VIPER_Industry_Day_Slides_15May2018.pptx

Virtualized Intelligence Platform Engineering & Research (VIPER) Industry Day COR: John Woodruff Alt-COR: Lt Osbert Xiao Contracting Officer: Christopher Scialdone Contract Specialist: Andrea Falcone 15 May 2018

Industry Day Objectives General Session Provide interested companies with an overview of the VIPER effort, including SecureView® program, and an opportunity to gather more information prior to RFP being issued Open forum for Q&A Opportunity to meet with potential teaming partners Afternoon & Wednesday Sessions (One-on-One Meetings)

Acquisition Team PM/Contracting Officer’s Representative (COR) – John Woodruff Alternate COR – Lt Osbert Xiao Contracting Officer – Christopher Scialdone Contract Specialist – Andrea Falcone

Overview Maximum Ordering Amount: $93.6M Anticipated Ordering Period: 60 months Principal Purpose: Operations & Maintenance (O&M) services with integral Research & Development (R&D), to include O&M, R&D, and Procurement requirements Contemplated Contract Type: Single Award Indefinite Delivery Indefinite Quantity (IDIQ) contract with Cost Plus Fixed Fee (CPFF) (Term and Completion) task orders.

Task orders (TO) will be completed within 24 months after the end of the ordering period Award Schedule: Estimated award by April 2019 Contemplate 60 day stand-up phase Anticipate two (2) real orders:

Order 0001 (RDT&E) Order 0002 (O&M)

Market Research Request for Information (RFI): Posted to FedBizOpps on 03 November 2017. Posted to NETCENTS 2 and ALLIANT on 21 March 2018.

10 total responses received, from combination of both small and large businesses Evaluation of responses submitted by small businesses did not warrant establishment of SB set-aside Intend to solicit as full and open competition Contemplate having small business participation as evaluation sub-factor

Contact with myriad of potentially-interested companies, via combination of in-person meetings, phone conversations, and email correspondence

Intend to release DRAFT Request for Proposal (RFP) June 2018, via FedBizOpps DRAFT RFP will include anticipated first two orders Industry will have opportunity to comment/provide feedback in response to DRAFT RFP

Source Selection Procedures Formal Source Selection procedures pursuant to FAR Part 15, as supplemented (Best Value Continuum).

Best Value Tradeoff Source Selection Process (FAR 15.101-1). This process allows for a tradeoff between non-cost factors and cost/price and allows the Government to accept other than the lowest priced proposal or other than the highest technically rated proposal to achieve a best-value contract award. Further, it describes various rating approaches to evaluating proposals when using a tradeoff process.

Prime to be selected based on two awardable orders, to be included in solicitation

Evaluation Criteria Specific Criteria for Award: The factors identified below will be considered during proposal evaluation for the basic IDIQ award. Technical (Factor 1) and Past Performance (Factor 2) are equal and when combined are significantly more important than Cost/Price (Factor 3). However, cost or price will still contribute substantially to the best value award decision.

Technical Evaluation Criteria: The technical factor will be evaluated on the basis of the following subfactors. Subfactors 1, 2, 3, and 4 being of equal importance. Proposals for the basic PWS and Orders 0001 and 0002 will be evaluated together with equal weighting

Factor 1: Technical The technical factor will be evaluated on the basis of the following subfactors:

Subfactor 1: Reseach, Development and Design Engineering Subfactor 2: Deployment and System Support Subfactor 3: Management Approach Subfactor 4: Small Business Participation Factor 2: Past Performance Factor 3: Cost or Price

Factor 1: TECHNICAL Subfactor 1: Research and Development (PWS & Order 0001) Soundness of approach to researching, developing, integrating and testing software/systems for the DoD and IC cross domain communities to include compliance with National Cross Domain Strategy and Management Office (NCDSMO) established community standards Evidence of working knowledge of long-range operational needs, policy limitations, and technological opportunities in the field of multi-level access across multiple security domains Ability to identify candidate R&D opportunities beyond those in progress Soundness of approach to software development methodology

Factor 1: TECHNICAL (cont.)

Subfactor 2: System Support (PWS, Order 0002) Soundness of approach for providing support to operational sites, including methodology for analyzing site problems, monitoring system performance, and maintaining a central maintenance function Maintenance of system and application software Use of software maintenance techniques and configuration management procedures and methods Soundness of approach for deploying Multi-Level Access systems to DoD and IC operational sties Method for providing training on delivered capabilities to operational site personnel that will be responsible for administrating these systems

Subfactor 3: Management Approach (PWS, Orders 0001 & 0002) Soundness of proposed pre-award and post-award approach for adequately staffing and managing multiple complex orders under short, time-critical deadlines, including subcontractor management, control, and utilization Program Management Plan (PMP): identification of tasks required to accomplish the complete program and its relationship to the events, accomplishments, and entry/exit criteria; detailed milestone schedules in the Master Integrated Program Schedule with realistic durations given overall program delivery requirements.

Approach for ensuring TS/SCI cleared personnel and a secure development facility are available Soundness of proposed approach to contract start-up for a maximum sixty (60) day period with minimal disruption to the program and current operations of fielded systems, including dates and procedures for transferring functional responsibilities and development of initial plan to ensure seamless operation

Subfactor 4: Small Business Participation (PWS, Orders 0001 & 0002) The extent, in terms of the value of the total acquisition, to which the Offeror identifies and commits to the use of small business and historically black college or university and minority institution in performance of the contract whether in the form of a joint venture, teaming arrangement, or subcontract.

Past performance of the Offeror in complying with requirements of the Section I clauses at FAR 52.219-8 and 52.219-9 including compliance with subcontracting plan goals, shall be considered.

Factor 2: PAST PERFORMANCE

• Performance assessment will consider data:

Provided by the offeror’s past performance references Independently obtained Ex. CPARS, PPIRS, FAPIIS, industry/commercial sources

• Purpose: allow Government to assess offeror’s ability to perform the effort described in the solicitation based on the offeror’s experience, qualifications, and demonstrated present and past performance

• Process:

Information will be reviewed for recency and relevance to scope, magnitude, and complexity of effort. Of primary interest is work which supported development of intelligence and Cross Domain technology, virtualization, XEN hypervisors, OpenXT, multi-level access, Cross Domain A&A certification for both TSABI and SABI communities, deployment, and maintenance Previous compliance with SB subcontracting and related rules will be considered

Factor 3: Cost or Price The Cost or Price factor will be evaluated to assess the cost of doing business with offerors. Proposed labor categories and rates, both direct and indirect, and any associated fees are analyzed to determine the overall cost of doing business with offerors based upon the following criteria:

Reasonableness - The degree to which proposed cost or price compares to the cost or price a reasonable and prudent person would expect to incur for the same or similar goods or services.

Realism – The degree to which proposed cost or price demonstrates that the Offeror understands the objectives and requirements of the contemplated contract.

Evaluation will consider evidence that the Offeror can successfully complete the requirements for the proposed cost or price.

Evaluation will also consider the degree to which the proposed elements conform to established forward pricing standards and procedures.

Balance – The degree to which the offer contains balanced pricing in accordance with FAR 15.404-1(g).

Evaluation will consider the risks to Government associated with the unbalanced pricing in determining the competitive range and in making the source selection decision, and consider whether award will result in paying unreasonably high prices for contract performance. Offers that are determined to be unbalanced may be rejected if the lack of balance poses an unacceptable risk to the Government.

Milestones Estimated Schedule

Note: Basic IDIQ to be awarded in conjunction with initial orders.

Acquisition Strategy

The Acquisition Strategy Q&A from Industry Day will be posted to FedBizOpps.

To be added to the Interested Parties List posted on FBO or for any questions, please sign up today or email:

Christopher.Scialdone@us.af.mil Andrea.Falcone@us.af.mil

Program Summary Virtualized Intelligence Platform Engineering & Research (VIPER) is the contract vehicle to research, develop, enhance, integrate, deploy, and sustain Multi-Level Access (MLA) security solutions Provide authorized users the ability to securely access information across multiple isolated domains from a single client device Ensure systems protect against unauthorized access or malicious attack Must comply with security standards and enforce separation : zero tolerance for data exfiltration

Current MLA Solution: SecureView® Multi-domain information access that leverages hypervisor technology, providing enhanced security and a consolidated footprint Capable of running multiple guest virtual machines (VMs) running at differing security levels

Respond to unpredictable future requirements for MLA Rapidly growing customer base External information technology trends Ever increasing sophistication of cyber threats

VIPER Mission/Objectives Mission Facilitate the development, deployment, evolution, and sustainment of functional and security requirements yielding multi-level information access solutions through innovative analysis and integration of evolving technologies

Objectives Requirements Compliance Maintain close relationships with Stakeholders to ensure delivery of certifiable user requirement compliant solutions Develop new capabilities while maintaining or even improving robust security architecture for successful Security Assessment & Authorization (A&A) by Top Secret/SCI And Below Interoperability (TSABI), Secret And Below Interoperability (SABI) and other evaluators Operational Support Provide responsive and comprehensive technical engineering, deployment, operations, maintenance, and sustainment to the User community Protect network resources from external and internal threats

Scope VIPER has 3 major focus areas Software development Research & development of new technologies that can be applied to multi-level access (MLA) requirements Enhancements to current SecureView® baseline Meet multi-level security requirements as defined by NIST 800-53 security controls with Cross Domain, Intelligence and Classification overlays Deployment Installation for new customer sites Upgrades for existing customers Assist customer in Assessment and Authorization (A&A) Sustain Level III Help Desk support and ticket tracking Software maintenance to alleviate defect/issue/limitation findings of current technologies Onsite engineering Provide admin and VPN training

VERY DIVERSE PROGRAM REQUIRING A BROAD SET OF SKILLS

Scope (continued) Expected application: Military/Government Purpose Access to classified and sensitive information from various security networks (e.g. SIPRNET, JWICS, coalition networks) from a single client device New capabilities will improve performance to enhance security and functionality to the current, fielded baseline systems Success of this effort is critical to the AF, DoD, and Intelligence Community (IC) mission because it enhances their ability to access mission-critical, time-sensitive information for improved situational awareness and direct mission planning/execution Government Acceptance Testing (GAT) will occur within AFRL/RIE’s Integrated Intelligence Innovation Facility (I3F), Bldg 3 Various agencies conduct formal Cross Domain Security Assessment & Authorization (A&A)

VIPER Technical Components VIPER will provide a multi-level virtual client architecture (i.e. SecureView®) that is built upon the OpenXT open source hypervisor to be integrated into the IC and DoD’s global intelligence network infrastructure

Current SecureView® Development – v3.1 Workstation based on OpenXT stable 8 release Supports 8th gen and previous Intel vPro processors Hardware Compatibility List (HCL) of 50+ platforms Management Server based on Red Hat Enterprise Linux (RHEL) 7 release

Why is SecureView® needed?

Before SecureView® Separate PC required for each security domain After SecureView® Access applications and data from multiple security domains on a single desktop Reduces footprint, power, and admin cost Increases security posture dramatically

VIPER Technical Components (continued) OpenXT Xen Type-1, Bare Metal Hypervisor Minimized Dom0 and dedicated Service Virtual Machines (VMs)

Intel’s vPro Processor & Chipset VT-x: Virtualization Extensions VT-d: Technology for Directed I/O AES-NI: Hardware-based Encryption/Decryption TXT: Trusted Execution Technology TPM: Trusted Platform Module

SecureView® leverages OpenXT and vPro for to improve security and application performance

VIPER Technical Components (continued)

SecureView® Workstation

SecureView® Management Server

SecureView® Development Process Efforts/Tasks defined as Epics in DI2E JIRA Define scope of work, requirements, design, etc

Specify integration target for COR approval and Public Affairs assessment SecureView® OpenXT Other Upstream Products

Scope review performed at Product Binning Meeting to identify target version

Requirements provided by PMO in conjunction with developer and operational sites; reviewed via SecureView® Configuration Control Board (CCB)

Developer provides draft design; design review via SecureView® CCB Design managed via DI2E Confluence pages or JIRA ticket attachments Small efforts with no formal design review should have a defined technical approach

SV Development Process (continued) Leveraging code from the base repositories, software changes are made, reviewed, and published to the respective project locations SecureView® – SCM using git via Bitbucket Code repositories maintained at https://bitbucket.di2e.net/projects/SV/ OpenXT – SCM using git via GitHub Code repositories maintained at https://github.com/OpenXT/

All source code undergoes a peer review at minimum prior to publication of code to the baseline branches Leverage DI2E Pull Request mechanism Leverage DI2E tools such as SonarQube for supplemental code analysis Can leverage external tools for additional analysis and test

SecureView® Development Process Use of feature branches for in-development tasks is encouraged Improves stability of baseline Controls integration into product line May not be appropriate for all development tasks

Upon completion of a feature, a feature is bundled into a regular development release for testing Test cases and event execution are managed using DI2E JIRA/Zephyr

Bugs/Issues encountered are tracked using DI2E JIRA

Prior to product testing, complete Test Readiness Review Assess all know bugs/issues Evaluate completeness of functionality Review development test results and resolutions

Product release testing (Government Acceptance Testing) Test all product functionality Execute all security test procedures Execute ad-hoc tests Evaluate fitness to field

Documentation

Deployment Process System installation and configuration is complex Growing customer base will result in many new installations & upgrades Full turnkey installation to achieve IATO/ATO Site Survey Integration analysis and implementation plan development Configuration to accommodate site required data types Certification & Accreditation documentation and support User and administrative training Installation in accordance with the implementation plan Hardware procurement and installation Support Security Test & Evaluation (ST&E) – one week security assessment Provide post installation quick reaction support

Requires TS/SCI-cleared personnel for most sites

Customer Base

73 operational sites, over 10,000 users Air Combat Command (ACC/A2Y) – DoDIIS Executive Agent AF organizations : 20+ active AF sites DoD Intelligence Information Systems (DoDIIS) Community Department of Homeland Security (DHS) Intelligence Community (IC) National Space Defense Center (NSDC) US Army/Navy Other U.S. Government agencies

Enterprise Deployments Major deployments in progress or under consideration Site D – approx. 30 sites and 2,500 workstations (in progress) Site C – 4 primary sites and 2,300 workstations (in progress) Provided on-site engineer Site P – 10 sites across the theater Site AF – single site with 5,000 users across the command Site AR – up to 80 sites (4 site pilot completed) Site AFG – 5 sites Site M – DoD level coalition sharing environment across 5 hubs with up to 5,000 seats Site N with multi-site NRO tie in (in progress) Provided on-site engineer

Sustainment - Software Maintenance Problem Reports (PR) and Change Requests (CR) Present at monthly Configuration Control Board (CCB) Develop and submit work plans

Quick Reaction Support Respond to sites experiencing problems

Develop periodic maintenance releases Approx. every 6 months Bug fixes, CVEs and security updates

Help Desk Level III help desk, support all deployed versions

Sustainment - Training Support Create and update training curriculum

Developer will be required to maintain comprehensive training facility (unclassified) for hands on administrator training Hands-on training on representative hardware Administrator training Basic Administrator Training / Workstation Provisioning for desktop deployment & help desk personnel Full SV administrator training for Level 2/3 Sys Admins VPN Administrator training for site network engineering staff

Any of above may be delivered to customer sites via mobile training kit

Sustainment - Onsite Engineering SecureView® full time onsite engineers to provide enterprise deployments and integration into unique customer environments TBD at customer locations on an order by order basis Currently providing onsite engineering to AFLCMC at Lackland and National Space Defense Center (NSDC) at Schriever Future sites likely to include OCONUS Must be cleared to the level of the site deployment The effort will also focus on SV integration, deployment, and sustainment activities within the customer enterprise. On-site engineering input provided will consist of, but is not limited to, the following:

Resolve administration and management issues with SV SV training activities at site Provide SV outreach, including briefings and demonstrations, within site Assist sites in their SV A&A package Site application engineering, integration, and testing in the SV environment

Risks

VIPER Technical Read Library Available now

The library contains technical data subject to export control

Potential Offerors who wish to gain access will be required to sign a Non-Disclosure Agreement (NDA), as well as furnish a copy of their company's DD Form 2345 - Militarily Critical Technical Data Agreement along with a letter from their Data Custodian designated on that form authorizing access by whomever will be reviewing the library. If interested in access to the technical library please contact 1st Lt. Osbert Xiao by phone at (315) 330-7637, or email at osbert.xiao@us.af.mil.

VIPER Read Library Contents Development Applicable Documentation Links.docx Reference Documentation Links.docx SV_30_SystemRequirementSpecification_SRS.pdf Deployment Deployment-Process-v13 FINAL.docx SiteSurvey_Template_31Jan18.xlsx SV_30_SVMgmtServerAdminGuide_SVMSAG.pdf SV_30_SVMgmtServerInstallationConfigurationGuide_SVMSICG.pdf SV_30_WorkstationInstallationConfigurationandAdminGuide_WICAG.pdf SV_30_WorkstationUserGuide_WUG.pdf SV_3.0 Virtual Lab Environment (VLE) Sustainment SV_CCBWorkflow.pdf SV_CCBWorkflowSteps.docx Training SecureView_UA_Training_July2017.pdf SecureView_VPN_July2017.pdf UA_Training_Agenda.pdf VPN_Training_Agenda.pdf

Questions?

Applicable Documents

Intelligence Community Directive (ICD) 503, Intelligence Community Information Technology Systems Security Risk Management, Certification, and Accreditation, 15 September 2008.

CNSSI 1253, Security Categorization and Control Selection for National Security Systems, March 2014 NIST Special Publication 800-53 Rev 4, Assessing Security and Privacy Controls in Federal Information Systems and Organizations, April 2013 NIST Special Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems, December 2014 NIST Special Publication 800-37 Rev 1, Guide for Applying the Risk Management Framework to Federal Information Systems FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems, February 2010 DoDIIS Joint Security Implementation Guide (DJSIG), August 2011 DoD Instruction 8540.01, Cross Domain Policy, May 2015 USGCB Settings, http://usgcb.nist.gov/usgcb/documentation/USGCB-Settings-Major-Version-1.0.x.0.xls Citrix XenApp STIG Ver 1, Release 1.2, Dated October 2009 Web Server STIG Version 7, Release 1, Dated September 2010 AFRL/RIEB Lifecycle Engineering Technical Support (LETS) Configuration Management Plan (CMP) Version 4.0, dated 1 September 2010 NSA Commercial Solutions for Classified (CSfC) capability packages, https://www.nsa.gov/resources/everyone/csfc/ NSA Commercial Solutions for Classified (CSfC) “Multi-Site Connectivity Capability Package” Ver 1.0, dated February 2017 or subsequent version NSA Commercial Solutions for Classified (CSfC) “Mobile Access Capability Package” Ver 2.0, dated August 2017 or subsequent version NSA Commercial Solutions for Classified (CSfC) “Data at Rest Capability Package” Ver 3.0, dated March 2016 or subsequent version National Information Assurance Partnership (NIAP) Protection Profiles for US Government, http://www.niap-ccevs.org/pp/

Applicable Documents (continued) Debian Security Advisories, https://lists.debian.org/debian-security-announce/ StrongSwan Advisories, https://lists.strongswan.org/mailman/listinfo/announce Cisco/AnyConnect Advisories, CiscoTechnical Assistance Center Citrix Receiver for Linux, http:support.citrix.com/search?searchQuery=%F&lang=en&sort=cr_date_desc&prod=&pver=&ct=Security+Bulletin VMware Horizon View Client, http://www.vmware.com/security/advisories RDP Client,https://lists.sourceforge.net/lists/listinfo.freerdp-devel RHEL Errata List, https://redhat.com/errata/ NIST CVE Vulnerabilities List, https://nvd.nist.gov/download.cfm CVE List Main Page - Common Vulnerabilities and Exposures, https://cve.mitre.org/cve/ National Vulnerability Database, https://nvd.nist.gov/ CERT Knowledgebase, http://www.cert.org/vulnerability-analysis/knowledgebase/index.cfm US - Computer Emergency Readiness Team, https://www.us-cert.gov/ Xen Security Advisories, http://xenbits.xen.org/xsa/ Symantec - Security Response Vulnerabilities, http://www.symantec.com/security_response/landing/vulnerabilities.jsp Vulnerability & Exploit Database | Rapid7, http://www.rapid7.com/db/modules/ Security Tracker, http://securitytracker.com/archives/summary/9000.html Red Hat vulnerabilities by CVE name, https://access.redhat.com/security/cve/ Microsoft Security TechCenter - Security Bulletins, https://technet.microsoft.com/en-us/library/security/dn631937.aspx Internet Storm Center - Internet Security | SANS ISC, https://isc.sans.edu/ VISTA Penetration Study (Vulnerability Internet Security Testing Audit), http://www.internetbankingaudits.com/list_of_vulnerabilities.htm SecLists.Org Security Mailing List Archive, http://seclists.org/ image3.png image1.png image2.png image4.jpeg image5.jpeg image6.jpeg image7.png image8.png image9.png