FENCES PWS Task Requirements_DRAFT22Dec25.pdf

Secretary of the Air Force (SAF)

Office of Competitive Activities (OC)

Concepts Development and Management (CDM)

Cloud Computing Services Platform-As-A-Service

(FENCES CLOUD)

Performance Work Statement (PWS)

Task Requirements

17 December 2025

1 INTRODUCTION AND BACKGROUND

This Performance Work Statement (PWS) describes the requirements for FENCES. The Office of the Department of War (DoW), Chief Information Officer (CIO) for Secure Access

Program(s) (SAPs) (DoW SAP CIO) requires Enterprise Information Technology capabilities that enable collaboration between the various components comprising the DoW Compartmented

Intelligence Community.

1.1 Objectives

SAF/CDM is seeking information for the FENCES requirement. The FENCES requirement provides and facilitates the use, in accordance with (IAW) the NIST definition of cloud computing, of Platform-as-a-Service (PaaS) supported by commercially available Infrastructure-as-a-Service (IaaS) offering(s). The Contractor shall provide a solution to allow Special Access

Program (SAP) customers across the DoW to access and utilize multiple commercial cloud capabilities in a SAP accredited manner IAW with DoW SAP Chief Information Officer (SAP

CIO) Authorizing Official (AO) policies and guidelines.

Achieving this objective, the Contractor shall support:

▪ FENCES Platform o Maintain the current scalable Fences platform to continue customer operational mission.

o Develop the Fences platform according to requirements provided by the sponsor organization.

▪ SAP/CAP Collaboration Desktop o Maintain the SAP/CAP collaboration desktop to continue customer operational mission.

o Develop the SAP/CAP collaboration desktop according to requirements by the sponsor agency.

▪ Customer Engineering Support o Provide field technical engineering (FTE) support services as dictated by customer FENCES requirements.

▪ Migration Support Service o Provide assistance for customers who are migrating from on-premise architectures into the FENCES cloud environment and do not have the technical cloud architectural expertise to re-factor their IT architecture.

1.2 SAF/CDM Vision

The Secretary of the Air Force, Office of Competitive Activities, Concepts, Development, and

Management (SAF/OC/CDM), hereafter referred to as “CDM” Office explores new concepts, develops emerging opportunities, and manages high-priority projects and programs to provide innovative solutions to Air Force and defense-wide challenges. CDM requires analytical and technical services support to meet current and projected workload requirements. The analytical and technical services described in this performance work statement (PWS) directly support

CDM’s mission to be the partner of choice for innovation, discovery, and opportunity development across the Department of Defense (DoD) and its components.

1.3 SAF/CDM Focus Areas

CDM core capabilities are often driven by customer-identified needs or specifically by senior management direction – with unique experience in tradecraft development, operations support, intelligence-related activities, and interagency stewardship. CDM focus areas generally fall into one of five areas:

1. Strategic and operational enablers. Establishing mechanisms and relationships to support virtual and physical access to data, people, and locations.

2. Operations Support. Provide operations support to mission partners in the

Department of the Air Force (DAF), Defense Intelligence Enterprise (DIE), Intelligence Community (IC), and Combatant Commands (CCMD) through the development of innovative technologies, methodologies and approaches that produce strategic effects against malign peer competitors.

3. Advanced analytics. Includes state-of-the-art data science, operations research, and systems analysis; the systematic application of advanced algorithms to complex data with high-performance computing to obtain immediately actionable insight.

4. Technology development. Research and Development (R&D) of new capabilities, applications, or technology enhancements, including sensors, tags, communications, material that support technical operations of intelligence, surveillance, and reconnaissance (ISR) requirements.

5. Systems and Architectures. Design, configuration, accreditation, and implementation of information management systems and cloud-based solutions support defense and intelligence priorities and internal business processes and mission functions, network communications, database management, security accreditation, and workflow management.

1.4 FENCES Background

The DoW SAP CIO is the principal staff assistant and senior advisor to the Secretary of Defense

(SECDEF) and Deputy SECDEF for Information Technology (IT) (including national security systems and defense business systems), Information Resource(s) Management (IRM) and efficiencies. The DoW SAP CIO, through the cognizant program office, as directed by the Under

Secretary of War, Intelligence (USW(I)), is tasked to manage the compartmented community’s

IT Enterprise and provide capabilities that enable collaboration between the various components

(e.g. The Services, DoW Field Activities, Intelligence Elements and offices, etc.).

Information and access sharing above the TS / Special Intelligence (SI) / Talent Keyhole (TK) level is a long-standing challenge throughout the DoW and IC. The associated resources, security and policy challenges all too often outweigh the operational requirement to share and integrate highly compartmented Special Access Program (SAP), Sensitive Compartmented Information

(SCI) or Alternate Compensatory Control Measure (ACCM) activities. This has resulted in inefficient operations, increased costs to do business and has impacted information sharing regarding SAP oversight and governance. To address these challenges, in 2012 USW(I) directed the development of an innovative system to provide secure information sharing to the community through available commercially based cloud computing capabilities. The FENCES development has proven critical to the Office of the Secretary of War (OSW) and the Service

SAP Central Office’s ability to communicate, de-conflict and govern. This effort represents the outcome directed by the USW(I) of a core set of services and common infrastructure.

2 SCOPE

FENCES is Authorized To Operate (ATO) per the National Institute of Standards and

Technology (NIST) Risk Management (RMF) process, and is in operational use across the DoW.

This requirement will provide cloud service offerings for over 100 users under the Platform-as-a-

Service (PaaS) model and from the perspective of the Private cloud deployment model to support the compartmented and special access Intelligence Community (IC) business and mission operations. FENCES Cloud users will include all DoW entities as defined in DoWM 5205.7, Volume 1 (DoW Special Access Program (SAP) Security Manual: General Procedures).

FENCES Cloud services will offer production and development, operation(s) and securing capabilities hosted in the Cloud Service Provider’s Unclassified (U) (IL-5), Secret (S) (IL-6), and

Top Secret (TS) region, from the home front to the tactical edge, including disconnected and austere environments, and closed loop networks. The FENCES’ IL-6 and TS Cloud services must be secured and accredited to perform all the capabilities in compliance with the Joint SAP

Implementation Guide (JSIG) in order to protect SAP equities. 8500 8510 CNSSI 1253 DOW

JSIG Tactical edge refers to the (Concept of Operations) CONOPS whereby customers may develop and test in the cloud then deploy applications on devices in remote locations to collect, pre-process, and return the data (common use cases may include data migration, data transport, image collation, Internet of Things (IoT) sensor stream capture, and machine learning). FENCES

Cloud services are required to meet industry-standard Service Level Agreements (SLAs) and the requirements of this PWS, regardless of where services are being delivered.

The Offeror shall act as a Cloud Service Partner (Cloud Broker, Cloud Auditor and Cloud

Carrier; as applicable to this PWS), as defined by NIST SP 500-291, coordinating the delivery of the Service model (PaaS) and orchestration of the Service Deployment model (Private Cloud);

ensuring the characteristics of Cloud Service Management, as defined in NIST SP 500-292, are met.

Work under this Contract/Agreement may require personnel performing intelligence related functions to have access to US Persons information. Contractor personnel must adhere to

Executive Order 12333, as amended, DoW Manual 5240.01, DoWD 5148.13, and DoW

5240.01-R, as amended (Procs 11-13), Air Force Instruction 14-104, and other DoW intelligence issuances and training requirements. When contractor personnel perform intelligence related functions and have access to US Persons information, the contractor must submit to the COR/PM a plan for compliance with intelligence oversight requirements. All personnel working on this effort will be certified and compliant with Defense Cyber Workforce Framework.

3 REQUIREMENTS

Project-based requirements may be defined during the execution of this contract. During the development or upon receipt of approved requirements, the Contractor shall assist in categorizing requirements as they align to the major sections of this PWS. If unclear of the category, the Contractor shall recommend a category for SAF/CDMX approval.

Requirements may originate from multiple sources. Requirements have the potential to introduce or fundamentally change user services, the technical system infrastructure, the deployment strategy, or any other aspect of FENCES. Requirements may originate from:

▪ Within the SAF/CDM organization

▪ FENCES users

▪ The Contractor. The Contractor is responsible for anticipating FENCES needs and recommending projects from ongoing analysis and investigations. The Contractor shall seek approval through the approved requirements management process or through the

PWS for validation prior to installation or implementation.

The Contractor shall provide the functional support required to fulfill this TO as described in the following subtasks.

3.1 FENCES Platform

3.1.1 Continued Operations

The Fences environment is currently operational with mission workloads deployed, therefore it is imperative that there be no service disruption. The Contractor shall:

3.1.1.1 Provision new accounts, user(s) and / or service offering(s). Offering deployment(s) within FENCES Cloud must not take any longer than service offerings, and the level of service, that is provided in the Offeror’s publicly available Commercial Cloud;

assuming that offerings have been authorized for use in FENCES Cloud. If service offerings must be scaled / customized / authorized for usage within FENCES Cloud, the contractor shall customize service offering(s) level of service requirements.

3.1.1.2 Assign a simple process for activating, provisioning, deactivating and de-provisioning any cloud service offering for all accounts under FENCES Cloud, upon request.

3.1.1.3 Provide a mechanism to deploy cloud-based computing and storage services based on standardized, pre-assembled configurations and security policies, as required.

3.1.1.4 Respond to authorized user requests for cloud resource(s) within a portal, or via an

Application Programming Interface (API), developed and managed by the contractor.

The Portal or API shall confirm via a ticket that resource deployment has begun, and response time must be to an acceptable industry standard, and confirmed via email.

3.1.1.5 Manage an individual IaaS computer instance's time required to go from power off to receiving and processing user instructions as less than a standard OS boot time.

3.1.1.6 Provide processing unit architecture(s), system memory, storage capabilities, and networking option(s) that are optimized (on a case by case basis, per workload assigned with customer SaaS workload owners) for specific and customized compute-based IaaS activities.

3.1.1.7 Provide an API Gateway-service that allows FENCES Cloud users the ability to develop, deploy, secure and scale their APIs as required.

3.1.1.8 Provide the ability to host virtual desktop environment remote-connection and provide access to persistent storage.

3.1.1.9 Coordinate with workload owners and their network providers, DISA DISN managers and the DoW SAP CIO provision cloud services to onboard cloud workload owners.

3.1.1.10 Support multiple architecture network environments and collaborate with CSP(s), and workload owner(s) to architect and engineer the provisioning of any circuit(s) with the most suitable Quality of Service (QoS) for mission owner success.

3.1.1.11 Ensure that the operation and support of the current Fences platform of tools and capabilities remains operational by working with the incumbent integrator to ensure there is sufficient pass down of information and materials.

3.1.2 High Availability

High availability (HA) systems are designed to ensure that critical systems are available and functioning properly most of the time, even during planned and unplanned outages. The benefits of HA include:

▪ Improved User Experience: HA systems can help maintain customer satisfaction by providing fast and reliable services.

▪ Protection from Outages: HA systems can protect against outages caused by hardware failures, software problems, human error, and environmental issues.

▪ Disaster Recovery: HA systems can help organizations recover and resume critical applications at a remote site in the event of a disaster.

▪ Improved Performance: HA systems can improve performance by distributing the load across multiple systems.

The contractor shall:

3.1.2.1 Develop a high availability roadmap, implementation plan, and architecture within 3 months of award. The contractor shall then implement the plan, then maintain the high availability architecture. The architecture must provide 99.95% for cloud platform availability.

3.1.2.2 Provide infrastructure and network support, as classified services must be physically separate from any infrastructure and network(s) supporting unclassified and Non-classified Internet Protocol (IP) Router Network (NIPRNet) service(s).

3.1.2.3 Provide redundant and globally distributed points of presence (i.e. Cloud, Circuit, Carrier Neutral Facility (CNF)) available on all continents (except Antarctica) through two (2) or more connections providing a total bandwidth capacity of at least

40 Gigabits (Gb) per second. Redundancy and global distribution shall be based on the interconnection of the commercial cloud service provider(s) model and architecture and the Defense Information Systems Network (DISN) end point presence across the globe.

3.1.3 Scalability

Scalability improves computing and storage capacity, in an efficient and rapid manner, to meet mission requirements. The contractor shall:

3.1.3.1 Ensure that all cloud services used by the platform and tools are well architected and scale as needed according to mission needs.

3.1.3.2 Develop and implement a transparent Configuration Management and Change

Control process that meets the requirements of Joint SAP Implementation Guide

(JSIG) Configuration Management.

3.1.3.3 Provide Personnel scalability: If more regions or boundaries are consumed, cyber work increases; If more networks are hybrid connected, more networking personnel is required; If FENCES becomes a more standard cloud offering, the onboarding, architectures, and provisioning of cloud resources should be quick and scalable (as with on-demand public cloud resources).

3.1.4 Financial Transparency and Customer Cost Sharing

3.1.4.1 Financial Operations (FinOps) Capability: The contractor shall provide customers with a government purpose rights solution that provides financial information to include cloud spend and modeling (at all classification levels). Additionally, this capability should allow for hierarchical tiering of customers for senior level visibility.

Furthermore, the solution must offer architecture recommendations for cost savings utilizing native cloud capabilities.

3.1.5 Multiple Cloud Provider Integration

The FENCES platform must support and allow platform and tenant deployments on any approved DoW Cloud Service Provider (CSP). These deployments can be isolated to a single

CSP or span across multiple CSPs. FENCES will also support hybrid/edge solutions native to a

CSP where tenants have a requirement or desire to host resources and data locally/on-premises.

3.1.5.1 The contractor shall, within one month of contract award, develop and present a plan for continued integration of commercial cloud providers into the Fence platform. The plan must include a roadmap for the current Oracle FENCES implementation as well as integration with Microsoft’s PLx offering.

3.1.6 Platform Enterprise Support Desk

3.1.6.1 The contractor shall stand up and provide a platform enterprise service desk capability to include implementation and operating with telephony and ticketing capabilities, along with a common communication medium. This capability should include not just multi-channel customer communication options, but also request solutions for sharing information (including capability and application health status) and capturing, tracking, and reporting on metrics. Service Desk requirements should take into consideration dispersed geography and time zones of FENCES tenants

(including key tenants in UT, NM, CA, and HI) and requirements for not only providing Service Desk support for the general working hours in those locations but also identifying ways to perform patching and maintenance activities in the least disruptive manner possible.

3.1.7 Cross Domain Solutions (CDS)

The FENCES platform should leverage the cross-domain solutions of each Cloud Service

Provider (CSP) where such CDS is available for tenant use. Cross domain services from low security networks to high security networks allow for the Fences customer to build full

Continuous Integration/Continuous Delivery (CI/CD) in addition to data movement between domains.

3.1.7.1 The contractor shall maintain and improve the Fences Data Transfer as a Service

(DTaaS) for all customers. The contractor shall continue to maintain the low to high

DTaaS and implement the High to Low DTaaS as soon as the native cloud capability is accredited and available.

3.1.7.2 CTR shall ensure training and guidance is provided to customer…

3.1.7.3 FENCES should maintain Tier 2 Enterprise CDS Provider (ECDSP) responsibilities for any cloud offering so that they can onboard customers to that Cloud Providers

CDS capabilities.

3.1.8 Scaled Agile Planning Increments

3.1.8.1 The contractor shall manage and work all platform changes and improvements using the Scaled Agile Framework (SAFe) and provide quarterly updates for the midpoint and main Planning Increment (PI) meetings. (Reference Attachment XXXXX).

3.1.9 Cyber Security

3.1.9.1 Coordinate with IC Host Agency or JWCC for currency of inherited controls.

(depending where FENCES will sit in the future.

3.1.9.2 Conduct RMF in accordance with JSIG, etc.

3.1.9.3 Store BOE within eMASS (at the appropriate security level) - Maybe consider support deployment of additional eMASS at other security levels beyond TS-SAR.

3.1.9.4 Coordinate with AO and SCAs on FENCES platform cybersecurity documentation, changes, and updates through an established rhythm of battle.

3.1.9.5 Develop incident response plans, etc.

3.1.9.6 Hire third-party for testing of FENCES platform (red team or blue team).

3.1.9.7 Conduct Quarterly Table-Top Exercises (TTXs).

3.1.9.8 Support coordination of customer ISAs for connectivity between FENCES and other systems.

3.1.10 Enterprise Services

3.1.10.1 Information Assurance/Cyber Tools: The contractor shall provide cyber security tools and services as an enterprise service to all Fences workloads.

3.1.10.2 Repositories and Registries: The contractor shall provide and maintain code and image registries and repositories at an enterprise level for all Fences workload owners. This is S/W available for all DAF users, not just the FENCES platform. This should also be available at the various security levels where the software or IaC/CaC has been configured/installed.

3.1.10.3 Include any from SAP/CAP collaboration desktop that are enterprise

3.1.10.4 Hosting Platform

3.1.11 Training

3.1.11.1 Contractor shall create comprehensive training materials, including:

▪ User Guides: Step-by-step instructions for common platform tasks and workflows.

▪ Training Presentations: Engaging presentations covering key concepts, functionalities, and best practices.

▪ Hands-on Exercises: Practical exercises that allow users to apply their knowledge in a simulated environment.

▪ Quick Reference Guides: Concise summaries of essential information and troubleshooting tips.

3.1.11.2 Contractor shall conduct engaging and effective training sessions for external users, covering topics such as:

▪ Platform Overview: Introduction to the platform's purpose, functionalities, and benefits.

▪ Account Setup and Management: Guidance on creating accounts, managing profiles, and accessing platform resources.

▪ Core Features and Workflows: Detailed instruction on using the platform's key features and completing typical tasks.

▪ Security and Compliance: Training on platform security protocols, data privacy guidelines, and compliance requirements.

▪ Troubleshooting and Support: Guidance on identifying and resolving common issues, and accessing platform support resources.

3.1.11.3 Contractor shall collect feedback from training participants and use it to continuously improve training materials and delivery methods.

3.1.11.4 Contractor shall maintain training materials up to date with the latest platform features and functionalities.

3.1.11.5 Contractor shall collaborate with the platform development team to stay informed about new features and updates and ensure training materials are aligned with the latest platform version.

3.1.12 Enterprise Support for SAP CIO Offerings

3.2 SAP/CAP Collaboration Desktop

3.2.1 Sustain and continue development of a Government-owned modern cloud-based

SAP/CAP user collaboration environment that includes secure voice, video, chat, office automation, and collaboration capabilities with access to SAP/CAP data through a zero-trust data mesh architecture.

3.2.1.1 Provides a modern user environment with standard office productivity and collaboration tools

3.2.1.2 Enables users to access SAP and CAP data for which they are authorized from a single user collaboration space

3.2.1.3 Provides users with the ability to collaborate with team members and SAP and CAP colleagues through secure voice, video, chat, and collaboration tools

3.2.1.4 Provides users with persistence (data and user settings) between logins

3.2.1.5 Increases SAP user environment resiliency, availability, and scalability

3.2.1.6 Decreases user account provisioning timelines and latency

3.2.2 Sustain and continue development of a Linux Baseline for AWS Workspaces

3.2.2.1 For developers and data scientists who require access to scripting and analytics tools

3.2.2.2 Contains common development and data science tools such as Docker, Git, Vim, Jupyter, Python, R etc.

3.2.3 Sustain and continue development of a Windows Baseline for AWS Workspaces

3.2.3.1 General: For the general user who wants to share data and collaborate across SAP and

CAP programs.

3.2.3.2 GPU: For the user who requires access to tools that are graphics intensive. All the tools in the General Windows Baseline + SIMDIS

3.2.4 Work with COR to maintain and enhance service/capability categories:

3.2.4.1 Cloud Infrastructure

▪ 14 AWS Accounts:

o 7 Prod o 7 Dev/Test

▪ Associated networking:

o VPCs o Security Groups o Proxy to JWICS o Transit Gateways o Route tables o External connections and paperwork

3.2.4.2 Virtual Desktop Baselines

▪ Windows Baseline

▪ Linux Baseline

▪ Windows GPU Baseline

3.2.4.3 Collaboration Services

▪ Confluence

▪ Jira

▪ SharePoint

▪ AWS Wickr Chat Voice and Video

▪ Email o Internal to SAP/CAP collaboration desktop o Connections to SIC and CORE email

3.2.4.4 Security Services

▪ SIEM

o OpenSearch Cluster o Dashboards

▪ Vulnerability scanning - Tenable Nessus

▪ Host based security - Trellix

▪ IdAMS o Microsoft AD and ADFS o Keycloak

• Integration with AcessIT

• Integration with JSD o Certificate Authority

▪ Data Tagging and Security Platform:

o Sentris o Virtru

▪ Wickr bots

3.2.4.5 Mission Data Mesh

▪ OpenSearch Cluster

▪ User Interface

▪ External repository connections

3.2.4.6 Automation/Configuration Management

▪ IaC/CaC for all services o Workspaces image pipeline o User account creation pipeline

▪ Mirror of ADV repos for Linux users:

o NPM o Python o CRAN

▪ Configuration Control Board

▪ Configuration Item Baselines

3.2.4.7 Customer Engagement/Service Desk

▪ Cost model/chargeback model

▪ Onboarding process

▪ Customer front door/portal o JWICS o SAP Networks

▪ Security Model Document

▪ User Agreements o Maintain document o Ensure all users sign and maintain copies as required by policy

▪ User Wiki

3.2.4.8 Agile events

▪ Backlog

▪ Requirements management

3.2.4.9 Assessment & Authorization Continuous Monitoring

▪ Maintain and update the Body of Evidence

▪ Monitor scans, audit events etc.

▪ Report and receive SCA/AO approval for all security relevant changes

3.3 Customer Engineering Support

Customer Engineering Support requires dedicated FTEs to provide subject matter expertise for each FENCES Government customer. Customers will have a list of IDIQ Labor Categories

(LCATs) to build their specific Task Order(s) based on their requirements and resourcing needs.

3.4 Migration Service Support

Government customers moving from an on premise environment to the cloud may require assistance refactoring and planning for the migration. This section of the PWS allows for the scope of these needs and provides dedicated cloud architecture FTE support specific to on premise technologies and refactoring into cloud native architectures. The Contractor will be required to offer migration service support to customers who require it.