Attachment P4_ Sample Task 1 Acqsec.docx

Sample Task 1: Acquisition Security (ACQSEC) Support

a. Background – NAWCAD Security Department provides embedded program security support to assigned NAVAIR Program Offices to provide security guidance to Program Management regarding Acquisition security requirements and management of all traditional security requirements. The contractor is responsible for providing all assigned personnel, throughout the life cycle of the weapons system, that have necessary expertise for managing the detailed process tasks associated with implementing appropriate security policies, programs and processes to reduce risk and support an uncompromised asset delivered to the fleet.

b. Program Management Aircraft (PMA) 288 has managed the Navy’s F-55 Aircraft for the past 25 years. The ACAT 1D F-55 Program Of Record (POR) was established as a joint project with the Air Force and there are several Foreign Military Sales (FMS) cases that have been established through both services. Because it was fully operational prior to the inception of the Program Protection Acquisition Security requirements, no formal Program Protection Plan (PPP) was established. The Navy is planning to end it’s involvement with the F-55 Aircraft within the next fiscal year and transition to a new weapons system, which is currently being developed by an industry partner. The new ACAT 1D weapons system, titled F-56, will meet all previous mission requirements of the F-55 as well as introduce several new capabilities, which will provide a technological advantage over our adversaries. These new capabilities have been identified as a priority for the warfighter through an Urgent Operational Need (UON). The Milestone decision authority has just approved the F-56 weapons systems to enter at the Pre-milestone B phase of the Acquisition process with Milestone B review set for April 2021. The F-55 Aircraft will remain as a POR for the Air Force and will continue to be supported by both services for all FMS customers.

c. PMA288 has never had dedicated, embedded security support in the form of a Program Security manager (PSM), Foreign Disclosure Officer (FDO) or a trained Contractor Support Services (CSS) Security Specialist to manage all Program security requirements. Overall Program Security risk has been measured and found to be at a very high level. The only acquisition documentation for the F-55 Weapons system that was established was a Security Classification Guide (SCG) and is currently one year overdue a mandatory review. No other formal security documentation or processes have been established. PMA288 and their Prime Contractor experience, on average, six classified spills each year. Findings from preliminary Inquiries identify an absence of security requirements documented in Statements of Work (SOW), lack of understanding of the SCG determination, training insufficiencies, deficiencies with implementing required Cyber Security practices or procedures and poor practices with managing information released to the public. No Acquisition documentation or Research Technology Protection (RTP) processes have been initiated for the F-56 weapons system at this time.

The offeror shall develop an approach and plan that outlines how the offeror would manage the overall security requirements for the Program Office. The plan shall include all acquisition and traditional requirements for both POR weapons systems (F-55/F-56) and the implementation of sound security practices to effectively mitigate current and future security risks.

The offeror’s approach and plan shall specifically address the following areas:

1) Describe the current and potential security risks that must be accounted for.

2) Develop a holistic, fundamental plan to address the implementation of an effective security program for PMA288 that encompasses all areas deficient in the above scenario.

3) Describe actions that can mitigate the identified risk(s), or changes in current processes/metrics that show how current risk is mitigated and could mitigate identified risks in the future.

4) Describe the required Acquisition/RTP documentation that must be addressed for both, the Navy sunset of the F-55 and the establishment of the F-56 POR.

5) Describe critical outside dependencies that can influence the offeror’s ability to successfully complete the plan, and how to manage them if possible.

6) What type of resources are anticipated to support your plan and how would they be utilized?

7) Describe how you would maintain this level of security posture.