Cybersecurity Statement of Work (SOW)_V1_20AUG25.docx

CONTROLLED UNCLASSIFIED INFORMATION

SVT

Cybersecurity Statement of Work Aug 2025

PEO STRI

Soldier Virtual Trainer (SVT)

Cybersecurity Statement of Work (SOW) Document Version: 1.0.0 Aug 2025

Prepared For:

U.S. Army Program Executive Office Simulation, Training, and Instrumentation (PEO STRI) Orlando, Florida 32826-3275 Prepared By:

12249 Science Drive, Suite 200 Orlando. FL 32826

Control Statement:

Controlled by: PEO STRI Controlled by: Jeffrey Ketts CUI Category: Contract Use (CONTRACT) Limited Dissemination Control: FEDCON POC: Ketts, Jeffrey L CIV USARMY PEO STRI (USA): jeffrey.l.ketts.civ@army.mil

1. Cybersecurity Lead Integrator

1.1. The Cybersecurity Lead Integrator shall be responsible for the oversight and coordination of the cybersecurity effort by acting as the primary liaison between the Government, software developers, and other stakeholders to ensure cybersecurity requirements are met. They shall coordinate cybersecurity efforts across multiple software development teams to ensure consistency and compliance with applicable regulations and ensure all teams adhere to the Risk Management Framework (RMF) Confidentiality, Integrity, and Availability (CIA) standards.

1.2. The vendor shall provide DevSecOps Leadership to include:

1.2.1. Lead the integration of DevSecOps practices across all software development teams to embed security into the software development lifecycle (SDLC).

1.2.2. Establish and enforce the use of automated security testing, vulnerability scans, and compliance checks within Continuous Integration/Continuous Deployment (CI/CD) pipelines.

1.2.3. Promote collaboration between development, security, and operations teams to address security concerns early and iteratively.

1.3. The vendor shall provide Cybersecurity Planning and Strategy by developing and maintaining a comprehensive cybersecurity strategy that aligns with the program's objectives and regulatory requirements.

1.4. The vendor shall provide Vulnerability Management by:

1.4.1. Overseeing the implementation of vulnerability management processes across all software development teams to include but not limited to:

1.4.1.1. Performing automated and manual vulnerability scans using evaluateSTIG as well as other tools including but not limited to: ACAS/Nessus and SCAP

1.4.1.2. Ensuring timely remediation of vulnerabilities identified during scans and penetration testing.

1.4.1.3. Incorporating Information Assurance Vulnerability Management (IAVM) updates into software revisions and fielded systems.

1.5. The vendor shall provide Compliance and Accreditation by:

1.5.1. Ensuring that all software and systems maintain Authority to Operate (ATO) certification by meeting RMF standards.

1.5.2. Overseeing the configuration of systems to meet Security Technical Implementation Guide (STIG) compliance and ensure adherence to patch management and IAVM requirements.

1.5.3. Supporting the accreditation process by providing required documentation and ensuring compliance with applicable standards.

1.5.4. Coordinating with the Government to address any findings or issues identified during the accreditation process.

1.6. The vendor shall provide Cybersecurity documentation by:

1.6.1. Overseeing the creation, maintenance, and submission of cybersecurity documentation, including but not limited to:

1.6.1.1. System Security Plan (SSP)

1.6.1.2. System Contingency Plan (SCP)

1.6.1.3. Plan of Action and Milestones (POA&M)

1.6.1.4. Information Assurance Vulnerability Alert (IAVA) Reports

1.6.1.5. Control Family SOPs (Standard Operating Procedures)

1.6.2. Ensure that all Cybersecurity documentation is consistent, accurate, and up to date.

1.7. The vendor shall provide collaboration and communication by:

1.7.1. Facilitating communication and collaboration between software development teams, the Government, and other stakeholders to ensure alignment on cybersecurity objectives.

1.7.2. Provide regular updates to the Government on the status of Cybersecurity efforts, including but not limited to:

1.7.2.1. Progress on DevSecOps integration

1.7.2.2. Vulnerability management

1.7.2.3. Accreditation status

1.8. The vendor shall provide continuous monitoring and vulnerability management by:

1.8.1. Implementing continuous monitoring processes to ensure the security of systems and software throughout their lifecycle.

1.8.2. Using DevSecOps practices to automate monitoring and reporting of security metrics.

1.8.3. Identifying and addressing emerging threats and vulnerabilities in a timely manner and providing POAM remediation.

2. Training

2.1. All personnel that have privileged access and are part of the cybersecurity workforce, network administration or systems administration, and some developers (excluding COTS products) shall possess the necessary skills and expertise to implement and maintain effective cybersecurity controls in accordance with relevant industry standards and guidelines, including NIST SP 800-53 rev 4 and rev 5 and AR 25-2.

2.2. All personnel shall possess an in-depth understanding of cyber concepts and processes and apply this knowledge to implement the system cybersecurity requirements IAW their specific duties.

2.3. The Government will verify the contractor's implementation of these cybersecurity controls using reviews and checks throughout the process. The CSWF will be required to have education and training on operating systems and cybersecurity like those specified in DoDM 8140.03. The Government may request System Administration (SA) personnel supporting the program to supply evidence of certification and registration/compliance

2.4. Compliance with Regulations and Standards

2.4.1. The vendor shall ensure that all software development and system configurations comply with applicable Department of Defense (DoD), Army, and Federal cybersecurity regulations for vendor provided products.

2.4.2. The vendor shall ensure that all development aligns with cybersecurity practices IAW Risk Management Framework (RMF) Confidentiality, Integrity, and Availability (CIA) standards.

2.4.3. The vendor shall follow practices described in NIST SP 800-171 R2, R3 “Protecting CUI in Non-Federal Systems and Organizations”, and NIST SP 800-53 Rev 4 “Security and Privacy Controls for Federal Information Systems and Organizations”.

2.5. DevSecOps Integration (not applicable to COTS)

2.5.1. The vendor shall support and integrate DevSecOps principles into the software development lifecycle (SDLC) to ensure security is embedded at every stage.

2.5.2. The vendor shall automate security testing, vulnerability scans, and compliance checks within Continuous Integration/Continuous Deployment (CI/CD) pipelines.

2.5.3. The vendor shall use DevSecOps tools to identify and remediate vulnerabilities during development and deployment.

2.5.4. The vendor shall collaborate across development, security, and operations teams to address security concerns iteratively and proactively.

2.6. Secure Software Development

2.6.1. The vendor shall incorporate cybersecurity updates into the software development process.

2.6.2. The vendor shall use security coding tools to validate the security of the codebase or support coding tools if provided by the Cybersecurity Lead Integrator.

2.6.3. The vendor shall conduct testing of all software with a Software Code Security Tool prior to integration into the system baseline or support testing tools if provided by the Cybersecurity Lead Integrator.

2.6.4. The vendor shall mitigate vulnerabilities identified during security testing, automated scans, and manual reviews within 30 days or shall provide a plan of action and milestones (POA&M) for approval.

2.7. System Security Implementation

2.7.1. The vendor shall ensure that all software developed under this contract adheres to secure coding practices.

2.8. Vulnerability Management

2.8.1. The vendor shall automate vulnerability detection and remediation using DevSecOps tools for vendor-developed and provided products.

2.8.2. The vendor shall incorporate IAVM updates into the system software development process on all vendor-developed and provided products.

2.8.3. The vendor shall support third-party vulnerability scans and annual reviews of Information Assurance (IA) controls as required.

2.9. Cybersecurity Documentation and Reporting

2.9.1. The vendor shall provide documentation that demonstrates the use of DevSecOps practices in the development of all products delivered.

2.10. System Configuration and Monitoring

2.10.1. The vendor shall continuously track, log, and report security vulnerabilities and risks related to all software provided under this contract. All emerging vulnerabilities or risks shall be reported within 72 hours.

2.10.2. The vendor shall support the Cybersecurity Lead Integrator in maintaining and monitoring system configuration for all delivered products.

2.10.3. The vendor shall conduct Configuration Control Boards with the government and integration team for all products to be delivered.

2.10.4. The vendor shall update cybersecurity measures as needed to address emerging threats and vulnerabilities.

2.11. Incident Response and Recovery

2.11.1. The vendor shall develop and maintain incident/spillage response plans and support backup and recovery operations and support the incident response and recovery plan of the Cybersecurity Lead Integrator

2.11.2. The vendor shall report all cyber incidents to the Government, within 72 hours of discovery, that result in an actual or potentially adverse effect on the covered Contractor information system and the Covered Defense Information (CDI) residing therein, or on a Contractor's ability to provide operational critical support.

2.11.3. The vendor shall automate incident detection and reporting for vendor specific products.

2.11.4. The vendor shall ensure that incident response plans are tested and updated annually.

References

· (a) NIST National Institute of Standards and Technology - https://www.nist.gov/

· (b) NIST SP 800-53 rev. 4, rev. 5 - Security and Privacy Controls for Federal Information Systems and Organizations

· (c) Army Regulation 25-2: Army Cybersecurity

· (d) DoDM 8140.03 – Cyberspace Workforce Qualification and Management Program

· (e) NIST SP 800-171 R2, R3 - Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

· (f) DODI 8500.01 - Cybersecurity