DRAFT DMSAT PWS 15Nov24.pdf

PERFORMANCE WORK STATEMENT (PWS) 1

FOR 2

DEFENDER MOBILE SITUATIONAL AWARENESS TOOLKIT (DMSAT) 3

AIR FORCE LIFE CYCLE AND MANAGEMENT CENTER 10

FORCE PROTECTION DIVISION (AFLCMC/HBU) 11

HANSCOM AFB, MA 12

15 November 2024 16 Distribution Statement D - Distribution authorized to the Department of Defense and U.S. DoD 19 Contractors only: administrative/operational use; 15 December 2020. Other requests for this document 20 shall be referred to the AFLCMC/HBUC Program Manager, 3 Eglin St, Bldg. 1612, Hanscom AFB, MA 21 01731-2102. 22 Handling and Destruction Notice: For classified documents, DoD civilians or military personnel will 24 follow the procedures outlined in DoDM 5200.01, Volume 3, Enclosure 3; DoD contractors will follow 25 procedures outlined in DoDM 5220.22, sections 11-19. For sensitive unclassified documents, destroy by 26 any method that will prevent disclosure of contents or reconstruction of this document. 27

Table of Contents 31

1.0 INTRODUCTION 5 32

1.1 Scope 5 33

2.0 APPLICABLE DOCUMENTS 5 34

2.1 General 5 35

2.2 Government Documents 5 36

2.2.1 Specifications, Standards, and Handbooks 5 37

2.2.2 Other Government Documents, Drawings, and Publications 6 38

2.3 Order of Precedence 8 39

3.0 TECHNICAL CONTRACTOR PERFORMANCE REQUIREMENTS SUMMARY 8 40

3.1 Fielding Period 8 41

3.2 Deployment 9 42

3.3 Program Management Support 9 43

3.4 Cyber Security Support 9 44

3.4.1 DoD Vulnerability and CVE Tracking and Compliance 9 45

3.4.2 DISA SRG and STIG Compliance 10 46

3.4.3 Information Assurance Vulnerability Alerts and Bulletins (IAVA/B) 10 47

3.4.4 Unsupported Components 10 48

3.4.5 Flaw Remediation 10 49

3.5 RMF Support 10 50

3.5.1 Authorization and Assessment Support 11 51

3.5.2 Authorization to Connect Support 11 52

3.5.3 DoD Ports, Protocols, and Services Management Support 11 53

3.5.4 DISA SNAP Registration & DISA BCAP Connection 11 54

3.5.5 Cybersecurity Incident Reporting 11 55

3.5.6 Cybersecurity Incident Reporting Timelines 12 56

3.5.7 Mandatory Reporting Data 12 57

3.5.8 Incident Reporting Coordination 12 58

3.6 Cloud and Network Engineering 13 59

3.6.1 Cloud Engineering 13 60

3.6.2 Network Engineering 13 61

3.7 General Engineering 13 62

3.8 Logistics 14 63

3.8.1 Training Plan and Materials 14 64

3.8.2 Commercial Manuals / Supplementation 14 65

3.8.3 Packaging, Handling, Support & Transportation (PHS&T) 15 66

3.8.4 Obsolescence Management 15 67

3.8.5 Help Desk Support 16 68

3.8.6 Spares Management 17 69

3.8.7 Preventive Maintenance Plan and Preventive Maintenance Inspection Schedule 17 70

3.8.8 Warranties and Licenses 17 71

3.8.9 Disposition Plan 17 72

3.8.10 Data Service 17 73

3.8.11 Readiness 17 74

3.8.11.1 Operational Availability (Ao) 18 75

3.8.11.2 Mean Time to Repair (MTTR) 18 76

3.8.12 Supply Chain Risk Management (SCRM) 18 77

3.9 Site Acceptance Test (SAT) 19 78

4.0 MANAGEMENT AND REPORTING 19 79

4.1 Personnel 19 80

4.1.1 Program Manager (PM) 19 81

4.1.2 Training Personnel 20 82

4.2 Sub-Contractor Management 20 83

4.3 Meetings & Communication 20 84

4.3.1 Post Award Kick-Off Meeting 20 85

4.3.2 Integrated Product Team (IPT) Meetings 20 86

4.3.4 Program Management Reviews (PMRs) 21 87

4.4 Program Risk Management 21 88

4.5 Programmatic Cost Data and Status Reporting 21 89

4.6 Configuration Management (CM) 21 90

4.6.1 Change Management 21 91

4.7 Planning, Performance Tracking, and Reporting 22 92

4.8 Data Management 22 93

4.9 Quality Control (QC) 23 94

4.10 Phase Out 23 95

5.0 GENERAL REQUIREMENTS 24 96

5.1 Security Requirements 24 97

5.1.1 Security Management 24 98

5.1.2 Operations Security (OPSEC) 24 99

5.1.3 Controlled Unclassified Information (CUI) 24 100

5.1.4 Communication Security (COMSEC) 24 101

5.1.5 Security Classification Guide (SCG) 24 102

5.1.6 Personnel Security 25 103

5.1.7 Security Incidents and Violations 25 104

5.1.8 Common Access Card (CAC) 25 105

5.1.8 Security Training 25 106

5.2 Base Access and Support 25 107

5.3 Essential Services 25 108

5.4 Contractor Visit Requests 26 109

5.5 Contractor Manpower Reporting 26 110

5.6 Safety 26 111

5.7 Federal, State and Local Law Violations 27 112

5.8 Government Hazardous Waste/Material 27 113

5.9 Duty Hours 27 114

5.10 Service Delivery Schedule (SDS) 27 115

ACRONYMS 30 116

APPENDIX A: DMSAT BASELINE 33 117

APPENDIX B: CONFIGURATION MANAGEMENT GUIDE 34 118

This page intentionally left blank. 134

1.0 INTRODUCTION

The objective of this effort is to deliver Tactical Awareness Kit (TAK) Force Protection capability to Air Force units both CONUS and OCONUS. The procurement, configuration, and deployment will be continuous based on Government incremental funding. The effort includes the development and continuous improvement of cloud-based and network infrastructure to include a master Security Enclave that provides security services to multiple cloud and on-premises environments. This PWS defines requirements for the contractor to provide a wide range of installation, training and management support to ensure AFLCMC/HBU Gov Cloud instance and Defender Mobile Situational Awareness Toolkit (DMSAT) continue to operate.

1.1 Scope

The scope of this contract is to provide TAK based technical, administrative, infrastructure and managerial support as required to the USAF. The contractor shall procure, configure, and deploy TAK based Force Protection and supporting sub systems for CONUS and OCONUS Air Force units. The contractor shall develop the necessary Bodies of Evidence (BOE) to complete an Authority to Operate (ATO) for this system and research, assess and staff the required paperwork to obtain an ATO from the appropriate Approving Official (AO). This effort includes the preparation of training materials and Standard Operating Procedure (SOP) templates. The contractor shall conduct TAK training classes in accordance with section 4.2. The contractor shall develop the necessary Risk Management Framework (RMF) action and Bodies of Evidence (BOE) to maintain and update the existing HAF/A4S “DMSAT” Authority to Operate (ATO) for this system. The contractor shall maintain and update cloud-based TAK servers in accordance with section 4.3. The contractor shall provide TAK sustainment support through a help desk ticketing system in accordance with section 4.8. The contractor shall conduct a Site Acceptance Test (SAT) of the TAK capability at each deployed location to support a government acceptance decision. The contractor shall also offer support for integration testing in support of expansion of the system technical baseline with coordination with the Government. The contractor shall interface with the Government customer and manage workloads to achieve customer objectives.

2.0 APPLICABLE DOCUMENTS

2.1 General

The following documents are applicable to this PWS to the extent specified herein. Where not specifically cited below, the contractor is responsible for compliance with applicable federal, state, local and base codes and regulations during performance of this Task Order (TO).

2.2 Government Documents

2.2.1 Specifications, Standards, and Handbooks

The following specifications, standards, and handbooks, of the exact revision listed below, form a part of this document to the extent specified herein. The contractor shall review and maintain current with the latest guidance documents.

OSHA CFR 1910 Occupational Safety and Health Standards OSHA 1926.502 Fall Protection Systems Criteria and Practices SD-22 Diminishing Manufacturing Sources and Material Shortages. Defense Standardization Program Office Applicable Base Architectural Various Government provided, if available

(Copies of above documents are available from AFLCMC/HBU, 3 Eglin Street, Bldg. 1612, Hanscom AFB, MA 01731- 2100.)

MIL-HDBK-61B Configuration Management Guidance MIL-HDBK-29612-1 Guidance for Acquisition of Training Data Products and Services

MIL-HDBK-29612-2 Instructional Systems Development/Systems Approach to Training and Education

(Copies of above document are available at: http://www.product-lifecycle-management.com/mil-hdbk-61a-00.htm)

MIL-STD-129R (2) Military Marking for Shipment and Storage MIL-STD-130N Identification Marking of U.S. Military Property MIL-STD-461G Current Electromagnetic Interference Characteristics Requirements for Equipment MIL-STD-882E Current Standard Practice for System Safety MIL-STD-2073-1E Current Standard Practice for Military Packaging MIL-STD-130 Current Identification Markings of U.S Military Property

(Copies of above documents are available at: http://everyspec.com/)

NIST SP 800-37 20 Dec 18 Risk Management Framework, DoD IT NIST SP 800-171 28 Jan 21 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations SAE Aerospace Standard AS5553 2 Apr 09 Counterfeit Electronic Parts: Avoidance, Detection, Mitigation, and Disposition

NIST SP 800-53 Rev. 5, 19 Dec 23 Security and Privacy Controls for Information Systems and Organizations

NIST SP 800-88 Rev.1, 01 Sep 06 Guidelines for Media Sanitization Security Technical Implementation Guides (STIGs)

SAE-GEIA-HB-649A 20 May 16 Configuration Management Standard Implementation Guide

(Copies of above document are available at: https://nvlpubs.nist.gov/nistpubs/)

2.2.2 Other Government Documents, Drawings, and Publications

The following other Government documents, drawings, and publications, of the exact revision level shown, form a part of this document to the extent specified herein.

DEPARTMENT OF DEFENSE

DoDM 4140-1 6 Mar 2019 DoD Supply Chain Materiel Policy DoDM 4140-7 15 Jul 2019 DoD Supply Chain Materiel Management Procedures for Storage and Material Handling

(Copies of above document are available at:

https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/414001p.pdf)

DoD 4160.21-M 2 Oct 2019 Defense Material Disposition Manual DoDI 4161.02 31 Aug 2018 Accountability and Management of Government Contract Property DoDM 5200.01-V3 24 Feb 12 DoD Information Security Program: IC2 DoD 5220.22M 18 May 16 National Industrial Security Program Operating Manual DoD 8570.01-M 10 Nov 2015 Information Assurance Workforce Improvement Program Workforce Management Incorporating Change 4 http://www.product-lifecycle-management.com/mil-hdbk-61a-00.htm http://everyspec.com/ https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/414001p.pdf

DoDI 8551.01 31 May 23 Ports, Protocols and Services Management DoDI 5200.48 6 Mar 20 Controlled Unclassified Information (CUI) DoDI 4140.67 2 Feb 24 DoD Counterfeit Prevention Policy DAFI 16-1403 5 Oct 21 CUI Operations Support

(Copies of above documents are available at: https://www.esd.whs.mil/dd/)

DoD Standard Operating Procedure 25 Feb 11 Acquisition/Procurement Guide for Unique Item Traceability Data Integrity, V1.0

(Copies of above documents are available at https://www.acq.osd.mil/dpap/pdi/uid/docs/SOP_- _Unique_Item_Traceability_Data_Integrity_02252011_(2)_(2).pdf)

DoDI 5000.64 Current Accountability and Management of DoD Equipment and Other Accountable Property (Copies of the above document are available at:

https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/500064p.pdf?ver=2019-06-10-100933-460)

DFARS 211.274 31 May 2019 Item Identification and Valuation Requirements (Copies of the above document are available at https://www.acq.osd.mil/dpap/dars/dfars/html/current/211_2.htm#211.274)

DFARS 252.245-7001 28 Dec 2017 Tagging, Labeling, and Marking of Government Furnished Property DFARS 252.211-7002 28 Dec 2017 Reporting Loss of Government Property DFARS 252.211-7004 28 Dec 2017 Reporting, Reutilization, and Disposal

(Copies of the above document are available at:

https://www.acq.osd.mil/dpap/dars/dfars/html/current/252245.htm#252.245-7004)

DoD Foreign Clearance Guide Current Guide for Foreign Clearance (Copy of above document is available at: https://www.fcg.pentagon.mil/fcg.cfm )

AF LIFE CYCLE MANAGEMENT CENTER (AFLCMC), HANSCOM AFB

Configuration and Data Management 6 Oct 23 AFLCMC/HBU Configuration and Data Management Plan, V3

(Copies of above documents are available from AFLCMC/HBU, 3 Eglin Street, Bldg. 1612, Hanscom AFB, MA 01731- 2100.)

AIR FORCE

AFI 16-1404 30 Oct 2019 Air Force Information Security Program

(Copy of above document is available at:

https://static.e-publishing.af.mil/production/1/saf_aa/publication/afi16-1404/afi16-1404.pdf)

AFI 17-101 6 Feb 2020 Risk Management Framework (RMF) for Information Technology AFI 31-101 11 Apr 23 Integrated Defense AFI 10-701 24 Jul 19 Operations Security https://www.esd.whs.mil/dd/ https://www.acq.osd.mil/dpap/pdi/uid/docs/SOP_-_Unique_Item_Traceability_Data_Integrity_02252011_(2)_(2).pdf) https://www.acq.osd.mil/dpap/pdi/uid/docs/SOP_-_Unique_Item_Traceability_Data_Integrity_02252011_(2)_(2).pdf) https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/500064p.pdf?ver=2019-06-10-100933-460 https://www.acq.osd.mil/dpap/dars/dfars/html/current/211_2.htm#211.274 https://www.acq.osd.mil/dpap/dars/dfars/html/current/252245.htm#252.245-7004 https://www.fcg.pentagon.mil/fcg.cfm https://static.e-publishing.af.mil/production/1/saf_aa/publication/afi16-1404/afi16-1404.pdf

AFI 63-101/20-101 9 May 2017 Integrated Life Cycle Management AFI 20-105 16 Nov 2017 Diminishing Manufacturing Sources and Material Shortages (DMSMS) AFI 23-101 09 Sep 2019 Air Force Materiel Management AFH 23-123 29 Sep 2017 Materiel Management ILS-S, Materiel Management Operations AFMAN 23-122 09 Sep 2019 Materiel Management Procedures AFMAN 24-204 24 July 2018 Preparing Hazardous Materials (HAZMAT) for Military Air Shipments AFPAM 63-113 Oct 2013 Program Protection Planning for Life Cycle Management

(Copies of above documents are available from https://www.e-publishing.af.mil/.)

2.2.3 Others

SAE AS5553C 14 Nov 2019 SAE International Standard, AS5553, Counterfeit Electronic Parts: Avoidance, Detection, Mitigation, and Disposition

OEM Manuals/Guides Various Government provided, if available

2.3 Order of Precedence

In the event of a conflict between this document and the references cited herein, the more stringent requirement shall take precedence, unless directed otherwise by the Procurement Contracting Officer (PCO). In the event of a conflict between this document and the basic Indefinite Delivery (ID)/ Indefinite Quantity (IQ) contract and/or task order, the contract or task order shall take precedence unless explicitly directed otherwise by the PCO. Nothing in this PWS, however, supersedes applicable federal, state and local codes and regulations unless a specific exemption has been obtained.

3.0 TECHNICAL CONTRACTOR PERFORMANCE REQUIREMENTS SUMMARY

The contractor shall provide:

• Program Management and Reporting

• Equipment Procurement and Deployment

• Training

• Training Material Support

• Configuration Management

• Technical Support

• Testing Support

• Quality control

• Cyber Support o Cross Program Support (as directed)

• Cloud Engineering and Maintenance

• Network Engineering

• General Engineering Support

• Logistics Obsolescence Management

3.1 Fielding Period

During this period the contractor shall procure, deploy and train DMSAT systems at coordinated locations. Expected number of bases is 30 per fiscal year given appropriate funding. The contractor shall provide a timeline of meeting the expected number of fielded bases to the Government for review and approval.

3.2 Deployment

The contractor shall procure the necessary equipment to field specific locations and outfit installations with base level Security Forces TAK Capability. Equipment shall be determined by the Program Management Office (PMO) in coordination with the local units and contractor via virtual site surveys. Once the equipment list is finalized and approved, direction to procure will be given by AFLCMC/HBUM. End User Devices must be procured using the Navy Spiral contract, but if not possible alternative avenues for procurement must be approved by AFLCMC/HBUM. Hardware and software that is procured must be approved by the AFLCMC/HBUM TRB/CCB process and be listed in the equipment and software configuration baseline. The Equipment and Software baseline is iteratively managed through the AFLCMC/HBUM Configuration Management Process and is subject to updates. TAK.gov shall be the sole source of TAK related SW solutions for DMSAT. The current configuration baseline is in the attachment labeled DMSAT Configuration Baseline.

In support of deploying DMSAT, the contractor shall purchase all hardware incidental to the configuration and deployment to support system requirements. While deploying, the contractor shall maximize the use of Government funded and managed infrastructure. The contractor shall purchase and install all software licensing required for DMSAT network, configure network devices, and provision End User Devices (EUDs) to TAK system. The contractor shall coordinate delivery of all hardware to the deployed locations with the HBUM and location POCs.

3.3 Program Management Support

The contractor shall coordinate delivery of all hardware to the deployed locations with the HBUM and location POCs. Prior to deployment, the contractor shall conduct virtual site surveys to determine the appropriate device requirements to complete a base level TAK Deployment. During deployment, the contractor shall provide introduction & out briefs with unit Commanders and Major Command leadership as directed. Following deployment, the contractor shall complete After Action Reports detailing the installation events, training, unit interactions and deliver to HBUM. All contractor personnel shall regularly maintain user accounts on TAK.gov and DMSAT IPT Teams page to follow overarching program changes.

3.4 Cyber Security Support

The contractor shall support the government cybersecurity staff at HBUM to update ATO documentation and help develop the appropriate Bodies of Evidence (BOE) necessary to maintain, update, and expand the DMSAT ATO. Also, the contractor shall support the Authority to Connect (ATC) and system interconnection agreements between other accredited systems in support of future integrations with DMSAT. All cybersecurity activities shall be conducted at the direction of the government to include existing Security Forces TAK Logistics Detail (LOGDET) TAK configuration in the ATO process.

The contractor shall provide cyber support for other AFLCMC/HBUM programs as directed.

3.4.1 DoD Vulnerability and CVE Tracking and Compliance

The Contractor shall support the Government’s RMF processes to obtain an ATO for DMSAT. The Contractor shall configure and operate information systems securely IAW the current versions of Department of Defense (DoD) policy;

National Institute of Standards and Technology (NIST) Special Publications (SPs); National Security Agency (NSA) publications; Committee on National Security Systems (CNSS) issuances; United States Cyber Command (USCYBERCOM) tasking orders and requirements; A4 CIO Guidance/A4S Authorizing Official (AO) Guidance; support improving cyber resiliency for the information system and reducing vulnerability to the DoD Information Networks (DoDINs). The Contractor shall support the Government’s continuous monitoring and the integration of security and RMF activities into the systems development lifecycle (SDLC).

SONG, SEUNG H Capt USAF AFMC AFLCMC/HBUM Need content regarding CVEs?

3.4.2 DISA SRG and STIG Compliance

The Contractor shall run the applicable Enclave test and development (T&D) and application, security, and development (ASD) Security Technical Implementation Guides (STIG) against their internal environments IAW A4 CIO Guidance/A4S AO Guidance Document and deliver results NLT 60 calendar days after the start of the contract award.

The Contractor shall register with the DISA STIG library (https://cyber.mil/stigs/) upon contract award to receive notifications for updates to ensure the application and supporting application technology (i.e., operating system, database, servers, etc.) comply with the most up-to-date version of the DISA Security Requirements Guide (SRGs), available at https://public.cyber.mil, and STIGs. The Contractor shall evaluate each SRG/STIG item, determine applicability based on presence of technology/functionality, and annotate the checklist comment section for each item with statements of review status, applicability, and compliance/non- compliance. In the event of a non-compliant SRG/STIG check, the Contractor shall annotate open SRGs/STIG findings, along with fix or proposed mitigation actions, on a Plan of Action and Milestones (POA&M) for Government approval.

The Government may use and disclose reported information as authorized by law and shall only provide attribution information on a need-to-know basis to authorized persons for cybersecurity and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counterintelligence, threat reporting, and trend analysis). The Government may share threat information with other industry partners without attributing or identifying the affected Contractor.

The Contractor shall review the reported security status of the information system (including the effectiveness of security controls employed within and inherited by the system) on an ongoing basis IAW the organization and system specific monitoring strategies; recommend remediation actions based on the results of ongoing monitoring activities and outstanding items in the POA&M; and make associated updates in Enterprise Mission Assurance Support Service (eMASS), as appropriate.

3.4.3 Information Assurance Vulnerability Alerts and Bulletins (IAVA/B)

3.4.4 Unsupported Components

3.4.5 Flaw Remediation

3.5 RMF Support

The Contractor shall provide support for Risk Management activities within and/or outside eMASS. The Contractor shall provide technical and operational analyses of supporting artifacts and render risk analysis recommendations to the Security Controls Assessor (SCA). The Contractor shall have a thorough understanding of eMASS and execute/perform functions in eMASS using capabilities that would automate and integrate capabilities to review/assess artifacts.

The Contractor shall review security artifacts provided by program offices or other organizations and assess both technical and functional adequacy of cyber security/Information Assurance (IA) controls. The Contractor shall also provide written narrative risk recommendations to the SCA, as defined by the Government. SCA recommendations shall be supported with artifacts of compliance/non-compliance from the Information Systems Security Manager (ISSM)/Government and may include Bottom Line Up Front, Risk Impact (Technical/Operational/Cost, etc.), mitigations, and estimated completion dates. The Contractor shall maintain historical copies of all packages.

The Contractor shall perform the Independent Verification and Validation (IV&V) role within the eMASS tool on Non-classified Internet Protocol (IP) Router Network (NIPRNet), verifying that controls are in-place, operating as intended, producing desired outcomes, and providing feedback to submitters on non-compliant security controls, adequacy of artifacts, and POA&M items, as needed.

The Contractor shall maintain and execute processes for reviewing and routing authorization packages. The Contractor shall maintain current documentation on authorization processes/procedures and provide the following deliverable documents to the Government IAW the assigned suspense dates. The products below are presented as examples:

• Security Control Selection Response and Inheritance Guide (Fiscal Qtr. 2).

• Reference list of core artifacts and inheritable controls (Fiscal Qtr. 1,2,3,4).

• Authorizations Example Artifacts/Documentation (if requested) Fiscal Qtr.

• Authorization coordination documents required for staffing packages for signature.

The Contractor shall create and process authorization packages within the workflow in eMASS, and Certification and Accreditation Process Tool (CAPT), when requested by the Government.

The Contractor shall collect and provide the Government with monthly metrics on authorization activity. The metrics shall include, but not be limited to:

• Number, type, and status of packages (e.g., IATT, ATO, etc.) processed.

• Service delivery objectives, such as the 5-day triage time, 30-day interim.

• IATT processing time and 60-day ATO/Authorization-to-Connect (ATC) processing time.

• Status of conditions for conditional ATOs, to include condition due dates.

• Package processing cycle times, to include (at a minimum), package submission date, review start date, review completion date, package return metrics, authorization decision date, and number of days before or after required authorization date.

The Contractor shall function as the subject matter expert to provide recommendations to programs in developing their authorization documentation, to ensure consistency, accuracy, and compliance with DoD policy. In this capacity, the Contractor shall provide recommendations to the Government to provide or create the required authorization documentation needed for security control validation. The Contractor shall document the provided recommendations in emails, point papers, reports, or briefings, as requested, by the Government.

The Contractor shall assess, identify, and provide to the Government, for AO approval, a listing of recommended enterprise security controls/enhancements that provide mission assurance for cyber-key terrain systems supporting mission. In addition, the Contractor shall assess, identify, and provide the Government with a listing of inheritable security controls (e.g., common controls), to include test results, artifacts, POA&Ms, and other compelling evidence for compliance and non-compliance. This listing and supporting artifacts shall be updated as needed or minimally on a quarterly basis.

3.5.1 Authorization and Assessment Support

3.5.2 Authorization to Connect Support

3.5.3 DoD Ports, Protocols, and Services Management Support

The Contractor shall assist in performing actions required to implement the DoD Ports, Protocols, and Services Management (PPSM) Program as outlined in DoDI 8551.01 and other applicable DoD Directives. In support of this task, the Contractor shall develop a plan to manage the overall life cycle risk management of Ports, Protocols, and Services (PPS) IAW DoDI 8551.01. Additionally, the Contractor shall help Government accomplish PPSM technical functions.

The Contractor shall review and provide recommendations to submitters on new/updated PPS declaration worksheets, PPS exceptions, vulnerability assessments, and Component Local Service Assessments (CLSAs) submitted by programs. The Contractor shall also provide confirmation of the compliant/noncompliant status of the PPS security control CM-7(3) in eMASS to the SCA team. Upon approval by the PPS Management Government lead, the Contractor shall submit PPS exceptions, vulnerability assessments, and CLSAs on behalf of Government to the PPSM Secretariat, DoD PPSM CCB, and the DoD PPSM Technical Advisory Board.

3.5.4 DISA SNAP Registration & DISA BCAP Connection

3.5.5 Cybersecurity Incident Reporting

In addition to the DFARS Clause 252.204-7012 reporting requirements for unclassified systems, reportable cyber-incidents include, but are not limited to, the following:

• Unauthorized data exfiltration, manipulation, or disclosure of any DoD information resident on or transiting the Contractor's unclassified or classified information systems or networks.

• Conduct objective evaluations on student tests and provide additional instruction for students who do not pass objective evaluations to the Contractor’s unclassified or classified information system(s) or networks(s) on which DoD information is resident or transiting.

• Cyber-incidents, as listed in MITRE’s Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) Framework available at https://attack.mitre.org/, incorporated herein by reference, which affect network or information systems where DoD information is resident or transiting.

• Notifications by a federal, state, or local law enforcement agency or cyber-center (i.e., National Cyber Investigative Joint Task Force (NCIJTF), National Cybersecurity & Communications Integration Center (NCCIC)) of being a victim of a successful or unsuccessful cyber-event, anomaly, incident, insider threat, breach, intrusion, or exfiltration.

3.5.6 Cybersecurity Incident Reporting Timelines

In addition to providing the notification required by DFARS Clause 252.204-7012, the Contractor shall notify the appropriate Government POCs, to include the PM and ISSM, as soon as practicable, but no later than 24 hours after discovering a reportable cyber incident. The reporting timeline begins when the incident is discovered or reported to the company, its employees, Contractors, or cybersecurity firm responsible for providing cybersecurity and response for the company. A follow-on cyber incident report shall also be provided within 72 hours of becoming aware of a reportable cyber incident.

3.5.7 Mandatory Reporting Data

The Contractor shall, within 24 hours of becoming aware of a reportable cyber-incident, provide an initial notification of the incident.

Guidance, even if some details are not yet available, which includes, but is not limited to, the following information:

• Contractor Name

• Contractor POC (name, telephone, email)

• Contracting Officer POC (name, telephone, email)

• Overall Assessment: Description of incident, data at risk, and mitigations applied

• Indicators of compromise

• Vector of attack (if known)

• Estimated time of attack (if known)

The Contractor shall provide a follow-on cyber incident report within 72 hours of becoming aware of a reportable cyber incident.

Guidance, which includes, but is not limited to, the following information:

• Contractor’s Commercial and Government Entity (CAGE) code

• Contract numbers affected

• Facility CAGE code, where the incident occurred if different than the prime Contractor’s location

• POC, if different than the POC recorded in the System for Award Management (name, address, position, telephone, email)

• Contracting Officer POC (name, telephone, email)

• Contract clearance level

• DoD programs, platforms, systems, or information involved

• Location(s) of compromise

• Date incident discovered

• Description of technical information compromised

• Any additional information relevant to the information compromise

3.5.8 Incident Reporting Coordination

In the event of a cyber incident, the Government may conduct an on-site review of network or information systems where DoD information is resident on or transiting to assist the Contractor in evaluating the extent of the incident and to share information to minimize the impact to both parties. The date and time of on-site visits shall be mutually agreed upon with the Contractor in advance.

The Contractor will not be required to maintain an organic forensic capability, but must ensure data is preserved (e.g., remove an affected system, while still powered on, from the network) and all actions documented until forensic analysis can be performed by the Government or, if the Government is unable to conduct the forensic analysis, a mutually agreed upon third party (e.g., Federally Funded Research and Development Center (FFRDC), commercial security Contractor, etc.). Any follow-on actions shall be coordinated with the Contractor via the CO.

The Contractor shall agree to indemnify and hold the Government harmless for following any recommendations to remedy or mitigate the cyber-incident following the actions under this PWS.

3.6 Cloud and Network Engineering

3.6.1 Cloud Engineering

The contractor shall ensure the hybrid cloud hosting environment is designed to meet the stringent security and compliance requirements of the United States Air Force (USAF) and DoD to provide a secure and compliant environment for Force Protection security workload. The contractor shall work to ensure the hybrid cloud hosting environment provides a broad set of computers, networking, storage, security, identity, data integration, management, monitoring, and operations services to build hybrid architectures that meet specific requirements and use cases.

The contractor shall establish and maintain TAK Servers inside of AFLCMC’s DMDC3 Cloud environment under the control of HBUM. TAK servers shall be deployed in the architecture as directed by AFLCMC/HBUM. Local on-site redundant TAK servers shall be established as directed by HBUM.

The contractor shall ensure provide ongoing maintenance, patching, and vulnerability management of the cloud infrastructure in coordination and in support of the AFLCMC/HBUM cybersecurity team. The contractor shall support cloud infrastructure optimization and reorganization as directed by HBUM. The contractor shall ensure hybrid cloud environment supports other HBU programs as directed by HBU.

3.6.2 Network Engineering

The contractor shall provide network engineering support to facilitate system interconnections for capability integrations as directed by AFLCMC/HBUM. The contractor shall architect, deploy, troubleshoot, and restore on-premises, hybrid cloud, and cloud-based topologies in compliance with security and compliance requirements. While deploying the contractor shall troubleshoot and support alternative communications pathways to allow for TAK network connectivity inside Security Force Control Centers where LTE may not be permitted or available. Alternative communication pathways not on the approved Configuration Baseline must follow HBUM Engineering process to be fielded.

3.7 General Engineering

The contractor shall provide general engineering support towards the maintenance of the DMSAT baseline, to include hardware and software obsolescence identification and replacement, testing of hardware and software for inclusion into the DMSAT baseline, integration testing, and delivery of test reports. The contractor shall prepare engineering change requests for proposed changes to the DMSAT baseline, which will be submitted to AFLCMC/HBUM engineers via the DMSAT ECR submission process. The contractor shall address questions or requests for additional information during the ECR approval process. The contractor shall be responsible for managing DMSAT end user devices through an Approved Mobile Device Management (MDM) and assist in configuration management with HBUM. The contractor shall be able to assist in other HBUM programs as directed.

3.8 Logistics

3.8.1 Training Plan and Materials

For all training, the Contractor shall deliver a complete training plan and training courseware. All training material must be to the level of Train-the-Trainer (T3) and sufficient for the Government to use to develop its own organic training capability.

Materials shall be provided to the Government with full rights to modify and reproduce, and shall include:

• Training plan

• Course overview

• Instructor guide

• Student guide

• All applicable courseware

Training shall be broken out into three main audience groups:

• Basic Users: This group consists of personnel with the most restrictive permission and will be interfacing with the system on a regular basis for the completion of their day-to-day job. All personnel that will interact or handle TAK devices are required to complete this basic training.

• Advanced Users: This group focuses on in-depth TAK system features, complex troubleshooting methods, and advanced operational techniques, designed for users with higher levels of responsibilities and technical expertise.

• Program Managers: This group focuses on strategic training on program management fundamentals, report creation and analysis, trouble ticket management, and logistical coordination.

The contractor shall conduct training courses on a planned schedule approved by the Government, and it shall execute the following requirements:

• Demonstrate the various levels of TAK system interaction

• Include hands-on “on the job” training that requires an active learning approach and incorporates realistic scenario-based training

• Prepare and deliver TAK specific training materials to remain with the units

• Acquire participant feedback via surveys at the conclusion of each training class. The survey materials will be produced by the Government

The contractor shall determine the appropriate length of training classes required to effectively train and objectively evaluate students. The contractor shall coordinate class schedules at least thirty (30) working days in advance of proposed training schedule with the Government to ensure mutual agreement on the proposed dates. The contractor shall schedule and conduct training classes during day shifts, and during swing shifts to accommodate students determined by the Government if needed.

The contractor shall provide revisions to training documentation and Contractor-led training as requested by the Government and permit the Government to record all training conducted.

3.8.2 Commercial Manuals / Supplementation

The contractor shall provide comprehensive manuals for all Commercial Off-the-Shelf (COTS) and Modified Off-the-Shelf (MOTS) components of the DMSAT systems. In addition to OEM manuals, the Contractor shall provide any tailored manuals needed to meet the operational, system administrative, and maintenance needs specific to the DMSAT environment and must include:

• Operational Procedures: Detailed instructions on system setup, startup, operation, and shutdown, ensuring clarity for users with varied technical backgrounds.

• Administrator Procedures: Aimed at assisting administrators or technical users in installing, configuring, managing, and troubleshooting the DMSAT solution.

• Maintenance and Repair: Step-by-step guides for routine maintenance, troubleshooting, and repair procedures, including schematic diagrams, parts lists, and specifications.

• Configuration Management: Instructions on configuration settings, software updates, and modifications, highlighting how these processes impact system performance and security.

• Safety Precautions: Detailed safety information related to the operation, maintenance, and repair of the system, including emergency shutdown procedures and hazard warnings.

• Technical Specifications: Complete technical specifications of the system(s) and components, including performance characteristics and compliance with relevant standards.

• Warranty and Support Information: Information on warranty terms, technical support contacts, and procedures for obtaining repair services or spare parts if supported by a vendor.

• Additional manuals as requested by the Government.

3.8.3 Packaging, Handling, Support & Transportation (PHS&T)

The contractor shall be responsible for all shipping and packaging. The contractor shall preserve, package, and identify all items to be supported under the terms of this contract in such a manner that protection is provided against corrosion, deterioration, and physical damage during shipment and handling from source of supply to the ultimate destination. When the contractor utilizes commercial shipping, they shall use a transport company with automated freight tracking system for real time tracking and monitoring of equipment during transit. The contractor shall track all equipment deliveries in transit and shall verify deliveries to proper destinations.

For overseas shipment, the contractor shall ensure that applicable items shipment is International Traffic in Arms Regulations (ITAR) and/or Trade Agreements Act (TAA) compliant. The contractor shall comply with all export control laws and regulations and shall obtain any required export licenses and other authorizations prior to shipping. The contractor shall maintain accurate and complete records of all shipment transactions and shall make such records available to the Government upon request.

The contractor shall ensure all items packaging adhere to IAW-MIL-STD-2073 (Standard Practice for Military Packaging) and MIL-STD-1791D (Designing for Internal Aerial Delivery in Fixed Wing Aircraft). The contractor shall use MIL-STD-129R (Military Marking for Shipment and Storage) and adhere to the minimum uniform marking, labels, requirements for materiel shipment, and storage.

The contractor shall identify Hazardous Materials (HAZMAT) and provide Material Safety Data Sheet(s) (MSDS) for identified items, if applicable. HAZMAT items transported on military airlift will conform to AFMAN 24-604. The contractor shall ensure Hazardous shipments are prepared, label, certified and comply with International Civil Aviation Organization (ICAO), U.S. Code of Federal Regulations (CFR) Title 49, International Air Transport Association (IATA) Dangerous Goods Regulation, and International Maritime Dangerous Goods Code (IMDG, Annex 1).

The contractor shall use the Material Inspection and Receiving Report, DD Form 250, to provide inventory data for each system. The form and any attachments to the form shall include system information, such as serial numbers for all components and subcomponents of each system.

3.8.4 Obsolescence Management

The contractor shall be responsible for managing obsolescence over the entire period of the contract to ensure compliance with all performance and contract requirements. The contractor shall assist HBUM Logistics functionals in obsolescence management and identification of upgrades over the life cycle of the system. The contractor, on a continuous basis during contract performance, shall review and identify obsolescence issues related to system components. Identified upgrades or changes considered necessary by the Contractor to ensure the continued manufacture and/or repair of the equipment shall go through the HBUM TRB/CCB process. The contractor shall be prepared to perform preventative maintenance on hardware or replace failed items as directed by HBUM. The contractor shall develop a plan for all obsolescence issues to include managing the loss, or impending loss, of manufacturers or suppliers of component, assemblies, or materials used in the system. The contractor shall determine substitute components for any COTS hardware or software that become non-procurable and/or obsolete and recommend to the Government suitable replacement items.

In addition, the contractor shall register and participate in the Government-Industry Data Exchange Program (GIDEP). The contractor shall report all obsolescence management issues, such as the identification of obsolete or soon-to-be obsolete parts, the availability of substitute parts, and the impact of obsolescence on the performance to GIDEP. The contractor shall provide the Government with access to all GIDEP reports and data related to this contract.

3.8.5 Help Desk Support

The contractor shall establish and maintain a basic Help Desk Ticketing System capable of logging, tracking, managing, and resolving customer support requests. The contractor shall ensure that the Help Desk support staff are trained and/or experienced in supporting TAK platform by offering troubleshooting, technical assistance, and escalation services for TAK related issues. The Help Desk support shall be activated, and personnel assigned only in response to issues reported during designated working hours of 0800-1700 site local time, Monday through Friday, or as otherwise directed by the Government. The contractor shall ensure that the system remains functional and able to generate reports on ticket status, response times, and resolution metrics. The Help Desk shall operate within a multi-tiered system consisting of:

• Tier 1 - System issue that can be resolved by the user with support or remotely by a TAK expert.

o Expected to be fixed by the first person who responds either to help desk email or phone call

Includes basic troubleshooting of hardware on premises o Does not require engineering or back-end support o Focused on fix actions related to EUD configuration and/or use o Response within 24 hours if not an urgent operational issue submitted via email

Urgent operational issue is one that can or will result in capability gaps potentially resulting in loss of life or critical operational impacts o All urgent operational issues should be submitted via email and then followed by phone call o Fixed or elevated to ‘Tier 2’ in 24 hours

• Tier 2 - System issue related to back end or network (TAK server and/or the MDM) o Cannot be resolved remotely by a TAK expert, elevated to ‘Tier 2.’

o Tier 2 issue may include a server reset, resolving a minor networking or certificate issue, etc.

o Expected to be fixed by engineering team o Tier 2 issues do not include code development o Non urgent operational issues will be fixed or elevated to ‘Tier 3 ‘in 24 hours

• Tier 3 - Requires engineering meeting/coordination between multiple experts and possible code or hardware fixes to resolve o Fix action at the Tier 3 level may cause Configuration Control Board (CCB) impact o Fix action at the Tier 3 level will take longer than 24 hours

3.8.6 Spares Management

The contractor shall procure devices on the HBU approved equipment baseline to build out DMSAT systems. To prevent excessive down time, the contractor shall propose a readiness based sparing strategy for all DMSAT peripheral components and subcomponents for all systems, to be approved by the Government, and maintain spares for all delivered systems according to the approved strategy. The contractor shall replace failed items and restore all DMSAT solutions to operational status as designed utilizing contractor provided spare equipment and components and repair parts. The contractor shall maintain spares in designated storage warehouse and continually track inventory and report to the Government.

3.8.7 Preventive Maintenance Plan and Preventive Maintenance Inspection Schedule

The Contractor shall provide a Preventative Maintenance Plan (PMP) and Preventative Maintenance Inspection (PMI) Schedule to support the DMSAT equipment IAW the CDRL.

3.8.8 Warranties and Licenses

The contractor shall provide customary commercial warranties for hardware procured for the DMSAT solution. The contractor shall track items by item and serial number, manage and enforce open warranties and provide copies of all warranties for materials delivered to the Government. The contractor shall transfer all Original Equipment Manufacturer (OEM) warranty coverage to the Government IAW the CDRL requirements. The contractor shall provide all equipment licenses required to integrate, test, operate, and maintain the installed system. The contractor shall transfer all equipment licenses to the Government IAW the CDRL requirements.

3.8.9 Disposition Plan

The contractor shall establish a disposition plan to securely wipe all data and safely dispose obsolete or inoperable DMSAT items. Wiping of data and disposition of End User Devices shall be accomplished in the Watchtower MDM interface in coordination with AFLCMC/HBUM engineering.

3.8.10 Data Service

The contractor shall provide a continuous data service plan for all TAK devices procured by HBU for a period of 12 months via FirstNet, unless directed otherwise. Data plans for devices will only be supplied for devices procured by this program and approved by the PMO. The service must ensure reliable data connectivity to support real-time communications, situational awareness, and operational functionality in various field environments. Prior to the conclusions of the 12-month service period, the contractor shall coordinate a seamless transition of the data plan for each respective unit. This transition plan must be communicated and finalized no later than 60 days before the end of the one-year support period specified in the contract. The contractor shall ensure all necessary arrangements, including documentations receipts, points of contacts, and communication records are completed within this timeframe to facilitate a seamless transition.

3.8.11 Readiness

The contractor shall be responsible for ensuring the reliability, maintainability, and supportability of the DMSAT system throughout its operational lifecycle. The contractor shall implement measures to meet the following performance criteria:

• Operational Availability (Ao)

• Mean Time to Repair (MTTR)

3.8.11.1 Operational Availability (Ao)

Operational availability of the DMSAT represents the portion of time that a system is in operational status. It is expressed as the system uptime divided by total elapsed time. The system uptime can be defined as the total elapsed time for the period minus the total downtime during the same period. Downtime shall be considered the cumulative time to repair all failures.

𝐴𝐴𝑜𝑜 =

𝑈𝑈𝑈𝑈𝑈𝑈𝑈𝑈𝑈𝑈𝑈𝑈

𝑇𝑇𝑇𝑇𝑈𝑈𝑇𝑇𝑇𝑇 𝐸𝐸𝑇𝑇𝑇𝑇𝑈𝑈𝐸𝐸𝑈𝑈𝐸𝐸 𝑇𝑇𝑈𝑈𝑈𝑈𝑈𝑈

𝑇𝑇𝑇𝑇𝑈𝑈𝑇𝑇𝑇𝑇 𝐸𝐸𝑇𝑇𝑇𝑇𝑈𝑈𝐸𝐸𝑈𝑈𝐸𝐸 𝑇𝑇𝑈𝑈𝑈𝑈𝑈𝑈 − 𝐷𝐷𝑇𝑇𝐷𝐷𝐷𝐷𝑈𝑈𝑈𝑈𝑈𝑈𝑈𝑈

𝑇𝑇𝑇𝑇𝑈𝑈𝑇𝑇𝑇𝑇 𝐸𝐸𝑇𝑇𝑇𝑇𝑈𝑈𝐸𝐸𝑈𝑈𝐸𝐸 𝑇𝑇𝑈𝑈𝑈𝑈𝑈𝑈

Thresholds are .978. The focus of this contract is sustainment with contractor data collection and analysis to measure and validate the current system and equipment reliability/maintainability metrics. The contractor shall collect and analyze data and make recommendations to the Government to improve reliability and maintainability to achieve stated thresholds.

3.8.11.2 Mean Time to Repair (MTTR)

MTTR is defined as the total elapsed time (clock hours) for corrective maintenance divided by the total number of corrective maintenance actions during a given period.

Thresholds are 24 hours for all failures. The contractor shall report on actual MTTR performance by event and by trends identifying repair times to operational status and make recommendations towards achieving threshold MTTR goal.

3.8.12 Supply Chain Risk Management (SCRM)

The Contractor shall implement an SCRM program and integrate SCRM with the Contractor’s overall risk management process to ensure that the delivered system, equipment, components, software, maintenance equipment, and supplies (e.g., spares and repair parts) meet the availability, reliability, and supportability requirements without a supply chain disruption caused by counterfeit parts, malicious code, or any other elements that would allow adversaries to gain unauthorized access to data and critical program information, alter data, interrupt communications, or otherwise disrupt operations.