Cyber III - UEWR PWS.pdf

CYBERSECURITY ASSESSMENTS OF UEWR FA8723-23-F-9001 PERFORMANCE WORK STATEMENT

Attachment 2 Page 1 of 12

CYBERSECURITY ASSESSMENTS OF UPGRADED EARLY

WARNING RADARS (UEWR)

PERFORMANCE WORK STATEMENT

CONTRACT NO.: TBD

ORDER NO.: FA8723-23-F-9001

1 SEPTEMBER 2022

Space Systems Command

Enterprise Corps

Digital Directorate

Strategic Warning and Surveillance Systems

(SSC/SZQ)

Attachment 2 Page 2 of 12

TABLE OF CONTENTS

Page

Contents

TABLE OF CONTENTS

1.0 INTRODUCTION

1.1 Background

1.2 Scope

1.3 Objectives

2.0 REQUIREMENTS

2.1 Temporary Duty and Travel

2.2 Contract Security

2.3 Security Assessment Plan (SAP)

2.4 Scripts

2.5 Security Assessment

2.6 Risk Analysis

2.7 Initial Report

2.8 Security Assessment Report (SAR)

2.9 Program Plan of Action & Milestone (POA&M)

2.10 Authorization Decision Document (ADD)

2.11 Site Downtime Requests

2.12 Site Deployment Readiness Review

2.13 Site In-Brief

2.14 Site Status Report

2.15 Site Out-Brief

2.16 Inherently Governmental Functions

3.0 PROGRAM MANAGEMENT

3.1 Management of Order

3.2 General Information

3.3 Contract Administration

3.4 Sub-Contract Management

3.5 Contractor Personnel, Discipline, & Specialites

3.6 Non-Personal Services

3.7 Business Relations

APPENDIX A – ACRONYM LIST

Attachment 2 Page 3 of 12

1.0 INTRODUCTION

1.1 Background

1.1.1 The AN/FPS-123 and AN/FPS-132 Ballistic Missile UEWR Upgraded Early Warning Radars (UEWR) radar sensors are ground-based, computer-driven phased array radars. The UEWR radars are located at Beale Air Force Base (AFB), CA, Cape Cod SFS, MA. Clear Space Force Station (SFS), Alaska, Royal Air Force, Fylingdales, United Kingdom, and Thule Air Base, Greenland. The UEWR Centralized Integration Support Facility (CISF) System Integration Lab (SIL) equipment suite located at Peterson SFB, CO, is primarily used to provide automated data processing services supporting system and software development, integration, communications, and maintenance of the operational UEWR radars.

1.1.2 The AN/FPS-123 and AN/FPS-132 UEWR radar sensors support the Integrated Tactical Warning/Attack Assessment system. These radar sensors are considered Space Surveillance Network sensors. The UEWR radar sensors in the AN/FPS-132 configuration support the Missile Defense network.

1.2 Scope

This Performance Work Statement (PWS) defines the performance-based requirements for cybersecurity assessments in support of Certification and Accreditation for all UEWR radars and the CISF SIL.

1.2.1 The Cybersecurity assessment contract, which encompasses assessments at nine sites, includes 12 months for the base year and 12 months for the three (3) option years. The Government requires a minimum of four (4) site assessments, with a preference of five (5) site assessments, during each period. A notional schedule for assessments will be provided, but the Government reserves the right to reorder the sites upon 30-day notice to the contractor.

1.2.2 This support shall include, but is not limited to the following:

1.2.2.1 Develop a Security Assessment Plan (SAP) for the UEWR Enclave (approximately 100 systems and devices).

1.2.2.2 Perform a Security Assessment on all identified systems and devices and applicable software applications within the UEWR Enclave using the Government-approved Contractor assessment tool, versions, engines, and rule packs, and the Contractor developed scanning scripts.

1.2.2.3 Analyze and correlate findings into a consolidated report. This report shall document recommended and suggested mitigations, and compliance actions for identified discrepancies.

1.3 Objectives

1.3.1 Analyze and correlate findings into a consolidated report. This report shall document recommended and suggested mitigations, and compliance actions for identified discrepancies.

Cybersecurity accreditation is required for the UEWR Enclave at Beale AFB, Clear SFS, Cape Cod SFS, RAF Fylingdales, and Thule AB and must be accomplished within the existing Period of Performance (PoP). Accreditation must be from an Agent for the Security Control Assessor (ASCA). The UEWRT&DS, which is used to provide automated data processing services

Attachment 2 Page 4 of 12 supporting system and software development, integration, communications, and maintenance of the operational UEWR radars, must also undergo identical cybersecurity accreditation.

2.0 REQUIREMENTS

TASK

2.1 Temporary Duty and Travel. Travel will be required to accomplish tasks required by this PWS.

The contractor shall travel to Beale SFB, Peterson SFB, Clear SFS, Cape Cod SFS, RAF Fylingdales, and Thule AB.

TASK OUTCOME/STANDARD

2.1.1 Finalize travel plans no later than (NLT) six weeks prior to 10-day Site Deployment Readiness Review (SDRR) and coordinate with the Government Program Office (GPO) and site.

DELIVERABLES

Contributes to Briefing Material for the SDRR in accordance with (IAW) CDRL A001

2.2 Contract Security. Overarching security requirements and contractor access to classified information shall be as specified in the applicable Security Clearance Guides (SCGs) and basic DD Form 254. All contractor personnel with access to the site shall have at a minimum a SECRET clearance. DD Form 254 outlines responsibilities in the following areas: Contractor security supervision; Standard Practice Procedures; access, accountability, storage, and transmission of classified material; marking requirements; security education; personnel security clearances;

reports; security checks; security guidance; emergency protection; protection of government resources; periodic security reviews; and other responsibilities, as required.

TASK

2.2.1 Security Personnel. The contractor shall ensure that contractor personnel who work in areas or who have access to the installation Local Area Network have a SECRET security clearance IAW DoD 5200.2-R. The Contractor shall comply with Installation and Site requirements for bringing electronic assets into a Government facility, as specified in the Beale AFB, the CISF SIL at Peterson SFB, Clear SFS, Cape Cod SFS, RAF Fylingdales, and Thule AB local procedures.

TASK OUTCOME/STANDARD

2.2.1.1 Personnel shall, at a minimum, be are aware of the Cybersecurity Classification/Declassification Guide (CSCG) and security requirements for Beale AFB, the CISF SIL at Peterson SFB, Clear SFS, Cape Cod SFS, RAF Fylingdales, and Thule AB.

DELIVERABLES

None

TASK

2.3 Security Assessment Plan (SAP). The Contractor shall develop and provide a SAP for the systems and devices identified by the SSC/SZQ SW&SSD that will be evaluated for the UEWR Enclave at Beale AFB, the CISF SIL at Peterson SFB, Clear SFS, Cape Cod SFS, RAF Fylingdales, and Thule

AB.

TASK OUTCOME/STANDARD

2.3.1 SAP delivered IAW CDRL A002.

Attachment 2 Page 5 of 12

DELIVERABLES

SAP CDRL A002.

TASK

2.4 Scripts. The Contractor shall produce scripts that will run on the assessed systems and devices in order to automate the Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) Checklists process.

TASK OUTCOME/STANDARD

2.4.1 Scripts complete IAW CDRL A003.

DELIVERABLES

CDRL A003

TASK

2.5 Security Assessment. The Contractor shall utilize their own Space Systems Command (SSC)-approved cybersecurity assessment tool to perform the Security Assessment. This tool must be a standalone analysis suite that will not be connected to any mission system or non-secure Internet Protocol Router network before, during, or after the Security Assessment. The Assessment shall be done on all identified systems and devices. Benchmarks identified by the program office will be covered and some systems may require multiple benchmarks be assessed. The Contractor shall also perform interviews and physical checks as part of the Security Assessment.

TASK OUTCOME/STANDARD

2.5.1 The Security Assessment is complete without connecting an assessment tool to the mission system.

DELIVERABLES:

None.

TASK

2.6 Risk Analysis. The Contractor shall analyze, document, and assign a risk to all findings based on DoD risk-levels. Given the classification level of the results, all analysis shall be performed at Beale SFB, with the CISF SIL at Peterson SFB, Clear SFS, Cape Cod SFS, RAF Fylingdales, and Thule AB.

TASK OUTCOME/STANDARD

2.6.1 Analyze and assign risk to all findings.

DELIVERABLES

None.

TASK

2.7 Initial Report. The Contractor shall produce and deliver an Initial Findings Report in contractor format once the initial analysis is complete. The initial report is intended to be used for the program office to review and verify. The Contractor team will use the report to determine the mitigations to any findings identified.

Attachment 2 Page 6 of 12

TASK OUTCOME/STANDARD

2.7.1 Produce and deliver IAW CDRL A004.

DELIVERABLES

CDRL A004

TASK

2.8 Security Assessment Report (SAR). The Contractor shall produce a SAR based on the Risk Management Framework (RMF) Knowledge Service (KS) Core Security Authorization Package, but will be tailored to match any requirements levied by SpOC S3/6C office for package submission.

TASK OUTCOMES/STANDARD

2.8.1 SAR shall be produced IAW CDRL A005.

DELIVERABLES

CDRL A005.

TASK

2.9 Program Plan of Action & Milestone (POA&M). The Contractor shall produce and update the Program POA&M with the current state of the system, mitigations, and help estimate the get-well timing.

TASK OUTCOMES/STANDARD

2.9.1 POA&M shall be produced and updated IAW CDRL A006.

DELIVERABLES

CDRL A006.

TASK

2.10 Authorization Decision Document (ADD). The Contractor shall produce the ADD with the system risk level for SpOC S3/6C signature. All supporting documentation shall be delivered to SpOC S3/6C to facilitate the signing of the ADD.

TASK OUTCOMES/STANDARD

2.10.1 ADD shall be produced IAW CDRL A007.

DELIVERABLES

CDRL A007.

TASK

2.11 Site Downtime Requests. The Contractor shall provide requests for all downtime requirements to the GPO for on-site visits to the operational systems.

2.11.1 The Contractor shall provide information for back-up or contingency downtime requirements.

Attachment 2 Page 7 of 12

TASK OUTCOMES/STANDARD

2.11.2 Contractor will provide requests for all downtime requirements to the GPO at least sixty (60) calendar days prior to on-site visit to the operational systems.

DELIVERABLES

None.

TASK

2.12 Site Deployment Readiness Review. The Contractor will plan, host, and conduct a 30-day Site Deployment Readiness Review (SDRR) and a 10-day SDRR IAW CDRL A001. This SDRR will be based on calendar days.

2.12.1 The Contractor shall prepare briefing slides to guide and summarize all planned, Contractor-led discussions for the SDRR. The Contractor shall include the following topics in the briefing:

1. Purpose of the on-site activity;

2. Goals of the on-site activity;

3. Identification of the impacts to the site;

4. Site Support Required

5. Details of planned on-site activities, including the activities in the approved Security Assessment Plan; and

6. Other topics as conditions warrant and IAW CDRL A001.

TASK OUTCOMES/STANDARD

2.12.2 Contractor to prepare and deliver slides IAW CDRL A001

DELIVERABLES

CDRL A001

TASK

2.13 Site In-Brief. The Contractor shall provide briefing slide information to the GPO detailing the Assessment Procedures of on-site activities for all site visits to the operational systems.

2.13.1 The Contractor shall participate in a GPO led Site In-Brief for all site visits to the operational systems.

TASK OUTCOMES/STANDARD

2.13.2 Contractor shall provide read-ahead slides NLT five business days before first day on site IAW

CDRL A008.

DELIVERABLES

CDRL A008.

TASK

Attachment 2 Page 8 of 12

2.14 Site Status Report. The Contractor shall provide an unclassified daily status report of on-site activities in a Site Status Report (SSR)/Daily Activity Report (DAR), as a result of site visits to the operational systems, via email.

TASK OUTCOMES/STANDARD

2.14.1 Contractor to email SSR/DAR to Government Cybersecurity Lead daily when at Beale AFB, the CISF SIL at Peterson SFB, Clear SFS, Cape Cod SFS, RAF Fylingdales, and Thule AB.

DELIVERABLES

None.

TASK

2.15 Site Out-Brief. The Contractor shall provide briefing slide information to the GPO detailing the technical results of on-site activities for all site visits to the operational systems.

2.15.1 The Contractor shall participate in a GPO led Site Out-Brief for all site visits to the operational systems.

TASK OUTCOMES/STANDARD

2.15.2 Contractor shall present slide information to site commander on the last day of work IAW

CDRL A008.

DELIVERABLES

CDRL A008.

2.16 Inherently Governmental Functions. The Contractor shall not use the services required by this PWS to perform work of a policy/decision making or management nature, for example, inherently Governmental functions as specified in Federal Acquisition Regulations (FAR) 7.503(c), Inherently Governmental Functions Policy.

2.16.1 The Contractor shall not assert responsibility for decisions that are sole responsibility of the Government relative to programs supported by the Contractor.

3.0 PROGRAM MANAGEMENT REQUIREMENTS

3.1 Management of Order

3.1.1 The Contractor shall plan, organize, coordinate, integrate and execute all requirements included in this PWS within schedule. The Period of Performance (PoP) shall be 12 months for the base year and 12 months for each of the three (3) option years, with a planned start date of 31 October 2022. The initial site visit and ongoing order of site assessments will be determined IAW SSC/SZQ priorities as communicated via the SZQ ISSM and Cybersecurity OIC.

3.1.2 The Contractor shall provide the GPO full insight into order performance by inviting GPO participation and involvement in all Contractor technical and management teams and meetings for the effort in this PWS.

3.2 General Information

Attachment 2 Page 9 of 12

3.2.1 Recognized Holidays: The Contractor is not required to perform services on the following holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

3.2.2 Hours of Operation: The Contractor is responsible for conducting business at different times of the day, any day of the week dependent upon mission needs. The Contractor shall expect the possibility of working irregular hours based on mission needs and requirements except federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. In the event of a crisis or natural disaster, only mission-essential personnel will be required to continue services and operations. The services required for this effort are considered non-essential and therefore, will not continue in the event of a crisis or natural disaster.

3.2.3 Place of Performance: The work under this contract will be performed at UEWR radar sites located at Beale SFB, the CISF SIL at Peterson SFB, Clear SFS, Cape Cod SFS, RAF Fylingdales, and Thule AB.

3.2.4 Type of Contract: The Government will award a Firm Fixed Price (FFP) contract.

3.2.5 Security Requirements: Contractor personnel performing work under this contract must have a Secret Clearance at the time of proposal submission, and must maintain the level of security required for the life of the contract.

3.2.6 Physical Security: The Contractor shall be responsible for safeguarding all Government equipment, information and property provided for Contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured.

3.2.7 Special Qualifications: The Contractor shall ensure all employees performing the cybersecurity function have the proper certifications IAW the AF and Space ASCA Licensing Guide during the execution of the contract.

3.2.8 Continuation of Mission-Essential Services During a Crisis: The Functional Commander or civilian equivalent has determined these services are not mission-essential and will not continue in the event of a crisis.

3.2.9 Inspection of Services: In accordance with the Inspection of Supply/Services clause(s) identified in the contract/order, the Government reserves the right to inspect Contractor performance.

3.2.10 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The Contracting Officer and other Government personnel, as appropriate, may meet periodically (approximately one (1) time per week during each thirty

(30) day assessment) with the Contractor at Peterson SFB to review the Contractor's performance. At these meetings the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of any problems being experienced. Appropriate action shall be taken to resolve

Attachment 2 Page 10 of 12 outstanding issues. The cost of these meetings should be captured in the proposal to the Government.

3.2.11 Work Space: The contractor shall be responsible for providing their own workspace. The Government will not provide the contractor any designated work area within any Program Office or other SZQ facility, to include supporting facilities. Contractor SIPRNET access will be facilitated within the indicated Government footprint as available.

3.3 Contract Administration. The contractor shall establish processes and assign appropriate resources to administer the contract.

3.4 Subcontract Management. The contractor shall be responsible for any subcontract management necessary to integrate work performed. The contractor shall be responsible and accountable for subcontractor performance.

3.5 Contractor Personnel, Disciplines and Specialties. The contractor shall accomplish the assigned work by employing and utilizing qualified personnel. The contractor shall provide the necessary resources and infrastructure to manage and administer the contract.

3.5.1 All Contractor personal shall wear company picture identification badges to distinguish themselves from Government employees.

3.5.2 All Contractor personnel shall identify themselves as such when conversing with Government personnel during business meetings, over the telephone or via electronic mail.

3.5.3 All Contractor personnel shall identify themselves on any attendance sheet or any coordination documents they may review.

3.5.4 All Contractor personnel shall identify their company affiliation in electronic mail signature blocks.

3.6 Non-Personal Services. The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. The contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services. The contractor shall notify the Government Contracting Officer immediately if the contractor believes that any actions constitute, or are perceived to constitute, personal services. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental functions IAW FAR 7.5. All decisions relative to programs supported by the contractor shall be the sole responsibility of the Government.

3.7 Business Relations. The contractor shall successfully integrate and coordinate all activity needed to execute the requirement: the timeliness, completeness and quality of problem identification, corrective action plans, proposal submittals, timely identification of issues, effective/responsive management of subcontractors, customer satisfaction and professional and ethical behavior of contractor personnel.

Attachment 2 Page 11 of 12

Attachment 2 Page 12 of 12

APPENDIX A – ACRONYM LIST

Acronym Meaning

ADD Authorization Decision Document AFLCMC Air Force Life Cycle Management Center AF Air Force AFSPC Air Force Space Command AFS Air Force Station ASCA Agent for the Security Control Assessor CDRL Contract Data Requirements List CISF Centralized Integration Support Facility DAR Daily Activity Report DISA Defense Information Systems Agency DoD / DD Department of Defense / Department of Defense (Form only) ECQ Enterprise Corps FAR Federal Acquisition Regulation FFP Firm Fixed Price GPO Government Program Office IA Information Assurance IAW In Accordance With KS Knowledge Service L&PI Launch and Predicted Impact MW Missile Warning NLT No Later Than OA Operational Acceptance PAVE PAWS PAVE Phase Array Warning System POA&M Plan of Action & Milestones PoP Period of Performance PWS Performance Work Statement RAF Royal Air Force RMF Risk Management Framework SAP Security Assessment Plan SAR Security Assessment Report SCC Space Systems Command SCGs Security Clearance Guides SDRR Site Deployment Readiness Review SIL System Integration Lab STIG Security Technical Implementation Guide SW&SSD Strategic Warning and Surveillance Systems Division UEWR Upgraded Early Warning Radar

1.3 Objectives

2.16 Inherently Governmental Functions. The Contractor shall not use the services required by this PWS to perform work of a policy/decision making or management nature, for example, inherently Governmental functions as specified in Federal Acquisition...

Appendix a – Acronym LisT