B01 Attachment 2 - SOW.docx

UNCLASSIFIED

Statement of Work (SOW)

1. Background & Overview

Project Overview: Joint Cyber Intelligence Suite (JCITS) Malware Intelligence Triage Tool (JMITT) Platform supports the Defense Counterintelligence and Security Agency (DCSA) Counterintelligence Cyber Mission Center (CIC). JMITT is a platform that ingests emails provided by cleared contractors (CC) and automatically conducts a real-time analysis of suspicious attachments to determine whether they contain malicious content. This processing assists cleared personnel to make an informed decision about opening those links or attachments. JMITT was created out of necessity to keep malware off DCSA networks. Cleared industry partners were asked to report suspicious contacts to DCSA personnel. As such, CCs were forwarding suspicious emails to DCSA personnel, potentially exposing DCSA’s network to malware. To stop malicious content from being ingested into DCSA’s network, CIC contracted with Georgia Tech Applied Research Corp. (GTARC) to develop the Malware Relationship Triage Tool (MReTT) to support JMITT (which is built on the Apiary platform).

Business Objectives: The mission of protecting information and information systems within its industry partners is an ongoing endeavor. Adversaries continue to present a persistent threat taking advantage of new forms of intrusion, malware, and data exfiltration. By using new technology advances and adjusting focus on potential vulnerabilities, DCSA can strengthen cybersecurity activity and Cybersecurity Defense Operations (CDO).

2. Scope of Work

The capability for the requirement must be a Software-as-a-Service (SaaS) that conducts analytics on information relevant to malicious software and threat actor behaviors. Information of this nature shall be sourced either through open internet collection means, gathered through malware analysis, or provided by the sponsor. Analysis can include machine learning, semantic analysis, big data analytics, graph analytics, and statistical trending.

In-Scope Services & Features: The Contractor shall provide SaaS support and maintenance and a deliverable Information Security Analysis Trend Report (ISATR) (CDRL A002).

Software support and maintenance details: The Contractor shall provide support and maintenance to the JMITT MReTT as necessary. The contractor shall maintain the software application so that it provides continuous metrics analysis of system status, function, security, and access control via user interface dashboards.

On-premises details: The Contractor shall maintain the isolated infrastructure on-premises (limited Government Owned-Contracted Operated) located in Atlanta, Georgia.

Subscription Details:

The SaaS must be scalable to support up to 10,000 suspicion email submissions per day. The submitter shall submit a suspicious email, and the SaaS shall provide an automated response in less than 30 minutes but no later than the end of business day.

The SaaS must provide an Information Security Analysis Trend Report (ISATR) that includes: Early identification and notification of trending malware topics, including identifying discussions on new software threats; linking open-source reporting information to provide a knowledge base for malware and threat actors, including linking Anti-Virus (AV) vendor malware names together; analysis of threat actor communications to identify possible new exploit development efforts; identification of trends in malicious software through analysis of malware behaviors and static characteristics; and identification of unique or rare malicious software samples that may indicate a targeted threat.

Integration:

The SaaS for this requirement must: integrate a malware analysis tool (Apiary) containing a repository of more than 288 million malware samples that provides automated analysis and threat reporting capabilities to the information security community; include custom algorithms, frameworks, and visualizations to support the detection of targeted malware and other sophisticated threats; be a SaaS instantiation of Apiary, the Malware Relationship Triage Tool (MReTT) that will augment the data available to a DCSA Counterintelligence Agent (CISA) and provide clear and more coherent indicator of online threats.

The SaaS solution must connect with and be fully integrated into JMITT.

Quality Control (A001):

The Contractor must develop and maintain an effective quality control program, including a Quality Control Plan (QCP), to ensure services are performed in accordance with this SOW. The Contractor’s quality control program will assure the Contractor that work complies with the requirement of the contract. The contractor must deliver the QCP within 30 calendar days after contract award. A comprehensive written QCP must be submitted to the Contracting Officer (KO), Contract Specialist (CS) and Contracting Officer’s Representative (COR) within five business days when changes are made thereafter. After acceptance of the QCP, the Contractor must receive the KO’s acceptance in writing of any proposed change to its QCP.

Phase-In Plan (A005): During the phase-in of the contract/order, which is determined to be within 90 calendar days of contract award, a smooth and orderly transition between the incumbent contractor and the United States Government is necessary to ensure a minimum disruption to vital Government business.

Contractor Responsibilities – The contractor shall cooperate to the extent required to permit an orderly implementation. Phase-in activities include, but are not limited to, the tasks below.

Phase-In Plan Submission – The contractor shall submit a comprehensive phase-in plan to the KO and COR within 90 calendar days of contract award.

Schedule Adherence – The contractor shall maintain the phase-in schedule included within the phase-in plan.

Phase-In Checklist – The contractor shall develop and execute a phase-in checklist [documenting the completion of all required implementation activities]. This checklist shall be submitted to the Government for review and acceptance no less than 14 business days of contract award.

Government Acceptance – The phase-in will be deemed completed upon approval by the KO or COR when it is determined that the contract/order has been successfully implemented as required.

Phase –Out Plan (A006): During phase-out of the contract/order, which is determined to be a period of 30 calendar days prior to the lifecycle end date of the contract/order, a smooth and orderly transition between the incumbent contractor and the United States Government is necessary to ensure a minimum disruption to vital Government business.

Contractor Responsibilities – The contractor shall cooperate to the extent required to permit an orderly changeover to the Government. Phase-out activities include, but are not limited to, the tasks below.

Phase-Out Plan Submission – The contractor shall submit a comprehensive phase-out plan to the KO and COR within 60 calendar days before contract closeout.

Schedule Adherence – The contractor shall maintain the phase-out schedule included within the phase-out plan.

Property Transition – The contractor shall have all government-furnished property and services ready for pick up by DCSA personnel no later than the final day of the contract/order.

Documentation Transition – The contractor shall transfer all supporting documentation, including but not limited to licenses to the United States Government.

Account Transition – The contractor shall facilitate the transition of all relevant user accounts and access credentials and data feed licenses, ensuring access levels are maintained for the Government.

Knowledge Transfer – The contractor shall provide comprehensive knowledge transfer on the established installation, operation, and maintenance procedure of the supported technologies. The phase-out plan shall clearly describe the proposed methodologies to be utilized for such transfer, including but not limited to written documentation, manuals, formal classroom training, and one-on-one training sessions.

Phase-Out Checklist – The contractor shall develop and execute a phase-out checklist [documenting the completion of all required transition activities] This checklist shall be submitted to the Government for review and acceptance no less than 14 business days prior to final contract/order closeout.

Government Acceptance – The phase-out will be deemed completed upon approval by the KO or COR when it is determined that the transition of property, documentation, accounts, and knowledge acquired or developed as a part of the contract/order have been successfully changed over from the outgoing contractor to the Government as required.

3. Period of Performance

The period of performance will start after contract award and include a Base Period with a duration of six (6) months and (4) four potential (12) month Option Periods.

Base: 01 August 2026 – 31 January 2027 Option Year 1: 01 February 2027 – 31 January 2028 Option Year 2: 01 February 2028 – 31 January 2029 Option Year 3: 01 February 2029 – 31 January 2030 Option Year 4: 01 February 2030 – 31 January 2031

4. Service Level Agreement (SLA)

The SLA defines the expected level of service, including performance standards and remedies for failure to meet these standards.

Uptime Guarantee: The JMITT operational availability: 99.9%, Monday - Friday, 06:00 am to 06:00 pm EST.

Support & Maintenance: The Contractor System Administration Representatives shall monitor the SaaS and notify the Government Point of Contact (POC) if the system goes down. The method of technical support and maintenance may be Contractor determined (i.e., phone, electronic mail, or virtual/online) but must be accessible to the Government during the defined business hours, 06:00 am to 06:00 pm, to minimize service interruptions.

Support Hours: Support shall be available Monday - Friday, 06:00 am to 06:00 pm EST.

Response Times: The Contractor shall resolve support requests, by priority (e.g., High, Medium, Low). A response must be provided within 2 hours of help request initiation(s) received during the defined business hours.

Remedies for SLA Breaches: The Contractor may provide a service credit or period of performance extension equal to the length of SLA breach(es) if it fails to meet the agreed-upon service levels.

5. Data Management & Security

Data Ownership: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights. DCSA has access rights to analytic reports and JMITT user Email submissions.

Data Security: Contractor will not have unsupervised access to systems and networks.

The contractor shall comply with OPSEC requirements contained in the contract, addendum thereto, or identified herein. The contractor will comply with all security and OPSEC policies, directives, instructions or mandates as directed. OPSEC and other security guidance issued to the Prime Contractor shall also apply to subcontractors working on this effort.

The contractor will ensure compliance with the Agency’s OPSEC Policy Statement, Critical Information and Indicators List (CIL), and unclassified document destruction procedures. Items of critical information are those facts, which individually, or in the aggregate, reveal sensitive details about the mission, operation, etc., and thus require protection from adversarial collection or exploitation.

Include OPSEC as part of the security awareness program. The contractor shall be familiar with OPSEC and will be required to take government furnished initial and annual refresher OPSEC training and provide certificates as CDRL A003 and will be reminded of their continued responsibility to protect sensitive information as directed by DoDM 5205.02. Sensitive unclassified information includes, but is not limited to, agency identified critical information, legacy “For Official Use Only” (FOUO), Controlled Unclassified Information (CUI), Privacy Act of 1974, Personally Identifiable Information (PII), Department of Defense Unclassified Controlled Nuclear Information (DoD UCNI) and company proprietary information.

The contractor shall take the necessary precautions to ensure employees with access to the sensitive and critical information are instructed not to disclose or disseminate any information relating to the conduct and performance of the contract to any individual not authorized to perform on this contract. Assigned personnel shall be knowledgeable of the designated critical information and measures in place to protect it.

For programs protected by a Program Protection Plan (PPP) and have identified Critical Program Information (CPI) and/or Critical Technologies Information (CTI), must be identified and protected in accordance with DoD Instruction 5200.39, CPI Identification and Protection within RDT&E. The contractor shall ensure that any program with CPI or CTI has the corresponding supplements and associated plan, such as an OPSEC plan, approved and in effect in support of the PPP.

The contractor shall comply with OPSEC content review policies within the Agency. A content review is an evaluation of all information, to include all CUI, intended for release outside the control of the organization or release to the public. OPSEC focuses on identifying and protecting the organization’s unclassified information that may individually or in the aggregate lead to the compromise of classified information and sensitive activities. The contractor will ensure that these reviews are conducted according to agency guidance in accordance with mandates from DoDD 5205.02E, DoD OPSEC Program, DoDM 5205.02-M, DoD OPSEC Program Manual, DoDI 5230.09, Clearance of DoD Information for Public Release, DoDI 5230.29, Security and Policy Review of DoD Information for Public Release, DoDI 5400.04, Provision of Information to Congress, DoDM 5400.07, DoD FOIA Program, and DoDI 8170.01, Online Information Management and Electronic Messaging.

Further OPSEC guidance may be obtained by the Prime contractor contacting the OPSEC PM by group e-mail: dcsa.quantico.dcsa-hq.mbx.operations-security@mail.mil.

All programs and materials developed at government expense during the performance period of this contract are the property of the US Government.

Contractor personnel shall utilize US Government or official company e-mail for transmitting official US Government business. Official US Government business shall NOT be transmitted via personal, private, and/or commercial e-mail accounts, i.e., YAHOO, HOTMAIL, GMAIL, JUNO, AOL, COMCAST, KNOLOGY, VERIZON, etc.

Data Portability & Deletion: The Contractor shall provide an ISATR and present that data in a manner that enables analysts to identify malicious software and threat actor behaviors. The Contractor shall permanently delete all client data from their systems after the contract ends.

6. Roles & Responsibilities

Vendor Responsibilities:

· The Contractor shall provide technical support, ongoing SaaS maintenance, and any respective platform upkeep as required by the provider and/or the Government for associated licensing.

· The Contractor shall provide timely (i.e., 48-hours) notice(s) (e.g., support resolution, SaaS maintenance, and downtime) to the Government. The Contractor shall determine the method of notice(s) (i.e., phone, electronic mail, or virtual/online) as required.

· The Contractor shall provide a point-of-contact (POC) to the Government for support, notice(s), and/or license renewal inquiries. The Contractor may determine the best POC (i.e., Program/Project Manager, Business/Sales Manager).

Government Responsibilities:

The Government shall not exercise direct supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

· The Government shall provide timely (i.e., 48-hours) service and maintenance request(s) as needed.

· The Government shall provide timely (i.e., 48-hours) acceptance of notice(s) received from the Contractor; the Government may determine the method of acceptance notice(s) (i.e., phone, electronic mail, or virtual/online) as required.

· The Government shall provide a POC to the Contractor to receive notice(s) and other respective communication. The Government may determine the best POC (i.e., Contracting Officer Representative (COR), Contracting Officer (KO), or Technical Point of Contact (TPOC)).

· The Government shall provide timely review and acceptance (i.e., one week) of the deliverables.

7. Deliverables

Training Certificates A003

8. Section 508 Compliance

Section 508 Compliance: Information and Communication Technology (ICT) Accessibility Requirements Statement per the Revised Section 508 of the Rehabilitation Act: ICT that is procured, developed, maintained, or used by agencies shall conform to the Revised 508 Standards. Section 508 requires access to ICT developed, procured, maintained, or used by federal agencies. Examples include computers, telecommunications equipment, multifunction office machines such as copiers that also operate as printers, software, websites, information kiosks and transaction machines, and electronic documents. The Section 508 Standards, which are part of the Federal Acquisition Regulation, ensure access for people with physical, sensory, or cognitive disabilities. Contractor shall ensure maintenance upgrades, substitutions, and replacements to software pursuant to this contract do not reduce the original level of conformance with the applicable Revised 508 Standards at the time of contract award.

Exceptions:

1. E202.2 Legacy ICT - Any component or portion of existing ICT that complies with an earlier standard issued pursuant to Section 508 of the Rehabilitation Act of1973, as amended (as republished in Appendix D), and that has not been altered on or after January 18, 2018, shall not be required to be modified to conform to the Revised 508 Standards.

2. E202.3 National Security -The Revised 508 Standards do not apply to ICT operated by agencies as part of a national security system, as defined by 40 U.S.C. 1103(a).”

UNCLASSIFIED

image1.png