Attachment B - C-sUAS ESS - Software Integration and Sustainment Task Order 1.pdf

CUI

Statement Of Work (SOW) for

Force Protection Counter-small Unmanned Aircraft Systems (C-sUAS) Engineering & Sustainment Services – Task Order 1

AIR FORCE LIFE CYCLE AND MANAGEMENT CENTER

FORCE PROTECTION SYSTEMS DIVISION (AFLCMC/ESS)

HANSCOM AFB, MA

16 Oct 2025

DISTRIBUTION STATEMENT C: Distribution authorized to U.S. Government Agencies and their contractors (Administrative/Operational Use) (29 Jan 2025). Other requests for this document shall be referred to Force Protection Division, (AFLCMC/ESS), 11 Eglin Street, Bldg. 1618, Hanscom AFB, MA 01731-2100.

Handling and Destruction Notice: For classified documents, DoD civilians or military personnel will follow the procedures outlined in DoDM 5200.01, Volume 3, Enclosure 3; DoD contractors will follow procedures outlined in DoDM 5220.22, sections 11-19. For sensitive unclassified documents, destroy by any method that will prevent disclosure of contents or reconstruction of this document.

Controlled by: AFLCMC/ES Controlled by: AFLCMC/ESS CUI Category: PROCURE Distribution Control: Distribution Statement D POC: Maj Sergio Dominguez, sergio.dominguez.1@us.af.mil

DSN: 845-5012

Contents

1. Introduction

1.1. Scope

2. Applicable Documents

2.1. General

2.2. Order of Precedence

3. Contractor Requirements Summary

3.1. Program Management

3.1.1. Ramp Up

3.1.2. Associated Contract Agreements

3.1.3. Meeting and Communication Support

3.1.4. Program Risk Management

3.1.5. Programmatic Cost Data and Status Reporting

3.1.6. Data Management

3.1.7. Quality Assurance (QA)

3.1.8. Contract Schedule Overview

3.1.9. Transition Out

3.2. Digital Program

3.2.1. Cloud One Launch Pad

3.2.2. Logistics Management Information System (LMIS)

3.2.3. Joint Deficiency Reporting System (JDRS)

3.2.4. EMASS

3.2.5. JIRA

3.2.6. Confluence

3.2.7. DevSecOps Pipeline (DSOP)

3.2.8. Software release platform

3.3. System Planning and Installation

3.3.1. Site Survey

3.3.2. Site Survey In-brief

3.3.3. Site Survey Out-Brief

3.3.4. Site Installation

3.3.5. Site Acceptance Test

3.4. Capability Development, Integration, and Support

3.4.1. Backlog

3.4.2. Weekly Technical Interchange Meetings (TIMs)

3.4.3. Configuration Management

3.4.4. Engineering Change Proposals

3.4.5. Change or Variance Approval

3.4.6. Technical Reviews

3.4.7. Laboratory Space and Test Ranges and Simulators

3.4.8. Software Releases

3.4.9. Integration

3.5. Program Protection Planning

3.6. Demonstration and Real-World Event Support

3.7. Test and Evaluation

3.7.1. Contract Test and Evaluation (T&E)

3.7.2. Software testing

3.7.3. Training for Government Test Team

3.8. Cybersecurity

3.8.1. Scanning, Patching, and Vulnerability Analysis

3.8.2. Authorization and Accreditation Support

3.8.3. Cybersecurity Manning and Support Requirements

3.8.4. Approved Products

3.8.5. Ports, Protocols, and Services Management

3.9. Sustainment Support

3.9.1. Logistics Working Group

3.9.2. Warranty Management

3.9.3. Software Licenses & Updates

3.9.4. Diminishing Manufacturing Sources and Material Shortage (DMSMS) and End of Life (EoL)

3.9.5. Help Desk

3.9.6. Work Orders

3.9.7. Metrics and Trend Reporting

3.9.8. Organizational Level Maintenance

3.9.9. Item Unique Identification (IUID)

3.9.10. Spares

3.9.11. Warehousing

3.9.12. Supply Chain Management

3.9.13. Training

3.10. NCR SEW Short Term

4. General Requirements

4.1. Security Requirement

4.1.1. Security Management

4.1.2. Operations Security (OPSEC)

4.1.3. Controlled Unclassified Information (CUI)

4.1.4. Communications Security (COMSEC)

4.1.5. Security Classification Guide (SCG)

4.1.6. Personnel

4.1.7. Personnel Security

4.1.8. Security Incidents and Violations

4.1.9. Common Access Card (CAC)

4.1.10. Security Training

4.2. Base Access and Support

4.3. Essential Services

4.4. Contractor Visit Requests

4.5. Contractor Manpower Reporting

4.6. Safety

4.7. Federal, State, and Local Law Violations

4.8. Government Hazardous Waste/Material

4.9. Duty Hours

5. Glossary

6. Acronym List

1. Introduction The Air Force Life Cycle Management Center, Force Protection Systems Division (AFLCMC/ESS) supports the United States Air Force (USAF) Security Forces (SF) by providing full lifecycle support for Counter-small (Group 1, 2, & 3) Unmanned Aircraft Systems (C-sUAS). AFLCMC/ESS provides life cycle support for C-sUAS fielded equipment. The C-sUAS system is a Commercial Off the Shelf (COTS) and Government Off the Shelf (GOTS) Systems of Systems (SoS) design comprised of multiple sub-systems which have one or more physical components. These disparate physical components are pulled into a Command-And-Control (C2) system that provides a Human-Machine-Interface (HMI) for the operator to perform their necessary functions. Together these systems provide the capability to Detect, Identify, Track and Defeat small Unmanned Aircraft Systems (sUAS). Mission requirements have driven C-sUAS to be deployed in various configurations such as Fixed Site, Mobile, Portable, Transportable, and Handheld. This SOW defines requirements for the contractor to provide development, integration, and sustainment to ensure C-sUAS operational availability at all locations, both CONUS and OCONUS.

1.1. Scope

The scope of this Task Order is to conduct the ongoing development, integration, installation and sustainment of the Medusa System of Systems (SoS). The scope of this Task Order (TO) includes work necessary to develop software upgrades and integrate new capabilities, including system design, design reviews, software development, test and evaluation, documentation, etc.

This scope of effort also includes all work necessary to field, maintain and sustain the fielded systems to include organizational and depot level maintenance, training, issue tracking, inventory management, spares, tech refresh, etc. In addition, this Task Order also covers six months of sustainment support for the National Capital Region Shared Early Warning (NCR SEW) System.

2. Applicable Documents

2.1. General

The following documents are applicable to this SOW to the extent specified herein. Where not specifically cited below, the contractor is responsible for compliance with all applicable federal, state, local, and installation codes, laws, and regulations during performance of this contract.

Doc # Date Name OSHA CFR 1910 Current Occupational Safety and Health Standards OSHA 1926.502 Current Fall Protection Systems Criteria and Practices SD-22 Mar-24 Diminishing Manufacturing Sources &

Material Shortages Guidebook MIL-HDBK-61B 07-Apr-20 Configuration Management Guidance MIL-STD-129R (2) 27-Sep-19 Military Marking for Shipment and Storage MIL-STD-130M 16-Nov-12 DOD Standard Practice Identification Marking of US Military

MIL-STD-461G 11-Dec-15 Electromagnetic Interference Characteristics Requirements for Equipment

MIL-STD-882E 27-Sep-23 Standard Practice for System Safety MIL-STD-2073-1E 22-Apr-19 Standard Practice for Military Packaging MIL-STD-130 17-Dec-07 Identification Markings of U.S Military

Property NIST Special Publication 800-53, Revision 5

September 2020, includes updates as of 12-10-2020

National Institute of Standards and Technology, U.S. Department of Commerce, Security and Privacy Controls for Federal Information Systems and Organizations

DoDI 1100.22

April 12, 2010 Change 1, December

1, 2017

Policy and Procedures for Determining Work Force Mix, Incorporating Change 1, 1 Dec

Turn In Handbook August 2022 DoD DLA Disposition Services – Turn in

Handbook DoDM 4140-1 6-Mar-19 DoD Supply Chain Materiel Policy

DoDM 4140-7 19-Apr-19 DoD Supply Chain Materiel Management Procedures for Storage and Material Handling

DoD 4160.21-M

Volume 3 October 22, 2015, Incorporating

Change 4, November 18, 2022

Defense Material Disposition Manual

DoDI 4161.02 31-Aug-18 Accountability and Management of Government Contract Property

DoDM 5200.01-V3

24 Feb 12 Incorporating

Change 3, Effective

July 28, 2020

DoD Information Security Program: IC2, 19 Mar 2013 Protection of Classified Information

32 CFR Part 117 20-Sep-24 National Industrial Security Program Operating Manual (NISPOM)

DoD 8540.03-M 15 Feb 2023 Cyberspace Workforce Qualification and Management Program

N/A - DoD Standard Operating Procedure 02-Aug-2013

Acquisition/Procurement Guide for Unique Item Traceability Data Integrity, V1.1

DoDI 5000.64 10-Jun-19 Accountability and Management of DoD Equipment and Other Accountable Property

DFARS 211.274 16-Sep-24 Item Identification and Valuation Requirements

DoD 4500.54E 31-May-

2022 DoD Foreign Clearance Program

Medusa SoS_SCG_0002 Current Medusa System of Systems Security Classification Guide

Current Ninja Security Clarification Guide (SCG) Small Unmanned Aircraft Systems (C-sUAS)

Current Counter small Unmanned Aircraft Systems (C-sUAS) System Security Plan (SSP)

AFI 16-1404 12-Apr-23 Information, Personnel & Industrial Security Programs

AFI17-101_DAFGM2024-01 5-Sep-2024

Department of the Air Force Guidance Memorandum (DAFGM) to Air Force Instruction (AFI) 17-101, RISK

MANAGEMENT FRAMEWORK (RMF)

FOR DEPARTMENT OF THE AIR FORCE

INFORMATION TECHNOLOGY (IT)

AFI 63-101/20-101 16-Feb-2024 Integrated Life Cycle Management

AFI 20-105 15-July-22

Diminishing Manufacturing Sources and Material Shortages (DMSMS)

AFI 23-101 14-Aug-23 Air Force Materiel Management

AFH 23-123 20-Sep-21 Materiel Management ILS-S, Materiel Management Operations

AFMAN 23-122 28-Aug-24 Materiel Management Procedures

AFMAN 24-204 15-Nov-21 Preparing Hazardous Materials (HAZMAT) for Military Air Shipments

AFPAM 63-113 08-Mar-22 Program Protection Planning for Life Cycle Management

SAE AS5553C 14-Nov-19

SAE International Standard, AS5553, Counterfeit Electronic Parts: Avoidance, Detection, Mitigation, and Disposition

ICS 705-1 17-Sep-10

Intelligence Community Standard Number 705-1: Physical Security Standards for Sensitive Compartmented Information Facilities

ICS 705-2 22-Dec-16

Intelligence Community Standard Number 705-2 Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information

N/A Jan-23 National Telecommunications and Information Administration (NTIA) “Red Book”, Manual of Regulations and Procedure for Federal Radio Frequency, Ch10

ANSI-EIA-649C 7-Feb-19 National Consensus Standard for Configuration Management

2.2. Order of Precedence

In the event of a conflict between this document and the references cited herein, the more stringent requirement shall take precedence, unless directed otherwise by the Procurement Contracting Officer (PCO). In the event of a conflict between this document and the basic Indefinite Delivery (ID)/ Indefinite Quantity (IQ) contract and/or task order, the contract or task order shall take precedence unless explicitly directed otherwise by the PCO. Nothing in this SOW, however, supersedes applicable federal, state, and local codes and regulations unless a specific exemption has been obtained.

3. Contractor Requirements Summary

3.1. Program Management

3.1.1. Ramp Up

The contractor shall lead the transition of current development and sustainment work being conducted on expiring contracts from the incumbent contractors to the new contractor. The Government will act as the mediator in the transition period. Within 2 weeks of contract award, the contractor shall deliver a transition plan detailing the necessary milestones, actions, and documentation that will be generated. Upon approval from the Government, the contractor shall execute the Transition Plan. The plan shall include a detailed timeline of transition for their assigned duties. The contractor shall use the Transition Plan to track completion of milestones documenting contractor readiness to assume the C-sUAS RDT&E workload. The contractor shall transition all support to begin full performance of this SOW in the allotted time. The Government will provide any existing GFI/GFE.

Transition Activity Documentation Timeframe Notes MATR Draft Lease Agreement MASSDEV

Range Control Plan Inventory list (GFE) Safety plans and procedures Etc.

Contract Award

SW Baseline SW documentation Test documentation and results

HW Baseline HW Specs, BOMs, Cameo models, etc.

Requirements, traceability current and future

Sustainment Inventories

Warehousing of spares and excess

PHS&T

Repair and Return procedures FSR procedures Call-back support procedures Training Etc.

Integration Support ICDs Test Data Lab equipment

AXXX- TRANSITION PLAN

3.1.2. Associated Contract Agreements

There will be situations where another contractor is providing C-sUAS service(s) for the Government. The contractor shall professionally interact and work with other contractors to ensure all requirements in this SOW are met. The contractor shall create Associated Contract Agreements (ACAs) with pertinent contractors providing contractual support for C-sUAS.

3.1.3. Meeting and Communication Support

In addition to the formal meetings detailed in this section, the contractor shall support ad hoc meetings and communications with other stakeholders as directed by the Government.

3.1.3.1. Post Award Kick-Off Meeting

The contractor shall schedule and conduct a post contract award meeting at their facility no later than fifteen (15) working days after the start of the contract. The contractor shall provide the option for additional Government team personnel to join virtually. The contractor shall discuss their program implementation strategy at this meeting. The contractor shall submit briefing materials to the Government prior to the meeting. The contractor shall identify known program risks and provide strategies to avoid or limit those risks. The contractor shall present upcoming program milestones relative to the contract actions initiated. The contractor shall include a detailed transition period review, showing tasks required and timing of contractual activity to support this effort. Following the Post Award Kick-off Meeting, the contractor shall submit meeting minutes.

AXXX - BRIEFING MATERIALS

AXXX - Integrated Program Management Data and Analysis Report (IPMDAR)

AXXX - MEETING MINUTES

3.1.3.2. Integrated Product Team (IPT) Meetings

The contractor shall conduct weekly Integrated Product Teams (IPT) meetings with the Government utilizing MS Teams. The contractor shall provide a MS Teams meeting link and a teleconference number to support the weekly IPT. The contractor shall propose an agenda, provide slides indicating project status and keep a running Action Item list. The contactor shall ensure PowerPoint slides highlight things such as schedule status, programmatic issues, risks and mitigations, staffing considerations, summary of all support activities, and recommendations for improved maintenance/ sustainment actions. The contractor shall provide IPT PowerPoint slides to the Government no later than two (2) hours prior to an IPT meeting.

3.1.3.3. Program Management Reviews (PMRs)

The contractor shall schedule and conduct quarterly PMRs at the Government Program Management Office at Hanscom AFB or at the contractor facility and provide the Government with accurate and timely status in meeting contractual requirements. The contractor shall ensure PMRs apprise the Government of program progress including, but not limited to, schedule status, contract and/or programmatic risks and issues with status and mitigation plans, financial status, Reliability Availability & Maintainability metrics, training status, inventory/property management status, up-to-date configuration status accounting information, staffing status, mobilization and demobilization plans, quality assurance, and when applicable address cybersecurity compliance status. The Contractor shall submit Briefing Materials prior to the PMR. The Contractor shall submit Meeting Minutes following the PMR.

AXXX – BRIEFING MATERIALS

AXXX - MEETING MINUTES

3.1.4. Program Risk Management

The contractor shall perform ongoing program risk analysis which provides a process for identifying, tracking, and managing/mitigating cost, schedule, and performance risks using Air Force Instruction (AFI) 63-101/20-101, Integrated Life Cycle Management, as guidance. The contractor shall assign each program risk a high, medium, or low rating and create a ranked order listing of potential risks to be encountered and managed during performance of the program.

The contractor shall classify each program risk as either cost, schedule or performance and the contractor shall report risk management at weekly IPTs and quarterly PMRs.

AXXX – RISK REGISTER

3.1.5. Programmatic Cost Data and Status Reporting

The contractor shall implement cost reporting and controls utilizing internal cost reporting and control procedures or systems to plan, schedule, budget, monitor, report cost and technical status applicable to the contract. The contractor shall provide financial reporting including detailed cost accounting down to the base level. The contractor shall ensure financial CDRLs are representative of the same accounting period (e.g. information shall have the same start date and complete date).

AXXX - CONTRACTOR FUND STATUS REPORT

AXXX - FUNDS AND MAN HOURS EXPENDITURE REPORT

AXXX – COST AND SOFTWARE DATA REPORT

3.1.6. Data Management

The contractor shall use sound data management discipline for developing, acquiring, controlling, and delivering all required technical, management, and other data. The contractor shall ensure on-time delivery of data. The contractor shall identify data generated under this contract that is not deliverable. The contractor shall maintain all classified data with appropriate markings and physical access controls IAW approved security classification guidance and DD254 instructions. The data shall be delivered in human-readable format, unless directed otherwise by Government.

AXXX – DATA ACCESSION LIST (DAL)

3.1.7. Quality Assurance (QA)

The contractor shall establish and maintain a quality assurance plan that incorporates daily operations, maintenance, and support IAW this contract, applicable laws and regulations, and commercial best practices. The contractor shall implement an independent assessment/verification process that establishes contractor QA measures to include the Contractor’s methodology, standards and processes focusing on elements specific to this project, within 90 calendar days of the start of the contract. An independent QA function shall be defined as separate QA personnel who are technically qualified to review the work of others but are not directly responsible for the delivery of the service under contract.

AXXX - QUALITY ASSURANCE SURVEILLANCE PLAN

3.1.8. Contract Schedule Overview

The contractor shall maintain an Integrated Master Schedule (IMS) in Microsoft Project for program execution for the life of the contract. The contractor shall deliver the IMS as part of the IPMDAR. The contractor shall brief the status of the IMS at each PMR.

AXXX – IMPDAR

3.1.9. Transition Out

The contractor shall actively participate in the transition of current development and sustainment work to the new contractor at the end of this contract. The Government will act as the mediator in the transition period. Seven (7) months prior to the end of the contract, the contractor shall deliver a transition plan detailing the necessary milestones, actions, and documentation that will be provided to the new contractor. The plan shall include a detailed timeline of transition of their assigned duties. The contractor shall use the Transition Plan to track completion of milestones.

AXXX- TRANSITION OUT PLAN

3.2. Digital Program

The Contractor shall support the Government digital program goal by maximizing the use of Government owned digital infrastructure and systems to serve as the Authoritative Source of Truth (ASoT) for technical program data. The Contractor shall provide a list of personnel requiring access to each of the systems at the kick-off meeting and shall alert the Government as personnel onboard or depart. The Government will alert the Contractor as a specific tool or environment will be changing to allow time for the Contractor to migrate to the new system.

3.2.1. Cloud One Launch Pad

3.2.1.1. Cameo Model

The contractor shall maintain the Government system of systems model in the Government Cloud 1 launch pad cameo. The model shall contain data on all software and hardware components and interfaces. The contractor shall maintain model integrity to ensure accuracy, consistency, and adherence to Government modeling standards. The contractor shall maintain version control within the model, with Government guidance. The contractor shall perform routine model validation and verification checks against contractual requirements.

3.2.1.2. DOORS Requirements

The contractor shall have access to the Government maintained IBM DOORs requirements tool and maintain design level requirements in this tool. The contractor shall have read-only access to Government requirements (SRD, RPRD, etc.) within DOORs. The contractor shall create, edit, and maintain contractor requirements documents (SSD, SSS, etc.) in DOORs.

3.2.1.3. Computer Aided Design (CAD)

The contractor shall build and maintain Computer Aid Design files in the Cloud One Launch Pad as required.

3.2.2. Logistics Management Information System (LMIS)

The contractor shall maintain the data in the Government Logistics Management Information System (LMIS) IAW the ESSC LMIS Implementation Guide and the requirements of this SOW.

The LMIS shall be the authoritative source of truth for the configuration and status of equipment at each site, work orders, warranty and license information. The contractor shall identify and alert the government PM of any requested information that is not able to be captured in the Government LMIS. The contractor shall work with the government to establish reporting templates and timelines. The Government LMIS will be subject to change during the period of performance of this contract. The contractor shall support the transition to the new LMIS if this change occurs.

3.2.3. Joint Deficiency Reporting System (JDRS)

The contractor shall maintain the data in the JDRS when DRs are assigned to the Contractor for action. JDRS will be the Authoritative Source of Truth for all deficiencies associated with the system.

3.2.4. EMASS

The contractor shall support the government in building the EMASS documentation required to meet USAF Authority to Connect requirements.

3.2.5. JIRA

The contractor shall maintain JIRA tickets when they are assigned to the contractor and provide information pertaining to the ticket such as start/end date, tracked time/effort against ticket. The Government JIRA shall be the authoritative source of truth for the backlog.

3.2.6. Confluence

The contractor shall maintain training records on Confluence. Confluence shall serve as the authoritative source of truth for all CDRL submissions and training records. The contractor shall maintain technical documentation, information, and data in Confluence regarding the system.

The contractor shall maintain / follow space management, administration management, and user management governance / direction as approved by the Government.

3.2.7. DevSecOps Pipeline (DSOP)

The contractor shall maintain the tools within the Government provided DevSecOps Pipeline (DSOP), The contractor shall maintain automated build, test, and deployment pipelines for the program. The contractor shall manage and maintain integrated DSOP tools (GitLab, Jenkins, Artifactory, SonarQube, fortify, etc.). The contractor shall maintain and create as needed automated testing / test cases. The contractor shall be responsible for providing and maintaining artifacts from the pipeline in support of Government approvals / activities (e.g., ATO, test artifacts, etc). The Government will provide the necessary support and hardware to enable the use of a DSOP.

3.2.8. Software release platform

The contractor shall manage a software release platform used to stage then deploy software to the field both for new systems as well as upgrading existing systems. The contractor shall ensure this platform meets necessary requirements to ensure proper access, security, and credentials.

The contractor shall ensure the platform is available for maintainers or system administrators in the field to download updates and install on deployed systems.

3.3. System Planning and Installation

3.3.1. Site Survey

The contractor shall conduct site surveys as directed by the Government. The contactor shall complete all work necessary during the site survey to complete the Site Preparation Requirement and Installation Plan (SPRIP). Site surveys shall include, at minimum, a complete RF Spectrum Analysis, a Coverage Analysis, Accessibility analysis, Infrastructure analysis. The contractor shall be responsible for providing all tools necessary for the site survey. The contractor shall deliver a SPRIP for each site surveyed.

AXXX: Site Preparation Requirements and Installation Plan

3.3.2. Site Survey In-brief

The contractor shall support a Site Survey In-Brief at the start of the site survey to coordinate with site stakeholders (i.e., Security Forces, Civil Engineering Squadron (CES), Communications Squadron (CS), and wing leadership). The in-brief shall include an introduction of the contractor’s site survey team members, an agenda for the site survey activities, identify base-level support requirements and anything the government deems critical to be mentioned for the project.

3.3.3. Site Survey Out-Brief

At the conclusion of site survey, the contractor shall schedule, prepare, and present an out-brief to the GPM (or GPM representative on site) and project stakeholders.

The Site Survey Out-Brief shall include summaries of the results, any issues and findings, and applicable high-level recommendations of the proposed project design.

3.3.4. Site Installation

3.3.4.1. Installation

The Contractor shall install equipment in accordance with provided documentation.

3.3.4.2. As-Built Design

After install, the contractor shall provide the as-built drawings and photos representative of the final system installation. after install, the contractor shall provide Real Property Facilities As- Built Drawings that accurately reflect the condition of all real property facilities involved with the system, as constructed, installed, and erected.

CDRL XXX – As-Built Design CDRL XXX – Real Property Facilities As-Built Drawings

3.3.5. Site Acceptance Test

The contractor shall provide on-site support to the Government’s SAT at the conclusion of each system installation at a specific operational location. On-site support for SAT may include engineering, technical and/or logistics support, and “red-team” flying to ensure the installed system is correctly configured and operating as intended for the site.

3.4. Capability Development, Integration, and Support

The contractor shall conduct the engineering and technical work necessary to continue ongoing Operational Safety, Suitability, and Effectiveness of the SoS. As the threat and technology evolves the Contractor will support the Government priorities for enhancing and updating the SoS.

3.4.1. Backlog

The Contractor shall work with the Government to prioritize the backlog and identify potential solutions to issues. The contractor shall update tasks assigned to the contractor on a weekly basis, at minimum. The contractor shall adhere to the Government Backlog management process.

3.4.2. Weekly Technical Interchange Meetings (TIMs)

The Contractor shall support a weekly virtual technical interchange meeting (TIM). The Contractor shall address ongoing software releases and integration efforts, to include the status and any delays. The contractor shall raise any other technical issues and possible resolutions to technical issues.

3.4.3. Configuration Management

The contractor shall comply with the Government provided configuration management process.

The contractor shall ensure the currently approved configuration and approved variances are documented for each supported site in the LMIS database. The contractor shall track configuration data to the LRU level.

3.4.4. Engineering Change Proposals

The contractor shall propose solution(s) to resolve more complex backlog items via Engineering Change Proposal as required by the Government. All ECPs shall demonstrate how the proposed solution will meet applicable requirements. The contractor shall alert the Government PM if a change needs to occur rapidly with justification so the PM can request an ECP.

AXXX - ENGINEERING CHANGE PROPOSAL

3.4.5. Change or Variance Approval

The Government will approve all changes to the baseline through the Configuration Control Board (CCB). The contractor shall provide updated documentation for the changed configuration. The contractor shall support the Government CCB process by attending the meetings and answering technical questions as required. The contractor shall not make any changes to the baseline or configuration of fielded systems without approval from the Government CCB.

AXXX – SOFTWARE DELIVERY

AXXX - Software Documentation Package AXXX - Software User Manual (SUM) AXXX – COTS Manual AXXX – COTS Manual Supplement AXXX – Training Materials AXXX - Software Description Document (SDD) AXXX- Spectrum Management Form AXXX – Interface Design Document (IDD)

3.4.6. Technical Reviews

The contractor shall host technical reviews for changes to the system as required for software releases, test events, design reviews, and other required events. The Contractor shall deliver meeting materials and technical documentation prior to the technical review. The contractor shall address the technical details related to all system changes to include, but not limited to, network topology, software implementation plans, configuration, risks, model updates, etc. The contractor shall deliver meeting minutes following the technical review.

A014-BRIEFING MATERIALS

A013- MEETING MINUTES

AXXX – SOFTWARE DELIVERY

AXXX - Software Documentation Package AXXX - Software User Manual (SUM) AXXX – COTS Manual AXXX – COTS Manual Supplement AXXX – Training Materials AXXX - Software Description Document (SDD) AXXX- Spectrum Management Form AXXX – Interface Design Document (IDD)

3.4.7. Laboratory Space and Test Ranges and Simulators

The contractor shall maintain appropriate lab space to successfully meet the requirements of this contract. The contractor shall operate and maintain the integration laboratory location at Moore Army Airfield, Ayer MA.

3.4.8. Software Releases

The contractor shall deliver one software release package each quarter with content as determined by the backlog process. The Government will work with the contractor to agree upon specific dates for release. The contractor shall adhere to the ESSC software development guide. The contractor shall integrate cyber security throughout the development cycle. The contractor shall perform all software release work in the Government DSOP. The contractor shall deliver software releases through the Software Release Platform. The Contract shall deliver the associated software documentation. The contractor shall support Government testing and CCB as requested to obtain approval for release to the field. The contractor shall release the software to the field through the Software Release Platform, after approval from the Government CCB. The contractor shall be capable of resolving emergency issues and doing out of cycle releases if requested by the Government.

AXXX – SOFTWARE DELIVERY

AXXX - Software Documentation Package

AXXX - Software User Manual (SUM) AXXX – Interface Design Document (IDD)

3.4.9. Integration

When a backlog task requires new or alternative software, sensors, effectors, or other subsystems need to be integrated into the SoS and an ECP has been approved by the Government, the contractor shall complete the technical work needed to complete the integration. The contractor shall coordinate with the developers or owners of the capability being integrated with as necessary to complete the integration. The contractor shall be responsible for the integration of all systems and data feeds. The contractor shall be responsible for the hardware, software, and firmware updates required for integration. The contractor shall not change any updates to the internal and external interfaces of the system other than those approved as part of the ECP.

3.5. Program Protection Planning

The contractor shall support the Government program protection plan development.

3.6. Demonstration and Real-World Event Support

The contractor shall support government held demos and real-world events with installation, configuration, set up as needed and onsite support as directed. Six events per year should be anticipated.

3.7. Test and Evaluation

Government Integrated Test Team (ITT) Support.

The contractor shall participate in virtual biweekly Government ITT meetings. The contractor shall assist in identifying risks, issues, and opportunities for integrated testing or redundancies in testing.

3.7.1. Contract Test and Evaluation (T&E)

The contractor shall plan and conduct robust C-sUAS T&E to verify the system and/or associated sub-systems meet applicable performance requirements in the System Requirements Document (SRD). All applicable SRD requirements with a verification method designation of “Test” or “Demonstration” shall be part of the contractor’s T&E program. The contractor shall plan individual subsystem/component testing as well as integrated system-level testing to show the system as a whole meets performance requirements. All contractor testing shall occur before any part of the system is accepted for Government T&E.

3.7.2. Software testing

The contractor shall develop a Software Test Plan, Software Test Description (i.e., procedures) and a Software Test Report for software testing. The contractor shall perform software tests using the approved test descriptions/procedures. If employing agile software development and testing methodologies, the contractor’s Test Plan shall clearly describe the test development approach and the scope and frequency of any automated testing. This shall include both functional as well as cybersecurity testing. The contractor shall host Government representatives, as determined by the Government program management office, to observe/witness any contractor software testing.

CDRL AXXX – Software Test Plan CDRL AXXX – Software Test Description CDRL AXXX – Software Test Report

3.7.3. Training for Government Test Team

The contractor shall provide and complete training on each new release to the Government test team NLT 10 business days prior to the start of any Government test phase. The contractor shall provide a copy of all applicable system manuals as a part of this training.

3.7.3.1. Support for Government T&E execution

The contractor shall plan to provide/ship/transport the system under test (SUT) and all necessary spare equipment to the identified Government test location if it does not already exist at that location. The Government test location will usually be at Eglin AFB, FL, but may vary based on specific test objectives and needs. The contractor shall plan to provide on-site support to the Government test team at the identified Government test location for the duration of the test event. The contractor shall serve in an advisory role and provide engineering, technical and logistic support as requested by the Government test team.

3.7.3.2. Resolution of Government T&E-Identified Deficiency Reports The contractor shall participate as a non-voting member in all Government T&E DRBs. The contractor shall resolve/correct Category I and all Category II Urgent DRs identified by the Government test team and make those corrections available to the Government test team for verification via a Government regression test.

3.7.3.3. Integrated Test Team

The contractor shall support government Integrated Test Team to support the once per quarter test cadence of the system

3.8. Cybersecurity

3.8.1. Scanning, Patching, and Vulnerability Analysis

The contractor shall perform cyber scanning and recording of results throughout the development process, as specified by the Government. As part of the DevSecOps pipeline, the following scanning and artifacts are required to be generated for all software versions integrated, installed, and deployed. Vulnerability testing must include, at a minimum, static code analysis, dynamic code analysis, dependency analysis, Software Bill of Materials, assessment of the OWASP Top 10 for applicable application types (i.e. web application), and Common Weakness Enumeration (CWE) if not covered by static and dynamic scans. All software developed should also be analyzed IAW the Application Security Development STIG published by DISA at https://public.cyber.mil. All findings from the previous vulnerability scans and assessments shall https://public.cyber.mil/ be included in the Plan of Action and Milestones as part of the RMF deliverable. The contractor will provide evidence of any false positive findings, recommended mitigations to findings, level of effort assessments for open findings, and any technical restrictions which require findings to remain open.

3.8.2. Authorization and Accreditation Support

The contractor shall support Government efforts to generate information system security assessment and authorization (A&A) documentation/evidence of control compliance for all applicable security control families necessary to achieve an authorization decision (authorization to operate/connect [ATO/ATC] or interim authorization to test [IATT]) and/or support continued authorization in accordance with (IAW) the current version of DOD Instruction (DODI) 8500.01, Cybersecurity, DODI 8510.01, NIST Special Publication 800-37, Risk Management Framework (RMF) for DoD Information Technology (IT), Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6510.01F, Information Assurance (IA) and Support to Computer Network Defense (CND), Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, Cyber Incident Handling Program, Committee on National Security Systems Instruction (CNSSI) 1253, Security Categorization and Control Selection for National Security Systems, NIST SP 800-53 rev 5, Security and Privacy Controls for Federal Information Systems and Organizations, and NIST SP 800-53A, Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans. In addition, the contractor shall support existing system security documentation within the Enterprise Mission Assurance Support Service (eMASS) or other government selected tool in accordance with timelines and frequencies specified by the government to facilitate/maintain security authorization in accordance with DOD RMF authorization requirements.

3.8.3. Cybersecurity Manning and Support Requirements

The contractor shall comply with DoDD 8140.01, Cyberspace Workforce Management, and DoD 8570.01-M, Information Assurance Workforce Improvement Program. The contractor shall ensure that all Cybersecurity personnel maintain current IAT Level II certifications.

3.8.4. Approved Products

The contractor shall ensure that all network equipment is pre-certified IAW (https://aplits.disa.mil/processAPList.do) in all turnover documents and all security controls and mitigations required by the APLITS Cybersecurity Assessement Package are employed or mitigated below high risk. All hardware and equipment must be purchased as TAA compliant IAW DFARS clause 252.225-7021 Trade Agreements. Any third party software must be approved on any of the DoD Approve Products Lists or included in the ATO paperwork, with vulnerability analysis and mitigations identified, and submitted as part of the RMF deliverable.

The Contractor’s development efforts will not utilize unsupported/extended support hardware, software, firmware or computer code unless specifically agreed upon by the Government.

Contractor will ensure unsupported components are replaced/removed prior to end of life per a Government approved POA&M. The Government approved POA&M will outline the transition to supported components during any extended support period. All products acquired by the contractor which have available NIAP protection profiles (https://www.niap-ccevs.org/) either https://aplits.disa.mil/processAPList.do https://www.niap-ccevs.org/ have been or will be evaluated against that profile. All cryptographic-based IT and components must meet the FIPS 140-2 or 140-3 standards.

3.8.5. Ports, Protocols, and Services Management

The contractor shall collaborate with system administrators, developers, programmers, and authorization team members to produce a single, comprehensive port, protocols, and services (PPS) declaration worksheet for each system and maintain the artifact within eMASS. The contractor will ensure all declared PPS will be in compliance with DODI 8551.01, Ports, Protocols, and Services Management (PPSM), the DOD Category Assurance Listing (CAL) and Vulnerability Assessment (VA) reports.

A-XXX Risk Management Framework (RMF)

3.9. Sustainment Support

3.9.1. Logistics Working Group

The contractor shall host a logistics working group semi-annually as needed. The topics to be covered under this working group will be Inventory, warehouse activities, DRMO, DMSMS, sparing, maintenance activities, equipment status and readiness, help desk, training, Organic maintenance support.

3.9.2. Warranty Management

The Contractor shall establish a warranty management process to maintain and track, by part number and serial number, warranties for all components, to include spare components. The contractor shall maintain all warranty information in the LMIS. The contractor shall identify and enforce work under warranty when requests for repairs or service are required. The contractor shall advise the Government of impending expiration of existing equipment warranties no later than 120 days before the warranty expiration. The Contractor shall track in the LMIS work orders any use of a warranty.

3.9.3. Software Licenses & Updates

The contractor shall maintain all software license information in the LMIS database. The contractor shall notify the Government of any impending license expirations no later than 120 days before the expiration date. Upon direction from the Government, the contractor shall renew or procure software licenses.

3.9.4. Diminishing Manufacturing Sources and Material Shortage (DMSMS) and End of Life (EoL)

The contractor shall {establish, implement, and maintain} a proactive DMSMS management program encompassing the C-sUAS equipment/component/software, and document standard operating procedures in a DMSMS Management Plan (DMP). This DMP shall address the C-sUAS components from all levels of suppliers to forecast and address any parts supportability issues. The contractor shall provide Government access to the DMSMS database used to manage the DMSMS program through the {Integrated Digital Environment (IDE) or other environment}.

The contractor shall identify and notify the Government of all issues related to the loss or impending loss of manufacturers and suppliers, and the obsolescence of all electronic and non-electronic parts, NDI, and material required for performance of this contract in a DMSMS Implementation Plan. As part of the DMSMS program the contractor shall, to the maximum extent possible, maintain adequate competition among the sources. The contractor’s DMSMS solutions shall minimize impact to the C-sUAS’s life cycle cost and assess impacts to data rights, licenses, certification, training, Technical Orders, Operation Manuals, and sustainment (for example: supply chain and repair procedures). After the Government accepts delivered C-sUAS hardware, the contractor shall address any DMSMS issues by the submittal of an Engineering Change Proposal (ECP). The contractor shall use the SD-22 DoD DMSMS Guidebook, SD-26 DMSMS Contract Language Guidebook and MIL-HDBK-896A, Manufacturing Management Program Guide, as guides in establishing this program. The contractor shall maintain close contact with the OEMs to learn about possible upgrades. The contractor’s processes shall be IAW the following DODIs: 4245.15, DODI 4140.01, 5000.02T, 5000.02, 5000.75, 5000.80, 5000.81, 5000.85, and 5000.87. The contractor shall provide an obsolesce report notice for specific DMSMS or EoL issues as requested by the Government.

A010- OBSOLESCENCE ALERT NOTICE

3.9.5. Help Desk

The contractor shall provide a twenty-four (24) hours per day/seven (7) days per week (24/7), three hundred sixty –five (365) days per year manned phone and monitored email address. The help desk shall respond within 30 minutes to all calls or emails and document the work order in the LMIS or government approved system. The help desk shall immediately begin troubleshooting the issue. If the help desk is unsuccessful in resolving the issue, the work order shall be forwarded to a Subject Matter Expert (SME) or Field Service Representative (FSR) for additional troubleshooting.

3.9.6. Work Orders

The contractor shall provide recording, troubleshooting, tracking, coordination, resolution and reporting of all work orders. The contractor shall ensure all work orders are recorded and updated from initiation until closure in the LMIS IAW the ESSC LMIS Implementation Guide.

The contractor shall leverage increasingly specialized SMEs as needed to troubleshoot/restore the system to an operational state, starting with the help desk and minimizing fly-out support.

The contractor shall immediately contact the Government PM with an explanation regarding any delays or halts in work orders. The contractor shall document and report the actual duration where work could not be performed.

The PCO can escalate a work order priority if a sub-system is centric or critical to that site’s

CONOPS.

3.9.6.1. Work Order Suspense

The contractor shall utilize the suspense feature in the LMIS to stop all metrics clocks when restoration activities have stopped, due to situational circumstances outside of the contractor control. During suspense time, no other delay time will accumulate, to include logistic delay time. The contractor shall inform the Government PM or representative of rationale for all work order suspensions when status has changed.

3.9.7. Metrics and Trend Reporting

The contractor shall track the following metrics and trends in the LMIS. The contract shall analyze events to identify any trends and make recommendations towards improving the metrics at each PMR/TIM.

3.9.7.1. Operational Availability (Ao)

The contractor shall track and report Ao per sub-system, per configuration, per site in the LMIS.

3.9.7.2. Mean Time Between Failure (MTBF)

The contractor shall track and report C-sUAS MTBF in the LMIS.

3.9.7.3. Mean Time To Repair (MTTR)

The contractor shall track and report MTTR performance by event in the LMIS.

3.9.7.4. Mean Logistical Delay (MLD)

The contractor shall track and report MLD metrics per incident in the LMIS.

3.9.7.5. Mean Restoration Time (MRT)

The contractor shall track and report MRT actuals for incidents in the LMIS.

3.9.7.6. Mission Capability Percentage (MC%1)

The contractor shall track and report MC%1 per subsystem, per configuration, per site in the

LMIS.

3.9.7.7. Mission Capability Percentage (MC%2)

The contractor shall track and report MC%2 per configuration, per site in the LMIS.

3.9.7.8. Mission Capability Percentage (MC%3)

The contractor shall track and report MC%3 continuously monthly average per configuration, per site in the LMIS.

3.9.8. Organizational Level Maintenance

The contractor shall deliver Organizational Level Support for each location. Organizational Level Support shall include Corrective Maintenance and Preventive Maintenance, and Inspection (PMI) for all systems, software, ancillary equipment, and associated infrastructure. The contractor shall provide expertise across operations, maintenance, and administration of each system. The contractor shall provide an on-site Field Service Representatives (FSRs), regional FSRs and fly-out support as directed by the Government.

3.9.8.1. Corrective Maintenance

The contractor shall ensure contractor resources have appropriate training and are qualified to provide C-sUAS maintenance and sustainment. The Contractor shall be responsible for, but not be limited to, troubleshooting, equipment fault determination and/or fault isolation at the LRU level, Removal and Replacement (R&R) of failed LRUs, and repair (onsite & depot) for all equipment. The contractor shall collect system logs for analysis and software improvements, pending Government approval. The contractor shall be responsible for all equipment including ancillary components and infrastructure. The contractor shall provide any unique equipment with trained and certified operators if not provided by the base (lifts, bucket trucks, forklifts).

The contractor shall record all inoperative equipment that is removed for repair and/or replacement in the LMIS database. The contractor shall ensure the system is fully mission capable (FMC) after repairs are made. The contractor shall update or create LMIS records to accurately reflect the status of the equipment throughout this process.

AXXX - GFE/GFP CAP REPORTING

3.9.8.2. System of Systems Manuals

The contractor shall maintain a software users manual for the Medusa C2 subsystem. The contractor shall maintain a comprehensive COTS Manual to meet the requirements of the

TMCR.

AXXX – Software User Manual

AXXX – COTS Manual

AXXX – COTS Manual Supplemental Data

3.9.8.3. Preventative Maintenance & Inspection

The Contractor shall conduct Preventative Maintenance and Inspection (PMI) IAW the approved COTS Manuals at locations as directed by the Government. The contractor shall record, manage, and track Preventive Maintenance activities completed by the Contractor or the Government as work orders in the LMIS.

3.9.8.4. Fly-Out Support

The contractor shall deploy expertise to locations as required to perform troubleshooting and/or corrective maintenance. The contractor shall have the capability to have fly-out to a site within 48hrs of Government direction support as required to provide troubleshooting and/or equipment restoration.

3.9.8.5. Depot Level Maintenance

The contractor shall perform an assessment for determination of repair/disposition for equipment received from fielded…