REVISED_PDS Systems_PWS (002).pdf

PERFORMANCE WORK

STATEMENT FOR

Protected Distribution System (PDS) Periodic Testing/Data Shutoff Unit

AT

Air National Guard Readiness Center, Joint Base Andrews, MD 15 January 2025

PERFORMANCE-BASED WORK STATEMENT

TABLE OF CONTENTS

SECTION PAGE

1 DESCRIPTION OF SERVICES

2 GENERAL INFORMATION

3 SERVICES SUMMARY ............................................................ Error! Bookmark not defined.

4 GOVERNMENT FURNISHED PROPERTY (GFP) AND SERVICES

1 DESCRIPTION OF SERVICES: The Air National Guard Readiness Center (ANGRC) CCYC has a requirement for CyberSecure IPS devices, specifically (3) Opti-Guard M4 units, (1) 8-port, single-mode Stoplight™. This solution must be centrally managed and integrated with the existing CyberSecure IMS solution. The current PDS has (2) end-of-life devices that will be replaced with CyberSecure IPS Opti-Guard M4 units, along with a CyberSecure IPS 8-port, Single-mode Stoplight to ensure with the CNSSI 7003 and CORA standards. If a different periodic testing/data shutoff unit other than CyberSecure IPS Stoplight™ is purchased it shall meet salient characteristics in this purchase description.

The ANGRC currently has a PDS built by Network Integrity Systems, Inc. This PDS is fitted with two (2) end of life units with associated software that have provided secure network access. The PDS is to deter, detect and/or make physical access to the communication lines carrying national security information difficult. A specification called the National Security Telecommunications and Information Systems Security Instruction (NSTISSI) 7003 was issued in December 1996 by the Committee on National Security Systems. [1] Approval authority, standards, and guidance for the design, installation, and maintenance for PDS are provided by NSTISSI 7003 to U.S.

government departments and agencies and their contractors and vendors. This instruction describes the requirements for all PDS installations within the U.S. and for low and medium threat locations outside the U.S. PDS is commonly used to protect SIPRNet and JWICS networks.

The PDS solution is a fully compliant NSTISSI 7003 and AFSSI 7703 Communications Security:

Protective Distribution Systems (PDS) and Authority to Operate (ATO) in networks carrying data up to the TS/SCI level including SIPRNet, and in high threat level environments.

The replacement of the end-of-life units with Opti-Guards and StopLight software/hardware is designed to integrate and to be centrally managed with the existing CyberSecure IMS to protect fiber optic networks that aren’t manned all hours of the day. The sensor within StopLight instantly suspends data flow through fiber using a micro-optical shutter, preventing the interception of data during any breach.

1.1 SPECIFIC REQUIREMENTS: The contractor shall provide, CyberSecure IPS Stoplight™ management hardware and software or equal involving periodic testing/data shutoff unit, cabling and associated software and configuration be completed within 90 calendar days from date of contract award.

1.1.1 The contractor shall install one (1) CyberSecure Stoplight™ or equal located at the ANGRC, Bldg. 3500, Andrew AFB MD utilizing as much of the current infrastructure as possible.

1.1.2 The contractor shall perform the following: (2) Opti-Guard M4 units will be installed and commissioned. (1) Opti-Guard M4 unit will be utilized as a spare (1) 8-port, single-mode Stoplight will be installed and commissioned with the Opti-Guards. All three devices should be managed by the CyberSecure IPS IMS or equal for periodic testing of ANGRC’s PDS zones and support automated data shutoff on PDS alarm.

1.1.3 The contractor shall provide CyberSecure IPS device, specifically (3) Opti-Guard M4 units, (12) Off-Ramps and (1) 8-port, single-mode Stoplight. This solution must be centrally managed and integrated with the existing IMS solution.

1.1.4 The contractor shall provide a support contract for the basis of 12 months, with the option to renewal for four additional years. The contract will provide support for CyberSecure Opti- Guard and StopLight devices.

1.2 SOFTWARE REQUIREMENTS: The technical management software can give two (2) Network CyberSecure Opti-Guard units with associated software to provide secure network protection. This system’s requirement aligns with Section VIII of the CNSSI 7003 in protecting secure fiber optic networks. The system effectively complies with section 19 of AFI 7703 using the existing infrastructure to provide the most cost-effective way to provide the required protection. If a contractor shall provide a different periodic testing/data shutoff unit it must meet the following characteristics:

1.2.1. Optical advancements

Designed for data infrastructure security Provides modular hardware scalable from 8 to 32 ports Provides support for both Single-mode and Multi-mode fiber optic cables Utilizes latching switch technology

1.2.2. Centralized Management

Supports CyberSecure IMS software integration Provides secure, software-controlled management of optical ports to facilitate automated testing of existing PDS zones.

Provides secure, software-controlled management of optical ports to facilitate shutoff of data.

1.2.3. Integrated Alarm Response Management

Integrates with existing ANGRC CyberSecure IMS Infrastructure Management System to support automated and scheduled testing of existing PDS zones.

1.2.4. Automated Testing

Provides integration with CyberSecure IMS to support the creation of scheduled testing by zone(s)

1.2.5. Data Shutoff Capabilities

Provides integration with CyberSecure IMS to support automated data shutoff during PDS alarm of specified fiber optic communications by zone(s).

1.3. Telephone Support will include: The contractor shall provide Call Center Technical Support − Telephone support shall provide technical assistance with diagnosis of defects or failures in the CyberSecure Stoplight hardware and operational software (“products”) to conform to published documentation.

1.4. Applicable Publications: Reference: AFSSI 7703 Communications Security: Protective

Distribution Systems (PDS). National Security Telecommunications and Information Systems Security Instruction (NSTISSI) 7003 was issued in December 1996 by the Committee on National Security Systems.

DISA STIG: Traditional Security v1r2. CNSSI 7003

1.5. Special Asset Tagging: The contractor shall provide special asset tags IAW MIL STD- 130, DODI 8320.04, Item Unique Identification (IUID) Standards for Tangible Personal Property and DFARS 252.211-7703, Item Identification and Valuation. The current list of accepted unique item identifier types is maintained at http://www.acq.osd.mil/dpap/pdi/uid/uii_types.html.

All DoD recognized unique identification equivalents are listed at http://www.acq.osd.mil/dpap/pdi/uid/iuid_equivalents.html.

1.6. Energy Star Mandate: The contractor shall ensure the product meets Energy Star guidelines

1.7. IPV6 Mandate: The contractor shall ensure the product meets IPV6 capabilities per UCR 2013 and certified by the DoDIN Approved Products List

(https://aplits.disa.mil/processAPList.action).

1.8. Unified Capabilities (UCR) 2013 Mandate: The Contractor shall provide UC approved products. The DoDIN Approved Products List is a consolidated list of products that have completed interoperability and information assurance certification and is managed by Defense

Information Systems Agency (DISA).

1.9. BIOS Mandate: Per DoD CIO, the contractor shall ensure that all x86 and x64 laptops and desktops are BIOS protection compliant IAW Section 3.1 of NIST Special Publication 800- 147 (BIOS Protection Guidelines).

1.10. Trusted Platform Module (TPM) Mandate: In accordance with DoDI 8500.01, computer assets will include a Trusted Platform Module (TPM) version 2.0 or higher. TPMs must be in conformance with Trusted Computing Group (http://www.trustedcomputinggroup.org) standards and ISO/IEC 11889-1:2009 through ISO/IEC 11889-4:2009.

1.11. Common Criteria Evaluation & Validation Scheme Mandate: The contractor shall ensure that products used to protect information on National Security Systems are certified by the NIAP/CCEVS approved product list.

1.12. TEMPEST Program Mandates: The contractor shall provide TEMPEST products certified by the NSA TEMPEST Program. Visit the NSA Information Assurance site for more information.

1.13. Software Tagging Mandate: The contractor shall ensure COTS software items support International Standard for Software Tagging and Identification, ISO/IEC 19770-2, Software Tags when designated as mandatory by the standard. Further guidance can be found at:

http://tagvault.org/.

1.14. Applicable Applications: AFSSI 7703 Communications Security: Protective Distribution Systems (PDS). National Security Telecommunications and Information Systems Security Instruction (NSTISSI) 7003 was issued in December 1996 by the Committee on National Security Systems. DISA

STIG: Traditional Security v1r2. CNSSI 7003

2 GENERAL INFORMATION:

2.1 HOURS OF OPERATION: The contractor shall perform the services required under this contract during the following hours: 6:00 A.M. - 6:00 P.M., Monday through Friday excluding Federal holidays. Federal holidays include; New Year’s Day, Labor Day, Martin Luther King Day, Columbus Day, Presidents Day, Veterans Day, Memorial Day, Thanksgiving Day, Independence Day, and Christmas Day. Any holiday rescheduling shall be at no additional cost to the government and shall not be the basis for non-performance.

2.2 Security Requirements: All personnel employed by the contractor in the performance of this contract, or any representative of the contractor entering the government installation, shall abide by all security regulations of the installation. The contractor shall be responsible for the action of any of their subcontractors and their employees who are working on JBA. The contractor and subcontractor shall hire U.S. citizen(s) that are in possession of a valid State driver’s license and birth certificate. If the employee is not a U.S. citizen, the contractor and/or subcontractor may hire non-U.S. citizens if they are in possession of a Green Card, Social Security Card, Resident Card, Work Visa, and State issued Identification Card. If driving on base a State issued driver’s license is required. The Contractor shall ensure the pass and identification items required for contract performance are obtained for employees and non-government owned vehicles.

2.3 WEAPONS. Weapons of any sort are not authorized on JBA, this includes guns, knives, swords, nunchucks, brass knuckles, or any other weapon that has a sole purpose to injure or maim. Combination tools such as Leatherman and small pocketknives with folding blades less than four inches are authorized if used in the performance of duty. Those found in violation of this directive are subject to apprehension, criminal charges, and debarment from the installation.

2.4 ILLEGAL CONTROLLED SUBSTANCE: The U.S. Federal government is the most vocal opponent of the drug industry and it has set the de facto international standards regarding the legality and illegality of different drugs. Illegal controlled substance and narcotics are not authorized on JBA whatsoever. Controlled substances shall not be transported on the installation via vehicle or on an individual person. Marijuana/cannabis, cocaine, crack cocaine, LSD, methamphetamine (meth), heroin, anabolic steroids, psilocybin mushrooms, are some of the forbidden substances (this list is not all-inclusive). Prescription medications are authorized for the person the medication is issued; however, the medication must not be expired, and the label must clearly indicate the name of the person the medication is issued to. Otherwise, prescription medication may be deemed illegal by law enforcement officials. Those found in violation of this directive are subject to apprehension, criminal charges, and debarment from the installation.

2.5 CONTINUATION OF ESSENTIAL DEPARTMENT OF DEFENSE (DOD)

CONTRACTOR SERVICES DURING CRISIS. In the event the contractor is unable to perform his daily operations due to peacetime emergency and/or wartime contingency disturbances, etc., neither the Government nor the contractor shall take action for non-compliance with contract requirements. Upon notification by the CO, the contractor shall perform emergency and special event services, contingencies, operational readiness exercises or inspections. Emergency and special event services will be priced separately from routine services

2.6 GOVERNMENT REMEDIES. The CO shall follow FAR 52.212-4, Contract Terms and Conditions- Commercial Items (May 2015), for contractor’s failure to perform satisfactory services or failure to correct non-conforming services.

2.7 SPECIAL QUALIFICATIONS: To be authorized to install a PDS system, a vendor must have trained, certified, and authorized personnel to conduct the system's commissioning. This includes software installation and thorough testing of all endpoints to ensure the system operates in accordance with CNSSI 7003.

2.8 Additionally, the contractor/vendor performing the commissioning service must hold a DoD 8140 certification (formerly known as DoD 8570 IAT Level II), which includes a CompTIA Security+ or equivalent certification, and at a minimum, a Secret-level security clearance.

3 GOVERNMENT FURNISHED PROPERTY (GFP) AND SERVICES: The US Government will not provide any equipment, fuel, personnel, utilities or facilities to the contractor for the execution of this contract. Should an emergency arise, only the necessary basic lifesaving and life support measures will be provided during the emergency.