Att 2_SOW_TaskOrder_N0017325RML01_.docx

High Assurance Computer Systems Security RFP N0017325RML01 Attachment #2

Naval Research Laboratory 4555 Overlook Avenue SW Washington DC, 20375-5329 Code 5540

HIGH ASSURANCE COMPUTER SYSTEMS SECURITY

Statement of Work (SOW) – Task Order 1

Estimated Task Order Period of Performance: March 2025 – March 2028

15 June 2023

RFP N00173-18-R-MJO1

Attachment #6 Date: 11/07/2020

B2a SOW Sample_1117

STATEMENT OF WORK

(HIGH ASSURANCE COMPUTER SYSTEMS SECURITY)

Security Research Field #7

Section 1 Background.

The Center for High Assurance Computer Systems (CHACS), Code 5540, seeks to ensure that the Department of the Navy has the best High Assurance Information Systems by evaluating, improving, and/or developing technology, components, methods or processes, and tools for various Commands and Organizations. Code 5540 conducts research and development in techniques for processing and communicating data that preserve critical system properties, such as security, safety, availability, and timely delivery of computational results, and improve formal methods for analyzing and developing software and hardware systems.

This statement of work (SOW) describes the engineering and technical support to be provided to the Center for High Assurance Computer Systems, Code 5540, at the Naval Research Laboratory (NRL) in Washington, D.C. The support includes a number of strongly interrelated assignments that vary significantly in technical scope and deliverable products. Several of the assignments support the same mission and careful technical coordination is required to ensure a successful deliverable product.

Section 2 Objective.

The objectives of this statement of work include, but are not limited to the research, design, development, integration, testing and installation of:

· Prototypes for code vulnerability analysis and information assurance technology that addresses cyber security threats

· High assurance cryptographic technologies and high assurance enabling technologies

· Airborne and space-borne sensor and communications systems, various wireless sensor and communications systems and unmanned vehicle and test platforms

· Toolsets and specialized security capabilities appropriate for distributed architectures

· High assurance hardware, software, networks, and diagnostic equipment

· New types of security protocols and algorithms and their analysis for security and performance in information systems

Section 3 Scope

The contractor shall provide scientific, engineering, technical, analytical, and project management support for a wide range of NRL research programs and activities. Contractor personnel shall support programs addressing Navy, DoD, and Intelligence Community (IC) sponsor priorities. The contractor shall provide program/project management in the form of fiscal tracking and objective-driven tracking of progress as required by assignments, as well as support for program reviews, status management and decision history tracking.

The contractor shall provide support for establishing and maintaining computational and secure networking resources as required by the assignments to complete their objectives in a timely manner. Performance shall be onsite at NRL and offsite locations.

Section 4 Requirements.

4.1 High Assurance Development Support for Cryptographic and IA Enabling Technology

The Contractor shall provide technical and engineering support toward the design, development, integration, testing and certification of NRL produced high assurance Cryptographic Technologies. The Contractor shall design/develop new cryptographic modules, end cryptographic units, cryptographic techniques/algorithm implementations of direct importance to the Navy and DoD for a wide range of applications, including but not limited to tactical military grade applications constrained by size weight and power (SWaP), applications with strict environmental and nuclear hardening requirements, and network applications.

The Contractor shall design, develop, integrate, and test hardware and firmware for high assurance programmable cryptographic technology. Hardware/firmware designs shall be produced using computer aided engineering tools, and shall encompass state-of-the-art high-speed hardware technology (e.g., multi- core microprocessors, microcontrollers, Field Programmable Gate Arrays [FPGAs], advanced memory technology, high speed data interfaces). The development process shall involve, but is not limited to modeling, simulation, prototyping, and shall require developing schematics, writing VHSIC Hardware Description Language (VHDL) code and test benches for FPGAs, preparing board layout packages, routing the design to produce GERBER files, conducting pre- and post- signal integrity simulations, thermal analysis, testing the implemented design on manufactured Printed Circuit Assembly (PCA) boards, and conducting static code analysis on the VHDL code using in-house tools and analyzing the reports for corrective actions.

The Contractor shall design, develop, integrate, and test software for high assurance programmable cryptographic technology. The development process shall involve, but is not limited to modeling, simulation, prototyping, and shall require code development in C, C++, Python, Java, Assembly, and the strict adherence to coding standards and development processes, as well as writing design and security documentation describing the software. The development process shall also involve testing the code at a unit-level, the development of data artifacts to support the testing, integrating and testing the code on the target hardware, and integrating the developed cryptographic modules within a system and performing system integration testing. Also, the process shall involve performing static code analysis using in-house and commercially available tools, preparing and analyzing the reports for corrective actions. The Contractor shall also provide technical and engineering support for the design and manufacture of Chassis enclosures as needed for encasing the developed high assurance programmable cryptographic technology, assembly of product units requiring integration of PCAs into chassis enclosures, programming the units, and conducting manufacturer tests on the units.

The Contractor shall provide technical and security engineering support toward certification of the NRL developed high assurance programmable cryptographic technology and IA enabling technology. Tasks may result in conducting analysis, writing security documentation (requirements analysis, design, testing documents), as well as performing/witnessing security testing to facilitate the respective security certification processes for the developed technology.

The Contractor shall provide technical and engineering support toward the design, development, integration, test, operation and certification of Information Assurance (IA) Enabling Technology, e.g., Cross Domain Solutions (CDS). Tasks may result in the design/development/testing of new Information Assurance (IA) products, high assurance data filtering technology for legacy and emerging data types, communications protocol plug-ins for CDS that are of direct importance to the Navy, DoD and the Intelligence Communities (IC) for a wide range of applications, including but not limited to tactical military grade applications constrained by size weight and power (SWaP), shipboard networking applications, and network applications.

The Contractor shall provide design, software development, integration and test of components, subsystems or complete systems for IA enabling technology, such as Cross Domain filtering and guarding solutions. The development process shall involve, but is not limited to modeling, simulation, prototyping, and require code development in C, C++, and the strict adherence to coding standards and development processes. The development process shall also involve testing the code at a unit-level, building, integrating and testing the code on the target hardware, integrating the developed technology with host systems and performing system integration testing, and performing various types of functional and security testing including by not limited to compliance testing against Information Assurance (IA) controls and penetration testing to support certification. Also, the process shall involve developing scripts to enable automated testing, conducting/analyzing performance testing, throughput/latency measurements, performing static code analysis using in-house and commercially available tools, preparing and analyzing the reports for corrective actions, and developing/integrating/analyzing security policies including but not limited to developing/applying Security Enhanced Linux (SELinux) policies. The software development shall also include researching and implementing updated build systems, driver development and custom Booter and kernel development and optimization for target hardware technology.

The Contractor shall provide technical and engineering support for procuring supplies and equipment, manufacturing and fabrication of hardware for Guarding Solution products, e.g., Printed Circuit Boards (PCBs) and assembly of boards with components to produce Printed Circuit Assemblies (PCAs). The Contractor shall also provide technical and engineering support for the design and manufacture of Chassis enclosures as needed for encasing the developed IA technology, assembly of product units requiring integration of PCAs into chassis enclosures, programming the units, and conducting manufacturer tests on the units.

The Contractor shall provide engineering support for product installations of cryptographic and IA enabling technologies at off-site locations under NRL direction. The Contractor shall provide design, development, and documentation of training modules required for the NRL developed cryptographic and IA enabling technologies, using various mechanisms including but not limited to Computer Based Training (CBT) modules.

4.2 Demonstrate enhanced communication, computational, and assurance capabilities for tactical military platforms.

The contractor shall provide programmatic and technical support toward high assurance applications of artificial intelligence (AI). The contractor shall perform the below tasks:

· Plan and host workshops and conferences, organize Community of Interest (CoI) forums, and solicit speakers for technical talks.

· Investigate, evaluate, optimize, and document high assurance AI applications (e.g., physics-informed machine learning models for ship motion prediction).

The contractor shall provide programmatic and technical support toward high assurance communications. For this task, the contractor shall design, fabricate, integrate and test communications subsystems with varied Size, Weight (and) Power-Cost (SWaP-C) constraints (e.g., that can be easily integrated with sonobuoys). Proposed tasks to include:

· Validate lossless compression and forward error correction on hydrophone data implemented with legacy sonobuoy radios.

· Implement a new waveform on SDRs suitable for sonobuoy fielding.

· Over-the-air demonstration of SDRs in sonobuoys using the new waveform.

4.3 Design, Development, Integration, and Testing of Secure Wireless Network components, Various Wireless Sensors and Communication Systems, and Unmanned Vehicle and Test Platform Integration

The contractor shall support the investigation and development of unique wireless systems related to new communications capabilities and mobile systems security. The Contractor shall develop new equipment and techniques of direct importance to the Navy for a wide range of applications including ground-to- space data transfer, data transfer to surveillance platforms, and ship-to shore and ship-to-ship data transfer. The contractor shall support the investigation and development of unique airborne and maritime platforms related to various wireless network sensing and communications platforms. The contractor shall provide technical and engineering support towards the design, development, integration, test and operation of these systems. Performance of this task area shall include design, development, integration and test of components, subsystems or complete remote sensor systems for airborne and/or space borne or maritime missions. The Contractor shall provide technical and engineering support in the design, development, testing, and operations of unmanned vehicles or other test platforms necessary to support the integration, testing, fielding, operations, and research.

The Contractor shall customize engineering support to include, but not limited to:

· Sensor analysis and assessment

· Sensor engineering and development

· Custom component development and testing

· Vehicle Command and Control testing support

· Vehicle Analysis and Assessments

· Vehicle/ Test Platform Payload Analysis and Assessments

· Custom Vehicle design and development

· Custom Payload enclosure design and development

The Contractor shall provide support, to include procurement of supplies and equipment, fabrication, integration, test and calibration, as well as hardware, software, and diagnostics for efforts at both on-site and for fielded experiments at off-site locations under NRL direction. The Contractor, in support of the requirements herein, shall install and operate diagnostic equipment, acquire raw data, process the data, as well as analyze and archive collected data. Upon completion of this analysis, the Contractor shall provide the data acquired, including all disks, tapes, films, etc., and submit a written report of the results.

4.4 Design, Development, Integration, Testing of Computer Resources for High Assurance Computer Systems projects

The contractor shall provide technical and engineering support toward the integration, test, and administration of computing resources for the Center of High Assurance Computer Systems projects. Performance of this Task Area shall include integration, test, and administration of highly available and secure networked systems.

This Task Area includes maintaining a variety of networked systems in support of research and development programs. Systems shall include state-of-the-art high-speed wired networks with high-end- workstations, laptops, servers, thin clients and zero clients. These networked systems are often configured and reconfigured to address newly identified network scenarios.

The Contractor shall provide support, to include integration, test and administration, as well as hardware, software, and diagnostics under NRL direction. The Contractor, in support of the requirements herein, shall install and operate diagnostic equipment, acquire raw data, process the data, as well as analyze and archive collected data.

Requirements exist to test and implement reliable and secure capabilities; reconfigure and maintain networked systems; update older configurations and generally maintain systems at current or recent versions of the operating systems and file management systems as well as meeting Information Assurance Vulnerability Message (IAVM) and Computer Task Order (CTO) compliance requirements. The overall systems include but are not limited to: Linux-based PC and server systems, Apple Macintosh, Windows- based PCs, Android and iOS tablets and phones, routers, firewalls, network-attached and direct-attached storage, virtual machine technology, network management systems, network switches, network monitoring systems, firewalls, intrusion detection systems, intrusion prevention systems, security event and information management systems, log management systems, and cloud computing technology.

The contractor shall configure, reconfigure, update and maintain individual networked groups. This includes, maintaining close to current revisions of operating systems and adapting to the full range of available local and wide area networks to meet specific project and program requirements as well as meet all compliance requirements. They shall also provide maintenance and support with efforts such as High Assurance Guard (HAG) sustainment and services, AAS/TMAAS risk management framework support and High Assurance Architecture (HAA) support.

4.5 Program Resource Management Support

The Contractor shall provide technical and administrative support in the preparation of technical briefings and presentations, the development of work plans, annotation and promulgation of action items resulting from meetings and general programmatic support. The Contractor shall ensure all project and program actions are tracked and documented and that the documentation is available to specified program and project participants. The Contractor shall provide support for the planning, negotiation, and implementation of meetings, conferences, and seminars. The Contractor efforts shall include the planning and execution of these events including, but not limited to, event planning, securing meeting venues and facilities, acquiring required equipment, meeting management, execution of the agenda and event management, producing marketing material to facilitate showcasing the NRL developed technologies at technical conferences/symposiums. The contractor shall also perform the below tasks, but not limited to:

· Provide assistance to the technical managers in each program, drawing from an embedded knowledge of the global Science and Technology (S&T) environment to maximize effectiveness, collaboration and transition potential of S&T initiatives.

· Assisting the Branch Director as required by providing concise planning and implementation options for achieving the goals of the organization in the most efficient and effective manner.

· Planning and execution of meetings and forums between program Technical POCs. Prepare agendas and background briefings pertinent to the topics for discussion.

· Provide assistance for each assigned program by tracking, coordinating, planning, and overseeing all program activities.

· Develop and provide all associated documentation for programmatic, logistics, planning, and financial activities.

· Perform as liaison with the NRL Contracting Officer’s Representative (COR) and support staff.

· Produce and deliver a monthly comprehensive contract cost monitoring and control reports.

· Perform as liaison to subcontractors for technical tasking, technical and financial performance monitoring, and compliance review of deliverable items.

· Planning and execution of meetings and forums between program Technical POCs. Prepare agendas and background briefings pertinent to the topics for discussion.

5.0 Security Requirements

Contractor personnel assigned to this contract who require Top Secret/SCI access must have a favorably adjudicated DoD Tier 5 investigation; a final Top Secret security clearance, with eligibility of SCI prior to submission. Contractor personnel assigned to this contract who require Top Secret access must have a favorably adjudicated DoD Tier 5 investigation; a final Top Secret security clearance prior to submission. Contractor personnel, who require access to Secret information, must have a favorably completed Tier 3 investigation and a final Secret clearance prior to submission.

Contractors issued a DoD interim secret security clearance may ONLY work on unclassified tasks as outlined in the SOW. Unclassified IA or IT positions are NOT authorized with a DoD issued interim secret clearance.

Contract Facility Security Officers (FSOs), and/or NRL CORs, are required to report immediately to Code 1230 any derogatory information regarding a contractor holding an interim Secret clearance, either on- or off-site. FSOs and NRL CORs shall also notify Code 1230 when a contractor’s interim or final clearance has been declined or revoked.

For Contractors working on unclassified task orders and performing at the locations listed in block 13, a favorably completed suitability determination and a submitted T3 investigation is required prior to the start of work. Individual installation access restrictions may apply.

All contractors (including subcontractors) identified in the Statement of Work shall supplement their current security practices by requiring any personnel involved in executing the contract to complete Government-sponsored and administered Operations Security (OPSEC) training, OPSE-1301 and any OPSEC guidance that may pertain to the project.

B2 SOW Template_1117 image1.png