DRAFT DMSAT SOW 6 Mar 25.pdf

Defender Mobile Situational Awareness Toolkit (DMSAT)

STATEMENT OF WORK (SOW)

Current as of 5 March 2025

Program Office: AFLCMC/HBUM

Contracting

Office:

AFLCMC/HBUK

Purpose: The primary purpose of this acquisition is to deliver a mobile multi-domain situational awareness capability for first responders at the edge. DMSAT consists of mobile end user devices that connect first responders to each other and their leadership, enabling leadership to execute command and control with an enhanced understanding of rapidly evolving situations, the environment, and their forces.

1.0 Scope

This SOW details the effort needed to deliver TAK-based technical, administrative, infrastructure, and managerial support to Air Force first responder units in both Continental United States (CONUS) and Outside Continental

United States (OCONUS) bases in accordance with (IAW) the Government’s requirements. Any delivery order

(DO) issued under the DMSAT indefinite-delivery indefinite-quantity (IDIQ) contract may address any combination of the items listed below:

• Contractor Program Management and Subcontractor Oversight

• Equipment Procurement and Deployment

• Systems Engineering

• Spectrum Certification Support

• Cybersecurity, Risk Management Framework (RMF), and Authorization-to-Operate (ATO) Update and

Maintenance Support

• Preparation of Training Plan, Training Materials, and Standard Operating Procedure (SOP) Materials

• Training

• Purchase of Commercial-Off-the-Shelf (COTS) and Ancillary Equipment, to Include Spares

• COTS and Modified-Off-the-Shelf Manuals and Associated Supplemental Data

• Contractor Training of USAF Defenders and First Responders

• Cloud-Based TAK Servers and Network Infrastructure Engineering Support

• Help Desk Support Services

• Test Support

• Integration and Testing in Support of System Technical Baseline Expansion

• Obsolescence Management

• Spares Management

• Configuration and Data Management

• Cellular Data Service

• Quality Control

• Supply Chain Risk Management (SCRM)

• Acquisition of DMSAT Systems and Associated Support for Other United States Government Agencies

• Other Acquisition and Sustainment Support for DMSAT, When Required

1.1 Duration of Contract.

In accordance with FAR Clause 52.216-18, Ordering, the ordering period of the DMSAT IDIQ is five (5) years, beginning on the date of contract award. In accordance with FAR Clause 52.216-22, Indefinite Quantity, any order issued during the effective ordering period of the IDIQ and not completed within that period shall be completed by the Contractor within the time specified in the DO. The contract shall govern the Contractor’s and Government’s rights and obligations with respect to that order to the same extent as if the order were completed during the IDIQ’s effective period, provided that the Contractor shall not be required to make any deliveries 24 months after the ordering period expires.

2.0 APPLICABLE DOCUMENTS

2.1 General

The following documents are applicable to this SOW to the extent specified herein. The Contractor shall meet all specified requirements in this SOW. Where not specifically cited below, the Contractor is responsible for compliance with applicable federal, state, and local laws and base codes and regulations as well as applicable base and industry architectural and construction standards during performance of delivery orders.

If copies of the documents identified are not accessible to the public, then they are available upon request. Please reach out to the Program Manager (PM) and Contracting Officer (CO) for assistance in accessing any document.

2.2 Government Documents

2.2.1 Specifications, Standards, and Handbooks

The following specifications, standards, and handbooks, of the exact revision listed below, form a part of this document to the extent specified herein. The Contractor shall review and maintain currency with the latest guidance documents.

48 Code of Federal Regulations

(CFR) Section 52.246-01

Contractor Inspection Requirements

48 CFR Section FAR 52.246-02 Inspection of Supplies – Fixed Price

48 CFR Section FAR 52.246-04 Inspection of Services – Fixed Price

48 CFR Section FAR 52.246-15 Certificate of Conformance

OSHA CFR 1910 Occupational Safety and Health

Standards

OSHA 1926.502 Fall Protection Systems Criteria and

Practices

MIL-HDBK-61B 7 Apr 20 Configuration Management Guidance

MIL-HDBK-29612-1 31 Dec 20 Guidance for Acquisition of Training

Data Products and Services

MIL-HDBK-29612-2 31 Dec 20 Instructional Systems

Development/Systems

Approach to Training and Education

MIL-STD-129R 25 Feb 23 Military Marking for Shipment and

Storage

MIL-STD-130N 26 Aug 19 Identification Marking of U.S. Military

Property

MIL-STD-461G 11 Dec 15 Requirements for the Control of

Electromagnetic Interference

Characteristics of Subsystems and

Equipment

MIL-STD-882E 27 Sep 23 Standard Practice for System Safety

MIL -STD 207-1E(4) 22 Apr 19 Standard Practice for Military Packaging

MIL-STD-130N 26 Aug 19 Identification Marking of U.S. Military

Property

(Copies of above documents are available at: https://quicksearch.dla.mil/) https://quicksearch.dla.mil/

NIST SP 800-37 20 Dec 18 Risk Management Framework, DoD IT

NIST SP 800-171 28 Jan 21 Protecting Controlled Unclassified

Information in Nonfederal Information

Systems and Organizations

SAE Aerospace Standard AS5553 2 Apr 09 Counterfeit Electronic Parts: Avoidance, Detection, Mitigation, and Disposition

NIST SP 800-53, Rev 5 19 Dec 23 Security and Privacy Controls for

Information Systems and Organizations

NIST SP 800-88 Rev.1 1 Sep 06 Guidelines for Media Sanitization

SAE-GEIA-HB-649A 20 May 16 Configuration Management Standard

Implementation Guide

2.2.2 Other Government Documents, Drawings, and Publications

The following other Government documents, drawings, and publications, of the exact revision level shown, form a part of this document to the extent specified herein.

DEPARTMENT OF DEFENSE

DoDM 4140-1 6 Mar 19 DoD Supply Chain Materiel Policy

DoDM 4140-7 15 Jul 19 DoD Supply Chain Materiel Management

Procedures for Storage and Material

Handling

DoD 4160.21-M 2 Oct 19 Defense Material Disposition Manual

DAFI 16-1403 5 Oct 21 CUI Operations Support

DoD 5220.22M 18 May 16 National Industrial Security Program

Operating Manual

DoD 8570.01-M 10 Nov 15 Information Assurance Workforce

Improvement Program Workforce

Management Incorporating Change 4

DoDI 4140.67 2 Feb 24 DoD Counterfeit Prevention Policy

DoDI 4161.02 31 Aug 18 Accountability and Management of

Government Contract Property

DoDI 4245.15 5 Nov 20 Diminishing Manufacturing Sources and

Material Shortages Management

DoDI 5200.48 6 Mar 20 Controlled Unclassified Information

(CUI)

DoDI 8551.01 31 May 23 Ports, Protocols and Services

Management

DoDM 5200.01-V3 24 Feb 12 DoD Information Security Program: IC2

DoD Standard Operating Procedure

25 Feb 11 Acquisition/Procurement Guide for

Unique Item Traceability Data Integrity, V1.0

DoDI 5000.64 27 Apr 17 Accountability and Management of DoD

Equipment and Other Accountable

Property

DFARS 211.274 31 May 19 Item Identification and Valuation

Requirements

DFARS 252.211-7002 28 Dec 17 Reporting Loss of Government Property

DFARS 252.211-7004 28 Dec 17 Reporting, Reutilization, and Disposal

DFARS 252.245-7001 28 Dec 2017 Tagging, Labeling, and Marking of

Government Furnished Property

AF LIFE CYCLE MANAGEMENT CENTER (AFLCMC), HANSCOM AFB.

Configuration and Data

Management

6 Oct 23 AFLCMC/HBU Configuration and Data

Management Plan, V3

IBDSS/ESE Security Classification

Guide

Integrated Base Defense Security

Classification Guide System/Electronic

Security Equipment (IBDSS/ESE)

Security Classification Guide

AIR FORCE

AFI 16-1404 30 Oct 19 Air Force Information Security Program

AFI 17-101 6 Feb 20 Risk Management Framework (RMF) for Information Technology

AFI 31-101 11 Apr 23 Integrated Defense

AFI 10-701 24 Jul 19 Operations Security

AFI 63-101/20-101 9 May 17 Integrated Life Cycle Management

AFI 20-105 16 Nov 17 Diminishing Manufacturing Sources and

Material Shortages (DMSMS)

AFI 23-101 9 Sep 19 Air Force Materiel Management

AFH 23-123 29 Sep 17 Materiel Management ILS-S, Materiel

Management Operations

AFMAN 23-122 9 Sep 19 Materiel Management Procedures

AFMAN 24-204 24 Jul 18 Preparing Hazardous Materials

(HAZMAT) for Military Air Shipments

AFPAM 63-113 Oct 13 Program Protection Planning for Life

Cycle Management

2.2.3 Others

SAE AS5553C 14 Nov 2019 SAE International Standard, AS5553, Counterfeit Electronic Parts: Avoidance, Detection, Mitigation, and Disposition

OEM Manuals/Guides Various Government provided, if available

2.3 Order of Precedence

In the event of a conflict between this document and the references cited herein, the more stringent requirement shall take precedence, unless directed otherwise by the Procurement Contracting Officer (PCO). In the event of a conflict between this document and the basic Indefinite Delivery (ID)/ Indefinite Quantity (IQ) contract and/or task order, the contract or task order shall take precedence unless explicitly directed otherwise by the PCO. Nothing in this SOW, however, supersedes applicable federal, state and local codes and regulations unless a specific exemption has been obtained.

3.0 Delivery Order-Level Requirements

3.1 General Requirements

3.1.1 Program Management

The Contractor shall manage program operations to include program execution and Subcontractor management, if applicable. The Contractor shall maintain task management practices to manage all technical performance, cost, schedule, and deliverables throughout the DO’s period of performance. The Contractor’s task management practices shall provide visibility into the organization and techniques used in managing the program to include Subcontractor, vendor, and data management.

3.1.2 Personnel

The Contractor shall ensure resources are trained, qualified and in place to provide DMSAT services IAW the requirements of this SOW no later than 60 days following contract award. Contractor-provided support shall have the requisite skills, experience and flexibility required to address the DMSAT support requirements. The Contractor shall identify all key personnel that are critical to the success of this effort. If any change to key personnel occurs, the Contractor shall immediately notify the Contracting Officer and Government PM in writing of the proposed replacement personnel who shall be of at least substantially equal ability and qualifications as the individuals currently performing in that category. The Contractor shall ensure that all personnel performing onsite labor and management of this contract are U.S citizens and possess a current U.S. clearance no lower than SECRET.

The Contractor shall be responsible to provide all travel, visas, insurance, business fees, taxes and other associated travel requirements for personnel required to meet the requirements of this SOW. A Common Access Card (CAC), and a Letter of Authorization (LOA) will be the responsibility of the Government. The Contractor shall be responsible to identify and support all pre-deployment requirements such as the use of Synchronized Pre-deployment and Operational Tracker (SPOT) database. The Contractor shall submit to the Government an

Organizational Breakdown Structure (OBS) that includes all personnel required to complete the tasks within the

SOW. The Contractor shall provide an updated OBS (with any changes highlighted), as required, which depicts a hierarchical team structure broken out by position. The OBS shall include the following at a minimum: name of individual, title, location, experience, certifications, and security clearance level for each position included in the

OBS.

3.1.2.1 Training Personnel

Training instructors shall have the ability to help evolve/modify training material; possess excellent grammar and writing skills; have strong organizational skill with the ability to manage time and multiple priorities; and have the ability to adapt to a rapidly changing environment. The Contractor shall be subject to training audits throughout program lifecycle. It is mandatory that training instructors have prior experience with TAK in an operational environment. Examples of prior experience can include but not limited to military (Special Forces, Army, Marines, etc.), United States Government (FBI, USSS, DHS, etc.), and civilian first responder roles. It is preferred that training instructors have knowledge of base defense operations, law enforcement, and/or first responder operations;

be familiar with U.S. Air Force organization, hierarchy, and rank structure; and have knowledge of U.S. Air Force and military terminology.

3.1.3 Sub-Contractor Management

The Contractor shall create sub-contract or teaming relationships as necessary to accomplish the requirements of this SOW. For all OCONUS support the Contractor shall ensure they are using Host Nation vetted contractors.

The Contractor shall flow down all applicable prime contract requirements to all sub-contractors.

3.1.4 Planning, Performance Tracking, and Reporting

The Contractor shall maintain a program schedule of all current and projected major/critical program events and activities, milestones, deliverables, and engineering and test events required for delivering the DMSAT system. The

Contractor shall notify the Government Project Manager (PM), in writing, of any anticipated or projected work stoppages or delays that will influence schedules. [Contract Data Requirements List (CDRL) A010, Integrated

Master Schedule (IMS)]

The Contractor shall provide Monthly Status Reports (MSRs). The MSRs shall align to the SOW requirements and include at minimum:

• Current Activities

• Major Accomplishments

• Risk/Issues

• Action Item Status

• Program Schedule

• Financial Reports and Funding Status

• Data Service Performance and Utilization

• Quality Control Overview

• Help Desk and Support Ticket Report, to include ticket volume, response and resolution times, and trends

• Performance Metrics Reporting, to include but not limited to, AWS Network Traffic Report (7-day increments), Virtual Private Cloud (VPC) utilization, System Incidents Report (to include downtime, report on afflicted resources, and Mean Time to Resolve (MTTR)), System uptime, and cost report.

o Performance Metrics Reporting shall have granularity to individual base unit level

[CDRL A039, Monthly Status Report]

3.1.5 Meetings & Communication

The Contractor shall conduct program reviews and meetings as requested by the Government. Most reviews and meetings shall be conducted via teleconference, but more critical events shall be held in person at the Contractor’s facilities or other mutually agreed upon location, as identified and requested by the Government. The Contractor shall prepare agendas and meeting presentation materials prior to each event and provide meeting minutes following each event listed below. The contractor shall support communication and meetings with Original Equipment

Manufacturers (OEMs) and other Government organizations during execution of this SOW. Action items shall be documented and reviewed at each event. [CDRL A005, Meeting Minutes; CDRL A004, Meeting Agenda]

3.1.5.1 Post-Award Kickoff Meeting

The contractor shall schedule and conduct a post-award kickoff no-later-than (NLT) fifteen (15) working days after contract award. The Contractor shall provide and introduction and roster of the contractor team. The contractor shall be prepared to discuss their program implementation strategy at this meeting. The contractor shall prepare and present a mobilization plan detailing time to full staffing to meet the requirements as outlined in this SOW. The mobilization plan shall not exceed 90 days between contract award and day 1 of fielding to the first base. The contractor shall identify known program risks and provide detailed strategies to avoid or limit those risks. The contractor shall also present the transition Integrated Master Schedule (IMS) to show tasks required and timing of contractual activity to support this effort. The IMS shall be presented at both summary level and at detailed base-by-base level.

3.1.5.2 Integrated Product Team (IPT) Meetings

The contractor shall conduct regularly scheduled IPT virtual meetings with AFLCMC/HBUM. The timing of these meetings shall be determined by the Government. The contractor shall propose an agenda, provide slides indicating project status and keep a running Action Item (AI) list. The contactor shall ensure PowerPoint slides highlight things such as schedule status, programmatic issues, risks and mitigations, staffing considerations, summary of all support activities and recommendations for improved maintenance/ sustainment actions. The IPTs to be supported shall include:

• Program Management

• Systems Engineering

• Cybersecurity

• Logistics

• Etc…

3.1.5.3 Cross Contracts Meeting

As directed by HBUM, the contractor shall participate in Government lead teleconference with other contractors.

The purpose of this meeting will be to discuss the status of ongoing DMSAT program actions involving and or affecting Other Government Contracts (OGCs). At a minimum the contractor PM will be responsible for inviting pertinent team members to the call as necessary.

3.1.5.4 Program Management Reviews (PMRs)

The contractor shall schedule and conduct quarterly PMRs to be held at the direction of the Government either at a

Government approved facility or virtually and provide the Government with accurate and timely status in meeting contractual requirements. The contractor shall ensure PMRs apprise the Government of program progress including but not limited to: schedule updates and/or issues, contract and/or programmatic issues, risks and mitigation plans, financial status, Reliability Availability & Maintainability metrics, training status, inventory/property management status and provide up-to-date configuration status accounting information, staffing status, mobilization and demobilization plans, risk status, quality assurance and control, and cybersecurity compliance status. The contractor shall track and record their compliance with the Standard Delivery Schedule (SDS) and report their findings semi-annually during scheduled PMRs.

3.1.6 Program Risk Management

The contractor shall perform ongoing program risk analysis which provides a process for identifying, tracking and managing/mitigating cost, schedule and performance risks. The contractor shall report risk management at weekly

IPTs and PMRs.

3.1.7 Quality Control (QC)

The contractor shall establish and maintain quality assurance plans that incorporate daily operations, maintenance and support services IAW this contract, applicable laws and regulations, and commercial best practices. The contractor shall implement an independent assessment/verification process that establishes contractor QC measures to include the Contractor’s methodology, standards and processes focusing on elements specific to this project, within 90 calendar days of the start of the contract. An independent QA function is defined as separate QA personnel who are technically qualified to review the work of others but are not directly responsible for the delivery of the service under contract. The Contractor is responsible for performing or having performed all inspections and tests necessary to substantiate that the supplies or services furnished under this contract conform to contract requirements, including any applicable technical requirements for specified manufacturers’ parts. This clause takes precedence over any Government inspection and testing required in the contract’s specifications, except for specialized inspections or tests specified to be performed solely by the Government. The contractor shall deliver and conduct audit reports, as part of the Quality Control Plan (QCP), to the Gov't as required. The contractor shall ensure the QCP provides an overview of how the contractor’s current quality program is tailored specific to this effort. The contractor shall include in the QCP at a minimum, an overview of the implementation of QC planning, checklists, assessments, audits and reporting processes for the areas below:

a. Program Specific Quality Control (QC) Planning, Processes and Checklists: The contractor shall develop program specific QC planning, processes and checklists to be employed to identify, document and troubleshoot faulty/underperforming system and subsystem equipment. The contractor shall also identify processes to be applied towards performing and documenting corrective actions for the faulty equipment.

b. Configuration and Data Deliverables Schedules and Content: The contractor shall develop and implement specific criteria and identify appropriate methodology to ensure configuration and data deliverables comply with the delivery schedules and offer acceptable content delivered IAW the CDRLs.

c. Training: The contractor shall develop program specific QC planning, processes, checklists to be employed to ensure adequate and continuous improvement of training quality.

[CDRL A029, Quality Control Plan]

3.1.8 Programmatic Cost Data and Status Reporting

The contractor shall implement cost reporting and controls utilizing internal cost reporting and control procedures, or systems to plan, schedule, budget, monitor, report cost and technical status applicable to contract. The contractor shall provide financial reporting including detailed cost accounting down to the base level. The contractor shall ensure financial deliverables are representative of the same accounting period (e.g. information shall have the same start date and complete date).

3.1.9 Fielding Period

During this period the contractor shall procure, deploy and train DMSAT systems at coordinated locations as directed by the Government. The expected number of bases is thirty (30) per fiscal year given appropriate funding.

The contractor shall provide a timeline of meeting the expected number of fielded bases to the Government for review and approval.

3.1.9.1 Virtual Site Surveys

The contractor shall conduct virtual site surveys NLT sixty (60) days prior to deployment to determine the appropriate device requirements to complete a base level DMSAT deployment. The site survey shall include the

GOVERNMENT and local units.

3.1.9.2 Pre-Deployment Kickoff Meetings

The contractor shall conduct DMSAT virtual kick-off meetings with each base requiring Field Service Engineer

(FSE) deployment within thirty (30) days prior to the FSE deployment date. The contractor shall assist the

Government with introductions and out briefs to unit Commanders and Major Command leadership as directed.

The contractor shall follow up kick-off meetings by conducting a meeting with bases within one (1) week of deployment. The kick-off meeting shall be held with the local unit and with any organization the local unit chooses to include. The contractor shall prepare and submit a presentation package with agenda for both in-person meetings and teleconferences.

3.1.9.3 Procurement and Deployment

The contractor shall procure the necessary equipment to field specific locations and outfit installations with base level Security Forces TAK Capability as determined during the Site Survey and approved by the GOVERNMENT.

End User Devices must be procured using the Navy Spiral contract, but if not possible alternative avenues for procurement must be approved by AFLCMC/HBUM. Hardware and software that is procured must be approved by the AFLCMC/HBUM Technology Review Board/ Configuration Control Board (TRB/CCB) process and be listed in the equipment and software configuration baseline. The Equipment and Software baseline is iteratively managed through the AFLCMC/HBUM Configuration Management Process and is subject to updates. TAK.gov shall be the sole source of TAK related SW solutions for DMSAT. The current configuration baseline is in the attachment labeled DMSAT Configuration Baseline.

In support of deploying DMSAT, the contractor shall purchase all hardware incidental to the configuration and deployment to support system requirements. While deploying, the contractor shall maximize the use of Government funded and managed infrastructure. The contractor shall purchase and install all software licensing required for

DMSAT network, configure network devices, and provision End User Devices (EUDs) to TAK system. The contractor shall coordinate delivery of all hardware to the deployed locations with the HBUM and location POCs.

On completion of the delivery, the contractor shall deliver the final bill of materials and architecture drawings in the digital format directed by the GOVERNMENT. The contractor shall also complete After Action Reports detailing the installation events, training, unit interactions and deliver to HBUM. All contractor personnel shall regularly maintain user accounts on TAK.gov and DMSAT IPT Teams page to follow overarching program changes.

3.1.10 Cyber Security, Certification, and Accreditation Support

The Contractor shall contribute to developing a System Security Plan (SSP) including any Annex(s) applicable to this agreement and shall maintain all designated DMSAT systems in a manner that does not invalidate the

Government’s Approval to Operate (ATO). As per DoDD 8140.01, Cyber Workforce Management, and DoD

8570.01-M. Information Assurance Workforce Improvement Program, Cybersecurity functions focus on the development, operation, management, and enforcement of security capabilities for systems and networks. Site design documents shall provide the Cybersecurity compliance characteristics of each system prior to modification, as well as post system modification. Incorporation of DISA’s APL network equipment

(https://aplits.disa.mil/processAPList) is required for all new work. The Contractor shall ensure all final dedicated network infrastructures, interconnections of the communication system equipment and configurations are compliant to the Risk Management Framework (RMF) for DoD Information Technology (IT). The Contractor shall implement an assessment plan to ensure compliance with the approved Trusted Associate Sponsor System (TASS) and other

IDS SSPs provided as Government-Furnished Information (GFI).

The Cybersecurity assessment plan shall review the current system interfaces for Cybersecurity compliance, capture and address possible conflicts and identify corrective actions, as necessary. The plan shall assess all network equipment for compliance with DISA APL-approved devices and document any deficiencies, as necessary. The

Contractor shall install, modify, connect, and document the specific annunciator communication devices with the systems IAW the SSP, and Section 3 (Tailored DISA STIG Configuration) of the SSP Annex(s) of the approved

CCDE. Any changes or repairs that impact the SSP regarding the applicable certified equipment shall require the

Contractor to obtain Government Configuration Control Board (CCB) approval and shall require Contractor

Cybersecurity testing and Government Cybersecurity verification prior to implementation of the repair or change.

The Contractor shall establish a rolling maintenance plan with a schedule to include criteria for interconnection characteristics, re-assessments to address compliance to ensure DoD and AF Cybersecurity requirements are achieved, and the Government’s ATO is maintained. The Cybersecurity processes, findings, and observations shall be delivered as part of the monthly status reports, and when directed by the Government, the Contractor shall also be briefed at program reviews. The Contractor shall also provide Cybersecurity Architecture Control Drawings.

The Contractor shall provide cybersecurity related documentation in the form of CDRL A023. Contractor personnel requiring access to Enterprise Mission Assurance Support Service (eMASS) shall have a DD2875 on file.

3.1.10.1 Authorization and Assessment (A&A Support)

The Contractor shall create, edit, update, and maintain information system security assessment and authorization

(A&A) documentation/evidence of control compliance for all applicable security control families necessary to achieve an authorization decision (authorization to operate/connect [ATO/ATC] or interim authorization to test

[IATT]) and/or support continued authorization IAW A4 CIO Guidance/A4S AO Guidance, the current version of

DOD Instruction (DODI) 8500.01, Cybersecurity, DODI 8510.01, NIST Special Publication 800-37, Risk

Management Framework (RMF) for DoD Information Technology (IT), Chairman of the Joint Chiefs of Staff

Instruction (CJCSI) 6510.01F, Information Assurance (IA) and Support to Computer Network Defense (CND), Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, Cyber Incident Handling Program, Committee on National Security Systems Instruction (CNSSI) 1253, Security Categorization and Control Selection for National

Security Systems, NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and

Organizations, and NIST SP 800-53A, Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans. Additionally, the Contractor shall support and update existing system security documentation, to include within eMASS or another Government-selected tool per the timelines and frequencies specified by the Government to facilitate/maintain security authorization IAW the DoD

RMF authorization requirements and A4 CIO Guidance/A4S AO Guidance. [A023, Risk Management

Framework (RMF) Deliverable Data]. (This is customizable based upon the system requirements. The

Contractor’s PM shall identify the timelines and requirements within the SOW required to bring the system into full RMF package.) [CDRL A023 Risk Management Framework (RMF) Data Deliverable]

The Contractor shall support the requirements submitting systems for authorization decisions (ATO/ATC/IATT) within the timelines identified in the RMF Guidance and A4 CIO Guidance/A4S AO Guidance. The Contractor shall produce evidence/artifacts that validate security control requirements established within NIST SP 800-53, published standards and guidance. Evidence/artifacts meeting assessment standards of NIST SP 800-53a shall be utilized to support an authorization decision according to the normal processing times and the authorization need date IAW A4 CIO Guidance/A4S AO Guidance. The Contractor shall identify sources of evidence/artifacts for the

A&A package to the Government.

The Contractor shall support IATT activities for system testing on the operational network or when using live data

(which is data that has not been sanitized to remove operational information) by providing the following documentation: An updated architectural diagram (showing test configuration), proposed ports, protocols, and services (PPS) declaration worksheet, and a comprehensive test plan that describes the test environment, projected specific testing events and schedules, and expected outcomes for remediating existing or future vulnerability IAW

A4 CIO Guidance/A4S AO Guidance.

The Contractor shall provide assessment and authorization (A&A) metrics for packages in progress, returned as incomplete/incorrect, in delay due to unavailable resources (staffing, expertise, equipment, software, or access), completed, and projected authorization activities related to IATTs, ATOs, ATCs, and minor modifications. The method of delivery and frequency for these metrics shall be determined by the Government IAW A4 CIO

Guidance/A4S AO Guidance (e.g., spreadsheet, briefing, inclusion in the monthly status report, etc.).

The Contractor shall have an ongoing responsibility for writing and/or updating supporting evidence/artifacts required by the applicable security controls for all deliverables, as identified in control guidance in eMASS, NIST

SP 800-53 series documents, and/or CNSSI 1253 and IAW A4 CIO Guidance/A4S AO Guidance. The Contractor shall demonstrate requirements compliance, outline non-compliance and mitigations, and justify non-applicable controls to support information system/enterprise continuous monitoring efforts IAW A4 CIO Guidance/A4S AO

Guidance.

The Contractor shall ensure security control evidence/artifacts clearly support compliance or describe non-compliance with the security control within eMASS. For instances of non-compliance, the Contractor shall state the raw severity of the risk, mitigations (in place and/or planned), and a recommendation for residual risk to the

Government. Evidence/artifacts shall be specific to the security control and shall have annotation within the artifact to call attention to the topic. Evidence/artifacts shall be delivered to the Government according to the Government-specified authorization/reauthorization timeline within eMASS or other Government-selected tool IAW A4 CIO

Guidance/A4S AO Guidance. [CDRL A023, Risk Management Framework (RMF) Deliverable Data]

The Contractor shall provide evidence for applicable security controls, as identified in the current version of NIST

800-53A and NIST SP 800-30, Guide for Conducting Risk Assessments, or as specified in applicable DoD, CNSS to demonstrate compliance with the requirements of the DISA STIGs/SRGs, Assessment Procedures (APs), and/or

Control Correlation Identifiers (CCIs), such as screen shots, audit logs, messages, Security Content Automation

Protocol (SCAP) scans, software code scans, Assured Compliance Assessment Solution (ACAS) scans, mitigation plans, diagrams, completed forms/checklists, signed letters, and/or other documentation, etc. The Contractor shall automate whenever possible and conduct scans and continuous monitoring policies. The Contractor shall also provide scan results and/or analysis to the Government to allow vulnerability remediation. The Contractor shall upload software code scans (Fortify or similar Government-specified tool), ACAS, STIG/SRG scans and

STIG/SRG manual checklists in eMASS to facilitate authorization/reauthorization activities IAW A4 CIO

Guidance/A4S AO Guidance.

The Contractor shall run applicable manual and automated DISA STIGs/SRGs, checklists, and compile for validation within the timeframe specified by the Government using the DISA STIG viewer tool, available on the

DoD Cyber Exchange website. The Contractor shall document APs and CCIs in the applicable security controls within eMASS to determine compliance IAW A4 CIO Guidance/A4S AO Guidance. The Contractor shall develop mitigations for non-compliant controls IAW A4 CIO Guidance/A4S AO Guidance.

The Contractor shall document security-focused configuration management according to NIST SP 800-128, Guide for Security-Focused Configuration Management of Information Systems, or as specified in applicable DoD, CNSS guidance and IAW A4 CIO Guidance/A4S AO Guidance. The Contractor shall employ the appropriate configuration settings on commercial IT products and conduct/facilitate/support security scanning (SCAP, ACAS, STIGs/SRGs, software code [Fortify or similar Government-specified tool]) and the mitigation of findings/vulnerabilities. Develop/maintain remediation (burn-down) plans to resolve findings and mitigate risk according to severity. (CDRL A023)

The Contractor shall document compliance/non-compliance within eMASS or another Government selected tool, tracking non-compliance and milestones in the Plan of Actions and Milestones (POA&M) IAW A4 CIO

Guidance/A4S AO Guidance. The Contractor shall identify planned and implemented countermeasures for risk mitigation with realistic timelines and resources for resolving the non-compliant security controls. The Contractor shall maintain/update the POA&M to ensure proper disposition of vulnerabilities (e.g., Completed, Ongoing, Risk

Accepted, etc.) and when changes to plans, milestones, mitigations, risk levels, etc. are required. (CDRL A023)

The Contractor shall complete quarterly reviews to identify support issues and provide replacement/upgrade recommendations and timelines to the Government IAW A4 CIO Guidance/A4S AO Guidance. Any such reviews and/or recommendations by the Contractor shall be impartial, unbiased, and free from any influence that would reasonably be considered a conflict of interest due to a disclosed or undisclosed relationship or affinity to a particular vendor and/or supplier.

The Contractor shall verify compliance of the hardware and software IAW DODI 8330.01, Interoperability of IT, Including National Security Systems (NSS).

The Contractor shall limit the acquisition of IA/IA-enabled COTS products to those that meet evaluation and validation requirements as outlined in DODI 8500.01, Cybersecurity. Products providing IA and are IA-enabled shall have certification through the National Information Assurance Partnership (NIAP) Common Criteria

Evaluation and Validation Scheme (CCEVS)/Common Criteria (CC) evaluation process or cryptographic module validation process for Federal Information Processing Standard (FIPS) 140-2, Security Requirements for

Cryptographic Modules.

The Contractor shall implement processes and procedures for continuous monitoring of system security controls through automated means (scans, monitoring tools, etc.) and through manual means (e.g., document review), as required IAW A4 CIO Guidance/A4S AO Guidance. The Contractor shall complete continuous monitoring activities per the requirements and frequency of the system and organization’s continuous monitoring plan or policies.

The Contractor shall support meeting ATO conditions and provide evidence of satisfying each condition within eMASS IAW A4 CIO Guidance/A4S AO Guidance. The Contractor shall support meeting POA&M milestone completion dates and seeking confirmation of completion.

The Contractor shall develop and/or update remediation plans for noncompliant controls IAW A4 CIO

The Contractor shall update POA&M items and support approval of new milestone completion dates from

Delegation of Approval Authorities IAW A4 CIO Guidance/A4S AO Guidance. (CDRLA023)

The Contractor shall collaborate with system administrators, developers, programmers, and authorization team members to produce a single, comprehensive PPS declaration worksheet for each system and maintain the artifact within eMASS IAW A4 CIO Guidance/A4S AO Guidance. The Contractor shall ensure all declared PPS comply with DODI 8551.01, Ports, Protocols, and Services Management (PPSM), the DoD Category Assurance Listing

(CAL) and Vulnerability Assessment (VA) reports.

The Contractor shall register and maintain the registration of the system within the DoD PPSM registry and ensure implementation compliance with the DoD CAL and VA reports, as published by the DoD PPSM IAW A4 CIO

The Contractor shall prepare exception requests and component-level security assessments (CLSAs) for all non-compliant PPS declarations and submit to the PPS Manager for submission to the DOD PPSM for approval. The

Contractor shall notify the A&A team of noncompliance with RMF security control CM-7(3) based upon unapproved deviations from the CAL IAW A4 CIO Guidance/A4S AO Guidance.

The Contractor shall provide notification of proposed PPS declaration changes to the Government functional lead for review. At a minimum, the Contractor shall review, update, and certify as current each system PPS declaration worksheet IAW A4 CIO Guidance/A4S AO Guidance.

The Contractor shall review the reported security status of the information system (including the effectiveness of security controls employed within and inherited by the system) on an ongoing basis IAW the organization and system specific monitoring strategies; recommend remediation actions based on the results of ongoing monitoring activities and outstanding items in the POA&M; and make associated updates in eMASS, as appropriate, IAW A4

CIO Guidance/A4S AO Guidance. [CDRL A023, Risk Management Framework (RMF) Deliverable Data].

3.1.10.2 DoD Vulnerability and CVE Tracking and Compliance

The Contractor shall support the Government’s RMF processes to obtain an ATO for DMSAT. The Contractor shall configure and operate information systems securely IAW the current versions of Department of Defense (DoD) policy; National Institute of Standards and Technology (NIST) Special Publications (SPs); National Security

Agency (NSA) publications; Committee on National Security Systems (CNSS) issuances; United States Cyber

Command (USCYBERCOM) tasking orders and requirements; A4 CIO Guidance/A4S Authorizing Official (AO)

Guidance; support improving cyber resiliency for the information system and reducing vulnerability to the DoD

Information Networks (DoDINs). The Contractor shall support the Government’s continuous monitoring and the integration of security and RMF activities into the systems development lifecycle (SDLC). The contractor shall provide continuous monitoring of Common Vulnerabilities and Exposures (CVEs) pertinent to the system. The contractor shall notify the Government of any security incidents and their vulnerabilities fixes and mitigation plan within 72 hours of discovery.

3.1.10.3 DISA SRG and STIG Compliance

The Contractor shall run the applicable Enclave test and development (T&D) and application, security, and development (ASD) Security Technical Implementation Guides (STIG) against their internal environments IAW

A4 CIO Guidance/A4S AO Guidance Document and deliver results NLT 60 calendar days after the start of the contract award.

The Contractor shall register with the DISA STIG library (https://cyber.mil/stigs/) upon contract award to receive notifications for updates to ensure the application and supporting application technology (i.e., operating system, database, servers, etc.) comply with the most up-to-date version of the DISA Security Requirements Guide (SRGs), available at https://public.cyber.mil, and STIGs. The Contractor shall evaluate each SRG/STIG item, determine applicability based on presence of technology/functionality, and annotate the checklist comment section for each item with statements of review status, applicability, and compliance/non- compliance. In the event of a non-compliant SRG/STIG check, the Contractor shall annotate open SRGs/STIG findings, along with fix or proposed mitigation actions, on a Plan of Action and Milestones (POA&M) for Government approval.

The Government may use and disclose reported information as authorized by law and shall only provide attribution information on a need-to-know basis to authorized persons for cybersecurity and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counterintelligence, threat reporting, and trend analysis). The Government may share threat information with other industry partners without attributing or identifying the affected Contractor.

The Contractor shall review the reported security status of the information system (including the effectiveness of security controls employed within and inherited by the system) on an ongoing basis IAW the organization and system specific monitoring strategies; recommend remediation actions based on the results of ongoing monitoring activities and outstanding items in the POA&M; and make associated updates in Enterprise Mission Assurance

Support Service (eMASS), as appropriate.

3.1.10.4 Information Assurance Vulnerability Alerts and Bulletins (IAVA/B)

The contractor shall provide the expertise and resources necessary to ensure timely and effective mitigation of vulnerabilities identified in IAVAs across all information systems. The contractor will provide comprehensive

IAVA support services, encompassing both monitoring and remediation. This includes actively monitoring and reviewing all IAVAs and related bulletins released by the relevant governing body. The contractor will then analyze these IAVAs to determine their applicability to information systems and assess the potential impact. This analysis will involve prioritizing IAVAs based on factors such as severity level, system criticality, and operational impact.

To ensure meticulous tracking, the contractor will maintain a comprehensive IAVA tracking system, diligently documenting all pertinent information, including IAVA ID, severity level, affected systems, remediation actions undertaken, and completion status.

Beyond monitoring, the contractor will also be responsible for remediation planning and implementation. This includes developing detailed remediation plans for all applicable IAVAs, outlining specific actions to be taken, established timelines, and designated responsible parties. The contractor will coordinate closely with system owners and administrators to implement these remediation actions, which may include software patching, configuration changes, and system hardening. Throughout the remediation process, the contractor will provide technical guidance and support to ensure effective implementation. Finally, the contractor will validate the effectiveness of all remediation actions taken, ensuring full compliance with IAVA requirements.

3.1.10.5 Unsupported Components

The Contractor’s integration efforts shall not utilize unsupported or extended support hardware, software, firmware, or computer code, unless specifically agreed upon by the Government. The Contractor shall ensure unsupported components are replaced or removed prior to end of life, per a Government-approved POA&M IAW

A4 CIO Guidance/A4S AO Guidance. The Government-approved POA&M shall outline the transition to supported components during any extended support period.

3.1.10.6 Flaw Remediation

The Contractor’s software releases shall not introduce any unmitigated critical or high severity vulnerabilities. The

Contractor shall assist the Government in tracking all open findings on a Government-reviewed and Government-approved POA&M IAW A4 CIO Guidance/A4S AO Guidance. The Contractor shall support the Government’s

Burn Down Plan to prioritize remediation actions based on finding severity and the Government’s discretion. The

Contractor shall assist the Government Information System Security Manager with conducting a quarterly review of scan findings to ensure the POA&M and Burn Down Plan accurately reflect the current risk posture of the software IAW A4 CIO Guidance/A4S AO Guidance. The Contractor shall provide the results of the review to the

Government.

3.1.11 Risk Management Framework (RMF) Support

The Contractor shall configure and/or operate information system components and/or information systems securely

IAW the current versions of DOD policy, National Institute of Standards and Technology (NIST) Special

Publications (SPs), National Security Agency (NSA) publications, Committee on National Security Systems

(CNSS) issuances, United States Cyber Command (USCYBERCOM) tasking orders, and requirements; A4 CIO

Guidance/A4S AO Guidance; support improving cyber resiliency for the information system and reducing vulnerability to the DODIN. The Contractor shall support the Government’s continuous monitoring and the integration of security and risk management framework (RMF) activities into the systems development lifecycle

(SDLC) IAW A4 CIO Guidance/A4S AO Guidance.

3.1.11.1 Cybersecurity Incident Reporting

In addition to the DFARS Clause 252.204-7012 reporting requirements for unclassified systems, reportable cyber-incidents include, but are not limited to, the following:

• Unauthorized data exfiltration, manipulation, or disclosure of any DoD information resident on or transiting the Contractor's unclassified or classified information systems or networks.

• Conduct objective evaluations on student tests and provide additional instruction for students who do not pass objective evaluations to the Contractor’s unclassified or classified information system(s) or networks(s) on which DoD information is resident or transiting.

• Cyber-incidents, as listed in MITRE’s Adversarial Tactics, Techniques, and Common Knowledge

(ATT&CK) Framework available at https://attack.mitre.org/, incorporated herein by reference, which affect network or information systems where DoD information is resident or transiting.

• Notifications by a federal, state, or local law enforcement agency or cyber-center (i.e., National Cyber

Investigative Joint Task Force (NCIJTF), National Cybersecurity & Communications Integration Center

(NCCIC)) of being a victim of a successful or unsuccessful cyber-event, anomaly, incident, insider threat, breach, intrusion, or exfiltration.

3.1.11.2 Cybersecurity Incident Reporting Timelines

In addition to providing the notification required by DFARS Clause 252.204-7012, the Contractor shall notify the appropriate Government POCs, to include the PM and ISSM, as soon as practicable, but no later than 24 hours after discovering a reportable cyber incident. The reporting timeline begins when the incident is discovered or reported to the company, its employees, Contractors, or cybersecurity firm responsible for providing cybersecurity and response for the company. A follow-on cyber incident report shall also be provided within 72 hours of becoming aware of a reportable cyber incident.

3.1.11.3 Mandatory Reporting Data

The Contractor shall, within 24 hours of becoming aware of a reportable cyber-incident, provide an initial notification of the incident. Guidance, even if some details are not yet available, which includes, but is not limited to, the following information:

• Contractor Name

• Contractor POC (name, telephone, email)

• Contracting Officer POC (name, telephone, email)

• Overall Assessment: Description of incident, data at risk, and mitigations applied

• Indicators of compromise

• Vector of attack (if known)

• Estimated time of attack (if known)

The Contractor shall provide a follow-on cyber incident report within 72 hours of becoming aware of a reportable cyber incident. Guidance, which includes, but is not limited to, the following information:

• Contractor’s Commercial and Government Entity (CAGE) code

• Contract numbers affected

• Facility CAGE code, where the incident occurred if different than the prime Contractor’s location

• POC, if different than the POC recorded in the System for Award Management (name, address, position, telephone, email)

• Contracting Officer POC (name, telephone, email)

• Contract clearance level

• DoD programs,…