DRAFT SOW - SAP DE - 805CTS.docx

Headquarters Air Combat Command (HQ ACC) 805th Combat Training Squadron Nellis AFB, NV 89191 Shadow Operations Center Nellis (ShOC-N) Statement of Work (SOW)

For

Special Access Program (SAP) Digital Environment (DE)

1.0 INTRODUCTION/BACKGROUND: The 805 CTS requires a Special Access Program (SAP) Model and Simulation Environment to support current and future Joint All Domain Command and Control (JADC2)/Advanced Battle Management Systems (ABMS) initiatives and the meet the Chief of Staff of the Air Force’s (CSAF) appointment of ShOC-Nellis as the Lead Air Force Battlelab. Comply with HAF/A57 Battlelab Capability Development Document, attribute 3 Experimentation Environment.

2.0 Overview

Contract Awardee shall provide SAP DE solution to the 805 CTS at Nellis AFB, NV. This solution shall support file sharing and application test and development. The solution shall include Risk Management Framework (RMF) support to achieve an ATO to connect to JWICs.

3.0 Statement of Work

3.1 Technical Solution

3.1.1 Network

The network components of this solution shall consist of three (3) switches. Two (2) Top of Rack (TOR) switches shall support the eighteen (18) servers, Network Attached Storage (NAS), two (2) firewalls, one (1) Cross Domain Solution (CDS), and one (1) access switch. The one (1) access switch shall provide connectivity to sixteen (16) workstations. The TOR switches shall be Cisco Nexus N9K-C9336C-FX2 and the access switch shall be a Catalyst 9300X-24Y multigigabit 25/10/1G switch.

The two TOR switches shall be configured to use vPC links to the server cluster, access switch, firewalls, and CDS. They shall provide 100G backplane for the server cluster via redundant 100G links. The NAS shall have redundant 25G links to the TOR switches. The access switch shall have a redundant 10G uplink to the TOR switches. The firewall shall have redundant 1G links to the TOR and a 1G link to the local JWICs POP once an ATT or ATO has been awarded.

3.1.2 Firewall

The firewall component of this solution shall consist of a failover pair of Cisco NGFW 1120s to provide isolation and access control between the local enclave and JWICS.

The Firewall shall NOT NAT the local address space. The 805th is responsible for providing or acquiring sufficient JWICS address space to support the project.

3.1.3 Servers and Workstations

The server component of this solution shall consist of two (2) different models of servers and the workstation component shall consist of one (1) model of workstation. The contractor shall provide:

· Five (5) PowerEdge R7525 servers each with:

· Two (2) AMD 7742 2.25GHz 64C/128T CPUs

· 1TB RAM

· Two (2) 480GB SSD Boot disk, Seven (7) 7.68TB SSD with PERC H745 RAID controller

· Two (2) Broadcom 100GbE QSFP and two (2) 10GbE SFP+ NICs

· RedHat Enterprise Server with OpenShift

· Twelve (8) PowerEdge R6525 servers each with:

· Two (2) AMD 7743 2.85GHz 24C/48T CPUs

· 384 GB RAM

· Two (2) 480GB SSD Boot disk, Four (4) 3.84TB SSD with PERC H345 RAID controller

· Two (2) Broadcom 100GbE QSFP and two (2) 10GbE SFP+ NICs

· RedHat Enterprise Server with OpenShift

· One (1) PowerEdge R6525 servers each with:

· Two (2) AMD 7743 2.85GHz 24C/48T CPUs

· 384 GB RAM

· Two (2) 480GB SSD Boot disk, Four (4) 3.84TB SSD with PERC H345 RAID controller

· Two (2) Broadcom 100GbE QSFP and two (2) 10GbE SFP+ NICs

· RedHat Enterprise Server with Elastic SIEM

· Sixteen (8) Precision 7920 tower workstations each with:

· Two Intell Xeon Gold 5217 3.0GHz 8C/16T

· 128GB RAM

· One(1) M.2 512GB NVMe and One(1) M.2 2TB NVMe SSD

· One(1) Fiber 1Gb NIC

· One Nvidia RTX A2000 6GB GPU

· RedHat Enterprise Workstation

3.1.4 Network Attached Storage (NAS)

The NAS component of this solution shall consist of a Dell Unity 880F with an all flash storage array allowing very high density in a small footprint. The NAS shall provide 384TB of raw block/file storage.

3.1.5 Security Information and Event Management (SIEM)

The SIEM component of this solution shall consist of a single Elastic node to provide SIEM functionality for the local enclave. It shall consume logs from all the devices, operating systems, and application sources. This shall provide auditing and performance situational awareness for the 805th Network, Cybersecurity, and Server administrative teams.

3.1.6 Uninterruptible Power Supply (UPS)

The UPS component of this solution shall consist of a UPS and battery shall provide conditioned power and protection for the switches, servers, NAS, firewalls, and CDS. The UPS shall provide enough runtime to safely shutdown the attached devices in the event of a power outage.

3.1.7 Cross Domain Solution (CDS)

The CDS component of this solution shall provide the capability to move data between two (2) lower classification networks and the attached TS SAP network. This data shall include video, audio and text files. This solution shall consist of a Forcepoint High Speed Guard (HSG) and Trusted Gateway System (TGS) guard servers along with an admin server.

This solution shall support the following data flow types:

DSTO/HTTPS

DSTO/HTTPS

Hardware and Software Summary:

· One (1) HSG Server

· Two (2) Rack Unit (RU)

· Connected to HSG Admin Server via dedicated Ethernet connection.

· 10 Gb Ethernet

· Four (4) dual port 10Gb fiber NICs

· One (1) HSG Admin Server

· One (1) RU

· Isolated Administration Network

· HSG and TSG Server connected via dedicated Ethernet connection.

· 10 Gb Ethernet

· One (1) TGS Server

· One (1) RU

· Connected to HSG Admin Server via dedicated Ethernet connection.

· 10 Gb Ethernet

· Four (4) dual port 10Gb fiber NICs

3.1.7.1 Risk Management Framework (RMF)

The Contractor shall properly test all the SAP DE solution’s major components, assess the results, provide General Atomics with all information needed to patch system vulnerabilities identified, develop all required RMF documentation, work with DIA’s Cyber Frontdoor office to update JWICS as needed, and request system accreditation using the JWICS RMF Accreditation and Authorization (A&A) Workflow submission process (via the Xacta tool). The Contractor shall employ a scan-fix-scan methodology to eliminate as many vulnerabilities as possible prior to ATO package submission. This in turn helps expedite getting the system through the RMF A&A workflow process. The goal shall be to seek and obtain a three (3) year ATO for the SAP DE solution.

The list of the major components to be tested is below:

· Server

· NAS

· SIEM

· CDS

· Firewall

· Network

Each major component along with its applicable software shall be assessed and configured in accordance with the appropriate DISA STIG checklist(s). In addition, credentialed Tenable Nessus scans using current plugins will be conducted on the components and software to detect ports, assess the configuration, and identify any resident vulnerabilities. The STIG checklist(s) and Nessus scans shall be completed and serve as the “initial” set of testing. The Contractor shall then employ a repetitive scan-fix-scan process to identify and eradicate as many vulnerabilities as possible. From there the Contractor shall work with General Atomics to alleviate any remaining conflicts (if any) between the STIG requirements and functionality of the SAP DE Solution. Scan results provided ensures there are no open Critical or High findings that are not mitigated to a risk level approved by the 805 CTS applicable accreditation authority.

All open or unimplemented STIG settings shall be documented along with the Nessus scan findings in a SAP DE Solution ATO Plan of Action and Milestones (POA&M). This POA&M shall be developed and managed by the Contractor and used to track the status of each open/ongoing STIG and Nessus scan finding. The POA&M shall document all residual levels of risk present in the system. The Contractor shall work with 805 CTS to develop justification statements for those non-compliant STIG settings, as well as draft mitigation plans, and resources required to resolve any of the open/ongoing STIG and Nessus findings. Any level of risk which cannot be mitigated must be approved by the Government.

The Contractor shall perform the following RMF A&A services, as well as draft the RMF artifacts relative to the hardware, software, and subsequent security tests performed for the SAP DE solution.

All RMF documentation shall be prepared using approved templates:

· Cybersecurity Testing

· Meet with 805 CTS SMEs and Contractor to gather existing RMF/Information

· Assurance-related documentation and discuss known/current vulnerabilities and threats

· Perform an initial risk assessment of the system in relation to proposed solution

· Test the system’s hardware/software by performing ACAS Nessus scans and applying

· Applicable STIGs, Security Requirements Guides (SRGs), and Secure Content

· Automation Protocol (SCAP) settings (as appropriate)

· Implement the “scan-fix-scan” methodology

· Identify and document Ports, Protocols and Services (PPS)

· Document open/ongoing vulnerabilities and other findings within a POA&M

· Perform Gap Analysis and Risk Assessment

· Documentation Support

· Draft/update the HW/SW/FW List

· Draft/update the Authorization Boundary Diagram

· Draft/update the PPS list

· Draft/Update the Security Assessment Plan (SAP)

· Xacta Support

· Update the security control implementation in the Security Controls Traceability Matrix (SCTM) portion of the System Security Plan (SSP) via JWICS (Xacta)

· Update RMF security controls test results as necessary

· Upload all updated or new RMF artifacts and test results into the Xacta record

· Update the Xacta POA&M as necessary

· Resolve all Xacta conflicts

· Process and manage all Xacta workflows as directed/needed

3.1.8 Deliverables

The following set of work products shall be provided to the 805 CTS at the end of the engagement:

· High Level Design

· As-Built documentation

· Test Plan

3.1.9 Cross Domain Solution (CDS) Deliverables

· Site Survey – Details for 805 CTS implementation (inputs and assigned actions)

· SDD – Specific design pertaining to environment and requirements

· HSG DVG – Specific rule sets pertaining to data and requirements

· Input to HSG/TGS A&A Documentation – Input to HSG/TSG SSP, SCTM, and SBSA Plan

· HSG/TSG Configuration Material – Slides describing how HSG and TSG is configured

· HSG/TSG Maintenance Material – Slides describing how HSG and TSG is maintained

· Trip Report(s) – Reports detailing activities while performing on-site installations services

3.1.10 Risk Management Framework (RMF) Deliverables

· Hardware and Software List

· System Authorization Boundary Diagram

· Information Flows/Paths Diagram

· Ports, Protocols and Services List

· Updates to the System Security Plan (SSP)

· Test Results (Scans, STIGs, SRGs, SCAPs)

· Final POA&M (to include Risk Assessment)

3.1.11 Contractor Responsibilities

· Planning

· Attend the project kick-off meeting

· Contribute to the project plan timeline

· Provide guidance on configuration recommendations to support deploying OpenShift, user/process authentication, authorization, and auditing to meet RMF requirements

· Identify specific risks and mitigation strategies

· Contribute to project and end user communication plans

· Initial Deployment of RedHat OS and OpenShift

· Install and configure RedHat Enterprise Linux Server on provided Dell servers (18)

· Install and configure RedHat Enterprise Linux Workstation on all provided Dell workstations (16)

· Install and configure (baseline) Red Hat OpenShift Container Platform

· Install and Configure an Identity Management Solution

· Ensure that the systems are configured optimally and securely.

· Install and perform all needed updates, upgrades, RMF controls

· Configure OS Firewall rules

· Configure Services Accounts as needed

· Configure Security Controls as needed

· RMF Support

· Remediate any findings that may arise during the project.

· Ensure that all findings are addressed in a timely and effective manner.

· Assist in troubleshooting any security control related issues.

· Documentation

· Document Red Hat Enterprise Linux Server configuration

· Document Red Hat Enterprise Linux Workstation configuration

· Document Red Hat Enterprise OpenShift configuration

· Document network connections

· Document firewall rules

· Document troubleshooting processes

· Knowledge Transfer

· Provide “over-the-shoulder” admin training to the customer’s designated admin and user community on how to complete required management functions of OS and container management solution (OpenShift).

· Pre-Onsite Engineering Services

· System architecture/design and technical risk mitigation for HSG and TGS solution

· Define file type and transfer policies for the TGS

· Create System Design Document (SDD) to include the HSG and TGS design and configuration information

· Develop HSG Rule Sets (filters) for the data types expected to traverse the HSG

· Audio/Video Files (e.g., MPG, AVI, MP3, WAV)

· Document the Rule Set validation with a Data Validation Guide (DVG)

· Develop initial, unclassified server host configs for the HSG and admin servers

· Pre-Onsite A&A services:

· Support A&A discussions on coordination, schedule, and Body of Evidence (BoE) expectations.

· Provide input to a System Security Plan (SSP) and Security Controls Traceability Matrix (SCTM) for HSG and TGS

· Update/modify Site-Based Security Assessment (SBSA) tests for HSG and TGS

· Onsite Implementation Services HSG:

· Onsite implementation services include one (1) Forcepoint engineer for up to two (2) weeks

· Deployment of the HSG solution

· Configure one (1) HSG Admin server(s)

· Apply host configurations to the Admin(s)

· Integrate the Admin(s) with existing customer provided enterprise services that may include NTP, SSH, SNMP

· Integrate the Admin(s) with network infrastructure

· Install and configure one (1) HSG connected to three (3) networks

· Apply rule sets and host configurations to the Guard(s)

· Integrate the Guard(s) with the Admin(s)

· Integrate the Guard(s) with network infrastructure

· Configure HSG to transfer log and audit files to external log servers

· Perform functional end-to-end testing

· Provide HSG over-the-shoulder system administrator training

· Onsite A&A Test Services – HSG:

· Onsite implementation services include two (2) Forcepoint engineers for up to one (1) week

· Assist site in performing HSG SBSA dry-runs and conducting HSG SBSA testing

· Assist site in creating HSG SBSA Report and Plan of Action and Milestones (POA&M) findings, if necessary

· Onsite Implementation Services TGS:

· Onsite implementation services include one (1) Forcepoint engineer for up to two (2) weeks.

· Deployment of the TGS solution

· Integrate and configure one (1) TGS server connected to three (3) networks

· Integrate the TGS solution with existing customer provided enterprise services that may include NTP, SSH, SMTP

· Integrate the TGS solution with network infrastructure

· Configure TGS transfer and file inspection policies

· Configure TGS data transfer paths

· Configure TGS to transfer log and audit files to external log servers

· Perform functional end-to-end testing

· Provide TGS over-the-shoulder system administrator knowledge transfer

· Onsite A&A Test Services TGS:

· Onsite implementation services include two (2) Forcepoint engineers for up to one (1) week

· Assist site in performing TGS SBSA dry-runs and conducting TGS SBSA testing

· Assist site in creating TGS SBSA Report and Plan of Action and Milestones (POA&M) findings, if necessary

3.1.12 805 CTS Responsibilities

· 805 CTS will be responsible for establishing a JWICS Xacta record

· 805 CTS will provide SMEs to work with Contractor with RMF/ATO Support

· 805 CTS POC will provide access to required workspace

· 805 CTS will provide power and network connectivity

· 805 CTS will provide necessary rack space, power, cooling, and connectivity for equipment procured under this project

· 805 CTS will provide access to required workspace and staging area to support this project

· 805 CTS will provide any required change control processes or documents needed for completion of this project.

· 805 CTS will provide any/all IP addresses required to complete the installation of the solution

· 805 CTS will provide escorts to enable deployment resources access to required spaces to complete installation of the solution

· 805 CTS will provide DD form 254 to authorize the Contractor access to the work area.

· 805 CTS will provide RMF categorization and controls required as reference to Contractor to ensure hardening meets specification

3.2 Management Approach

3.2.1 Project Management

The Contractor shall assign a dedicated Project Manager to serve as the primary point of contact for the 805 CTS regarding the contractual and financial aspects of the project. The Project Manager shall be responsible for coordinating the Project Initiation Meeting (PIM) and follow-on Status Meetings with appropriate 805 CTS project management and technical staff, ensuring that all reporting is properly conducted and provided as deliverables in accordance with project requirements. The Project Manager shall also define and schedule appropriate resources, and provide project status and other communication, and be responsible for scope management, including responding to requests for change in scope.

3.2.2 Project Initiation Meeting (PIM)

The Project Manager shall host one (1) PIM call with the 805 CTS and Contractor representatives. Topics to be discussed include the following:

· Project business drivers, scope, and objectives.

· Project deadlines, estimated timelines, scheduling, and logistics.

· Identification of key 805 CTS team members with whom Contractor shall work to perform the tasks defined in this SOW.

· Participating team members are confirmed and contact details are exchanged to schedule the project kick-off meeting.

· Deliverables

· One (1) project initiation call

3.2.3 Project Plan

Contractor leads one (1) project kick-off meeting with 805 CTS to review expectations about the purpose of the engagement, the delivery approach, and estimated timelines. The following are the objectives of the meeting:

· Introducing the Contractor team, roles, and responsibilities.

· Describing the project goals, phases, and key dates.

· Agreeing on communication and reporting process and creating a communications plan.

· Validating the project expectations and clarifying roles and responsibilities.

· Confirming prerequisites are met as detailed in the solution checklist for specified solutions.

· Presenting the solution overview for specified solutions including expected project results and deliverables.

3.2.4 Project Communication

3.2.4.1 Project Status Meetings

As described above, in addition to conducting the PIM, the Contractor Project Manager shall schedule and host Project Status Meetings (PSM) in order to effectively keep 805 CTS project management apprised of progress. The PSMs shall meet weekly (Day to be coordinated between the PIM and 805 CTS POC) throughout the life of the project, and shall not exceed one-hour total duration per week. PSMs may be held either at the 805 CTS site or via teleconference.

PSMs document the work performed under this project and shall be provided as required by 805 CTS project management. PSMs shall contain an accurate, up-to-date summary account of tasks completed, tasks ongoing, tasks to be worked, and any outstanding issues. These reports shall follow the format provided by 805 CTS project management. During the execution of this engagement Contractor shall develop and provide the 805 CTS the following deliverable products:

· 805 CTS Meetings with Meeting Minutes (meeting frequency shall be determined at PIM)

· Weekly Status Reports

· Project Test Plans and Results

3.2.4.2 Change Management

Change management is a key process in the systematic application of project management best practices. This process focuses on controlling changes to the baseline plan to ensure project success. The process supports the ability to make conscious decisions regarding specific project trade-offs between scope, schedule, resources, and other program parameters while dealing with the reality of the need to make changes. It provides all parties a recorded trail of all changes made to the project baseline plan. Once a change is proposed, it is reviewed and its impact both within and across the project functional areas is assessed. Changes that originate within a project but have an impact on other projects or organizational functions must be escalated to the 805 CTS’s project sponsor for review and approval. The proposed change's alignment with project objectives is validated and it is either approved or rejected. Once that decision has been made it must be communicated to all affected organizations and team members. Adjustments reflecting the changes are made to the project planning documents and the change documents are placed in the project notebook.

3.2.4.3 Reporting

The Contractor Project Manager shall ensure accurate and timely reporting for all contractual requirements under this project. All reports shall be submitted electronically in Microsoft Word format and delivered during PSMs.

These reporting deliverables include:

· Minutes from PSMs and other technical meetings/reviews

· Project Close-out report and minutes from Project Close-out Meeting

3.2.5 Project Close-out

Once the solution has been delivered, the Contractor Project Manager shall schedule a final Project Close-out Meeting. All aspects of the project shall be reviewed to ensure that 805 CTS project management has no final requirements. As part of this meeting the following shall be verified as complete:

· Test and Acceptance for each technical area identified in this SOW

· Providing of all documentation and deliverables identified in this SOW

· Resolution of any punch-list items identified in conjunction with Test and Acceptance

· Upon favorable completion of the above tasks and as part of closure to this meeting, the 805 CTS will sign the project acceptance form, signifying completion of the project.

3.3 Work Environment and Coordination

3.3.1 Single Point of Contact

The 805 CTS Configuration Manager will act as the single point of contact (POC) to work with the Contractor Project Manager for any pre-project preparation and for coordination during the life of the project. This individual will be responsible for any 805 CTS requirements identified in this SOW, and will participate in the PIM, PSMs, and other meetings. Additionally, the 805 CTS POC will work with the Contractor on schedule coordination and approval, will participate in Project Acceptance Testing and Project Close-out. This individual will also be available on a regular, ad hoc basis to resolve any site logistical issues that may hinder progress. The 805 CTS POC will be the only representative authorized to approve change orders to this SOW on behalf of the 805 CTS.

3.3.2 Site Access and Security Requirements

The 805 CTS shall provide written guidance regarding any security requirements for access to facilities, systems, and networks. The guidance should outline all of the security requirements associated with information, networks, or systems being accessed.

The 805 CTS will provide security guidance in accordance with Federal Acquisition Regulation (FAR), specifically FAR clause 52.204-2, Security Requirements and FAR Subpart

4.4 – Safeguarding Classified Information within Industry by providing a Form DD254.

Work will be performed at the government facility, Bldg 202, 3663 Tyndall Ave, Nellis AFB, 89191, requires access to classified networks at the Top Secret level and will require a vendor registered FCL.

· Contractors will require access to Restricted Data and controlled unclassified information to perform duties.

· Operations Security (OPSEC), will comply with AFI 10-701, Operations Security, local plans and publications.

3.3.3 Scheduling

All work will be scheduled with the Contractor Project Manager in writing at least ten business days prior to the desired project start date. Actual start dates may vary based on staff, equipment delivery, and other resource availability. Changes to the project start date or the schedule in general must be requested one week in advance of the previously agreed start date. Any changes to the Period of Performance must be coordinated with 99 CONS and officially changed via a contract modification.

3.3.4 Work Hours

Working hours of 7:30am – 4:30pm, Monday – Friday, with all work to be performed so as to minimize interference with normal facility functions. Some tasks may require working outside regular working hours; however, normal working hours will be in effect for the bulk of this project. Cut overs will be scheduled for afterhours. Coordination with 99CONS needs to be made in advance of contract award for concerns with the work hours.

3.3.5 Period of Performance

The period of performance for project services is one year from signature or receipt of purchase order.

3.3.6 Service Interruptions

Planned outages may be required in order to fully implement the system identified in this SOW. The Contractor will schedule any required outages for a mutually agreed time with the 805 CTS.

3.3.7 Current Infrastructure

The 805 CTS will ensure the current network environment is stable and software revisions on any applicable network or systems components are sufficient to support the introduction of the components identified in this SOW. The 805 CTS shall provide all necessary site configuration information, drawings, and passwords as identified in the 3.1.5 section above. The 805 CTS will ensure that any existing equipment that may be involved in this project is properly backed up prior to project start.

3.3.8 Power and Environment Requirements

The 805 CTS will ensure that electrical power with the appropriate interface and current rating is provided prior to the date of installation. The 805 CTS will additionally ensure that all other environmental requirements are satisfied, including temperature control, safety, and security.

3.3.9 Circuits

Any new circuits required to implement this solution will be installed and ready for use prior to the start of this engagement.