Att_1_SOW_Cyber MAC_SB_03112026.pdf

UNCLASSIFIED

STATEMENT OF WORK

FOR

CYBERSPACE SCIENCE, RESEARCH, ENGINEERING AND TECHNOLOGY

INTEGRATION

SMALL BUSINESS MULTIPLE AWARD CONTRACT (MAC)

11 March 2026

1 INTRODUCTION

1.1 BACKGROUND

Cyberspace Operations are the employment of cyberspace capabilities where the primary purpose is to achieve objectives in or through the cyberspace domain. This domain is defined by the Secretary of Defense (SecDef) as "a global domain within the information environment consisting of the interdependent network of information technology infrastructures, including the internet, telecommunications networks, computer systems and embedded processors and controllers." The successful execution of Cyberspace Operations requires the integrated and synchronized employment of offensive, defensive, and Department of Defense Information Network (DODIN) operations, underpinned by effective and timely operational preparation of the Operating Environment. Cyberspace Operations missions encompass Offensive Cyberspace Operations (OCO), Defensive Cyberspace Operations (DCO), and DODIN Operations, based on their intent, not on the specific effects created, or the capabilities used.

OCO are intended to project power by the application of force in and through cyberspace; they include operations to attack automated systems (e.g., Command, Control, Communications, Computers, Intelligence, Surveillance and Reconnaissance (C4ISR)), and the interaction between the physical, social and biological networks that define human-machine interaction. DCO are intended to defend DoD or other friendly cyberspace domains, including network operations that encompass friendly C4ISR and Information Operations (IO) functions that occur within the cyberspace domain. DODIN Operations are actions taken to design, build, configure, secure, operate, maintain, and sustain DoD communications systems and networks in a way that creates and preserves data availability, integrity, and confidentiality, as well as user/entity authentication, authorization, and non-repudiation. DODIN Operations includes cyber security activities, security engineering, and all other activities and actions taken to ensure the integrity of systems, networks, and nodes that enable friendly use of the cyberspace domain. These missions are planned and executed at all levels of military operations, and commanders use Joint Functions concepts to integrate cyberspace capabilities into operational planning and execution, and to synchronize Cyberspace Operations with other operations and effects within the battlespace.

The Naval Information Warfare Center, Pacific (NIWC Pacific), as the principle Navy Research, Development, Test and Evaluation (RDT&E) and Acquisition Center for C4ISR and IO is responsible for functions that include: mission analysis, assessment and development of technology base, basic and applied research, demonstration of technology, engineering in support of production, support to operating forces; supporting doctrine, policy, and strategy development; and integration of numerous National and Tactical systems in the area of Cyberspace Operations.

Increasingly, NIWC Pacific, DoD and other Government customers require advice, assistance, coordination and products necessary to support operational planning, assessment, integration, execution and technology development to assure superiority for the warfighter in the cyberspace domain. Specific activities of interest required to achieve superiority in cyberspace include, but are not limited to:

- Cyberspace Operations (e.g., Offensive, Defensive, DoD Information Network, and ISR, Operational Preparation of the Environment (OPE), and other supporting functions) as they relate to the interdependent network of information technology infrastructures, including the internet, telecommunications networks, computer systems and embedded processors and controllers.

- Configuration Management (CM) - Establishing processes to manage system baselines, track changes, and ensure version control. This guarantees consistency, integrity, and traceability of cyberspace tools, configurations, and infrastructure across their lifecycle.

- Offensive Cyberspace Operations (OCO) against automated systems, and the interaction between the physical, social and biological networks that define human-machine interaction.

- Defensive Cyberspace Operations (DCO), includes both active and passive cyberspace defense operations, and utilizes cybersecurity, Security Engineering, and computer network defense measures to protect and defend friendly Naval, Joint and National systems.

- Department of Defense Information Network (DODIN) Operations, including cybersecurity planning, Security and Network Engineering, and Risk Management Framework (RMF) to provide friendly forces with survivable defended communications and networks to support military operations.

- DevSecOps - The Implementation of secure development practices that integrate cybersecurity into all phases of the software development lifecycle. This ensures that software, tools, and systems maintain continuous security posture and resilience against evolving cyber threats during development, deployment, and operations. Cyberspace Intelligence, Surveillance and Reconnaissance (ISR) conducted in support of OCO, DCO and DODIN, and Space Operations mission planning and execution.

- Cyberspace Operational Preparation of the Environment (OPE) conducted in support of OCO, DCO, and DODIN, and Space Operations mission planning and execution.

- Offensive Tool Development - Creation and refinement of offensive cyberspace capabilities to exploit adversary systems, enhance strategic options, and maintain superiority in the cyberspace domain.

- Cyber Deception for Defense - Utilization of deception techniques for cyber defense, including detection and mitigation through Machine Learning and AI, applied to both physical hardware and software environments to confuse and mislead adversaries while enhancing detection capabilities.

- Cyberspace Operations Mission Assurance and Mission Planning.

- Cyberspace Situational Awareness (CSSA) and Understanding of the Operational Environment

(OE).

- Understanding aspects of human behavior and cognitive functions to influence adversary decision making (e.g., Military Information Support Operations (MISO), and Military Deception

(MILDEC)).

- Electronic Warfare (EW) to include Electronic Attack (EA) Electronic Support (ES) and Electronic Protect (EP) in the Radio Frequency (RF), millimeter wave, and optical environments.

- Electromagnetic Maneuver Warfare (EMW) – the area of EMW is closely related to Cyberspace Operations since cyber quite often flows through the electromagnetic spectrum (EMS) and in some instances can impact the ability of U.S., Allied and Coalition use of it. EMW is defined by OPNAV N2/N6 as, “Navy’s initiative to understand all activity in the spectrum, control our signature, and command the EMS as critical maneuver space. It includes all actions that create combat advantage in and through the EMS by disrupting the adversary’s kill chain while optimizing our own.” As such, EMW will be critical to warfighting in cyberspace.

- Monitoring, analyzing and mitigating Operations Security (OPSEC) vulnerabilities.

- The Joint Functions as they relate to Cyberspace Operations, including:

o Command and Control (C2) o Intelligence o Fires/Integrated Fires o Movement and Maneuver o Sustainment o Protection

- Protecting, storing, disseminating and managing information in the realm of cyberspace.

- Test and Evaluation (T&E) - Conducting structured testing processes to validate the performance, effectiveness, and security of cyberspace capabilities under simulated and operational conditions.

This includes evaluating systems for compliance with mission objectives and readiness for deployment.

- Ubiquitous Communications and Computing Environment.

- Countermeasures including the capabilities and expertise to develop source identification tools, data management, and methodologies for object correlation and referencing.

- Analytical processing of data, including Machine Learning (ML) techniques, that enable an essential Cyberspace Operations function or capability through features like predictive analysis or automation.

- Modeling, Simulation and Visualization of the future environment in which communications, computing, data, sensors and networks are interoperable, ubiquitous and transparent to humans.

- Understanding networks as a science and developing models which can provide clarity into how networks operate and resist or deter attack.

- Convergence of physical, biological and social networks and how this will affect human interactions and decision cycles.

- Understanding of Joint and Naval Cyberspace Operations Doctrine, and Tactics, Techniques and Procedures (TTP).

- Understanding Cyberspace Operations training objectives and sustainment strategy.

- Understanding Cyberspace Operations capabilities to include cryptology, cryptography, signals intelligence and analysis, and cybersecurity.

- Verification and Validation (V&V) - Ensuring systems, tools, and processes meet design specifications and function as intended. This involves independent verification to confirm requirements are met and validation under real-world scenarios to ensure operational effectiveness. The work to be conducted under this contract will support NIWC Pacific in creating capabilities and providing technical services to support technical and operational activities in the cyberspace domain by the Navy, DoD and other Government agencies.

1.2 SCOPE

The scope of this contract will include efforts to examine the architecture, engineering, functionality, interface and interoperability of Cyberspace Operations systems, services and capabilities at the tactical, operational and strategic levels, to include all enabling technologies. This will include operational exercise design and construction, operations and requirements analysis, concept formulation and development, feasibility demonstrations and operational and technical support. This will include efforts to analyze and engineer operational, functional and system requirements in order to establish national, theater and force level architecture. Further, these requirements will drive engineering plans, interface and systems specifications and definitions, and implementation, including hardware acquisition for turnkey systems. Additional efforts will include requirements verification and validation, engineering analysis, technical documentation, software and hardware design and implementation as well as systems integration, test and evaluation and demonstration, applying a systems engineering approach to development while ensuring secure development practices through DevSecOps methodologies.

Research and development in advanced technology and special technical operations requires periodic Contractor augmentation of a technical or scientific nature to meet technical as well as operational commitments and/or requirements. Contractor support is also required to supplement or provide personnel with specific expertise that is limited or not available at NIWC Pacific. Areas of expertise that may be required include, but are not limited to: Cyberspace Operations doctrine/tactics, techniques and procedures (TTP); policy and strategy; operational planning, analysis and intelligence assessment;

measures of effectiveness (MOE) and measures of performance (MOP) development and evaluation;

electronic warfare; quantum computing; machine learning & artificial intelligence (AI); wargaming, modeling and simulation; systems engineering, systems analysis; computer hardware and software engineering and development, implementation and integration; operational research and analysis;

communications and networking hardware; protocols; and security; and Configuration Management (CM) to ensure system baselines, version control, and traceability throughout the lifecycle.

The work described below is representative of the type of requirements that currently exist or can reasonably be anticipated. Because of the variety of tasks that may be required, specific work efforts will be initiated by means of delivery/task orders which will be issued in accordance with the provisions of this Statement of Work (SOW) and other provisions of the contract.

- Perform basic and applied research in Cyberspace Operations, its enabling technologies, techniques, and theory.

- Design and develop network, system, services and application architectures that support the rapid development and implementation of new technologies and capabilities that reflect the rapidly evolving techniques that characterize cyber attacks. Ensure secure development practices are integrated throughout the lifecycle using DevSecOps principles and more.

- Analyze, design, develop, document, integrate, test, install and maintain Cyberspace Operations enabling capabilities, ensuring comprehensive Test and Evaluation (T&E) processes validate performance, security, and compliance under simulated and operational conditions.

- Develop, implement, and integrate solution sets that enable a holistic command and control capability, with appropriate underpinning technologies and capabilities that provide for interagency communication and collaboration of cyber activities, and that appropriately support execution in an integrated joint fires framework.

- Serve as the test site (via the NIWC Pacific labs and other Government facilities) for interoperability testing among Cyberspace Operations systems, tools, technologies and processes (both existing and new) prior to their introduction into operational environments.

- Serve as Integration, Validation, and Verification (IV&V) site for DoD certification of cyber tools, systems, and capabilities, ensuring processes confirm systems meet design requirements and demonstrate effectiveness in real-world operational scenarios.

- Participate in cyber technology forums.

- Provide operational support to assist in technical and programmatic oversight of Cyberspace

Operations enabling systems, programs and functions.

- Provide Systems Engineering and Integration support to improve overall effectiveness of

Cyberspace Operations enabling systems, services and functions, while incorporating robust Configuration Management (CM) practices to maintain integrity, consistency, and traceability across system lifecycle phases.

- Demonstrate and evaluate the application of advanced software and hardware concepts and technology to Cyberspace Operations enabling systems and functions.

- Associate information posted in cyberspace to a physical identity and originating location.

- Conduct analyses and systems engineering to develop initiatives in support of emerging

Cyberspace Operations requirements.

- Develop capabilities to detect and identify complex, multi-dimensional attacks on an adversary, including precursor activities, and to be able to correlate disparate events with their greater implications to the warfighter.

- Provide computer and network forensic capabilities.

- Perform analysis, algorithm development and implementation, and display for Cyberspace

Operations tools and data fusion drawn from various sources of information.

- Provide support for Cyberspace Operations experiments, exercises, and other events.

- Ensure cybersecurity Test and Evaluations (T&E) are conducted throughout the acquisition life cycle, integrated with interoperability and other functional testing,

- Ensure a cybersecurity representative participates in planning, execution and reporting of integrated T&E activities.

- Perform analysis of adversarial cyber threat capabilities to develop courses-of-action and response options under a variety of hypothetical scenarios.

- Conduct Cyberspace Operations Modeling and Simulation, wargaming and analysis.

- Perform risk assessment and mitigation planning.

1.3 REFERENCE DOCUMENTS

The following documents were used in the development of this SOW and may be invoked for individual delivery/task orders:

a. Cyberspace Policy Review, May 2009

b. U.S. Cyber Operations Policy, Presidential Policy Directive-20 (PDD-20, 2010)

c. Improving Critical Infrastructure Cybersecurity (Executive Order), 12 Feb 2013

d. International Strategy for Cyberspace, May 2011

e. Comprehensive National Cybersecurity Initiative, 2008

f. The National Security Strategy, October 2022

g. Department of Defense Strategy for Operations in Cyberspace, May 2023

h. Director of Central Intelligence Directive 7/3 Information Operations and Intelligence Community

Related Activities (U)

i. DODD O-8530.1 Computer Network Defense (CND), 2001

j. DODI O-8530.2 Support to Computer Network Defense (CND), 9 March, 2001

k. DoD Directive O-3600.3, Technical Assurance Standard for Computer Network Attack (CNA)

Capabilities, 13 May 2005

l. DoD Instruction O-3600.03, Technical Assurance Standard for Computer Network Attack (CNA)

Capabilities, Change 1, 19 Nov 2010

m. CJCSM 6510.01B (Series) Cyber Incident Handling Program, 18 Dec 2014

n. Joint Doctrine for Cyberspace Operations, Joint Pub 3-12, 8 June 2018

o. Joint Doctrine for Information Operations, Joint Pub 3-13, 27 Nov 2012

p. Naval Warfare Publication 3-12, Cyberspace Operations

q. Naval Warfare Publication 3-13, Navy Information Operations, Feb 2014

r. Naval Warfare Pub 3-63 CNO Vol 1 and 2

s. NTTP 3.13.x series on Navy IO

t. SECNAVINST 5239.19 (Series), DON Computer Network Incident Response/Reporting, 4 Sept,

u. SECNAVINST 5000.2 (Series), DoN Implementation of the Defense Acquisition System and the

Adaptive Acquisition Framework, 8 Apr 2022

v. NAVSEA Instruction 3900.8A, Human Systems Integration (HSI) Policy in Acquisition and

Modernization, 20 May 2005

w. Joint Force Component Commander-Network Warfare (JFCC-NW) Document, Computer

Network Attack Technical Assurance, 2009

x. JFCC-NW Document, Technical Assurance Evaluation Standards for Evaluated Level of

Assurance I, II, III, and IV, 2009

y. National Institute of Standards and Technology (NIST) Publications

z. NIWC Pacific Organizational Set of Standard Processes (OSSP)

aa. DoDI O-2000.16 Volume 1, DoD Antiterrorism Program Implementation: DoD Antiterrorism

Standards,17 November 2016, Ch-3 7 May 2021

bb. Part 117 of Title 32, Code of Federal Regulations, National Industrial Security Program Operating Manual (NISPOM), 21 December 2020

cc. National Security Decision Directive 298 (Series), National Operations Security Program (NSDD)

298, 22 January 1988

dd. DODM 5205.02, DOD Operations Security (OPSEC) Program, Change 2, 29 October 2020

ee. OPNAVINST 3432.1 (Series), DON Operations Security, 4 August 2011

ff. SPAWARINST 3432.1 (Series), Operations Security Policy, 2 February 2005

gg. DoD 5015.21-M Volume I, Ch-2, Sensitive Compartmented Information (SCI) Administrative

Security Manual: Administration of Information and Information Systems Security, 6 Oct 2020

hh. DoD 5105.21-M Volume II, Ch-2, Sensitive Compartmented Information (SCI) Administrative

Security Manual: Administration of Information and Information Systems Security, 2 Nov 2020

ii. DoD 5105.21-M Volume III, Ch-2, Sensitive Compartmented Information (SCI) Administrative

Security Manual: Administration of Information and Information Systems Security, 14 Sep 2020

jj. DODM 5200.01, Volume 1, DoD Information Security Program: Overview, Classification, And

Declassification, dated February 24, 2012, Change 3 17 January 2025 28 July 2020

kk. DODM 5200.01, Volume 2, DoD Information Security Program: Marking Of Information, dated

February 24, 2012, Change 4 28 July 2020

ll. DODM 5200.01, Volume 3, DoD Information Security Program: Protection Of Classified

Information, dated February 24, 2012, Change 4 17 January 2025

mm. Replaced by DoDI 5200.48 Controlled Unclassified Information (CUI) 6 March 2020

nn. DoDI 5200.02, DoD Personnel Security Program (PSP), Change 3, 24 Sept 2020

oo. DoD M-5200.02 – Procedures for the DoD Personnel Security Program (PSP), Change 1, 29

October 2020

pp. DoDD 5205.02E, DoD Operations Security (OPSEC) Program, 20 June 2012, Ch-2 20 August

qq. DoDI 5220.31, National Industrial Security Program (NISP), 9 May 2023

rr. DoDM 5220.32, Volume 1, National Industrial Security Program: Industrial Security Procedures for Government Activities, 1 August 2018, Ch-2 10 December 2021

ss. DoDM 5220.32, Volume 2, National Industrial Security Program: Procedures For Government

Activities Relating To Foreign Ownership, Control, Or Influence (FOCI), 17 April 2014, Ch-2 10 December 2021

tt. DoDI 6205.4, Immunization of Other Than U.S. Forces (OTUSF) for Biological Warfare Defense, 14 April 2000

uu. DoDI 8500.01, Cybersecurity, 27 September 2018

vv. DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), 19

July 2022

ww. DoDM 8140.03 Cyberspace Workforce Qualification and Management Program, 15 February

xx. DoDD 8140.01, Cyberspace Workforce Management, 5 October 2020

yy. SECNAV M-5239.2, DON Information Assurance Workforce Management Manual, June 2016

zz. SECNAVI 5510.30, DON Regulation – Personnel Security Program, 24 Jan 2020 aaa. SECNAVINST 5510.36B, DON Information Security Program, 12 July 2019 bbb. SECNAVINST 4440.34, Secretary of the Navy Instruction – Implementation of Item Unique

Identification within the DoN, 22 December 2009 ccc. SECNAVINST 5239.20A, DON Cybersecurity Policy, 2 May 2016 ddd. SECNAVINST 5239.3C, DON Cybersecurity Policy, 2 May 2016 eee. NIWCPACINST 5500.1D Security Manual, 15 Aug 2023 fff. SPAWARINST 4440.12, Management of Operating Materials and Supplies (OM&S), Government Furnished Property (GFP), Contractor Acquired Property (CAP), Property, Plant and Equipment (PP&E), and Inventory, 11 Apr 2016 ggg. SPAWARINST 5721.1B, SPAWAR Section 508 Implementation Policy, 17 November 2009 hhh. COMUSFLTFORCOM/COMPACFLTINST 6320.3A, Commander US Fleet Forces Command/Commander US Pacific Fleet Instruction, Medical Screening For US Govt Civilian Employees, Contractor Personnel, and Guests prior to embarking Fleet Units, 7 APR 2014

iii. Navy Telecommunications Directive (NTD 10-11), System Authorization Access Request

(SAAR) – Navy jjj. DoD Cybersecurity Test and Evaluation Guidebook, Version 2, Change 1, 6 Feb 2020

2 TECHNICAL REQUIREMENTS

The Contractor shall be required to provide a wide range of expertise supporting full spectrum Cyberspace Operations and enabling activities.

2.1 GENERAL

The Contractor shall provide technical and management services to support NIWC Pacific in establishing and maintaining Cyberspace Operations and enabling product lines, programs and projects. The Contractor shall engage in identifying and developing core technical and functional services in support of full spectrum Cyberspace Operations and enabling capabilities. The Contractor shall provide technical and management services that enable rapid, secure and continuous development of new capabilities using DevSecOps methodologies to conduct Offensive, Defensive, and DODIN Operations and missions on friendly, adversary, and potential adversary networks, systems and services in response to emerging requirements. The contractor shall develop and deploy holistic systems and tool sets for developing, maintaining, and disseminating comprehensive Cyber Situational/Battlespace Awareness (CS/BA) across the range of military operations and provide Command and Control (C2) of Cyberspace Operations at all levels of war, across all components of the joint services and allied and partner nations. The Contractor shall support the development of tools and processes for developing, maintaining, and increasing Understanding of the Cyberspace Operational Environment. The Contractor shall investigate and research improved techniques and solutions meeting the requirements documents or specifications IAW applicable documents.

2.2 TECHNOLOGY ASSESSMENT, DEVELOPMENT AND TRANSITION

Reserved.

2.2.1 INNOVATIVE TECHNOLOGY ASSESSMENT AND DEVELOPMENT

The Contractor shall identify and perform research, analysis, analysis of alternatives (AoA), evaluation, development and test of technologies from industry, academia, and other government organizations, including Commercial Off-The-Shelf (COTS), Government Off-The-Shelf (GOTS), and open source technologies, and AI/ML-based solutions for applicability to solving Cyberspace Operations deficiencies, addressing evolving threats, improving existing Cyberspace Operations and enabling capabilities, and generating new capabilities.

The Contractor shall identify and analyze innovative technology applicable to problems and opportunities related to Offensive and Defensive Cyberspace Operations (OCO/DCO); Cybersecurity; Cyberspace Operational Assessment (OA), and Cyber Intelligence, Surveillance, and Reconnaissance (ISR).

In order to properly identify and analyze innovative technology for these listed areas, support will be required from the unclassified to the TS/SCI level as directed by relevant SCGs and Original Classification Authorities. Designated TS/SCI support will be required to obtain and maintain SCI clearances and Joint Worldwide Intelligence Communications System (JWICS) and potentially National Security Agency network (NSAnet) and National Geospatial Agency network (NGAnet) accounts to support meetings, access to spaces, reviews, communications, actions and datacalls at the SCI level.

2.3 REQUIREMENTS ANALYSIS

Reserved.

2.4 SYSTEMS ENGINEERING

The Contractor shall perform system analysis, architecture, engineering, and integration services at the system, intra/inter-node, force, theater and national levels. The Contractor shall perform analyses of current Cyberspace Operations and enabling capabilities and deficiencies, identify and derive system and sub-system requirements and associated architectures and perform all aspects of systems engineering support required to implement the full spectrum of Cyberspace Operations capabilities and systems. The Contractor shall perform and report technical trade studies which shall lead to the development of new Cyberspace Operations architectures and detailed engineering designs. The Contractor shall utilize a Systems Engineering approach. The contractor shall conduct assessments on proposed solution architectures, proposed designs, and strategic roadmaps and provide recommendations for improvement.

In order to perform systems engineering, support will be required from the unclassified to the TS/SCI level as directed by relevant SCGs and Original Classification Authorities. Designated TS/SCI support will be required to obtain and maintain SCI clearances and Joint Worldwide Intelligence Communications System (JWICS) and potentially National Security Agency network (NSAnet) and National Geospatial Agency network (NGAnet) accounts to support meetings, access to spaces, reviews, communications, actions and datacalls at the SCI level.

2.5 OPERATIONAL AND TECHNICAL SUPPORT

2.5.1 OPERATIONAL SUPPORT

The Contractor shall provide on and off-site operational support to NIWC Pacific Cyberspace Operations and enabling efforts by reviewing and analyzing national security policy and military strategy, including defense transformation and planning guidance, intelligence estimates, threat projections, and other relevant material and activities. The Contractor shall support the production and implementation of concepts of operations, standard operating procedures, rules of engagement, pre-planned responses, and supporting Annexes/Tabs to Combatant Commanders', Joint Force/Service/Functional Component Commanders', and Joint Task Force (JTF) Commanders’ Operational and Contingency Plans (OPLAN/CONPLAN). This support shall include preparation for, and presentation of technical briefs.

The Contractor shall participate in cyber-focused forums, boards, conferences, seminars, exercises, and planning sessions.

Operational support will be required from the unclassified to the TS/SCI level as directed by relevant SCGs and Original Classification Authorities. Designated TS/SCI support will be required to obtain and maintain SCI clearances and Joint Worldwide Intelligence Communications System (JWICS) and potentially National Security Agency network (NSAnet) and National Geospatial Agency network (NGAnet) accounts to support meetings, access to spaces, reviews, analysis, communications, actions and datacalls at the SCI level.

2.5.2 TECHNICAL SUPPORT

Reserved.

2.5.3 SYSTEM TECHNICAL SUPPORT

Reserved.

2.6 EXERCISE AND EXPERIMENTATION SUPPORT

Reserved.

2.6.1 SPECIAL EXERCISE SUPPORT

The Contractor shall participate in Exercises (including war gaming) to support the development and assessment of Cyberspace Operations and enabling capabilities and their utility, to identify new tactics, techniques and procedures for Cyberspace Operations. These requirements include:

a) Develop simulation capabilities and/or models for validation of functional operation of Cyberspace Operations and enabling capabilities or activities.

b) Participate in exercise and experiments, observe systems or activity and collect data.

c) Analyze exercise and experiment data and provide assessments on the results to enable new cyberspace operations capabilities.

Special Exercise support will be required from the unclassified to the TS/SCI level as directed by relevant SCGs and Original Classification Authorities. Designated TS/SCI support will be required to obtain and maintain SCI clearances and Joint Worldwide Intelligence Communications System (JWICS) and potentially National Security Agency network (NSAnet) and National Geospatial Agency network (NGAnet) accounts to support access to spaces, meetings, reviews, analysis, communications, actions and datacalls at the SCI level.

2.7 SOFTWARE DEVELOPMENT AND PROTOTYPING

The Contractor shall specify, design, develop, code, test, integrate and document software modules, systems and subsystems to provide new functional capabilities and improve existing Cyberspace Operations and enabling systems. The Contractor shall perform reverse engineering of software components and systems to support vulnerability and exploitation analysis. The functions to be implemented include the full spectrum of Cyberspace Operations. The Contractor shall adhere to open standards and modern software development methodologies, including what is considered ‘best’ practices by the industry. The Contractor shall support compliance testing for software system components.

Software Development and Prototyping support will be required from the unclassified to the TS/SCI level as directed by relevant SCGs and Original Classification Authorities. Designated TS/SCI support will be required to obtain and maintain SCI clearances and Joint Worldwide Intelligence Communications System (JWICS) and potentially National Security Agency network (NSAnet) and National Geospatial Agency network (NGAnet) accounts to support access to spaces, meetings, reviews, analysis, communications, actions and datacalls at the SCI level.

2.8 HARDWARE DEVELOPMENT AND PROTOTYPING

Reserved.

2.9 MODELING AND SIMULATION

Reserved.

2.10 TRAINING SUPPORT

Reserved.

2.10.1 ENABLING CAPABILITY TRAINING SUPPORT

The Contractor shall plan, develop, and implement Cyberspace Operations training plans and courses that enable offensive and defensive capabilities for Cyberspace Operations. The Contractor shall provide informal training at designated locations. Training support includes, but is not limited to:

a. On the job training (OJT);

b. Informal training conducted in conjunction with technical support, exercises, and operations;

c. Development of computer based training (CBT) material;

d. Development of formal training materials and curricula;

e. Development of system specific training.

Enabling Capability Training support will be required from the unclassified to the TS/SCI level as directed by relevant SCGs and Original Classification Authorities. Designated TS/SCI support will be required to obtain and maintain SCI clearances and Joint Worldwide Intelligence Communications System (JWICS) and potentially National Security Agency network (NSAnet) and National Geospatial Agency network (NGAnet) accounts to support access to spaces, meetings, reviews, analysis, communications, actions and datacalls at the SCI level.

2.11 SECURITY ENGINEERING/CYBERSECURITY

2.11.1 FULL SPECTRUM SECURITY ENGINEERING SUPPORT

Reserved.

2.11.2 SECURITY ENGINEERING SUPPORT AND RAPID PROTOTYPING

The Contractor shall provide security engineering services for development and rapid prototyping of Cybersecurity systems, including but not limited to, firewalls, virtual private network devices, intrusion detection/prevention systems, biometrics technologies, wireless technologies, and network vulnerability scanning and remediation technologies. The Contractor shall support correction of vulnerabilities in the absence of source code. The Contractor shall support development of predictive cyber attack technologies to enable Active Defensive Cyberspace Operations.

Security Engineering and Rapid Prototyping support will be required from the unclassified to the TS/SCI level as directed by relevant SCGs and Original Classification Authorities. Designated TS/SCI support will be required to obtain and maintain SCI clearances and Joint Worldwide Intelligence Communications System (JWICS) and potentially National Security Agency network (NSAnet) and National Geospatial Agency network (NGAnet) accounts to support access to spaces, meetings, reviews, analysis, communications, actions and datacalls at the SCI level.

2.11.3 CYBERSECURITY RISK MANAGEMENT

The Contractor shall support Government execution of the US Department of Defense Information Assurance Certification and Accreditation Process (DIACAP)/Risk Management Framework (RMF) transformation. The Contractor shall support security tests and evaluations and provide a comprehensive risk assessment as part of their individual delivery/task order fulfillment. The Contractor shall support the certification and accreditation (C&A) of programs using DIACAP/RMF, Secret and Below Interoperability (SABI), and Director of Central Intelligence Directive (DCID) 6/3 processes. The Contractor shall also perform analysis related to the development of security test plans, procedures, reports, and assessments.

Most cybersecurity efforts will be at the Secret level or below, but some components will require SCI review and / or accreditation. Contractors supporting programs with SCI components will be required to obtain and maintain active SCI clearance, JWICS and potentially National Security Agency network (NSAnet) and National Geospatial Agency network (NGAnet) accounts to attend technical meetings, review classified design material, and manage SCI RMF packages and cybersecurity actions.

2.11.4 INFORMATION TECHNOLOGY SYSTEMS SUPPORT

The Contractor shall provide Information Technology Systems Support to NIWC Pacific for Department of Defense classified and unclassified networks, including System Administration; Cybersecurity compliance; network monitoring and intrusion detection and prevention; system security vulnerability assessment and correction; and asset risk assessment.

Information Technology Systems support will be required from the unclassified to the TS/SCI level as directed by relevant SCGs and Original Classification Authorities. Designated TS/SCI support will be required to obtain and maintain SCI clearances and Joint Worldwide Intelligence Communications System (JWICS) and potentially National Security Agency network (NSAnet) and National Geospatial Agency network (NGAnet) accounts to support access to spaces, meetings, reviews, analysis, communications, actions and datacalls at the SCI level.

3 SOFTWARE ENGINEERING APPROACH

The contractor shall define a software development approach appropriate for the computer software effort to be performed under this contract. This approach shall be documented in a Software Development Plan (SDP) (see DID No. DI-IPSC-81427B for required format and content). Once defined, the contractor shall follow this SDP for all computer software to be developed or maintained under this contract.

The SDP shall define the contractor’s proposed life cycle model and the processes used as a part of that model. In this context, the term “life cycle model” is as defined in IEEE/EIA Std. 12207.0. The SDP shall describe the overall life cycle and shall include primary, supporting, and organizational processes based on the work content of this contract. In accordance with the framework defined in IEEE/EIA Std.

12207.0, the SDP shall define the processes, the activities to be performed as a part of the processes, the tasks which support the activities, and the techniques and tools to be used to perform the tasks. Because IEEE/EIA Std. 12207 does not prescribe how to accomplish the task, the contractor must provide this detailed information so the Government can assess whether the contractor’s approach is viable.

The SDP shall contain the information defined by IEEE/EIA Std. 12207.1, section 5.2.1 (generic content) and the Plans or Procedures in Table 1 of IEEE/EIA Std. 12207.1. In all cases, the level of detail shall be sufficient to define all software development processes, activities, and tasks to be conducted. Information provided must include, as a minimum, specific standard, methods, tools, action, strategies, and responsibilities associated with development and qualification.

The contractor’s software engineering approach shall afford opportunities for input and oversight by the Government.

4 GOVERNMENT FURNISHED INFORMATION/MATERIAL/PROPERTY

To be determined at the order level.

5 TRAVEL

To be determined at the order level.

6 REPORTS, DATA AND DELIVERABLES

Reports, technical data, and computer software delivery requirements shall be specified through use of a Contract Data Requirements List, DD Form 1423, at the individual delivery/task order level.

The contractor shall provide prototype deliverables as specified in individual task orders.

All classified deliverables shall be protected and handled in accordance with standard security practices and procedures.

7 SECURITY

The work performed by the Contractor will include access to unclassified and up to Top Secret/incidental Sensitive Compartmented Information (SCI) data, information, and spaces. The contractor will be required to provide individuals with security clearances at the appropriate classification levels, as specified in individual task orders. The Contractor will be required to attend meetings classified up to Top Secret/SCI. The Contractor will require access to Communications Security (COMSEC), and Secure Internet Protocol Router Network (SIPRNet)/Joint Worldwide Intelligence Communications System (JWICS)/NSAnet/Naval Enterprise Network (ONE-NET).

Although there is no requirement for the contractor to access NATO on this contract per Naval Intelligence Security Policy Directive 17-008 those contractors that have SCI and those with SCI access and will need access to JWIC, NSAnet, ONE-NET and SIPRNet shall be North Atlantic Treaty Organization (NATO) read-on and complete the derivative classification training is provided by the facility security officer. Specific requirements provided in the Department of Defense Contract Security Classification Specification, DD Form 254.

Contractors performing tasks at the TS or below level without SCI access shall only receive the North Atlantic Treaty Organization (NATO) awareness brief and complete the derivative classification training prior to being granted access to SIPRnet. The facility security officer provides training. Specific requirements provided in the Department of Defense Contract Security Classification Specification, DD Form 254.

Contractor personnel assigned to this effort who require access to SCI data and spaces must possess a current SSBI with ICD 704 eligibility (which replaced DCID 6/4 eligibility) and be enrolled in Continuous Vetting.

Personnel requiring privileged access to government information systems must have a favorable Tier 5 background investigation or its equivalent.

Some contractor personnel will perform non-technical, administrative duties at the Unclassified and/or Controlled Unclassified Information (CUI) at the contractor facility and not the government installation.

These contractors may be required to attend unclassified meetings at the government installation, These contractors will not need a Common Access Card (CAC) therefore a fitness determination by NIWC PAC Personnel Security is not required. If base access is required, these contractors will be escorted by technical point of contact or other NIWC PAC government employees.

The National Industrial Security Program Operating Manual (NISPOM) 32 CFR NISPOM Rule 117.8 implements contractor reporting requirements per SEAD 3. Contractors are required to report certain events such as those that have an impact on: 1) the status of the facility clearance (FCL), 2) the status of an employee's personnel clearance (PCL); may indicate the employee poses an insider threat the proper,

3) the proper safeguarding of classified information, and 4) or an indication that classified information has been lost or compromised. Contractors working under NIWC Pacific contracts will ensure information pertaining to assigned contractor personnel are reported to the Contracting Officer Representative (COR)/Technical Point of Contact (TPOC), the Contracting Specialist, and the Security's COR in addition to notifying appropriate agencies such as Cognizant Security Agency (CSA), Cognizant Security Office (CSO), or Defense Counterintelligence & Security Agency Consolidated Adjudication Services (DCSA CAS) when that information relates to the denial, suspension, or revocation of a security clearance of any assigned personnel; any adverse information on an assigned employee's continued suitability for continued access to classified access; any instance of loss or compromise, or suspected loss or compromise, of classified information; actual, probable or possible espionage, sabotage, or subversive information; or any other circumstances of a security nature that would affect the contractor's operation while working under NIWC Pacific contracts.

If foreign travel is required, all outgoing Country/Theater clearance message requests shall be submitted to the Commanding Officer, Attn: Foreign Travel Team, Naval Information Warfare Center Pacific, 53560 Hull Street Building 27, 2nd Floor -Room 206, San Diego, CA 92152 for action. A Request for Foreign Travel form shall be submitted for each traveler, in advance of the travel, to initiate the release of a clearance message at least 30 days in advance of departure. Each Traveler must also submit a Personal Protection Plan and have a Level 1 Antiterrorism/Force Protection briefing within one year of departure and a country specific briefing within 90 days of departure. Anti-Terrorism/Force Protection (AT/FP) briefings are required for all personnel (Military, DOD Civilian, and contractor) when the Commanders have granted access to their installations or separate facilities per DoDI O-2000.16 Volume 1. Contractor employees must receive the AT/FP briefing annually. The briefing is available at Joint Knowledge Online (JKO): https://jkodirect.jten.mil (prefix): JS; course number: US007; title: Level 1 Anti-terrorism awareness training, if experiencing problems accessing this website contact the JKO Help Desk (24 hours a day/7 days a week, js.jko.helpdesk@mail.mil, 757-203-5654). This training can also be found on the Total Workforce Management Services (TWMS) site: https://twms.dc3n.navy.mil/selfservice/. Sere

100.2 Level A code of conduct training is also required prior to Oconus travel for all personnel. Sere

100.2 Level A training can be accessed https://jkodirect.jten.mil/Atlas2/page/desktop/DesktopHome.jsf, recommend course: prefix: J3T: course #: A-US1329, for civilian, military, and contractors. Personnel utilizing the JKO site must have a CAC or contractor shall request a sponsored account to access the training. NOTE: Please email or fax the certificate to Foreign Travel Group (NIWC_PAC_FORTRAV@us.navy.mil). Other specialized training for specific locations may also be required contact the NIWC Pacific foreign travel team at (NIWC_PAC_FORTRAV@us.navy.mil).

Additional information can be found in NIWCPACINST 4650.3B-Ch-1, dtd 20 February 2019. If you have questions about the process contact your NIWC Pacific COR.

Finally, EUCOM has mandated that all personnel going on official travel to the EUCOM AOR must now register with the Smart Traveler Enrollment Program (STEP). When you sign up, you will automatically receive the most current information the State Department compiles about your destination country. You will also receive updates, including Travel Warnings and Travel Alerts. Sign up is one-time only, after you have established your STEP account, you can easily add official or personal travel to anywhere in the world, not just EUCOM. http://travel.state.gov/content/passports/en/go/step.html.

Pursuant to DoDM 5200.01 and DoDI 5200.48, the contractor shall provide adequate security for all Controlled Unclassified Information (CUI) and Unclassified DoD information passing through non- DoD information system including all subcontractor information systems utilized on contract. If the contractor originates, adds to, or changes any of the DoD information, it must be marked in accordance with DODI 5200.48 and handled properly. The contractor shall disseminate CUI and https://jkodirect.jten.mil/ mailto:JS.JKO.HelpDesk@mail.mil https://twms.dc3n.navy.mil/selfservice/ https://jkodirect.jten.mil/Atlas2/page/desktop/DesktopHome.jsf mailto:NIWC_PAC_FORTRAV@us.navy.mil mailto:NIWC_PAC_FORTRAV@us.navy.mil unclassified DoD information within the scope of assigned duties and with a clear expectation that confidentiality is preserved. Examples of such information include the following: non-public information provided to the contractor, information developed during the course of the contract, and privileged contract information (e.g., program schedules, contract-related tracking).

7.1 OPERATIONS SECURITY

OPSEC is a six-step continuous analytical process (identify critical information; analyze the threat;

analyze vulnerabilities; assess risk; apply countermeasures; and periodic assessment of effectiveness). Critical information is any specific facts about friendly intentions, capabilities, and activities needed by adversaries for them to plan and act effectively so as to guarantee failure or unacceptable consequences for friendly mission accomplishment. Critical information does not necessarily mean CI, but includes all CI, CUI, and certain aggregations of information that meet the definition of critical information. Examples of critical information include research and development information, proprietary operational information, personal identifiable information, and financial information associated with U.S. national security related programs and activities. All personnel working under this task may at some time handle, produce or process critical information or Critical Program Information (CPI), and therefore both Collaborators must practice OPSEC. All work is to be performed in accordance with DoD OPSEC requirements, and in accordance with the OPSEC attachment to the DD 254.

Questions regarding the handling of CUI with regard to the support or performance of this Agreement may be directed to the Naval Information Warfare Systems Command (NAVWAR)/NIWC Pacific, OPSEC Manager, Code 87200.

Security programs are oriented towards protection of CI and classified material. OPSEC is an operations function, which involves the protection of any critical information – focusing on unclassified information that may be susceptible to adversary exploitation. Pursuant to DoDD 5205.02E, SECNAVINST 3070.2A, NAVWARINST 3432.1, Navy Tactics, Techniques, and Procedures (NTTP) Operations Security (OPSEC) Manual, the National Security Decision Directive (NSDD) Number 298, and NAVWAR/NIWC Atlantic/NIWC Pacific’s OPSEC program implements requirements in DoD 5205.02- M – OPSEC Program Manual. Note: OPSEC requirements are applicable when contract personnel handle, produce or process critical information, have access to CI, unclassified CPI, CUI, or Department of Navy (DON) networks. CDSE OPSEC Course: https://securityawareness.dcsa.mil/opsec/index.htm.

(End of SOW) https://securityawareness.dcsa.mil/opsec/index.htm