Attach 1_SOW_AVRA-SAS_PhaseII_Draft.pdf

Statement of Work (SOW) for

AVRA-SAS Cloud Migration Phase II Vandenberg Space Force Base (VSFB)

28 January 2025

1. SCOPE: This Statement of Work (SOW) continues the migration of the on-premises Safety Analysis System (SAS) to the GovCloud, building on the AVRA-SAS Cloud Migration Phase I effort. The scope of Phase II includes completing the feature set, providing cloud system administration and maintenance, and ensuring ongoing Cyber Security/Authority to Operate (ATO) compliance for Vandenberg Space Force Base (VSFB) users.

1.1 Background: The SLD30 Launch Safety office currently relies on on-premises infrastructure, including computers, networking equipment, servers, and high-performance compute clusters, to meet the stringent requirements for protecting life and property during launch operations.

Following the initial Cloud Migration Phase I, which established a foundational GovCloud environment for basic analysis, Phase II aims to expand and complete the cloud-based capability set, enabling a more comprehensive and efficient launch safety operation.

1.2 Objective: This Statement of Work aims to establish a fully cloud-based system, enabling SLD 30 Safety analysts to execute their responsibilities within the GovCloud, thereby reducing dependence on on-premises infrastructure and fostering a scalable, cost-effective system that supports the increasing demands of the launch schedule.

2. REQUIREMENTS:

2.1 AVRA-SAS Cloud System Administration

2.1.1 The contractor shall provide comprehensive support for the administration of AVRA-SAS, including all requisite labor, materials, management, and maintenance. This shall encompass expertise in virtual Windows desktops, as well as experience with the Nebula cloud computing platform and Amazon Web Services (AWS) GovCloud, to ensure seamless system operation and maintenance.

2.1.2 The contractor shall perform day-to-day maintenance and management of the system, including accounts, updates, patches, and system configurations.

2.1.3 The contractor shall perform all work using industry standards, to include Security Controls as specified in NIST 800-53 and approved by the system owner and ISSM.

2.1.4 The contractor will coordinate with the requester/customer to schedule installation times that best fulfill mission requirements.

2.1.5 Maintenance/service calls shall be handled promptly.

2.2 Cloud Cyber Security / ATO Compliance

2.2.1 The contractor shall perform all work using industry standards, to include Security Controls as specified in NIST 800-53 and approved by the system owner and ISSM.

2.2.2 The contractor shall perform continuous monitoring in compliance with Dod standards to reduce cyber risk.

2.2.3 The contractor shall work with an ISSE/ISSO to implement security controls and ensure that vulnerabilities are identified and addressed in a timely manner.

2.2.4 The contractor shall coordinate with the ISSE/ISSO/ISSM per the Configuration Management Policy on all configuration changes.

2.3 Full Feature Set (Gap)

2.3.1 The contractor shall provide a method for incorporating in-house SLD 30 SELR/SELF tools into the AVRA-SAS. These tools are critical for automation of tedious and time-consuming tasks.

2.3.2 The contractor shall provide batch processing/scripting capability, specifically allowing the user to create and run Python scripts and Windows or linux scripts for batch processing.

2.3.3 The Contractor may substitute functionally equivalent tools to satisfy the requirements of paragraph 2.3.1 and 2.3.2.

2.3.4 The contractor shall not disclose, release, or transfer any program or utility developed from SLD 30 tool source code to any commercial entity without obtaining prior coordination and explicit agreement from SLD 30, ensuring that all intellectual property rights and interests are protected.

2.3.5 The Contractor shall allow macro-enabled Excel workbooks be allowed similarly to the way the USAF NIPR SDC allows these types of files. E.g., a prompt to accept “Enable macros”, or the equivalent.

2.3.6 To the extent practicable, the contractor shall grant elevated privileges to SLD 30 employees who have completed acceptable training, e.g., Security+ certification or the equivalent, enabling them to perform emergency updates to utility programs while adapting to unannounced changes in data formats from third-party sources.

3. PERIOD OF PERFORMANCE:

3.1 The period of performance is one year following contract award.

KEVIN R. CASE, NH-IV, DAF

Chief Engineer