SOO FTEL SCIF Network MLS v4.docx

STATEMENT OF OBJECTIVES

FOR

Flight Test Engineering Lab (FTEL) SCIF Network Multi-Level Security (MLS) System Version 4 FTEL, Building 2710, Edwards AFB 9 April 2025

Table of Contents

SOO FTEL Network MLS v4

1.0 INTRODUCTION

The 412th Test Wing installed a state-of-the-art Flight Test Engineering Lab (FTEL) on Edwards AFB in 2024. The FTEL is designed to improve the testing and integration of critical systems in the areas of Electro Optics/Infrared (EO/IR) sensors, long-range kill chain data link capabilities, and the development of digital twin tools that accelerate the creation of future combat capabilities. This new facility will enable the Air Force to push the boundaries of modern warfare, ensuring the U.S. maintains its technological edge.

This requirement is being established to populate a new a comprehensive network design to meet the customer's leveraged requirements for 18 different networks all while reducing physical footprint, power consumption, cooling and manpower workload.

2.0 PURPOSE

This Statement of Objectives (SOO) for a firm-fixed-price (FFP) contract defines the scope of work to be performed in support of a Trusted Thin Client (TTC) topology implementation for the 412 Test Engineering Group (TENG), FTEL Sensitive Compartmented Information Facility (SCIF), Building 2710. The scope of this project is to provide network multi-level security, for the new 20,000 square foot SCIF of the FTEL building at Edwards Air Force Base, CA.

3.0 SCOPE

The vendor shall provide all labor, travel, materials, tools, equipment, vehicles, facilities, supervision, other items and support necessary to execute this contract. The technical scope of work is described as follows:

· System Design and Procurement - The objectives of these requirements are to design the MLS system and acquire all hardware and software required for the integrated solution.

· System Installation, Training, and Turn-over - The objective of this requirement is to install and configure the integrated solution, provide on-site training for Edwards AFB staff, and ensure a smooth transition and turn-over for operations.

· Assist with Certification per the System Design - The objective for this requirement is to provide initial documentation for the assessment and authorization of the integrated solution to meet the "Raise the Bar" security requirements.

3.1 Description

The 412 TENG FTEL requires a multi-level security (MLS) system. The EverFox ForcePoint distribution console will be the focal point of the integrated solution and with the implementation of the Trusted Thin Client (TTC) multilevel access solution. This system shall support access to six (6) Top Secret and Below Interoperability (TSABI) networks for up to a threshold of fifty (50) users.

The system shall be designed to provide access to a centralized Virtual Desktop Infrastructure. This complies with the Industry "Zero Trust" architecture and is approved by the NSA to allow access to multiple differing classification networks concurrently. Zero Trust moves the security boundary from the endpoint (user workstation) to a centralized Virtual Desktop Infrastructure. There is zero compute, storage or Operating System at the endpoint, removing endpoint vulnerabilities. This also allows a dynamic reappropriation of network access based on what the room is classified at, who is in the room, and which room one is in.

Technical Summary:

· TTC shall be configured to provide connectivity to virtual applications or desktops hosted within a virtualized environment (e.g. Virtual Desktop Infrastructure) located on each network.

· The vendor shall provide installation, training, and assessment and authorization (A&A) support for a threshold of two (2) TTC servers at Edwards AFB, California.

Hardware/Software Summary:

· A threshold of two (2) Distribution Console (DC) servers should be included with this effort.

The data networks shall be at least 10 Gb Ethernet, with each DC server having a threshold of six (6) quad port and two (2) dual port 10 Gb fiber NICs (includes SR SFPs with LC connectors).

The vendor shall supply Trusted Thin Clients (TTCs), Forcepoint distribution consoles, and Forcepoint Management console and the vendor shall supply the administrative workstation.

The vendor shall provide software, software licenses, and configurations in support of this contract effort.

3.2 Tasks

The following tasks shall be performed by the vendor as outlined:

3.2.1 Technical Project Management (oversight, resourcing, budgeting, scheduling, meetings, risk mitigation)

3.2.2 Conduct kickoff and site survey for the TTC implementation.

3.2.3 Pre-Onsite Engineering Support:

· Perform system architecture/design and technical risk mitigation for TTC

· Develop the appropriate configuration for the deployment

· Create System Design Document (SDD) to include TTC design and configuration information

· Conduct Design reviews:

· System Requirements Review (SRR)

· Preliminary Design Review (PDR)

· Critical Design Review (CDR)

3.2.4 Pre-Onsite Support:

· Support customer discussions on coordination, schedule, and Body of Evidence (BoE) expectations.

· Complete a System Security Plan (SSP) and Security Controls Traceability Matrix (SCTM) based on Government-supplied document template for TTC

· Update/modify Site-Based Security Assessment (SBSA), based on Government-supplied document template, tests for TTC

3.2.5 Acquisition:

· Hardware, Software, Software licenses, Acquisition per a government approved design.

3.2.6 Onsite Implementation Support – at Edwards AFB, California:

· Onsite implementation support includes one or more vendor engineer for up to two (2) weeks.

· Deployment of the TTC solution

· Install and configure two (2) TTC Distribution Consoles (DCs)

· Integrate the TTC solution with existing customer provided enterprise support that may include NTP, SSH, SMTP

· Integrate the TTC solution with network infrastructure

· Integrate the TTC cluster with VDI system on each network enclave

· Support the deployment of eighty (80) TTC endpoints for functional testing purposes

· Configure TTC to transfer log and audit files to external log servers

· Perform functional end-to-end testing

3.2.7 Onsite Test Support – at Edwards AFB, California:

· Onsite test support includes two (2) vendor engineers for up to one (1) week

· Assist site in performing TTC SBSA dry-runs and official TTC SBSA testing

· Assist site in creating TTC SBSA Report and Plan of Action and Milestones (POA&M) findings, if necessary

3.2.8 On-site Training Support:

· Provide system administrator training for up to a threshold of five (5) planned TTC Administrators

· Training shall take place in an unclassified meeting room available to both the vendor instructor(s) and Customer engineers. The location shall be on-site. This class is a blend of classroom and hands-on training that provides an understanding of:

· The operational and security features of the TTC prior to operational transition

· Implementation, configuration, and maintenance activities in a simulated operational environment

· The vendor and the Customer shall agree on a schedule prior to the training event. Training is conducted by one engineer for up to one week

3.2.9 Verification and Validation:

· Vendor shall verify and validate that all on-site support has been accomplished and that transition to FTEL Support Team is viable.

· Vendor supplied on-site personnel working on documentation must hold current and active security clearances with SCI briefs.

· Vendor shall provide documentation and BoE for an ATO Package:

· SSP/SCTM

· BoE:

· Hardware/Software list

· POA&M

· STIG Checklists

· PPSM

· Letters of Volatility/Sanitization Procedures

· Vendor shall test and validate functionality of eighty (80) TTC’s to the Distribution Consoles.

3.2.10 Project Closeout:

· Update and deliver final revision of SDD

· Version descriptions of hardware and software at turn-over.

3.3 Deliverables

3.3.1 Hardware:

The vendor shall Plan, Design, Install, Test, and Provide Training and Documentation for installing networking devices using these specific COTS items, all TAA compliant:

· Cisco Catalyst 9500 and 9300 switches

· Juniper SRX1500 routers

· Everfox Forcepoint Distribution Consoles

· 10zig Trusted Thin Clients with fiber NICs, 32GB RAM

· 34” curved Displays and ancillary components (keyboards, mice, cabling, etc.)

· APC NetShelter 42U SX Gen 2 server rack with sides #AR3100B2

· APC Smart-UPS SRT 19-inch Rail kit #SRTRK2

· APC Smart-UPS SRT 192V 5kVa and 6kVa Battery Pack #SRT192BPUS

· APC Smart-UPS On-Line SRT5KRMXLTUS

· APC Smart-UPS SRT Extension cable #SRT002

· APC Rack PDU 2G #AP8459NA3

1.

2.

3.

3.3.2 Data:

Document ID# DI-MISC-82104

Document ID# DI-IPSC-81432

Critical Design Review (CDR) System Requirements Review (SRR) Document ID# DI-MISC-80652, with tailoring to N/A DID para.7.2 and 7.3, 10.2 e-format is acceptable.

Document ID# DI-MGMT-82395 (excluding sections 3.h, 3.i, 3.j, 3.l, 3m)

Document ID# DI-MGMT-82395 (3.g)

Document ID# DI-QCIC-80553A Acceptance Test Report

Document ID# DI-SESS-81697

Document ID# DI-MGMT-82192

Document ID# DI-MGMT-80368

Document ID# DI-SESS-81248

The vendor shall provide data, documentation, and reports regarding the contract effort.

3.3.2.2 Licenses.

3.3.2.2.1 Vendor shall provide a list of all procured software licenses and transfer ownership to the Government.

3.3.2.6 System Engineering Documentation.

System requirements reviews (SRR), preliminary design reviews (PDR), critical design reviews (CDR), technical interchange meetings, meeting minutes, prototyping and fabrication, component and system testing, verification and validation testing, and other technical reviews and technical activities shall be documented and reported, consistent with system engineering best practices and task requirements.

Acceptance Test Procedures (ATP) and Acceptance Test Reports (ATR) shall be provided.

Performance compliance shall be demonstrated by successful completion of the applicable unit and system.

Cybersecurity Documentation. The vendor shall support Government cybersecurity determination(s). The vendor shall provide product Supply Chain integrity documentation (hardware and software), Software Version Descriptions (SVD), Interface Control Documents (ICD), computer system design descriptions, data flow descriptions, computer system vulnerability analysis results, computer system vulnerability testing results, data system volatility/non- volatility documentation, and other data for their system as necessary.

4.0 General Requirements

4.1 Transition

The vendor shall ensure the transition occur once the FTEL Support Team is considered fluent in all hardware and software configurations necessary to maintain an 100% operational solution. Transition also requires all appropriate account accesses to hardware and software for full operations

4.2 Travel

The vendor shall include within their proposal, travel costs associated with performance of orders. Proposed travel shall be validated and approved IAW FAR Part 31 by the CO prior to issuance of the order.

4.3 Government Furnished Support

4.3.1 Government Furnished Property.

No GFP will be provided or required as part of this effort.

4.3.2 Government Facilities/Support.

For this effort, the Government will not be required to furnish office workstation space and/or access to a telephone and computer at Edwards AFB CA.

4.3.3 Government Furnished Information.

As required, the Government shall provide necessary GFI to the vendor within an appropriate timeframe to complete the tasks. GFI includes the documentation templates for cybersecurity reviews and any relevant information to complete the documentation.

4.4 General Information

4.4.1 Contractor Points of Contact:

4.4.1.1 Contract Administrative Point of Contact. The vendor shall provide a person to be lead point of contact for overall administration of this contract and the orders issued. The vendor shall provide the person’s name, address, telephone number, email address, and other contact information to allow for prompt contact and response. The name shall be updated promptly in the event of a change in personnel.

4.4.1.2 Contract Technical Point of Contact. The vendor shall provide a person to be lead point of contact for overall technical concerns arising from the products or support offered on this contract and the delivery orders created under it. The vendor shall provide the person’s name, address, telephone number, email address, and other contact information to allow for prompt contact and response. The name shall be updated promptly in the event of a change in personnel.

4.4.2 Security Requirements:

4.4.2.1 Vendors shall comply with all base security regulations and with actions dictated by Force Protection Condition (FPCON) changes/measures and/or Health Protection Condition (HPCON) changes/measures. For real-world situations/exercises, changes to force/health protection conditions could impact vendor performance of work and can include denial of access to the installation to perform work.

4.4.2.2 Vendor employees are prohibited from possessing weapons, firearms or ammunition, on themselves or within contractor-owned or privately owned vehicle while on Edwards Air Force Base.

4.4.2.3 shall report suspicious activity (refer to Edwards AFB Contractor Antiterrorism Awareness pamphlet) to Security Forces at 661-277-3340 in a timely manner.

4.4.2.4 Base passes will be limited to the length of the contract not to exceed 3 years from the date the AFMC Form 496 is submitted to the Contracting Office for signature.

4.4.2.5 The AFMC Form 496 will be reviewed/approved by the CO, then taken by the contractor employee to the Edwards AFB Pass & Registration Office in Building 3000 for the security portion and issuance of the Base pass.

4.4.2.6 The vendor shall comply with all base security regulations. Additionally, the vendor shall comply with actions dictated by force protection condition (FPCON) changes/measures and/or health protection condition (HPCON) changes/measures. For real-world situations/exercises, changes to force/health protection conditions could impact vendor performance of work and can include denial of access to the installation to perform work. Only employees who will be working on the contract consistently/frequently should be submitted for a long-term Base pass.

4.4.2.7 The vendor shall comply with all security requirements imposed by the Installation. Specific security considerations will be handled on an individual Task Order/contract basis as required.

4.4.2.8 The vendor shall report suspicious activity (refer to Edwards AFB Vendor Antiterrorism Awareness pamphlet) to Security Forces at 661-277-3340 in a timely manner.

4.4.2.9 The vendor and its employees shall comply with all base traffic regulations.

4.4.2.10 No States are subject to Real ID Act enforcement at this time. The Department of Defense will accept standard State-issued driver's licenses and identification cards from all U.S. States and territories as proof of identity. Please visit the Department of Homeland Security's (DHS) website to get the latest information, https://www.dhs.gov/current-status-states-territories.

4.4.2.11 Vendor personnel who require routine physical access to the installation shall comply with Level I - Antiterrorism Awareness training requirements. Routine physical access applies to vendor personnel whose contract, performance work statement/statement of work has a 45 day or more period of performance. AT Level I training provides vendor employees with the requisite knowledge necessary to remain vigilant for possible terrorist threats. AT Level I training can be taken at https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf for non-Common Access Card (CAC) holders. CAC holders may complete AT Level I training (Force Protection course) via myLearning at https://lms-jets.cce.af.mil/moodle/. AT Level I training will be completed by all contractor personnel within 30 days of requiring access and annually thereafter. Tracking for each contractor or sub-contractor employee is the responsibility of the COR or unit Antiterrorism Representative.

4.4.2.12 The vendor shall be responsible for safeguarding all government property, equipment and materials provided for vendor use. At the end of each work period, all government facilities, equipment, and materials shall be secured.

4.4.2.13 During performance of the contract, the vendor shall be responsible for obtaining required identification for newly assigned personnel.

4.4.2.14 The vendor shall be responsible for prompt return of credentials and vehicle passes for: 1) any employee who no longer requires access to the work site; 2) upon request by a CO; and 3) upon completion or termination of the contract. The Prime contractor shall ensure that all Base identification passes issued to employees and sub-contractor employees are returned to the issuing office. Failure to comply with these requirements may result in withholding of payment.

4.4.2.15 Vendor employees are prohibited from possessing weapons, firearms or ammunition, on themselves or within contractor-owned or privately owned vehicle while on Edwards AFB.

4.4.5 Environmental Protection.

The vendor shall comply with all applicable Federal, state and local laws, regulations and standards that are or may become applicable to contractor’s activities in performance of this SOO.

4.4.6 Safety and Health Requirements:

4.4.6.1 It is the vendor's responsibility to ensure its employees and managers have a comprehensive understanding of OSHA requirements. Detailed information is available on the OSHA website at http://www.osha.gov. Vendors are responsible for complying with federal and state occupational safety and health standards for their employees, except where the Air Force contractually agreed to assume responsibility.

4.4.6.2 Mishap Reporting. The vendor shall promptly report pertinent facts to the Government Program Office (GPO) regarding mishaps involving government personnel or property, on or off the Air Force Installation, incidental to work performed IAW DAFI 91-204, Safety Investigation and Hazard Reporting. Direct costs related to the mishap shall be separated from other cost and provided to the GPO and Safety Investigators.

4.4.6.3 The vendor is responsible for establishing requirements for all sub-contractors who qualify as sub-contractors under the resulting contract.

5.0 ACRONYMS & DEFINITIONS

SOO

SSH

Statement of Objectives Secure Shell