DRAFT PWS_Nimbus_2024 10 17.docx

E-5-1501

AIR FORCE RESEARCH LABORATORY

ROME RESEARCH SITE

ROME, NEW YORK

DRAFT

PERFORMANCE WORK STATEMENT

FOR

Nimbus

PCSN E51501

17 OCT 2024

(Solicitation No. FA8750-25-R-B001)

1.4 Conducting Intelligence Surveillance and Reconnaissance (ISR) missions, including Open Source (OSINT), Signals Intelligence (SIGINT), and Geospatial Intelligence (GEOINT) is critically important in the current geopolitical environment. The implementation of the Processing Exploitation and Dissemination (PED) workflows is also critically important and coincides with the fielding of C4ISR systems, both at CONUS and OCONUS facilities.

2.1.9 Create, develop, and engage in continuous improvement of IT capabilities with requirements defined by NASIC/GXK in an agile development environment. The contractors must be able to work in a dynamic environment and adapt to current and future requirements.

2.1.12 Research and architect software factories (e.g. CI/CD Pipelines, DEVSECOPS) to design and deliver secure software development environments that ensure Identification, Authentication, Authorization and Auditing (IAAA) mechanisms are binding for all developed software facilitating an automated Authorization to Operate (AtO) policy.

2.1.13 Work performed under this task order includes providing engineering and technical allsource analysis and data support focusing on adversary supply chains/ecosystems that unlay their research, development, test, acquisition, and sustainment capabilities/processes. Work performed will include evaluating and integrating data from classified and unclassified sources; performing technical analysis; developing assessments and evaluations; and providing reports.

2.1.14 Create and deliver the following documentation:

· Presentation Materials, including briefs, security road maps, and technical reports/white papers, describing the compliance of the system design with the governing security policies. (See CDRLs, A005, C005, D005, E005, F005, G005, H005, J005 and K005)

· Meeting Minutes for Design Reviews, Technical Exchanges, and other meetings attended. (See CDRLs, A006, C006, D006, E006, F006, G006, H006, J006 and K006)

· Trip Reports (See CDRLs, A007, C007, D007, E007, FG007, G007, H007, J007 and K007)

· Presentation Materials (See CDRLs, A005, C005, D005, E005, F005, G005, H005, J005 and K005)

· Meeting Minutes for Design Reviews, Technical Exchanges, and other meetings attended. (See CDRLs, A006, C006, D006, E006, F006, G006, H006, J006 and K006)

· Trip Reports (See CDRLs, A007, C007, D007, E007, F007, G007, H007, J007 and K007)

· Technical White Papers (See CDRLs, A010, C010, D010, ER010, F010, G010, H010, J010 and K010)

· Presentation Materials (See CDRLs, A005, C005, D005, E005, F005, G005, H005, J005 and K005)

· Meeting Minutes for Design Reviews, Technical Exchanges, and other meetings attended. (See CDRLs, A006, C006, D006, E006, F006,G006, H006, J006 and K006)

· Trip Reports (See CDRLs, A007, C007, D007, E007, F007, G007, H007, J007 and K007)

· Risk Assessment Reports (See CDRLs, A009, C009, D009, E009, F009, G009, H009, J009 and K009)

· Technical White Papers (See CDRLs, A010, C010, D010, E010, F010, G010, H010, J010 and K010)

· Site Preparation Requirements and Implementation Plan (SPRIP) (See CDRLs, A021, C021, D021, E021, F021, G021, H021, J021 and K021)

2.4.2 Develop and enhance systems, hardware, software, and Test Harnesses to facilitate systems engineering, development, and testing activities. To include creating tools that allow automation, enhancement, modeling and simulation of those activities within operational and cyberspace environments.

2.4.2.1 Participate in iterative test cycle activities such as DevSecOps, Continuous Integration / Continuous Development (CI/CD) activities as required in support of system development, testing, and integration.

2.4.3.5 Ensure a complete and comprehensive Body of Evidence is developed for all C4ISR and Cybersecurity system that is designed, architected, engineered, developed, enhanced, integrated, transitioned, and supported under this contract. The body of evidence may include the following areas Supply Chain Risk Management (SCRM), Vulnerability Management, Patch Management, Configuration Management, Change Management, Test and Evaluation Master Plan (TEMP), Systems Engineering, and Program Management.

2.4.4 Deliver all created documentation and any software or hardware developed, enhanced, assembled or acquired in accordance with the following:

· Presentation Materials (See CDRLs, A005, C005, D005, E005, F005, G005, H005, J005 and K005)

· Meeting Minutes for Design Reviews, Technical Exchanges, and other meetings attended. (See CDRLs, A006, C006, D006, E006, F006, G006, H006, J006 and K006)

· Trip Reports (See CDRLs, A007, C007, D007, E007, F007, G007, H007, J007, and K007)

· Risk Assessment Reports document review reports describing findings in the system documentation requiring resolution (See CDRLs, A009, C009, D009, E009, F009, G009, H009, J009 and K009)

· Technical White Papers (See CDRLs, A010, C010, D010, E010, F010, G010, H010, J010 and K010)

· System Test Plan for test and evaluation and/or IA assessment (See CDRLs, A011, C011, D011, E011, F011, G011, H011, J011 and K011)

· System Test Procedures for test and evaluation and/or IA assessment (See CDRLs, A012, C012, D012, E012, F012, G012, H012, J012 and K012)

· Source and object (executable) Code (See CDRLs, A022, C022, D022, E022, F022, G022, H022, J022 and K022)

· Complete software documentation (See CDRLs, A023, C023, D023, E023, F023, G023, H023, J023 and K023)

· Acquired commercial off-the-shelf hardware and software (See CDRLs, A024, C024, D024, E024, F024, G024, H024, J024 and K024)

2.5.2.2 Participate in iterative test cycle activities such as AGILE/SCRUM, DevSecOps, Continuous Integration / Continuous Development (CI/CD) activities as required in support of system development, enhancement, testing, and integration.

2.5.2.3 Conduct periodic functional and cybersecurity assessments to verify implementation of requirements.

2.5.3 Develop and enhance systems, hardware, software, and Test Harnesses to facilitate systems engineering, capability development, and testing activities. To include creating tools that allow automation, enhancement, modeling and simulation of development, enhancement and testing activities.

2.5.4 Create and deliver the following documentation:

· Presentation Materials describing progress of testing and issues (See CDRLs, A005, C005, D005, E005, F005, G005, H005, J005 and K005)

· Meeting Minutes for Design Reviews, Technical Exchanges, and other meetings attended. (See CDRLs, A006, C006, D006, E006, F006, G006, H006, J006 K006)

· Trip Reports (See CDRLs, A007, C007, D007, E007, F007, G007, H007, J007 and K007)

· Technical White Papers (See CDRLs, A010, C010, D010, E010, F010, G010, H010, J010 and K010)

· Test Reports (See CDRLs, A013, C013, D013, E013, F013, G013, H013, J013 and K013)

· Describing software bugs, performance issues, and issues in security and functionality observed during test and evaluation

· Incorporating the findings, conclusions, and possible mitigations resulting from the test activity

· Source and object (executable) Code (See CDRLs, A022, C022, D022, E022, F022, G022, H022, J022 and K022)

· Complete software documentation (See CDRLs, A023, C023, D023, E023, F023, G023, H023, J023 and K023)

· Acquired commercial off-the-shelf hardware and software (See CDRLs, A024, C024, D024, E024, F024, G024, H024, J024 and K024)

2.6.4 Develop and enhance systems, hardware, software, and Test Harnesses to facilitate systems engineering, capability development, and testing activities. To include creating tools that allow automation, enhancement, modeling and simulation of testing activities.

2.6.5 Conduct functional, IA, and cybersecurity testing, to include vulnerability, penetration, and adversarial assessment testing, for systems, hardware, firmware, and software.

2.6.6 Create and deliver the following documentation:

· Presentation Materials describing progress of contractor activities during the verification phase (See CDRLs, A005, B005, C005, D005, E005, F005, G005, H005, J005 and K005)

· Meeting Minutes documenting Technical Exchanges attended during the verification phase (See CDRLs, A006, B006, C006, D006, E006, F006, G006, H006, J006 and K006)

· Trip Reports (See CDRLs, A007, B007, C007, D007, E007, F007, G007, H007, J007 and K007)

· Technical White Papers (See CDRLs, A010, B010, C010, D010, E010, F010, G010, H010, J010 and K010)

· Source and object (executable) Code (See CDRLs, A022, B022, C022, D022, E022, F022, G022, H022, J022 and K022)

· Complete software documentation (See CDRLs, A023. B023, C023, D023, E023, F023, G023, H023, J023 and K023)

· Acquired commercial off-the-shelf hardware and software (See CDRLs A024, B024, C024, D024, E024, F024, G024, H024, J024 and K024)

2.7.6 Develop and enhance system, hardware, software, and Test Harnesses to facilitate systems engineering, development, and testing activities. To include creating tools that allow automation, enhancement, modeling and simulation of testing activities within software factories based on CI/CD Pipeline, AGILE/SCRUM or DEVSECOPS.

2.7.7 Create and deliver the following documentation:

· Presentation Materials (See CDRLs A005, B005, C005, D005, E005, F005, G005, H005, J005 and K005)

· Meeting Minutes for Design Reviews, Technical Exchanges, and other meetings attended. (See CDRLs, A006, B006, C006, D006, E006, F006, G006, H006 J006 and K006)

· Trip Reports (See CDRLs, A007, B007, C007, D007, E007, F007, G007, H007, J007 and K007)

· Risk Assessment Report describing the results of system risk analysis as it applies to RMF (See CDRLs, A009, B009, C009, D009, E009, F009, G009, H009, J009 and K009)

· Technical White Papers (See CDRLs, A010, B010, C010, D010, E010, F010, G010, H010, J010 and K010)

· Test Reports (See CDRLs, A013, B013, C013, D013, E013, F013, G013, H013, J013 and K013)

· RMF IA Control Validation Reports describing the results and issues for systems under evaluation (See CDRLs, A014, B014, C014, D014, E014, F014, G014, H014, J014 and K014)

· Source and object (executable) Code (See CDRLs, A022, B022, C022, D022, E022,F022, G022, H022, J022 and K022)

· Complete software documentation (See CDRLs, A023, B023, C023, D023, E023, F023, G023, H023, J023 and K023)

· Acquired commercial off-the-shelf hardware and software (See CDRLs, A024, B024, C024, D024, E024, F024, G024, H024, j024 and K024)

2.8.3.18 Provide oversight and maintenance, change and configuration management, and enhancement services of C4ISR systems.

2.8.3.19 Provide Tier 2, 3, and 4 Help Desk support services as necessary by mission partner organization.

2.8.3.20 Conduct system familiarization and knowledge transfer activities for the systems developed and/or enhanced as part of this PWS.

2.8.3.21 Perform Information System Security Officer (ISSO) and Information System Security Engineer duties to include scanning, account management, access control, and auditing.

2.8.3.22 Perform system and/or network administration.

2.8.4 Conduct ISR PED and RDA

2.8.4.1 Conduct comprehensive Processing, Exploitation, and Dissemination (PED) missions to support Intelligence, Surveillance, and Reconnaissance (ISR) operations. This includes the efficient processing of raw ISR data, its subsequent analysis to extract actionable intelligence, and the timely dissemination of this intelligence to relevant stakeholders. This mission aims to enhance situational awareness, operational effectiveness, and decision-making capabilities across various platforms and environments.

2.8,4.1.1 Processing: Perform and support the ingestion and initial processing of ISR data, which includes data normalization, decryption, and formatting to ensure compatibility with analytical tools and systems. Processing must adhere to established standards and protocols to ensure data integrity and readiness for exploitation.

2.8.4.1.2 Exploitation: Conduct detailed analysis of processed ISR data to identify, assess, and interpret relevant information. This includes leveraging advanced analytical techniques and tools to derive actionable intelligence. Analysts are expected to produce high-quality intelligence products, including situational reports, threat assessments, and operational recommendations.

2.8.4.1.3 Dissemination: Manage and support the dissemination of intelligence products to appropriate end-users in a timely manner. This involves the preparation and distribution of intelligence reports, briefings, and other relevant documents through secure channels. The contractor must ensure that dissemination processes comply with all relevant security protocols and ensure that information reaches stakeholders promptly and efficiently.

2.8.4.2 Using SCRUM methodologies conduct a comprehensive evaluation and analysis of the Research, Development and Acquisition (RDA) capabilities, processes, facilities, entities, and ecosystems of foreign states and non-state actors. This analysis will include identifying the networks of individuals, organizations, facilities, and resources required to support the research, development, testing, manufacturing, acquisition, distribution, and sustainment of these adversary systems and capabilities. Additionally, the contractor will identify key foreign decision-makers and decision-making bodies, as well as their funding programs and sources. As part of this analysis develop architectures and systems to counter adversary capabilities. Provide engineering and technical all source analysis and data support focusing on adversary supply chains/ecosystems that unlay their research, development, test, acquisition, and sustainment capabilities/processes. Work performed will include evaluating and integrating data from classified and unclassified sources; performing technical analysis; developing assessments and evaluations; and providing reports.

2.8.5 Deliver all created documentation and any software or hardware developed, enhanced, assembled or acquired in accordance with the following:

· Presentation Material - CDSSA Briefings to CDTAB (classified reports) for Cross Domain systems (See CDRLs, A005, B005, C005, D005, E005, F005, G005, H005, J005 and K005)

· Meeting Minutes for Design Reviews, Technical Exchanges, and other meetings attended. (See CDRLs, A006, B006, C006, D006, E006, F006, G006, H006, J006 and K006)

· Trip Reports (See CDRLs, A007, B007, C007, D007)

· Risk Assessment Reports for the CA on the risk to the operational environment by fielding the system under evaluation (See CDRLs, A009, B009, C009, D009, E009, F009, G009, H009, J009 and K009)

· E/APL Certification Memos (See CDRLs, A015, B015, C015, D015, E015, F015, G015, H015, J015 and K015)

· Security/Design/Test Readiness Report (See CDRLs, A016, B016, C016, D016, E015, F016, G016, H016, J016 and K016)

· Security Design Review Reports for Cross Domain systems

· Test Readiness Review Reports for Cross Domain systems

· CDSSA Test Procedures for Cross Domain systems (See CDRLs, A017, B017, C017, D017, E017, F017, G017, H017, J017 and K017)

· CDSSA Test Reports for Cross Domain systems (See CDRLs, A018, B018, C018, D018, E018, F018, G018, H018, J018 and K018)

· Technical Risk Rating Reports (classified reports) for Cross Domain systems (See CDRLs, A019, B019, C019, D019, E019, F019, G019, H019, J019 and K019)

· Policy Bypass Reports (classified reports) for Cross Domain systems (See CDRLs, A020, B020, C020, D020, E020, F020, G020, H020, J020 and K020)

· Site Preparation Requirements and Implementation Plan (SPRIP) (See CDRLs, A021, B021, C021, D021, E021, F021, G021, H021, J021 and K021)

· Source and object (executable) Code (See CDRLs, A022, B022, C022, D022, E022, F022, G022, H022, J022 and K022)

· Complete software documentation (See CDRLs, A023, B023, C023, D023, E023, F023, G023, H023, J023 and K023)

· Acquired commercial off-the-shelf hardware and software (See CDRLs, A024, B024, C024, D024, E024, F024, G024, H024, J024 and K024)

2.9.12 This effort will require TS/SCI cleared Intelligence Analysts and Data Scientists experienced with NASIC.

analytical standards and environment with a background in adversary supply chains.

2.9.13 Create and deliver the following documentation:

· Contractor Progress, Status and Management Report (See CDRLs A001, B001, C001, D001, E001, F001, G001, H001, J001 and K001)

· Contract Funds Status Report (See CDRLs, A002, B002, C002, D002, E002, F002, G002, H002, J002 and K002)

· Funds and Man-Hour Expenditure Report (See CDRLs, A003, B003, C003, D003, E003, F003, G003, H003, J003 and K003)

· Program Management Plan (See CDRLs, A004, B004, C004, D004, E004, F004, G004, H004, J004 and K004)

· Presentation Materials (See CDRLs, A005, B005, C005, D005, E005, F005, G005, H005, J005 and K005)

· Meeting Minutes (See CDRLs, A006, B006, C006, D006, E006, F006, G006, H006, J006 and K006)

· Trip Reports (See CDRLs, A007, B007, C007, D007, E007, F007, G007, H007, J007 and K007)

· Revisions to Existing Government Documents (See CDRLs, A008, B008, C008, D008, E008, F008, G008, H008, J008 and K008)

· Integration Requirements and Evaluation Procedures

· Virtual Test Folder

· System Architecture

· System Test Plan (See CDRLs, A011, B011, C011, D011, E011, F011, G011, H011, J011 and K011)

· System Test Procedures (See CDRLs, A012, B012, C012, D012,E012, F012, G012, H012, J012 and K012 )

-Requirement Development

-Logical Analysis

-Design Solution

-Implementation

-Integration

-Verification

-Validation

-Transition

2.1

2.2

2.3

2.4

2.5

2.6

2.7

2.8 Exceptional = 0 deficiencies.

Very Good = 1-2 deficiencies.

Satisfactory = 3 functionally unrelated deficiencies.

Marginal = 3 or more functionally related deficiencies or 4 or more functionally unrelated deficiencies. Corrective action acceptable to the COR is planned or underway.

Unsatisfactory = 3 or more functionally related deficiencies or 4 or more functionally unrelated deficiencies. No corrective action acceptable to the COR is planned or underway.

R = Tr x Cr

Points Content (Cr)

Unsatisfactory = 1 or more deficiencies

3.4 Methods of Assessment. The COR will inspect the Contractor’s performance of contract requirements using a combination of (1) periodic inspection and (2) customer complaints.

3.4.1 Periodic Inspection. These items are inspected using periodic surveillance (daily, weekly, monthly, quarterly, etc.) as determined by the COR. The results of the periodic surveillance inspections may be used as the basis for actions (other than payment deductions) toward the contractor. In such cases, the Inspection of Services clause becomes the basis for the CO’s actions. The schedules (if requested) are submitted to the CA for review prior to the period being inspected. All inspections will be documented accordingly.

3.4.2 Customer Complaints. The COR is the point of contact and must collect all customer complaints. The AF Form 714, Customer Complaint Record, or a similar locally devised form may be used for this purpose. All complaints and any resulting resolution of such complaints must be documented with the information required on the customer complaint form. Customer complaint forms become a permanent part of the COR surveillance records. The COR will contact each customer involved with this order periodically to assure there is an understanding of the requirement by all appropriate personnel.