Attachment 02 Draft Data Software Services Statement of Work 09 Dec 22.pdf

PRE-DECISIONAL

STATEMENT OF WORK FA8806-23-R-0001

Attachment 2

Statement of Work (SOW) - Version 1

Multiple Award Indefinite Delivery Indefinite Quantity

Contract

For

(U)Data Software Services (DSS)

(U) United States Space Force (USSF)

(U) Space Systems Command (SSC)

(U) Space Domain Awareness & Combat Power (SDACP)/Battle Management Command, Control, &

Communications (BMC3) Program Offices

Contract:

FA8806-23-R-0001

Ordering Period:

1 April 2023 – 31 March 2028

Date:

09 December 2022

DRAFT COPY

Table of Contents

1. (U) Scope

2. (U) Deliverables

2.1 (U) Base Software Licenses

2.2 (U) Software Platform Installation and Management

2.3 (U) Data Connections, Ingestion, and Integration

2.4 (U) Product Configuration/Analytical Views

2.5 (U) User Training and Feedback Sessions

2.6 (U) Accreditation Support

2.7 (U) Briefings and Reporting

2.8 (U) Delivery Schedule

3. (U) Technical requirements

3.1 (U) Data Connection & Ingestion

3.2 (U) Data Quality

3.3 (U) Data Lineage

3.4 (U) Analytic Tools

3.5 (U) Open Architecture & Open Standards

3.6 (U) DevOps Tools

3.7 (U) Ontology Creation and Maintenance Tools

3.8 (U) Collaboration

3.9 (U) Security

3.10 (U) Network Operations Center & System Monitoring

3.11 (U) Highly Available Architecture

4. (U) Program Contract Deliverable Requirements List (CDRLs)

5. (U) Place of Performance

6. (U) Government Furnished Equipment (GFE) and Support

6.1 (U) Installation Access and Badging

6.2 (U) Data Access

6.3 (U) Network Access

6.4 (U) Hosting Environments

6.5 (U) Data Connection Agent

6.6 (U) Single Sign-On

6.7 (U) On-Site Space

6.8 (U) Personnel Security Clearances

6.9 (U) Data Transfer Officer Rights

6.10 (U) CDS Sponsorship

7. (U) Data Rights Assertion

8. (U) Ordering Period

9. (U) Basis Of Acceptance

1. (U) Scope

(U) This Statement of Work (SOW) is for a commercial solution with capabilities supporting a Data-as-a-Service (DaaS) platform. The government has transitioned to an agile approach toward software development to deliver advanced warfighter capabilities that require the aggregation of massive amounts of data from disparate sources and systems. The DaaS will assist the scaling of this effort by providing enterprise data storage and data management solutions capable of operating in secure environments and providing data products and advanced analytics to the broader space community.

(U) The scope of this effort includes Data-as-a-Service software offered by the contractor for the duration of the Ordering Period. Over the course of the project, the Contractor shall field their software in government-approved environments, connect to and integrate data from government- identified data sources into the DaaS, and deliver a dynamic ontology to model data for use within internal or external applications. Warfighters and third-party software development teams will be able to explore, transform, and analyze the data within the platform’s core tools as well as the platform’s Application Programming Interfaces (APIs) and application development tools.

(U) The Contractor shall provide software licenses, training, and support services to implement the DaaS as the integrated data environment for the project. The Contractor shall install, maintain, and configure the platform in Amazon Web Services (AWS) at the Unclassified, Secret, TS/SCI, and SAP levels.

(U) The commercial solution must have a DOD IL-5/6 provisional authorization or similar accreditation bodies of evidence that will enable expedited deployments and accreditation in support of rapidly emerging warfighter requirements. The Contractor shall work with the Government to accredit the solution using an Initial Authority to Test (IATT) and/or an Authority to Operate (ATO) on relevant Air Force networks over the course of the project.

2. (U) Deliverables

(U) The Contractor shall provide the Government with the following items over the course of the ordering period.

2.1 (U) Base Software Licenses

2.1.1 (U) The Contractor shall provide software licenses for the DaaS through a software as a service ( SaaS) delivery model where the contractor manages the cloud environments and is responsible for the ongoing maintenance on the, Unclassified, Secret, Top Secret/SCI and SAP Networks for data integrations and visualization configurations, provided pursuant to License delivery and upon Authority to Proceed (ATP).

2.2 (U) Software Platform Installation and Management

2.2.1 (U) The Contractor shall manage the setup and installation of the software platform in the government provided environments and be fully managed by the Contractor on contract award. Once the platform installation has concluded the Contractor will undergo a technical checkout to ensure all listed technical requirements have been met. The Contractor shall perform ongoing maintenance and regular patching of installed environments.

2.3 (U) Data Connections, Ingestion, and Integration

2.3.1 (U) The Contractor shall work with Government technical teams to establish data connections to source systems and configure the DaaS to ingest raw datasets into the platform. Datasets the contractor should have experience in rapidly ingesting may include:

2.3.1.1 Space Domain Awareness Data

2.3.1.2 Personnel Readiness Data

2.3.1.3 Combatant Command operational related Data

2.3.1.4 Equipment mission capability status

2.3.2 (U) The Contractor shall work with Government Subject Matter Experts to integrate datasets into a dynamic ontology for use throughout the platform.

2.4 (U) Product Configuration/Analytical Views

2.4.1 (U) The Contractor shall assist the Government to produce a consolidated set of ontology objects to users using out-of-the-box capability. The Contractor shall also assist the Government in configuring custom analytic views or web applications.

2.5 (U) User Training and Feedback Sessions

2.5.1 (U) The Contractor shall train systems administrators and users on successful operation of the DaaS solution.

2.5.2 (U) Training may be conducted in a classroom setting, over video teleconference, and/or side-by-side.

2.5.3 (U) Training shall include the ability to connect external applications to APIs as well as utilization of the platform’s analytic tools and application configuration tools. The cadence of training sessions shall be agreed upon during Sprint Planning.

2.5.4 (U) The Contractor shall be present for feedback sessions.

2.5.5 (U) The Contractor shall provide access to developer and user documentation.

2.5.6 (U) The Contractor shall provide in platform training aids that can be accomplished by the warfighter in a self-service manner.

2.5.7 (U) The Contractor shall provide detailed platform documentation for multiple user roles ranging from standard users to administrators.

2.5.8 (U) The Contractor shall provide a training program for an industry standard certification process.

2.6 (U) Accreditation Support

2.6.1 (U) The Contractor shall provide documentation and support to ensure the software can expeditiously receive an ATO. Documentation shall include:

2.6.1.1 (U) IATT Documentation (A005): The Contractor shall provide

IATT Documentation. The submission of the IATT Documentation shall be provided 5 calendar days after contract award. The format for this information is at the discretion of the Contractor.

2.6.1.2 (U) ATO Documentation (A006): The Contractor shall provide ATO Documentation. The submission of the ATO Documentation shall be provided 30 calendar days after contract award. The format for this information is at the discretion of the Contractor.

2.7 (U) Briefings and Reporting

2.7.1 (U) Program Management Briefing (A001): The Contractor shall provide a Program Management Briefing. The first submission of the Program Management Briefing shall be provided 45 calendar days after contract award. The format for this information is at the discretion of the Contractor.

2.7.2 (U) Project Plans: The Contractor and Government will create and maintain detailed documentation on project prioritization, including dataset integration and product configuration plans. Project plans may also include additional scoping, deliverables, governance, and other requirements for expansion projects as mutually agreed upon between the Contractor and the Government.

2.7.3 (U) Load Test for Processing Analysis (A002): The Contractor shall provide a Load Test for Processing report, not to exceed one report per month. The first submission of the Load Test for Processing Analysis shall be provided within five business days of request. The format for this information is at the discretion of the Contractor.

2.7.4 (U) Platform Utilization Metrics (A007): The Contractor shall provide Platform Utilization Metrics, not to exceed one report per month. The submission of the Platform Utilization Metrics shall be provided five business days after request. The format for this information is at the discretion of the Contractor.

2.7.5 (U) Platform Performance Metrics (A008): The Contractor shall provide Platform Performance Metrics, not to exceed one report per month. The submission of the Platform Performance Metrics shall be provided five business days after request. The format for this information is at the discretion of the Contractor.

2.7.6 (U) Final Project Report: The Contractor shall provide a summation of the performance during the contract period, along with plans to transition the capability to production. Not to exceed one report per month.

2.8 (U) Delivery Schedule

2.8.1 (U) The Contractor shall provide, upon execution of the Delivery Order, the primary commercial data solution which meets the entirety of the scope outlined within this SOW.

2.8.2 (U) The contractor shall successfully implement the commercial solution and provide continued performance for all exiting users and for all environments. The contractor is responsible for providing software licenses, training, and support services to implement the commercial solution as the integrated data environment for the project.

3. (U) Technical requirements Technical requirements are detailed below for data integrations and configurations.

3.1 (U) Data Connection & Ingestion

3.1.1 (U) Provide a single, integrated platform that is able to ingest, store, synchronize, search, share, transfer, analyze, and visualize large datasets from a variety of internal and external sources, including structured, unstructured, and semi-structured datasets from a variety of network-based, file-based, and message-based interfaces.

3.1.2 (U) Ingest data from numerous authoritative data sources in an automated manner that minimizes or eliminates the requirement for manual intervention during data acquisition and enables information management.

3.1.3 (U) Provide data resynchronization mechanisms to stay in sync with corresponding changes to data and push any necessary changes to the main repository.

3.1.4 (U) Include graphical interfaces for importing and structuring small data sources, such as an Excel spreadsheet, through the front-end user interface with “drag and drop” functionality.

3.1.5 (U) Enable integration of revised dataset structures/schemas from internal and external sources.

3.1.6 (U) Enable data engineers to schedule builds of data pipelines based on temporal factors or as underlying data is updated or logic is changed.

3.1.7 (U) Enable entity resolution and de-confliction capabilities across all available datasets.

3.2 (U) Data Quality

3.2.1 (U) Provide data quality assurance, monitoring, and alerting tooling to support creation and sustainment of clean, usable data.

3.2.2 (U) Enable users, both technical and non-technical, to clean and prepare massive scale datasets using an interactive tool supporting point-and-click actions to fix data quality issues (find and replace, concatenation, value splitting, value mapping, etc.), hashing/masking of data, and application of advanced functions.

3.2.3 (U) Enable front-end configuration of data quality checks to validate that data meets pre-defined requirements and alerts owners to failed checks.

3.2.4 (U) Enable users to flag and surface granular data quality issues and administrative users to triage and resolve issues.

3.3 (U) Data Lineage

3.3.1 (U) Maintain data origin and lineage metadata for every resource (e.g., dataset, analysis, report), such that users, analysts, and consumers of resources can trace the exact version of all upstream code and data dependencies backing a resource.

3.4 (U) Analytic Tools

3.4.1 (U) Provide advanced analytics tools to conduct relational, temporal, geospatial, statistical, network and behavioral analysis to turn raw data into actionable intelligence.

3.4.2 (U) Provide an interactive, top‐down, large‐scale data exploration application to allow non‐technical users to iteratively explore massive‐scale data in a top‐ down, point‐and‐ click application and filter billions of pieces of data into a digestible set of useful information.

3.4.3 (U) Allow for rapid searchability across many datasets and documents consisting of structured and unstructured data.

3.4.4 (U) Provide the ability to generate reports reflecting outputs of analysis, with lineage and traceability to underlying data.

3.4.5 (U) Provide the ability to display geospatial information as a map overlay.

3.4.6 (U) Include visualization to represent specific relationships and entities within the data.

3.4.7 (U) Provide users with interactive network diagrams that display associations between records of interest.

3.4.8 (U) Provide users with point‐and‐click analytics tools to plot, overlay, and transform high scale time‐series data, including the application for machine learning to time‐series data.

3.5 (U) Open Architecture & Open Standards

3.5.1 (U) Data should be stored in open, industry standard formats and should be able to be easily exported or shared in open, non‐proprietary data formats via application programming interfaces (APIs). The platform software applications must be built on a distributed micro services architecture with open, well‐documented APIs to seamlessly interface with other systems.

3.5.2 (U) Store data in open, industry standard formats and ensure it can be easily exported or shared in open, non- proprietary data formats.

3.5.3 (U) Provide a web application framework that allows analysts and business users to create applications and dashboards that are dynamically linked to the underlying data and correspondingly reflect dynamic data changes.

3.6 (U) DevOps Tools

3.6.1 (U) Support a “DevSecOps for Data” approach to data management. Both code and data must be supported across different, coexisting branches according to industry- standard version-control workflows.

3.6.2 (U) Users shall be able to fork data and code into logically separated repositories for development, testing, and/or experimentation without affecting “master” repositories.

3.6.3 (U) Data and code may be maintained in separate repositories or re‐ incorporated into master repositories where applicable.

3.6.4 (U) Platform applications must support analysis and transformation on specific branches of data or code.

3.6.5 (U) Include a collaborative code editing capability to write, publish, and build data transformations and pipelines, with support for SQL, Python, and Java.

3.6.6 (U) Allow for code and data to be branched and versioned to support development, testing, training and/or experimentation without affecting “master” repositories.

3.6.7 (U) Enable data scientists to build, deploy, and monitor advanced mathematical models on top of integrated data through a “notebook” like application.

3.6.8 (U) Track and monitor dataset transactions and build history, with the ability to access historical versions of the dataset and interrogate the changes of individual transactions.

3.6.9 (U) Allow privileged users to use a broad range of open-source machine learning libraries in the platform and transform data using statistical languages like PySpark, Pandas, and R.

3.6.10 (U) Enable sharing of techniques and models to other users across the platform.

3.6.11 (U) Enable continuous monitoring of models, including validation statistics, model stages, and key parameters. Allow comparison of these attributes across branches to assess proposed model modifications.

3.6.12 (U) Provide the ability to code locally on individual development computer.

3.6.13 (U) Provide the ability to instantiate and tear down branches for development pipeline steps to include automated testing, accessible via platform tools and APIs.

3.7 (U) Ontology Creation and Maintenance Tools

3.7.1 (U) Provide a dynamic data model along with object-based search/discovery and analysis workflows, allowing easy definition of objects, properties, and links that propagate from a source table, and provide natural ways to move between tabular and object-oriented interfaces and data analysis.

3.7.2 (U) Provide visualization capabilities that highlight and display associations and links between defined data objects.

3.7.3 (U) Allow users to create objects and add attributes through an intuitive graphical user interface.

3.7.4 (U) Allow for the creation of protected ontologies governed by granular role based access controls.

3.8 (U) Collaboration

3.8.1 (U) Provide collaboration capabilities to enable teams composed of technical and non‐ technical roles to work seamlessly and concurrently on the same data and merge analytical paths in one place.(U) Allow multiple users to work on the same analysis or assignment through file sharing capabilities.

3.8.2 (U) Allow users to use collaboration and knowledge management capabilities to include the ability for multiple analysts to collaborate on an individual project with all the information kept and shared in one location, updated and worked on simultaneously.

3.8.3 (U) Allow for secure collaboration and enable work product and workspace sharing with flexible permission controls available to users that allow authorized access across sites.

3.8.4 (U) Allow users to request and set alert notifications when defined data object is searched or updated by another user.

3.9 (U) Security

The Contractor is responsible for providing the following:

3.9.1 (U) Provide granular security access controls with the ability for data owners and users to easily control all downstream uses of the originating data and conform to organizational security policies.

3.9.2 (U) Provide out-of-the-box support for Role Based Access Controls and Classification Based Access Controls, and for Access Control Lists.

3.9.3 (U) Provide the ability to track and control access to defined datasets.

3.9.4 (U) Provide the ability to audit access of all data and analytical resources.

3.9.5 (U) Maintain a history of user activity per session.

3.9.6 (U) Provide the ability to support multiple, diverse use cases with overlapping or disjunct security policies, which all contribute to a single core data asset.

3.9.7 (U) Provide the ability to track and control access to defined datasets.

3.9.8 (U) Provide the ability for end users to control access to data based on complex row level need to know security requirements.

3.10 (U) Network Operations Center & System Monitoring

(U) The Contractor is responsible for providing the following:

3.10.1 (U) A 24/7 system monitoring team that will ensure base infrastructure remains functioning based on operational requirements.

3.10.1.1 (U) The maximum acceptable downtime of the system is 15 minutes.

3.10.2 (U) A 24/7 cyber monitoring team that will ensure the secure operation of the platform, investigate anomalous activity and defend against cyber vulnerabilities.

3.11 (U) Highly Available Architecture

(U) The commercial product is required to be deployed in a highly available manner to ensure the upmost reasonable uptime in support of national security space requirements.

3.11.1 (U) Deploy software in a replicated, Availability-Zone aware configuration.

Solution should be tolerant to an availability zone outage in cloud regions where a sufficient number of availability zones are available.

3.11.2 (U) Upgrade software in a Blue/Green deployment pattern with the ability to automatically roll back software releases with a negative availability impact.

3.11.3 (U) Implement service level health reporting to alert when software installation becomes unhealthy and requires intervention.

3.11.4 (U) Automatically scale infrastructure to meet unexpected increases in compute or storage demands.

3.11.5 (U) Ability to configure priority for compute jobs to ensure that mission critical feeds are updated with low latency and variability.

3.11.6 (U) Software must be able to support thousands of concurrent users without performance or availability degradation.

3.11.7 (U) Support the ability to restore capability from a backup for disaster recovery scenarios.

4. (U) Program Contract Deliverable Requirements List (CDRLs)

(U) The Contractor shall maintain all program documentation and CDRLs in the shared Government-identified electronic repository, under CM control. The Contractor shall deliver all formal and informal data and documentation to this electronic repository in accordance with the established delivery schedule for each item. The preceding does not apply to Contractor cost, proprietary, or other private programmatic information. See CDRL list below:

(U) Table 1 – Required CDRLs*

Data Item # Title

A001 Program Management Briefing A002 Load Test for Processing Analysis A003 Program Update Briefing A004 ACAS Vulnerability Scanning Review A005 IATT Documentation A006 ATO Documentation A007 Platform Utilization Metrics A008 Platform Performance Metrics

*This Table is Unclassified

5. (U) Place of Performance

(U) Work may be performed at the following locations:

5.1 Los Angeles Air Force Base

5.2 Schriever Air Force Base

5.3 Peterson Air Force Base

5.4 Dahlgren, Virginia

5.5 Aerospace Corporation, El Segundo Campus

5.6 Vandenberg Air Force Base

5.7 Andrews Air Force Base

5.8 The Pentagon

5.9 Additional locations to be determined at the discretion of the Government with mutual consent from the Contractor.

6. (U) Government Furnished Equipment (GFE) and Support

(U) The Government will provide cloud hosting environments and support throughout the Ordering Period. Any delays may cause additional time for completion of critical deliverables, including software installation, data integration, and user training.

6.1 (U) Installation Access and Badging

(U) The Government will provide Contractor personnel with all necessary badging, including issuing Common Access Cards (CAC) and hard tokens where required for computing access (e.g., SIPRnet tokens).

6.2 (U) Data Access

(U) The Government will secure access and authorizations for the data sources listed in Section 2.3 above, including documentation, data models and schemas, entity-relationship diagrams, and architecture artifacts for all data sources. Direct access to source systems will be required in order to demonstrate scalable impact to the Government.

6.3 (U) Network Access

(U) The Government will provide access to the network environment and will also provide sufficient seats with JWICS, SIPRNet and Unclassified (i.e.

NIPRNet/Internet) access from a government facility.

6.4 (U) Hosting Environments

(U) The Contractor will provide the Data-as-a-Service solution using Amazon Web Services (AWS) cloud infrastructure for all environments. The Contractor may install the solution using their AWS Master Service Provider account, if one exists.

Should the Government not utilize the contractor’s AWS Master Service Provider account:

6.4.1 (U) SC2S Environment: The Government will provide the Contractor with access to an AWS Account in the AWS Secret Region (SC2S), owned by and billed separately to the Government, but designated for the Contractor’s exclusive use. The Government will provision the environment sufficient for the Contractor to meet the requirements of the Agreement. The Government will provide the Contractor with a User account with sufficient permissions and privileges to install and operate the solution. This requirement must be satisfied in order for the Contractor to provide end-to-end management of the SC2S environment and to meet the estimated delivery dates outlined elsewhere in the proposal.

6.4.2 (U) C2S Environment: The Government will provide the Contractor with access to an AWS Account in the AWS Top Secret Region (C2S), owned by and billed separately to the Government, but designated for the Contractor’s exclusive use. The Government will provision the environment sufficient for the Contractor to meet the requirements of the Agreement. The Government will provide the Contractor with a User account with sufficient permissions and privileges to install and operate the solution. This requirement must be satisfied in order for the Contractor to provide end-to-end management of the C2S environment and to meet the estimated delivery dates outlined elsewhere in the proposal.

6.4.3 (U) Special Access (SAP) environments: The Government will provide the Contractor with access to an AWS Account in the AWS Top Secret Region (Compartmentalized C2S), owned by and billed separately to the Government, but designated for the Contractor’s exclusive use. The Government will provision the environment sufficient for the Contractor to meet the requirements of the Agreement. The Government will provide the Contractor with a User account with sufficient permissions and privileges to install and operate the solution. This requirement must be satisfied in order for the Contractor to provide end-to-end management of the C2S environment and to meet the estimated delivery dates outlined elsewhere in the proposal.

6.4.4 (U) On-Premises environments: The commercial solution shall be able to support both cloud and on premises deployments. The Government, if required, will provide the contractor access to an on-premises data center where the commercial solution will be deployed. Both the on-premises and cloud environment should be fully replicated and in sync to within one hour of one another.

6.5 (U) Data Connection Agent

(U) The Government will allocate necessary computing infrastructure and credentials for a data connection/ingestion agent software installed on the Government’s network to coordinate ingestion of data from source systems into the Data-as-a-Service solution.

6.6 (U) Single Sign-On

(U) The Government will assist the Contractor in connecting the Data-as-a-Service solution to the Government’s enterprise Single Sign-On Identity Provider solution, where such a solution exists. The Contractor should have experience integrating with DOD and Intelligence Community IDAM providers such as NGA GeoAxis and SAP IDAMs.

6.7 (U) On-Site Space

6.7.1 (U) The Government will provide the Contractor Project Team with access to working space, as required, for initial setup, training, and maintenance.

The working space will provide the necessary network access to the unclassified

6.7.2 (U) NIPRNet/Internet, SC2S, C2S, and all network locations of data source or other integrated systems with the Data-as-a-Service platform. The working space will include sufficient workstations for the Contractor Project Team to operate in parallel.

6.7.3 (U) The Government will provide the approved members of the Contractor Project Team with sufficient facility badges to the working space and any other building badges required to get to the working space. Badges will go through all necessary training and approval steps to be provisioned for Contractor Project Team members that allow them to enter the working space unescorted. As members of the Contractor Project Team roll off of the team, new members will be allowed to replace their badge slot and obtain a new badge if necessary. The Government will sponsor any additional read-ins, accesses, or trainings required for Contractor Project Team members to access the working space.

6.7.4 (U) The Contractor Project Team will have access to project site locations.

6.8 (U) Personnel Security Clearances

(U) The Government will sponsor sufficient billets for Contractor Project Team members up to the required Top Secret SCI and SAP levels.

6.9 (U) Data Transfer Officer Rights

(U) The Government will provide contractor personnel with the appropriate training and equipment to act as certified Data Transfer Officers to facilitate the transfer of software onto the Government network.

6.10 (U) CDS Sponsorship

(U) A desired end state will be that the Government will sponsor and accredit a cross-domain solution (CDS) such as AWS Diode to transfer binary files used for the DaaS platform software upgrades using approved processes from both unclassified network to SIPR and from unclassified network to JWICS to be used with both SC2S and C2S respectively. The CDS will be approved to transfer binary files types (including compiled code formats such as .class files) and will implement all necessary accreditation requirements.

7. (U) Data Rights Assertion

(U) The Government always retains ownership over its own data and content, including algorithms and code, that it imports or stores within the DaaS, as well as any Government- created work product. Reference DFARS Clause for data rights assertions.

8. (U) Ordering Period

(U) The ordering period this contract will be five (5) years. Continued funding is contingent upon an acceptable level of performance and successful implementation of the commercial solution.

9. (U) Basis Of Acceptance

9.1 (U) (For all CLINs) The basis for inspection/acceptance shall be compliance with the requirement specified each individual Delivery Order.

9.2 The commercial solution is accepted when Accreditation and Operational Acceptance at the Unclassified, Secret, TS/SCI, and SAP levels has occurred. This acceptance shall be upon award and operable as of 01 April 2023.