle reporting and software/hardware reconciliation.

Specifically, the one surge position for Top Secret effort must have minimum 3 years supporting the lifecycle documentation for Top Secret environments.

All positions require experience managing networks with different platforms (Windows/Linux/Apple) and various security classification environments (Unclassified/Classified) such as Secret level environments.

1.5.9 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.5.10 Contracting Officer Representative (COR): The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.5.11 Key Personnel: The following personnel are considered key personnel by the government:

IT Sys Solutions Architect-Sr/Contract Manager. The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer.

The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 8:00 a.m. to 4:30p.m, Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons. Qualifications for all key personnel are listed below: The IT Sys Solutions Architect-Sr/Contract Manager must have a high degree of expertise with the following systems/protocols: DoD RMF policies and practices, security audits, risk assessment practices, DISA STIG compliance, knowledge of NIST special publications, FISMA compliance, excellent writing and communications skills, and former experience as a Server Administrator or Network Administrator is highly desirable.

1.5.12 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contractor personnel will be required to obtain and wear badges in the performance of this service.

1.5.13 Contractor Travel: CONUS and OCONUS travel are not anticipated in support of this PWS. Should the need for travel arise, the number of trips and personnel travelling shall be limited to the minimum required to meet mission requirements. All travel must be submitted and approved by the COR prior to the start date.

Government concurrence of travel requirements should be requested via email and provided as a separate attachment in the submission to the COR for prior approval. Travel arrangements and execution should not occur prior to receiving COR approval.

All travel must be in accordance with Joint Travel Regulations (JTR) and be within Government per diem. If Government per diem is exceeded, written justification and Government approval must be provided when invoiced. When invoicing for travel costs, submit an itemized travel expense report, travel estimate, applicable receipts, and Government concurrence email.

1.5.14 Other Direct Costs: Other Direct Costs are not anticipated in support of this PWS.

1.5.15 Data Rights : The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.5.16 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may effect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.5.17 PHASE IN /PHASE OUT PERIOD: To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the Contractor shall have personnel on board, during the 30 day phase in/ phase out periods. During the phase in period, the Contractor shall become familiar with performance requirements in order to commence full performance of services on the contract start date.

1.5.18 ELECTRONIC INVOICING. IAW DFARS 252.232-7003 – Electronic Submission of Payment Requests, the Contractor is required to submit request for payment (invoicing) thru the Wide Area Workflow (WAWF) electronic invoicing application. Instructions for registering and submitting electronic invoices using WAWF can be found at https://piee.eb.mil/. Web-based training on the procedures to use WAWF can be found at https://pieetraining.eb.mil/wbt/.

1.6. PERFROMANCE STANDARDS.

The Contractor will comply with the following DoD Cybersecurity policies listed below:

a. Title 40/Clinger-Cohen Act

b. The Contractor will comply with the DoD Instruction 8500.01 Cybersecurity - 14 Mar 2014

c. The Contractor will comply with the DoD Directive 8570.1 “Information Assurance Training, Certification, and Workforce Management” - 23 April 2007

d. The Contractor will comply with the DoD Instruction 8580.1 “Information Assurance in the Defense Acquisition System”

e. The Contractor will comply with the DoD Instruction 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT) - 12 Mar 2014

f. The Contractor will comply with the Chairman of the Joint Chiefs of Staff (CJCS) Instruction 6510.01E “Information Assurance (IA) and Computer Network Defense (CND)”

g. The Contractor will comply with the Chairman of the Joint Chiefs of Staff (CJCS) Instruction 6212.01 “Interoperability and Supportability of IT and National Security Systems”

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.2. CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.3. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.5. DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.6. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.7. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.8. QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.9. QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.10. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.11. SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.12. WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.13. WORK WEEK. Monday through Friday, unless specified otherwise.

2.2. ACRONYMS:

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1. Services: Not applicable.

3.2 Facilities: The Government will provide the necessary workspace for the contractor staff to provide the support outlined in the PWS to include desk space, telephones, computers, and other items necessary to maintain an office environment.

3.3 Utilities: The Government will provide all utilities in the facility, which will be available for the contractor’s use in performance of tasks outlined in this PWS. If utilities are furnished, the following is required: The Contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount to accomplish cleaning vehicles and equipment.

3.4 Equipment: The Government will provide laptops, programmatic documents and archives, applicable standard operating procedures, applicable regulations and guidelines, and other source documents as may be required to execute tasks and functions. The Government shall provide a workspace and required IT support to conduct required task functions. Since the Government property provided to the Contractor is incidental to the place of performance, a Government Furnished Property List is not required per FAR 45.000(b)(5).

3.5 Materials: Not applicable.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1 General: There will be no Contractor furnished items under this contract.

4.2 Secret Facility Clearance: The contractor shall possess and maintain a SECRET facility clearance from the Defense Security Service. The Contractor’s employees, performing work in support of this contract shall have been granted a SECRET security clearance from the Defense Industrial Security Clearance Office. The DD 254 is provided as Attachment.

PART 5

SPECIFIC TASKS

5. Specific Tasks:

5.1. Basic Services. The contractor shall provide Cybersecurity Engineering and DoD Risk Management Framework (RMF) Support Services to the Aberdeen Test Center (ATC). The contractor will specifically provide RMF analysis, planning, execution, and maintenance of client system(s) Authority to Operate (ATO). Contractor will conduct appropriate RMF activities to establish and/or maintain ATO and RMF compliance. The contractor shall support the following ATC systems/projects: Aberdeen Test Center Local Area Network (ATC LAN), Aberdeen Test Center Logically Isolated Network (ATC LIN), Aberdeen Test Center Secure Test Environment (ATC STE), and Aberdeen Test Center Test and Evaluation Network (ATC T&EN).

5.2. Task Heading. The Contractor shall perform the following tasks:

5.2.1 The contractor shall review and analyze all proposed engineering changes to system hardware and software baselines for the purpose of ensuring continued satisfaction of system performance and interoperability requirements.

5.2.2 The Contractor shall support Configuration Management (CM) processes and technical reviews to evaluate all system changes to include full support to review and control boards as deemed applicable by the government. Perform analysis and review of all target candidate defects per domain area in the defect tracking system to evaluate and validate all captured and reported incident reports.

5.2.3 The Contractor shall provide system-wide architectural support for the development of the software baselines requirements and design to include emerging technologies and migration of existing capabilities.

5.2.4 The Contractor shall identify, assess, analyze, document, and audit Cybersecurity requirements through the DoD Risk Management Framework (RMF) for SECRET and below. The contractor shall do the same for TOP SECRET requirements in accordance with Intelligence Community Directive (ICD) 503.

5.2.5 Categorize Information Systems. The Contractor will categorize ATC systems and identify system boundaries. Contactor will gather all pertinent organizational and system information, including but not limited to, mission, roles, responsibilities, operating environment, and use and connections with other systems.

5.2.6 Select Security Controls. The Contractor will select applicable security controls – management, operational, and technical safeguards and/or countermeasures – based on ATC information system categorization.

5.2.7 Implement Security Controls. The Contractor will implement the selected security controls to protect the confidentiality, integrity, and availability of the ATC information systems.

5.2.8 Assess Security Controls. The Contractor will assess controls using industry best practices and procedures to determine correct implementation and operation of the controls. Contract will conduct verification and validation (V&V) activities to ensure the controls are producing the desired outcome and meeting the security requirements for the ATC information systems.

5.2.9 Support Authorization Activities. The Contractor will support Security Control Assessor (SCA) visits, assessments, and other activities.

5.2.10 Monitor Security Controls. The Contractor will conduct continuous monitoring activities to maintain security authorization(s) on ATC information systems, including Plan of Action & Milestones (POA&M) maintenance and information assurance vulnerability management (IAVM) activities.

5.3. SERVICE CONTRACT REPORTING (SCR): In accordance with FAR Clause 52.204-14 or 52.204-15 (Service Contract Reporting Requirements), the Contractor shall report Service Contract Reporting (SCR) data annually via SAM.gov. The Contractor shall completely input all required manpower and labor-hour data by October 31 for the preceding Government fiscal year period of performance.

PART 6

APPLICABLE PUBLICATIONS

6. APPLICABLE PUBLICATIONS (CURRENT EDITIONS):

6.1. The Contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures, including NIST SP 800-53, DoDI 8510.01, AR 25-1, and AR 25-2.

PART 7

ATTACHMENT/TECHNICAL EXHIBIT LISTING

7. Attachment/Technical Exhibit List:

7.1. Attachment 1/Technical Exhibit 1 – Performance Requirements Summary

7.2. Attachment 2/Technical Exhibit 2 – Deliverables Schedule

7.3 Attachment 3/Technical Exhibit 3 – Estimated Workload Data

TECHNICAL EXHIBIT 1

Performance Requirements Summary The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Method of Surveillance

PRS # 1

Transition-In Timeliness

PRS # 2

Anti-Terrorism (AT) Level 1 Training Completion

PRS # 3

Delivery of Quality Services

PRS # 4

Program Management Financial Deliverables Accuracy

TECHNICAL EXHIBIT 2

DELIVERABLES SCHEDULE

TECHNICAL EXHIBIT 3

ESTIMATED WORKLOAD DATA

ITEM

NAME

ESTIMATED QUANTITY