Attachment 1_SOW ASRS Cyber Workshop draft 2.pdf

Automated Storage Retrieval System (ASRS) Cybersecurity Workshop

Statement of Work

1.0 OBJECTIVE: Anniston Army Depot (ANAD) has a need for a Department of Army (DA) Cybersecurity compliant Automated Storage and Retrieval System (ASRS) Information Technology (IT) life cycle upgrade from Dematic Corporation (“Dematic” herein), the ASRS original equipment manufacturer (OEM). The government shall hold a Cybersecurity Workshop with Dematic to determine the Cybersecurity requirements for the ASRS solution and the gaps in Dematic’s system in order for the lifecycle upgrade of the ASRS system to be Cyber compliant.

2.0 SCOPE: ANAD’s current ASRS IT infrastructure is past end of life (EOL) and supported on a best effort maintenance agreement with Demantic. Server parts are scarce and hard to acquire, including on the secondhand market. The SRS IT infrastructure is no longer compliant with current DA Cybersecurity requirements.

ASRS is currently at risk of being removed from the network if a Category I (CAT I) vulnerability (the highest classification of Cybersecurity risk/weakness) is found or an unrecoverable system failure resulting from its low supportability occurs.

Dematic is the incumbent vendor and the OEM. They own the proprietary data rights to the current system to include the interface between the warehouse management software solution and the automated retrieval equipment (cranes, automated ground vehicles (AGV), and conveyors). Dematic has current contracts with other DOD sites and has encountered Cybersecurity compliance issues due to the requirements not being sufficiently defined before start of work.

Dematic will not provide a quote, including a Cybersecurity line item, without the workshop to determine ANAD’s Cyber requirements and the gaps in Dematic’s current commercially available warehouse management solution. Dematic requires compensation for performing the workshop for the labor costs of their team members including system engineer and Cybersecurity personnel. This workshop is in support of ANAD’s ASRS IT Lifecycle Replacement Capital Improvement Plan (CIP) project.

The Cybersecurity Workshop will include a walk-through for the existing ASRS system; a review of current operations, business processes, and Warehouse Control Software (WCS) functional requirements; assessment of the legacy system architecture to include identifying upgrade opportunities and information gathering and documentation; discussion of the operations and business processes managed by the WCS. Topics of discussion for the Cyber Workshop include, but are not limited to ,DoD cybersecurity threats, risks, and trends to include DoD cybersecurity frameworks, standards, and compliance with DOD Cybersecurity policies to include password management, data handling, and device usage; ANAD-specific risk management and compliance variances to include assessment of ANAD-specific ASRS/AGVS risks and vulnerabilities; and Cybersecurity technologies alternatives available. The Workshop will take place in two parts: three days onsite at ANAD and a follow-up remote Workshop for a Final Scope Determination and the Solution Team will identify desired improvements to the current system functionality (UI screens, reports, technologies, business processes, storage/handling, etc.).

3.0 REQUIREMENTS:

3.1. The contractor shall not proceed with any verbal or written change(s) to the scope of work from sources other than the Contracting Officer (KO), who will provide changes in writing.

3.2. The contractor shall

a) Provide their team members to include Cybersecurity Team Lead, New Cumberland DoD Projects Manager, New Cumberland DoD Software Consultant, CS Solution Development Software Lead, CS Project Manager/Systems Engineer, and CS Solutions Development Lead for the Cybersecurity Workshop.

b) Provide a Cybersecurity Specification proposal for the WCS Upgrade.

c) Provide an updated Dematic WCS and Controls Upgrade Proposal Including project schedule and firm price for a single - or multi-phased implementation.

3.3. The government will

a) Provide their team members to include ANAD Cybersecurity Team Member, ANAD ASRS System Administrator, ANAD Network Team Member, ANAD ASRS Operations Supervisor, ANAD Project Manager, ANAD Maintenance Team Member, ACC-ANAD Contracting Specialist, and other Team Members determined to be needed as workshop progresses.

b) Provide a space for the Cybersecurity Workshop to be held onsite and access to the current ASRS.

c) Provide known DA Cybersecurity requirements during the workshop.

d) Provide available documentation on existing ASRS.

1.0 OBJECTIVE: Anniston Army Depot (ANAD) has a need for a Department of Army (DA) Cybersecurity compliant Automated Storage and Retrieval System (ASRS) Information Technology (IT) life cycle upgrade from Dematic Corporation (“Dematic” herein), the A...