RFI_Cyber_SU.pdf

Project Manager Mission Command (PM MC) has a Request for Information (RFI) for COTS and or GOTS Software solution for Cyber Situational Understanding (SU) Program.

1.0 Introduction

Request for Information (RFI). This RFI is for information and planning purposes only - it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. The Government may revise its draft requirements at any time, or may elect not to proceed with a procurement.

Contractors are not required to respond to this announcement, but may do so at their own cost. The United States Government will not pay for information requested nor will it compensate any respondent for any cost incurred in developing information provided to the United States Government.

The Government may conduct a product demonstration in accordance with this RFI later. If a Product demonstration is required, it will be completed prior to the end of September 2019. It is required that any of the technologies identified to this RFI be a Technical Readiness Level (TRL) of 8 or higher, and be of either commercial or non-developmental nature.

2.0 Overview

The Cyber Situational Understanding (SU) mission is to provide the U.S. Army a SU of cyberspace throughout the full range of military operations, to prevent, shape, and win conflicts, enabling friendly freedom of action in all domains and phases of conflict. Cyber SU enables CEMA (Cyber Electromagnetic Activities) analysis and CCIR (Commander Critical Information Requirements) development to inform the Commander in operational terms, the state and status of cyber operations, and their impact to overall mission operations.

Cyber SU integrates COTS capabilities into the Command Post Computing Environment (CPCE) to enable CEMA Working Group operations across the Physical, Network and Cyber-persona Cyber Operational (CO) layers, to include cross-staff MDMP/CoA development and running estimate support.

Uses CPCE infrastructure to build and present a consolidated picture of the CEMA operational environment relevant to strategic, operational and tactical Army units. Interfaces with external intelligence and network operation support systems for real-time cyber operational data analysis and visualization by the CEMA working groups.

3.0 Requirements

The Army is seeking to procure a Commercial-Off-The-Shelf / Non-Developmental Item (COTS/NDI) software infrastructure package that will allow for immediate 3rd party development of integrated Command Post, Mounted and Dismounted tactical computing capabilities to meet the Army Acquisition Executive (AAE) directed requirement for establishing a Common Operating Environment (COE). This will be a phased approach:

1. Cyber SU Phases:

a. Phase I is See Yourself: Subsequent requirements below (starting with 2) describe at an unclassified level what is required. Initial release of software capabilities to Army Battle Labs are expected in 4QFY20. This early release will provide the Government the ability to gain early Warfighter feedback.

b. Phase 2 is See Battlespace: Details provided later.

c. Phase 3 is Understand the Battlespace: Details provided later.

2. Any selected software capability will need to be a technically mature software baseline equivalent to Technology Readiness Level (TRL) 8 or greater within a tactically deployed network and information system environment.

3. The software capability will be hosted on an Army tactical server and be integrated into the Army's Common Operating Environment (COE), Command Post Computing Environment (CPCE) v3 or later framework. Given that tactical server resources are shared and limited;

responses should include CPU and RAM estimates and storage needs beyond storing raw data feeds.

4. The software capability must be able to efficiently and effectively normalize disparate data sources, lexicons, and formats to permit data correlation and analysis. The COTS/GOTS software application(s) must be capable of presenting the data in a usable and consolidated manner to allow tactical Commanders and their staff users to quickly comprehend the Cyber SU operational picture and then develop actionable Courses of Action to address operational risks and opportunities.

5. The desired outputs for the COTS/GOTS software solution must be a dashboard(s), analytical reports, in-depth analysis of second/third-order effects, and operational CCIRs (Commander Critical Information Requirements). Note the Common Operating Picture (COP), including maps and map overlays and collaboration tools (e.g., chat) will be provided by the CPCE v3 framework. Any COTS/GOTS using map data must be able to integrate with the CPCE geospatial capability.

6. The software must be compliant with the requirements of Cyber Electromagnetic Activities (CEMA), Army FM 3-12. The capabilities of the software must be able to support of Multi- Domain Operations within the Mission Command footprint. The software should have the following capabilities:

a. Ingest, analyze, correlate, and display relevant cyberspace data from multiple Joint, Army, and non-DOD sources into useful, actionable information for the Warfighter at the tactical echelons. Focus areas with associated data fields from Army system data providers for Cyber SU capability are the following (understanding that some areas may require additional development time):

• Network topology

• Network and system configuration

• Network and system health/status

• Cyber Threat Intelligence

• Indications and Warnings

• Network Incidents

• Anomalous Network Activity

• Anomalous System Activity

• Security Events

• Mission Impact

• Force Status

b. The software supporting Army CEMA must be able to correlate and fuse existing and future cyber, movement and maneuver, command and control, intelligence, protection, and fires data to create a depiction, perception, and understanding of cyberspace that enables the delivery of commander’s desired effects in support of operations.

7. COTS software application(s) should be capable of integrating data from specific Army Programs of Records (PORs), which include but are not limited to:

a. PM Tactical Networks (TN), i.e., WIN-T relevant equipment (e.g., switches, routers, firewalls, NetOps tools, SIEM tool, HBSS, vulnerability scanners, IPS/IDS, etc.)

b. PM Mission Command, Command Post Computing Environment (CPCE)

c. PM Distributed Common Ground System-Army (DCGS-A),

d. PdM Electronic Warfare Planning and Management Tool (EWPMT)

e. Tactical Defensive Cyber Operations-Infrastructure (TDI).

8. The COTS tool must provide a level of automation to reduce Warfighter workload and increase efficiencies

9. The software capability must be able to provide an Army staff the ability ingest, normalize, correlate, and analyze data from various computer and network devices, such as but not limited to the following capabilities:

a. Host Intrusion Prevention System (HIPS), intrusion protection system (IPS)/intrusion detection system (IDS), advanced firewalls; vulnerability scanners, compute management metrics (e.g., indicating high-CPU and/or memory utilization), SCADA (Supervisory Control and Data Acquisition) data (e.g., HVAC and generator status data). The additional intent is to use applicable data to reduce the likeliness of false positives.

b. Cyber threat intelligence (CTI) data provided by an Army intelligence system

c. Electromagnetic spectrum and electronic warfare (EW) data provided by an Army EW system.

10. The software capability must be extensible to accommodate additional functionality, such as the display and correlation of electronic warfare and intelligence information, expanded dashboards, graphics, and data.

11. The software capability will provide run-time environments that are interoperable with Microsoft Windows Army Gold Master (Windows Server, version intentionally withheld), Linux Operating System (OS), and run in a virtual environment.

12. Software must not utilize proprietary or closed APIs, and should be developed using best practices for extensibility.

13. The software capability must be installable, configurable, and supportable without the need for any deployed Field Service Representatives (FSRs).

14. The product must meet requirements for certification on unclassified and classified networks per Cybersecurity Risk Management Framework (RMF) requirements (DoDI 8500.01), and maintained compliant with US Army CYBERCOM IAVA requirements.

4.0 White Paper and Supporting Documentation

Requested Information

The Government is requesting interested sources provide sufficient information in the form of a White Paper, which demonstrates recent experience and the capabilities in providing the requirements described in this RFI. White Papers shall be submitted electronically, in Microsoft Word or Adobe PDF format. The White Paper shall consist of no more than 10 pages. The paper will include:

1. Description of capabilities to meet the requirements

2. Any End User License Agreement/Terms of COTS required to meet the capabilities (see below for criteria)

3. Relevant Past Performance within last 5 years

4. Name of Company

5. Cage Code and DUNS Number

6. Address

7. Point of Contact including Phone Number and E-mail Address

The Government will use the information submitted in response to this notice at its discretion and will not provide comments to any submission; however, the Government reserves the right to contact any respondent to this notice for the sole purpose of enhancing understanding of the notice submission.

Information received will not be considered releasable unless it is labelled confidential and proprietary.

Company proprietary data will be reviewed by Government employees and authorized representatives only.

1. Questions:

a) Does your company utilize best practices for software development, i.e. Capability Maturity Model Integration (CMMI) certification? If so, what is your certification level?

Licenses and Maintenance Agreements

1. Describe the terms and conditions, maintenance program

2. Enterprise License Agreement