Section_J_Attachment_1_-_Draft_DCRIOS_PWS_19_Jan_2016.pdf

UNCLASSIFIED//FOUO

PERFORMANCE WORK STATEMENT (PWS)

FOR

DEPARTMENT OF THE AIR FORCE

688 CYBERSPACE WING (CW)

DEFENSIVE CYBER REALIZATION, INTEGRATION & OPERATIONAL SUPPORT

(DCRIOS)

DRAFT

AIR FORCE SPACE COMMAND (AFSPC)

19 Jan 2016

Table of Contents

1.0 Introduction

2.0 General Requirements

3.0 Performance Requirements

4.0 Special Requirements

5.0 Task Order Process

6.0 Deliverables

7.0 Service Summary

8.0 Appendices

1.0 INTRODUCTION

1.1 Mission

The mission of the 688 Cyberspace Wing (CW) is to deliver Asymmetric Advantage; to achieve air, space, and cyberspace superiority in the most efficient and innovative way possible.

1.2 Background

The DCRIOS requirements within this PWS evolved from the Cyber Assessment Engineering and Technical Support (CAETS) requirements that supported the Cyber Vulnerability Assessment (CVA) functions of the 92 Information Operations Squadron (IOS). The mission of the 92 IOS was to quantify the security posture, integrity and network defense capabilities of Department of Defense (DoD) and Air Force (AF) cyber assets. This mission was executed through a Cyber Assessment Program linked to DoD and AF requirements along with “Best Practices” as defined by industry and governmental organizations. The 92 IOS Cyber Assessment Program was composed of three main assessment pillars: Vulnerability Assessment, Defense Assessment, and Intrusion Assessment. The Vulnerability Assessment identified weaknesses in network security that could be exploited to disrupt operations; the Defense Assessment determined a unit’s ability to deter, detect and defeat a cyber-attack; and the Intrusion Assessment determined if a network has been compromised by a cyber-attack. As the threat to AF and DoD partners grew, the need for a more comprehensive defensive posture was developed by United States Cyber Command (USCYBERCOM). USCYBERCOM dictated that the 688 CW would build the defensive aspects of this new methodology in the form of Cyber Protection Teams (CPT). The DCRIOS requirement was developed to support the 688 CW mission of providing CVAs to AF weapon and support systems in various stages of development as well as supporting the new USCYBERCOM's Cyber Mission Forces (CMF) initiative. The 688th is the US AF's focal point for developing the CPT a component of the CMF responsible for providing mission assurance by defending AF and Combatant Command's information initiative to defend the nation's networks. DCRIOS is intended to support new functions and requirements previously unavailable to include Discovery and Counter Infiltration, Cyber Readiness, Cyber Support, Cyber Threat Emulation, and Mission Protection.

1.3 Scope

The purpose of this PWS is to provide the 688 CW with support, management, engineering and technical services to sustain the 688 CW Operations.

1.3.1 Mission Support: The contractor shall provide the technical support necessary to evolve/sustain Cyber infrastructure as well as data and processes. The support required will be Unit Line Maintenance (ULM) (which is defined as the support required to perform day-to-day operations), Training, Standardization and Evaluation (STAN/EVAL), and Weapons and Tactics.

1.3.2 Mission Operations: The contractor shall provide the technical support necessary to baseline, evolve, sustain and execute CVA and Defensive Cyber Operations (DCO) to include CPT and CVA.

2.0 GENERAL REQUIREMENTS

2.1 Non-Personal Services

The Government shall not supervise the contractor nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor’s responsibility to notify the Contracting Officer (CO) immediately.

2.2 Business Relations

The contractor shall integrate and coordinate all contractor activity needed to execute the requirement. The contractor shall manage the timeliness, completeness, and quality of problem identification. The contractor shall provide corrective action plans, proposal submittals, timely identification of issues, and effective management of subcontractors.

2.3 Contract Administration and Management

2.3.1 Contract Management

The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. The contractor must maintain continuity between the support operations at 688 CW and the contractor's corporate offices.

2.3.2 Contract Administration

2.3.2.1 The contractor shall establish processes and assign appropriate resources to effectively administer the requirement.

2.3.2.2 The contractor shall have a single point of contact between the Government and contractor personnel assigned to support this contract and subsequent task orders.

2.3.2.3 The contractor shall hold weekly status reviews. The contractor’s weekly status reviews shall describe: the progress, resource allocation, personnel assignment and event schedule of all tasks including (a) the personnel allocated to specific tasks/assessments; (b) the status of assigned tasks; (c) training and personnel certification status; (d) results of conducted training;

and (e) subject matter expert (SME) status.

2.3.2.4 The contractor shall hold monthly Technical Interchange Meetings (TIMs), as well as formal program reviews/other meetings on a coordinated basis with the Contracting Officer’s Representative (COR). (Contract Data Requirements List (CDRL) A001, A002, A007)

2.3.3 Personnel Administration

2.3.3.1 The contractor shall accomplish the assigned work by employing and utilizing sufficient, qualified personnel with appropriate combinations of education, training and experience to perform the work specified within the PWS.

2.3.3.2 The contractor shall ensure all required certifications, training and STAN/EVAL requirements are met in accordance with (IAW) Department of Defense Manual (DoDD) 8570.01M, Air Force Manual (AFMAN) 33-285, Air Force Instruction (AFI) 10-1703 Vols 1, 2 and 3 and AFI 10-1703V1 Air Force Space Command Supplement (AFSPCSUP) and AFI 10- 1703V2 AFSPCSUP. Contractor personnel conducting CPT operations shall also be certified IAW USCYBERCOM Joint Cyberspace Training and Certification Standards (JCT&CS) as well as any additional individual, squad and team level CPT specific required training requirements.

Obtaining required certifications are the responsibility of the contractor. If the Government provides specific certification training (for purposes of satisfying 8570 requirements) using in-house assets, contractor employees may attend with COR approval, provided they pay for all related course materials/tests as well as not charging the Government for the time for the training. The contractor must also maintain task coverage.

CPT training is still under development. Contractor employees are waived from the Mission Ready (MR)/Combat Mission Ready(CMR) requirement to attend Initial Qualification Training; however contractor employees shall require requisite knowledge, skills, and abilities to meet IQT standards. Appendix E can be used to assist in identifying the requisite knowledge. As a minimum, contractor employees shall possess training/certifications in networking, Windows and Linux Operating Systems and ethical hacking. Training, which is commercially available and is a required element of the training plan, will be at the contractor's expense. The Government will provide unique, non-commercially available specific weapon systems training to contractor employees as well as Mission Qualification Training and Continuation Training.

2.3.3.2.1 The contractor shall ensure that personnel accessing information systems have the proper and current information assurance (IA) certification to perform information assurance functions IAW DoDD 8570.01-M, Information Assurance Workforce Improvement Program. The contractor shall meet the applicable IA certification requirements, including (1) DoD-approved IA workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M; and (2) appropriate operating system certification for IA technical positions as required by DoDD 8570.01-M.

2.3.3.2.2 Upon request by the Government, the contractor shall provide documentation supporting the IA certification status of personnel performing IA functions.

2.3.3.2.3 Contractor personnel who do not possess proper and current certifications shall be denied access to DoD information systems for the purpose of performing IA functions.

2.3.3.2.4 In addition to the IA baseline certification requirement for their level, Information Assurance Technicians (IAT) with privileged access must obtain appropriate Computing Environment (CE) certifications for the operating system(s) and/or security related tools/devices they support as required by their employing organization. If supporting multiple tools and devices, an IAT shall obtain CE certifications for all the tools and devices they are supporting.

At a minimum, the IAT shall obtain a certification for the tool or device being supported(i.e., an IAT spending the majority of time supporting security functions on a CISCO router should obtain a CE certification for that equipment). This requirement ensures they can effectively apply IA requirements to their hardware and software systems.

2.3.3.3 Contractor personnel who perform cyberspace operations duties and are designated or will be designated as MR are bound by the requirements set forth by AFSPC Supplement to AFI 10-1703v1. MR designated contractor personnel are waived from the MR requirement to attend Initial Qualification Training (IQT); however, contractor personnel are required to possess the requisite knowledge, skills and abilities to meet IQT standards. Contractor personnel assigned to support CPT work roles shall meet all USCYBERCOM training requirements. All contractor personnel and their processes shall be subject to inspection visits.

2.3.3.4 The prime contractor shall hold and maintain Capability Maturity Model Integration (CMMI) Level 3 throughout the entire performance period of the contract, inclusive of ordering periods. IAW the CMMI maturity models, the contractor shall “focus on process improvement” and continue the optimization of the 688 CW’s defined processes.

2.3.3.5 Contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversation and in formal written correspondence.

2.3.4 Reporting Contract Labor

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the DCRIOS via a secure data collection site. The contractor is required to completely fill in all required data fields at http://www/ecmra.mil. Reporting inputs will be for the labor executed during the period of performance for each Government Fiscal Year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year. The contractor may direct questions to the Contractor Manpower Reporting Application (eCMRA) help desk.

2.3.5 Subcontract Management

2.3.5.1 The contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance.

2.3.5.2 The prime contractor shall manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations. The contractor may add or remove subcontractors to its team after CO and COR notification.

2.3.6 Location and Hours of Work

2.3.6.1 Place of Performance

The primary work location for this effort shall be 3515 S. General McMullen, Bldg. 4, San Antonio TX, 78226. Additional support may be required at different off-site locations for mission execution as determined by each Task Order or COR based on taskings provided to the

688 CW.

2.3.6.2 Hours of Work

Normal work hours, on-site, at the 688 CW shall be Monday thru Friday, excluding Federal Holidays. Mandatory core working hours are 9:00 A.M. – 3:00 P.M. Alternate Work schedules in the workplace are appropriate if deemed acceptable by the COR. During mission execution, the number of hours may exceed 8 hours per day, 40 hours/week, or 80 hours/2 week, and may include weekends and holidays with various shifts.

2.3.6.3 Overtime and Holidays

Overtime and holidays are not reimbursed by the Government under the terms of the contract as it is included within the price proposed; therefore, change shall be negotiated solely between the contractor and its employees IAW applicable labor laws.

2.3.6.4 Government Non-Work Days

The contractor shall provide for employees during designated Government non-work days or other periods where Government offices are closed due to weather or security conditions. The contractor shall ensure all contractor personnel who work 24/7/365 are relocated to corporate headquarters or other designated work location.

2.3.7 Travel / Temporary Duty (TDY)

2.3.7.1 Travel

Travel to Government and contractor facilities within and outside the continental United States shall be required to support 688 CW’s mission activities. The vast majority of these facilities are USAF installations located in the US. The purpose of contractor travel shall include: conducting and attending meetings; assessment activities; performing data gathering and analysis; providing security consultation; performing mission operation activities; and installing/configuring hardware and coordinating with the 688 CW, other DoD personnel, organizations, and contractor personnel.

2.3.7.2 Travel Arrangements

The contractor shall make necessary travel arrangements for employees. All travel requirements (including plans, agenda, itinerary, or dates) shall be pre-approved by the Government (subject to local policy procedures), and is on a strictly cost reimbursable basis. Performance or travel on weekends is authorized only when deemed appropriate by the Government. Costs for travel shall be billed IAW the Joint Travel Regulation and regulatory implementation of Public Law 99-234 and Federal Acquisition Regulation (FAR) 31.205-46 Travel Costs (subject to local policy & procedures).

3.0 Performance Requirements

3.1 Mission Support

The contractor shall provide the engineering, management and technical support required to evolve, operate and maintain 688 CW systems and components along with its associated capabilities and data. The current hardware and software baseline as described in the Equipment List (see Appendix C).

3.1.1 Configuration Management

The contractor shall provide the necessary documentation, including data flow diagrams, network diagrams, requirements documents, design criteria and test documentation to support baseline management, configuration control, and engineering activities. (CDRLs A004 & A006)

3.1.2 System Evolution and Integration

The contractor shall support the Government to define and execute a disciplined process for controlling and evolving baselines and enhancing systems and their components. Upon COR or Government team lead approval, the contractor may utilize this process to procure and integrate Government-approved tools, hardware and software into the baseline. The contractor shall identify emerging requirements to ensure the 688 CW requirements are met. The contractor shall participate in the unit Requirements Review Board (RRB), Integrated Product Team (IPT) and Program Management Office (PMO) driven requirements boards. The contractor shall provide necessary written agendas, post meeting minutes, technical diagrams/drawings, and spreadsheets to support successful conduct of these boards. (CDRLs A004 & A006)

3.1.3 Unit Line Maintenance

The contractor shall provide Unit Line Maintenance defined as day-to-day operations which differs from the life cycle support provided by the PMO. The contractor shall install, document, and test 688 CW components. Documentation may take the form of written reports, technical drawings or diagrams, or spreadsheets. The current hardware and software baseline is described in the Equipment List (see Appendix C). (CDRLs A004 & A006)

3.1.3.1 The contractor shall maintain network configuration diagrams of network components.

3.1.3.2 The contractor shall maintain configuration baselines for the approved systems and components.

3.1.3.3 The contractor shall install, configure, and test local area network (LAN) hardware and software components and cabling.

3.1.3.4 The contractor shall analyze, troubleshoot, document, resolve and report problems as they are encountered IAW 688 CW and industry standards and methodologies.

3.1.3.5 The contractor shall install vendor security patches and measures IAW Defense Information System Agency (DISA) Information Assurance Vulnerability Management (IAVM), 624 Time Compliance Network Order (TCNO), Cyber Control Order (CCO), Maintenance Tasking Order (MTO) and any other orders developed and released by 624th.

3.1.3.6 The contractor shall implement security recommendations for mission and support functions.

3.1.3.7 The contractor shall backup and restore application and operating system software and data.

3.1.3.8 The contractor shall establish and maintain all assets including: firewalls, Domain Name Server (DNS), Windows Internet Name Service (WINS), Exchange services, routers, Storage Area Networks (SANs), and Cross Domain Solution (CDS).

3.1.3.9 The contractor shall integrate approved assessment tools.

3.1.3.10 The contractor shall modify systems IAW with approved change request process.

3.1.3.11 The contractor shall document and track configuration and assets.

3.1.3.12 The contractor shall test tools, network subsystems and interfaces.

3.1.4 Information Protection/Certification and Accreditation

The contractor shall provide engineering and technical support to ensure the 688 CW systems and their components achieve initial and recurring accreditation. (CDRL A003 and A006)

3.1.4.1 Certification and Accreditation, DIACAP/RMF/EITDR Package and FISMA Reporting

3.1.4.1.1 The contractor shall provide engineering and technical support for the Certification and Accreditation (C&A) standards and processes to achieve uniform quality and a level of consistency throughout the life cycle of the systems. The contractor shall provide the necessary written documentation, technical drawings/diagrams, or spreadsheets to support the C&A process. (CDRL A003 and A006)

3.1.4.1.2 The contractor shall provide the certification and accreditation surveys and document responses into the Enterprise Information Technology Data Repository (EITDR). The contractor shall ensure the EITDR questions are answered to meet or exceed the common minimum standards as required to support annual Federal Information System Management Act (FISMA) reporting requirements.

3.1.4.1.3 The contractor shall develop DoD Information Assurance Certification and Accreditation Process (DIACAP) certification packages for accreditation approval.

3.1.4.1.4 The contractor shall develop DIACAP certification packages. The contractor shall develop written documentation, technical diagrams/drawings as part of the DIACAP certification package build. The contractor’s packages shall include the following: (CDRLs A003, A005 and A006)

• DIACAP Plan of Action and Milestone (POA&M) to include a timeline and resources to mitigate outstanding risks to an acceptable level.

• DIACAP Scorecard to include validated and tested IA controls based on Mission Assurance Category (MAC) and Confidentiality Level (CL)

• Validation evidence for all appropriate IA Controls formatted for easy upload into

EITDR

• Final System Identification Profile

• Final DIACAP Implementation Plan

3.1.4.2 System Artifacts

The contractor shall develop, review, document and finalize requirements necessary to satisfy DoD IA controls including the following artifacts:

• System Security Concept of Operations

• Security Requirements from Appropriate IA Controls

• Security Maintenance Procedures

• System Security Architecture and Interconnects

• Contingency Operations Plan (COOP)

• Data Backup Plan

• Disaster Recovery Plan

• Maintenance Support Plan

• Hardware Baseline Inventory

• Software Quality Plan

• Systems Rules Behavior

• Physical Functions System Security Descriptions

• Security Plan

• Security Assessment Report

• Plan of Action and Milestones

The contractor shall develop the necessary scientific/technical reports, technical drawings/diagrams, and spreadsheets necessary to build the above listed documents. (CDRLs A003, A005 and A006)

3.1.4.3 Information Assurance Support

The contractor shall develop, review, document and finalize the requirements necessary to satisfy DoD IA controls. (CDRLs A006 and A007)

3.1.4.3.1 The contractor shall ensure implementation of information security measures and procedures, including reporting incidents to the IA Officer and appropriate reporting chains. The contractor shall coordinate system-level responses to unauthorized disclosures.

3.1.4.3.2 The contractor shall implement and enforce all DoD Information System (IS) and Platform Information Technology (PIT) system cybersecurity policies and procedures, as defined by cybersecurity-related documentation.

3.1.4.3.3 The contractor shall ensure that all users have the requisite security clearances and access authorization, and are aware of their cybersecurity responsibilities for DoD IS and PIT systems under their purview before being granted access to those systems.

3.1.4.3.4 The contractor shall, in coordination with the Information System Security Manager (ISSM), initiate protective or corrective measures when a cybersecurity incident or vulnerability is discovered and ensure that a process is in place for authorized users to report all cybersecurity-related events and potential threats and vulnerabilities to the Information System Security Officer

(ISSO).

3.1.4.3.5 The contractor shall ensure that all DoD IS cybersecurity-related documentation is current and accessible to properly authorized individuals.

3.1.4.3.6 The contractor shall configure and operate Information Technology (IT) systems within the authorities vested in them IAW DoD cybersecurity policies and procedures.

3.1.4.3.7 The contractor shall protect authenticators commensurate with the classification or sensitivity of the information accessed and report any compromise or suspected compromise of an authenticator to the appropriate ISSO.

3.1.4.3.8 The contractor shall observe policies and procedures governing the secure operation and authorized use of DoD IT systems, including operations security.

3.1.4.3.9 The contractor shall develop and maintain an organizational or system-level cybersecurity program that includes cybersecurity architecture, requirements, objectives and policies, cybersecurity personnel, and cybersecurity processes and procedures.

3.1.4.3.10 The contractor shall maintain certification of DoD baseline requirements.

3.1.4.3.11 The contractor shall implement and enforce all AF IA policies and procedures.

3.1.5 Document Control and Tracking

3.1.5.1 The contractor shall contribute in the development of policies and procedures for constructing and archiving technical reports; reporting standards linked to DoD and AF guidance; and generating templates based on these standards. In addition, the contractor shall review reports for accuracy, grammar and compliance with AF and DoD guidelines for official documents.

3.1.5.2 The contractor shall maintain a current centralized repository of security information, Government reports and contractor deliverables. This repository shall be an electronic repository with an index for storage and retrieval purposes and shall be kept on a classified server. The centralized repository shall include the following:

• Network security related regulations, policies and guidance

• DCO plans, notes and reports

• Training materials

• Contractor deliverables

• Design, development and test documentation

• Configuration baseline data

• DCO tools

• DCO Tactics, Techniques, and Procedures (TTP)

3.1.6 Training and Standards and Evaluations

The contractor shall support the development and sustainment of the current formal training and STAN/EVAL program IAW AFI 10-1703 Vols 1 and 2.

3.1.6.1 The contractor shall assess overall operator skills and the specific ability to successfully operate the CVA/Hunter. The contractor shall manage a simulator or lab environment and develop training evaluations on the simulator or lab. Currently, there is no AF or AFSPC level approved simulator for the CVA/H weapon system. The 92d Cyber Operations Squadron (COS) developed hardware/software training solutions in a lab/range environment to better train CPT personnel. Contractor personnel shall support the current training lab/range environment to include training development and presentation. If an AF or AFSPC approved simulator is provided to the 92d in the future, contractor personnel shall develop and administer training or mission rehearsals for the simulator.

3.1.6.2 The contractor shall identify, provide, and update a list of skill sets and expertise levels needed to qualify for device assessment training; identify the training requirements and activities for assessing the devices; and identify the infrastructure requirements needed to train personnel to execute the device assessments. The contractor shall ensure all personnel performing evaluations are certified for the function they are evaluating. Contractor personnel supporting training and STAN/EVAL shall maintain MR status. (CDRLs A004 and A005)

3.1.6.3 The contractor shall develop, implement, review and update training curriculum, including presentation material, proper usage of referenced tools, test material, and the student/instructor guides necessary to teach personnel how to execute the required mission.

3.1.7 Weapons and Tactics

The contractor shall support TTP development and dissemination responsibilities, to include coordinating with internal and external entities, and mission Planning, Briefing, Execution and Debriefing (PBED), IAW AFI 10-1703 Vol 3, AFI 10-703, AFI 90-1601, AFI 11-415, AFSPCI 10-260, AFSPCI 10-415 and other governing directives as they are identified. The contractor shall provide Weapons and Tactics support to other Government agencies (Army Navy, Marines, NSA, and USCYBERCOM) and necessary Quick Reaction Force (QRF) support. The contractor shall ensure tactics information such as Flash Bulletins, are disseminated within 90 days IAW AFI 11-260. The contractor shall attend in-house training to maintain expert level knowledge.

Fifty percent of the contractor personnel shall maintain MR status. MR contractors shall maintain instructor/evaluator certification on the CVA/H cyberspace weapon system. The contractor shall support the assessment of lessons learned, and provide inputs concerning combat capability; training documentation, equipment status, support requirements, and TTP deficiencies to include determining advanced tactical training objectives for participation in exercises and other training. The contractor shall participate in Operations Review Panels/Boards. The contractor shall support the integration of new equipment or capabilities into daily operations and exercises. The contractor shall document all findings within detailed written reports, and briefings, and provide to Weapons and Tactics leadership. (CDRLs A004 and A006)

3.1.7.1 Weapons and Tactics Training Innovation

The contractor shall develop, conduct, evolve, innovate and train TTPs. TTPs may be developed for the following types of systems: Internet of Things, Industrial Control System/Supervisory Control and Data Acquisition (ICS/SCADA), Wireless, cloud, external and internal devices, mobile devices, and other emerging technologies and trends.

3.1.7.1.1 .The contractor shall provide training and input for DCO training and curriculum development in order to sense, detect, deter, deny and respond to methods of intrusion, TTPs (new, used, and unidentified), malicious behaviors, and corrective actions.

3.1.7.2 Weapons and Tactics Forensics Innovation

The contractor shall develop, train, conduct, evolve and innovate network and computer forensics capabilities and methodologies on IT based systems and components such as the Internet of Things, both external and internal devices/drives, mobile devices, Wireless, cloud and other emerging technologies and trends.

3.1.7.2.1 The contractor shall identify, execute, train and develop corrective actions and tactics necessary to detect and deter future and similar activities.

3.1.7.2.2 The contractor shall perform reverse engineering of suspected malicious items (malware, files, hard drives, etc.).

3.1.7.2.3 The contractor shall perform hard drive analysis of suspected/confirmed compromised systems.

3.1.7.2.4 The contractor shall develop methods to sense, detect, deter, deny, respond and analyze malware-based activities on IT based systems and their components.

3.1.7.3 Weapons and Tactics Innovation Incident Response

3.1.7.3.1 The contractor shall perform Root Cause analysis.

3.1.7.3.2 The contractor shall integrate new equipment or capabilities into daily operations and exercises.

3.1.7.3.3 The contractor shall develop, train, document, conduct, evolve and innovate network and host based traffic analysis and incident response procedures and methodologies using IT based systems such as (Internet of things, Virtual, Wireless, Mobile, ICS/SCADA, Cloud and other emerging technologies).

3.1.7.3.4 The contractor shall utilize the tools and methodologies available to develop TTPs to sense, investigate, validate identify, detect, deter, and deny system compromises, evasion techniques, lateral movement and other adversary TTPs.

3.1.7.3.5 The contractor shall provide input for document processes, procedures, lessons learned, and checklists. The contractor shall perform cyber security actions.

3.1.7.4 Weapons and Tactics Innovation Assessments

3.1.7.4.1 The contractor shall develop, train, document, conduct, evolve and innovate DCO TTPs and methodology using IT based systems such as (Internet of things, Virtual, Wireless, Mobile, ICS/SCADA, Cloud and other emerging technologies).

3.1.7.4.2 The contractor shall utilize the tools and methodologies available to develop TTPs to sense, investigate, validate, identify, detect, deny and mitigate unauthorized activities/weaknesses/vulnerabilities on IT based systems.

3.1.7.4.3 The contractor shall perform Root Cause analysis and provide results to the COR or Government team leads. (CDRL A003 and A004)

3.1.7.4.4 The contractor shall document and provide to the COR or Government team lead the processes, procedures, lessons learned, and checklists. The contractor shall perform cyber security actions and other duties and projects as assigned by flight leadership via coordination with the COR. (CDRLs A004 & A005)

3.1.8 Final Reporting and Lessons Learned Analysis

The contractor shall analyze the aggregate information obtained from each task completed during contract execution, summarize the results, determine the lessons learned and provide recommended Instructional Fix Actions (in a classified centralized database) in network security posture, operations, and support, and estimate potential impacts to operations if these trends or lessons are not reversed. (CDRL A004)

3.2 Mission Operations

The contractor shall research and develop the concepts, methodology, and technology in order for the 688 CW to fulfill its mission to secure and defend AF/DOD assets. The 688 CW DCO are composed of two main unit capabilities: CVA and CPT, both supported by program development and evolution and tool and technology evolution. The contractor shall execute and report on all parts of the unit capabilities IAW with 688 CW policies and plans. Mission operations are conducted normally under a deliberate, steadystate process where processes, procedures, schedules and personnel remain the same. There are times, however, when threats to

USAF operations may require a quick response from a CVA team or CPT. This may entail Emerging Contingency Requirements where modifications are required to steadystate operations.

Processes may need to be shortened, procedures may need to be modified or adjusted in order to counter new threats, schedules (to include longer hours, shift work) may be adjusted, and teams may be augmented with additional personnel.

3.2.1 Program Development and Evolution

3.2.1.1 The contractor shall research, develop, evolve, and field 688 CW capabilities and methodologies and to ensure these capabilities and methodologies are integrated with the DoD guidance and policy.

3.2.1.2 The contractor shall conduct reviews of competing assessment programs, methodologies, processes and objectives and provide recommendations on how to improve the DCO concept, process and reporting.

3.2.1.3 The contractor shall research, develop, document, and maintain methodologies that address the full spectrum of an assessment: planning, execution, and reporting.

3.2.1.4 The contractor shall provide methodologies that shall include tested and proven tools (both hardware and software based), tactics, techniques and procedures. The contractor shall update methodologies and integrate new methodologies. (CDRLs A003, A004 and A005)

3.2.2 Tool and Technology Evaluation

3.2.2.1 The contractor shall evaluate commercial off-the-shelf (COTS), Government off-the-shelf (GOTS), and Open Source tools for executing DCO. This evaluation shall include tools for collecting, analyzing and reporting the data required to determine the security posture of the devices and device types listed in Appendix C.

3.2.2.2 The contractor shall provide recommendations to the COR or Government team lead to define tool requirements and support the 688 CW with integrating approved tools. The contractor shall identify, document and demonstrate the proper usage of all tools developed and modified (including scripts and data base queries). (CDRL A003 and A005)

3.2.3 Cyber Vulnerability Assessments (CVA)

The contractor shall perform evaluations of systems, networks and applications that include an in-depth Vulnerability Assessment (VA), Compliance Assessment and Penetration Test of information technology assets such as computers, infrastructure, applications, data, applications and cyber operations. The contractor shall perform the CVA functions IAW DoD Cybersecurity policy.

3.2.3.1 Vulnerability Evaluation (VE)

The contractor shall provide in-depth evaluation of a system/network to identify potential vulnerabilities to determine the risk to operations; conduct network discovery and mapping on wired and wireless networks; and provide security guidance, root cause analysis and remediation recommendations.

3.2.3.2 Compliance Assessment (CA)

The contractor shall evaluate a system’s adherence to DoD security policies and guidelines using industry best practices and provide input of any security shortfalls discovered or identified to the COR or Government team lead

3.2.3.3 Penetration Testing (PT)

The contractor shall evaluate the security posture of a system and/or network through exploitation and privilege escalation; determine the impact of vulnerabilities; and recommend mitigation strategies.

3.2.3.4 Remediation Action (RA)

The contractor shall identify system deficiencies, identify undocumented system deficiencies, and design or enhance system protections. The contractor shall build and deploy remediation solutions.

3.2.3.5 Planning

The contractor shall provide input for mission planning to include approved 92 IOS findings customized to the specific mission, system or application, lessons learned and any limiting factors that affected mission outcome.

3.2.3.6 Reporting

The contractor shall provide input for development of any CVA written report to include approved 92 IOS findings customized to the specific mission, system or application. lessons learned and any limiting factors that affected mission outcome.

3.2.3.7 Functional Areas

During the VE, CA, RA and PT, the contractor shall perform the following functional areas to accomplish mission objectives:

3.2.3.7.1 Windows Systems Assessment

The contractor shall provide operating system defense support for Windows operating system;

identify and mitigate operating system vulnerabilities and imbedded persistent threats with a focus on forensics and server administration capabilities; and detect evidence of abuse or misuse.

3.2.3.7.2 UNIX Systems Assessment

The contractor shall identify and mitigate UNIX or UNIX-based operating system vulnerabilities with a focus on computer security and server administration capabilities and detect evidence of abuse or misuse.

3.2.3.7.3 Network Infrastructure Assessment

The contractor shall implement Computer Network Defense (CND) infrastructure support;

identify and mitigate infrastructure vulnerabilities and persistent threat; and understands, detect and emulate network infrastructure adversary tactics, techniques and procedures.

3.2.3.7.4 Reverse Engineering

The contractor shall dynamically or statically analyze software applications to gain an understanding of system, mission and/or application vulnerabilities and exploits.

3.2.3.7.5 Penetration Testing

The contractor shall dynamically or statically analyze software applications to gain an understanding of system, mission and/or application vulnerabilities and exploits. The contractor shall develop exploits for exposed vulnerabilities with a focus on non-interference of mission partner systems and networks.

3.2.3.7.6 Web Vulnerability Analysis

The contractor shall identify web and web application based vulnerabilities with a focus on computer security; system administration capabilities and detection of abuse or misuse.

3.2.3.7.7 Database Vulnerability Analysis

The contractor shall identify database and database application-based vulnerabilities with a focus on computer security, system administration, and detection of abuse or misuse.

3.2.3.7.8 Maintenance/Integration

3.2.3.7.8.1 The contractor shall evolve and innovate the development of new CVA capabilities.

The contractor shall provide technical/engineering support to configure Government-provided hardware/software to conduct CVA operations.

3.2.3.7.8.2 The contractor shall provide system support consisting of any routine or daily work to perform system engineering, administration and maintenance services to ensure the secure operational status of the system.

3.2.3.7.8.3 The contractor shall provide support for operation activities including the resolution of incidents (using the Remedy system) as well as maintaining data files and monitoring system configuration to ensure data integrity. The contractor shall provide metrics on system performance and resource availability, perform preventative system maintenance and install, support, and maintain computer systems. The contractor shall plan and respond to service outages, monitor and enhance system performance, and implement and ensure security preventative measures are fully functioning.

3.2.3.7.8.4 The contractor shall support activities required for, but not limited to, transitioning a system from the deployment phase into operational use, respond to the Task Requirement Notice (TRN) process, and maintain existing systems and environment IAW AF & DoD policy. The contractor shall sustain applications, databases, and interfaces in compliance with applicable AF DoD standards, support system sustainment activities to include maintaining existing legacy systems and provide requirements analysis, engineering impact assessments, cost estimates and COA development in response to 1067s.

3.2.3.7.8.5 The contractor shall provide technical analysis in support of advocacy for resources, remotely managing and monitoring sites as identified by the PMO; evaluating GOTS and COTS applications for integration into the WS / Integrate 3rd-party software into WS baselines; and performing test and application of Time Compliance Technical Orders (TCTOs). The contractor shall provide site specific logical and physical network drawing generation and maintenance, support testing activities to include development, operational and acceptance testing and developing the associated documents, and ensure systems are in compliance with STIGs.

3.2.3.7.8.6 The contractor shall provide engineering support for system integration and test events of systems/projects to include deployment and installation support, provide scripts and testing and implementation of those scripts; and provide engineering support for single occurrence or short duration activities in support of the CWSS portfolio systems (under Task Requirement Notice (TRN) section). The contractor shall support the Systems Engineering Process (SEP), Life-cycle systems engineering, Service Development and Delivery Process (SDDP) and conduct rapid testing and deployment of Core Data Services and Aggregation and Presentation Layer Services using distributed testing environment.

3.2.3.7.8.7 The contractor shall operate and maintain a system integrated test lab that is capable of supporting a full range of integration test activities for both the currently fielded system as well as maintenance/modernization releases, establish and maintain a production environment that mirrors the operational environment in order to perform regression testing, perform testing and inspections of all system services to ensure the technical adequacy and accuracy of all work, conduct testing ranging from data entry and display at the user level combined with system loading to represent a fully operational system, and provide on-site support during the acceptance-testing period.

3.2.3.7.9 System Maintenance Management: When performing CVA/CPT operations, contractor shall conduct the standard system maintenance utilizing procedures and standards outlined in AFI 33-150, Management of Cyberspace Support Activities, and TO 00-33A-1001, General Communications Activities Management Procedures and Practice Requirements which includes .

3.2.3.7.9.1 The contractor shall use AF-approved Maintenance Information Systems (MIS) to document maintenance/logistic activities. An AF-approved centrally managed level MIS is the tool used to track outages and other crucial data to help manage the equipment/system cradle to grave. Specifically, the contractor shall use the Integrated Maintenance Data System (IMDS) and Remedy.

3.2.3.7.9.2 The contractor shall implement Maintenance Data Collection (MDC) to enter systems and component failure(s) IAW TO 00-20-2, and Time Compliance Technical Order (TCTO) reporting requirements IAW TO 00-5-15, Air Force Time Compliance Technical Order Process.

3.2.3.7.9.3 The contractor shall provide complete source MDC documents and forms or automated products if not directly inputting data into the MIS.

3.2.3.7.9.4 The contractor shall follow unit standard operations procedures for system restoral priorities; system restoral response times; maintain configuration control; and document historical records, if not using the AF-approved MIS.

3.2.4 Cyber Protection Team (CPT) Operations

The contractor shall support advance mission assurance using DCO capabilities in support of DoD assets. This includes assessing cyberspace terrain and conducting risk analysis with regard to the designated networks/systems; deploying, integrating and providing advanced protection capabilities; identifying adversary maneuvers; and mitigating adversary operations in and across cyberspace key terrain IAW the USCYBERCOM JCT&CS. The contractor IAT Level requirements are identified in Appendix D.

3.2.4.1 Cyber Planning

The contractor shall coordinate and plan operations including scheduling, gaining proper network access and scoping lines of effort.

3.2.4.2 Mission Protection (MP)

The contractor shall provide support for the Mission Protection (MP) squad per CPT which coordinates with the mission owner to: 1) identify tasks and objectives to be supported by CPT effects; 2) identify the mission owner’s cyberspace key terrain and critical assets; and 3) develop and execute the mission Risk Mitigation Plan (RMP) and Mission Defense Plan (MDP). MP capabilities work to primarily enable two direct actions: 1) the improvement of existing embedded cyberspace defenders’ abilities to conduct mission, terrain, and risk analysis and employ risk mitigation effects, and 2) direct the execution of risk mitigation efforts through the CPT and synchronize with the larger DoD cyberspace operations (CO). The contractor shall support all phases of the MP squad defined by the CPT Concept of Operations (CONOP).

3.2.4.2.1 Windows Systems Architecture

The contractor shall provide expert operating system defense for Windows operating system;

identify and mitigate operating system vulnerabilities and imbedded persistent threats with a focus on forensics and server administration capabilities; and detect and emulate operating system adversary TTPs.

3.2.4.2.2 UNIX Systems Architecture

The contractor shall identify and mitigate UNIX or UNIX-based operating system vulnerabilities and imbedded persistent threats with a focus on forensics and server administration capabilities, and detect and emulate operating system adversary tactics, techniques and procedures.

3.2.4.2.3 Cyber Security Analysis

Contractor shall conduct overall vulnerability analysis, provides risk mitigation support, understands, detects and emulates adversary tactics, techniques and procedures.

3.2.4.2.4 Network Infrastructure

The contractor shall implement Computer Network Defense (CND) infrastructure support;

identify and mitigate infrastructure vulnerabilities and persistent threats; and understand, detect, and emulate network infrastructure adversary tactics, techniques and procedures.

3.2.4.2.5 Network Operations

The contractor shall detect and emulate network infrastructure adversary TTPs to defend against physical or logical access to network components including wireless technologies.

3.2.4.2.6 All Source Intelligence Analysis

The contractor shall provide a primary focal point support for the definition and understanding of adversary TTPs with special emphasis placed on Battle Damage Assessment Analysis.

3.2.4.3 Cyber Readiness (CR)

The contractor shall provide in-depth reviews of mission-supporting cyber assets ensuring compliance with DOD policies and regulations. Through targeted inspections, the contractor shall review the effectiveness of current security policies, recommend/direct changes, and provide insight into the inspected organization’s operational readiness.

3.2.4.3.1 Windows Systems Architecture

The contractor shall perform defensive TTPs specific to the Microsoft Windows Operating System with a focus on security auditing; identifying and mitigating operating system vulnerabilities and imbedded persistent threats; and detecting and emulating operating system adversary TTPs.

3.2.4.3.2 UNIX Systems Architecture

The contractor shall perform defensive TTPs specific to the UNIX or UNIX-based Operating System with a focus on security auditing; identifying and mitigating operating system vulnerabilities and imbedded persistent threats; and detecting and emulating operating system adversary TTPs.

3.2.4.3.3 Cyber Security Analysis

The contractor shall detect and emulate adversary TTPs, while conducting overall vulnerability analysis, and providing risk mitigation support with an emphasis on IA Compliance.

3.2.4.3.4 Network Infrastructure

The contractor shall implement network infrastructure support; identify and mitigate infrastructure vulnerabilities and persistent threats; and understand, detect and emulate network infrastructure adversary TTPs.

3.2.4.3.5 Network Operations

The contractor shall detect and emulate network infrastructure adversary TTPs to defend against physical or logical access to network components including wireless technologies.

3.2.4.3.6 All Source Intelligence Analysis

The contractor shall provide primary focal point support for the definition and understanding of adversary TTPs; conduct review of mission owner’s ability to communicate intelligence requirements; integrate intelligence into operation and decision; and provide feedback to the intelligence system.

3.2.4.4 Cyber Support (CS)

The contractor shall identify and correct deficiencies in security and defensive operations, policies, and procedures with the end-state of an improved and self-sustaining security posture.

This task can be procedural or technical in nature and is designed to cover the gaps in personnel training or capacity to achieve or sustain proper security. The contractor shall work closely with the organic network operators and defenders at an organization to plan, train, and deploy mitigations for cyber vulnerabilities.

3.2.4.4.1 Windows Systems Architecture

The contractor shall provide expert operating system defense for Windows operating system;

identify and mitigate operating system vulnerabilities and imbedded persistent threats with a focus on Server Administration and Cyber Training; and detect and emulate operating system adversary TTPs.

3.2.4.4.2 UNIX Systems Architecture

The contractor shall provide expert operating system defense for UNIX and UNIX-based operating system; identify and mitigate operating system vulnerabilities and imbedded persistent threats with a focus on Server Administration and Cyber Training; and detect and emulate operating system adversary TTPs.

3.2…