C3-U SOW.pdf

P a g e | 1

93 AIR GROUND OPERATIONS WING (AGOW) AND AIR NATIONAL GUARD (ANG)

Command, Control, Communica�ons University (C3-U) - Tac�cal Communicators Course

Statement of Work (SOW)

Version 2.0

20 May 2024

P a g e | 2

1) Course Description: This tactical communications course is designed for the Air Force Special Warfare community and is unique to their specific networks, waveforms, and system requirements.

a) The duration of the course shall be 21 training days, 12 students.

b) The curriculum shall cover all materials in this SOW's equipment and supplies section.

c) The instructor shall teach the course syllabus outlined in the attachment: Course

Syllabus.

2) Facilities/Access:

a) The contractor is responsible for course location and facilities. The contractor requires a

DD-254 to maintain the appropriate access level (TS/SCI).

b) Authorized to receive Government-furnished cryptographic equipment.

c) Authorized to have email and access to both SIPRNET and JWICS.

d) Authorized to have administrative rights to SIPR network stacks.

3) Instructor Qualifications:

a) Instructor Qualification/Prerequisites: The Contract shall ensure instructors possess appropriate security clearances for the operation of the system and instructor lessons.

This requirement cannot be waived.

b) The contractor is expected to maintain a minimum of 2 full-time team members who are graduates of the USAF Weapons School. This requirement underscores the need for highly qualified personnel to deliver the course effectively.

c) The contractor shall provide 3 x instructors for the entirety of the course. All instructors will have 7+ years of relevant distributed C2 experience to deliver the course content effectively and ensure a comprehensive learning experience for the attendees.

4) Courseware:

a) The Contractor shall manage, develop, distribute, publish, maintain, make corrections to and update courseware (format, grammar, spelling, and content), including courseware baselines, syllabi, and training materials for all syllabi noted in the SOW.

b) The Contractor shall identify conflicts within publications, regulation, specification, requirements regarding courseware material style, format, content, and interactivity level.

c) The Government maintains the right to modify the course syllabus up to 45 days before execution. This flexibility ensures the ability to restructure coursework as needed, shift focus areas, and cater to specific audiences. However, these modifications will not introduce new equipment/skills beyond what's already in this SOW and will not extend the course beyond 21 days.

d) Within ten (10) days of course completion, the contractor shall solicit, and the U.S.

Government as a valued partner, shall provide written feedback on the curriculum. This feedback will be utilized to adjust the desired learning objectives, instruction blocks, instructors, and training materials. Feedback is crucial in our continuous effort to improve the course.

e) Within sixty (60) days of course completion, the contractor must implement any changes, update course materials, and be ready to execute additional training iterations if the Government solicits.

P a g e | 3

-The contractor shall host a bi-monthly working group to solicit stakeholder feedback and provide project status reports.

5) Security (Cybersecurity)

a) The Contractor shall comply with the cybersecurity guidance to ensure compliance with:

i) AFI 17-130, Cybersecurity Program Management.

ii) AFI 17-101 Risk Management Framework (RMF) for Air Force Information

Technology (IT).

iii) AFI 33-332, The Air Force Privacy and Civil Liberties Program.

iv) AFMAN GM 17-1303, Cybersecurity Workforce Improvement Program.

v) CJCSI 6211.02D, Defense Information Systems Network (DISN) Responsibilities.

vi) CNSSI 1253, Security Categorization and Control Selection for National Security

Systems.

vii) DoD 5400.11R, Department of Defense Privacy Program.

viii) DoDI 8500.01, Cybersecurity.

ix) DoDI 8510.01, Risk Management Framework (RMF) for DoD Information

Technology (IT).

x) DoDM 8570.01, Information Assurance Workforce Improvement Program (Replaced with DoDD 8140.01).

xi) DoDI 8582.01, Security of Unclassified DoD Information on Non-DoD Information

Systems.

xii) NIST 800.30, Guide for Conducting Risk Assessments.

xiii) NIST 800.37, Guide for Applying the Risk Management Framework to Federal

Information Systems

xiv) NIST 800.53, Security and Privacy Controls for Federal Information Systems and

Organizations.

xv) AFI 16-1404, Air Force Information Security Program.

xvi) AFMAN 17-1301 Computer Security (COMPUSEC).

xvii) AFSSI 7700, Emission Security (EMSEC)

xviii) Air Force Manual 33-214, Emission Security Countermeasures Review.

xix) Air Force Pamphlet 63-113, Program Protection Planning for Life Cycle

Management.

xx) Appendix III to Office of Management and Budget Circular No. A-130, “Security of

Federal Automated Information Resources”

xxi) DoD 5220.22 Volume 2, AFMAN 16-1406 Volume 2, National Industrial Security

Program

xxii) DoDI 5200.44 Protection of Mission Critical Functions to Achieve Trusted

Systems and Networks

xxiii) DoDD 8140.01, Cyberspace Workforce Management

xxiv) FIPS PUB 199, Standards for Security Categorization of Federal Information and

Information Systems.

xxv) ISO 10005 Quality Management Systems

P a g e | 4

6) Operations Security (OPSEC)

a) The Contractor shall develop an OPSEC plan and apply OPSEC principles and practices to reduce program vulnerability from successful adversary collection and exploitation of Critical Information.

7) Communications Security (COMSEC)

a) Access to COMSEC material is restricted to US citizens holding final US Government clearances. Such information is not releasable to personnel holding only reciprocal clearances. The Contractor shall obtain and maintain External Certificate Authority certificates for authenticating, digital signing, and or encrypting communications allowing security electronic communications with the Government.

b) The Contractor shall comply with COMSEC requirements IAW AFMAN 17-1302, Communications Security (COMSEC) Operations.

c) The Contractor shall train all employees having access to, or a requirement for using COMSEC material in the proper way of handling and safeguarding such equipment.

8) INDUSTRIAL SECURITY

a) The Contractor shall establish, implement, and maintain security requirement IAW provisions of the Department of Defense Manual (DoDM) 5200.01, Vol 1-4, DoD Information Security Program. The Contractor shall comply with DoDD 5400.07 /Air Force Manual (AFMAN) 33- 302, DoD Freedom of Information Act (FOIA) Program requirements. This regulation sets policy and procedures for disclosure of records to the public. See DoDM 5200.01 Volumes 1-4, Information Security Program, for marking, handling, transmitting, and safeguarding controlled unclassified information and material.

b) The Contractor shall comply with requirements of DD form 254, DoDM 5220.22 Vol 2/AFMAN 16-1406 Vol 2.

c) The Contractor shall report to an appropriate Government authority any information or circumstances which they are aware that may pose a threat to security of DoD personnel, Contractor personnel, resources, and classified or unclassified defense information.

d) The Contractor shall obtain a Defense Information Security System (DISS) account(s) to accomplish requirements of this contract.

e) The contractor shall provide a system security IAW a System Security Plan (SSP) for operation and maintenance of all classified components for the required security level.

9) Personnel Security

a) The Contractor shall ensure the requirements for granting access to classified information are met, is current, and as defined in the following:

i) DD Form 254

ii) DoD 5220.22-M

iii) DoDM 5200.01 Volumes 1-4

P a g e | 5

iv) DODM 5200.01/AFI 16-1404, Air Force Information Security Program Management

v) DODM 5220.22 Vol 2/AFI 16-1406, National Industrial Security Program

b) All Contractor personnel shall obtain a DoD security clearance to the TOP SECRET level at a minimum as a condition of employment. The Contractor shall maintain the appropriate security clearances for its personnel during the duration of the contract.

c) The Contractor shall comply with, coordinate, and complete a DD Form 254, Department of Defense Contract Security Classification Specification requirements. Upon execution of award, the PCO will sign the DD Form 254. All classified information and equipment shall be returned to the Government upon contract termination or when notified by the U.S. Government that the equipment is needed.

d) The Contractor shall submit personnel security investigative paperwork for trustworthiness determinations IAW DODM 5220.22, Vol 2/AFI 16-1406, Vol 2, Air Force Industrial Security Program within 15 days of contract award.

10) SECURITY TRAINING

a) The Contractor shall ensure that each Contractor and Subcontractor employee completes the appropriate security training for the information being handled; (a) prior to performing any contract work, and (b) completes the annual refresher training throughout the PoP.

b) In addition to DoD Cybersecurity training, the Contractor shall ensure that each Contractor and Subcontractor employee completes specific Cybersecurity training IAW the applicable site and device SSP noted in #11.

11) SECURITY VIOLATION

a) Violations of rules, regulations, procedures, and policies will be dealt with consistent with the Contractor’s Security Violation Policy and Uniform Code of Military Justice.

Violations will be evaluated on an individual basis and will be adjudicated based on the ultimate impact to National Security and prior record of employee(s) involved. A security violation is any failure to comply with security regulations and or instructions, resulting in a real or potential compromise of classified/sensitive program information. In addition, any willful failure to comply with security policies and procedures constitutes a security violation even when no compromise has taken place. Security violations or suspected violations shall be immediately reported to the Facility Security Officer, 93D AGOW Information Protection, 93 AGOW Acquisition Program Manager, and Contracting Officer within 24 hours of the incident, for investigation and subsequent reporting to the Security Police/Contract Security Office/Office of Special Investigations, as appropriate.

b) Examples of violations include, but are not limited to, the following:

i) Any willful failure to comply with the security regulations and procedures established in this and other documents as published.

ii) Disclosure of classified information to any person not having required clearance or need to know.

iii) Unauthorized admittance of un-cleared personnel

P a g e | 6

iv) Any discrepancy resulting in an inadvertent disclosure or loss of classified information.

v) Failure to properly secure a classified security container, room, or facility.

vi) Unauthorized reproduction of classified documentation or data.

vii) Failure to properly mark classified material (e.g., UNCLASSIFIED, CONFIDENTIAL, SECRET, SPECIAL CATEGORY)

viii) Input of classified information on an unclassified Automated Information System

(AIS) or bringing unauthorized AIS onto the site.

ix) An inquiry will be performed in the event of a security incident. If it is determined the security incident is a probable or actual compromise, a damage assessment will be performed. The Contractor shall support the Original Classification Authority (OCA) during damage assessment.

12) QUALITY ASSURANCE

a) The U.S. Government has the right to visit the facility and observe instruction of students. The Contractor shall recognize FAR clauses 52.246-2, 3, 4, and 5, Inspection of Services and Supply for Fixed Price and Cost Reimbursement Contracts.

13) SAFETY

a) The Contractor shall generate, implement, maintain, a safety plan to analyze, prevent, eliminate, and or minimize hazards IAW commercial best practices, Military Standard (MIL-STD)-882E, DoD Standard Practice for System Safety, AFMAN 91-203, Air Force Consolidated Occupational Safety Instruction standards, Occupational Safety and Health Act (OSHA), local base regulations (if applicable), and Environment, Safety and Occupational Health (ESOH).

b) If required, The Contractor shall take additional immediate precautions as directed by the Procurement Contracting Officer (PCO) for health and safety purposes.

c) The Contractor shall be responsible for the proper handling, storage, transportation, and disposal of hazardous waste resulting from performance of this contract IAW AFI 32- 7042, Waste Management, host-base directives and guidelines (if applicable), 40 Code of Federal Regulations (CFR), Parts 260 - 271, and 49 CFR, Parts 171 and 172 and paragraph 2.2.9.4.

14) Training Management

a) Compliance with the regulations listed on the attached reference table is mandatory.

b) The USG will ensure all equipment is in place at the applicable training location NLT 60 days prior to course start date.

c) As applicable, the USG will provide subject matter experts (SME) that will provide recommendations regarding standardizing equipment configuration for the course.

P a g e | 7

d) Once equipment configurations have been standardized, the contractor will develop a course form detailing the recommended equipment configuration. Before the course start, all USG provided equipment will comply with this course form:

i) Cloud RF: MANET Planning Software

ii) PRC-161 / Link 16

iii) PRC-163,167, TW-875 / MANETs

iv) PRC-117G / MUOS & SATURN

v) PRC-160 / 3G, 3G+, 4G, LDD

vi) SKL/Crypto

vii) Maneuver Gateway

e) Use of the ADDIE (Analysis, Design, Development, Implementation, and Evaluation) methodology is highly recommended for all aspects of the program.

f) The contractor shall provide written materials (e.g., manuals, handbooks, texts) customarily provided with course offerings. Upon course completion, such documentation will become the customer's property.

g) The course will be 21 days long to ensure sufficient hands-on training. The contractor will provide up to 3 trainers per training event. Unless otherwise negotiated, training courses are limited to 12 attendees.

15) Training Cancelation and Rescheduling:

a) The U.S. Government must notify the contractor ten (10) business days before the scheduled training date if there is a need to cancel or reschedule the training. If the U.S.

Government needs to reschedule a course start date, the U.S. Government must collaborate with the contractor to determine a mutually agreeable time and date for the rescheduled training. Failure to cancel or reschedule within the specified timeframe will result in the U.S. Government being liable for the contracted dollar amount of the training course. If the contractor cannot proceed with the training on the agreed-upon date, the contractor must inform the U.S. Government at least fifteen (21) business days before the scheduled training date.

16) Limitation of Liability:

a) Except as expressly provided for herein, neither party shall be liable to the other for special, consequential, incidental, or indirect damages arising out of or in connection with its performance under this Agreement, whether in contract, tort, or otherwise, even if such party has been made aware of the possibility of such damages.

17) Warranties:

a) The manufacturer of any products and services furnished hereunder provides warranties to the extent such warranties are customarily offered to the public or the relevant manufacturer's other regular customer(s) in the regular course of business, except for any express or implied warranties that this Agreement and anything furnished hereunder may not have. Neither party will be liable for any indirect, special, consequential, or punitive damages in connection with or arising out of the performance of this Agreement or the

P a g e | 8 use of any item of confidential and proprietary information furnished hereunder, except as provided herein.

P a g e | 9

Attachment: Proposed Course Syllabus

DAY DESCRIPTION

Network Architecture Familiarization (community specific) - The "Why" Radio, Antenna Type, & Secure Key Loader Familiarization Test Out IPv4 Addressing Knowledge Basics Test Out

Radio Basic Operations Basic Antenna Theory & Design Test Out

Waveform Introduction - LOS/HAVEQUICK/SATURN Test Out

Waveform Introduction - MUOS Waveform Setup/Operation Introduction - MUOS Test Out

Waveform Introduction - HF / 3GIP / 4G HF Antenna Types, Antenna Theory, Antenna Design, FEAKs Tac Chat IP over 3GIP ALE Configuration and Operation Test Out

MANET Overview TSM Mission Planning TSM Crossbanding TSM Network / Crossbanding Repetitions Test Out

TSM Location Planning / Physics Re-hack - Cloud RF TSM + COTS TW Integration Test Out

Introduction to MTN / (Pre-Req is JT-101) Introduction to Link-16 Use, Integration, Terminals / RF & JREAP Types Test Out

Intro to PRC-161 / Terminal Fam / See 797 for PRC 161 PRC-161 Terminal Link Operations / J Series message TX/RX PRC-161 Terminal SWAK Integration Test Out

Intro to TACP Maneuver Gateway / MOJO / STT / See 797 for TACP MG TACP MG / MOJO / STT Operations, Integration, & 797 task Test Out

Intro to TRAX/WARHAWK: What is it? How is it used/employed?

TRAX/WARHWAWK Configuration, Setup, Operation Test Out

P a g e | 10

DAY DESCRIPTION

Intro to NETWORK STACK INTEGRATION TSM, HF, MUOS Network Stack Integration / Is there a 797 completed?

Network Stack Configuration Radio Integration

Refresh Network Concepts TAK Server Integration Basic Troubleshooting Test Out

Student COMMEX Scenario Drop and Objectives / Revolve around current threats and the ISET UTC and C2 TTPs

Student COMMEX Mission Planning Student RFIs to Instructors Student Mission Planning, Equipment Request and Equipment Prep

Revisit Documented Topics / Crypto Key Issue to Students / Fill Radios & Devices Student COMMEX / All Waveforms / Network Integration / Achieve Community Baseline

16-21 Scenario Based Events / Community Specific Full Mission Profiles/COMMEXs

P a g e | 11

GLOSSARY / ACRONYMNS TABLE:

SOW - Statement of Work USAF - United States Air Force SIPRNET - Secret Internet Protocol Router Network JWICS - Joint Worldwide Intelligence Communications System C2 - Command and Control DD-254 - Department of Defense Contract Security Classification Specification TS/SCI - Top Secret/Sensitive Compartmented Information AFI - Air Force Instruction RMF - Risk Management Framework AFMAN - Air Force Manual DISN - Defense Information Systems Network CNSSI - Committee on National Security Systems Instruction DoD - Department of Defense FIPS PUB - Federal Information Processing Standards Publication IAW – In Accordance With ISO - International Organization for Standardization OPSEC - Operations Security COMSEC - Communications Security COMPUSEC - Computer Security EMSEC - Emission Security FAR – Federal Acquisition Regulation FOIA - Freedom of Information Act DISS - Defense Information Security System SSP - System Security Plan OCA - Original Classification Authority PCO - Procurement Contracting Officer MIL-STD - Military Standard

P a g e | 12

REFERENCE TABLE (manuals, AFMAN, AFI, etc.):

DODM 5220.22/AFMAN 16-1406, National Industrial Security Program: Industrial Security Procedures for Government Activities.

DODM 5200.01/AFMAN 16-1404, Vol 4, Information Security Program: Protection of Classified Information.

DODM 5200.01/AFMAN 16-1404, Vol 1, Information Security Program: Overview, Classification, and Declassification.

DODM 5200.01/AFMAN 16-1404, Vol 2, Information Security Program: Marking of Information.

DODM 5200.01/AFMAN 16-1404, Vol 3, Information Security Program: Protection of Classified Information 32 Code of Federal Regulation, Part 117 and Industrial Security Letter 2021-02.

AFI 17-130: Air Force Instruction 17-130, Cybersecurity Program Management AFI 17-101: Air Force Instruction 17-101, Risk Management Framework (RMF) for Air Force Information Technology (IT) AFI 33-332: Air Force Instruction 33-332, The Air Force Privacy and Civil Liberties Program AFMAN 17-1302: Air Force Manual, Communications Security (COMSEC) Operations AFMAN 17-1303: Air Force Manual GM 17-1303, Cybersecurity Workforce Improvement Program AFMAN 17-1301: Air Force Manual 17-1301, Computer Security (COMPUSEC) AFSSI 7700: Air Force Special Security Instruction 7700, Emission Security (EMSEC) DoDI 8500.01: Department of Defense Instruction 8500.01, Cybersecurity DoDI 8510.01: Department of Defense Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT) DoDI 8582.01: Department of Defense Instruction 8582.01, Security of Unclassified DoD Information on Non-DoD Information Systems DoDD 8140.01: Department of Defense Directive 8140.01, Cyberspace Workforce Management DoDM 8570.01: Department of Defense Manual 8570.01, Information Assurance Workforce Improvement Program (Replaced with DoDD 8140.01) FIPS PUB 199: Federal Information Processing Standards Publication 199, Standards for Security Categorization of Federal Information and Information Systems CJCSI 6211.02D: Chairman of the Joint Chiefs of Staff Instruction 6211.02D, Defense Information Systems Network (DISN) Responsibilities CNSSI 1253: Committee on National Security Systems Instruction 1253, Security Categorization and Control Selection for National Security Systems DoD 5400.11R: Department of Defense Regulation 5400.11R, Department of Defense Privacy Program DoDM 8570.01: Department of Defense Manual 8570.01, Information Assurance Workforce Improvement Program (Replaced with DoDD 8140.01) NIST 800.30: National Institute of Standards and Technology Special Publication 800.30, Guide for Conducting Risk Assessments NIST 800.37: National Institute of Standards and Technology Special Publication 800.37, Guide for Applying the Risk Management Framework to Federal Information Systems NIST 800.53: National Institute of Standards and Technology Special Publication 800.53, Security and Privacy Controls for Federal Information Systems and Organizations ISO 10005: International Organization for Standardization 10005, Quality Management Systems

P a g e | 13