A2. Agile Cyber Tech 3 Umbrella 20200728.docx

G-2-XXXX

AIR FORCE RESEARCH LABORATORY

ROME RESEARCH SITE

ROME, NEW YORK

STATEMENT OF WORK

FOR

AGILE CYBER TECHNOLOGY 3

PCSN G-2-XXXX

28 JUL 2020

ATTACHMENT 2

SOLICITATION NO. FA8750-20-R-1004

TABLE OF CONTENTS

2.0 SCOPE 3

3.0 BACKGROUND 3

4.0 TECHNICAL REQUIREMENTS 9

1.0 OBJECTIVE:

1.1 The objective of this effort is to provide a focused yet flexible, rapid contracting vehicle between Air Force Research Laboratory (AFRL), its Products Centers, and the Operational Community to support rapid research, development, prototyping, demonstration, evaluation, and transition of cyber capabilities. Emphasis will be placed on: a) development of technology capability solutions that address specific user requirements; b) delivery of prototype technologies for evaluation and feedback in the context of the user’s operational environment; and c) provision of a mechanism for user acquisition of limited product quantities required for operational introduction of technologies.

2.0 SCOPE:

2.1 The scope of this effort is to perform multiple activities necessary to achieve AFRL’s Science and Technology (S&T) vision of cyber superiority. This includes activities for rapid development, design, prototyping, demonstration, scenario development, experimentation & evaluation, integration, testing, technical installation, transition, and support through initial operations of cyber technologies, which enable Global Vigilance, Global Reach, and Global Power in air, space, and cyberspace for:

1. Cyber Threat Avoidance & Cyber Defense

2. Full Spectrum Cyber Operations

3. Cyber Network Exploitation

4. Cyber Situational and Mission Awareness

5. Cyber Command & Control

6. Cyber Modeling, Simulation, & War Gaming

7. Cyber Infrastructure

8. Cyber Mission Assurance

2.1.1 The AFRL Core Technical Competencies (CTCs) relevant to the effort are: 1) Autonomy, Command and Control, and Decision Support, 2) Processing and Exploitation, 3) Connectivity and Dissemination, and 4) Cyber Science and Technology.

3.0 BACKGROUND:

3.1 Joint Publication 1-02 defines cyberspace as a global domain within the information environment consisting of the interdependent network of information technology infrastructures, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers.

3.1.1 Cyberspace operations are defined as the employment of cyber capabilities where the primary purpose is to achieve military objectives or effects in or through cyberspace. Such operations include computer network operations and activities to operate and defend the Global Information Grid. From an S&T perspective, operations in cyberspace occur whenever signals affect intelligent systems. This S&T view breaks cyber operations into three components: a) the effectors include a broad range of signal-borne threats, analog or digital, electronic or electromagnetic; b) the medium encompasses all means of signal delivery, wired or wireless, software or hardware; and c) the targets include all weapons and systems that use computers or networks.

3.1.2 Cyberspace is as relevant a domain for DoD activities as the traditional domains of land, sea, air, and space. The growing dependence of Air Force operations on cyber capabilities makes cyberspace a “center of gravity” and ideal target for any adversary.

3.1.3 The information technology infrastructure on which Air Force missions depend is controlled by both military and commercial entities and is vulnerable to attacks and manipulation. As operations in cyberspace have the ability to impact operations in all other warfighting domains, it is essential the Air Force preserve the ability to operate when the generation, processing, storage, transmission, and consumption of vital information is challenged.

3.2 The USAF vision of Global Vigilance, Global Reach and Global Power across the full spectrum of conflict from peacetime to major combat operations drives the S&T requirements for cyber operations. Figure 1 illustrates the changing requirements for vigilance, reach and power as tensions escalate towards combat. Within this context, cyber operations provide a necessary enabler for Air and Space power, while providing an additional domain where the USAF can deliver effects.

The S&T requirements for cyber operations do not focus solely on conducting operations in cyberspace, but rather look holistically at the cyber S&T necessary to accomplish the USAF vision of Global Vigilance, Global Reach and Global Power in all three domains of Air, Space and Cyberspace.

Cyberspace is first and foremost a foundational domain that enables US military superiority, and secondarily another domain where the US can deliver effects. Through cross domain dominance, operations in cyberspace can guarantee freedom of maneuver and assure mission essential functions (MEF) in all war fighting domains.

3.2.1 Global Vigilance. Global Vigilance refers to the persistent world-wide capability to keep an unblinking eye on any entity, to provide warning on capabilities and intentions, and to identify requirements and opportunities. The primary challenges of Global Vigilance include maintaining persistent, global, situational awareness using assured, trusted systems that can avoid a broad spectrum of threats. In turn, Global Vigilance depends to some extent on elements of Global Reach to support sensor positioning and forward basing of assets for situational awareness. Situational awareness, information and mission assurance, and threat avoidance are three main capabilities necessary to achieve Global Vigilance in and through cyberspace.

3.2.2 Global Reach. Global Reach describes the ability to move, supply and position assets with unrivaled velocity and precision anywhere on the planet. The concepts that support global reach in cyberspace include access technologies to position and deploy cyber assets, survival in a contested cyber environment, and cross-domain superiority for command and control of integrated mission execution. Global Reach is enabled through predominantly defensive measures when tension pushes a situation away from peace towards conflict. In turn, these predominantly defensive measures enable the capabilities that support Global Power in the event of conflict escalation into major combat operations.

3.2.3 Global Power. Global Power enables the US to affect any asset, anywhere in the world, at a time of our choosing, and to project swift, decisive and precise effects. Delivery of Global Power in any war fighting domain requires command and control of cyberspace, on which modern US military capability depends. The global projection of cyber power creates unique S&T challenges of developing precise cyber capabilities, estimating first, second, and higher order effects, and responding actively to external events.

3.2.4 Integrating Global Vigilance, Global Reach and Global Power to Achieve Cyber Superiority. The US Air Force vitally depends on cyberspace to achieve its vision of Global Vigilance, Global Reach and Global Power. Further, the USAF projects differently Global Vigilance, Global Reach and Global Power at various stages of tension across the spectrum of conflict. Global Vigilance at peacetime requires persistent situational awareness in all domains, mission and information assurance, and threat avoidance through deterrence and technology. Global Reach requires access to the battle space, survival and fighting through cyberspace attacks, and integrated planning of mission essential functions and their dependence on cyberspace. Global Power calls for predominantly combat operations enabled through the delivery of precision effects in cyberspace, reliable effects assessment and automated response action. Global Vigilance, Global Reach, and Global Power capabilities must all work together to realize the cyber superiority vision.

3.3 S&T for Cyber Superiority

3.3.1 Threat Avoidance & Cyber Defense. Defensive cyber technologies are those that guarantee the successful execution of MEF in a contested environment. Cyber defense seeks to avoid as many threats and attacks as possible by mitigating vulnerabilities, disrupting threats, and assuring missions. A goal is to deliberately design the cyber domain in order to favor defense and eliminate opportunities for attacks. Attacks will be avoided by way of agile systems that can evade and escape attacks. Advanced cyber defensive technologies will purposely misdirect the adversary, manipulating their perception of friendly systems and disrupting attack planning.

3.3.1.1 When attacks cannot be avoided, critical systems must be built with the ability to “fight through” successful attacks. The requirement will be at a speed that supports the minimum allowable continuity of MEFs, thus enabling successful completion of the mission despite attackers’ varying degrees of success. It should be noted that a successful “fight through” capability may go beyond the use of traditional network defense mechanisms such as intrusion detection systems (IDS), event correlation, visualization, attribution, etc., because none of these directly support the successful completion of a time-critical MEF.

3.3.1.2 Preserving continuity of operations requires that cyber defense systems include a longer-term ability to sense, fuse, attribute, understand and project the cyber situation and its impact on future missions. This awareness must then be used to actuate systems, configurations, architectures, and dependencies in order to maximize the ability to guarantee future missions.

3.3.2 Full Spectrum Cyber Operations enable the impact of any asset, anywhere in the world, at any time to project swift, decisive, and precise effects.

3.3.3 In Network Exploitation, current automated sensors are capable of collecting a vast amount of data, far more than can be processed by analysts. Efficient automatic/semi-automatic tools and methods to rapidly ascertain the highest interest information are paramount to the success for intelligence production.

3.3.4 Situation and Mission Awareness. The strategic objective of cyber situation and mission awareness (SA/MA) is to provide automated situation and mission assessment and analysis that meet the operational requirements of all areas within the cyber domain – friendly systems and missions, traversal neutral systems or global commons and adversary systems – across the entire spectrum of conflict – from peacetime to major combat operations. Mission awareness lies at the heart of SA. Understanding the dependence of missions on specific assets, the interdependence of assets and the interdependence of missions drives the requirements for SA.

3.3.5 Command and Control (C2). Cyber operations can be conducted at any level of war and across the entire spectrum of conflict in support of global and theater objectives. Global C2 provides a persistent, 24/7, collaborative environment comprised of people, processes, systems and tools to enable timely response to today’s asymmetric challenges. Global C2 ties real-time intelligence, collaborative planning and decision making to support a broad mix of military options – offensive, defensive, kinetic and non-kinetic. C2 capabilities for monitoring, assessing, planning, and executing cyber operations need to be designed, developed, and implemented to integrate with existing air and space capabilities using information sharing across multiple security classification domains.

3.3.5.1 Many parallels exist between operations in the more traditional domains of air and space and in the emerging domain of cyberspace. As capabilities are integrated, planning requirements for cyber assets mirror those for traditional Intelligence, Surveillance, and Reconnaissance (ISR) and combat assets. The practice of procedural versus positive control over air assets and the time scales of the Air Operations Center (AOC) do not translate well to cyberspace where decision cycles hover around a fraction of a second. Conversely, placing cyber assets under procedural control requires the incorporation of a set of previously agreed upon rules for a broad range of future scenarios. Integrated planning must take into consideration the challenges of cyberspace de-confliction, Identification of Friend or Foe (IFF) procedures and the potential of cyber fratricide and cross-domain fratricide. The ability to tag and identify cyber assets, and to continuously ascertain their status and integrity creates technical challenges unique to cyberspace.

3.3.5.2 Simply porting technologies developed for C2 in the air and space domain may not be directly applicable or useful in the cyber domain. Furthermore, the integration of non-kinetic assets with kinetic assets and the effects they produce are at a formative stage. With these two concepts in mind, novel and unique approaches to enable C2 in an environment that is not constrained by time, distance, and geographical boundaries are required.

3.3.6 Cyber Infrastructure. Cyber infrastructure consists of the underlying technologies that are crucial for cyber superiority. The concepts of correctness and acceptability are at the core of cyber infrastructure. Correctness is a theoretical concept motivated by the "computational" side of cyber. Cyber does not exist without computation. Acceptability is the practical side of cyber. It is motivated by the rest of the infrastructure. If infrastructure is defined as being composed of computing, communications, physical, and human components, then correctness is concerned with computing and communications. Acceptability is concerned with the physical and human components. Cyber Infrastructure includes all levels of granularity, ranging from individual circuits to systems of systems. The concepts of correctness and acceptability are at the core of cyber infrastructure, expecting applications to match the appropriate level of granularity for the cyber infrastructure in question.

3.3.6.1 Due to the efforts of many mathematicians and computer scientists, computing can either be an art or a science. When relegated to the art form, individuals or organizations simply specify, design, implement, and deliver hardware and software that operates, but much remains unknown about the system. As such, bugs and vulnerabilities are often reported and have the potential to be exploited by the adversary.

3.3.6.2 On the other hand, correctness is science. It is a careful application of formal methods. Correctness is a proof of a certain conclusion based on assumptions and premises. It also coincides with the different stages of the system life cycle. Correctness during the Design phase guarantees the design meets the specifications. If mission assurance properties appear in the original specification, the design must correctly meet those specifications. Correctness during the Implementation phase ensures the same mission assurance properties are met.

3.3.6.3 Correctness by itself is inadequate. For example, it is extremely difficult, if not impossible, to prove that a system in the Operations and Maintenance (O&M) phase of the lifecycle is equivalent to the implementation itself. What might be proven is that the system maintains its correctness if the underlying assumptions of the proof during the Research and Development phase were never violated. This is where acceptability comes in. Acceptability is concerned with practice, whereas correctness is a strict embodiment of theory. Acceptability is the notion of whether the physical and human infrastructures continue to enforce proven assumptions. This is a drastic departure from traditional cyber initiatives that work system development from the top-down.

3.3.6.4 In the top-down model, assumptions made during the Specification, Design or Implementation phases are incorporated into a usage policy. This policy is then forced on the users during O&M without knowledge of whether the policy will or can be enforced. In the bottom-up model, knowledge about the eventual users (human psychology in general) and operating environments where the systems will be used guide the assumptions that can be made. Much of this already takes place during the Requirements Gathering phase. If the same process is extended to the other stages of the system life cycle, especially the O&M phase, then the system further achieves acceptability. The most difficult aspect of acceptability is the ability to ascertain the expected human behavior, express it in the form of a formal language used in the correctness proofs, and then re-verify the same system under the new assumptions.

3.4 REFERENCE DOCUMENTS:

1. Joint Publication 1-02, Department of Defense Dictionary of Military and Associated Terms, 12 April 2001 (as amended through 15 February 2016)

2. Jabbour, Dr Kamal, “The Science & Technology of Cyber Operations,” High Frontier Journal for Space & Missile Professionals, May 2009, Volume 5, Number 3.

3. Defense Science Board Summer Study on the Challenges to Military Operations in Support of National Interests, 2007.

4. White House Cyberspace Policy Review, May 2009.

4.0 TECHNICAL REQUIREMENTS.

4.1. The Contractor shall accomplish the following on an order by order basis. The requirements for each order may encompass rapid Research & Development (R&D), design, prototyping, demonstration, scenario development, experimentation and evaluation, enhancement, integration, testing, technical installation, transition, and support through initial operations of cyber technologies, which are relevant to the following CTCs: 1) Autonomy, Command and Control, and Decision Support, 2) Processing and Exploitation, 3) Connectivity and Dissemination, and 4) Cyber Science and Technology.

4.1.1 Cyber Threat Avoidance & Cyber Defense

4.1.1.1 Research, develop, enhance, and integrate capabilities to secure and defend critical assets from cyber threats and cyber-attacks.

4.1.1.2 Perform leading edge research, development, enhancement, and integration to advance, demonstrate, and implement technologies and concepts to support mission-based cyber defense including techniques to avoid cyber-attacks by mitigating vulnerabilities and disrupting threats, ability to fight through unavoidable attacks in “mission time”, and assure mission essential functions are able to be conducted during an attack.

4.1.1.3 Provide a dynamic cyber defense to recover the sensors, processors, servers, networks, systems, and applications to an operable state following a successful adversary attack. Incorporate survivability, graceful degradation, and reconstitution as part of the recovery process.

4.1.1.4 Design, develop, and demonstrate wireless network defense capabilities, including wireless intrusion detection systems, detection of passive sniffers, defense against jammers, active response techniques, application of software defined radio technology to information assurance, and distributed and collaborative boundary control. Address wireless and Internet Protocol Version 6 (IPv6) standards.

4.1.2 Full Spectrum Cyber Operations

4.1.2.1 Research, develop, enhance, and integrate cyber capabilities to affect adversary perceptions, reactions, and ability to conduct operations.

4.1.2.2 Research, develop, enhance, and integrate capabilities to facilitate freedom of operation in cyberspace while denying adversaries the same ability.

4.1.3 Cyber Network Exploitation

4.1.3.1 Research, develop, enhance, and integrate technologies that provide Signals Intelligence, Imagery Intelligence, Computer Network Intelligence, Cyber Intelligence, Measurement/Signature Intelligence, and other relevant intelligence to achieve information dominance through processing of data from intelligence sensors.

4.1.3.2 Reduce the workload of the Intelligence Surveillance and Reconnaissance (ISR) operator/analyst by developing automated processes to identify, extract, analyze, correlate, sort and report information for further intelligence analysis, collection mission management, and warfighter action.

4.1.4 Cyber Situational and Mission Awareness

4.1.4.1 Research, develop, enhance, and integrate techniques and tools for automated situation and mission analysis and assessment for friendly cyber systems and missions, forces, neutral systems, and adversary systems across the spectrum of conflict – from peacetime to major combat operations. Develop cyber SA/MA capabilities such that they are able to be integrated with air and space SA capabilities.

4.1.4.1.1 Investigate, model, and develop a comprehensive SA/MA model for friendly cyber systems and missions that includes health, status, and contingency planning.

4.1.4.1.2 Develop data and models for awareness of adversary and neutral cyber systems.

4.1.4.1.3 Integrate knowledge base technology, data fusion to include text analytics, and forensics to achieve enhanced cyberspace situation and mission awareness.

4.1.4.1.4 Visualization of cyber data. Provide the capability to move seamlessly between geospatial and non-geospatial data to enable integrated decisions over the air, space, and cyber domains. Provide the capability to correlate and fuse cross-domain information on cyber, air, and space assets and graphically display the information in a Global Common Operating Picture (COP). Implement the capability to tailor and filter the information from the Global COP into a User Defined Operational Picture (UDOP).

4.1.5 Cyber Command & Control

4.1.5.1 Research, develop, enhance, integrate, demonstrate, experiment, and evaluate cyber C2 technologies and techniques to improve cyber C2 capabilities and integration of these capabilities with existing kinetic processes for Air Force systems. These technologies and techniques may address the following:

4.1.5.1.1 Collaborative planning, execution, and assessment of global integrated mission packages across multiple areas of responsibilities (AORs)

4.1.5.1.2 Courses of action for integrated, multi-domain effects that cross multiple AORs

4.1.5.1.3 Comprehensive modeling, simulation, and war gaming capabilities that provides realistic cross-domain (air, space, and cyberspace) representations and depictions

4.1.5.1.4 Synchronized tasking of air, space, and cyberspace assets arranged in time and space (physical and virtual)

4.1.5.1.5 Characterization of cyber assets for cyber effects and mission representations

4.1.5.1.6 Friendly Order of Battle (FROB) depictions for all air, space, and cyber assets in use during the various phases of planning and execution

4.1.5.1.7 Operational assessments of integrated air, space and cyberspace effects

4.1.6 Cyber Modeling & Simulation

4.1.6.1 Research, develop, enhance, and integrate cyber models for simulation of appropriate environments to support complex Course of Action (COA) evaluation within the cyberspace domain and across the air, space, and cyberspace domains. Develop the cyber models and simulations such that they are interoperable with existing air and space modeling & simulation environments, and improve the realism of cyber components in air and space models.

4.1.7 Cyber Infrastructure

4.1.7.1 Research, develop, enhance, and integrate technologies to establish the correctness of cyber infrastructure, including sensors, computers, servers, networks, and systems. Include both the correctness of systems that are built from scratch and systems whose correctness needs to be established after the fact.

4.1.7.2 Research, develop, enhance, and integrate technologies to establish the correctness of the communications infrastructure, including software application programmer’s interfaces.

4.1.7.2.1 Prove the correctness of existing networking protocols. Develop tools and techniques for new protocols. Research techniques for taking protocol specifications and automatically generating the equivalent source code to prove the source meets the protocol specification.

4.1.7.3 Design and identify means and methods for assessing the impacts of technologies to physical infrastructure.

4.1.7.4 Research and develop theories and methods for composing systems comprised of a) hardware/software systems; b) hardware/software/communications systems; and c) cyber/physical systems. Research tools and methods to show the impact of a certain assumption being violated on the overall correctness of the system.

4.1.7.5 Develop and implement means for ensuring smooth technology transitions. Examples: from Internet Protocol version 4 (IPv4) to IPv6, Windows XP to Windows Vista to Windows 7, and from standard system configurations to hardened systems.

4.1.7.6 Develop and implement means for vulnerability assessments for all infrastructures, holistically.

4.1.7.7 Develop and implement means for hardening interfaces between the physical and computing infrastructures.

4.1.7.8 Develop and implement means for hardening interfaces between different computing infrastructures.

4.1.8 Cyber Mission Assurance

4.1.8.1 Research, develop, enhance, and integrate capabilities for mission assurance in the cyber domain that addresses the following mission assurance attributes: a) prioritization, b) mapping, c) vulnerability assessment, and d) mitigation.

4.1.8.1.1 Prioritization: Research, develop, and implement a methodology that deals with identifying and prioritizing the critical mission functions, the scoping of the mission mapping activity, and the boundary establishment. Develop a methodology based on mission essential functions (MEFs) and the prioritization of the MEFs with respect to the overall mission of a command.

4.1.8.1.2 Mapping: Research, develop, and implement methods that define the functionality of each atomic cyber process and the interaction among the processes. Develop methods that decompose each critical MEF into a number of layers that represent sub-functions, relationships, responsibilities and systems, culminating into a logical representation of the atomic cyber processes that enable the MEF.

4.1.8.1.3 Vulnerability Assessment: Research, develop, and implement methods, based on autonomic discovery and table top war gaming by a combined team of cyber and mission domain experts, to conduct a systematic assessment of MEF susceptibility to process failures and the vulnerability of atomic cyber processes and inter-process communication to accidents and attacks.

4.1.8.1.3.1 Mitigation: Research, develop, and implement mitigation strategies that focus on atomic cyber processes, sensors, storage units, and inter-process communication.

4.1.9 Integrate Innovative Cyber Technologies to Enable Cyber Superiority

4.1.9.1 Provide for an integrated, operator-focused, full spectrum cyber operations and C2 environment that can process data from multiple sensors and intelligence sources.

4.1.9.2 Integrate the cyber modules and multiple sources of data into an architecture capable of meeting program requirements.

4.1.9.3 Develop or provide the ability to automatically generate datasets, to include automated text extraction techniques that can be used by the cyber systems for demonstration, test, and evaluation to include data set characteristics and evaluation metrics.

4.1.9.4 Perform test planning. Develop or acquire suitable test data, scenarios, metrics, and algorithms to support the cyber technology.

4.1.9.5 Develop the documentation required to permit the demonstration, testing, and evaluation of the cyber applications and systems.

4.1.9.6 Develop performance measures and metrics, Measures of Effectiveness (MOEs) and Measures of Performance (MOPs) for the cyber capabilities being tested and evaluated.

4.1.9.7 Evaluate performance based on predefined operational expectations.

4.1.9.8 Perform testing. Document all test results and provide recommendations on test results.

4.1.9.9 Perform demonstrations, field experiments, and field exercises to show the effectiveness of the cyber technology.

4.1.9.10 Provide on-site technical expertise at multiple locations for real-time automatic feedback, exercises, demonstrations, and fielding at/between multi-agency laboratories/organizations.

4.1.9.11 Perform site surveys, site installations and on-site technical expertise for cyber technologies.

4.1.9.12 Conduct on-site assessment and maintenance of cyber capabilities to identify problem areas, recommend solutions and implement bug fixes.

4.1.9.13 Develop work plans and schedules to manage and accomplish new installations of cyber technologies.

4.1.9.14 Integrate cyber technology with the fielded systems.

4.1.9.15 Deliver all supporting information and documentation developed or acquired to train, operate, install and maintain the cyber technology.

4.1.9.16 Prepare and develop documentation and conduct testing and evaluation required for DoD/Air Force certification and accreditation (C&A) to support operational fielding.

4.1.9.17 Determine Life Cycle Costing requirements for any operational/fielded cyber technology.

4.1.9.18 Determine Design-To-Cost requirements for any operational/fielded cyber technology.

4.1.9.19 Provide on-site familiarization and training of cyber technologies, their applications and tools.

4.1.9.20 Use a configuration management process for managing the development and integration of any delivered software. The software development process may include, but not be limited to, the following activities: Systems Requirements Analysis/Design, Software Requirements Analysis, Preliminary/Critical Design, Detailed Design, Coding and Computer Software Configuration Item Testing, System Integration and Testing, and Software/System Security Certification and Accreditation.

4.1.10 Facilitate Technology Transition

4.1.10.1 Enhance and operate cyber technologies developed and transitioned under this effort. Perform support through initial operations, maintenance and administration of data and information components, products or systems including engineering to address Operations & Maintenance (O&M) problems such as:

4.1.10.1.1 Problem Reports (PRs) and Change Requests (CRs), as identified in each applicable order.

4.1.10.1.2 Studies, analyses and recommendations on modifications, upgrades, and future enhancements/increments.

4.1.10.1.3 Interoperability, technology or process improvement.

4.1.10.1.4 System or architecture obsolescence.

4.1.10.1.5 Aging system or architecture issues.

4.1.10.1.6 Upgrades for Joint or Service commonality and interoperability.

4.1.10.1.7 Transition enhancements of system or architecture affordability, reliability, and supportability, while maintaining readiness.

4.1.10.2 Make module changes and enhancements to meet emerging user requirements, changing operating environments, and to resolve problems identified with the system. Provide baseline maintenance for all system and software configurations under a Government defined operational baseline. Update/revise system documentation.

4.1.11.5 Develop a test plan and submit it to the Government for review prior to the TRB as specified in the CDRL. Update the test plan according to TRB results and resubmit to Government prior to the SRB. Update the test plan according to SRB results and resubmit to Government for Test Execution Authority (TEA)/ Flight Operations Authority (FOA) approval. (See CDRL)

4.1.12 Adhere to Cloud Computing Requirements. Reference Section I clause DFARS 252.239-7010. (Only applicable when specifically identified in an individual order.)

4.1.12.1 Work on this effort will require or allow Contractor access to Privacy Information. Content contained within the cloud services is subject to the Privacy Act. As such, the Contractor shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a, and applicable agency rules and regulations.

4.1.12.2 Work on this effort will require or allow Contractor access to Level 2 Public or Non-Controlled Unclassified Information. Content contained within the cloud services is subject to the Freedom of Information Act (FOIA). As such, the Contractor shall adhere to the FOIA regulations, and applicable agency rules and regulations.

4.1.12.3 Work on this effort will require or allow Contractor access to Level 4 Controlled Unclassified Information, including “Export Controlled,” and “For Official Use Only” data, and non-National Security Systems (NSSs). Content contained within the cloud services is subject to the Freedom of Information Act (FOIA). As such, the Contractor shall adhere to the FOIA regulations, and applicable agency rules and regulations.

4.1.12.4 Work on this effort will require or allow Contractor access to Level 5: Higher Sensitivity Controlled Unclassified Information, Mission Critical Information, and NSSs. This CUI requires a higher level of protection as deemed necessary by the information owner, public law, or other Government regulations, such as information related to unclassified NSSs.

4.1.12.5 Work on this effort will require or allow Contractor access to Level 6: Classified Information up to SECRET which includes information that has been determined to be classified national security information or Restricted Data (RD). This impact level requires a higher level of protection and accommodates classified information categorizations up to moderate confidentiality and moderate integrity (M-M-x).

4.1.12.6 Data Ownership. All Government data, Government-related data, and metadata is and shall remain the exclusive property of the U.S. Government.

4.1.12.7 Disposition. Provide for the transition of data in commercially available, or open and non-proprietary format (and for permanent records, in accordance with disposition guidance issued by National Archives and Record Administration). The Cloud service provider shall ensure that the Government retains access and download capability of all Government data, and Government-related data, on demand within one week of request, in an open format (e.g., ASCII, CSV, XML). “Open format” means platform independent, machine readable, and made available to the public without restrictions that would impede the re-use of that information.

4.1.12.8 Support applicable inspection, audit, investigation, or other similar authorized activities specific to the relevant types of Government data and Government-related data, or specific to the type of cloud computing services being acquired. Ensure the CSP is able to supply the agency with audit trails, exception reports and transaction logs, if requested.

4.1.12.9 Support and cooperate with applicable system-wide search and access capabilities for inspections, audits, investigations, litigation, eDiscovery, records management associated with the agency’s retention schedules, and similar authorized activities; and

4.1.12.10 Coordinate with the COTR to respond to any spillage occurring in connection with the cloud computing services being provided under this effort.

4.1.12.11 Store all Government data within the 50 states, the District of Columbia, or outlying areas of the United States, unless the Government data is physically located on DoD premises or the Contractor is otherwise authorized in writing by the Contracting Officer.

4.1.13 CONFERENCES (Only applicable when specifically identified in an individual order.)

4.1.13.1 Provide conference and presentation capabilities, as approved by the Government, to allow for the presentation of prototypes, technical program information and issues. Address all aspects of coordinating, acquiring (for example, booths, supplies, shipping, multi-media, displays etc.) and configuring space to perform the required demonstration and/or presentation. Activities may include professional development seminars, demonstrations, trade shows, conferences and briefings relating to enterprise-wide integration issues or programs (to be determined on individual orders). A reference similar to this shall appear in the specific order (See CDRL).

4.1.14 Overseas Travel (Only applicable when specifically identified in an individual order.)

4.1.14.1 Comply with all Government foreign travel requirements as specified by this effort. Additional information and/or training maybe required on a country by country basis.

4.1.15 During the development of the software deliverable, address the Risk Management Framework (RMF) requirements and processes identified in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-39 and Committee on National Security Systems (CNSS) Policy (CNSSP) 22. If applicable provide the required artifacts and documentation for the Assessment and Authorization (A&A) process and RMF applicable to the targeted user environment identified and approved by the Government. (See CDRL)

4.2 Program Management

4.2.1 Continually determine the status of each order and report progress towards accomplishment of the requirements.

4.2.2 Continually determine the status of funding required for order performance.

4.2.3 Conduct oral presentations at such times and places designated in the order schedule. Provide status of technical progress made to date in performance of the order during presentations.

4.2.4 Update Government Furnished Documentation in the form of revisions. Format of the changes shall not deviate from that of the existing documentation without prior Government approval.

4.2.5 Document all technical work accomplished and information gained during performance of each Order. Include all pertinent observations, nature of problems, positive and negative results, and design criteria established of each Order. Document procedures followed, processes developed, and “Lessons Learned” of each order. Document the details of all technical work to permit full understanding of the techniques and procedures used in the evolving technology or processes developed. Individual Orders refine the technical requirements consistent with the general requirements stated herein. Cross-reference separate design, engineering, or process specifications delivered to permit a full understanding of the total acquisition.

4.2.6 Testing/Demonstrations will occur at both the Contractor and Government facilities as specified in each individual order.

4.2.6.1 Conduct testing to verify the fulfillment of the individual order requirements. All testing shall be in accordance with the Government reviewed test plan. (See CDRL)

4.2.6.2 Conduct a demonstration in order to verify the results of the individual order requirements. Conduct the demonstration at such a time and place as specified in the contract schedule. The demonstration shall be in accordance with the Government-reviewed demonstration plan. (See CDRL)

4.3 Software/Hardware Prototype

4.3.1 Deliver all software/hardware developed, modified, enhanced, assembled, or acquired to the Government in accordance with each order and the following:

4.3.1.1 All software developed shall be delivered to the Government in the form of source and object code.

4.3.1.2 Developed software is to be completely maintainable and modifiable with no reliance on any non-delivered computer programs or documentation.

4.3.1.3 For all software/hardware purchased or licensed, arrangements shall be made for licensing and maintenance agreements to be transferred to the Government upon the completion of each order.

4.3.1.4 Design the software to make use of existing software and for subsequent reuse to the maximum feasible extent. Ensure that the use of non-developmental software (i.e. Commercial Off-The-Shelf (COTS), reusable, or Government-furnished) will not interfere with the ability to meet all SOW requirements.

4.3.1.5 Consider the use of non-developmental software (i.e., commercial off-the-shelf (COTS), reusable, or Government-furnished) to ensure that all SOW requirements are met. Evaluate the software to determine whether the software performs as documented prior to incorporating acquired software into software being developed under this effort.

4.3.1.6 Transfer all purchased or licensed software used during development or as a component of each order upon completion; include licensing and maintenance agreements and original media software and documentation.

4.3.1.7 If any commercial off-the-shelf hardware and software acquired for use during the development or as a component of the end product, has licenses and/or maintenance agreements with them, transfer them to the Government upon completion of the effort. Include any ancillary cabling required.

4.3.1.8 Document the cyber developments in accordance with the Contract Data Requirements List (CDRL).

4.3.1.9 Design and develop all computer software using an approved Higher Order Language (HOL). Base the justification for the HOL selected on system interface, interoperability, communications functions, human interface, and requirements for security, safety, and reliability. Design the software to make use of existing software and for subsequent reuse to the maximum feasible extent.

4.3.1.10 The Air Force Computer Emergency Response Team (AFCERT) issues advisories to identify known vulnerabilities in computers and computer networks. These advisories include but are not limited to Information Assurance Vulnerability Alerts, Virus notification, Advisory Compliance Messages (ACMs), and Follow-up Messages. The Contractor shall report suspected vulnerabilities and security incidents in accordance with AFSSI 5021. The Contractor shall respond to AFCERT advisories in accordance with AFSSI 5021 as follows.

4.3.1.10.1 Acknowledge receipt of AFCERT advisories within three (3) days of issue.

4.3.1.10.2 Implement the countermeasures identified by the advisory within the timeframe specified by the advisory or as specified by the Government. If the countermeasures cannot be implemented, the Contractor shall document the inability and must receive approval from the Designated Approving Authority (see AFI 33-202) and the Government for either an alternative corrective action to continue operations without the countermeasures. If alternative corrective action is approved, the Contractor shall implement this action within the timeframe specified by the Government.

1. Contract, Contract number, Name and Title of Person(s) Reporting

1. Date, Time and exact location of accident/incident

1. Brief Narrative of accident/incident (events leading to accident/incident)

1. Cause of accident/incident (if known)

1. Type of injuries resulting from the accident/incident and estimated cost of accident/incident (material and labor to replace/repair)

1. Nomenclature of equipment involved in accident/incident

1. Personnel involved in accident/incident

1. Corrective Actions (taken or proposed)

1. Other pertinent information

1. Management

1. Supervisors

1. Employees

1. Safety Coordinator

image1.png