Attachment 0014 - SECURITY STATEMENT OF WORK.pdf

STATEMENT OF WORK FOR

SECURITY REQUIREMENTS OF THE M782 MULTI-OPTION FUZE

C.1 SCOPE

This Statement of Work (SOW) defines the security requirements for the M782 MULT-OPTION FUZE FOR ARTILLERY (MOFA), and any variant thereof.

C.2 APPLICABLE DOCUMENTS

The following documents are applicable for this Statement of Work:

C.2.1 TECHNICAL DATA PACKAGE LIST

Number Title 12984952 MOFA Fuze M782

DTL12984952 Detail Specification for the Multi-Option, Fuze for Artillery, M782

C.2.2 OTHER DOCUMENTS

Number Title Date Department of Defense Controlled Unclassified Information (CUI) 6 Mar 21 (DoD) Instruction 5200.48

MOFA SCG Fuze, Multi-Option, Artillery, M782 and Variants 08 Apr 20 Security Classification Guide

DoD Manual 5200.01 DoD Information Security Program: Overview, 24 Feb 12

Classification, and Declassification

Army Regulation 530-1 Operations Security 26 Sep 14

C.3 REQUIREMENTS

C.3.1. SECURITY

The security classification level for this effort is SECRET. The Contractor shall have available, or have the ability to obtain, the resources and personnel capable of reviewing, analyzing, and processing classified information up to the required classification level in accordance with the contract DD Form 254 (DD254)

- Contract Security Classification Specification. All contractor personnel requiring access to classified information shall have a SECRET clearance. The Contractor shall be responsible for ensuring that all security related requirements are 'flowed down' to its subcontractor and requiring that those same subcontractors subsequently flow them down to their lower tier subcontractors.

C.3.1.2. CONTRACTOR FACILITY CLEARANCE

The Contractor shall obtain and maintain a Facility Clearance at the Secret level. The Contractor shall also have the capability to store classified materials/information at their facility. The Contractor shall comply with all security requirements as specified in this PWS, the DD Form 254, and applicable contract clauses. A copy of DD Form 254 issued a subcontractor must be provided to the PCO and/or COR (if any) and the certifying official identified in prime contract DD Form 254 within 5 days of issuance. The Contractor shall only hire U.S. citizens to perform work on this contract.

C.3.1.3. HANDLING OR ACCESS TO CLASSIFIED INFORMATION

Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to classified information and requires contractors to comply with - (1) The Security Agreement (DD Form 441), including the NISPOM (DoD 5220.22-M); any revisions to DoD 5220.22-M, notice of which has been furnished to the contractor. The Contractor shall support the Government in ensuring that all aspects of security are maintained on developmental systems during all activities including, but not limited to: field tests and evaluations, test site surveys, relevant test data maintenance and reductions and limited test site security and test site administration activities. A COMSEC account is required to ensure timely communication with the USG on classified topics.

C.3.1.4. THREAT AWARENESS AND REPORTING PROGRAM

For all contractors with security clearances: Per AR 381-12, Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2-4b.

C.3.1.5 Access to Potential Critical Program Information (PCPI)/ Critical Program Information (CPI): The contractor shall comply with the associated Interim Program Protection Plan (IPPP)/Program Protection Plan (PPP)/or Technology Protection Plan (TPP). The contractor shall comply with DOD, DA and AMC technology protection requirements in DODI 5200.39, AR 70-1, DA PAM 70-3 and AMC-R-380-13.

C.3.2. ANTI-TERRORISM TRAINING

All contractor employees requiring access to any Federally-controlled facility and logical access to Federally controlled information systems except for national security systems as defined by 44 U.S.C.

3542(b)(2), shall be certified in Level 1 Anti-Terrorism Training. The training is accessible from any computer with access to the World Wide Web and is available at https:/atlevel1.dtic.mil/at. The contractor is responsible for ensuring that the training has been satisfactorily completed within 30 calendar days after contract award and that valid certificates of completion have been submitted to the Contracting Officers Representative (COR) with a copy furnished to the Contracting Officer. The Certificates are valid for one year; therefore, training shall be completed every year for the duration of the contract.

C.3.3. ACCESS TO GOVERNMENT INFORMATION SYSTEMS

All contractor employees with access to a government information system shall be registered in the Army Training Certification Tracking System (ATCTS) at the commencement of any services, and shall successfully complete the DoD Information Assurance (IA) awareness training before issuance of network access and annually thereafter. ATCTS and associated IA training is accessed at the following website: https://atc.us.army.mil/iastar/index.php/.

All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six months of appointment to IA/IT functions. Per DoD 8570.01-M, DFARS 252.239.7001 and AR 25-2, the contractor employees supporting IA/IT functions shall be https://atc.us.army.mil/iastar/index.php/ appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

C.3.4. CONTROLLED UNCLASSIFIED INFORMATION (CUI)

Contractor employees shall require access to controlled unclassified information (CUI) in performance of this contract. Contractor personnel will follow all DoD (DoDI 5200.48) and Army policies regarding access to CUI, and the handling, storage, transmission, and destruction of CUI while working on this contract. Contractor employees are required to complete initial CUI training within 30 days of start of performance on the contract, and then annually thereafter. Proof of completion shall be provided to COR. Training is available at https://securityhub.usalearning.gov/index.html. All CUI that is electronically transmitted shall be done via encrypted channels, i.e. via a file encryption platform such as the DoD Safe Access File Exchange (SAFE) website (https://safe.apps.mil/) and/or the Encryption Wizard tool (http://spi.dod.mil/). Electronic files/data stored on removable media may also be exchanged via US postal service or other approved delivery service.

C.3.5. iWATCH TRAINING The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days after contract award and within 30 calendar days of new employees commencing performance. The contractor is responsible for ensuring that the training has been satisfactorily completed with the results reported to the COR.

C.3.6. OPERATIONS SECURITY (OPSEC) STANDARD OPERATING PROCEDURE PLAN

The contractor shall develop an OPSEC Standard Operating Procedure (SOP)/Plan within 90 days of contract award, to be reviewed and approved by the responsible Government OPSEC officer, per Army Regulation 530-1, Operations Security. This SOP/Plan will include the government’s critical information, why it needs to be protected, where it is located, who is responsible, and how to protect it. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator. The contractor will ensure that this individual becomes OPSEC Level II certified per Army Regulation 530-1. Per AR 530-1, Operations Security, new contractor employees must complete Level I OPSEC training within 30 calendar days of their reporting for duty. All contractor employees must complete annual OPSEC awareness training.

C.3.7. INFORMATION PROTECTION

Information or data developed under this contract is the property of the United States Army. All rights are reserved to the US Government. The contractor shall not distribute or use the information and data without the specific written approval of the Contracting Officer.

C.3.8. CONTROLLED TECHNICAL INFORMATION (CTI)

Contractor employees shall require access to controlled technical information (CTI) in performance of this contract. Contractor personnel will follow all DoD and Army policies regarding access to CTI, and the handling, storage, transmission, and destruction of CTI while working on this contract (DFARS 252.204-7012.

Information Subject to Export Control Laws/International Traffic in Arms Regulation (ITAR): Public Law 90-629, "Arms Export Control Act," as amended (22 U.S.C. 2751 et. seq.) requires that all unclassified technical data with military application may not be exported lawfully without an approval, authorization, or license under EO 12470 or the Arms Export Control Act and that such data require an approval, authorization, or license for export under EO 12470 or the Arms Export Control Act. For purposes of making this determination, the Militarily Critical Technologies List (MCTL) shall be used as general guidance. All documents determined to contain export controlled technical data will be marked with the following notice: WARNING – This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., and Sec 2751, et seq) or the Export Administration Act of 1979, as amended, Title 50, U.S.C., App. 2401 et seq. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.

C.3.9. PHYSICAL SECURITY

The contractor shall provide adequate physical, transportation and informational security of Government property including test hardware, weapons, ammunition, technical data and proprietary information. The contractor shall protect sensitive conventional arms, ammunition, and explosives (AA&E) manufactured for the government or provided as GFM/GFE and satisfy security standards requirements of DoD Directive 5100.76-M Physical Security of Sensitive Conventional Arms, Ammunition, and Explosives (AA&E).

C.3.10. SYSTEM SECURITY PLAN AND PLANS OF ACTION AND MILESTONES (SSP/POAM) REVIEWS

(a) Within thirty (30) days of contract award, unless otherwise notified by the Government, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the Contractor's facility. The SSP(s) shall describe how the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 security requirements are implemented as required by Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract, and identify all applicable Commercial and Government Entity Code codes affected. The Contractor shall fully cooperate in the Government's review of the SSPs at the Contractor's facility.

(b) If the Government determines that the SSP(s) does not adequately describe how the NIST SP 800-171 security requirements are implemented, then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a Plan of Action and Milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

(c) Upon conclusion of the correction period, the Government may conduct a follow on review of the SSP(s) at the Contractor's facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

(d) The Government may, in its sole discretion or in response to a cyber incident, conduct subsequent reviews at the Contractor's site to verify the information in the SSP(s). The Government may conduct reviews at any time upon thirty (30) days' notice to the Contractor.

C3.11. COMPLIANCE TO NIST SP 800-171

(a) The Contractor shall fully implement the Controlled Unclassified Information (CUI) Security Requirements (Requirements) in NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the Contracting Officer, or establish a SSP(s) and POAMs) that varies from NIST SP 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

(b) Notwithstanding the allowance for such variation, the Contractor shall identify in any SSP and POAM their plans to implement the following, at a minimum:

(1) Implement Requirement 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Requirement 3.1.5 (least privilege) and associated Requirements, and identify practices that the Contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Requirement 3.1.12 (monitoring and control remote access sessions)-Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods;

(4) Audit user privileges on at least an annual basis;

(5) Implement Requirement 3.13.11 (Federal Information Processing Standards (FIPS) 140-2 validated cryptology or implementation of National Security Agency- or NIST-approved algorithms (i.e., FIPS 140-2 Annex A: Advanced Encryption Standard (AES) Or Triple Data Encryption Standard (DES) or compensating controls as documented in a SSP and POAM));

(6) Implement Requirement 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which can be evaluated by the Government Program Manager for risk to the program;

(7) Implement Requirement 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

C.3.12. CYBER INCIDENT RESPONSE

(a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period in DFARS clause 252.204-7012 ), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact. Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes 2 Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/lnstructions_for_Submitting_Media.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

(b) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

C.3.13. ARMY COUNTERINTELLIGENCE (CL) OUTREACH

The Contractor shall engage, whenever practicable, with Army Cl industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting Army programs and technologies; and make Contractor personnel available for threat briefings specific to foreign intelligence threats to Army programs and technologies.

C.3.14. ARMY CL/INDUSTRY MONITORING

(a) In the event of a cyber-incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Army Cl, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor, or vendor logs that show network activity, including any additional logs the Contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

(b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor will coordinate with Army Cl to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by the Army Cl, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an Army Cl network device shall be the subject of a separate agreement negotiated between Army Cl and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by Army Cl. Use of this alternative approach shall also be the subject of a separate agreement negotiated between Army Cl and the Contractor.

(c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.