Attachment 0013 - PWS 13 Technology and Cybersecurity.docx

RADFORD ARMY AMMUNITION PLANT

PERFORMANCE WORK STATEMENT (PWS)

PWS 13: Contractor Operational Technology (OT), Integrated Information Technology (IT) and Process Control Systems Cybersecurity April 2026

1. Background

1.1. Radford Army Ammunition Plant (RFAAP) manufactures diverse energetics and propellants, including nitrocellulose and nitroglycerin, across integrated, multi-building production lines. These operations, alongside the generation and distribution of essential utilities—electricity, steam, water, and compressed air—are supported by an OT Network. This infrastructure encompasses Programmable Logic Controllers (PLCs), Supervisory Control and Data Acquisition (SCADA) systems, and Industrial Control Systems (ICS).

2. Scope

2.1. The Contractor shall maintain and execute a comprehensive cybersecurity program across the RFAAP OT and Production Control Network, encompassing all current and future production processes, utilities (power, steam, water treatment), and plant security systems. In adherence to Government and industry standards, the Contractor shall implement prescribed security controls, ensure timely incident reporting to the Government, and fully cooperate with Government-led cyber defense initiatives for RFAAP.

2.2. This PWS excludes support for all USG systems and external tenant networks residing at RFAAP. Prohibited support areas include, but are not limited to, the RFAAP Army Staff business network and tenant-operated networks such as Grucci or Acquisition, Logistics, and Technology Enterprise Systems and Services Support.

3. Applicable Documents or Citations

3.1. The Contractor shall perform all functions in accordance with (IAW) current federal, Army, and local regulations—specifically those referenced in Paragraph 4—utilizing commercial best practices where feasible. All services and supplies must comply with the Clinger-Cohen Act and Section 508 of the Rehabilitation Act (36 CFR Part 1194) accessibility standards. Essential publications are available via APD, ESD, and Cyber.mil. The Contractor shall promptly notify the Procuring Contracting Officer (PCO) of any regulatory updates or document changes impacting contract performance or cost.

3.2. All directly cited and referenced documents, including subsequent revisions, updates, or replacements, shall be contractually binding to the extent specified unless otherwise stated in the solicitation or contract modifications.

3.2.1. Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7008, Compliance with Safeguarding Covered Defense Information Controls, OCT 2016

3.2.2. DFARS 252.204-7009 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information, OCT 2016

3.2.3. Clinger-Cohen Act of 1996 also known as the “Information Technology Management Reform Act of 1996”

3.2.4. Privacy Act of 1974 (5 U.S.C. § 552a)

3.2.5. National Institute of Standards and Technology (NIST) 800-53 Rev 5, Security and Privacy Controls for Federal Information Systems and Organization

3.2.6. NIST 800-171 rev3, Protecting Controlled Unclassified Information in Nonfederal systems and Organization

3.2.7. NIST 800-82 Rev 3, Guide to ICS Security

4. Definitions

4.1. Adequate Security: Protective measures that are commensurate with the consequences and probability of loss, misuse or unauthorized access to or modification of the information, process or equipment.

4.2. Covered Contractor OT/IT system: OT or IT system (Hardware and/or Software) which is utilized in the execution or support of manufacturing and process control on behalf of the government at this site or technical information associated with said mission.

4.3. Process Control Network: Network, or network infrastructure on which covered OT/IT systems used in the execution or support of manufacturing logically and physically reside.

4.4. Technical Information: Technical data or computer software as those defined in DFARS 252.227-7013 “Rights in technical data – Noncommercial Items” regardless of whether the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

4.5. Cyber Incident: Actions taken with computer or process control networks that result in the compromise of or actual or potentially adverse effect on an OT/IT system and/or information/technical information therein.

4.6. Compromise: Disclosure of information to unauthorized persons, or a violation of the security policy of a system or network, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information/technical information to unauthorized media may have occurred.

4.7. Sanitization: Sanitization refers to a process that renders access to target data on the media infeasible for a given level of effort.

5. General Requirements

5.1. Cyber Awareness Training: All Contractor personnel holding an Army Common Access Card (CAC) with access to classified or unclassified Government information systems and networks shall successfully complete required Cybersecurity awareness training as specified in Army Regulation (AR) 25-2, Department of Defense (DoD) Directive 8140.01, DoD 8570.01-M, and as directed by the Government requiring activity prior to access being granted. Training is available at https://cs.signal.army.mil. All required Cybersecurity awareness training shall be taken upon work performance start date and annually thereafter, for the duration of this contract.

5.1.1. The Contractor shall maintain records of initial and annual refresher training. CAC-holding personnel shall register with the Army Validation System (AVS) to manage System Authorization Access Requests and IT User Agreements. Until a centralized Army system of record is operational, the Contractor shall track personnel training internally. For compliance monitoring, the Contractor shall upload all required DoD 8570.01-M certifications (baseline and computing environment), Continuing Professional Education credits, Cyber training certificates, and Acceptable Use Policies to AVS and provide them to the Government upon request.

5.2. Non-Government-Owned Computing Systems or Devices: IAW AR 25-1 and AR 25-2, the Contractor shall not connect non-Government-owned systems or devices to Government networks without prior authorization from the appropriate Information System Security Manager (ISSM) and Government software approval. This restriction applies to all Contractor-owned or personal hardware capable of storing data, including laptops, mobile devices, and all forms of removable storage media (e.g., Universal Serial Bus drives, external hard drives, or optical media).

5.3. In-Progress Reviews: The Contractor shall conduct monthly In-Progress Reviews (IPRs) to analyze system performance trends and forecast upcoming upgrades, deployments, and project workloads. To ensure effective coordination, the Contractor shall distribute a formal agenda at least two business days prior to each meeting and deliver comprehensive meeting minutes within one business day post-review. (CDRL A13-001)

5.4. Data and Software Rights: The Government maintains unlimited rights and exclusive ownership of all documents, materials, software source code, and data—including email, contact information, and calendar content—produced or generated under this contract. The Contractor is prohibited from using, repurposing, or selling these deliverables without express written permission from the Contracting Officer and shall ensure continuous Government access and download capabilities for all data to facilitate research, investigation, transfer, or system migration. The Government's rights in these technical data and software deliverables are governed by DFARS 252.227-7013, 252.227-7014, and 252.227-7015, as applicable.

5.5. Document Markings: The Contractor shall be prohibited from marking any deliverables under this PWS as "proprietary."

5.6. Safeguarding Covered Defense Information and Cyber Incident Reporting: The Contractor shall comply with DFARS 252-204-7012 for networks/ systems that process and or store government Controlled Unclassified Information (CUI) used in support of the mission at RFAAP. Refer to CUI Registry at http://www.archives.gov/cui/registry/category-list.html, for additional information on what information is CUI.

6. Specific Tasks / Technical Requirement

6.1. Operational Technology (OT)/Information Technology (IT) Cybersecurity Program and Team Execution: The Contractor shall establish, maintain, and mature a comprehensive OT/IT cybersecurity program utilizing NIST, ISO, and defense-in-depth standards. To execute this program, the Contractor shall provide a cross-functional team—comprised of IT staff, control engineers, system operators, and security Subject Matter Experts (SME)—capable of delivering onsite Cyber Security Service Provider (CSSP) services. This team shall leverage specialized expertise in secure network architecture and industrial control systems to perform continuous network management, near real-time incident handling, threat analysis, and vulnerability management.

6.2. Network Infrastructure and Air-Gap Compliance: The Contractor shall maintain a physically air-gapped, stand-alone Industrial Control Network strictly isolated from all corporate business and Government networks. Within this environment, the Contractor shall enforce separation standards across all modernization projects, close all unnecessary ports, configure outward-facing software to operate without external connections, and ensure any connecting devices comply with designated NIST controls. While the Contractor’s corporate business network must comply with DFARS 252.204-7012 and 252.204-7021, all costs associated with the corporate network are excluded from this PWS.

6.3. Security Categorization and Site Security Plan (SSP): The Government designates the Security Categorization for all applicable OT/IT systems as Moderate across Confidentiality, Integrity, and Availability (CIA) per CNSSI 1253. Within 60 calendar days of contract award, the Contractor shall develop and submit a comprehensive SSP (CDRL A13-002) utilizing NIST SP 800-82 Appendix G overlays. The SSP must be signed by the Plant Director and include risk assessments, interconnection agreements, contingency plans, and incident response plans.

6.3.1. Control Tailoring: The Contractor may tailor the baseline to meet organizational needs, provided all tailoring is risk-based, coordinated with the Government, and documented in the SSP. Controls shall not be tailored out due to resource constraints; any selected but unimplemented controls must be justified and tracked via a Plan of Action and Milestones (POA&M). If tailoring leaves residual risk, the Contractor shall implement and document supplemental compensating controls based on NIST SP 800-30 risk assessments. The SSP shall be updated annually or following any security incident and made available to DoD or Army assessors upon request.

6.3.2. Cyber Defensive Operations: The Contractor shall facilitate and support Government-led Cyber Defensive Operations and security assessments, including situational, emergency, and triennial Mission Assurance Assessments. This support requires the Contractor to grant government personnel full access to all OT, IT, and Contractor information systems operating within the mission footprint. Furthermore, the Contractor shall actively provide SME and operator input to assist with all audits, assessments, and defensive operations as required to validate and maintain the site's cybersecurity posture.

6.4. Configuration Management: The Contractor shall establish and maintain comprehensive system baselines, ensuring all hardware and software modifications are documented and authorized. To maintain security hygiene, any software that is no longer required or lacks proper documentation and accreditation shall be removed. Furthermore, the Contractor shall implement controls to prevent unauthorized personnel from installing or modifying hardware and software, ensuring the integrity of the configuration is preserved.

6.5. OT / IT System Component Inventory: The Contractor shall develop and maintain a comprehensive inventory of all OT/IT devices within the process control network, submitting the initial baseline within 90 days of contract award. The Contractor shall establish a maintenance program to ensure all new processes, equipment, and supported OT are inventoried and mapped within 14 days of installation. Consolidated inventory and mapping updates shall be delivered to the Government at the end of each calendar quarter to ensure continuous configuration oversight. (CDRL A13-003)

6.5.1. The inventory database shall be electronic Microsoft® Excel compatible and include, but not limited to:

6.5.2. Network Diagram and Maps: The Contractor shall maintain and update Purdue model diagrams and overall network schematics depicting the physical and logical location of every device on the process control network, including connections down to individual building PLCs. These diagrams must explicitly illustrate the physical separation between the process control network and all business networks used in mission processes. The Contractor shall implement a defined process for updating these maps whenever equipment is added or removed, ensuring these updates are synchronized with the device inventory process. The initial network diagram submission is required within 90 calendar days of contract award, with subsequent updates submitted quarterly. (CDRL A13-004)

6.6. Security Technical Implementation Guides & Security Requirement Guides: The Contractor shall configure and maintain all supported Government systems in strict accordance with Defense Information Systems Agency Security Technical Implementation Guides and Security Requirement Guides. The Contractor shall remediate non-compliant findings, provide verification documentation for random Government audits, and submit compliance results to the PCO and RFAAP ISSM quarterly or upon request. For findings unable to be immediately resolved, the Contractor shall coordinate mitigation strategies with the site ISSM and submit updated POA&Ms by the 6th of each month. (CDRL A13-005)

6.7. Process and Procedures Documentation: The Contractor shall document all PWS-related processes and procedures—distinct from Risk Management Framework (RMF) requirements—within a centralized document management system utilizing standardized naming conventions to ensure immediate and continuous availability to the Government. Additionally, the Contractor shall conduct bi-annual reviews of all documentation, maintain detailed change logs for any necessary updates, and provide the Government a summary report of all revisions upon completion of each review cycle upon request.

6.8. OT Process Control Separation (Airgap Network): The Contractor shall implement and maintain network configurations to ensure OT/IT process control networks remain physically air-gapped and isolated from all business or government networks, enforcing these separation standards across all future modernization projects. Within this environment, the Contractor shall close all unnecessary ports, configure outward-facing software to operate without connections, and ensure any connecting devices comply with Section 1.4 NIST controls. Additionally, the Contractor shall achieve 100% Information Assurance Vulnerability Alert (IAVA)/Common Vulnerabilities and Exposure (CVE) compliance by scheduling and installing required mitigations prior to Government suspense dates. The Contractor shall report compliance status and submit a POA&M by the suspense date for any mitigations that cannot be completed on time.

6.9. Security Patches / Updates: The Contractor shall implement security requirements, patches, and updates according to Government-mandated timelines, ensuring all devices maintain the latest software and firmware versions. For any requirement where compliance cannot be met by the mitigation date, including instances where testing identifies mission interference, the Contractor shall document the finding and submit a POA&M to the site ISSM and PCO by the suspense date. Additionally, the Contractor shall provide a monthly Patch Management Report (CDRL A13-006) by the 5th of each month, detailing all failed IAVA/CVE or vendor updates, failure descriptions, resolutions, and projected compliance dates for any outstanding items.

6.10. Incident Response and Forensics:

6.10.1. Reporting: The Contractor shall notify the RFAAP Commander and staff IT Specialist within 24 hours of discovering any cyber incident (IAW AR 25-2). The Contractor shall submit an unclassified report (CDRL A13-007) containing Defense Industrial Base Network-required elements, actions taken, and a person of contact. Incidents involving compromised CUI require DFARS 252.204-7012 reporting within 72 hours.

6.10.2. Evidence Preservation: Upon discovery, the Contractor shall preserve all affected OT/IT system images, logs, and packet captures for at least 90 days following report submission.

6.10.3. Forensics and Damage Assessment: The Contractor shall provide designated Government organizations with full access to equipment and information necessary to conduct forensic analysis. If the Government elects to conduct a damage assessment, the Contractor shall surrender all internally gathered incident data to the PCO upon request.

6.11. RMF Support: The Contractor shall assist the Government in preparing packages and risk assessments for the accreditation, re-accreditation, and continuous monitoring processes of RMF. This includes providing artifacts, documentation, and Enterprise Mission Assurance Support Service IAW AR 25-2, DoDI 8510.01, and NIST SP 800-53 (current revision as cited in Section 3).

6.12. System Disposal and Destruction: Within six months of contract award, the Contractor shall develop and implement a digital media disposal and destruction strategy, reviewing it annually. The strategy shall establish procedures for sanitizing, tracking, and verifying the destruction of all information system media, including periodic testing of sanitization equipment to ensure performance. The Contractor must ensure all digital media is fully destroyed or sanitized prior to disposal or reuse outside the organization to prevent unauthorized access.

6.13. Key Performance Indicators (KPI) and Tracking:

6.13.1. The Contractor shall track, measure, and report on cybersecurity KPIs to evaluate risk management and compliance posture. The Contractor shall submit a monthly Cybersecurity KPI Report (CDRL A13-008), with the initial submission due 60 days post-transition. The initial report shall define the calculation methods and establish performance targets (justified by industry standards or baseline data) for Government approval. If any KPI trends negatively or falls below the target for three consecutive months, the Contractor must submit a Corrective Action Plan detailing mitigation steps, timelines, and the personnel responsible for achieving the target.

6.13.2. Required KPI Categories:

6.13.2.1. Compliance: Adherence to NIST SP 800-53 (SSP/POA&M status, Audit, and Access Control), NIST SP 800-171 (SPRS DoD Assessment score, MFA utilization), and NIST SP 800-82 (OT network segmentation and risk assessments).

6.13.2.2. Incident Response: Mean Time to Detect and Mean Time to Resolve/Remediate.

6.13.2.3. Threat Prevention: Patch compliance rates, number of intrusion attempts blocked, identification of unauthorized/uncatalogued devices, and personnel security awareness training completion rates.

6.13.2.4. Operational Efficiency: Service Level Agreement compliance rates, specifically concerning CSSP (ARCYBER) coordination.

6.13.3. KPI Management: The initial report shall define the calculation methods and establish performance targets (justified by industry standards or baseline data) for Government approval. If any KPI trends negatively or falls below the target for three consecutive months, the Contractor must submit a Corrective Action Plan detailing mitigation steps, timelines, and the personnel responsible for achieving the target.

6.14. CSSP Personnel Certification and Organizational Accreditation: To support metric achievement and baseline compliance, all personnel working within the CSSP Security Operations Center (SOC) must hold and maintain role-specific baseline certifications IAW DoDI 8140 (formerly 8570). Furthermore, the Contractor shall ensure the subordinate SOC maintains formal organizational accreditation and an active Authority to Operate (ATO) from the designated DoD authority, including facilitating the required triennial reassessments.