Attachment 0001 - Intelligence Support to Targeting Statement of Work _01 December 2021.pdf

UNCLASSIFIED

STATEMENT OF WORK (SOW)

FOR

INTELLIGENCE SYSTEMS & ANALYTICS (IS&A)

INTELLIGENCE APPLICATIONS (INTEL APPS)

INTELLIGENCE SUPPORT TO TARGETING

Solicitation Number: W56KGY-22-R-0005

Base contract Statement of Work Indefinite Delivery Indefinite Quantity (IDIQ) Contract

Version 1.0

29 November 2021

Project Manager Intelligence Systems & Analytics 6580 Surveillance Loop, Building 6006 Aberdeen Proving Ground, MD 21005 ii

Contents

1. Scope

1.1 Background

2. Applicable Documents

3. Requirements

3.0 ISTT Programmatic

ISTT Programmatic Kickoff

3.1 ISTT Technical Test

ISTT Technical Test Preparation

ISTT Test Readiness Review (TRR)

ISTT Technical Test

ISTT Technical Test – Contractor Support

ISTT – Post Technical Test Meetings

Software Version Description (SVD)

Logistic Support for Technical Test

3.2 ISTT – Soldier Touch Point (STP)

Soldier Touch Point Preparation

Soldier Touch Point – Test Readiness Review (TRR) Support

Soldier Touch Point - Test

Soldier Touch Point – Test Support

Soldier Touch Point - Program Management and Meeting Support

Software Version Description (SVD)

Logistic Support for Soldier Touch Point

3.3 ISTT Program Protection

3.4 ISTT NIPRNet RMF Authorization

Cybersecurity Support

RMF Compliance

Cybersecurity Compliance

3.5 ISTT Secret RMF Authorization

Cybersecurity Support

RMF Compliance

Cybersecurity Compliance

Solicitation # W56KGY-22-R-0005 Statement of Work November 2021 iii

3.6 ISTT Functional Configuration Audit

3.7 ISTT Solution Army Interoperability Certification (AIC)

3.8 ISTT Solution Joint Interoperability Test Certification (JITC)

3.9 ISTT Solution Training

3.10 Operational Assessment (OA)

Operational Test Readiness Review

Operational Assessment

Operational Assessment Support

IA Support for Operational Assessment

Operational Assessment Meetings

3.11 ISTT Solution Software

ISTT Solution Delivery

DEVOPS

Program Protection Implementation

3.12 Annual Sustainment

Annual Maintenance Upgrades

IA Support for Annual Sustainment

Reach Back Support for Annual Sustainment

3.13 Initial Integration Support

Warranties

3.14 Configuration Management

Software Problem Report (SPR)

Monthly Security Patch/Release Delivery

Field-discovered SPRs

3.15 Engineering Change Proposals (ECP)

Contractor-proposed ISTT Modifications due to Enhancements, Obsolescence, and Major Software Releases

Government-proposed Enhancements and Modifications

3.16 Exercise Support

Warranty Patch/Release Delivery iv

3.17 Army Contractor Manpower Reporting (CMR) System

3.18 Licensing

Technical Test Licensing

Soldier Touch Point (STP) Licenses

Operational Assessment (OA) Licenses

4. Contract Deliverables

4.1 Assurance Warranties

List of Tables Table 1. Program Documents

Table 2. Department of Defense Directives

Table 3. Department of Defense Instructions

Table 4. Army Regulations (AR)

Table 5. Other Documents

Table 6. Technical Test Asset List

Table 7. Soldier Touch Point Asset List

Table 8. Operational Assessment Asset List

1. Scope The contractor shall provide a commercial item that is a software-only solution to meet the Intelligence Support to Targeting (also known as ISTT) capability that serves to capture multiple intelligence support to targeting doctrinal attributes with a digital matrix and a digital visualization tool, enabling the intelligence user to track High Payoff Targeting (HPT) activities within a single view as applied to a given Army operation.

1.1 Background

PM IS&A is a Family of Systems that provides our Army with advanced analytics, support to targeting and situational understanding to commanders. It processes, exploits, and disseminates information and intelligence about the threat, weather, and terrain and provides tactical and operational ground stations that downlink data from national, joint partners and Army sensors. As technology evolves and new warfighting requirements emerge, the PM’s capability set needs to be updated to meet the user needs.

The ISTT requirements address the need to modernize and enhance the capabilities of Army’s intelligence at the tactical echelons. The contractor’s solution shall meet the capabilities called out in the Performance Requirements Documentation (PRD). The PRD may be tailored as applicable at the delivery order level. The Contractor’s ISTT software is intended to be hosted in the Command Post Computing Environment (CPCE) Tactical Server Infrastructure (TSI).

The ISTT capability shall align with multiple overarching directives, to include the Army’s Common Operating Environment (COE). The ISTT shall support net-centric military operations by being interoperable with current Army, Unified Action Partners, Joint Service, Allied, Coalition, and Command and Control information and ISR systems. ISTT shall operate across the Secure Internet Protocol Router Network (SIPRNet), Secret Coalition Networks, and Unclassified security domains, and within and across all COE computing environments.

The PM IS&A ISTT Intel Application will continue to contribute to visualization and situational awareness, maximizing combat power and enhancing the ability to operate in an unpredictable and changing environment throughout the operational spectrum. This application serves to capture multiple intelligence support to targeting doctrinal attributes with a digital matrix and a digital visualization tool, enabling the intelligence user to track HPT targeting activities within a single view as applied to a given Army operation.

2. Applicable Documents The following documents are applicable to this SOW.

Table 1. Program Documents Number Title Date

Performance Requirements Document (PRD) 23 November 2021

Table 2. Department of Defense Directives Number Title Date

DoD 5220.22-M National Industrial Security Program Operating Manual 28 February 2006 DoDD 8570.01 Information Assurance (IA) Training, Certification and Workforce

Management 15 August 2004

DoD 8570.01-M Information Assurance Workforce Improvement Program, Change 4 19 December 2005 w/ change 10 November

DoDD 8140.01 Cyberspace Workforce Management 11 August 2015 DoDI 4140.67 DoD Counterfeit Prevention Policy 26 April 2013 DoDI 4140.01 DoD Supply Chain Materiel Management Policy 14 December 2011

Number Title Date DoDI 8582.01 Security of Unclassified DoD Information on Non-DoD Information

Systems 6 June 2012

DoDI 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN)

5 November 2012

Table 3. Department of Defense Instructions Number Title Date

DoDI 3020.41 Operational Contract Support 20 December 2011 DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology 12 March 2014

Table 4. Army Regulations (AR) Number Title Date

AR 25-1 Army Information Technology 25 June 2013 AR 25-2 Information Assurance 4 April 2019 AR 70-1 Army Acquisition Policy 16 June 2017 AR 73-1 Test and Evaluation Policy 16 November 2016 AR 530-1 Operations Security 26 September 2014 AR 380-67 Personnel Security Program 24 January 2014 AR 381-12 Threat Awareness and Reporting Program (TARP) 01 June 2016 AR 70-77 Program Protection 08 June 2018 DA PAM 25-1-2 Information Technology Contingency Planning 06 June 2012

Table 5. Other Documents Number Title Date

JP 3-60 Joint Targeting 28 September 2018 JP 2.01.3 Joint Intelligence Preparation of the Operational Environment 16 June 2009 ATP 3-60 Army Technical Publication 7 May 2019 ATP 2.01.3 Intelligence Preparation of the Battlefield 1 March 2009 ATP 2-33.4 Intelligence Analysis 10 January 2020 ATP 3-34.80 Geospatial Engineering 22 February 2017 ATP 3-12.3 Electronic Warfare Techniques 16 July 2019 FM 2-0 Field Manual – Intelligence 6 July 2018 FM 100-61 Army and Mechanized-based Opposing Force – Chapter 7 C2 27 January 1998 (inactive) ADP 2-0 Army Doctrine Publication – Intelligence 31 July 2019 ADP 5-0 The Operations Process 31 July 2019 ADRP 1-03 The Army Universal Task List October 2015 CJCSI 3162.02 Methodology for Combat Assessment 8 March 2019 CJCSI 3370.01C Target Development Standards 2019 (limited mil/gov only)

3. Requirements This SOW addresses all products, support, and activities that shall be required throughout the period of performance for the IDIQ Contract. The Contractor shall provide all the necessary resources and knowledge to support the listed products, support, and activities.

The goal of this SOW and the applicable/referenced documents is to detail and implement commercial item solutions that will satisfy the Government’s requirements. The following requirements will be issued at the order level to establish the most viable commercial item solution(s) to meet the Government’s requirements.

The Government has provided Government Furnished Information (GFI) (Attachment 0006). Its purpose is to provide a reference to the data and interfaces used by the government. Any changes to the GFI will be accomplished via contract modification.

3.0 ISTT Programmatic

The Contractor shall designate a program manager with responsibility to plan, manage, and direct the successful and final completion of the requirements of this SOW. The Contractor’s program manager shall be the single focal point of contact for all required programmatic requirements and work directly with the Government.

ISTT Programmatic Kickoff The Contractor shall participate in a Government-run program kickoff event no later than ten (10) business days after receipt of order. The meeting is expected to run between two (2) to four (4) hours and will be conducted either at Aberdeen Proving Ground (APG), or remotely.

3.1 ISTT Technical Test

The Contractor shall provide all necessary software licenses, materials, and incidental support required to execute an ISTT Technical Test as detailed in the below paragraphs. This section shall include all analyst activities to include the ISTT Technical Test Preparation, ISTT Technical Test Support, the ISTT Technical Test Readiness Reviews (TRR), information assurance activities, and the actual performance of the ISTT Technical Test event.

The Contractor shall provide Cyber Security support through the following activities: Cooperative Vulnerability Identification, Adversarial Cybersecurity Developmental Test & Evaluation (AC DT&E), Cyber Vulnerability and Penetration Assessment, and Adversarial Assessment (AA). To save on cost and travel, the Government may elect to conduct these activities at the Technical Test(s), STP(s), and/or the OA:

• Cooperative Vulnerability Identification – blue team assessment – Army Research Laboratory Survivability and Lethality Analysis Directorate (ARL SLAD) in technical environment

ISTT Technical Test Preparation The Government will inform the contractor approximately four (4) weeks before the commencement of the ISTT Technical Test. During that time, the Contractor can modify and/or tailor its commercial solution as necessary. The goal is for the Contractor’s solution to successfully meet the Government’s requirements identified within the PRD incorporated in Section J of the base contract. The Government will provide a representative test environment, such as an environment hosted on hardware, at either APG or at an operational site, such as the 82nd ABN DIV, Ft Bragg, NC for the test event. That environment will be made available in advance of the testing for Contractor system setup and configuration, integration, test, and training.

ISTT Test Readiness Review Approximately ten (10) business days prior to the ISTT Technical Test Readiness Review, the Contractor shall participate in a Pre-Test meeting to discuss the test plan details and activities leading up to the ISTT Technical Test Readiness Review and the actual ISTT Technical Test. At the Government’s discretion, the meeting will be held either in person or remotely.

ISTT Technical Test The purpose of each ISTT Technical Test is to test the Contractor’s commercial ISTT solution to the system requirements. The Government may provide decomposed requirements, measures of performance, and technical performance measures to support the testing and evaluation. The first ISTT Technical Test will be conducted in a Government-provided hardware environment at Aberdeen, MD. Any further Technical Test(s) will be conducted at either APG, at other Government locations, or at a facility aligned to a military base, such as the 82nd ABN DIV, Ft Bragg, NC. Testing will be conducted by PM IS&A, or other Government authority.

The location of the Technical Test will be specified at the contract kickoff meeting. During the Technical Test, the software shall demonstrate its ability to meet the specified SOW and PRD requirements. The ISTT Technical Test (with contractor analyst support) may also include cybersecurity testing of the Contractor’s software. The Contractor will be provided the test location of Technical Test #2 within sixty (60) days to allow proper planning.

The time frame for each ISTT Technical Test is not-to-exceed (NTE) three (3) weeks overall, from set-up through teardown.

The Government will provide email notification to the Contractor no later than fifteen (15) business days prior to the start of each ISTT Technical Test. With this notification, the Government will provide a schedule that will include training dates, a test plan, and schedule of test events defining the specific timeframes for the application to be tested. The Government will have final discretion in determining the most efficient test sequence to meet the overall schedule. The Government’s test plan will include processes and resources to use during test conditions.

No software changes to the system under test will be allowed once testing has begun unless approved in writing by the Government Task Lead or Intel Apps Chief Engineer.

During testing, the Government may provide official Test Incident Reports (TIRs) to document anomalies and system failures identified by the Government. The Contractor may be provided TIRs during or at the conclusion of the event. The Government will decide on whether any TIRs result in a Priority 1-3 SPR, as defined in DA Pamphlet 73-1, Figure Q-31. The final delivered software shall contain no Priority 1-2 SPRs.

The Government will assign a user group to the Contractor’s system. It is possible that the Government may rotate user groups among systems from all base contract holders and may provide the Contractor, to a reasonable extent, with equal access and feedback from user groups.

ISTT Technical Test – Contractor Support The Contractor shall provide at least one (1) and no more than five (5) personnel for onsite test support for a maximum three (3) weeks per Technical Test. The Contractor onsite representative(s) shall include:

• Operator Support: The Contractor onsite support shall provide support for system operation / issues and troubleshooting throughout the ISTT Technical Test.

• System Configuration: The Contractor onsite support shall provide support for initial set up for the systems.

ISTT – Post Technical Test Meetings The Contractor shall participate in a Post-Performance Test meeting within five (5) business days after the completion of the Technical Test to allow the Government to provide the information collected from the ISTT Technical Test.

At the Government’s direction, all meetings will occur in the Aberdeen, MD area, remotely, or at the contractor’s location. The Contractor shall have maximum flexibility to assign the appropriate technical expertise to participate.

Software Version Description The Contractor shall be responsible for delivering an initial version of the Software Version Description (SVD) document in accordance with (IAW) CDRL A001. The Contractor shall deliver an SVD with each software deliverable to include monthly security patch/release deliveries and Development Operations updates, IAW

CDRL A001.

Logistic Support for Technical Test The Contractor shall be responsible for the maintenance and sustainment of software solutions participating in the ISTT Technical Test. This requirement is limited to those assets the Contractor has delivered in support of the ISTT Technical Test. The Contractor shall fix or replace any inoperable software it delivered to participate in the Intel Technical Test.

3.2 ISTT – Soldier Touch Point (STP)

The Contractor shall provide all necessary software licenses, materials, and incidental support required to execute a Government-run STP as detailed in the below paragraphs. This section shall include all activities to include the actual STP.

Soldier Touch Point Preparation The Government will notify the Contractor sixty (60) days in advance of a planned STP test event.

The Government will then allow four (4) weeks to prepare for the actual event test event.

During that four (4) weeks, the Contractor can modify and/or tailor its solution as necessary.

The goal is for the Contractor’s solution to successfully meet the Government’s requirements identified within the PRD. The Government will provide a representative environment at a Government facility/location, using Government-provided hardware, to be used for system setup, configuration, integration, test, and training.

Soldier Touch Point – Test Readiness Review Support Ten (10) business days prior to the STP – Test Readiness Review, the Contractor shall participate in a Pre- STP meeting, either in person or remotely, to discuss the test plan details and activities leading up to the STP Test Readiness Review and Test. The meeting is not expected to last more than two (2) hours.

Soldier Touch Point-Test The purpose of each STP is to test the proposed ISTT Intel App software to the requirements and solicit User feedback on system usability. The STP may be conducted in the Aberdeen, MD area, other Government locations, or at a facility aligned to a military base. There may be multiple such STP events.

Testing will be conducted by PM IS&A or by another Government authority. During a STP, the Contractor shall demonstrate its solution against the requirements defined in the applicable SOW and PRD. The Government will discuss any findings with the Contractor.

The time frame for each STP is NTE three (3) weeks overall, from set-up through teardown. This does not include the preparation time discussed in SOW para. 3.2.1.

No software changes to the system under test will be allowed once testing has begun, unless approved by the Government in a digitally signed email by the Government Task Lead or Intel Apps Chief Engineer. During testing, the Government may provide official TIRs to document anomalies and system failures identified by the Government. Contractor may be provided TIRs during or at the conclusion of the event. The Government will decide on whether any TIRs result in a Priority 1-3 SPR, as defined in DA Pamphlet 73-1, Figure Q-31. The final delivered software shall contain no Priority 1-2 SPRs. The Contractor shall provide User Training Material prior to the event. Training shall be conducted in a classroom environment and the Contractor shall assume recipients of the training have no prior experience with the Contractor’s system. Training during the STP should be divided into blocks and the Contractor is encouraged to utilize a “train-exercise-train” methodology.

However, the combination of all training shall not exceed twenty-four (24) hours over three (3) consecutive business days per user group. User groups shall not exceed twenty (20) people per group. The Contractor shall be responsible for proving its own training resources, such as laptops, software, and instructor(s) for its training activity.

Soldier Touch Point – Test Support The Contractor shall provide at least one (1) and no more than five (5) personnel for onsite test support for a maximum of three (3) weeks per STP Test. The Contractor onsite representative(s) shall include:

• Operator Support: The Contractor onsite support shall provide support for system operation / issues and troubleshooting throughout the Analytics and Tools Performance Test.

• System Configuration: The Contractor onsite support shall provide support for initial set up for the systems.

Soldier Touch Point - Program Management and Meeting Support The Contractor shall participate in a post-STP meeting within five (5) business days after the completion of STP to allow the Government to provide the information collected from the STP. All meetings will occur in the Aberdeen, MD area, remotely, or at the contractor’s location, if directed. The meetings will last no longer than two (2) hours.

Software Version Description (SVD) The Contractor shall be responsible for delivering an initial version of the SVD document after receipt of order IAW CDRL A001, and at the time of each of the RMF self-assessment artifacts IAW paragraphs 3.4.1.1 and

3.5.1.1. The Contractor shall deliver an SVD with each software deliverable to include monthly security patch/release deliveries, IAW CDRL A001.

(See CDRL DI-IPSC-81442A, A001)

Logistic Support for Soldier Touch Point The Contractor shall be responsible for the maintenance and sustainment of software solutions participating in the ISTT STP. This requirement is limited to those assets the Contractor has delivered in support of the ISTT STP. The Contractor shall fix or replace any inoperable software it delivered to participate in the Intel Application ISTT STP.

3.3 ISTT Program Protection

The Contractor shall perform the below tasks as described and shall flow down to any subcontractors engaged by the Contractor.

a) During the program kickoff meeting, SOW Section 3.0.1, the Contractor shall assist and support the Government in performing a Critical Functional Analysis and Critical Program Information (CPI) Assessment on the vendor solution to identify Critical Components and CPI.

b) During the Functional Configuration Audit, SOW Section 3.6, the Contractor shall assist the Government to develop, document and update required software assurance activities per Table 8 provided in the Defense Acquisition Guidebook, Chapter 9, Program Protection Plan, Section 9-3.2.5.

Note: P is for planned and A is for actual.

c) During the Functional Configuration Audit, SOW Section 3.6, the Contractor shall provide the Government with visibility into the supply chain for Critical Components, and the contractor shall describe how supply chain risk can be introduced through those Critical Components, and describe how the contractor has implemented or plans to implement countermeasures to mitigate such risks.

The Government will either approve, modify, or add additional countermeasures.

d) The Contractor shall provide a Program Protection Implementation Plan to the Government with initial delivery of ISTT solution as part of SOW Section 3.11.3 ISTT Solution Software and provide reports to the Government IAW CDRL DI-ADMN-81306, E001.

3.4 ISTT NIPRNet RMF Authorization

The ISTT Solution Software includes all activities leading up to and including the procurement of the separately priced software solutions, completion of fielding and the transition to sustainment, to include training support, licensing, configuration management, and RMF activities.

Cybersecurity Support The Contractor shall support and participate in NIPRNet authorization process and cybersecurity testing. The Contractor shall provide support for the RMF self-assessment.

3.4.1.1 RMF Self-Assessment Support

The Contractor shall provide self-assessment support to include but not limited to providing system artifacts and documentation, completing and providing Assured Compliance Assessment Solution (ACAS) vulnerability scans, complying with security controls IAW Categorization and Control Selection Systems (CNSSI 1253), and assisting in developing Plan of Actions & Milestones (POA&M) to meet RMF security control requirements. The Government will provide or make available to the Contractor the required security tools needed for RMF compliance activities.

The Contractor shall deliver the following system artifact documentation no later than fifteen (15) business days after receipt of order IAW CDRL B002 MGMT-82001 DOD RMF Package Deliverables:

• Software Version Description, CDRL A001

• Software User Manual, CDRL A002

• Security Plan, CDRL B002 o System Architecture Description o Components o Configurations o Accreditation/Authorization Boundaries o Compliant Network Diagrams o External Interfaces and Data Flow o Internal Data Flow o Contingency Plan (to include backup/restore/recovery procedures) o Incident Response Plan o Hardware Lists (NETCOM HW/SW Template) o Software/Firmware Lists o Ports, Protocols, and Services o Configuration Management Plan o Information Assurance Vulnerability Management (IAVM) Plan o RMF Implementation Plan

• Cybersecurity Test Plan, CDRL B002 o Required Vulnerability Scans-ACAS o Security Technical Implementation Guides (STIGs) o Security Readiness Guides o Secure Content Automation Protocol benchmarks

• POA&M, CDRL B002

• Software User Manuals, CDRL A002

• Administrator Manuals/Guides

• Operations Security Plan, CDRL B001

• Configuration Management Implementation Plan

• Maintenance Implementation Plan

• Audit and Accountability Implementation Plan

• System and Information Integrity Implementation Plan

• Identification and Authentication Implementation Plan

• Access Control Implementation Plan

• System and Services Acquisition Implementation Plan

• System and Communications Protection

• Media Protection Implementation Plan

• Incident Response Plan

• System Training Plans & Guides

• FSE Guides

• Testing and Evaluation Plan (security assessment, regression, flaw remediation)

• Secure configuration, installation, operation, and maintenance procedures

• Anti-counterfeit Implementation Procedures

• Supply Chain Protection Implementation Plan

• Controlled Unclassified Information Implementation Plan

(See CDRL, B002, DI-MGMT-82001, & A001, DI-IPSC-81442A) The Contractor shall comply with all applicable technical, procedural, and system documentation associated with Federal, Department of Defense (DoD), and Army Cybersecurity policy and requirements, including but not limited to the following.

a. Provide system information at the component level including security concepts and procedures and all system component user and maintenance manuals to the security engineering team after receipt of order, IAW CDRL B002. This system information shall become the baseline system configuration.

b. Provide system administration, access, and engineering support to the System Engineering team and installation management personnel from self-assessment activities through final system acceptance.

c. Provide system information and security assistance to the Security Control Assessor (SCA) team to support the RMF Authorizing Official’s (RMF AO) authorization decision process.

d. Provide a copy of complete system documentation including component manuals, configuration guides, administration guides, user guides, and any system unique documentation after receipt of order, IAW CDRL B002 Information System documentation shall describe secure configuration, installation, and operation of the system, component, or service; the application of information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

e. The Contractor shall provide vulnerability scans and deliver ACAS results to the Government, comply with security controls, and apply Defense Information Systems Agency (DISA) STIGs. Also, the Contractor shall assist the Government in developing the POA&M to meet RMF requirements.

RMF Compliance The Contractor shall perform cybersecurity assessment and authorization activities IAW DoDI 8510.01 RMF for DoD Information Technology and CNSSI 1253 Security Categorization and Control Selection for National Security Systems. During the early stage of RMF process, the Contractor’s system will be assessed for categorization for Confidentiality, Integrity, and Availability (CIA) impact levels and applicable security controls will be identified. The Contractor shall enable their solution to meet the requirements from the security controls by applying the required DISA STIGs which are applicable to the system. All applicable security controls identified in the CNSSI 1253 publication and STIGs shall be assessed to ensure security controls and STIGS are examined, and tested, ensuring authorization decision requirements are addressed.

The Contractor shall provide cybersecurity control artifacts that are compliant with the CNSSI 1253 publication.

No tools are authorized for generation of artifacts except those posted to the Army OIA&C site or Knowledge Service (KS) site. Artifacts provided must meet the requirements of Army and DoD guidance IAW CDRL B002.

Cybersecurity Compliance The ISTT Solution shall meet all applicable security control requirements so that an Authorization to Operate (ATO) can be obtained. Once an authorization decision has been obtained, the Contractor shall continue to sustain the security posture of the system baseline to maintain the compliance of the ATO requirement. The Contractor shall maintain an IAVM patching process at least monthly to support Command Cyber Readiness Inspection (CCRI) compliance.

3.5 ISTT Secret RMF Authorization

The ISTT Solution Software includes all activities leading up to and including the procurement of the separately priced software solutions, completion of fielding and the transition to sustainment to include training support, licensing, configuration management, and RMF activities.

Cybersecurity Support The Contractor shall support and participate in Secret authorization process and cybersecurity testing. The Contractor shall provide support for the RMF self-assessment.

3.5.1.1 RMF Self-Assessment Support

The Contractor shall provide self-assessment support to include but not limited to providing system artifact documentation, completing, and providing ACAS vulnerability scans, complying with security controls IAW CNSSI 1253, and assisting in developing POA&M to meet RMF security control requirements. The Government will provide or make available to the Contractor the required security tools needed for RMF activities.

The Contractor shall deliver the following system artifact documentation via SIPRNet no later than fifteen (15)business days after receipt of order IAW CDRL B002 (DI-MGMT-82001) DOD RMF Package Deliverables:

• Software Version Description, CDRL A001

• Software User Manual, CDRL A002

• Security Plan, CDRL B002 o System Architecture Description o Components o Configurations o Accreditation/Authorization Boundaries o Compliant Network Diagrams o External Interfaces and Data Flow o Internal Data Flow o Contingency Plan (to include backup/restore/recovery procedures) o Incident Response Plan o Hardware Lists (NETCOM HW/SW Template) o Software/Firmware Lists o Ports, Protocols, and Services o Configuration Management Plan o IAVM Plan o RMF Implementation Plan

• Cybersecurity Test Plan, CDRL B002 o Required Vulnerability Scans - ACAS o STIGs o Security Readiness Guides o Secure Content Automation Protocol benchmarks

• POA&M, CDRL B002

• Software User Manuals, CDRL A002

• Administrator Manuals/Guides

• Operations Security Plan, CDRL B001

• Configuration Management Implementation Plan

• Maintenance Implementation Plan

• Audit and Accountability Implementation Plan

• System and Information Integrity Implementation Plan

• Identification and Authentication Implementation Plan

• Access Control Implementation Plan

• System and Services Acquisition Implementation Plan

• System and Communications Protection

• Media Protection Implementation Plan

• Incident Response Plan

• System Training Plans & Guides

• FSE Guides

• Testing and Evaluation Plan (security assessment, regression, flaw remediation)

• Secure configuration, installation, operation, and maintenance procedures

• Anti-counterfeit Implementation Procedures

• Supply Chain Protection Implementation Plan

• Controlled Unclassified Information Implementation Plan

(See CDRL DI-MGMT-82001, B002, A001, DI-IPSC-81442A) The Contractor shall comply with all applicable technical, procedural, and system documentation associated with Federal, Department of Defense (DoD), and Army Cybersecurity policy and requirements, including but not limited to the following.

a. Provide system information at the component level including security concepts and procedures and all system component user and maintenance manuals to the security engineering team after receipt of order, IAW CDRL B002. This system information shall become the baseline system configuration.

b. Provide system administration, access, and engineering support to the System Engineering team and installation management personnel from self-assessment activities through final system acceptance.

c. Provide system information and security assistance to the SCA team to support the Authorizing Official’s (AO) authorization decision process.

d. Provide a copy of complete system documentation including component manuals, configuration guides, administration guides, user guides, and any system unique documentation after receipt of order, IAW CDRL B002. Information System documentation shall describe secure configuration, installation, and operation of the system, component, or service and the application of information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

The Contractor shall provide vulnerability scans and deliver ACAS results to the Government, comply with security controls, and apply DISA STIGs. Also, the Contractor shall assist the Government in developing the POA&M to meet RMF requirements.

RMF Compliance The Contractor shall perform cybersecurity accreditation IAW DoDI 8510.01 RMF for DoD Information Technology and CNSSI 1253 Security Categorization and Control Selection for National Security Systems.

During the early stage of RMF process, the Contractor’s system will be assessed for categorization for CIA impact levels and applicable security controls will be identified. The Contractor shall enable their solution to meet the requirements from the security controls by applying the required DISA STIGs which are applicable to the system. All applicable security controls identified in the CNSSI 1253 publication and STIGs shall be assessed to ensure security controls and STIGS are examined, and tested, ensuring authorization decision requirements are addressed.

The Contractor shall provide cybersecurity control artifacts that are compliant with the CNSSI 1253 publication.

No tools are authorized for generation of artifacts except those posted to the Army OIA&C site or KS site.

Artifacts provided must meet the requirements of Army and DoD guidance IAW B002.

Cybersecurity Compliance The ISTT II Solution shall meet all applicable security control requirements so that an ATO can be obtained.

Once an authorization decision has been obtained, the Contractor shall continue to sustain the security posture of the system baseline to maintain the compliance of the ATO requirement. The Contractor shall maintain IAVM patching process at least monthly to support CCRI compliance.

3.6 ISTT Functional Configuration Audit (FCA)

The Contractor shall provide no less than one (1) and no more than four (4) Subject Matter Experts (SMEs) to support the Government FCA, after receiving an order, for a duration not expected to exceed three (3) days.

This audit shall include, at a minimum, verification that the system complies with the applicable PRD requirements, incorporated within Section J of the contract. The FCA will occur in the Aberdeen, MD area, other designated Government location, or at the Contractor’s location, at the discretion of the Government. The FCA may involve testing and demonstrations of the Contractor’s software to verify compliance with requirements.

3.7 ISTT Solution Army Interoperability Certification (AIC)

The Contractor shall achieve an AIC. The Contractor shall provide system software (on a temporary basis), one (1) system operator, and one (1) cybersecurity person, who can be the same person, onsite for a duration not to exceed twelve (12) weeks for the AIC test event at the Central Technical Support Facility (CTSF) located at Fort Hood, TX. Activities for this event may include, but not limited to, system set-up, test operator training, AIC test plan review and coordination, general engineering services, Information Assurance scans, the Network Vulnerability Assessment (NVA), the cyber threat activity, and vulnerability and penetration assessments.

3.8 Paragraph 3.8 has intentionally been left blank.

Paragraph 3.8 is non-applicable to this Statement of Work

3.9 ISTT Solution Training

Upon direction by the government, the Contractor shall deliver a “train the trainer” course to support New Equipment Training (NET). The course shall not to exceed one (1) week in length and will support up to 20 personnel at the Contractor’s facility or Government location. The Contractor is expected to provide training for the Government’s fielding, training, and support personnel.

The Contractor shall provide after receipt of order ISTT NET materials, IAW DI-ILSS-80872 (CDRL F001), user manual, and administrator manual, IAW DI-IPSC-81443A (CDRL A002) and DI-MISC-80711A (CDRL C001).

New or updated NET materials and manuals will be provided whenever there are software changes that impact the user or administrator training. The NET materials and manuals may be in the vendor format, but it is suggested that the vendor be familiar with the tenants of Training & Doctrine Command (TRADOC) 350‐70 standard.

The Contractor shall conduct the “train the trainer” course as needed for additional training, with a maximum number of six (6) courses per year for the length of the delivery order.

3.10 Operational Assessment

The Contractor shall provide all necessary software licenses, materials, and support required to execute a Government-run OA as detailed in the below paragraphs. The Contractor shall provide support to the OA which includes all activities from pre-Operational Test Readiness Review through the conclusion of the OA, to include associated training support and continued RMF accreditation activities.

The Contractor shall provide Cyber Security support through the following activities: Cooperative Vulnerability Identification, Adversarial Cybersecurity (DT&E), Cyber Vulnerability and Penetration Assessment, and Adversarial Assessment (AA). To save on cost and travel, the Government may elect to conduct these activities at the Technical Test(s), Soldier Touch Point(s), and/or the OA.

• Adversarial Cybersecurity DT&E - red team assessment in technical environment

• Cyber Vulnerability and Penetration Assessment - blue team assessment in operational environment.

Soldiers using our system with cyber defenders protecting. Its cooperative so there will be no malicious attacks; blue team will work with S6 and Cyber Defender staff

• Adversarial Assessment- red team assessment in operational environment. Soldiers using our system with cyber defenders protecting. Not cooperative; there will be malicious attacks.

Operational Test Readiness Review The Contractor shall provide at least one (1) but not more than three (3) SMEs for one (1) day to support the Government during the Operational Test Readiness Review for the OA. The Operational Test Readiness Review will be held approximately five (5) days prior to the OA and may occur either at APG or remotely.

Operational Assessment The purpose of the OA is to test the proposed Intel Apps software against some or all requirements in PRD and related measures of performance, and to assess the Contractor’s ISTT software’s effectiveness, suitability, and survivability. The OA may also solicit user feedback on system usability, contribution to mission accomplishment, and may assess cybersecurity. The OA will be conducted at a location designated by the Government. Testing will be conducted by the Army Test and Evaluation Command (ATEC) and may be supported by Forces Command, INSCOM, and TRADOC. The OA is not expected to exceed six (6) weeks from set-up through teardown. The Government will provide email notification to the Contractor about fifteen

(15) business days prior to the start of OA. With this notification, the Contracting Officer will provide the Contractor a schedule that will include training dates, a test plan, and schedule of test events identifying the timeframes that the Contractor’s System will be tested. The Government will have final discretion in determining the most efficient test sequence to meet the overall schedule. The Contractor shall deliver the number of test licenses with all applicable licenses listed in Table 8 for the OA, after receipt of order IAW CDRL A001. The Contractor shall deliver their software to the location designated in the order. The Software shall be loaded by each Contractor onto the Government designated hardware/infrastructure (e.g., CPCE TSI).

No software changes to the system under test will be allowed upon receipt by the Government. During testing, official TIRs will be prepared to document all anomalies and system failures identified by the Government. The Government may provide the Contractor with some or all the results following the conclusion of the event. The Government will decide on whether any TIRs result in a Priority 1-3 SPR, as defined in DA Pamphlet 73-1. The Contractor shall provide Instructor / Intel Analyst Training and Training Material prior to the OA test event.

Training shall be provided in a classroom environment and the Contractor shall assume recipients of the training have no prior experience with the system. The training prior to the OA shall not exceed a total training time of twenty-four (24) hours over three (3) days per user group. User groups are not expected to exceed twenty (20) people per group. The Government will assign a user group to the Contractor’s system. Following the training, the Contractor will not be allowed access to the test site during testing unless accompanied by a Government test official. However, the Contractor will be provided a separate location in case support is needed during the event.

Operational Assessment Support The Contractor shall provide at least one (1) but not more than five (5) personnel to provide onsite training and test support for a period not to exceed six (6) weeks for the OA. The Government is planning to execute the OA in conjunction with the CPCE Increment II schedule (tentatively scheduled 3QFY2023 as of April 2021), but the location is subject to change. The Contractor onsite representative(s) shall include the following.

a. Training Support: The Contractor onsite support shall provide system training for up to twelve (12) users at a time. Training should be tailored to knowledge managers, maintainers, and operator/analysts. The Contractor shall be responsible for its training environment.

b. Initial System Set up: The Contractor onsite support shall provide support for initial set up of the Test platforms (e.g., CPCE TSI).

c. Operator/System Support: The Contactor onsite support shall provide support for any system or operator issues during the event. During the testing event, support shall remain in a separate building and not oversee or otherwise interfere with test conduct. The level of support and the location of support shall be at the discretion of the Government.

IA Support for Operational Assessment The Contractor shall continue to support all RMF activities including the Government’s SCA validation test and follow-on adjudications. The contractor shall support the SCA validation test, which is not expected to exceed one (1) week, at the Contractor’s facility. The Contractor shall also support all follow-on adjudications because of the SCA validation test.

Operational Assessment Meetings The Contractor shall participate in a Pre-Operational Assessment meeting approximately fifteen (15) business days prior to the Operational Test Readiness Review to discuss and review readiness to begin the OA. The meeting will occur in the Aberdeen MD area, remotely, or at contractor’s location, if directed. The meeting is not expected to last more than two (2) hours.

3.11 ISTT Solution Software

The ISTT Solution Software includes all activities leading up to and including the procurement of the separately priced annual software solutions, completion of fielding and the transition to sustainment of ISTT, to include licensing, configuration management, and program protection.

ISTT Solution Delivery The Contractor shall deliver the number of individual software solutions with all applicable licenses to a Government designated location (e.g., CPCE TSI). Each license should support up to four (4) ISTT users concurrently. A user (non-programmatic) is considered any person who has log in credentials and authorization to access and utilize the ISTT application by using the Mission Command provided Active Directory. The Government will inform how many sites will need to host the Contractor’s ISTT solution at the individual order-level.

The ISTT Intelligence Application shall provide “Support to Situational Understanding” via Intelligence Running Estimate and Threat Common Operating Picture. Sub-requirements are defined in the ISTT Performance Requirement Document.

DEVOPS

The Contractor shall provide configuration changes, enhanced data visualization, and interoperability support.

Configuration changes shall also include interoperability updates with external systems. Changes shall be incorporated into a patch at the Government's discretion. The Contractor shall deliver an SVD with each configuration change, IAW CDRL A001.

Program Protection Implementation The Contractor shall implement Government specified Supply Chain Risk Management Countermeasures to safeguard Government identified CPI and Critical Components, as specified within the PRD.

3.12 Annual Sustainment

The Annual Sustainment activities include licensing, configuration management, maintenance, and RMF activities.

Annual Maintenance Upgrades The Contractor shall provide any updates to their ISTT product software. In the case of follow-on re-accreditation of the ISTT software, the Contractor shall support the activities outlined in sections 3.3, 3.4, and 3.5.

Information Awareness Support for Annual Sustainment The Contractor shall continue to support all RMF activities in addition to supporting the continued RMF activities needed to achieve/maintain an ATO.

The Contractor shall update and maintain all system artifact documentation and provide information to update and maintain the POA&M IAW CDRL B002 monthly. In the case of follow-on re-accreditation of the ISTT, the Contractor shall support the activities outlined in sections 3.3, 3.4, and 3.5.

The Contractor shall release monthly security patches/releases to PM IS&A Configuration Management after receipt of order, IAW SOW Section 3.1.6, and CDRL C002.

Reach Back Support for Annual Sustainment The Contractor shall provide on-call subject matter expertise to support a reach back capability for five-hundred (500) hours per year for each year of annual sustainment. The Contractor shall respond to any inquiries within twenty-four (24) hours after first being reported.

The reach back support may be, but not limited to, one (1) or more of the following: live phone support or voicemail, email, or online portal.

3.13 Initial Integration Support

The Contractor shall deliver and install their ISTT software product on the CPCE Platform affiliated with each of the security enclaves (SIPRNet, NIPRNet).

The Government may provide a commercial CPCE service platform for each of the two (2) security enclaves (NIPR, SIPR). CPCE hosting may be a delivery mechanism for the ISTT solution, with an estimated user footprint of four (4) concurrent users per enclave. The CPCE infrastructure may also host the geospatial data (maps, imagery, etc.) that will be available to the ISTT solution. To communicate across security enclaves, ISTT may have to work with a Government-provided Cross Domain Solution. Cross domain solutions facilitate the transfer of structured and unstructured data from one (1) security enclave to another through either machine-to-machine exchanges or as part of a Human Review process.

The ISTT solution may also exist in a staging environment. Just like the production solution of ISTT, the primary staging environment may be served from the CPCE platform. The purpose of the staging environment is to test patches or new system configurations prior to applying to the production (fielded) system.

Warranties The Contractor shall warrant that the license grants the Government (and its service Contractors or covered Government support Contractors) the right to operate or use the solution, the software and software code has been properly licensed from the licensor, and warrant no third-party restrictions or encumbrances exist that would impact this contract.

The Contractor will indemnify the Government from any third-party fees or costs arising either directly or indirectly from third party royalties, infringement, source code ownership, object code, trademark violations, open source or any other such potential violations for use of the software as outlined within the contract terms.

If full indemnification is not possible the Contractor will provide a summary of what is not indemnified, copies of assignments, declarations and documentation needed for the Government to assess the level of risk and impacts.

If the Contractor becomes aware of an infraction or impact to this contract due to a third-party agreement, the Contractor will provide written notice to the Government within thirty (30) days detailing the infraction and impact on the contract.

3.14 Configuration Management

The Government will designate a point of contact at the contract/delivery order kickoff meeting to whom CDRLs will be sent.

Software Problem Report (SPR) The Government and Contractor shall collect and analyze SPR during Technical Test(s), STPs, and OA(s).

SPRs shall include those software defects found during laboratory testing, Beta testing in the field,…