Statement of Work (Amend 0002).pdf

CONTROLLED UNCLASSIFIED INFORMATION

STATEMENT OF WORK (SOW)

P5 COMBAT TRAINING SYSTEM

(P5CTS) SYSTEM SECURITY

UPDATE (SSU)

Prepared by:

AFLCMC/HBZPB

6049 Wardleigh Rd, Bldg 1205

HILL AIR FORCE BASE (AFB), UTAH 84056

TABLE OF CONTENTS

1.0 (CUI) Program Background

2.0 (CUI) Scope

3.0 (U) Applicable Documents

4.0 (U) Requirements

4.1 (CUI) Design and Engineering

4.1.1 (U) DSM

4.1.1.1 (CUI) Type 1 Encryption

4.1.1.2 (CUI) Controlled Interface

4.1.2 (U) MEC

4.1.3 (CUI) Encryptor Keying

4.2 (U) Test and Certification Requirements

4.2.1 (U) Contractor Test and Evaluation (T&E)

4.2.2 (U) Contractor Testing

4.2.3 (U) Airworthiness Flight Clearance and Interim Authorization to Test

4.2.4 (U) Contractor Certification

4.2.5 (U) Government T&E Program

4.2.6 (U) NSA Certification

4.2.7 (U) First Article Test (FAT)

4.2.8 (U) CSCI Testing

4.3 (U) SSU Kit Production

4.3.1 (U) Production or Modification of Government-Provided End Cap Assemblies

4.3.2 (U) Manufacture

4.3.3 (U) FMS Considerations

4.3.4 (U) Quantity Discounts

4.4 (U) Technical Data

4.4.1 (U) Distribution of Technical Documents

4.4.2 (U) TO

4.4.3 (U) Commercial Manuals/Documents

4.4.4 (U) Operations and Maintenance (O&M) Training

4.5 (U) Program Management

4.5.1 (U) Program Manager (PM)

4.5.2 (U) Subcontractor and Supplier Management

4.5.3 (U) Small Business (SB) Utilization Reporting

4.5.4 (U) Monthly Status Report

4.5.5 (U) Integrated Master Schedule (IMS)

4.5.6 (U) RM

4.5.7 (U) Government Contract Management

4.5.8 (U) Contractor Safety Plan

4.5.9 (U) Government Furnished Property (GFP)

4.6 (U) Meetings, Reviews and Conferences

4.6.1 (U) Conference Room

4.6.2 (U) Meeting Agendas and Presentation Material

4.6.3 (U) Meeting Minutes

4.6.4 (U) Contractor Facility Access

4.6.5 (U) Post-Award Conference (PAC)

4.6.6 (U) PMR Support

4.6.7 (U) Technical Interchange Meetings (TIM)

4.6.8 (U) Design Reviews

4.6.9 (U) TRR/Test and Evaluation Boards (TEB)

4.6.10 (U) FCA and PCA

4.6.11 (U) PRR

4.7 (U) Configuration Management Plan (CMP)

4.7.1 (U) QA Program

4.7.2 (U) Configuration Audit Plan

4.7.3 (U) Data Management

4.8 (U) Logistics

4.8.1 (U) Computer Program Identification Numbers (CPIN)

4.8.2 (U) DAL Process

4.8.3 (U) Requirements Management

4.8.4 (U) Supply Provisioning

4.8.5 (U) Logistics Support Planning

4.8.6 (U) Item Identification

4.8.7 (U) Packaging, Handling, Shipping, and Transportation

4.9 (U) Security Program

4.9.1 (U) System Security Working Group (SSWG)

4.9.2 (U) Cybersecurity Program

4.9.3 (U) Cybersecurity Compliance

4.9.4 (U) Secure Development Environment

4.9.5 (U) TEMPEST

4.9.6 (U) Remanence Analysis (RA)

4.9.7 (U) Covert Channel Analysis (CCA)

4.9.8 (U) PPP

4.9.9 (U) Counterfeit Prevention Plan (CPP) and Prevention of Counterfeit Parts and Malicious Logic

4.10 (U) Diminishing Manufacturing Sources and Material Shortages (DMSMS)

4.11 (U) Support Equipment

5.0 (U) CDRLs

EXHIBIT A (USAF)

EXHIBIT B (FMS)

EXHIBIT D (USAF, FIRST ARTICLE)

EXHIBIT T (USAF)

EXHIBIT C (FMS)

6.0 (U) Tables/Appendix

APPENDIX A REVIEWS AND AUDITS ENTRANCE/EXIT CRITERIA

Post-Award Entrance Criteria

Post-Award Exit Criteria

SRR Entrance Criteria

SRR Exit Criteria

PDR Entrance Criteria

PDR - Exit Criteria

CDR - Entrance Criteria

CDR - Exit Criteria

TRR - Entrance Criteria

TRR - Exit Criteria

FCA - Entrance Criteria

FCA- Exit Criteria

PCA - Entrance Criteria

PCA - Exit Criteria

PRR - Entrance Criteria

PRR – Exit Criteria

(U) APPENDIX B AGREEMENTS

1.0 (U) GOVERNMENT DIRECTION

2.0 (U) LICENSE RIGHTS IN TECHNICAL DATA AND SOFTWARE

3.0 (U) LIMITATION OF GOVERNMENT RIGHTS

4.0 (U) ACA

5.0 (U) USE OF NON-GOVERNMENT ADVISORS

6.0 (U) LM CSCI

7.0 (U) SOFTWARE LICENSE

1.0 (CUI) Program Background In order to meet current cybersecurity requirements and provide for future implementation of Proficiency Based Training, a security upgrade must be completed. Headquarters Air Combat Command requires implementation of an encrypted P5CTS data link to a) protect tactics and training methods and b) allow 4th generation aircraft to engage the F-35 during training missions.

The solution identified is a shop-replaceable retrofit kit to replace the obsolete Data Guard Processor (DGP) in the Airborne Subsystem (AS)/pods that consists of a Data Security Module (DSM), and a P5 AS Modified End Cap (MEC), interface cable(s) and associated hardware. The DSM shall encrypt data through a National Security Agency (NSA) certified Type 1 encryptor and provide a NSA certified control interface that enables or restricts the access or transfer of information between security domains. The DSM, MEC, associated hardware, software and technical data is referred to as the SSU kit. The engineering, hardware, software, documentation, and other efforts required to manage and produce the kits is referred to as the SSU program. The P5CTS AS currently transmits unencrypted Controlled Unclassified Information (CUI) over-the-air. Department of Defense (DoD) Risk Management Framework (RMF) requires encryption of classified and CUI data. Accordingly, the P5CTS must remedy the obsolescence concern and noted deficiencies to enable continued operations through at least 2030.

The P5CTS currently provides limited interoperability with the F-35 P5 Internal Subsystem (IS) Block 3F. A NSA certified CSF-34 decryption unit in the Ground Subsystem (GS) allows live and post mission processing of the F-35 P5 IS Time-Space-Positioning-Information (TSPI) data.

The F-35 P5 IS is also able to use the unencrypted TSPI of the P5 pod for engagements against 4th generation aircraft and the P5CTS pods relay encrypted F-35 P5 IS TSPI to the GS when necessary.

The P5CTS provides realistic air combat training to the warfighter and employs instrumentation on high activity participant aircraft and GS components. The System contains an air-to-air data link for sharing participant Global Positioning System (GPS) based TSPI. The AS transmits state vectoring information for aircraft motion and location generated from GPS tracking and provides real time kill notification based on Government-furnished weapon simulations. The system is capable of employing Government-furnished weapon simulations in accordance with (IAW) Government Interface Control Documents (ICDs). The system includes two AS configurations, AN/ASQ-T50(V)1 and AN/ASQ-T50(V)2. The two configurations are identical except for the AN/ASQ-T50(V)2 configured AS includes a carrier-qualified forward hanger that meets vibration and shock requirements imposed by the F/A-18 wing tip environment. The AS may operate in a completely autonomous (rangeless) mode or a Live Monitor (LM) mode with uplink control. The AS is packaged in a 5-inch diameter stainless steel tube that resembles an Air Interceptor Missile (AIM)-9 Sidewinder missile. The GS currently includes four configurations:

Transportable Ground Subsystem (TGS) with and without LM (AN/GSQ-T105 and AN/GSQ- T104); Portable Ground Subsystem (PGS)(AN/PSQ-T3); and, Fixed Ground Subsystem (FGS) (AN/GSQ-T106). The concept of operations at fielded locations is a major factor in facilitating joint training and providing interoperability with other services and coalition partners. The system enables interoperability through its ability to post-mission merge P5CTS data with data from other Air Combat Training Systems (ACTS) and present the merged data in a post-mission debrief.

2.0 (CUI) Scope This SOW establishes requirements and the responsibilities of the contractor to provide a non-developmental NSA certified Type 1 encrypted data link as delineated in this SOW to support the P5CTS. The contractor shall deliver a SSU solution with the capabilities to support daily operations at various locations worldwide including support for large force exercises with as many as 114 participant subsystems in use in a single network at any one time. The SSU shall support and maintain “step-to-the-jet” operations, not restrict flexibility or flow of operations, and remain capable of flight on currently certified airframes to include, but not limited to, F-5, AV-8, F-15, F-16, A-10, B-52 and F-18 U.S. The implementation shall be interoperable with the F-35 encrypted training system and maintain backward compatibility with P5CTS Block 4/4A and Spectrum Relocation updates. Additionally, the solution shall be interoperable with existing P5CTS United States Air Force (USAF) and United States Navy (USN) Combat Training range infrastructure: Test and Training Enabling Architecture (TENA), Joint Display System (JDS), Individual Combat Aircrew Display System (ICADS), Radar Acquisition and Display System (RADS), Electronic Warfare Server (EWS), and Radiant Mercury.

This SOW includes all labor, material, expertise and resources necessary to design, modify, integrate, manufacture, test, qualify, certify, produce, train, document, and deploy a SSU satisfying data encryption requirements. It includes all associated functional support to include Program Management, Subcontractor and Supplier Management, Human Systems Engineering, Risk Management (RM), Financial Management, Configuration and Data Management (to include technical data and computer software/hardware (SFW/HW) rights assertions and justification process), Manufacturing and Quality Management, Logistics Management and Security (to include operation of a secure development environment, cybersecurity and RMF, and activities required to satisfy NSA certifications, and USAF cybersecurity requirements).

The scope includes hardware, software, and firmware modifications to the Airborne Subsystem (AS). Additionally, the scope of this contract includes Foreign Military Sales (FMS) and United States Government (USG) procurement and delivery. SSU kits shall ensure that the USG can create and maintain a single system configuration across the entire USAF P5CTS fielded fleet.

The contractor shall perform the work IAW this SOW, the System Requirements Document (SRD), the Information Assurance SRD (IASRD), the Technical Security Requirements Document (TSRD), to include all document appendices, and other contract requirements.

3.0 (U) Applicable Documents The following documents are applicable to this SOW (and attached appendices) to the extent specified herein.

Documents for compliance under the scope of this contract. Applicable document versions/revisions/dates are as of effective date of the contract. If any questions, contact the Government Procuring Contracting Officer (PCO).

Military Standards/Handbooks/Technical

Orders (TOs)

TITLE

MIL-STD-461 Requirements for the Control of Electromagnetic Interference Characteristics of Subsystems and Equipment

Documents for compliance under the scope of this contract. Applicable document versions/revisions/dates are as of effective date of the contract. If any questions, contact the Government Procuring Contracting Officer (PCO).

Military Standards/Handbooks/Technical

Orders (TOs)

TITLE

MIL-STD-810 Environmental Engineering Considerations and Laboratory Test

MIL-HDBK-896 Manufacturing Management Program Guide Manufacturing Readiness Level (MRL) Deskbook

TO 00-35D-54 Technical Order – USAF Deficiency Reporting, Investigation and Resolution

Security/Information Assurance Documents

CNSSP No 11 Committee on National Security Systems Policy (CNSSP): Acquisition of Information Assurance (IA) and IA-Enabled Information Technology (IT) Products Software Assurance Countermeasures in Program Protection Planning

CNSSI 1253 (with all current attachments) Committee on National Security System Instruction (CNSSI): Security Categorization and Control Selection for National Security Systems (NSS)

DoD 5220.22-M Department of Defense Manual (DoDM) - National Industrial Security Program Operating Manual

DoDI 8500.01 Department of Defense Instruction (DoDI) - Cybersecurity

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology( IT)

NIST SP 800-53 National Institute of Standards and Technology Special Publication (NIST SP) Security and Privacy Controls for Federal Information Systems and Organizations

NIST SP 800-53A Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans

NIST SP 800-88 Guidelines for Media Sanitization

NIST SP 800-128

Guide for Security-Focused Configuration Management of Information Systems

Industry Documents

Documents for compliance under the scope of this contract. Applicable document versions/revisions/dates are as of effective date of the contract. If any questions, contact the Government Procuring Contracting Officer (PCO).

Military Standards/Handbooks/Technical

Orders (TOs)

TITLE

ISO 9001 International Organization for Standardization (ISO) Quality Management Systems - Requirements

ISO 10005 Guidelines for Quality Plans – Quality Management

SAE/EIA 649 Society of Automotive Engineers (SAE)/Electronic Industries Alliance (EIA) Configuration Management Standard

SAE AS 5553 Aerospace Standard (AS) – Fraudulent/Counterfeit Electronic Parts;

Avoidance, Detection, Mitigation, and Disposition

SAE AS6174 Counterfeit Material; Assuming Acquisition of Authentic and conforming Materiel

SAE AS6500 Manufacturing Management Program SAE AS9100 Quality Management: Aviation, Space, and

Defense Organizations SAE GEIA-STD-0007 Government Electronics and Information

Technology Association Standard - Logistics Product Data

Government Documents P5CTS Program Protection Plan (PPP) Unclassified/For Official Use Only

(U/FOUO)

P5CTS Security Classification Guides (SCG), U/FOUO and Classified, and DD Form(s) 254, Contract Security Classification Specification (CSCS)

SRD (U/FOUO)

IASRD (S)

TSRD with Software Analysis and Assessment Process Description (SAAPD)

(U/FOUO)

4.0 (U) Requirements The contractor shall implement robust Systems Engineering (SE) processes to fabricate, integrate, test, evaluate, document, and deliver the SSU as described in this SOW.

4.1 (CUI) Design and Engineering The contractor shall design, integrate, test, and qualify an encryption solution which meets requirements contained in the SRD, TSRD and IASRD. The solution shall be NSA certifiable within the program fielding requirements. The solution shall require no, or only minor, configuration modifications to adapt to the AS to fulfill the immediate operational need. Design, integration, test and certification efforts for the USAF SSU program shall be completed within 18 months. FMS countries employing the P5CTS also require an SSU solution. A single SSU hardware configuration for USAF and FMS which is exportable to partner nations is the objective. A separate FMS SSU hardware configuration exportable to foreign partners employing the P5CTS is acceptable. The contractor shall meet all FMS unique requirements and perform unique design, integration, test and certification efforts, to include all FMS deliverables specific to those unique requirements, separate from the USAF. The contractor shall design a FMS baseline kit configuration, and complete country specific changes to the baseline configuration contingent upon country specific funding. Exportability requirements shall not negatively impact the USAF SSU design. The contractor shall plan for a minimally intrusive and “ease of installation and use” design approach. The Government requires the DSM to meet size, weight and power (SWaP) constraints and operate in place of the current DGP. The contractor shall manufacture and use production representative kits for integration, certification and testing purposes. The contractor shall minimize any changes to existing P5CTS Computer Software Configuration Items (CSCI) and Hardware Configuration Items (HWCI). The contractor shall recommend CSCIs, HWCIs, and nomenclature updates and/or assignments during design reviews for Government approval. The contractor shall accomplish hardware/firmware/software design and modification and software design and coding, including software user procedures, using the P5CTS Spectrum baseline (A019 (USAF), DI-IPSC-81443A/T, Software User’s Manual (SUM); B019, (FMS) DI-IPSC-81443A/T, Software User’s Manual (SUM)). The contractor shall process an Engineering Change Proposal (ECP) IAW program TSRD for approval after exiting Functional Configuration Audit (FCA), Physical Configuration Audit (PCA), and Production Readiness Review (PRR) for Government Configuration Control Board (CCB) approval and implementation of the P5CTS new SSU baseline. (A018 (USAF), DI-

SESS-80639D/T, ECP; B018 (FMS), DI-SESS-80639D/T, ECP)

4.1.1 (U) DSM

4.1.1.1 (CUI) Type 1 Encryption The Type 1 encryptor shall be certified by the NSA prior to fielding. As a minimum requirement, the Type 1 encryptor shall be capable of single level encryption at the level of the key provided, up to the Secret/SAR level. A Type 1 encryptor capable of multiple level security using multiple keys to transmit simultaneously is an objective requirement for future growth.

4.1.1.2 (CUI) Controlled Interface Currently the AS's DGP performs a data guard function and serves as the RED/BLACK signal interface point between the Advanced Data Interface Unit (ADIU) and the Data Link Transmitter (DLT) data. The DSM will replace the current DGP in the AS. The DSM shall provide a NSA certified control interface that enables or restricts the access or transfer of information between security domains, and prevent unencrypted CUI and unencrypted classified information from being transmitted over the data link utilizing a NSA certified solution. NSA approved rule set changes shall be capable of being updated by operating location personnel without returning the device to depot for reprogramming.

4.1.2 (U) MEC

The P5 AS End Cap requires modification to support the encryption capability IAW the program SRD, TSRD, and IASRD. The Government-previously developed a Digital End Cap Assembly “modification” Technical Data package (TDP) which will be made available to the contractor for use at their discretion. The contractor shall deliver a MEC as part of each kit, and a TDP based on the final MEC product configuration. (A016 (USAF), DI-SESS-81000E/T, Product Drawings/Models and Associated Lists; B016 (FMS), DI-SESS-81000E/T, Product Drawings/Models and Associated Lists)

4.1.3 (CUI) Encryptor Keying The contractor shall establish and develop key management processes and procedures. The contractor shall assist the Government System Program Office (SPO) in developing a Key Distribution Plan for use by the Controlling Authority by providing pertinent information necessary to accomplish the plan. (A008 (USAF), DI-MISC-81688A/T, Key and Certification Management Plan (KCMP); B008 (FMS), DI-MISC-81688A/T, Key and Certification Management Plan (KCMP)). Keying material for the SSU shall be Key Management Infrastructure (KMI) compatible. Keying procedures shall not require additional maintenance actions once the AS is loaded on the aircraft including instances when the power is cycled. The DSM shall be stored as an unclassified Controlled Cryptographic Item (CCI) when powered off.

The contractor shall handle all equipment designated CCI by the NSA IAW the SRD and IASRD. The contractor shall package unkeyed CCIs for shipment in a manner that provides sufficient protection from damage and provides evidence of any attempt to penetrate the package while the material is in transit. The contractor shall package and mark CCI packages appropriate to their classification. The contractor shall ship only to authorized activities and by authorized couriers. The contractor shall address packages in a manner that shall ensure delivery of the material to an individual who is designated to accept custody at the recipient activity by utilizing a functional designator (e.g. an office symbol, duty position title, or account number).

4.2 (U) Test and Certification Requirements

4.2.1 (U) Contractor Test and Evaluation (T&E) The contractor shall implement a Government-approved T&E program to test, qualify for flight, and validate accomplishment of all requirements. The contractor shall include documentation and reporting of failures or anomalies identified through the Test Incident Report (TIR) process (A020 (USAF), DI-SESS-81927/T, Failure Analysis and Corrective Action Report (FACAR- TIR); B020 (FMS), DI-SESS-81927/T, Failure Analysis and Corrective Action Report (FACAR- TIR)). The contractor shall provide the Government a 15 workday advance notice and facility access to witness all tests. The Government has limited access to test facilities, as such the contractor shall have their own access to a certified System Integration Lab (SIL) to accomplish required tests. The contractor shall deliver a Test and Evaluation Program Plan (TEPP) for Government approval prior to commencing test events. (A021 (USAF), DI-NDTI-81284/T, TEPP; B021 (FMS), DI-NDTI-81284/T, TEPP)

4.2.2 (U) Contractor Testing The contractor shall accomplish contractor testing (e.g., CSCI, system integration, functional, security to include Telecommunications Electronic Materials Protected from Emanating Spurious Transmissions (TEMPEST aka Emission Security (EMSEC)), NSA testing requirements, regression, electromagnetic), to validate accomplishment of all requirements without degrading current capabilities and to satisfy certification requirements. To demonstrate that safety of flight is not violated with the host aircraft, the contractor shall conduct Electromagnetic Compatibility (EMC) testing. The contractor shall accomplish MIL-STD-461 testing to ensure system and subsystem requirements will function within their designed tolerances in their intended electromagnetic environment IAW the SRD. The contractor shall demonstrate that equipment design and performance meet requirements under environments simulated in a National Voluntary Laboratory Accreditation Program (NVLAP) certified facility.

The Contractor shall accomplish MIL-STD-810 testing IAW the SRD to determine capability of the SSU kit to perform its full array of intended functions in intended environments. The contractor shall provide the Government 30 working days (90 working days for F-35) advance notice for scheduling aircraft. The contractor shall hold, at its facilities, NSA-witnessed Security Verification Test (SVT) events. The contractor shall participate in and provide investigation, analysis, reporting and support of the Joint Deficiency Reporting System (JDRS) IAW USAF TO 00-35D-54, as requested by the Government, during contractor testing. The contractor may provide qualification by similar documentation approved by the USG. (Note see Paragraph 4.2.6 for all NSA related data deliverables; A012 (USAF), DI-EMCS-81683/T, TEMPEST Test Plan;

A013 (USAF), DI-EMCS-81684/T, TEMPEST Test Eval Rpt; A023 (USAF), DI-IPSC- 81442A/T, Software Version Description (SVD); A026 (USAF) , DI-AVCS-80700A/T, Computer Software Product End Items (CSPEI); A020 (USAF), DI-SESS-81927/T, FACAR- TIR; A025 (USAF), DI-NDTI-80603A/T, Test Procedures; A022 (USAF), DI-NDTI-80809B/T, Test/Inspection Rpt; A024 (USAF), DI-EMCS-81687, TEMPEST Control Plan (TCP); B012 (FMS), DI-EMCS-81683/T, TEMPEST Test Plan; B013 (FMS), DI-EMCS-81684/T, TEMPEST Test Eval Rpt; B023 (FMS), DI-IPSC-81442A/T, SVD; B026 (FMS), DI-AVCS-80700A/T, Computer Software Product End Items (CSPEI); B020 (FMS), DI-SESS-81927/T, FACAR- TIR;

B025 (FMS), DI-NDTI-80603A/T, Test Procedures; B022 (FMS), DI-NDTI-80809B/T, Test/Inspection Rpt; B024 (FMS), DI-EMCS-81687, TEMPEST Control Plan (TCP))

4.2.3 (U) Airworthiness Flight Clearance and Interim Authorization to Test The contractor shall obtain Government approval of all supporting documentation (e.g., contractor test reports, software version descriptions, etc.) to support the timeline (60 working day for F-16/F-15) for the completion of airworthiness flight clearance and Interim Authorization to Test. (A023 (USAF), DI-IPSC-81442A/T, SVD; B023 (FMS), DI-IPSC-81442A/T, SVD;

A022 (USAF), DI-NDTI-80809B/T, Test/Inspection Rpt; B022 (FMS), DI-NDTI-80809B/T, Test/Inspection Rpt; A027 (USAF), DI-GDRQ-81234A/T, Calculated Wt/Bal Rpt); B027 (FMS), DI-GDRQ-81234A/T, Calculated Wt/Bal Rpt))

4.2.4 (U) Contractor Certification The contractor shall confirm that contractor T&E is successfully accomplished. The contractor shall provide certification that validates the contractor has corrected all performance discrepancies, corrected and resolved all incident reports, satisfied all specification requirements, and the system is complete and ready for Government testing. (A028 (USAF), DI-MISC-

81356A/T, Certificate of Compliance; B028 (FMS), DI-MISC-81356A/T, Certificate of Compliance)

4.2.5 (U) Government T&E Program The contractor shall provide, modify, install, and deliver test articles to and from each test location to support Government testing as required. At the discretion of the Government, the contractor shall return all modified equipment to the CCB approved configuration upon completion of all testing.

4.2.5.3 (U) Government Developmental Test & Evaluation (DT&E) The Government will conduct DT&E to validate satisfaction of all requirements contained in the SRD and IASRD. The Government will determine the locations for Modeling & Simulation (M&S) Laboratory, ground and/or flight testing. The Government flight test program will include F-35 testing to validate satisfaction of requirements for F-35 interoperability. For planning purposes, “contractor shall assume Hill AFB, UT for M&S lab testing, and Eglin AFB, FL and/or Nellis AFB, NV for dedicated ground/flight test events. The contractor shall provide two weeks on-site support for each T&E event (M&S Laboratory, flight testing).

4.2.5.4 (U) Government Operational Test & Evaluation (OT&E) The Government will conduct OT&E to evaluate operational suitability of the system. The Government will determine the locations for ground and/or flight testing. The Government flight test program will include F-35 testing to validate satisfaction of requirements for F-35 interoperability. The Government may also conduct a large force exercise for F-16, F-15, and F- 35 interoperability testing estimated at 10 workdays at one location to independently evaluate the effectiveness and suitability of the changes made to the system. For planning purposes, contractor shall assume Eglin AFB, FL and/or Nellis AFB, NV for dedicated ground/flight test events. The contractor shall provide two weeks on-call support for each OT&E event.

4.2.5.5 (U) Government Test Plans At the Government’s discretion, the contractor shall review Government-prepared test plans and provide comments via letter to the Government PCO.

4.2.5.6 (U) Test Data Analysis At the discretion of the Government, the contractor shall analyze test data from Government T&E and report findings. (A029 (USAF), DI-MISC-80508B/T, Tech Rpt – Study/Svcs – Test Data Analysis; B029 (FMS), DI-MISC-80508B/T, Tech Rpt – Study/Svcs – Test Data Analysis)

4.2.6 (U) NSA Certification The contractor shall coordinate directly with NSA to certify the DSM for use with the P5 system.

The contractor shall complete security planning activities and support the NSA Certification process, IAW the TSRD, including coordinating security tasks and documentation, software releases, reviews, security content of program documentation, nomenclature(s) and identaplate(s), as well as NSA specific data, and test and verification requirements (to include SVT events). The contractor shall establish databases, spreadsheets and tables to record and document the NSA requirement products. (A001 (USAF), DI-MISC-81762A/T, Security

Evaluation Document (SED); A002 (USAF), DI-QCIC-81689/T, Security Verification Plan and Procedures (SVPP): A003 (USAF), DI-QCIC-81690/T, Security Verification Report (SVR);

A004 (USAF), DI-IPSC-81427B/T, Software Development Plan (SDPDD); A005 (USAF), DI- IPSC-81433A/T and 81431A/T, Software/Hardware Requirements Specification (SHRS); A006 (USAF), DI-IPSC-81432A/T and 81435A/T, System Subsystem Design Description (SSDD/SHDD); A007(USAF), DI-MISC-80508B/T, Software and Programmable Logic Evaluation Report (SPLER); A008 (USAF), DI-MISC-81688A/T, KCMP; A009 (USAF), DI- MISC-80508B/T, Tech Rpt – Study/Svcs – Key Certificate Specification (KCS); A010 (USAF), DI-SESS-81646B/T, Config Audit Plan; A011 (USAF), DI-SESS, 81022D/T, Config Audit Summary Rpt/Cert; A012 (USAF), DI-EMCS-81683/T, TEMPEST Test Plan; A013 (USAF), DI-EMCS-81684/T, TEMPEST Test Eval Rpt; A014 (USAF), DI-QCIC-81691A/T, In Process Accounting Procedures (IPAP); A015 (USAF), DI-QCIC-81722/T, Quality Prog Plan - SPA Description; A016 (USAF), DI-SESS-81000E/T, Product Drawings/Models and Associated Lists; A017 (USAF), DI-MGMT-81717D/T, Information Security (INFOSEC) Anonymity Plan;

A018 (USAF), DI-SESS-80639D/T, ECP; A024 (USAF), DI-EMCS-81687, TEMPEST Control Plan (TCP); A030 (USAF), DI-SESS-81248, ICD; A031 (USAF), DI-MISC-81709, Embedment Manual)

4.2.7 (U) First Article Test (FAT) If ordered, the contractor shall install production representative SSU kits into Government-provided AS’s to verify manufactured kit components meet Government requirements. FAT shall include FCA, PCA, and shall verify that all aspects of the system performance have met the system requirements in the SOW, SRD, TSRD, IASRD, System Specifications (SS), Subsystem Specifications (SSS), drawings, and other applicable technical documentation. The FCA shall verify that components of the kit meet all performance requirements. The PCA shall validate that components of the kit match all drawings. The PCA can be conducted incrementally, with multiple PCA reports delivered. In the event of an unsuccessful FAT, the contractor shall re-conduct all required testing at no additional cost to the Government. Each First Article (FA) shall be integrated into, and tested on a Government test or training range as part of testing/validation and delivery efforts IAW the SOW. (D001 (USAF), DI-NDTI-81284/T, First Article Test and Evaluation Program Plan; D002 (USAF), DI-NDTI-80603A/T, First Article Test Procedure; D003 (USAF), DI-NDTI-80809B/T, First Article Test/Inspection Report)

4.2.8 (U) CSCI Testing If software changes are required and approved as part of an ECP, CSCI testing shall be performed for each CSCI according to the software test plan, delivered as Government Furnished Information (GFI). This plan will describe the total software test approach at the system level, including complete software regression testing, and a description of all testing done at each CSCI level. The contractor shall produce software test descriptions, software test procedures, and software test reports for each CSCI updated. The software test plan and software test descriptions/procedures will address all applicable technical requirements and requirements for cybersecurity as defined in DoD instructions (DoDI) 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), March 12, 2014; DoDI 8500.01, Cybersecurity, March 14, 2014; and DoDI 5000.02, Operation of the Defense Acquisition System. Software test reports shall be delivered to the Government and shall be formatted to facilitate utilization in the FCA(s). Once software testing has been completed and the results are approved by the

Government as part of the initiated ECP there shall be no additional software changes without written Government approval from either the PCO or their designated representative. (A018 (USAF), DI-SESS-80639D/T, ECP; A019 (USAF), DI-IPSC-81443A, Software User’s Manual (SUM); A011 (USAF), DI-CMAN-81022C, Configuration Audit Summary Rpt/Cert; A035 (USAF), DI-IPSC-80590B, Computer Program End Item Documentation; A036 (USAF), DI- IPSC-81438A/T, Software Test Plan; A037 (USAF), DI-IPSC-81440A, Software Test Report;

A025 (USAF), DI-NDTI-80603A/T, Test Procedures; B018 (FMS), DI-SESS-80639D/T, ECP;

B019 (FMS), DI-IPSC-81443A, Software User’s Manual (SUM); B011 (FMS), DI-CMAN- 81022C, Configuration Audit Summary Rpt/Cert; B035 (FMS), DI-IPSC-80590B, Computer Program End Item Documentation; B036 (FMS), DI-IPSC-81438A/T, Software Test Plan; B037 (FMS), DI-IPSC-81440A, Software Test Report; B025 (FMS), DI-NDTI-80603A/T, Test Procedures.

4.3 (U) SSU Kit Production The contractor shall produce, test, and deliver Government CCB approved product baseline SSU Kits and spares for the AS. The SSU kit shall include, at a minimum, the DSM, MEC, interface cable(s) and associated hardware required for field installation by organic maintenance personnel. Spares shall include all SSU Kit parts and Shop Replaceable Assemblies (SRA) required to maintain and operate the system. Each spares lot will sustain 50 SSU kits for a three-year period. The contractor will assume repairs will be accomplish by the current Contract Logistic Support provider, Cubic Defense Applications (CDA) via replacement of inoperative items. The contractor and Government will collaborate on a delivery schedule, with delivery locations and associated quantities identified by the Government. For planning purposes, assume 1015 kits within 24 months as the accelerated schedule. The contractor shall plan for the installation of the SSU kits as a field level Time Compliance Technical Order (TCTO) (T004 (USAF), TM-86-01P, TCTO; C004 (FMS), TM-86-01P, TCTO) with minimal effort (Plug and Play) for the technician without the need for major component disassembly by the user.

Government personnel at each operating location will independently accomplish installation via an upgrade kit using the TCTO process and Electronic Software Distribution System (ESDS) release.

The contractor shall continue to meet the intent of SAE AS6500 and guidance in MIL-HDBK- 896 to maintain an effective manufacturing program. The Government shall have access to contractor facilities and manufacturing documentation pertaining to SSU Kits. The contractor shall perform factory acceptance testing, using Government approved test procedures, prior to shipment. The contractor shall notify Defense Contract Management Agency (DCMA) personnel 10 workdays in advance to witness test prior to shipment. The Government will install and ground test at each delivery location a representative sample of production deliveries prior to acceptance. (A040 (USAF), DI-MISC-81650, IMS; B040 (FMS), DI-MISC-81650, IMS; A039 (USAF), DI-MGMT-81453A/T, Data Accession List (DAL); B039 (FMS), DI-MGMT- 81453A/T, Data Accession List (DAL))

4.3.1 (U) Production or Modification of Government-Provided End Cap Assemblies The contractor shall design a MEC to support the encryption capability IAW the SRD and IASRD. Utilization of the Government-provided “as is” Digital End Cap Assembly “modification” TDP is at the contractor’s discretion. The contractor shall deliver a revised MEC

TDP based on the final product configuration. (A016 (USAF), DI-SESS-81000E/T, Product Drawings/Models and Associated Lists; B016 (FMS), DI-SESS-81000E/T, Product Drawings/Models and Associated Lists) The contractor shall produce new MEC assemblies or modify Government-provided end cap assemblies (02501900-1 and 02501900-2) to the final MEC configuration. The contractor shall include the new MEC assembly as part of the SSU kit.

The contractor shall assign part number and serial numbers, establish Item Unique Identifications (IUID) to the MECs, and update the IUID Registry to reflect the modification.

4.3.2 (U) Manufacture The contractor’s manufacturing management program shall meet the intent of SAE Aerospace Standard (AS) 6500 as well as the guidance contained in MIL-HDBK-896 to provide a production ready design that meets all SSU requirements, with no degradation of current functional and allocated capabilities. The contractor shall use serial numbers for hardware/software deliverables based on SPO and NSA provided information. The contractor shall provide Government access to contractor facilities and manufacturing documentation pertaining to the SSU.

4.3.3 (U) FMS Considerations In addition to the production on behalf of the USG, this contract scope includes FMS requirements. The procurement and production of any FMS end-items, spares, or technical documentation will be IAW SOW requirements and Contract Data Requirements List (CDRL).

FMS partner nations purchasing SSU kits may require additional non-recurring engineering for country specific requirements as well as on-site contractor installation, integration, test, and demonstration support. There will be a separate Request for Proposal (RFP) for each FMS partner under this contract to define the specific requirements for those efforts, as necessary.

4.3.4 (U) Quantity Discounts If the Government places an additional order for SSU Kits (USAF, FMS, or combination), within 3 weeks of the previous order, both orders will receive the discounted price expressed in the appropriate range of the SSU Pricing Workbook. The expected delivery schedule days will also be adjusted to the range that would satisfy this new quantity amount.

4.4 (U) Technical Data The contractor shall actively participate in working group meetings to support the Technical Manual (TM) and TCTO processes, to include the in-process reviews addressed in the Technical Manual Contract Requirements (TMCR) document. The contractor shall develop new procedures, update existing procedures, certify all TMs and TCTOs, and support Government verifications. The contractor shall ensure the TCTO procedures [to include software, firmware, and hardware changes] support the fielding approach addressed in Paragraphs 4.1 and 4.3. For planning purposes, Government verification will occur prior to the first Government Test Readiness Review (TRR). The contractor shall deliver a TDP, TMs and TCTOs IAW Exhibit T, T001-T004 (USAF) and Exhibit C, C001-C004 (FMS). The government shall have Government Purpose Rights (GPR) as identified in the Government Rights in Data (GRID) attachment to all non-commercial technical data and software delivered under this contract including changes that may be made to the TDP, TMs and TCTOs, unless otherwise asserted.

4.4.1 (U) Distribution of Technical Documents The distribution of technical documentation shall be no less than Distribution Statement D unless otherwise stated in a CDRL or in the provided GFI IAW AFI 61-201. Distribution D denotes authorized distribution to the DoD and DoD contractors only (AFI 61-201 Management of Scientific and Technical Information (STINFO) 29 Jan 2016). If any deliverable is other than Distribution D, the contractor must identify and obtain approval from the Government prior to submission. Technical documentation shall also include appropriate export control and destruction notices.

4.4.2 (U) TO

The government shall have GPR as identified in the GRID attachment to all changes that may be made to the TO and manuals under this contract, unless otherwise asserted. The contractor shall develop, prepare and deliver TO change pages in MIL-STD-38784A, MIL-STD-38807C, and MIL-PRF-5096G format resulting from ECPs. The contractor shall ensure the data supports the USAF two level P5CTS maintenance concept (operation level and depot level) and ensure the TOs are fully sustainable with the configuration of the P5CTS system/equipment’s hardware, software, firmware and operational mission requirements. The contractor shall deliver their Quality Assurance (QA) validated TO change pages No Later Than (NLT) 20 business days prior to the completion of any approved ECP. TO change page procedures must account for and document the support equipment required, provide any commercial TMs referenced if different from existing manuals, and include necessary usable on code identification.

4.4.3 (U) Commercial Manuals/Documents The contractor shall identify and deliver commercial manuals, specification sheets, publications and other documentation related to commercial equipment IAW the TMCR. (T003 (USAF), TM- 86-01P, Commercial Manuals/Documents; C003 (FMS), TM-86-01P, Commercial Manuals/Documents)

4.4.4 (U) Operations and Maintenance (O&M) Training The contractor shall develop an initial training program (hands-on and classroom activities, to include handouts), covering all aspects of SSU applicable to operations, maintenance (e.g., O&M shop personnel), and aircrew personnel. The contractor shall develop a training program with material in sufficient detail to allow for training by field level personnel (A041 (USAF), DI- ILSS-80872/T, Training Material; B041 (FMS), DI-ILSS-80872/T, Training Material)

4.5 (U) Program Management

4.5.1 (U) Program Manager (PM) The contractor shall identify and maintain a PM who shall be the single point of contact for all matters under this contract. This PM shall ensure all tasks are completed. The contractor shall also ensure that all program management personnel assigned to the program shall be available, as required, to meet all SOW requirements. The contractor shall flow down all applicable requirements of this SOW and contract to all subcontractor, suppliers and vendors. The contractor shall maintain and provide all functional support necessary to accomplish the requirements of this SOW. The contractor shall accept system integrator responsibilities for SSU implementation, to include integration into existing Government system infrastructures, ASs, and GSs. This includes implementing changes via minimizing logistical footprint into the existing

Government system infrastructure at operational locations and maintaining interfaces with existing contractor proprietary ICADS and Government JDS. As systems integrator the contractor shall work with Tactical Air Range Integration Facility (TARIF) for incremental engineering software build drops for integration and test efforts associated with TENA, JDS, RADS, and EWS. See Paragraph 4.5.19.10 for RM integration. (A042 (USAF), DI-IPSC- 81434A/T, Interface Requirements Specification (IRS); B042 (FMS), DI-IPSC-81434A/T, Interface Requirements Specification (IRS))

4.5.2 (U) Subcontractor and Supplier Management The contractor shall ensure appropriate flow down of contract requirements and effective management of subcontractor and supplier performance, to include the Data Accession List (DAL) process. The contractor shall establish necessary Associate Contractor Agreements (ACA) to share information, data, technical knowledge, expertise and resources, as required, to ensure contract requirements are met and shall provide copies of ACAs to the SPO. The contractor shall ensure subcontractor and supplier participation in meetings, reviews, and audits.

The contractor shall ensure a focus on identification and management of subcontractor and supplier risks, including nonconforming and counterfeit parts and raw material, and ongoing assessment of conformance to requirements and specifications. The contractor shall provide the Government insight into the performance of key subcontractors and suppliers, as determined by the SPO. (A039 (USAF), DI-MGMT-81453A/T, DAL; B039 (FMS), DI-MGMT-81453A/T, DAL)

4.5.3 (U) Small Business (SB) Utilization Reporting The Government has set an overall small business subcontracting goal (first-tier) of 10% of the total contract value. First-tier Subcontractor is defined as a subcontractor who contracts directly with the prime. The contractor shall deliver a SB Utilization Report to demonstrate the effort in fulfilling the SB subcontracting goals. (A043 (USAF), DI-MGMT-82041B, Small Business Utilization Report)

4.5.4 (U) Monthly Status Report The contractor shall develop a monthly metrics report consisting of general program status, the current status of engineering and integration efforts, each end-item in production, all kits, all spares, and status updates for the ECP. (A044 (USAF), DI-MGMT-80368A, Status Report; B044 (FMS), DI-MGMT-80368A, Status Report)

4.5.5 (U) Integrated Master Schedule (IMS) The contractor shall develop a baseline IMS, based on the contractor’s Integrated Management Plan (IMP), at the start of the program. The IMP is an event driven plan that defines a program’s major tasks and activities and lays out the necessary conditions to complete them. The contractor shall maintain and update the IMS throughout the program, using the original baseline schedule as an unchanging reference. The critical path and secondary critical path shall be delivered as separate and individual views with each submission. The IMS shall be provided in Microsoft Project format.

The contractor shall manage the execution of the SSU program using the IMS as a day-to-day execution tool and to periodically assess progress in meeting program requirements. The execution IMS shall include the activities of the prime contractor and their major subcontractors.

The contractor shall maintain and update the IMS when it is deemed necessary to reflect changes to the ongoing SSU program, subject to PCO approval. The contractor shall report on program progress IAW the IMS at each program management review, at selected technical reviews, and other times at the Government’s request. All contractor schedule information delivered to the Government or presented at program reviews shall originate from the execution IMS. The contractor shall perform appropriate analyses of the execution IMS tasks and report potential or existing problem areas and recommend corrective actions to eliminate or reduce schedule impact. (A040 (USAF), DI-MISC-81650, IMS; B040 (FMS), DI-MISC-81650, IMS).

4.5.6 (U) RM

The contractor, as an integral part of other program processes, shall manage risks (potential future events that may have a negative impact on achieving program objectives), issues (events or conditions with negative effect that have occurred or are certain to occur), and opportunities (potential future benefits in the program’s cost, schedule, and performance) for the program and shall present analysis, mitigations, monitoring and corrective action status at all meetings, reviews, and audits. The contractor shall establish, execute, and sustain a Risk Management Plan (RMP) (A045 (USAF), DI-MGMT-81808, Risk Management Plan; B045 (FMS), DI-MGMT- 81808, Risk Management Plan) The RMP shall, at a minimum:

1) Identify, analyze, mitigate, and track schedule and performance risks, integrating quantitative Risk Assessments (RA)

2) Identify, analyze, manage, and track risks that could impact the outcome of test events

3) Use RA as part of entry and exit criteria for all design reviews

4) Identify effect to Mean Time Between Failure (MTBF), as outlined in the SRD, and show risk mitigation

5) Review current risks as part of each formal Program Management Review (PMR)

6) Review current and new risks as part of any ECP

4.5.7 (U) Government Contract Management Responsibility for Government contracting activities rests solely with the Government PCO. No conversation, recommendations, or direction, whether given directly by, or implied by Government personnel, that will affect the scope, schedule, or price of the program covered by this SOW shall be acted upon by the contractor unless specifically approved by the Government PCO in writing.

4.5.8 (U) Contractor Safety Plan The contractor shall follow a safety plan that outlines compliance with all safety provisions, (e.g., technical specifications, technical publications, and Occupational Safety and Health Administration (OSHA) Standard (Title 29 CFR Part 1910)). If there is no applicable OSHA standard, use other applicable nationally recognized sources of safety, health, and fire prevention standards.

4.5.9 (U) Government Furnished Property (GFP) The contractor shall request all GFP, Government Furnished Equipment (GFE), GFI and Government Furnished Software (GFS) they require to complete the taskings of this SOW prior to contract award. The contractor shall make requests for additional GFP/GFE/GFI/GFS to the

SPO through the PCO NLT 60 days prior to the need date. The SPO will attempt to secure the requested GFP/GFE/GFI/GFS if it can be made available and released for the contractor’s use.

The GFP/GFE/GFI/GFS will be furnished within 30 days of contract award. All GFP/GFE/GFI/GFS is furnished “as is.” The contractor shall manage, maintain, and report accountability and serviceability of all GFP/GFE/GFI/GFS IAW all Federal Acquisition Regulation (FAR), Defense Federal Acquisition Regulation Supplement (DFARS) and Air Force Federal Acquisition Regulation Supplement (AFFARS) clauses contained in this contract and this SOW. The contractor shall meet GFP/GFE/GFI/GFS accountability and reporting requirements consistent with the FAR, DFARS and AFFARS by recording the required data in the Defense Property Accountability System (DPAS) and providing timely inputs to update the Defense Procurement and Acquisition Policy (DPAP) GFP list. (A046 (USAF), DI-MGMT- 80441C/T, Govt Property Inv Rpt; B046 (FMS), DI-MGMT-80441C/T, Govt Property Inv Rpt).

The Government, through the TARIF, will provide updates to the TENA, JDS, RADS, and EWS files/software throughout the program.

4.6 (U) Meetings, Reviews and Conferences The contractor shall be responsible for coordinating, participating in, and supporting all reviews, audits, and meetings as requested by the Government. The meetings will be conducted in person at the contractor’s facility or via teleconference/virtual video conference. The contractor shall arrange for a teleconference/virtual video conferencing if in-person meetings are not feasible due to time constraints or travel restrictions, and shall be coordinated through the Government PM and PCO. The contractor shall resolve issues and action items identified during each event prior to the next review/meeting. The contractor shall afford the Government, with contractor coordination, the opportunity to participate in internal contractor design meetings/reviews via teleconference or in person to clarify requirements and discuss design approach for this effort.

(A052 (USAF), DI-ADMN-81505/T, Report, Record of Meeting Minutes; B052 (FMS), DI- ADMN-81505/T, Report, Record of Meeting Minutes; A051 (USAF), DI-ADMN-81249B/T, Conf Agenda/Presentation Material; B051 (FMS), DI-ADMN-81249B/T, Conf Agenda/Presentation Material) (Note see Paragraph 4.2.6 for other NSA related data deliverables; A010…