Cyber III - PARCS PWS.pdf

CYBERSECURITY ASSESSMENT OF PARCS FA8723-23-F-9001 PERFORMANCE WORK STATEMENT

Attachment 1 Page 1 of 13

CYBERSECURITY ASSESSMENT OF PERIMETER ACQUISITION

RADAR ATTACK CHARACTERIZATION SYSTEM (PARCS)

PERFORMANCE WORK STATEMENT

CONTRACT NO.: TBD

ORDER NO.: FA8723-23-F-9001

1 SEPTEMBER 2022

Space Systems Command

Enterprise Corps

Digital Directorate

Strategic Warning and Surveillance Systems

(SSC/SZQ)

Attachment 1 Page 2 of 13

TABLE OF CONTENTS

Page

Contents

TABLE OF CONTENTS

1.0 INTRODUCTION

1.1 Background

1.2 Scope

1.3 Objectives

2.0 REQUIREMENTS

2.1 Temporary Duty and Travel

2.2 Contract Security

2.3 Security Assessment Plan (SAP)

2.4 Scripts

2.5 Security Assessment

2.6 Risk Analysis

2.7 Initial Report

2.8 Security Assessment Report (SAR)

2.9 Program Plan of Action & Milestone (POA&M)

2.10 Authorization Decision Document (ADD)

2.11 Site Downtime Requests

2.12 Site Deployment Readiness Review

2.13 Site In-Brief

2.14 Site Status Report

2.15 Site Out-Brief

2.16 Inherently Governmental Functions

3.0 PROGRAM MANAGEMENT

3.1 Management of Order

3.2 General Information

3.3 Contract Administration

3.4 Sub-Contract Management

3.5 Contractor Personnel, Discipline, & Specialites

3.6 Non-Personal Services

3.7 Business Relations

APPENDIX A – ACRONYM LIST

Attachment 1 Page 3 of 13

1.0 INTRODUCTION

1.1 Background

1.1.1 The AN/FPQ-16 Perimeter Acquisition Radar Attack Characterization System (PARCS) is a powerful phased-array radar system located at Cavalier AFS, North Dakota. PARCS is a single-faced, multi-function, UHF-Band, phased-array radar and the second most powerful phased array radar system in the U.S. Air Force's fleet of missile warning and space surveillance systems. The PARCS radar keeps watch for sea-launched and intercontinental ballistic missiles launched toward North America, which collects Launch and Predicted Impact (L&PI) data, and missile warning (MW) data. The secondary mission of PARCS is to provide data regarding space launches and orbiting objects as a collateral sensor for the Space Surveillance Network

(SSN).

1.1.2 The PARCS Software Development Suite (SDS) in an onsite tool which emulates the PARCS Mission Data Processor (PMDP) for the purposes of software development, integration, and testing. PMDP is the actual Information Assurance (IA)-enabled computer hardware and software that performs most of the mission processing for PARCS. The SDS is separate from and not connected to the PMDP. Through a manual script serial patch panel, the PMDP can be disconnected from the radar hardware. With PMDP disconnected, this allows the radar hardware to be connected to SDS, which emulates the PMDP. This is primarily done for testing purposes during projects that update components of the PMDP. This allows PARCS to revert to its baseline immediately during a real-world event or a failure in testing. Because the patch panel connects SDS and PMDP to the same radar hardware at different times, the program office decided to categorize SDS identically to PARCS. The SDS does not process any Intelligence information. The SDS does not process any real-time mission data. Real (past) mission data can be processed by the SDS, as well as fake, generated data to mimic mission data. The SDS does not act on the data it processes; it merely processes the data for testing purposes. No mission data is stored on the SDS. The SDS is not connected to any external network, and does not communicate with any other external system.

1.1.3 The PARCS requires an independent, off-site development, verification and validation test facility that provides weapon system equivalent capability/resources to the PARCS Program Office (PO) and other customers (e.g. test community) to help mitigate engineering risks, while supporting system integration efforts. The PARCS Development, Integration, and Test System (PDITS) is located within the PARCS Integration Lab (PIL), Centralized Integrated Support Facility (CISF) in building 2025, Peterson Space Force Base, Colorado Springs, Colorado for the purpose of testing new software and hardware prior to it being introduced into the PARCS radar, which will reduce downtime for development testing, improve engineering quality, and reduce future modernization risks. The PDITS is not currently connected to any public or external network. The only connection outside of the mission boundary is a temporary connection to the Test Development Facility (TDF) located in building 1840 which is only used during end-to-end testing.

1.2 Scope

This Performance Work Statement (PWS) defines the performance-based requirements for cybersecurity assessments in support of Certification and Accreditation activities on the PARCS Phased Array Radar (PAR), the PARCS SDS, and the PDITS.

Attachment 1 Page 4 of 13

1.2.1 The Cybersecurity assessment contract, which encompasses assessments at nine sites, includes 12 months for the base year and 12 months for the three (3) option years. The Government requires a minimum of four (4) site assessments, with a preference of five (5) site assessments, during each period. A notional schedule for assessments will be provided, but the Government reserves the right to reorder the sites upon 30-day notice to the contractor.

1.2.2 This support shall include, but is not limited to the following:

1.2.2.1 Develop a Security Assessment Plan (SAP) for the PARCS Enclave, the PARCS SDS, and the PDITS (approximately 50 systems and devices each).

1.2.2.2 Perform a Security Assessment on all identified systems and devices and applicable software applications within the PARCS Enclave, the PARCS SDS, and the PDITS using the Government-approved Contractor assessment tool, versions, engines, and rule packs, and the Contractor developed scanning scripts.

1.2.2.3 Analyze and correlate findings into a consolidated report for the PARCS Enclave.

Additionally, analyze and correlate findings into a consolidated report for the PARCS SDS and analyze and correlate findings into a separate consolidated report for the PDITS. Each report shall document recommended and suggested mitigations, and compliance actions for identified discrepancies.

1.3 Objectives

1.3.1 Analyze and correlate findings into a consolidated report for the PARCS Enclave. Additionally, analyze and correlate findings into a consolidated report for the PARCS SDS as well as analyze and correlate findings into a consolidated report for the PDITS. Each report shall document recommended and suggested mitigations, and compliance actions for identified discrepancies.

Cybersecurity accreditation is required for the PARCS Enclave at Cavalier AFS, ND, the PARCS SDS also located at Cavalier AFS, ND, and the PDITS located at Peterson SFB, CO, must be accomplished within the existing Period of Performance (PoP). Accreditation must be from an Agent for the Security Control Assessor (ASCA).

2.0 REQUIREMENTS

TASK

2.1 Temporary Duty and Travel. Travel will be required to accomplish tasks required by this PWS.

The contractor shall travel to Cavalier AFS, ND and Peterson SFB, CO to complete requirements of this effort.

TASK OUTCOME/STANDARD

2.1.1 Finalize travel plans no later than (NLT) ten days prior to 5-day Site Deployment Readiness Review (SDRR) and coordinate with the Government Program Office (GPO) and site.

DELIVERABLES

Contributes to Briefing Material for the SDRR in accordance with (IAW) CDRL A001

2.2 Contract Security. Overarching security requirements and contractor access to classified information shall be as specified in the applicable Security Clearance Guides (SCGs) and basic DD Form 254. All contractor personnel with access to the site shall have at a minimum a SECRET clearance. DD Form 254 outlines responsibilities in the following areas: Contractor security supervision; Standard Practice Procedures; access, accountability, storage, and transmission of classified material; marking requirements; security education; personnel security clearances;

Attachment 1 Page 5 of 13 reports; security checks; security guidance; emergency protection; protection of government resources; periodic security reviews; and other responsibilities, as required.

TASK

2.2.1 Security Personnel. The contractor shall ensure that contractor personnel who work in areas or who have access to the installation Local Area Network have a SECRET security clearance IAW DoD 5200.2-R. The Contractor shall comply with Installation and Site requirements for bringing electronic assets into a Government facility, as specified in local Cavalier AFS and Peterson SFB as well as PARCS procedures.

TASK OUTCOME/STANDARD

2.2.1.1 Personnel shall, at a minimum, be are aware of the Cybersecurity Classification/Declassification Guide (CSCG) and security requirements for Cavalier AFS, ND and Peterson SFB, CO.

DELIVERABLES

None

TASK

2.3 Security Assessment Plan (SAP). The Contractor shall develop and provide a SAP for the systems and devices identified by the SSC SW&SSD that will be evaluated for the PARCS Enclave and the PARCS SDS at Cavalier AFS, ND and the PDITS at Peterson SFB.

TASK OUTCOME/STANDARD

2.3.1 SAP delivered IAW CDRL A002.

DELIVERABLES

SAP CDRL A002.

TASK

2.4 Scripts. The Contractor shall produce scripts that will run on the assessed systems and devices in order to automate the Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) Checklists process.

TASK OUTCOME/STANDARD

2.4.1 Scripts complete IAW CDRL A003.

DELIVERABLES

CDRL A003

TASK

2.5 Security Assessment. The Contractor shall utilize their own Air Force Space Command (AFSPC)-approved cybersecurity assessment tool to perform the Security Assessment. This tool must be a standalone analysis suite that will not be connected to any mission system or non-secure Internet Protocol Router network before, during, or after the Security Assessment. The Assessment shall be done on all identified systems and devices. Benchmarks identified by the program office will be covered and some systems may require multiple benchmarks be assessed. The Contractor shall also perform interviews and physical checks as part of the Security Assessment.

Attachment 1 Page 6 of 13

TASK OUTCOME/STANDARD

2.5.1 The Security Assessment is complete without connecting an assessment tool to the mission system.

DELIVERABLES:

None.

TASK

2.6 Risk Analysis. The Contractor shall analyze, document, and assign a risk to all findings based on DoD risk-levels. Given the classification level of the results, all analysis shall be performed at Cavalier AFS, ND or Peterson SFB, CO.

TASK OUTCOME/STANDARD

2.6.1 Analyze and assign risk to all findings.

None.

TASK

2.7 Initial Report. The Contractor shall produce and deliver an Initial Findings Report in contractor format once the initial analysis is complete. The initial report is intended to be used for the program office to review and verify. The Contractor team will use the report to determine the mitigations to any findings identified.

TASK OUTCOME/STANDARD

2.7.1 Produce and deliver IAW CDRL A004.

DELIVERABLES

CDRL A004

TASK

2.8 Security Assessment Report (SAR). The Contractor shall produce a SAR based on the Risk Management Framework (RMF) Knowledge Service (KS) Core Security Authorization Package, but will be tailored to match any requirements levied by SpOC S3/6C office for package submission.

TASK OUTCOMES/STANDARD

2.8.1 SAR shall be produced IAW CDRL A005.

DELIVERABLES

CDRL A005.

TASK

2.9 Program Plan of Action & Milestone (POA&M). The Contractor shall produce and update the Program POA&M with the current state of the system, mitigations, and help estimate the get-well timing.

Attachment 1 Page 7 of 13

TASK OUTCOMES/STANDARD

2.9.1 POA&M shall be produced and updated IAW CDRL A006.

DELIVERABLES

CDRL A006.

TASK

2.10 Authorization Decision Document (ADD). The Contractor shall produce the ADD with the system risk level for SpOC S3/6C signature. All supporting documentation shall be delivered to SpOC S3/6C to facilitate the signing of the ADD.

TASK OUTCOMES/STANDARD

2.10.1 ADD shall be produced IAW CDRL A007.

CDRL A007.

TASK

2.11 Site Downtime Requests. The Contractor shall provide requests for all downtime requirements to the GPO for on-site visits to the operational systems.

2.11.1 The Contractor shall provide information for back-up or contingency downtime requirements.

TASK OUTCOMES/STANDARD

2.11.2 Contractor shall provide requests for all downtime requirements to the GPO at least sixty (60) calendar days prior to on-site visit to the operational systems.

DELIVERABLES

None.

TASK

2.12 Site Deployment Readiness Review. The Contractor will plan, host, and conduct a 5-day Site Deployment Readiness Review (SDRR) IAW CDRL A001 for each trip to Cavalier AFS, ND and Peterson SFB. This SDRR will be based on calendar days.

2.12.1 The Contractor shall prepare briefing slides to guide and summarize all planned, Contractor-led discussions for the SDRR. The Contractor shall include the following topics in the briefing:

1. Purpose of the on-site activity;

2. Goals of the on-site activity;

3. Identification of the impacts to the site;

4. Site Support Required

5. Details of planned on-site activities, including the activities in the approved Security Assessment Plan; and

6. Other topics as conditions warrant and IAW CDRL A001.

TASK OUTCOMES/STANDARD

Attachment 1 Page 8 of 13

2.12.2 Contractor to prepare and deliver slides IAW CDRL A001

CDRL A001

TASK

2.13 Site In-Brief. The Contractor shall provide briefing slide information to the GPO detailing the Assessment Procedures of on-site activities for all site visits to the operational systems.

2.13.1 The Contractor shall participate in a GPO led Site In-Brief for all site visits to PARCS.

TASK OUTCOMES/STANDARD

2.13.2 Contractor shall provide read-ahead slides NLT five business days before first day on site IAW

CDRL A008.

CDRL A008.

TASK

2.14 Site Status Report. The Contractor shall provide an unclassified daily status report of on-site activities in a Site Status Report (SSR)/Daily Activity Report (DAR), as a result of site visits to PARCS, via email.

TASK OUTCOMES/STANDARD

2.14.1 Contractor to email SSR/DAR to Government Cybersecurity Lead daily when at Cavalier AFS, ND.

DELIVERABLES

None.

TASK

2.15 Site Out-Brief. The Contractor shall provide briefing slide information to the GPO detailing the technical results of on-site activities for all site visits to PARCS.

2.15.1 The Contractor shall participate in a GPO led Site Out-Brief for all site visits to PARCS.

TASK OUTCOMES/STANDARD

2.15.2 Contractor shall present slide information to site commander on the last day of work IAW

CDRL A008.

DELIVERABLES

CDRL A008.

2.16 Inherently Governmental Functions. The Contractor shall not use the services required by this PWS to perform work of a policy/decision making or management nature, for example, inherently Governmental functions as specified in Federal Acquisition Regulation (FAR) 7.503(c), Inherently Governmental Functions Policy.

Attachment 1 Page 9 of 13

2.16.1 The Contractor shall not assert responsibility for decisions that are sole responsibility of the Government relative to programs supported by the Contractor.

3.0 PROGRAM MANAGEMENT REQUIREMENTS

3.1 Management of Order

3.1.1 The Contractor shall plan, organize, coordinate, integrate and execute all requirements included in this PWS within schedule. The Period of Performance (PoP) shall be 12 months for the base year and 12 month for the three (3) option years, with a planned start date of 31 October 2022.

The initial site visit and ongoing order of site assessments will be determined IAW SSC/SZQ priorities as communicated via the SZQ ISSM and Cybersecurity OIC.

3.1.2 The Contractor shall provide the GPO full insight into order performance by inviting GPO participation and involvement in all Contractor technical and management teams and meetings for the effort in this PWS.

3.2 General Information

3.2.1 Recognized Holidays: The Contractor is not required to perform services on the following holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

3.2.2 Hours of Operation: The Contractor is responsible for conducting business at different times of the day, any day of the week dependent upon mission needs. The Contractor shall expect the possibility of working irregular hours based on mission needs and requirements except federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. In the event of a crisis or natural disaster, only mission-essential personnel will be required to continue services and

Attachment 1 Page 10 of 13 operations. The services required for this effort are considered non-essential and therefore, will not continue in the event of a crisis or natural disaster.

3.2.3 Place of Performance: The work under this contract will be performed at the PARCS radar site located at Cavalier AFS, ND and Peterson SFB, CO.

3.2.4 Type of Contract: The Government will award a Firm Fixed Price (FFP) contract.

3.2.5 Security Requirements: Contractor personnel performing work under this contract must have a Secret Clearance at the time of proposal submission, and must maintain the level of security required for the life of the contract.

3.2.6 Physical Security: The Contractor shall be responsible for safeguarding all Government equipment, information and property provided for Contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured.

3.2.7 Special Qualifications: The Contractor shall ensure all employees performing the cybersecurity function have the proper certifications IAW the AF and Space ASCA Licensing Guide during the execution of the contract.

3.2.8 Continuation of Mission-Essential Services During a Crisis: The Functional Commander or civilian equivalent has determined these services are not mission-essential and will not continue in the event of a crisis.

3.2.9 Inspection of Services: In accordance with the Inspection of Supply/Services clause(s) identified in the contract/order, the Government reserves the right to inspect Contractor performance.

3.2.10 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The Contracting Officer and other Government personnel, as appropriate, may meet periodically (approximately one (1) time per week during each thirty

(30) day assessment) with the Contractor at Peterson SFB to review the Contractor's performance. At these meetings the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of any problems being experienced. Appropriate action shall be taken to resolve outstanding issues. The cost of these meetings should be captured in the proposal to the Government.

3.2.11 Work Space: The contractor shall be responsible for providing their own workspace. The Government will not provide the contractor any designated work area within any Program Office or other SZQ facility, to include supporting facilities. Contractor SIPRNET access will be facilitated within the indicated Government footprint as available.

3.3 Contract Administration. The contractor shall establish processes and assign appropriate resources to dminister the contract.

3.4 Subcontract Management. The contractor shall be responsible for any subcontract management necessary to integrate work performed. The contractor shall be responsible and accountable for subcontractor performance.

3.5 Contractor Personnel, Disciplines and Specialties. The contractor shall accomplish the assigned work by employing and utilizing qualified personnel. The contractor shall provide the necessary resources and infrastructure to manage and administer the contract.

Attachment 1 Page 11 of 13

3.5.1 All Contractor personal shall wear company picture identification badges to distinguish themselves from Government employees.

3.5.2 All Contractor personnel shall identify themselves as such when conversing with Government personnel during business meetings, over the telephone or via electronic mail.

3.5.3 All Contractor personnel shall identify themselves on any attendance sheet or any coordination documents they may review.

3.5.4 All Contractor personnel shall identify their company affiliation in electronic mail signature blocks.

3.6 Non-Personal Services. The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. The contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services. The contractor shall notify the Government Contracting Officer immediately if the contractor believes that any actions constitute, or are perceived to constitute, personal services. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental functions IAW FAR 7.5. All decisions relative to programs supported by the contractor shall be the sole responsibility of the Government.

3.7 Business Relations. The contractor shall successfully integrate and coordinate all activity needed to execute the requirement: the timeliness, completeness and quality of problem identification, corrective action plans, proposal submittals, timely identification of issues, effective/responsive management of subcontractors, customer satisfaction and professional and ethical behavior of contractor personnel.

Attachment 1 Page 12 of 13

APPENDIX A – ACRONYM LIST

Acronym Meaning

ADD Authorization Decision Document AF Air Force AFLCMC Air Force Life Cycle Management Center AFSPC Air Force Space Command AFS Air Force Station ASCA Agent for the Security Control Assessor CDRL Contract Data Requirements List DAR Daily Activity Report DISA Defense Information Systems Agency DoD / DD Department of Defense / Department of Defense (Form only) FAR Federal Acquisition Regulation FFP Firm Fixed Price GPO Government Program Office IA Information Assurance IAW In Accordance With KS Knowledge Service L&PI Launch and Predicted Impact MW Missile Warning ND North Dakota NLT No Later Than OA Operational Acceptance PAR PARCS Phased Array Radar PARCS Perimeter Acquisition Radar Attack Characterization System PDITS PARCS Development, Integration, and Test System PIL PARCS Integration Lab PMDP PARCS Mission Data Processor POA&M Plan of Action & Milestones PoP Period of Performance PWS Performance Work Statement RMF Risk Management Framework SAP Security Assessment Plan SAR Security Assessment Report SCGs Security Classification Guides SDRR Site Deployment Readiness Review SDS Software Development Suite SPA System Programming Agency SSC Space Systems Command SSN Space Surveillance Network STIG Security Technical Implementation Guide SW&SSD Strategic Warning and Surveillance Systems Division

Attachment 1 Page 13 of 13

Acronym Meaning

UHF Ultra High Frequency

1.3 Objectives

2.16 Inherently Governmental Functions. The Contractor shall not use the services required by this PWS to perform work of a policy/decision making or management nature, for example, inherently Governmental functions as specified in Federal Acquisition...

Appendix A – Acronym List