Attachment_10b_-_Task_Order_02-CAF_Development_and_Integration_Statement_of_Objectives.docx

FA4600-19-R-A001

Attachment 10b – Task Order 02-CAF Development and Integration Statement of Objectives

TECHNOLOGY APPLICATION DEVELOPMENT AND SUSTAINMENT (TADS)

TASK ORDER 02

CLOUD ANALYSIS AND FORECAST (CAF)

DEVELOPMENT AND INTEGRATION

STATEMENT OF OBJECTIVES

FA4600-19-R-A001

Attachment 10b 24 June 2019

FA4600-19-R-A001

Attachment 10b – Task Order 02-CAF Development and Integration Statement of Objectives

I. INTRODUCTION

CAF provides ingest, assimilation and display of geostationary and polar orbiting satellite data for both analysis and short-range forecasts with the primary function to create timely and accurate global cloud analyses and forecasts. CAF accomplishes this function through an algorithm suite that retrieves cloud information from satellite observations to create the Worldwide Merged Cloud Analysis (WWMCA). The Advect Cloud (ADVCLD) model then advects cloud elements from the analysis, using global model wind fields, to create a short-range 12-hour cloud forecast at 1-hour increments.

The vision of CAF is to transition towards a Numerical Weather Prediction (NWP) solution incorporated into an atmospheric model. Work to assimilate CAF analyses and inputs into model agnostic NWP with a focus on the Air Force GALWEM is currently under contract with NCAR. One primary purpose of this CAF Development as stated in this Statement of Objectives (SOO) is to begin the transition to NWP in support of the NCAR CAF work as well as to address near-term forecasting issues and to redefine what we currently perceive as being a “cloud” to allow for broader mission usability.

CAF will add new capability to derive microphysical properties across the cloud moisture spectrum and atmospheric optical properties, thus improving the accuracy and spatial resolution of the cloud analysis products. Furthermore, the long-term goal is for the CDFS-II baseline to sundown as various pieces are incorporated into other baselines dependent upon their needs as CAF heads towards its NWP approach to clouds and optical properties.

II. SCOPE

The offeror shall provide a Performance Work Statement in accordance with this SOO. This SOO shall provide the Government with the necessary services to continue and enhance current operations in a multiple enclave environment and allow for migration to a NWP based solution for radiance assimilation for clouds and optical properties. As progress is made towards an NWP solution there must be work done on current baselines to support that transition. New Data Assimilation techniques to help incorporate CAF output into the Air Force Weather (AFW) GALWEM model are needed to enhance short term forecasting abilities. A major component of this transition, and a growing need of the user community, requires a shift in the definition of what a “cloud” is and support will need to be included to allow for multiple definitions of the term. Work performed under this SOO will include contractor development activities in support of engineering analysis, software adaptation, system testing, verification and validation, and delivery of CAF software to the Government. It is intended to meet the purposes described in the Introduction above for subsequent implementation to production.

The intent under TADS is for the Contractor to stand up an instance in the Government provided Private Virtual Cloud (PVC) that is capable of running our operational baseline as well as select past baseline(s) for the purposes of case studies. In addition to this, the PVC instance should be utilized to archive a complete CAF input dataset for the purpose of a standard comparison between operational and developmental baselines so as to maintain a known benchmarked standard. Currently our OSE sandbox hardware is in constant use to archive data and run benchmarking and verification studies until a more specific case study is asked for by the Government. The plan going forward is that the Government will conduct its own benchmarking and verification only going to the Contractor for SME assistance and work on an on-demand basis.

The Contractor will be allowed access to use the current OSE Testbed hardware, but only from the physical location of Building 185 at Offutt AFB (due to inability of external connectivity for cyber security reasons). The Contractor is not required to use the OSE ‘and’ the PVC cloud sandbox instance, but at least one of them will be required and both may be utilized if the contractor wishes. The current plan is for the Government to continue utilization of the on-site OSE Testbed to continue the current benchmarking efforts that are in an ongoing status. If the Contractor wishes to utilize the on-site OSE then the request will be submitted and Government efforts will be paused to accommodate. If the Contractor utilizes the PVC instance for the testbed the Government may request occasional access to perform its own studies while the Contractor is not utilizing that instance.

III. OBJECTIVES

The objectives of this ensuing Task Order shall include all necessary services to provide the 557 WW the following capabilities:

· Integration and assimilation of various existing and next generation satellite sensor systems.

· Continuous improvement and/or development of cloud/optical property depiction, characterization, and forecasting algorithms.

· Error and deficiency identification, tracking, and developing a corrective plan of action

· Software development and testing of cloud screening applications on unclassified systems and data for potential incorporation to higher security enclave systems and data.

· Sandbox environment for use in studies, benchmarking, use case development, and prototype efforts.

· Updates in model outputs and properties to allow for multiple use cases and “cloud” definitions.

· Data Assimilation work geared towards atmospheric NWP integration and forecasting and all sky radiances.

· All training and documentation requested for maximum Government visibility and maintainability of software and science.

· Provide a first guess set of tunable parameters for the algorithm tuning mission with any science upgrade or addition of new sensors/channels.

IV. OPERATING CONSTRAINTS AND RISKS

· Funding profile for CAF has a ceiling of $13.41M for FY20 thru FY23.

· The 557 WW continuously develops the CDFS-II software baseline. As such, CAF releases are integrated into the next CDFS-II baseline that reasonably follows the CAF release. The 557 WW will provide the merged code post-integration.

· WWMCA production cannot degrade beyond defined WWMCA degrade rules.

V. CLIN STRUCTURE

The government anticipates the following CLIN structure:

X002 (CPFF) – Labor X006 (Cost Reimbursable) – Travel X016 (Cost Reimbursable) – Miscellaneous Direct Costs X008 (Not Separately Priced) - Data/CDRLs

VI. PERIOD OF PERFORMANCE

The period of performance is four years from contract award, comprised of a one-year base period and three one-year option periods.

VII. PLACE OF PERFORMACE

Development work has to be performed at the contractor’s facility.

VIII. GOVERNMENT FURNISHED PROPERTY/INFORMATION

There is no Government furnished property associated with this SOO. Government furnished information shall include all GALWEM or other chosen NWP Data Assimilation and output files as needed for development work.

The Government will provide a sandbox/OSE testbed environment using Amazon Web Services GovCloud. This will include the following tools:

· JIRA

· Trello

· Packer

· ANSIBLE

· Cloudformation

· Terraform

· Vormetric

· OpenSCAP

· CloudTrail

· Twistlock

· ClamAV

· AWS WAF

· Splunk

· Amazon Cloudwatch

· DISA HBSS, ACAS, & CSSP

· NeuVector

· Xacta 360

· Confluence

· Contrast Security

· ThreadFix

· Se

· Sonarqube

· Jenkins

· Artifactory

· Maven

· Git

IX. CONTRACTING OFFICER’S REPRESENTATIVE

In accordance with IDIQ clause 252.201-7000 – Contracting Officer’s Representative, the designated COR for this order will be provided at time of award.

Task Order COR: To Be Determined Email: To Be Determined Phone: DSN: 272-6869 Comm: 402-232-6869

X. SECURITY REQUIREMENTS

· Ensure software assurance IAW current law, policy and Government guidance.

· Provide a Secure Software Development Plan (SSDP) using a Secure Software Development Lifecycle model (S-SDLC) and the source code to complete software assurance.

· Assurance activities conducted during the development process should mitigate and minimize attacks (e.g. threat assessment and modeling, attack surface analysis, architecture and design reviews, application of static and dynamic code assessment tools and services, validation of 3rd party software/libraries, and penetration testing) that the information system is likely to face during operations.

· Update technical documents (i.e. Ports, Protocols and Services, administration, user, design, etc…) as necessary and as part of each development action.

· Ensure that software developed under this agreement does not compromise the security posture of the Air Force Weather Weapons System (AFWWS).

· All STIG/SRG findings, all ACAS findings, and all SAST/DAST findings introduced as part of, or resulting from development activities shall be considered deficiencies and compromises of the security posture of AFWWS.

· All open STIG/SRG findings and any SAST/DAST findings identified as inherited from the AFWWS shall remain audited and POA&Ms kept up-to-date.

· Category definitions shall be governed by DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT).

· Implement IA strategies and validation plans consistent with AFLCMC’s RMF implementation.

· Perform testing and evaluation as part of continuous integration development.

· Test results include vulnerabilities identified, demonstrated/estimated operational effects, residual risk on no technical or procedural solution is identified, potential risk mitigations, and residual risk once technical or procedural solution is applied.

· Use software configuration/deployment automation tools so that developers can deploy code changes to the target environment (e.g., development, test).

· Evaluate each software/hardware end-item against the applicable STIG/SRG or checklists as directed by law, policy, or the Government.

· Ensure updated, or up-to-date, STIG/SRG checklists and other Government cybersecurity requirements are applied for each development activity.

· For STIG/SRGs or checklists that are supported by automated test tools, the Contractor shall deliver the test reports generated by the test tools.

· Developed software shall be scanned using Static and Dynamic Application Security Testing (SAST/DAST) using static and dynamic code analysis tools as directed by the Government to identify any potential security vulnerabilities.

· All findings introduced as part of normal development activities shall be identified as deficiencies and resolved as part of the original development activity and funding.

· Deficiencies shall be analyzed, audited and presented to the Government as part of the originating development task.

· Deficiencies either newly introduced or reintroduced during development activities will be corrected as part of that development task prior to delivery and implementation.

· Mitigate or resolve all findings to the satisfaction of, and as prioritized by, the Government.

· Deficiencies that cannot be corrected immediately, and for those findings that are inherited from the enterprise, POA&Ms must be submitted to the Government (AFLCMC/HBAW).

· Apply Secure Coding Practices to all software developed.

XI. ACRONYM LIST

AFW

ARO

Air Force Weather After Receipt of Order