Cyber III - Cobra Dane PWS.pdf

CYBERSECURITY ASSESSMENT OF COBRA DANE FA8723-23-F-9001 PERFORMANCE WORK STATEMENT

Attachment 3 Page 1 of 11

CYBERSECURITY ASSESSMENT OF COBRA DANE MISSION

SYSTEM

PERFORMANCE WORK STATEMENT

CONTRACT NO.: TBD

ORDER NO.: FA8723-23-F-9001

1 SEPTEMBER 2022

Space Systems Command

Enterprise Corps

Digital Directorate

Strategic Warning and Surveillance Systems

(SSC/SZQ)

Attachment 3 Page 2 of 11

TABLE OF CONTENTS

Page

Contents

TABLE OF CONTENTS

1.0 INTRODUCTION

1.1 Background

1.2 Scope

1.3 Objectives

2.0 REQUIREMENTS

2.1 Temporary Duty and Travel

2.2 Contract Security

2.3 Security Assessment Plan (SAP)

2.4 Scripts

2.5 Security Assessment

2.6 Risk Analysis

2.7 Initial Report

2.8 Security Assessment Report (SAR)

2.9 Program Plan of Action & Milestone (POA&M)

2.10 Authorization Decision Document (ADD)

2.11 Site Downtime Requests

2.12 Site Deployment Readiness Review

2.13 Site In-Brief

2.14 Site Status Report

2.15 Site Out-Brief

2.16 Inherently Governmental Functions

3.0 PROGRAM MANAGEMENT

3.1 Management of Order

3.2 General Information

3.3 Contract Administration

3.4 Sub-Contract Management

3.5 Contractor Personnel, Discipline, & Specialites

3.6 Non-Personal Services

3.7 Business Relations

APPENDIX A – ACRONYM LIST

Attachment 3 Page 3 of 11

1.0 INTRODUCTION

1.1 Background

1.1.1 The COBRA DANE (CD) program consists of a one of a kind phased array radar located on Shemya Island, Alaska that was fielded in 1976. The mission code, written in Ada83, executes on VAX 6640 computers running the legacy VMS version 5.5.2 operating system. The Ground Based Midcourse Defense (GMD) mission was added in the early 2000s, which added Battle Management Command, Control and Communications (BMC3) Communications Processing Equipment (BCPE) to the mission system along with improved software functionality to bring the radar system to its current configuration.

1.1.2 Due to the age of the information system and components, it is important to note that there is not an alternate operations location and there is at time limited spare hardware components for the mission system. It is also important to understand the CD is located on a remote island where travel to and from the island is restricted and can take considerable amount of time to secure. Due diligence and care is imperative and must be exercised in any activities related to operating, maintaining, and sustaining the CD Mission System.

1.2 Scope

This Performance Work Statement (PWS) defines the performance-based requirements for cybersecurity assessments in support of Certification and Accreditation activities on COBRA DANE (CD) and COBRA DANE Transmitter System (CDTS).

1.2.1 The Cybersecurity assessment contract, which encompasses assessments at nine sites, includes 12 months for the base year and 12 months for the three (3) option years. The Government requires a minimum of four (4) site assessments, with a preference of five (5) site assessments, during each period. A notional schedule for assessments will be provided, but the Government reserves the right to reorder the sites upon 30-day notice to the contractor.

1.2.2 This support shall include, but is not limited to the following:

1.2.2.1 Develop a Security Assessment Plan (SAP) for the COBRA DANE Enclave (approximately 50 systems and devices).

1.2.2.2 Perform a Security Assessment on all identified systems and devices and applicable software applications within the COBRA DANE Enclave using the Government-approved Contractor assessment tool, versions, engines, and rule packs, and the Contractor developed scanning scripts.

1.2.2.3 Analyze and correlate findings into a consolidated report. This report shall document recommended and suggested mitigations, and compliance actions for identified discrepancies.

1.3 Objectives

1.3.1 Analyze and correlate findings into a consolidated report. This report shall document recommended and suggested mitigations, and compliance actions for identified discrepancies.

Cybersecurity accreditation is required for the COBRA DANE Enclave at Shemya Island and COBRA DANE Transmitter System (CDTS) also located at Shemya Island must be

Attachment 3 Page 4 of 11 accomplished within the existing Period of Performance (PoP). Accreditation must be from an Agent for the Security Control Assessor (ASCA).

2.0 REQUIREMENTS

TASK

2.1 Temporary Duty and Travel. Travel will be required to accomplish tasks required by this PWS.

The contractor shall travel to Shemya Island to complete requirements of this effort.

TASK OUTCOME/STANDARD

2.1.1 Finalize travel plans no later than (NLT) six weeks prior to 10-day Site Deployment Readiness Review (SDRR) and coordinate with the Government Program Office (GPO) and the Operations & Maintenance (O&M) contractor.

DELIVERABLES

Contributes to Briefing Material for the SDRR in accordance with (IAW) CDRL A001

2.2 Contract Security. Overarching security requirements and contractor access to classified information shall be as specified in the applicable Security Clearance Guides (SCGs) and basic DD Form 254. All contractor personnel with access to the site shall have at a minimum a SECRET clearance. DD Form 254 outlines responsibilities in the following areas: Contractor security supervision; Standard Practice Procedures; access, accountability, storage, and transmission of classified material; marking requirements; security education; personnel security clearances;

reports; security checks; security guidance; emergency protection; protection of government resources; periodic security reviews; and other responsibilities, as required.

TASK

2.2.1 Security Personnel. The contractor shall ensure that contractor personnel who work in areas or who have access to the installation Local Area Network have a SECRET security clearance IAW DoD 5200.2-R. The Contractor shall comply with Installation and Site requirements and the COBRA DANE Security Classification/Declassification Guide for bringing electronic assets into a Government facility, as specified in Shemya Island and COBRA DANE local procedures.

TASK OUTCOME/STANDARD

2.2.1.1 Personnel shall, at a minimum, be are aware of the Cybersecurity Classification/Declassification Guide (CSCG) and security requirements for Shemya Island.

DELIVERABLES

None

TASK

2.3 Security Assessment Plan (SAP). The Contractor shall develop and provide a SAP for the systems and devices identified by the SSC/SZQ SW&SSD that will be evaluated for the COBRA DANE Enclave at Shemya Island.

TASK OUTCOME/STANDARD

2.3.1 SAP delivered IAW CDRL A002.

DELIVERABLES

SAP CDRL A002.

Attachment 3 Page 5 of 11

TASK

2.4 Scripts. The Contractor shall produce scripts that will run on the assessed systems and devices in order to automate the Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) Checklists process.

TASK OUTCOME/STANDARD

2.4.1 Scripts complete IAW CDRL A003.

DELIVERABLES

CDRL A003

TASK

2.5 Security Assessment. The Contractor shall utilize their own Air Force Space Command (AFSPC)-approved cybersecurity assessment tool to perform the Security Assessment. This tool must be a standalone analysis suite that will not be connected to any mission system or non-secure Internet Protocol Router network before, during, or after the Security Assessment. The Assessment shall be done on all identified systems and devices. Benchmarks identified by the program office will be covered and some systems may require multiple benchmarks be assessed. The Contractor shall also perform interviews and physical checks as part of the Security Assessment.

TASK OUTCOME/STANDARD

2.5.1 The Security Assessment is complete without connecting an assessment tool to the mission system.

DELIVERABLES:

Contributes to A005 Security Assessment Report.

TASK

2.6 Risk Analysis. The Contractor shall analyze, document, and assign a risk to all findings based on DoD risk-levels. Given the classification level of the results, all analysis shall be performed at Shemya Island.

TASK OUTCOME/STANDARD

2.6.1 Analyze and assign risk to all findings.

DELIVERABLES

Contributes to A005 Security Assessment Report.

TASK

2.7 Initial Report. The Contractor shall produce and deliver an Initial Findings Report in contractor format once the initial analysis is complete. The initial report is intended to be used for the program office to review and verify. The Contractor team will use the report to determine the mitigations to any findings identified.

TASK OUTCOME/STANDARD

2.7.1 Produce and deliver IAW CDRL A004.

DELIVERABLES

CDRL A004

Attachment 3 Page 6 of 11

2.8 Security Assessment Report (SAR). The Contractor shall produce a SAR based on the Risk Management Framework (RMF) Knowledge Service (KS) Core Security Authorization Package, but will be tailored to match any requirements levied by SpOC S3/6C office for package submission.

TASK OUTCOMES/STANDARD

2.8.1 SAR shall be produced IAW CDRL A005.

DELIVERABLES

CDRL A005.

TASK

2.9 Program Plan of Action & Milestone (POA&M). The Contractor shall produce and update the Program POA&M with the current state of the system, mitigations, and help estimate the get-well timing.

TASK OUTCOMES/STANDARD

2.9.1 POA&M shall be produced and updated IAW CDRL A006.

DELIVERABLES

CDRL A006.

TASK

2.10 Authorization Decision Document (ADD). The Contractor shall produce the ADD with the system risk level for SpOC S3/6C signature. All supporting documentation shall be delivered to SpOC S3/6C to facilitate the signing of the ADD.

TASK OUTCOMES/STANDARD

2.10.1 ADD shall be produced IAW CDRL A007.

DELIVERABLES

CDRL A007.

TASK

2.11 Site Downtime Requests. The Contractor shall provide requests for all downtime requirements to the GPO for on-site visits to the operational systems.

2.11.1 The Contractor shall provide information for back-up or contingency downtime requirements.

TASK OUTCOMES/STANDARD

2.11.2 Contractor shall provide requests for all downtime requirements to the Government Program Office (GPO) at least sixty (60) calendar days prior to on-site visit to the operational systems.

DELIVERABLES

None.

Attachment 3 Page 7 of 11

2.12 Site Deployment Readiness Review. The Contractor will plan, host, and conduct a 30-day Site Deployment Readiness Review (SDRR) and a 10-day SDRR IAW CDRL A001. This SDRR will be based on calendar days.

2.12.1 The Contractor shall prepare briefing slides to guide and summarize all planned, Contractor-led discussions for the SDRR. The Contractor shall include the following topics in the briefing:

1. Purpose of the on-site activity;

2. Goals of the on-site activity;

3. Identification of the impacts to the site;

4. Site Support Required

5. Details of planned on-site activities, including the activities in the approved Security Assessment Plan; and

6. Other topics as conditions warrant and IAW CDRL A001.

TASK OUTCOMES/STANDARD

2.12.2 Contractor to prepare and deliver slides IAW CDRL A001

DELIVERABLES

CDRL A001

TASK

2.13 Site In-Brief. The Contractor shall provide briefing slide information to the GPO detailing the Assessment Procedures of on-site activities for all site visits to the operational systems.

2.13.1 The Contractor shall participate in a GPO led Site In-Brief for all site visits to the operational systems.

TASK OUTCOMES/STANDARD

2.13.2 Contractor shall provide read-ahead slides NLT five business days before first day on site IAW

CDRL A008.

DELIVERABLES

CDRL A008.

TASK

2.14 Site Status Report. The Contractor shall provide an unclassified daily status report of on-site activities in a Site Status Report (SSR)/Daily Activity Report (DAR), as a result of site visits to the operational systems, via email.

TASK OUTCOMES/STANDARD

2.14.1 Contractor to email SSR/DAR to Government Cybersecurity Lead daily when at Shemya Island.

DELIVERABLES

None.

Attachment 3 Page 8 of 11

2.15 Site Out-Brief. The Contractor shall provide briefing slide information to the GPO detailing the technical results of on-site activities for all site visits to the operational systems.

2.15.1 The Contractor shall participate in a GPO led Site Out-Brief for all site visits to the operational systems.

TASK OUTCOMES/STANDARD

2.15.2 Contractor shall present slide information to site commander on the last day of work IAW

CDRL A008.

DELIVERABLES

CDRL A008.

2.16 Inherently Governmental Functions. The Contractor shall not use the services required by this PWS to perform work of a policy/decision making or management nature, for example, inherently Governmental functions as specified in Federal Acquisition Regulation (FAR) 7.503(c), Inherently Governmental Functions Policy.

2.16.1 The Contractor shall not assert responsibility for decisions that are sole responsibility of the Government relative to programs supported by the Contractor.

3.0 PROGRAM MANAGEMENT REQUIREMENTS

3.1 Management of Order

3.1.1 The Contractor shall plan, organize, coordinate, integrate and execute all requirements included in this PWS within schedule. The Period of Performance (PoP) shall be 12 months for the base year and 12 months for the three (3) option years, with a planned start date of 31 October 2022.

The initial site visit and ongoing order of site assessments will be determined IAW SSC/SZQ priorities as communicated via the SZQ ISSM and Cybersecurity OIC.

3.1.2 The Contractor shall provide the GPO full insight into order performance by inviting GPO participation and involvement in all Contractor technical and management teams and meetings for the effort in this PWS.

3.2 General Information

3.2.1 Recognized Holidays: The Contractor is not required to perform services on the following holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

3.2.2 Hours of Operation: The Contractor is responsible for conducting business at different times of the day, any day of the week dependent upon mission needs. The Contractor shall expect the possibility of working irregular hours based on mission needs and requirements except federal

Attachment 3 Page 9 of 11 holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. In the event of a crisis or natural disaster, only mission-essential personnel will be required to continue services and operations. The services required for this effort are considered non-essential and therefore, will not continue in the event of a crisis or natural disaster.

3.2.3 Place of Performance: The work under this contract will be performed at the COBRA DANE radar site located at Shemya Island.

3.2.4 Type of Contract: The Government will award a Firm Fixed Price (FFP) contract.

3.2.5 Security Requirements: Contractor personnel performing work under this contract must have a Secret Clearance at the time of proposal submission, and must maintain the level of security required for the life of the contract.

3.2.6 Physical Security: The Contractor shall be responsible for safeguarding all Government equipment, information and property provided for Contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured.

3.2.7 Special Qualifications: The Contractor shall ensure all employees performing the cybersecurity function have the proper certifications IAW the AF and Space ASCA Licensing Guide during the execution of the contract.

3.2.8 Continuation of Mission-Essential Services During a Crisis: The Functional Commander or civilian equivalent has determined these services are not mission-essential and will not continue in the event of a crisis.

3.2.9 Inspection of Services: In accordance with the Inspection of Supply/Services clause(s) identified in the contract/order, the Government reserves the right to inspect Contractor performance.

3.2.10 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The Contracting Officer and other Government personnel, as appropriate, may meet periodically (approximately one (1) time per week during each thirty

(30) day assessment) with the Contractor at Peterson SFB to review the Contractor's performance. At these meetings the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of any problems being experienced. Appropriate action shall be taken to resolve outstanding issues. The cost of these meetings should be captured in the proposal to the Government.

3.2.11 Work Space: The contractor shall be responsible for providing their own workspace. The Government will not provide the contractor any designated work area within any Program Office or other SZQ facility, to include supporting facilities. Contractor SIPRNET access will be facilitated within the indicated Government footprint as available.

3.3 Contract Administration. The contractor shall establish processes and assign appropriate resources to administer the contract.

3.4 Subcontract Management. The contractor shall be responsible for any subcontract management necessary to integrate work performed. The contractor shall be responsible and accountable for subcontractor performance.

Attachment 3 Page 10 of 11

3.5 Contractor Personnel, Disciplines and Specialties. The contractor shall accomplish the assigned work by employing and utilizing qualified. The contractor shall provide the necessary resources and infrastructure to manage and administer the contract.

3.5.1 All Contractor personal shall wear company picture identification badges to distinguish themselves from Government employees.

3.5.2 All Contractor personnel shall identify themselves as such when conversing with Government personnel during business meetings, over the telephone or via electronic mail.

3.5.3 All Contractor personnel shall identify themselves on any attendance sheet or any coordination documents they may review.

3.5.4 All Contractor personnel shall identify their company affiliation in electronic mail signature blocks.

3.6 Non-Personal Services. The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. The contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services. The contractor shall notify the Government Contracting Officer immediately if the contractor believes that any actions constitute, or are perceived to constitute, personal services. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental functions IAW FAR 7.5. All decisions relative to programs supported by the contractor shall be the sole responsibility of the Government.

3.7 Business Relations. The contractor shall successfully integrate and coordinate all activity needed to execute the requirement: the timeliness, completeness and quality of problem identification, corrective action plans, proposal submittals, timely identification of issues, effective/responsive management of subcontractors, customer satisfaction and professional and ethical behavior of contractor personnel.

Attachment 3 Page 11 of 11

APPENDIX A – ACRONYM LIST

Acronym Meaning

ADD Authorization Decision Document SSC/ECQ Air Force Life Cycle Management Center AF Air Force AFSPC Air Force Space Command AFS Air Force Station ASCA Agent for the Security Control Assessor BMEWS Ballistic Missile Early Warning System

CD COBRA DANE

CDTS COBRA DANE Transmitter System CDRL Contract Data Requirements List DAR Daily Activity Report DISA Defense Information Systems Agency DoD / DD Department of Defense / Department of Defense (Form only) FAR Federal Acquisition Regulation FFP Firm Fixed Price GPO Government Program Office IA Information Assurance IAW In Accordance With KS Knowledge Service L&PI Launch and Predicted Impact MW Missile Warning NLT No Later Than OA Operational Acceptance POA&M Plan of Action & Milestones PoP Period of Performance PWS Performance Work Statement RAF Royal Air Force RMF Risk Management Framework SAP Security Assessment Plan SAR Security Assessment Report SCGs Security Clearance Guides SDRR Site Deployment Readiness Review SPA System Programming Agency SSN Space Surveillance Network STIG Security Technical Implementation Guide SW&SSD Strategic Warning and Surveillance Systems Division UHF Ultra High Frequency

1.3 Objectives

2.16 Inherently Governmental Functions. The Contractor shall not use the services required by this PWS to perform work of a policy/decision making or management nature, for example, inherently Governmental functions as specified in Federal Acquisition...

Appendix A – Acronym List