encl2c_pws_CFBLNet_Sept2026.docx

PERFORMANCE WORK STATEMENT (PWS)

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title. Combined Federated Battle Laboratories Network (CFBLNet) Support Services

3. Background. CFBLNet is an essential capability supporting the Mission Partner Environment (MPE), a framework enabling commanders to plan and execute Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance (C4ISR) within appropriate security domains spanning US and MP infrastructures, with integrated capabilities, processes, and governance.

The MPE vision seeks to foster an integrated strategic and episodic environment that is optimized for seamless interoperability and dynamic information sharing, supporting coalition cohesion, increasing the speed of command, action, and response across the range of military operations. Combined operational effects, with integrated core services, execution across diverse platforms, and supporting Phase 0 (Shape) through Phase 5 (Enable Civil Authority) operations with any mission partner, in any security domain, is the fundamental goal.

CFBLNet provides a Research and Development (R&D) environment for trials, assessments and R&D testing through assured coalition interoperability and end-to-end information exchanges among all MPs in each Coalition Mission Thread (CMT).

The CFBLNet capability team contains a mix of Government civilians and affiliates, occasional military, Systems Engineering and Technical Assistance (SETA) contractors, and FFRDC (Federally Funded Research and Development Center) and other contractors, who act on the Government’s behalf and support the Government with planning, technical, and administrative proficiency.

The CFBLNet US National Point of Presence is located at the Defense Information Systems Agency (DISA) Joint Interoperability Testing Command (JITC) at Fort Meade, MD. Enduring and episodic activities will be supported at the Unclassified/Restricted and Secret/Releasable (SEC/REL) levels and facilitate designated Communities of Interest. CFBLNet architecture is primarily characterized by Enclave configurations corresponding to requirements identified within governance (CFBLNet Manual) and/or consistent with organizational requirements. Examples include NATO, FVEY, and similar designations.

4. Objectives:

This Performance Work Statement (PWS) articulates the requirement for uninterrupted multinational Combined Federated Battle Laboratories Network (CFBLNet) information exchange, combined with supporting services and functions for enabling:

a. secure, worldwide, multinational federation and collaboration

b. developing and maturing capabilities for future mission support to military operations

c. providing a rapid response to evolving demands of U.S. national security.

These activities are specified to efficiently provide the full range of CFBLNet Design, Transition, and Operation (DTO) enablement capabilities in support of RDT&E initiatives, between Mission Partners, as managed by the Portfolio Acquisition Executive - Mission Partner Environment: “PAE-MPE.”

All services, functions, and supporting actions shall be compliant with all PAE-MPE standards and specifications; governance; technical implementation; Joining, Membership, and Exiting Instructions (JMEI); and mission-based interoperability compliance and assessment requirements as summarized, referenced or indicated in DoDI 8110.01. They shall also be compatible with, or have a role in implementing, CFBLNet governance documents, and shall comply with all Tactics, Techniques and Procedures (TTP) issuances.

All configurations will adhere to approved, mainstream commercial solutions and facilitate transition to operations and full-lifecycle sustainment activities for coalition capabilities.

Included in the CFBLNet requirement is the Coalition Interoperability Assurance and Validation (CIAV) process. The CFBLNet architecture provides the ability to ensure that CIAV can fulfill access and information exchange requirements in multiple security domains.

5. Scope.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 30% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

The scope of work performed by the Contractor under this TO supports the objectives defined in this PWS. Underpinning these objectives are basic functions spanning technical, administrative, business processes, and organizational interactions necessary to fulfill obligations to U.S. and Coalition (NATO, FVEY, and other COI) MPE activities. The scope of effort to support core tasks includes:

· Program Management

· Life Cycle Support

· Cybersecurity

· Operations

· Program Support

· Administrative Support

6. Performance Requirements.

6.1 Task 1 Task Order (TO) Management - Operations and Maintenance (O&M)

Apply planning, scheduling, activity prioritization, project management, as well as standardized processes and procedures for tasks required to support the CFBLNet environment through aligned services and functions. Most of the work required to satisfy the requirements of this TO can be conducted during normal, local operating hours, unless further specified. A small percentage of the work performed may require effort outside of normal operating hours. Defined operating hours will be established or communicated at each location. No overtime premium will be payable under this contract.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 20% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

6.1.1 Subtask 1 – Program Management. The contractor shall provide TO level management and prepare a Task Order Management Plan describing the technical approach, organizational resources, and management controls to be employed to meet the performance and schedule requirements as well as a risk assessment (identification and mitigation strategy) throughout the TO execution. In addition, the contractor shall develop an internal risk management program and will work jointly with government team members to identify and monitor overall project initiative risks and develop mitigation plans and strategies for those risks. The contractor shall prepare and submit written monthly status reports to the Contracting Officer’s Representative (COR).

The contractor shall participate in and prepare monthly Contractor Performance Review (CPR) presentations. The CPR presentations should include status of TO performance to the COR, Capability Lead, and other Government stakeholders. As directed by the COR, the presentations will be completed in a formal meeting (may be virtual or in-person) and/or by submitting the presentation material via email to the team. CPR inputs are provided at the task or Contract Line-Item Number (CLIN) level. If issues arise below the task level, then the contractor shall provide CPR inputs for the subtasks associated with the issues. Within the CPR presentation, the contractor shall provide a monthly status and projected requirements of funds, staff-hours, and work completion for evaluation of the contractor’s progress on the PWS tasks and subtasks. The weekly status report shall provide details of work performed on the TO from Monday through Friday of the previous week. The CPR presentation format is provided under this TO as Government Furnished Information (GFI) and shall take place at the government’s specified facility. At a minimum, this data shall include:

The CPR shall focus on overall TO performance including the tracking and reporting of the TO funding and Contractor burn rate. The Contractor shall provide insight into expenditures such as: 1) Total invoiced; 2) Remaining funds; and 3) Anticipated expenditures for both labor and Other Direct Costs (ODCs). The government will review submission of invoices and disbursement of funds during monthly CPRs to ensure that it is in line with targets based on the TO period of performance. The CPR shall also address staffing, progress, risks, milestones, and status of Government Furnished Equipment (GFE), including Contractor-purchased, Government-owned items, if any. The Contractor shall address price, schedule, performance, and status of each Government specified milestone and associated critical tasks of this TO, noting any problems or risks and alternatives, and recommending solutions and identification of tasks requiring Government decision or interaction.

The Contractor shall ensure the CPR presentation material, is provided to Government participants via the COR, is submitted by the last day of the month and no later than three (3) days prior to the formal meeting. The contractor should ensure that the data provided at program reviews is correct and current; no information within the report should be older than ten (10) workdays from the day of submission. Meeting minutes are only required when a formal meeting is held and shall be delivered to the Government within five (5) working days following the CPR formal meeting.

The Contractor shall allow the Government, and its representatives, access to perform Independent Validation and Verification (IV&V) as directed by PAE.

The Contractor shall establish procedures to instruct its personnel and subcontractor personnel (if applicable) at all levels in terms of compliance with the standards set forth in paragraph 6 and shall monitor compliance. The Contractor shall refer any issues with these laws and regulations while executing this PWS to the Contracting Officer (CO).

The Contractor is responsible for any technical training of its employees either to attain a skill or qualification, or to maintain them. The Contractor shall have processes/procedures to provide required refresher, upgrade, and proficiency training for personnel to remain in compliance with the requirements of the position.

When requested by CO or COR, the contractor shall provide the CO and COR with a summary of contractor personnel certifications and get well plans for those that are not appropriately certified. All qualified personnel shall be able to read, write, speak, and understand English. The contractor shall be responsible to the Government for acts and omissions of its employees and for any subcontractor(s) and its employees.

The Contractor shall submit a detailed Progress Report (MPR) that identifies the status of WBS tasks for that period in terms of accomplishments, work products delivered, schedule progress, existing and projected risk and risk mitigation status, administrative matters, and actual cost and 90-day projections of ODCs, and invoiced and remaining amounts.

The Contractor shall identify any schedule variances from the approved baseline. Schedule variances are the differences between the baseline schedule and actual completion or percent completion of Contractor WBS tasks. Schedule variances shall be reported in days. Any actual or projected deviation from the baseline defined in the Task Order Management Plan shall be reported and explained.

The Contractor shall establish and maintain a formal program management organizational structure and provide the COR with a current organization diagram and directory with the positions, names, and contact information of all personnel who are designated as points of contact or are executing this TO.

The Contractor shall effectively coordinate and work with the COR and COTR, who have the responsibility for administering and monitoring the TO. This will include the exchange of all relevant data and information and participation in various meetings. Despite the required unique relationships with the PAE and the geographically dispersed user community, the Contractor shall only take technical direction from the appropriate COR or COTR regarding this PWS.

6.1.2 Subtask 2 – Project Instantiation. The contractor shall schedule, coordinate, and host a Project Kick-Off Meeting at the location approved by the Government. The meeting shall provide an introduction between the contractor personnel and Government personnel who will be involved with the TO. The meeting shall provide the opportunity to discuss technical, management, and security issues, and travel authorization and reporting procedures. At a minimum, the attendees shall include Key contractor Personnel, representatives from the directorates, the Mission Partner Environment – Portfolio Acquisition Executive (MPE PAE), Technical Point of Contact (TPOC), other relevant Government personnel, and the DISA COR.

At least three days prior to the Kick-Off Meeting, the contractor shall provide a Meeting Agenda for review and approval by the DISA COR and the PAE-MPE Office, and TPOC prior to finalizing. The agenda shall include, at a minimum, the following topics/deliverables:

The Government will provide the contractor with the number of Government participants for the Kick-Off Meeting and the contractor shall provide sufficient copies of the presentation for all present.

The contractor shall draft and provide a Kick-Off Meeting Minutes Report documenting the Kick-Off Meeting discussion and capturing any action items.

Deliverables:

6.2 Task 2. Life Cycle Support.

The Contractor’s network and systems management and operations services shall support engineering design, requirements development, hardware/software acquisition, staging, testing, deployment, installation and integration, hosting, and communications security.

Support cradle-to-grave disposition of components, software, and associated elements of the CFBLNet architecture to assure continuous maturation of capabilities. Emphasis will be focused on technical support and collateral functions to recommend technology solutions, optimize configurations and maximize system performance. Conduct planning, design, development, testing, demonstration, rapid prototyping, integration, virtual site surveys, installation, configuration validation, and maintenance of communications and services supporting CFBLNet operations. Further provide technical coverage for cybersecurity components including encryption devices, firewall/guards, intrusion detection systems and information sensors of computer/network systems and affiliated infrastructure. Administer Internet Protocol (IP) assignments and convergence with integrated voice, data and video communications. Provision resources and services (physical and virtual) and conduct cyclical “Technical Refresh” of key components supporting the CFBLNet Point of Presence with sufficient built-in redundancy.

Capital Equipment Replacement Program (CERP). The Contractor shall incorporate cost efficiencies that can be gained by new technologies to assure steady state, secure functions. The client, server, application, and appliance baselines shall be consistent with the CFBLNet Enterprise, either already on or added to the DISA Approved Products List (APL) and sanctioned under the Trade Agreements Act (TAA) IAW Government standards. The Approved Product List (APL) is the approved list of items that can be added to the network. Existing items on the network are managed via Configuration Management including operation, support and CERP.

New equipment procurement and logistics support is not anticipated; however, some coordination and support may be required during performance. Should this be required, the Government may consider execution of surge to incorporate those requirements into the appropriate tasks/sub-tasks. Under “as directed” conditions, the software and hardware costs for the lifecycle and technology refreshment will be reimbursed through the ODC CLINs. The Contractor shall use existing resources (personnel) to the maximum extent possible. Reassignment of on-hand resources should be employed to minimize the need for additional resources while minimizing the risk to the continued operations of the existing infrastructure.

6.2.1 Subtask 1 – Requirements. During the development or upon receipt of PAE-approved requirements, the Contractor shall assist in sorting and categorizing requirements as they align to the major sections of this PWS.

If applicability is unclear, the Contractor shall make a recommendation of parameters and conditions for PAE-MPE approval.

Requirements may originate from multiple sources, with varying levels of specificity.

The Contractor shall seek PAE-MPE approval before performing any work on requirements in accordance with standing Change Management provisions.

Approval may be conveyed through an internal or extant onboarding process, following defined coordination steps (technical, programmatic, or acquisition review), or may be pre-approved for defined, recurring sustainment activities (system hardening).

Requirements have the potential to introduce or fundamentally change the nature or delivery of user services, the technical system infrastructure, the deployment strategy, interconnections, or any other aspect of CFBLNet community.

Requirements sources are:

a. Federal or Departmental mandates.

b. Internal – from the CFBLNet Program Manager (PM), formerly called Capability Lead.

c. External – from the CFBLNet Community, either directly from the user, or through PAE.

d. The Contractor - forecasting CFBLNet needs and recommending projects from ongoing analysis and assessment of alternatives.

6.2.2 Subtask 2 – Planning. With PAE concurrence, the Contractor shall conduct assessments resulting in reported findings and recommendations that address system requirements, architecture, design options, and implementation plans.

The Contractor shall maintain technical surveillance over technologies and industry practices as they affect DISA MPE systems and advise the COTR of emerging practices and products that can materially affect the cost, performance, and availability of services.

Resulting analysis shall contain clear and sufficient detail to identify impacted baselines, to include user services, system architecture, infrastructure, data exchanges, interfaces, etc.

Include potential architecture and design alternatives, risks involved, comparison of alternatives (to include non-adoption recommendations) or implementation approach, and suggestions for further development.

Develop detailed work plans, schedules, project estimates, resource plans, and status reports in the specified formats asserted in paragraph 6.

6.2.3 Subtask 3 – Design/Acquisition. The Contractor shall define, design, implement, document, and propose improvements to be incorporated into the current and future (To-Be) architecture to guide the development of CFBLNet based on guidance from the Government. The future architecture shall be included in the Technical Data Architecture Package (TDAP) and will be used as the basis for the structured approach to maintaining and maturing the CFBLNet architecture.

The Contractor shall collect, establish and maintain organized and complete documentation for the CFBLNet enterprise. The TDAP shall be updated with configuration documentation for all existing and completed improvements. The TDAP shall capture the “As Is” baseline architecture of CFBLNet. The contractor shall establish with the Government, the approved guidelines and policies. The contractor will present improvements to the TDAP design and implementation that includes the approach, design, level of effort, implementation timeline, and renderings of proposed layout within sixty (60) business days of TO award to the government POC for their review, revisions, and approval.

All TDAP material shall be properly marked and labeled as owned by the USG without corporate identification or logos (except where licensed or proprietary material is involved) and organized in a manner to facilitate its search and a logical understanding of CFBLNet. Proprietary material shall be maintained as a separate addendum to the TDAP, properly marked, with an explanation of why it is proprietary.

The TDAP shall be maintained in a controlled web-accessible format with links to detailed documentation and data of the infrastructure, architecture, operations, user and system operator documentation (e.g., user guides), and processes attendant to the operation of CFBLNet to include its supporting elements. The contractor shall continue to update and maintain the TDAP as US CFBLNet. Evolution of architecture will be guided by the need for standardization in IT, communications, and user services across all CFBLNet.

The PM/COR/COTR will review and provide comments of the TDAP within 15 business days. The Contractor and PM/COR/COTR shall discuss review/comments and approve within 15 calendar days of submission. All approved comments will be included with the updated TDAP deliverable during the next cycle. The TDAP shall be kept current with versioned updates.

For architecture modifications encompassing changes in scale, such as the establishment of a new persistent (colored) enclave, which is inherently different than evolving the existing configuration, the Contractor shall incorporate all performance aspects of the requirement to account for the project and its integration into the overarching capability.

All aspects of the development and implementation of assigned projects will have a single point of contact assigned for those projects with any contributing members documented in support. A RACI chart (Responsible, Accountable, Consulted, Informed) will be prepared to easily identify these responsibilities.

The TDAP will be rigorously synchronized with a Concept of Operation document that frames the commitments and contributions of PAE for the USA-managed architecture comprising the CFBLNet Enterprise.

6.2.4 Subtask 4 – Development. The Contractor shall build and support technical solutions through the integration of commercially available and standardized Information Technology components that meet National Information Assurance Partnership (NIAP) specifications. A phased-approach beginning with defining the problem set, matching requirements to organizational strategic intent and priority, establishing a business case, aligning or specifying key performance parameters (KPP) and measures of effectiveness (MOE), determining any risks, constraints, or dependencies, assessing options through analysis of alternatives (AoA) and evaluating technology readiness level (TRL) and culminating with steps necessary to prepare for pilot and or pathfinder trials.

6.2.5 Subtask 5 – Testing. The Contractor shall employ standard methods to validate the effectiveness of technical solutions through rigorous simulation, sampling, and security review to achieve appropriate Form, Fit and Function. Formal testing will leverage organizational structures to support Developmental Testing (DT), Operational Assessment (AO) and Operational Testing (OT) with thresholds defined for compliance and accessibility parameters.

6.2.6 Subtask 6 – Demonstration. The Contractor shall establish readiness of new functions, services, or capabilities by obtaining validation of compliance to federal and military baselines, comprehensive mapping of outcomes to requirements, and discernable value, prior to deploying change in the current architecture. The scope of this review is set by government decision-makers and determined case-by-case what scale will be required, from Table-Top Exercise (TTX) to End-to-End simulation in a proxy environment.

Demonstrations will be realistic, used to safely test, stress-test, and/or validate solutions.

6.2.7 Subtask 7 – Integration and Installation. The Contractor shall, upon government approval, take steps to schedule appropriate time to effect required updates. Actions taken during this period may include steps necessary to de-couple legacy components, alter configuration settings or apply prescriptive policies, and verify computing or networking resources can accommodate any new components. Integration shall be tempered by assurances of prudent roll-back options should any on-the-spot challenges prove unresolvable. Installation will be finalized when all operating parameters comply with telemetry requirements derived during design and testing and all effects are verified for in-tolerance and stable performance.

6.2.8 Subtask 8 – Fulfillment. The Contractor shall be responsible for the coordination and execution of requirements, integrating changes in CFBLNet architecture and recording them in definitive documents.

Responsibilities include:

a. All administrative, security, logistics, information technology (IT), communications, data exchange, knowledge management, services and functions.

b. Providing technical and analytical guidance to project teams; and recommending and taking action to analyze and solve problems.

c. Executing schedule and performance to fulfill requirements, management of projects from original concept through final implementation.

d. Coordinating with associate organizational elements to solicit, provision, and integrate support functions.

e. Conducting project meetings, tracking progress, addressing risk variables and analyzing effects.

f. Ensuring adherence to quality standards and reviewing project outcomes.

6.2.9 Subtask 9 – Maintenance. . The Contractor shall provide system administration services for all clients/server systems that require updates, repairs, and routine tasks within the scope of authority conveyed to CFBLNet. Day-to-Day checks to determine status of component operational performance will be conducted as soon as possible at the start of each workday, as well as following any Authorized Service Interruptions or facility/up-stream function issues that are discovered or reported to the team. Any disruptions, system errors, or baseline deviations will require troubleshooting with restoration of full operational capability using industry standard break/fix methods, replacement of broken hardware or corrupted software, and documenting all conditions in the approved ticketing system.

6.2.10 Subtask 10 – Sustainment and Technical Refresh. The Contractor shall keep all components of the CFBLNet architecture functional, secure, and aligned with mission needs. As operational efficiency begins to decrease or manufacturer support for legacy configurations is removed, replacement of components will be assessed. Reported observations, conditions and recommendations will be clearly articulated in a decision brief. The approach taken, whether to increase monitoring, leverage spares, or procure new items, will be coordinated and sanctioned by government personnel.

6.2.11 Subtask 11 – Configuration Management. The Contractor shall track, control, and administer the status of all components, sub-systems, and platforms. This includes maintaining an asset inventory and a configuration management database to manage CFBLNet Government Furnished Equipment (GFE) hardware, software and internal and external network infrastructure. Hardware components include, but are not limited to, workstations, servers, network devices, cryptographic devices, and purpose-built security appliances.

6.2.12 Subtask 12 – Change Procedures. The Contractor shall recommend and implement change procedures in a Systems Engineering Management Plan (SEMP) IAW standards and guidance from PAE. Content will include reference and applicability to organizational Requirements Management Plans (RMP) or equivalent direction and are subject to COR concurrence.

This includes the following:

a. Verify that change requests are properly approved and correlate directly to the CFBLNet architecture. Ensure procedures related to approving/rejecting change requests provide traceability from concept to implementation.

b. Analyze the type and frequency of change requests. Source information on Change Requests will be kept and assessment for updating Service Catalog options.

c. Verify that only planned and approved change requests are integrated into the CFBLNet architecture.

d. Ensure CFBLNet environment (architecture, processes, documentation) matures in an orderly, controlled manner with traceability to an approved baseline.

Deliverables:

6.3 Task 3. Cybersecurity.

Perform assessment and authorization of the entire CFBLNet architecture to maintain an unrestricted Authorization To Operate (ATO). Update workflows and artifacts. Apply Risk Management Framework (RMF) requirements with regulation of security controls, risks, and assurance of confidentiality, integrity, and availability of information system resources according to the NIST seven step continuous cycle model. Prepare artifacts (e.g., POA&Ms) to document planned activities to fulfill compliance mandates. Coordinate Interconnection agreements with required substantiation documents (e.g., ATC, ISA, or similar) and mechanisms (e.g., Guest packages). Integrate cybersecurity compliance requirements for client-server, Peer-To-Peer, or externally-hosted enterprises. Employ appropriate access control provisions (e.g., MFA, PKI and Symmetric Keys). Conduct Vulnerability Management functions. Maintain physical security of facilities and components. Support mandated CyberSecurity Service Provider (CSSP) requirements, working with certified authorities to configure associated sensors, processes, and logging within the monitored architecture.

The contractor shall deliver wide-ranging Cybersecurity services to support CFBLNet compliance with departmental mandates, DISA’s enterprise cybersecurity strategy, and ensure secure architecture. Specific applicability is derived from Federal Information Security Modernization Act (FISMA), Federal Information Technology Acquisition Reform Act (FITARA), OMB Circular Number A-130, the Clinger-Cohen Act (CCA), and several DoD/W Instructions (DoDI 8531.01—DoD Vulnerability Management, DoDI 5000.02—Operation of the Adaptive Acquisition Framework, DoDI 5000.82—Acquisition of Information Technology, DoDI 5000.90—Cybersecurity for Acquisition Decision Authorities and Program Managers, DoDI 8551.01—Ports, Protocols, and Services Management (PPSM), and CJCSI 6211.02D) Responsibilities include, but are not limited to:

6.3.1 Subtask 1 – Day-One Readiness. The Contractor shall ensure that all DoD/W Cyberspace Workforce Framework (DCWF) qualifications are verified and active on the first day of performance in accordance with the minimum standards asserted in Paragraph 6.

Information Assurance / Cyberspace Workforce (CSWF) Qualification.

Personnel supporting this PWS shall be U.S. citizens, possessing a minimum Secret security clearance, and licensure, certification, training, credentials, experience, and qualifications commensurate with their functional areas, designated roles, and assigned tasks.

All activities associated with cybersecurity roles require elevated permission. Prior to being granted privileged access, the Contractor shall ensure completion of the following requirements:

1. Background Investigation: Possess a favorably adjudicated background investigation commensurate with the system impact level.

2. System Authorization Access Request (SAAR): An approved DD Form 2875 with the "Privileged Access" block explicitly checked and justified.

3. Privileged Access Agreement (PAA): A signed DoD/Command-approved Privileged Access Agreement acknowledging their responsibilities, reviewed and signed annually.

4. Separation of Duties (SOD): Contractor personnel granted privileged access shall use a separate general user account to perform routine and non-administrative daily tasks. Privileged accounts shall strictly be used for authorized administrative or security functions.

(IAT-I)

(IAM-III)

6.3.2 Subtask 2 – Assessment & Authorization. The contractor shall support all requirements and processes to attain and maintain full Authorization To Operate. Activities will span orientation on organizational intent, developing system categorization, and supporting Cooperative Vulnerability Assessments.

6.3.3 Subtask 3 – Apply RMF. The contractor shall conduct preliminary assessment of directed security controls, make initial risk profile recommendations, and prepare artifacts (e.g., Plans Of Action and Milestones (POA&M)) to document planned activities necessary to fulfill compliance mandates. Assurance of confidentiality, integrity, and availability of information system resources is critical through regulation of security controls and risks.

6.3.4 Subtask 4 – Update eMASS. The contractor shall demonstrate required eMASS training, obtain associated eMASS accounts, maintain artifacts, and initiate supporting workflows to obtain approval(s) from Authorities according to pre-defined roles and responsibilities.

6.3.5 Subtask 5 – Interconnection Coordination. The contractor shall broker requests from mission partners by coordinating Authorization To Connect (ATC) and Interconnection Security Agreement (ISA) or similar instruments, through government-defined processes. Where required, coordinate and update mission partner project folders with required artifacts to substantiate a body of evidence in support in risk determination.

6.3.6 Subtask 6 – Apply Access Control. The Contractor shall employ approved methods to regulate utilization of system resources with Identification, Credentialing, Authentication, and Authorization (ICAM) required to maintain security. Aspects of control will be applied to account provisioning, permissions and behavior as orchestrated with Active Directory, Multi-Factor Authentication, Public Key Infrastructure techniques, and Symmetric Keys.

6.3.7 Subtask 7 – Vulnerability Management. The Contractor shall find and fix security weaknesses in the CFBLNet architecture to include incorporating Security Technical Information Guides (STIGs) and Information Assurance Vulnerability Alerts (IAVAs) to applicable equipment and recording status in eMASS. Tasks will be performed following amplification guidance from the government-appointed Information System Security Manager (ISSM) and include asset discovery, vulnerability scanning, and risk prioritization as well as required reporting to the ISSM or other directed authority.

6.3.8 Subtask 8 – Integration and Coordination. The Contractor shall review and execute mandated tasks associated with CyberSecurity Orders published by higher authority. Tasks may include integrating compliance requirements for client-server, peer-to-peer, or externally hosted enterprises, responding to data calls that enumerate the scope of risk or the configurations of cryptographic devices. When necessary, any changes, whether directed or resulting from new requirements, will be documented in a Security Impact Assessment (SIA) to account for risk assessment. SIAs will be provided to the ISSM.

6.3.9 Subtask 9 – Supplemental Functions. The Contractor shall support mandated CyberSecurity Service Provider (CSSP) requirements, working with certified authorities to configure associated sensors, processes, and logging within the monitored architecture.

6.3.10 Subtask 10 – Physical Security. The Contractor will adhere to facility provisions established by hosting environment policy. All resources will be secured appropriately, with technical information and hardware protected by locking containers.

6.3.11 Subtask 11 – Support and Reporting. The Contractor shall execute tactical, continuous monitoring and technical assessment of the CFBLNet environment.

Deliverables:

6.4 Task 4 - Operations.

The Contractor shall provide operations support for CFBLNet Initiatives, pilot activities, remote site coordination, and communities of interest (COIs).

For customer sites, the contractor shall assist with guiding customers to connect to CFBLNet via the Common Mission Network Transport (CMNT).

Also, the Contractor shall coordinate and integrate new customer and PAE-owned network sites and provide assistance and operations services for the sites.

Maintain a Concept of Operations (CONOP) with coverage addressing all mission requirements needed to support the planning and execution of CFBLNet Initiatives. Perform day-to-day activities to ensure the availability, use, and status reporting of systems and services are current and accurate, supporting mission needs. Assist customers and affiliates with Tier 2 and 3 support as requested or required. Ensure all system Resiliency factors (Power, Failover, Backups and Storage, Continuity of Operations) remain functional and available. Establish comprehensive Monitoring of all facets of the CFBLNet Point of Presence and interconnected sites leveraging Security Information and Event Management software to continuously poll status, respond to notifications, log all related conditions, fuse data and logs for Cybersecurity Service Provider (CSSP) consumption, analysis, and response recommendations/actions. Ensure system or remote customer activities do not produce unintentional harmful impact on other customers or system capabilities. Resolve conditions locally or assist external customers with configuration issues that prevent execution of CFBLNet Initiatives. Conduct analysis, isolation and coordination of corrective action for communications-related problems while concurrently providing status reporting to government stakeholders on initial, interim, and final conclusions as services are restored to full operational capacity. Collect and assess performance statistics to validate systems and services functionality in conjunction with communications and processing problems to identify and report capacity requirements, opportunities, and impactful trends. Metrics will conform to industry standards and processing definitions.

6.4.1 Subtask 1 – Service Management – Calls, Notifications, Ticketing, Updating, (Customer Support), Technical Support. The Contractor shall support Core and Provisioned Services. Functionality derived can be either essential to the architecture and administration of the capability or provisioned/hosted for enhancing the utility of CFBLNet. Core services include those for transport (multicast, unicast, Network Time, Network Address Translation, vProvider), IT Management (user account management, directory services, domain name services, search, storage, ticketing), Information Sharing (standard data types) and status dissemination. Provisioned services include those for Collaboration (Chat, VoIP, email, Wiki) and Support (monitoring, break/fix, Q&A). Other considerations, such as Video Tele-Conferencing (VTC) and accommodation of Full Motion (FMV) are non-standard provision-able services and addressed on a justifiable, case-by-case basis and subject to collection of metrics for managing capacity thresholds.

The Contractor shall provide exclusive, dedicated Level 2 and 3 helpdesk services. Help desk services shall be available to support pilot services, demonstrations, CFBLNet remote sites, and CFBLNet enclaves. All trouble calls shall be logged and tracked through resolution. The Contractor shall produce a monthly Trouble Ticket Report.

6.4.2 Subtask 2 – Perform Data Storage Functions – Backup, Storage, Provisioning, Logs. The Contractor shall assure performance optimization by leveraging fine-tuned virtualization to manage the handling of data while it is transiting the infrastructure, as well as securing and preserving technical information necessary to manage system components. This requires associating resource pools to components, continuous monitoring of capacity utilization, adjusting permissions, and scheduling automated processes to create backup copies of data for recovery purposes. Essential to this activity is the collection of logs from components and configured services to enable analysis of system functionality and security.

6.4.3 Subtask 3 – Requirements – Customer, Internal, Compliance. The Contractor shall support the processing of formal requirements, regardless of the avenue of onboarding. A common template will be leveraged to document the key parameters of operational needs presented or may be detailed in Orders, Directives, or published Policy. Actions required to support requirement processing will include reviewing specifications or associated use cases, compiling cost estimates from authorized purchasing vehicles and authorized sources, making recommendations to facilitate the established outcome, providing scheduling forecasts, and obtaining final government approval to execute.

6.4.4 Subtask 4 – Fault Isolation and Resolution – Identify, Assess, Resolve. The Contractor shall identify, assess, and resolve automation and information technology hardware and software issues and problems for all routing and computing components comprising the architecture of the CFBLNet configuration. Faults or baseline deviations may be discovered during routine component checks, configuration changes, reported by monitoring tools, or reported by mission partners. Use industry best practices to perform root cause analysis to ensure corrective actions are applied at the appropriate level.

6.4.5 Subtask 5 – Monitoring. The Contractor will surveil systems operation and component performance predominantly using automated agents and centralized logging. Agents will be configured to create alerts to assist maintainers with identification of trouble sources. For significant indications, filtered from routine journal records, up-channel reporting requirements can be expected.

6.4.6 Subtask 6 – Status Reporting. The Contractor shall support status reporting of CFBLNet execution activities. The contractor’s reporting responsibilities will support the following tasks:

a. Initiative Processing. Advise the US Country Lead Representative of the introduction of new or revised submissions, approvals, schedules, issues, and execution of defining CFBLNet Initiative Information Packs (CIIP). For tasks impacting cybersecurity or technical configurations, ensure that appropriate intra-team coordination is asserted. Facilitate Weekly synchronization sessions with the Initiatives WG Chair.

b. Connection Approvals and Site Authorizations. As updates or changes are approved, ensure appropriate government stakeholders are informed. New Authorizing Official risk decisions (Authorization To Connect, Authorization To Disconnect), Multi-National Security Accreditation Board endorsements (Site/Initiative National Accreditation Endorsement Certificates, S-NAEC/I-NAEC) or Local Authority determinations (Authorization To Operate, Cross-Domain System Approval, etc.) are representations.

c. Authorized Service Interruptions. For internally driven events, ensure prior scheduling approval with appropriate government stakeholders. For externally driven events, assess potential impacts and provide event parameters, possible issues, and any necessary preventive actions needed to de-conflict operational effects.

d. Service or Interconnection Impairments. For any circumstances leading to unexpected availability impairments, whether shared services or Mission Partner connectivity, initiate reporting via Situational Reporting (SITREP) to appropriate government stakeholders and designated Network Control Center sources. Where possible, provide After Action Reporting of the causes of any outage detected.

e. Changes to Key Governance Documents. Upon coordination of approved changes to the Technical Arrangement/Charter, Strategic Plan, Manual, Guide, CONOP, etc., ensure the updates and impact are advised to government stakeholders.

Deliverables:

6.5 Task 5 – Program Support.

The Contractor shall synchronize with various affiliate organizational elements on collaborative activities.

Perform logistics, coordinate COMSEC/CCI requirements and resource accountability with associate elements, synchronize facility requirements, and organize work assignments with consideration for authorities and responsibilities.

Maintain required web content on provisioned platforms. More complex support such as design or administration of web services is not anticipated; however, some coordination and support may be required during performance. Should this additional support be required, the Government may consider execution of surge to incorporate those requirements into the appropriate tasks/sub-tasks, under “as directed” conditions.

Compliance with DoW/DoD accountability and reporting requirements will be rigorously adhered to.

6.5.1 Subtask 1 – Coordinate Logistics (shipping/receiving). The Contractor shall provide asset procurement (order, staging, and delivery), logistics (coordination, accountability, inventory, control, tracking, disposition, and reporting), and related automated data processing equipment (ADPE) management support.

“As directed (surge),” the Contractor shall procure all assets necessary to execute this PWS including (but not limited to) hardware, software, licenses, warranties, and support agreements. Preparation of actions under these conditions will include Rough Order of Magnitude (ROMs), Requested Items of Purchase (RIPs) and the proper management of the documentation and tracking activities for this process.

The Contractor shall follow established Warehouse processes coordinating with staff to address dependencies for controlling items and scheduling transfers.

The Contractor shall maximize the use of existing resources and maintain an approved, rotating inventory of spare parts for operational readiness and minimize new procurements.

The Contractor shall support shipping and receiving equipment and supplies purchased by DISA and/or CFBLNet customers to support site installations, repairs, upgrades and stocking (storage and tracking) at authorized levels for spare hardware and supply items.

The Contractor shall support chain of custody and electronic tracking of all accountable resources in the designated inventory control system until final disposition through signature transfer, IAW Government directive.

The Contractor shall submit Integrated Master Schedule (IMS) updates that describe the progress and any approved changes to the baseline schedule.

6.5.2 Subtask 2 – Assist COMSEC/CCI. The Contractor shall requisition COMSEC equipment as needed and coordinate with the DISA JITC Lab COMSEC custodian for configuration, implementation and maintenance as well as obtain and employ appropriate keying material in support of the CFBLNet Point of Presence.

6.5.3 Subtask 3 – Assist Hardware Accountability. The Contractor shall coordinate with designated property custodians to comply with inventory control requirements and processes requiring physical access to assigned components. Property custodians will, at a minimum, require access to equipment to complete annual and spot inspections. Onboarding of new components will require substantiation documents with invoices and/or shipping forms correlating unique serial numbers and assigned Unit Identification Code (UIC) per component. Offloading components also requires substantiation documents, with per item accountability detailed to property custodians to remove items from the controlled inventory. Continuous accountability and chain-of-custody must be maintained at all times for controlled items.

6.5.4 Subtask 4 – Assist…