a_SEE ME FIRST_PTS-G Technical Capability Market Research RFI_FINAL_22Apr24.pdf

PTS-G Technical Capability Market Research RFI

Please Note: All documents are draft pre-decisional, notional, for market research and not for action.

Additionally, the technical documents mentioned below are provided to assist your company gain an understanding of the scope.

1. Please see the attached Draft PTS-G Technical Requirements Document (Enclosure 1) and provide comments.

a. Additional statements not called out in the TRD

i. Anchor station terminals at commercial and/or DoD sites with GFE Joint hubs and

DODIN terrestrial lines

ii. Government Owned Contractor Operated construct

iii. Limited government oversight and commercial best practices with respect to risk management and developmental test and evaluation

iv. Deliverables expected to be limited to payload performance and contractor best practices used to verify own systems

2. Please see the attached documents for your reference only.

a. PTES-8210-Rev_D (Enclosure 2.a)

b. PATS-13390 (Enclosure 2.b)

c. MIL-STD-188-164C (Enclosure 2.c)

d. PTS-G Contract Award Program Objective and Milestones (POAM) (Enclosure 2.d)

PATS-13390 is under review for updates for PTS-G. For example, updates under consideration include, but are not limited to:

- Expand other program specific terminology (e.g., PGET) to include PTS-G terminology (e.g., Anchor Station)

- Update of schema to reflect transponded satellite architecture o PayloadRFConfiguration – removal of demodulator, modulator from schema and addition of parameters like hopping bandwidth, power allocation o PayloadStatus – removal of modem branches

- Clarification that MMS will not provide configuration files to PTS-G payloads

- Clarification that PTS-G does not have Space ECUs

3. The government has identified a short list of critical technologies. Please confirm if your company considers these critical technologies and/or how you would modify this list

a. Channelizers

b. NSA approved cryptography into T&C subsystem and SOC

c. X-band deployable antenna and amplifiers for 1000-kg sized satellite

d. Electrical power system for a 2-5 kW payload on a 1000-kg sized satellite

e. High thrust (100-1000 mN) propulsion for quick repositioning

4. Cybersecurity/IA requirements

a. PTS-G contractors will be required to meet a small subset of Risk Management Framework

(RMF)

b. Please comment on and provide potential impacts for the following Cybersecurity Tasks.

Please note that these tasks are currently in work and subject to change.

c. Documents included in this RFI that are applicable:

i. DODI 8510.01 (Enclosure 4.c.i)

ii. NIST SP 800-53 rev 5 (Enclosure 4.c.ii)

iii. CNSSI No 1253 (Enclosure 4.c.iii)

iv. Space_AO_IATT_Process_Memo 24 Jan 2023 (Enclosure 4.c.iv)

v. Space_AO_Required_Artifacts_Memo_06 Feb 2023 (Enclosure 4.c.v)

d. Is this a deal breaker on potentially bidding for a PTS-G Space Vehicle? If so, provide alternate task statements or recommendations? Were you anticipating using the IA-PRE program or another program?

Development

The following cybersecurity requirements shall be applicable at the system, segment levels and below to include hardware, software, and firmware.

a. The PTS-G Contractor shall tailor the security controls to implement for the system. The PTS-G Contractor shall flow-down the tailored security controls into the system components and system engineering processes and deliver a Cybersecurity Implementation Plan (CSIP). The CSIP shall demonstrate how the PTS-G Contractor will implement the tailored security controls and deliver a system that is capable of obtaining the RMF authorization approval from the SpOC S3/6 office.

b. The PTS-G Contractor shall develop and deliver the Cybersecurity Test & Verification Plan (CTVP) that details how the cybersecurity requirements identified from the PTS-G TRD (PTS- XXXXX) and the tailored security controls will be tested and validated throughout the system lifecycle. The CTVP shall be developed covering all cybersecurity-enabled device (e.g., router, switch, desktop, server) up through the system level.

c. The PTS-G Contractor shall ensure their overall system cybersecurity test and evaluation process is fully integrated into the overall system test and evaluation processes and plans. The PTS-G Contractor shall demonstrate and maintain traceability between the CSIP, CTVP, allocated and Government approved tailored security controls, and PTS-G TRD (PTS-XXXX).

d. The PTS-G Contractor shall design, develop, and implement an Operating System and Software Patching Plan (OSSPP) that captures and demonstrates how the PTS-G Contractor will maintain the operating system and software patching compliance with published STIGs and vendor OEM standards. The PTS-G Contractor shall collaborate with DISA and integrate the OSSPP into the systems engineering policies, plans and procedures.

e. The PTS-G Contractor shall develop and deliver a Cybersecurity Architecture.

f. The PTS-G Contractor shall develop a Hardware/Software (HW/SW) List and deliver using to the Government provided template.

g. The PTS-G Contractor shall develop the Ports, Protocols and Services (PPS), delivered according to the Government provided template.

h. The PTS-G Contractor shall deliver products that support the Government obtaining the RMF authorization approval from SpOC S3/6 for the system with an RMF system categorization impact assessment of a High Confidentiality, High Integrity, and Moderate Availability (HHM) and all applicable overlays IAW CNSSI 1253, and NIST SP800-53. (accessible on IDE)

1. The artifacts required for the Interim Authority to Test (IATT) approval are captured in Space_AO_IATT_Process_Memo 24 Jan 2023.

2. The artifacts required for Authorization to Operate (ATO) are captured in Space_AO_Required_Artifacts_Memo_06 Feb 2023.

i. The PTS-G Contractor shall maintain the efforts that implemented DISA Security Technical Implementation Guides (STIG)s, vendor (Original Equipment Manufacturer (OEM)) security guidance, best practices, and applicable vendor product patches at least quarterly to the system under test and operation.

j. The PTS-G Contractor shall demonstrate how the system Solution Architecture is Global (e.g., fail-safe; redundant; able to operate through compromise, degraded operation, or degraded communications).

k. The PTS-G Contractor shall demonstrate how the system will support the continuous monitoring of cybersecurity status with the ability to identify, isolate, eradicate, and recover from an internal and external threat.

l. The PTS-G Contractor shall assess the impact of vulnerabilities and develop and implement custom countermeasures.

m. The PTS-G Contractor shall ensure the PTS-G cybersecurity workforce is certified consistent with DoDD 8140.01 (Cyberspace Workforce Management), IA Training, Certification and Workforce Management within six (6) months of ECD.

n. The PTS-G Contractor shall comply with Committee on National Security Systems Policy (CNSSP) No. 11 (National Policy Governing the Acquisition of Information Assurance (IA) and IA-Enabled Information Technology (IT) Products) and CNSSP No. 12 (Cybersecurity Policy for Space Systems Used to Support National Security Missions), and consistent with DoDI 8500.01 (Cybersecurity) for all cybersecurity related to PTS-G, including subsystems, hardware, and software.

o. The PTS-G Contractor shall support the Government PTS-G Program Office led Cybersecurity Review Board (CRB) for the development, refinement, and implementation of a cybersecurity strategy. Projected meetings are quarterly.

p. The PTS-G Contractor shall maintain the Cybersecurity Test & Verification Plan (CTVP) that details how the cybersecurity requirements identified from the PTS-G TRD (PTS-XXXX) and the tailored security controls. The controls will be tested throughout the system lifecycle. The CTVP shall be developed covering all cybersecurity-enabled device (e.g., Router, switch, desktop, server) up through the system level. [A010]

q. PTS-G system component with a direct network interface to the DISN shall comply with the DISA Approved Product List (APL) (https://aplits.disa.mil/).

Sustainment

a. The PTS-G Contractor shall ensure compliance with Information Assurance, Cybersecurity, and Program Protection requirements.

1. The PTS-G Contractor shall conduct STIG compliance scans and deliver a quarterly status of STIG and OEM test status along with system and segment patch status. (accessible on IDE)

i. The PTS-G Contractor shall deliver both raw and summary STIG results, as well as the version and date of the STIGs used, along with the monthly status updates into the IDE.

ii. The summary STIG results shall include validation statements proving that the vendor has reviewed and addressed each finding within the STIG compliance scans.

iii. The PTS-G Contractor shall review their POAM monthly and provide comments and milestones to the Government Program Office. (accessible on the IDE)

b. The PTS-G Contractor shall identify and implement efficiencies and process improvements over the lifecycle, that will reduce the cost to operate and sustain the system.

c. The PTS-G Contractor shall maintain the security controls implemented for the operational life of the PTS-G system.

d. The PTS-G Contractor shall maintain the Operating System and Software Patching Plan (OSSPP) for the operational life of the PTS-G System.

e. PTS-G Contractor shall maintain the PTS-G Cybersecurity Architecture for the operational life of the PTS-G System.

f. The PTS-G Contractor shall perform cybersecurity maintenance activities needed to maintain the RMF authorization for the operational life of the PTS-G system and annual review of the system security policies or the RMF authorization extension. The review will be held in conjunction with the Cybersecurity Review Board.

Section Document Name Space Platform Corresponding Requirements

2a SCA Signed Security Categorization Memo Same

2b AO Designated Representative (AODR) Signed eMASS Registration and Security Plan

Same

2c Topology/Authorization Boundary Same

2d Hardware List Hardware List, Parts, Materials, and Processes Selection List (Approved suppliers), As-Built Configuration

2d Software List Software List, Software Version Description

(SVD)

2e Boundary Network Device Configuration Files (as requested)

N/A

2f Cybersecurity Strategy Same

2g Signed and dated Access Control, Audit and Accountability, Configuration Management and Incident Response plans and policies

Same, also include the Orbital Operator Handbook

2h Security Technical Implementation Guide (STIG) applicability list (i.e., a listing of all STIGs applicable to the information system based on technologies and architecture)

Interface Control Document (ICDs) / Test Cases. Software Test Description

2i STIG compliance and vulnerability scans for all assets (analyzed and dated within 60 days of submission)

ASD STIG, Functional Test Results/Documents, (i.e., Software Test Report (STR), Software Integration Test (SWIT), Software Item Qualification Test (SIQT), Static Code Analysis, System Performance Test (SPT)) Flight Software (FSW) scans

2j Ports, Protocols, and Services (PPS) Matrix and PPS registration / tracking number

Interface Control Document (ICDs) / Test Cases. Software Test Description

2k Information System Continuous Monitoring Strategy

Same

The above table is for Space Vehicle assessment with government known documents, can you please inform the government what your company calls the above documents? Additionally, if there are documents listed on this table that are not applicable to your company, can you please identify that document for the government?

Enclosures:

Enclosure 1 - Draft PTS-G Technical Requirements Document (CUI/subject to export control) Enclosure 2.a – PTES-8210-Rev_D (FOUO, Distro D/subject to export control) Enclosure 2.b - PATS-13390 (CUI/subject to export control) Enclosure 2.c - MIL-STD-188-164C (for public release) Enclosure 2.d - PTS-G Contract Award Program Objective and Milestones (POAM) (CUI) Enclosure 3 – Not applicable and not provided Enclosure 4.c.i – DODI 8510.01 (for public release) Enclosure 4.c.ii – NIST SP 800-53 rev 5 (for public release) Enclosure 4.c.iii - CNSSI No 1253 (for public release) Enclosure 4.c.iv - Space_AO_IATT_Process_Memo 24 Jan 2023 (CUI, FOUO) Enclosure 4.c.v - Space_AO_Required_Artifacts_Memo_06 Feb 2023 (CUI, FOUO)