(U) ATTACHMENT 1 - DRAFT TECHNICAL REQUIREMENTS.pdf

UNCLASSIFIED

DRAFT CSO Call 5 – “Project Marine Duck”

Attachment 1 – DRAFT Technical Requirements 13 November 2024

ATTACHMENT 1 – DRAFT TECHNICAL REQUIREMENTS

I. GENERAL TECHNICAL REQUIREMENTS: The following general technical requirements must be met during the performance of this program:

1. For all potential Phases, the following requirements apply for the deliverable/prototype:

a. The deliverable/prototype must be an innovative DISA accredited hybrid cloud, cloud native network, or “environment” to host modern software development, with focus on C++ and collaboration tools.

b. The developed environment shall, to the maximum extent practical, be compliant with the latest version of the DoD DevSecOps enterprise reference design as located at:

https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSec Ops%20Reference%20Design%20v1.0_Public%20Release.pdf

2. For all potential Phases, the following requirements apply to the contractor/performer’s performance in the contract/agreement:

a. The environment shall meet DoD cloud computing security requirements to support (e.g., store and process) ITAR designated information.

b. The contractor/performer shall support any collaboration and configuration changes necessary to support data transfer, to include the instantiation of Data Transfer as a Service (DTaaS).

c. The contractor/performer shall provide all licenses, hardware, software, and platform engineering manpower to build, secure, deploy, sustain, update, and scale the environment.

d. The contractor/performer shall employ U.S. citizens ONLY. Network administrators and cybersecurity professionals must possess an active DOD SECRET clearance, at minimum, and possess a Security Plus or other COMPTIA compliant certification.

e. To the maximum extent possible, the contractor/performer shall utilize DoD enterprise contracts, such as Joint Warfare Cloud Computing (JWCC) to acquire and maintain cloud resources, as applicable.

f. The contractor/performer shall implement a VDI solution allowing AFLCMC partners to have access to the environment via AFNET.

https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf

g. The contractor/performer shall ensure AFLCMC has the ability to, via a data transfer agent, remove data and data products from the environment.

h. The contractor/performer shall provide continuous support for the developed environment, including, but not limited to performing maintenance, conducting updates, and expanding the environment. Specifically, the continuous support shall be comprehensive and include, but is not limited to, on-call tiered help desk support, best-practice patching, license management, continuous cybersecurity compliance, continuous reevaluation of processes improvements that maximize automation to the greatest extent possible, and consultation/advising on future environment projects.

3. The following requirement applies to the prototype/deliverable for Phase II (and potential subsequent Phase) performance:

a. The developed environment must be able to accommodate edge devices (Ex: a gaming tower) for local compute and store and/or testing. AFLCMC has particular interest in vendors who can provide pre-configured and STIGGED hardware to AFLCMC and external contractors/performers. The contractor/performer shall detail its ability to do so in the scalability plan deliverable for Phase I.

4. The following requirements apply to the contractor/performer for Phase II (and potential subsequent Phase) performance:

a. The contractor/performance shall maintain an IT inventory management process in support of edge devices.

b. The contractor/performer shall maintain live dashboards to report resource utilization and environment performance. Dashboards shall be numerous and customized to the needs of individual user types and roles.

5. The following are not requirements applicable to this specific Call, but are technical objectives for any potential subsequent Phase following Phase II:

a. When the environment is fully scaled, AFLCMC desires a contractor/performer-provided help desk from 0700-2200 ET for the environment that provides support for access requests, group management, onboarding, general IT issues/questions, new capability and feature requests, account issues, and application issues.

b. For ongoing performance following Phase II, AFLCMC desires a contractor/performer provided and maintained knowledge base that provides relevant instructions, information, and training resources to support users (i.e.

onboarding, tool catalog, tool support resources, technical support and how-to guides).

c. For ongoing performance following Phase II, AFLCMC desires contractor/performer continuous support to identify, propose, coordinate, and implement continuous environment improvements.

II. USER-SPECIFIC REQUIREMENTS:

1. The following requirement applies to the deliverable/prototype for Phase I:

a. The environment shall be capable of hosting up to 10 concurrent AFLCMC users, at minimum.

2. The following requirements apply to the deliverable/prototype for Phase II:

a. The environment shall be capable of hosting up to 50 users, to include both

AFLCMC and third-party contractor users, at minimum.

b. The environment shall be capable of hosting up to 40 concurrent users (to include both AFLCMC and third-party contractor users), at minimum.

3. The following requirements apply to the deliverable/prototype for all Phases:

a. The environment shall be capable of having all of the following:

o “General users” with limited permissions to perform work o “Power users” who have application-level permissions o “Super users” who have network level permissions o “Administrative users” who have kernel-level permissions for on-prem hardware o “Monitoring users” with minimal permissions restricted to limited read accesses

b. The environment shall support role-based permissions (e.g., Program Manager (PM developer, and project lead). Specifically, users shall be allocated licenses only for the tools required by their role within the environment.

4. The following requirements apply to the contractor/performer for all Phases:

a. The contractor/performer shall be able to identify and segment user groups by data distribution and dissemination controls.

b. The contractor/performer shall be able to identify and segment user groups by company and organization.

c. The contractor/performer shall create and implement a user onboarding process, which maximizes automation to the greatest extent practical.

d. The contractor/performer shall create and implement a user validation process, which will check if a person possesses an active security clearance or a positive tier 1 background check. This validation process shall also validate, via USG and/or contractor confirmation, approval for account creation.

III. TOOLING AND LICENSING SPECIFIC REQUIREMENTS:

1. The following tooling and licensing general requirements apply to the deliverable/prototype for all Phases:

a. The developed environment shall be capable of hosting industry standard DevOps tools including, but not limited to: (1) source code management; (2) Continuous Integration/ Continuous Deployment (CI/CD) pipelines; (3) configuration management; (4) containerization and orchestration; (5) monitoring and logging and (6) security and compliance. Examples of acceptable industry standard DevOps tools include Gitlab, Nessus, Purefile, and Sonarqube.

b. The developed environment shall be capable of hosting industry standard engineering and data analytics tools including, but not limited to: (1) model-based systems engineering; (2) computer-aided design; (3) product lifecycle management; (4) simulation tools; (5) data analysis and visualization and (6) collaboration and communication. Examples of acceptable industry standard engineering and data analytics tools include Cameo Systems Modeler, Teamwork Cloud, and Matlab.

c. The environment shall be capable of hosting industry standard real time collaboration including, but not limited to various productivity applications and multimedia communication (e.g., video, voice, and content sharing for dial in and teleconferencing). Examples of similar products include Microsoft Office, Atlassian Suite, Mattermost, Skype, Teams, Teams, Zoom Gov, and Cisco CMS.

d. The environment shall be capable of hosting an isolated email server, accessible to only those in the environment.

2. The following tooling and licensing requirement applies to the contractor/performer performance for Phase I:

a. The contractor/performer shall utilize trial licenses or Joint Enterprise License

Agreements (JELAs) to demonstrate the contractor/performer’s ability to host applications to the maximum extent practical.

3. The following tooling and licensing requirement applies to the deliverable/prototype performance for Phase II and any potential subsequent Phase following Phase II:

a. The developed environment shall be capable of either first- or third-party management of licenses, networking, and cloud resources, as applicable.

4. The following tooling and licensing requirement applies to contractor/performer performance for Phase II and any potential subsequent Phase following Phase II:

b. The contractor/performer shall maintain dashboards specifically for license utilization.

IV. CYBERSECURITY SPECIFIC REQUIREMENTS:

1. The following cybersecurity requirements apply to the deliverable/prototype for all Phases:

a. The environment shall embrace, to the maximum extent practical, the latest USAF

Zero Trust architecture practices and policy (ZTA). A recent copy can be found here:

https://www.safcn.af.mil/Portals/64/Documents/Strategy/DAF%20Zero%20Trust %20Strategy%20v1.0%20(002).pdf

b. The environment shall be, to the maximum extent practical, logically isolated from the internet.

c. The environment shall employ and be compliant with latest National Institute of

Standards and Technology (NIST) (https://www.nist.gov/) and Federal Information Processing Standards (FIPS) (https://csrc.nist.gov/pubs/fips/140- 3/final) requirements for network security and encryption, at the DISA specified-impact level to accommodate Controlled Unclassified Information (CUI) and International Traffic in Arms Regulations (ITAR) data.

d. The environment shall be capable of having segmented project spaces which can securely protect intellectual property, ITAR information, and obfuscate vendor relationships with one another, when directed by the USG.

e. The environment shall be capable of securely hosting personally identifiable

Information (PII).

f. The environment shall have an ability safely and rapidly ingest commercial off the shelf (COTS), government off the shelf (GOTS), and open-source software (OSS) and associated dependencies.

https://www.safcn.af.mil/Portals/64/Documents/Strategy/DAF%20Zero%20Trust%20Strategy%20v1.0%20(002).pdf https://www.safcn.af.mil/Portals/64/Documents/Strategy/DAF%20Zero%20Trust%20Strategy%20v1.0%20(002).pdf https://www.nist.gov/ https://csrc.nist.gov/pubs/fips/140-3/final https://csrc.nist.gov/pubs/fips/140-3/final

g. The environment shall implement two-factor authentication (2FA). The contractor/performer shall detail the 2FA plan in the scalability plan deliverable at the end of Phase I.

h. The environment shall have keystroke-level traceability via log and event management (LEM). The contractor/performer shall explain their LEM strategy in the scalability plan deliverable at the end of Phase I.

2. The following cybersecurity requirements apply to the contractor/performer’s performance for all Phases:

a. The contractor shall maintain a continuously compliant NIST compliant Authority to Operate (ATO) package subject to request and review by the Government at any time.

3. The following cybersecurity requirements apply to the contractor/performer’s performance for Phase II and any potential Phases following Phase II:

a. The contractor/performer shall allow AFLCMC or an AFLCMC-designated third party contractor to perform regular and re-occurring penetrative assessments on the developed environment. The contractor/performer shall patch, or by AFLCMC approval-only, mitigate all security relevant findings within 30 days of USG notification.

b. The contractor/performer shall implement a security incident response plan. The contractor/performer shall detail its incident response plan in the scalability plan deliverable at the end of Phase I.