Attachment 0001 - Base Statement of Work_ 26 October 2021.pdf

UNCLASSFIED

UNCLASSIFIED

STATEMENT OF WORK (SOW)

FOR

INTELLIGENCE SYSTEMS & ANALYTICS (IS&A)

INTELLIGENCE APPLICATIONS (INTEL APPS)

ALL SOURCE II

Solicitation Number: W56KGY-22-R-0004

Base Statement of Work Indefinite Delivery Indefinite Quantity (IDIQ) Contract

Version 1.0

26 October 2021

Project Manager Intelligence Systems & Analytics 6580 Surveillance Loop, Building 6006 Aberdeen Proving Ground, MD 21005 ii

Contents

1. Scope

1.1 Background

2. Applicable Documents

3. Requirements

3.0 ASII Programmatic

ASII Programmatic Kickoff

3.1 ASII Technical Test

ASII Technical Test Preparation

ASII Test Readiness Review (TRR)

ASII Technical Test

ASII Technical Test – Contractor Support

ASII – Post Technical Test Meetings

Software Version Description (SVD)

Logistic Support for Technical Test

3.2 ASII – Soldier Touch Point (STP)

Soldier Touch Point Preparation

Soldier Touch Point – Test Readiness Review (TRR) Support

Soldier Touch Point - Test

Soldier Touch Point – Test Support

Soldier Touch Point - Program Management and Meeting Support

Software Version Description (SVD)

Logistic Support for Soldier Touch Point

3.3 ASII Program Protection

3.4 ASII NIPRNet RMF Authorization

Cybersecurity Support

RMF Compliance

Cybersecurity Compliance

3.5 ASII Secret RMF Authorization

Cybersecurity Support

RMF Compliance

Cybersecurity Compliance

Solicitation # W56KGY-22-R-0004 Statement of Work October 2021 iii

3.6 ASII Functional Configuration Audit

3.7 ASII Software Army Interoperability Certification (AIC)

3.8 ASII Software Joint Interoperability Test Certification (JITC)

3.9 ASII Software Training

3.10 Operational Assessment

Operational Test Readiness Review

Operational Assessment

Operational Assessment Support

IA Support for Operational Assessment

Operational Assessment Meetings

3.11 ASII Software

ASII Software Delivery

DEVOPS

Program Protection Implementation

3.12 Annual Sustainment

Annual Maintenance Upgrades

IA Support for Annual Sustainment

Reach Back Support for Annual Sustainment

3.13 Initial Integration Support

Warranties

3.14 Configuration Management

Software Problem Report (SPR)

Monthly Security Patch/Release Delivery

Field-discovered SPRs

3.15 Engineering Change Proposals (ECP)

Contractor-proposed ASII Modifications due to Enhancements, Obsolescence, and Major Software Releases

Government-proposed Enhancements and Modifications

3.16 Exercise Support

Warranty Patch/Release Delivery iv

3.17 Army Contractor Manpower Reporting (CMR) System

3.18 Licensing

Technical Test Licensing

Soldier Touch Point (STP) Licenses

Operational Assessment (OA) Licenses

4. Contract Deliverables

4.1 Assurance Warranties

List of Tables Table 1. Program Documents

Table 2. Department of Defense Directives

Table 3. Department of Defense Instructions

Table 4. Army Regulations (AR)

Table 5. Other Documents

Table 6. Technical Test Asset List

Table 7. Soldier Touch Point Asset List

Table 8. Operational Assessment Asset List

1. Scope The contractor shall provide a commercial item that is a software only solution to meet the ASII II (ASII) interoperability, security, training, usability, and data management capabilities. The Contractor shall also provide support services, incidental services, and deliverables for the procurement of commercial item software to satisfy the ASII requirements.

1.1 Background

PM IS&A is a Family of Systems that provides our Army with advanced analytics, support to targeting and situation understanding to commanders. It processes, exploits, and disseminates information and intelligence about the threat, weather, and terrain and provides tactical and operational ground stations that downlink data from national, joint partners and Army sensors. As technology evolves and new warfighting requirements emerge, the PM’s capability set need to be updated to meet the user needs.

The ASII requirements address the need to modernize and enhance the capabilities of Army’s intelligence at the tactical echelons. The contractor’s software shall meet the capabilities called out in the Base Performance Requirement Documentation (Base PRD). Separate PRN will be issued at the order level if the orders requirement is not inclusive of all Base PRD requirements The Contractor’s ASII software is intended to be hosted in the Command Post Computing Environment (CPCE) Tactical Server Infrastructure (TSI).

The ASII capability shall align with multiple overarching directives, to include the Army’s Common Operating Environment (COE). The ASII shall support net-centric military operations by being interoperable with current Army, Unified Action Partners, Joint Service, Allied, Coalition, and Command and Control information and ISR systems. ASII shall operate across the Secure Internet Protocol Router Network (SIPRNet), Secret Coalition Networks, and Unclassified security domains, and within and across all COE computing environments.

PM IS&A ASII app will continue to contribute to visualization and situational awareness, maximizing combat power and enhancing the ability to operate in an unpredictable and changing environment throughout the operational spectrum.

2. Applicable Documents The following documents are applicable to this SOW.

Table 1. Program Documents Number Title Date

Base Performance Requirements Document (Base PRD) - Includes Delivery Order #1 and Delivery #2 combined requirements

Sept 2021

Table 2. Department of Defense Directives Number Title Date

DoD 5220.22-M National Industrial Security Program Operating Manual 28 February 2006 DoDD 8570.01 Information Assurance (IA) Training, Certification and Workforce

Management 15 August 2004

DoD 8570.01-M Information Assurance Workforce Improvement Program, Change 4 19 December 2005 w/ change 10 November

DoDD 8140.01 Cyberspace Workforce Management 11 August 2015 DoDI 4140.67 DoD Counterfeit Prevention Policy 26 April 2013 DoDI 4140.01 DoD Supply Chain Materiel Management Policy 14 December 2011

Number Title Date DoDI 8582.01 Security of Unclassified DoD Information on Non-DoD Information

Systems 6 June 2012

DoDI 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN)

5 November 2012

Table 3. Department of Defense Instructions Number Title Date

DoDI 3020.41 Operational Contract Support 20 December 2011 DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT) 12 March 2014

Table 4. Army Regulations (AR) Number Title Date

AR 25-1 Army Information Technology 25 June 2013 AR 25-2 Information Assurance 4 April 2019 AR 70-1 Army Acquisition Policy 16 June 2017 AR 73-1 Test and Evaluation Policy 16 November 2016 AR 530-1 Operations Security 26 September 2014 AR 380-67 Personnel Security Program 24 January 2014 AR 381-12 Threat Awareness and Reporting Program (TARP) 01 June 2016 AR 70-77 Program Protection 08 June 2018 DA PAM 25-1-2 Information Technology Contingency Planning 06 June 2012

Table 5. Other Documents Number Title Date

NIST Special Publication 800- 53A Rev 4

Assessing Security and Privacy Controls in Federal Information Systems and Organizations

December 2014

Cybersecurity T&E Guidebook

Department of Defense Cybersecurity Test and Evaluation Guidebook

1 July 2015

DA Pam 73-1 Test and Evaluation in Support of Systems Acquisition 30 May 2003 DOT&E Memo Procedures for Operational Test and Evaluation of Cybersecurity in

Acquisition 1 August 2014

DAG 2017 Defense Acquisition Guidebook 21 August 2017 MIL-STD-810 Department of Defense Test Method Standard, Environmental

Engineering Considerations and Laboratory Tests 31 October 2008

NIST Interagency Report 7622

Notional Supply Chain Risk Management Practices for Federal Information Systems

October 2012

NIST Special Publication 800-18 rev 1

Guide for Developing Security Plans for Federal Information Systems

February 2006

NIST Special Publication 800-

Supply Chain Risk Management Practices for Federal Information Systems and Organizations

April 2015

3. Requirements This SOW addresses all products, support, and activities that shall be required throughout the period of performance (PoP) for the IDIQ Contract. The Contractor shall provide all the necessary resources and knowledge to support the listed products, support, and activities.

The goal of this SOW and the applicable/referenced documents is to detail and implement commercial item software that will satisfy the Government’s requirements. The following requirements will be issued at the order level to establish the most viable commercial item software to meet the Government’s requirements.

3.0 ASII Programmatic

The Contractor shall designate a program manager with responsibility to plan, manage, and direct the successful and final completion of the requirements of this SOW. The Contractor’s program manager shall be the single focal point of contact for all required programmatic requirements and work directly with the Government.

ASII Programmatic Kickoff The Contractor shall participate in a Government-run program kickoff event, no later than 10 business days after receipt of order. The Contractor shall plan for the kickoff meeting to last anywhere between two to four hours, and will be conducted at Government Location at APG, or remotely.

3.1 ASII Technical Test

The Contractor shall provide all necessary software licenses, materials, and incidental support required to execute an ASII Technical Test as detailed in the below paragraphs. This section shall include all analyst activities to include the ASII Technical Test Preparation, ASII Technical Test Support, the ASII Technical Test Readiness Reviews (TRR), information assurance activities, and the actual performance of the ASII Technical Test event.

ASII Technical Test Preparation The contractor shall have a period of no longer than eight weeks before the ASII Technical Test, during which the Contractor can modify and/or tailor its commercial software as necessary. The goal is for the Contractor’s software to successfully meet the Government’s requirements identified within the Base PRD incorporated in Section J of the Base IDIQ contract. The Government will make available to the Contractor a representative test environment, such as an environment hosted on hardware at either Aberdeen Proving Ground (APG) or at an operational site, such as the 82nd ABN DIV, Ft Bragg, NC, during that time. That environment will be made available in advance of the testing to the Contractor for system setup and configuration, integration, test, and training.

ASII Test Readiness Review (TRR) The Contractor shall participate in a Pre-Test meeting either in-person or remotely, approximately 10 business days prior to the ASII Technical Test Readiness Review (TRR), to discuss the test plan details and activities leading up to the ASII Technical Test TRR and the actual ASII Technical Test. The meeting is not expected to last more than two hours. The TRR is not expected to last more than two hours.

ASII Technical Test The purpose of each ASII Technical Test is to test the Contractor’s commercial ASII software to the system requirements. The Government may provide decomposed requirements, measures of performance, and technical performance measures to support the testing and evaluation. The first (of two) ASII Technical Tests will be conducted in a Government-provided hardware environment, at Aberdeen, MD. The second Technical Test will be conducted at either APG, other Government locations, or at a facility aligned to a military base, such as the 82nd ABN DIV, Ft Bragg, NC. Testing will be conducted by PM IS&A, or other Government Authority. The location of the Technical Test will be specified at the Delivery Order level. During the Technical Test, the software shall demonstrate its ability to meet the specified SOW and PRD requirements. The ASII Technical Test (with contractor Analyst Support) may also include cybersecurity testing of the Contractor’s software. The Contractor will be provided the test location of Technical Test #2 within 60 days to allow proper planning.

Each ASII Technical Test is not expected to exceed three weeks overall, from set-up through teardown.

The Government will provide email notification to the Contractor no later than 15 business days prior to the start of each ASII Technical Test. With this notification, the Government will provide each Contractor a schedule that will include training dates, a test plan, and schedule of test events defining the specific timeframes that each Contractor’s System will be tested. The Government will have final discretion in determining the most efficient test sequence to meet the overall schedule. If multiple base contractor awardees are issued the same ASII Technical Test, then the Government will make reasonable efforts to conduct tests in as similar conditions as possible for each Contractor. The Government’s test plan will include processes and resources the Government plans to use during test conditions.

No software changes to the system under test will be allowed once testing has begun, unless approved by the Government, unless approved by the Government in a digitally signed email by the Government Task Lead or Intel Apps Chief Engineer.

During testing, the Government may provide official Test Incident Reports (TIR) to document anomalies and system failures identified by the Government. The Contractor may be provided TIRs during or at the conclusion of the event. The Government will decide on whether any TIRs result in a Priority 1-3 Software Problem Report (SPR), as defined in DA Pamphlet 73-1, Figure Q-31. The final delivered software shall contain no Priority 1-2 SPRs.

The Government will assign a user group to the Contractor’s system. It is possible that the Government may rotate user groups among systems from all base contract holders and may provide the Contractor, to a reasonable extent, with equal access and feedback from user groups.

ASII Technical Test – Contractor Support The Contractor shall provide onsite test support for a period not expected to exceed six weeks (in total) with no more than eight on-site Contractors and no less than one Contractor on-site representatives for the ASII Technical Test. The Contractor on-site representative(s) shall include:

Operator Support: The Contractor on-site support shall provide support for system operation / issues and troubleshooting throughout the ASII Technical Test.

System Configuration: The Contractor on-site support shall provide support for initial set up for the systems.

ASII – Post Technical Test Meetings The Contractor shall participate in a Post-Performance Test meeting, within five business days after the completion of the Technical Test, to allow the Government to provide the Contactor with the information collected from the ASII Technical Test.

All meetings will occur in the Aberdeen, MD area, remotely, or at the contractor’s location, at the Government’s direction. The Contractor shall have maximum flexibility to assign the appropriate person or persons to participate. The meeting should last no longer than two hours.

Software Version Description (SVD) The Contractor shall be responsible for delivering an initial version of the SVD document IAW CDRL A001. The Contractor shall deliver an SVD with each software deliverable to include monthly security patch/release deliveries and Development Operations (DEVOPS) updates, IAW CDRL A001.

Logistic Support for Technical Test The Contractor shall be responsible for the maintenance and sustainment of software licenses participating in the ASII Technical Test. This requirement is limited to those assets the Contractor has delivered in support of the ASII Technical Test. The Contractor shall fix or replace any inoperable software it delivered to participate in the Intel Technical Test.

3.2 ASII – Soldier Touch Point (STP)

The Contractor shall provide all necessary software licenses, materials, and incidental support required to execute a Government-run Technical Test as detailed in the below paragraphs. This section shall include all activities to include the actual Soldier Touch Point (STP).

Soldier Touch Point Preparation The Contractor shall have a period of no longer than eight weeks before a Soldier Touch Point, during which time the Contractor can modify and/or tailor its software as necessary. The goal is for the Contractor’s software to successfully meet the Government’s requirements identified within the PRD incorporated into Section J of the delivery order. The Government will make available to the Contractor a representative environment at a Government facility, using Government-provided hardware, or at another Government facility, most likely at the 82nd ABN DIV, Ft Bragg, NC. That environment will be made available to the Contractor for system setup and configuration, integration, test, and training. The Contractor will be notified 60 days in advance of any testing occurring to allow adequate time to prepare.

Soldier Touch Point – Test Readiness Review (TRR) Support The Contractor shall participate in a Pre-STP meeting, either in person or remotely, 10 business days prior to the STP TRR, to discuss the test plan details and activities leading up to the STP TRR and Test. The meeting is not expected to last more than two hours.

Soldier Touch Point - Test The purpose of each Soldier Touch Point is to test the proposed ASII Intel App software to the requirements and solicit feedback on system performance from Government technical experts. The Government may provide decomposed requirements, measures of performance, and technical performance measures to support the testing and evaluation. The Soldier Touch Point may be conducted in the Aberdeen, MD area, other Government locations or at a facility aligned to a military base, such as the 82nd ABN DIV, Ft Bragg, NC, without limit, as may be needed. Testing will be conducted by PM IS&A, or other Government Authority. During a Soldier Touch Point the Contractor shall demonstrate its technical software against the requirements defined in the SOW and PRD, incorporated in Section J of the delivery order. During the Soldier Touch Point the Government may generate findings regarding the system performance and provide those findings to the Contractor.

Each STP is not expected to exceed three weeks overall, from set-up through teardown.

The Government will provide email notification to the Contractor 15 business days prior to the start of each STP. With this notification, the Government will provide each Contractor a schedule that will include training dates, a test plan, and schedule of test events defining the specific timeframes that each Contractor’s System will be tested. The Government will have final discretion in determining the most efficient test sequence to meet the overall schedule.

No software changes to the system under test will be allowed once testing has begun, unless approved by the Government in a digitally signed email by the Government Task Lead or Intel Apps Chief Engineer. During testing, the Government may provide official TIRs to document anomalies and system failures identified by the Government. Contractor may be provided TIRs during or at the conclusion of the event. The Government will decide on whether any TIRs result in a Priority 1-3 SPR, as defined in DA Pamphlet 73-1, Figure Q-31. The final delivered software shall contain no Priority 1-2 SPRs. The Contractor shall provide User Training Material prior to the event. Training shall be conducted in a classroom environment and the Contractor shall assume recipients of the training have no prior experience with the Contractor’s system. Training during the STP should be divided into blocks and the Contractor is encouraged to utilize a “train-exercise-train” methodology.

However, the combination of all training shall not exceed 24 hours over 3 days per user group. User groups are not expected to exceed 20 people per group. The Contractor shall be responsible for its own training environment. The Government will assign a user group to the Contractor’s system. It is possible that the Government may rotate user groups among systems from all base contract holders and may provide the Contractor, to a reasonable extent, with equal access and feedback from user groups.

Soldier Touch Point – Test Support The Contractor shall provide on-site test support for a period not expected to exceed three weeks with no more than eight and no less than one Contractor on-site representatives for the STP. The Contractor on-site representative(s) shall include:

• Operator Support: The Contractor on-site support shall provide support for system operation / issues and troubleshooting throughout the Analytics and Tools Performance Test.

• System Configuration: The Contractor on-site support shall provide support for initial set up for the systems.

Soldier Touch Point - Program Management and Meeting Support The Contractor shall participate in a Post-Technical Test meeting, within five business days after the completion of Technical Test, to allow the Government to provide the contactor with the information collected from the Technical Test. All meetings will occur at Aberdeen, MD area, remotely, or at the contractor’s location, if directed. Contractor shall have maximum flexibility to assign the appropriate person or persons to participate.

The meetings should last no longer than two hours.

Software Version Description (SVD) The Contractor shall be responsible for delivering an initial version of the SVD document after receipt of order IAW CDRL A001, and at the time of each of the RMF self-assessment artifacts IAW paragraphs 3.3.1.1, 3.4.1.1, and 3.5.1.1. The Contractor shall deliver an SVD with each software deliverable to include monthly security patch/release deliveries, IAW CDRL A001.

(See CDRL DI-IPSC-81442A, A001)

Logistic Support for Soldier Touch Point The Contractor shall be responsible for the maintenance and sustainment of software licenses participating in the ASII STP. This requirement is limited to those assets the Contractor has delivered in support of the ASII STP. The Contractor shall fix or replace any inoperable software it delivered to participate in the Intel Application ASII STP.

3.3 ASII Program Protection

The Contractor shall perform the below tasks as described and shall flow down to any subcontractors engaged by the Contractor.

a. During the program kickoff meeting, SOW Section 3.0.1, the Contractor shall assist and support the Government in performing a Critical Functional Analysis and Critical Program Information (CPI) Assessment on the vendor software to identify Critical Components and CPI.

b. During the Functional Configuration Audit, SOW Section 3.6, the Contractor shall assist the Government to develop, document and update required software assurance activities per Table 8 provided in the Defense Acquisition Guidebook, Chapter 9, Program Protection Plan, Section 9-3.2.5. Note: P is for planned and A is for actual.

c. During the Functional Configuration Audit, SOW Section 3.6, the Contractor shall provide the Government with visibility into the supply chain for Critical Components, and the contractor shall describe how supply chain risk can be introduced through those Critical Components, and describe how the contractor has implemented or plans to implement countermeasures to mitigate such risks. The Government will either approve, modify, or add additional countermeasures.

d. The Contractor shall provide a Program Protection Implementation Plan to the Government with initial delivery of ASII software as part of SOW Section 3.11.3 ASIISoftware and provide reports to the Government IAW CDRL DI-ADMN-81306, E001.

3.4 ASII NIPRNet RMF Authorization

The ASIISoftware includes all activities leading up to and including the procurement of the separately priced software licenses, completion of fielding and the transition to sustainment, to include training support, licensing, configuration management, and RMF activities.

Cybersecurity Support The Contractor shall support and participate in NIPRNet authorization process and cybersecurity testing. The Contractor shall provide support for the RMF self-assessment.

3.4.1.1 RMF Self-Assessment Support

The Contractor shall provide self-assessment support to include but not limited to providing system artifacts and documentation, completing and providing Assured Compliance Assessment Solution (ACAS) vulnerability scans, complying with security controls IAW Categorization and Control Selection Systems (CNSSI 1253), and assisting in developing Plan of Actions & Milestones (POA&M) to meet RMF security control requirements. The Government will provide or make available to the Contractor the required security tools needed for RMF compliance activities.

The Contractor shall deliver the following system artifact documentation no later than 15 business days after receipt of order IAW CDRL B002 MGMT-82001 DOD RMF Package Deliverables:

• SVD, CDRL A001

• Software User Manual, CDRL A002

• Security Plan, CDRL B002 o System Architecture Description o Components o Configurations o Accreditation/Authorization Boundaries o Compliant Network Diagrams o External Interfaces and Data Flow o Internal Data Flow o Contingency Plan (to include backup/restore/recovery procedures) o Incident Response Plan o Hardware Lists (NETCOM HW/SW Template) o Software/Firmware Lists o Ports, Protocols, and Services (PPS) o Configuration Management Plan o Information Assurance Vulnerability Management (IAVM) Plan o RMF Implementation Plan

• Cybersecurity Test Plan, CDRL B002 o Required Vulnerability Scans (ACAS) o Security Technical Implementation Guides (STIGs) o Security Readiness Guides (SRGs) o Secure Content Automation Protocol (SCAP) benchmarks

• POA&M, CDRL B002

• Software User Manuals, CDRL A002

• Administrator Manuals/Guides

• Operations Security (OPSEC) Plan, CDRL B001

• Configuration Management Implementation Plan

• Maintenance Implementation Plan

• Audit and Accountability Implementation Plan

• System and Information Integrity Implementation Plan

• Identification and Authentication Implementation Plan

• Access Control Implementation Plan

• System and Services Acquisition Implementation Plan

• System and Communications Protection

• Media Protection Implementation Plan

• Incident Response Plan

• System Training Plans & Guides

• FSE Guides

• Testing and Evaluation Plan (security assessment, regression, flaw remediation)

• Secure configuration, installation, operation, and maintenance procedures

• Anti-counterfeit Implementation Procedures

• Supply Chain Protection Implementation Plan

• Controlled Unclassified Information Implementation Plan

(See CDRL, B002, DI-MGMT-82001, & A001, DI-IPSC-81442A) The Contractor shall comply with all applicable technical, procedural, and system documentation associated with Federal, Department of Defense (DoD), and Army Cybersecurity policy and requirements, including but not limited to the following.

a. Provide system information at the component level including security concepts and procedures and all system component user and maintenance manuals to the security engineering team after receipt of order, IAW CDRL B002. This system information shall become the baseline system configuration.

b. Provide system administration, access, and engineering support to the System Engineering team and installation management personnel from self-assessment activities through final system acceptance.

c. Provide system information and security assistance to the Security Control Assessor (SCA) team to support the Authorizing Official’s (AO) authorization decision process.

d. Provide a copy of complete system documentation including component manuals, configuration guides, administration guides, user guides, and any system unique documentation after receipt of order, IAW CDRL B002 Information System documentation shall describe secure configuration, installation, and operation of the system, component, or service; the application of information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

e. The Contractor shall provide vulnerability scans and deliver ACAS results to the Government, comply with security controls, and apply Defense Information Systems Agency (DISA) STIGs.

Also, the Contractor shall assist the Government in developing the POA&M to meet RMF requirements.

RMF Compliance The Contractor shall perform cybersecurity assessment and authorization activities IAW DoDI 8510.01 RMF for DoD Information Technology (IT) and CNSSI 1253 Security Categorization and Control Selection for National Security Systems. During the early stage of RMF process, the Contractor’s system will be assessed for categorization for Confidentiality, Integrity, and Availability (CIA) impact levels and applicable security controls will be identified. The Contractor shall enable their software to meet the requirements from the security controls by applying the required DISA STIGs which are applicable to the system. All applicable security controls identified in the CNSSI 1253 publication and STIGs shall be assessed to ensure security controls and STIGS are examined, and tested, ensuring authorization decision requirements are addressed.

The Contractor shall provide cybersecurity control artifacts that are compliant with the CNSSI 1253 publication.

No tools are authorized for generation of artifacts except those posted to the Army OIA&C site or Knowledge Service (KS) site. Artifacts provided must meet the requirements of Army and DoD guidance IAW CDRL B002.

Cybersecurity Compliance The ASII software shall meet all applicable security control requirements so that an Authorization to Operate (ATO) can be obtained. Once an authorization decision has been obtained, the Contractor shall continue to sustain the security posture of the system baseline to maintain the compliance of the ATO requirement. The

Contractor shall maintain an IAVM patching process at least monthly to support Command Cyber Readiness Inspection (CCRI) compliance.

3.5 ASII Secret RMF Authorization

The ASIISoftware includes all activities leading up to and including the procurement of the separately priced software licenses, completion of fielding and the transition to sustainment to include training support, licensing, configuration management, and RMF activities.

Cybersecurity Support The Contractor shall support and participate in Secret authorization process and cybersecurity testing. The Contractor shall provide support for the RMF self-assessment.

3.5.1.1 RMF Self-Assessment Support

The Contractor shall provide self-assessment support to include but not limited to providing system artifact documentation, completing and providing ACAS vulnerability scans, complying with security controls IAW CNSSI 1253, and assisting in developing POA&M to meet RMF security control requirements. The Government will provide or make available to the Contractor the required security tools needed for RMF activities.

The Contractor shall deliver the following system artifact documentation via SIPRNet no later than 15 business days after receipt of order IAW CDRL B002 (DI-MGMT-82001) DOD RMF Package Deliverables:

• SVD, CDRL A001

• Software User Manual, CDRL A002

• Security Plan, CDRL B002 o System Architecture Description o Components o Configurations o Accreditation/Authorization Boundaries o Compliant Network Diagrams o External Interfaces and Data Flow o Internal Data Flow o Contingency Plan (to include backup/restore/recovery procedures) o Incident Response Plan o Hardware Lists (NETCOM HW/SW Template) o Software/Firmware Lists o Ports, Protocols, and Services (PPS) o Configuration Management Plan o Information Assurance Vulnerability Management (IAVM) Plan o RMF Implementation Plan

• Cybersecurity Test Plan, CDRL B002 o Required Vulnerability Scans (ACAS) o STIGs o Security Readiness Guides (SRGs) o Secure Content Automation Protocol (SCAP) benchmarks

• POA&M, CDRL B002

• Software User Manuals, CDRL A002

• Administrator Manuals/Guides

• Operations Security (OPSEC) Plan, CDRL B001

• Configuration Management Implementation Plan

• Maintenance Implementation Plan

• Audit and Accountability Implementation Plan

• System and Information Integrity Implementation Plan

• Identification and Authentication Implementation Plan

• Access Control Implementation Plan

• System and Services Acquisition Implementation Plan

• System and Communications Protection

• Media Protection Implementation Plan

• Incident Response Plan

• System Training Plans & Guides

• FSE Guides

• Testing and Evaluation Plan (security assessment, regression, flaw remediation)

• Secure configuration, installation, operation, and maintenance procedures

• Anti-counterfeit Implementation Procedures

• Supply Chain Protection Implementation Plan

• Controlled Unclassified Information Implementation Plan

(See CDRL DI-MGMT-82001, B002, A001, DI-IPSC-81442A) The Contractor shall comply with all applicable technical, procedural, and system documentation associated with Federal, Department of Defense (DoD), and Army Cybersecurity policy and requirements, including but not limited to the following.

a. Provide system information at the component level including security concepts and procedures and all system component user and maintenance manuals to the security engineering team after receipt of order, IAW CDRL B002. This system information shall become the baseline system configuration.

b. Provide system administration, access, and engineering support to the System Engineering team and installation management personnel from self-assessment activities through final system acceptance.

c. Provide system information and security assistance to the Security Control Assessor (SCA) team to support the Authorizing Official’s (AO) authorization decision process.

d. Provide a copy of complete system documentation including component manuals, configuration guides, administration guides, user guides, and any system unique documentation after receipt of order, IAW CDRL B002. Information System documentation shall describe secure configuration, installation, and operation of the system, component, or service; the application of information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

The Contractor shall provide vulnerability scans and deliver ACAS results to the Government, comply with security controls, and apply DISA STIGs. Also, the Contractor shall assist the Government in developing the POA&M to meet RMF requirements.

RMF Compliance The Contractor shall perform cybersecurity accreditation IAW DoDI 8510.01 RMF for DoD Information Technology (IT) and CNSSI 1253 Security Categorization and Control Selection for National Security Systems.

During the early stage of RMF process, the Contractor’s system will be assessed for categorization for CIA impact levels and applicable security controls will be identified. The Contractor shall enable their software to meet the requirements from the security controls by applying the required DISA STIGs which are applicable to the system. All applicable security controls identified in the CNSSI 1253 publication and STIGs shall be assessed to ensure security controls and STIGS are examined, and tested, ensuring authorization decision requirements are addressed.

The Contractor shall provide cybersecurity control artifacts that are compliant with the CNSSI 1253 publication.

No tools are authorized for generation of artifacts except those posted to the Army OIA&C site or KS site.

Artifacts provided must meet the requirements of Army and DoD guidance IAW B002.

Cybersecurity Compliance The ASII II software shall meet all applicable security control requirements so that an ATO can be obtained.

Once an authorization decision has been obtained, the Contractor shall continue to sustain the security posture of the system baseline to maintain the compliance of the ATO requirement. The Contractor shall maintain IAVM patching process at least monthly to support CCRI compliance.

3.6 ASII Functional Configuration Audit

The Contractor shall provide no less than one and no more than four SMEs to support the Government Functional Configuration Audit, after receiving an order, for a duration not expected to exceed three days. This audit shall include, at a minimum, verification that the system complies with the applicable PRD requirements, incorporated within Section J of the contract. The FCA will occur in the Aberdeen, MD area, other designated Government location, or at the Contractor’s location, at the discretion of the Government. The FCA may involve testing and demonstrations of the Contractor’s software to verify compliance with requirements.

3.7 ASII Software Army Interoperability Certification (AIC)

The Contractor shall achieve an AIC. The Contractor shall provide system software (on a temporary basis), 1 system operator, and 1 cybersecurity person, who can be the same person, on-site for a duration not to exceed 12 weeks for the AIC test event at the Central Technical Support Facility (CTSF) located at Fort Hood, TX. Activities for this event may include, but not limited to, system set-up, test operator training, AIC test plan review and coordination, general engineering services, IA scans, the Network Vulnerability Assessment (NVA), the cyber threat activity, and vulnerability and penetration assessments.

3.8 ASII Software Joint Interoperability Test Certification (JITC) The Contractor shall achieve a Joint Interoperability Test Certification (JITC). The Contractor shall provide system software (on a temporary basis), one system operator, and one cybersecurity person, who can be the same person, on-site for a duration not to exceed two weeks for the JITC event located at APG, or alternate location to be determined by the Government. Activities for this event may include, but not limited to, system set-up, test operator training, JITC test plan review and coordination, general engineering services, IA scans, the Network Vulnerability Assessment (NVA), the cyber threat activity, and vulnerability and penetration assessments.

3.9 ASII Software Training

The Contractor shall deliver a “train the trainer” course to support New Equipment Training (NET), not to exceed 1 week, to support up to 20 personnel at the Contractor’s facility or Government location, at the discretion of the Government. The Contractor is expected to provide training for the Government’s fielding, training, and support personnel.

The Contractor shall provide after receipt of order ASII NET materials, IAW DI-ILSS-80872 (CDRL F001), user manual, and administrator manual, IAW DI-IPSC-81443A (CDRL A002) and DI-MISC-80711A (CDRL C001).

New or updated NET materials and manuals will be provided whenever there are software changes that impact the user or administrator training. The NET materials and manuals may be in the vendor format.

The Contractor shall provide the “train the trainer” course, as needed, for additional training, not to exceed six courses per year for the length of the delivery order.

3.10 Operational Assessment

The Contractor shall provide all necessary software licenses, materials, and support required to execute a Government-run Operational Assessment (OA) as detailed in the below paragraphs. The Contractor shall provide support to the OA which includes all activities from pre-Operational Test Readiness Review (OTRR) through the conclusion of the OA, to include associated training support and continued RMF accreditation activities.

Operational Test Readiness Review The Contractor shall provide no more than three no less than one SME for one day to support the Government during the OTRR for the OA. The OTRR may occur at APG, or remotely, about, five business days prior to the

OA.

Operational Assessment The purpose of the OA is to test the proposed Intel Apps software against some or all requirements in PRD and related measures of performance, and, to assess the Contractor’s ASII software’s effectiveness, suitability, and survivability. The OA may also solicit User feedback on system usability, contribution to mission accomplishment, and may assess cybersecurity. The OA will be conducted at a location designated by the Government. Testing will be conducted by the Army Test and Evaluation Command (ATEC) and may be supported by Forces Command (FORSCOM), INSCOM, and TRADOC. The OA is not expected to exceed six weeks from set-up through teardown. The Government will provide email notification to the Contractor about 15 business days prior to the start of OA. With this notification, the Contracting Officer will provide the Contractor a schedule that will include training dates, a test plan, and schedule of test events identifying the timeframes that the Contractor’s System will be tested. The Government will have final discretion in determining the most efficient test sequence to meet the overall schedule. The Contractor shall deliver the number of test licenses with all applicable licenses listed in Table 8 for the OA, after receipt of order IAW CDRL A001. The Contractor shall deliver their software to the location designated in the order. The Software shall be loaded by each Contractor onto the Government designated hardware/infrastructure (e.g., CPCE TSI).

No software changes to the system under test will be allowed upon receipt by the Government. During testing, official TIRs will be prepared to document all anomalies and system failures identified by the Government. The result(s) of the TIRs will be Government Work Products. Also, any input and output data (to include any data residing/existing in the software) resulted from the Government’s input data will be Government work product.

The Contractor shall copy and provide all of the existing data in the software to the Government in a readable and usable format at the conclusion of the test if the Government is unable to export the data. The Government may or may not provide the Contractor with some or all the results following the conclusion of the event. The Government will decide on whether any TIRs result in a Priority 1-3 Software Problem Report (SPR), as defined in DA Pamphlet 73-1. The Contractor shall provide Instructor / Intel Analyst Training and Training Material prior to the OA test event. Training shall be provided in a classroom environment and the Contractor shall assume recipients of the training have no prior experience with the system. The training prior to the OA shall not exceed a total training time of 24 hours over 3 days per user group. User groups are not expected to exceed 20 people per group. The Government will assign a user group to the Contractor’s system. It is possible that the Government may rotate user groups among systems from all base contract holders and may provide the Contractor, to a reasonable extent, with equal access and feedback from user groups. Following the training, the Contractor will not be allowed access to the test site during testing unless accompanied by a Government Test Official. However, the Contractor will be provided a separate location in case support is needed during the event.

Operational Assessment Support The Contractor shall provide no more than five and not less than one Contractor on-site representatives to provide on-site training and test support for a period not to exceed six weeks for the OA. The Government is planning to execute the OA in conjunction with the CPCE Increment II schedule (tentatively scheduled 3Q FY23 as of April 2021), but the location is subject to change. The Contractor on-site representative(s) shall include the following.

a. Training Support: The Contractor on-site support shall provide system training for up to 20 users at a time. Training should be tailored to knowledge managers, maintainers, and operator/analysts. The Contractor shall be responsible for its training environment.

b. Initial System Set up: The Contractor on-site support shall provide support for initial set up of the Test platforms (e.g., CPCE TSI).

c. Operator/System Support: The Contactor on-site support shall provide support for any system or operator issues during the event. During the testing event, support shall remain in a separate building and not oversee or otherwise interfere with test conduct. The level of support and the location of support shall be at the discretion of the Government.

IA Support for Operational Assessment The Contractor shall continue to support all RMF activities including the Government’s Security Control Assessor (SCA) validation test and follow-on adjudications. The contractor shall support the SCA validation test, which is not expected to exceed one week, at the Contractor’s facility. The Contractor shall also support all follow-on adjudications because of the SCA validation test.

Operational Assessment Meetings The Contractor shall participate in a Pre-Operational Assessment (OA) meeting, approximately 15 business days prior to the OTRR to discuss and review readiness to begin the OA. The meeting will occur in the Aberdeen MD area, remotely, or at contractor’s location, if directed. The meeting is not expected to last more than two hours.

3.11 ASII Software

The ASII Software includes all activities leading up to and including the procurement of the separately priced software licenses (either term, perpetual, or term enterprise licenses), completion of fielding and the transition to sustainment of ASII, to include licensing, configuration management, DEVOPS, and program protection.

ASII Software Delivery The Contractor shall deliver the number of individual applicable software licenses to a Government designated location (e.g., CPCE TSI). Each license should support up to ten ASII users concurrently. A user (non-programmatic) is considered any person who has log in credentials and authorization to access and utilize the ASII application by using the Mission Command provided Active Directory. The Government will inform how many sites will need to host the Contractor’s ASII software at the individual order-level.

The ASII Intelligence Application shall provide “Support to Situational Understanding” via Intelligence Running Estimate and Threat COP. Sub-requirements are defined in the ASII Delivery Order PRD.

DEVOPS

The Contractor shall provide configuration changes; enrich data curation; improve data exploration; augment data modeling; and enhance data visualization in near-real-time based on mission need and Government direction. Configuration changes shall also include interoperability updates with external systems. Changes shall be incorporated into a monthly patch or at the Government’s discretion. The Contractor shall deliver an SVD with each configuration change, IAW CDRL A001.

Program Protection Implementation The Contractor shall implement Government specified Supply Chain Risk Management Countermeasures to safeguard Government identified CPI and Critical Components, as specified within the delivery order PRD.

3.12 Annual Sustainment

The Annual Sustainment activities include licensing, configuration management, maintenance, and RMF activities.

Annual Maintenance Upgrades The Contractor shall provide any updates to their ASII product software. In the case of follow-on re-accreditation of the ASII software, the Contractor shall support the activities outlined in sections 3.3, 3.4, and 3.5.

IA Support for Annual Sustainment The Contractor shall continue to support all RMF activities in addition to supporting the continued RMF activities needed to achieve/maintain an ATO.

The Contractor shall update and maintain all system artifact documentation and provide information to update and maintain the POA&M IAW CDRL B002 monthly. In the case of follow-on re-accreditation of the ASII, the Contractor shall support the activities outlined in sections 3.3, 3.4, and 3.5.

The Contractor shall release monthly security patches/releases to PM IS&A Configuration Management after receipt of order, IAW SOW Section 3.16, and CDRL C002.

Reach Back Support for Annual Sustainment The Contractor shall provide on-call subject matter expertise to support a reach back capability, for 500 hours per year, for each year of Annual Sustainment. The Contractor shall respond to any inquiries within 24 hours after first being reported.

The reach back support may be, but not limited to one or more of the following: live phone support or voicemail, email, or online portal.

3.13 Initial Integration Support

The Contractor shall deliver and install their ASII software product on the CPCE Platform affiliated with each of the security enclaves (SIPRNet, NIPRNet).

The Government may provide a commercial CPCE service platform for each of the two security enclaves (NIPR, SIPR). CPCE hosting may be a delivery mechanism for the ASII software, with an estimated user footprint of 20 concurrent users per enclave. The CPCE infrastructure may also host the geospatial data

(maps, imagery, etc.) that will be available to the ASII software. To communicate across security enclaves, ASII may have to work with a Government-provided Cross Domain Solution. Cross domain solutions facilitate the transfer of structured and unstructured data from one security enclave to another through either machine-to-machine exchanges or as part of a Human Review process.

The ASII software may also exist in a staging environment. Just like the production software of ASII, the primary staging environment may be served from the CPCE platform. The purpose of the staging environment is to test patches or new system configurations prior to applying to the production (fielded) system.

Warranties The Contractor shall warrant that the license grants the Government (and its service Contractors or covered Government support Contractors) the right to operate or use the software, the software and software code has been properly licensed from the licensor, and warrant no third-party restrictions or encumbrances exist that would impact this contract.

The Contractor will indemnify the Government from any third-party fees or costs arising either directly or indirectly from third party royalties, infringement, source…