Advanced Cyber Security Threat Detection and Analysis Platform_Draft PWS_20241009.docx

Defense Threat Reduction Agency (DTRA)

Advanced Cyber Security Threat Detection and Analysis Platform Performance Work Statement

HDTRA125R0013

09 October 2024

1. BACKGROUND/INTRODUCTION

The Defense Threat Reduction Agency (DTRA), Nuclear Enterprise Support Directorate (NE), Mission Assurance (MA) Department performs integrated, multidisciplinary mission assurance assessments that assess vulnerabilities of critical mission systems, networks, architectures, infrastructures, and assets.

DTRA’s Advanced Blue Cyber assessments represent a critical aspect to the MA Department’s larger Mission Assurance program and provides a deep-packet analysis and susceptibility assessments of critical United States (U.S.) and allied national/theater mission systems.

These assessment outputs inform DTRA customers and partners of existing cyber vulnerabilities which require mitigation moving forward, and inform these partners of factual, operationally active, and specific current on-going cyber threats. Advanced Blue Cyber assessments provide NE-MA customers with actionable information to implement risk management strategies for mission assurance to prevent, protect, and mitigate threats to assets and operations critical to national security and the National Military Strategy.

2. APPLICABLE DOCUMENTS

2.1 DoDD 5105.62, Defense Threat Reduction Agency

2.2 DoDD 3020.40, Mission Assurance

2.3 DoDI 3020.45, Mission Assurance Construct

2.4 DoDI 3000.08, Balanced Survivability Assessments

2.5 DoDI 8500.01, Cybersecurity

2.6 DoDI 8510.01, Risk Management Framework for DoD Information Technology

2.7 DoD 8570.01-M, Information Assurance Workforce Improvement Program

2.8 DoD 8140.01, Cyberspace Workforce Management

3. SCOPE

The Contractor shall provide the Advanced Cyber Security Threat Detection and Analysis Platform (ACSTDAP) to support NE-MA customers and programs. The Contractor shall provide NE-MA Cyber Division with specialized support and expertise to meet mission requirements. The specialized support and expertise would facilitate the performance of advanced cyber assessments in support of the larger Mission Assurance Program in addition to all related supporting activity. Supporting activity includes the (1) providing all components and software which comprise the Advance Cyber Security Threat Detection and Analysis Platform; (2) Supporting the management and configuration of the platform; (3) perform testing and evaluation of platform components; (4) Maintain stockpile of all peripheral components; (5) Develop long-term storage solution; and (6) provide documentation and develop technical training.

The Contractor shall provide adequate personnel with the requisite skills and certifications to perform the requirements outlined in this PWS.

3.1. On Demand HARDWARE service and IT support

As part of NE-MA commitment to maintaining a cutting-edge cyber security threat detection and analysis platform, we are seeking a tailored-On Demand Hardware support and IT service model solution. This solution is essential for the lifecycle replacement and capability expansion of our system, consisting of (10) Sealing Technology Mobile Analytic Tool Suites, AI/ ML enhanced deep analytic system, and long-term data storage capability.

The Contractor shall provide a comprehensive on demand hardware and IT service support with managing this system that will allow for deployment at the Unclassified, Secret, and Top-Secret classification level and includes the following components:

· Custom Hardware Systems: Tailored configurations that meet the specific requirements of advanced threat detection and deep analysis platform.

· AI/ML Processing Units: Optimized for complex data analysis and real-time threat identification.

· Data Storage Solutions: Capable of handling long-term data retention with high durability and accessibility.

· Lifecycle Management: Continuous updates and replacements as part of the service to ensure optimal performance and security.

3.1.1. Service Level Agreements (SLAs):

The Contractor shall adhere to the following SLAs:

· Response Time: The Contractor shall respond to any request of service or support within 1 hour of the initial request.

· Resolution Time: The Contractor shall respond with initial resolution within 24 hours of the request.

· Availability: The Contractor shall ensure maximum availability of all equipment, ensuring minimum disruption to mission.

· Components: All hardware which includes individual components, components used to comprise a system(s), or peripheral devices will be manufactured in a TAA compliant county of origin.

· All components, hardware, and support will be maintained and stored in DoD approved secure facility and maintained by Top Secret SCI cleared personnel.

Component Destruction: The Contractor shall perform hardware and software lifecycle management and component destruction in accordance with DoDI on DLA Disposition Services and Agency’s security policies.

3.2. CONFIGURATION MANAGEMENT

The Contractor shall provide configuration management to ensure the integrity, consistency, and reliability of our advanced cyber security threat detection and analysis platform. It encompasses the processes, tools, and policies required to effectively manage changes to the hardware, software, and documentation through the lifecycle.

Configuration management applies to all components of the platform, including hardware, software, firmware, documentation, and any associated dependencies. It encompasses version control, change management, release management, and configuration baselines to facilitate efficient and effective development, deployment, and maintenance activities.

3.3. TEST AND EVALUATION (T&E)

The Contractor shall provide T&E of integrated technologies and software to ensure functionality, reliability, and performance of our advanced cyber security threat detection and analysis platform. This section outlines the comprehensive approach to T&E that encompasses all aspects of integrated Artificial Intelligence/Machine Learning (AI/ML), Large Language Model (LLM), and other software and hardware components.

3.3.1. Test Planning

The Contractor shall provide test planning support to include defining the objective, scope, and methodology for evaluating the integrated technologies and software. This includes identifying test scenarios, defining success criteria, and establishing testing environments that closely mimic production conditions.

3.3.2. Functionality Testing

The Contractor shall provide functionality testing to validate the functionality of individual components as well as their interactions within the integrated system. This includes testing user interfaces, Application Programming Interface (API) endpoints, data processing pipelines and other critical functionalities to ensure they meet specified requirements and standards.

3.3.3. Integration Testing

The Contractor shall provide integration testing to verify the seamless interaction and interoperability of different software components within the integrated system. This includes testing end-to-end workflows, data flow between subsystems, and consistency of outputs across various integrated points.

3.3.4. Performance Testing

The Contractor shall conduct performance testing to evaluate the responsiveness, scalability, and stability of the integrated system under various workloads and conditions. This includes load testing, stress testing, and scalability testing to identify performance bottlenecks, resource utilization patterns and scalability limits.

3.3.5. Security Testing

The Contractor shall conduct security testing to assess the resilience of the integrated system against potential cyber threats and vulnerabilities. This includes penetration testing, vulnerability scanning, and security code reviews to identify and mitigate security risks such as unauthorized access and data breaches.

3.3.6. Usability Testing

The Contractor shall conduct usability testing to evaluate the user experience and accessibility of the integrated system to ensure it meets the needs and expectations of its intended users. This involves conducting user feedback sessions, heuristic evaluations, and usability studies to identify usability issues and make iterative improvements to the user interface and interaction design.

3.3.7. Regression Testing

The Contractor shall perform regression testing to ensure that changes and updates to the integrated system do not introduce new defects or regressions in existing functionalities. This involves re-running previously executed tests and verifying that all previously implemented features continue to work as expected after each iteration of development and integration.

3.3.8. Validation and Verification

The Contractor shall conduct validation and verification to ensure that the integrated system meets the intended requirements and objectives, while verification shall confirm that it adheres to specified standards and regulations. This will involve comparing actual results against expected outcomes, conducting acceptance testing with NE-MA Cyber Division, and obtaining sign off on the integrated solution.

3.3.9. Documentation and Reporting

The Contractor shall document and report results, findings, and recommendations from the T&E process. This will include test plans, test cases, test results, issue logs, and post -mortem reports that provide insights into the quality and maturity of the integrated system.

3.3.10. Continuous Improvement

The Contractor shall continuously improve the T&E process, enabling iterative enhancements and optimizations based on lessons learned and feedback from testing activities.

3.4. PERIPHERAL COMPONENTS

The Contractor shall maintain strategic stockpile of peripheral components to ensure uninterrupted operations and timely maintenance of our cyber security threat detection and analysis platform. These stockpiles encompass a range of essential components, included but not limited to cables, connectors, power supplies, hard drives, random access memory (RAM), and other peripheral devices.

3.5. SECURITY AND COMPLIANCE

The Contractor shall provide NE-MA IT support in ensuring the implementation and compliance with all relevant security standards and regulations, including but not limited to National Institute of Standards and Technology Risk Management Framework (NIST RMF) Standard, Zero Trust, and 508 Standards. Measures shall be implemented to safeguard sensitive data and prevent unauthorized access.

3.6. DOCUMENTATION AND TRAINING

The Contractor shall provide comprehensive training sessions for NE-MA personnel on the operation, maintenance, and troubleshooting of the Advanced Cyber Security Threat Detection and Analysis Platform hardware and software solution. Additionally, the Contractor shall provide detailed documentation including user manuals, technical specifications, and troubleshooting.

4. PROGRAM MANAGEMENT

The Contractor shall actively manage performance under the contract by coordinating closely with the designated DTRA Contracting Officer’s Representative (COR). The Contractor shall submit monthly progress reports in accordance with CDRL A001. The Contractor shall submit all reports on time and adhere to the instructions specified in each CDRL. At the COR’s request, the Contractor shall review statuses on any open task or assignment and travel reports with the COR.

The Contractor shall also provide logistical coordination and ensure that the assessment teams have the full services, support, and resources necessary under Section 3 to the conduct of assessments.

· All travel must be compliant with the Joint Travel Regulations (JTR) unless otherwise specified by the COR. The Contractor shall follow CDRL A001 for submittal/approval of all proposed and actual travel.

· The Contractor shall coordinate closely with the COR to arrange travel overseas, specifically when contractor personnel are to fall under a Status of Forces Agreement (SOFA) or other host nation agreements and/or when Synchronized Pre-deployment & Operational Tracker (SPOT) requirements are triggered. The Contractor shall comply with all requirements of the SPOT clauses included in the contract in a timely manner.

· The contractor personnel shall comply with all DTRA mandatory travel reporting policies.

The Contractor shall also manage all contractor-acquired property (CAP) and Government furnished property (GFP). Contractor personnel performing work under this contract on-site will be provided a government workspace, a laptop, computer peripherals, Common Access Cards (CACs), DTRA e-mail accounts, access to Government file servers while off-site, and office supplies. However:

· The contractor personnel shall not use Government furnished equipment (GFE) for personal use. GFE may only be used by the Contractor for the execution of the tasks specified in this contract.

· The Contractor shall submit requests for replacement of GFE to the COR for processing. Any lost or stolen GFE requires verbal report immediately following an incident and followed-up with a written response within 24 hours of incident to the COR. In instances were found negligible, the Contractor can assume financial liability for lost, stolen, or damaged GFE.

· The Contractor shall submit an Equipment Procurement Plan (EPP) in accordance with CDRL A002, and the COR shall approve procurements of all items prior to the execution of any purchase totaling more than $5,000 under this contract.

· The Contractor shall submit a GFP Inventory and Forecasting Report in accordance with CDRL A003 and the contract clauses.

Any accommodations not identified in this section are the responsibility of the Contractor for their personnel and shall be coordinated through the COR.

Upon receipt of the Government’s written notification, the Contractor shall provide a detailed inventory of all equipment subject to the buyout clause, including serial number, description, and current condition assessments. The purchase price shall be mutually agreed upon by both parties, taking into consideration any maintenance or refurbishment cost required to restore the equipment to satisfactory condition.

The Contractor shall transfer all Government owned equipment to the Government, including all associated documentation, warranties, and licenses at the expiration of the contract.

4.1. PLACE OF PERFORMANCE

The Contractor is responsible for providing services to DTRA from the contractor’s facility, the Fort Belvoir, VA location, or other locations, as required. On Federal holidays or when the Office of Personnel Management or DTRA close for business due to local or national emergencies, administrative closings, or similar Government directed closings, the Contractor is not expected to provide services unless mission requires performance. The Contractor may conduct business offsite if necessary or directed by the DTRA COR. The Contractor and all contractor personnel accessing DTRA facilities must adhere to all building access requirements. The Contractor must always maintain an adequate workforce for the uninterrupted performance of all tasks identified within this PWS when the Government facility is not closed for one of the above reasons.

4.2. RECRUITMENT, RETENTION, AND REPLACEMENT PLAN

The Contractor shall notify the COR as soon as practicable of any departures or reassignments of personnel away from the performance of the tasks arising under this contract. The Contractor shall propose a substitution as soon as practicable. As soon as a substitution is identified, the Contractor shall submit a completed DTRA Form 3 and SCI Nomination Letter to the COR for processing to ensure the contractor employee meets all DTRA security and access requirements.

When hiring employees to perform on this contract, the Contractor shall keep in mind that stability and continuity of the workforce are essential. The Contractor shall establish a transition plan for its personnel to ensure a seamless transition between incoming and outgoing contractor personnel. The Contractor shall also maintain a Personnel Recruitment, Retention, and Replacement plan to ensure that it remains agile and ready to meet the DTRA NE-MA mission requirements.

The Contractor shall replace lost personnel with qualified employees within 45 days.

4.3. SECURITY

The Contractor’s employees working on this program must be U.S. citizens and will require a DoD TOP SECRET clearance with an SCI caveat. SCI caveats are sponsored by DTRA and adjudicated by the DoD Consolidated Adjudications Facility (DoD CAF) upon award. A facility clearance must be in place prior to contract award. A Visit Authorization Letter (VAL) must be provided for each contractor employee working on this contract who will require access to any DTRA site. The VALs for collateral security clearance shall be submitted in JPAS, contain the information specified in paragraphs 6-103, 6-104 and 6-105 of the National Industrial Security Program Operating Manual (NISPOM), and be submitted to the DTRA Security Support Branch (Visitor Control). The term of the VAL shall be for the term of the contract. The Contractor shall provide proof of U.S. citizenship for all contracted employees prior to entering the DTRC. The Contractor shall comply with all terms of the DD 254, the NISPOM, the DoD 5220.22-M, NATIONAL INDUSTRIAL SECURITY PROGRAM, and any revisions to that manual. The Contractor shall provide all forms and information, apply for clearances, and be responsible for any expense incurred in obtaining TOP SECRET/SCI security clearances for the contractor employees.

· The Contractor will produce some SECRET and/or TOP SECRET documents and store SECRET and TOP SECRET equipment. The Contactor shall comply with all DoD requirements for marking, handling, storing, and transporting classified documents, working papers, notes, media, equipment, etc. (herein referred to as documents) while in the possession of the Contractor. This includes any document the Contractor may generate in performance of this contract.

· The Contractor shall use sound and proven OPSEC practices, ensuring the safeguard and protection of unclassified/sensitive information at all times, and abides by all DTRA OPSEC policies.

· The Contractor shall adhere to all facility access control policies and procedures. Contractor personnel shall wear security identification badges at all times while in DTRA facilities, as access cards and Identification Cards (IDs) are presented upon request at all entry control points. Lost or stolen IDs or badges requires a verbal report immediately following an incident and followed-up with a written response within 24 hours of incident to the DTRA.

· The Contractor must be responsible for safeguarding all Government property provided for contractor use. At the end of each work period, all Government property, equipment, and materials must be secured.

5. PERFORMANCE REQUIREMENTS SUMMARY

The above-mentioned contractor service requirements specified above are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success. Contractor service requirements, performance metrics, and remediation plans are provided below.

PWS

Section

If Contractor meets or exceeds the performance threshold, it will:

(i) Contribute to a positive Schedule rating in CPARS.

(ii) Increase likelihood of option exercise.

If Contractor does not meet contract performance, remedies at FAR Clause 52.246-4 will be pursued, and/or likelihood of option exercise will be decreased.