FY25 OT Stack Phase 2 SOW - 05202025 DRAFT.pdf

STATEMENT OF WORK (SOW)

FOR

INSTALLATION RESILIENCE OPERATIONS COMMAND & CONTROL (IROC)

OPERATIONAL TECHNOLOGY (OT) STACK FY25

15 May 2025

Table of Contents

Section I – Description of Services

1.0 General

1.1 Background

1.2 Scope

Section II - Requirements

2.1 Acquisition

2.2 Configuration

2.3 Installation

2.4 Cutover

Section III - Deliverables Section IV - Timeline Section V - General Information

5.1 Location

5.2 Security and Training Requirements

Section VI – Facilities List

6.1 GFGI Facilities List

6.2 CFCI Facilities List (Configuration Labor Only)

Section VII - Appendix I

7.1 Component Descriptions

7.2 IMPLEMENTATION OF DISCLOSURE OF INFORMATION

7.3 ACRONYMS

SECTION I – DESCRIPTION OF SERVICES

1.0 General.

The Natural Disaster Recovery (NDR) Division provides installation recovery and reconstruction capabilities to the USAF after the impacts of natural disasters. Currently, the NDR oversees major reconstruction programs for Tyndall AFB, Florida and Offutt AFB, Nebraska. Within the NDR, the Integration Branch oversees several key technical innovations, including controls modernization and cybersecurity.

1.1 Background.

Tyndall AFB was devastated by Hurricane Michael in October 2018. USAF senior leadership directed Tyndall’s restoration “not as it was, but as it needed to be” and to identify and incorporate innovative technologies under the banner of “Installation of the Future”. The NDR team identified the need for unified installation operations command and control and developed the Installation Resilience Operations Command and Control (IROC) requirement. This requirement was awarded via Other Transaction Authority (OTA) in 2020. IROC can connect a variety of sensors and systems at greater Confidentiality, Integrity, Availability (CIA) ratings than previous approaches and delivers data via the Cloud to multiple stakeholders, outside the FRCS enclave, to enhance decision making and improve situational awareness.

1.2 Scope.

AFCEC, and its higher headquarters, AFIMSC, operate several Facility-Related Control Systems (FRCS) to monitor, manage, and control various facility aspects across USAF bases world-wide.

Deployment of the Operational Technology (OT) stack in each facility provides secure connectivity between the devices and the central IROC services in the base data center. This scope of work shall acquire, configure, and deploy OT networking infrastructure in connected facilities and cutover connected FRCS devices to the IROC network.

SECTION II - REQUIREMENTS

2.1 Acquisition.

For Government-Furnished/Government-Installed (GFGI) facilities, the contractor shall provide all the tools, labor, materials, and equipment to purchase, configure, and install the appropriate OT stack configuration based on the 1) number and capacity (i.e., port count) of switches, 2) OT Gateways (OTG) (typ. 1 per facility), 3) Uninterruptible Power Supplies (UPS), and 4) necessary mounting, power, and uplink/downlink media (i.e., Ethernet patch cables, media converters, fiber transceivers, and fiber patch cables) at the facilities indicated in Section VI, para. 6.0. All parts shall meet the specifications provided in Section 7.0 APPENDIX 1. Each facility will have its own requirements, based upon the design/layout of the facility and connectivity end points for each OT device.

For the GFGI facilities listed in para. 6.0, the following items will be provided under this contract:

a. OTG, power supply, and mounting rail

b. Cisco 9200 series switch (may need multiple per facility) or 3200 series when ruggedized is required

c. UPS, 1 per closet with OT equipment

d. SFP modules and fiber jumpers to support uplink from child closet(s) to master comm closet

e. Ethernet patch cables to support connectivity from OT switch to OTG and from OTG to

COMM switch

f. Ethernet patch cables from the OT device patch panels to the OT switch

For Contractor-Furnished/Contractor-Installed (CFCI) facilities, the contractor shall provide all the tools and labor necessary to configure the OT stack configuration reflected in para. 6.1.

2.2 Configuration

The contractor shall configure the OTG and OT switches according to IROC cybersecurity STIGs and enroll devices in IROC enterprise management.

a. OTG configuration (one per facility).

b. OT Switches, multiple per facility depending upon configuration.

c. UPS communications with OTG to manage events and shutdown.

2.3 Installation

For GFGI facilities, the contractor shall physically install OT Gateway, OTG power supply, OT switches, and UPS in the rack as necessary in each designated COMM closet. Contractor shall install fiber and copper patch connections as necessary to inter-connect all OT equipment to IT switch at designated connection point(s). It should be noted that some COMM closets are in secure areas;

therefore, the contractor shall work with the Government to coordinate the appropriate paperwork with the security office to obtain access to these areas.

2.4 Cutover

The contractor shall connect each OT device connection to the IROC network. This support includes the following.

a. Enroll/configure secure device connection on the OTG or OT Switch for each OT device (direct connection to OTG when only 1-2 [device] connections in the facility

b. Coordinate with facility MILCON contractor, or its assigned agents, to execute connection of OT devices to the OTG or switch.

c. Configure and test OT device network configuration to ensure it is communicating properly on the network and to other FRCS devices and systems.

SECTION III - DELIVERABLES

The Contractor shall provide deliverable(s) in a format mutually agreed upon by the Government and the Contractor. The following deliverables are not expected to change. Due Date intervals are not expected to change but actual dates may need to be revised depending on actual contract start date.

DELIVERABLE DUE DATE DELIVERY METHOD

Progress Reporting Monthly By email to the COR OT Stack documentation for RMF Compliance

Within 1 week of completing cutover for each facility completed.

By email to the COR and IROC ISSM in artifact format provided in eMASS system

SECTION IV - TIMELINE

The timeline for equipment acquisition, configuration, installation and cutover is driven by the Joint Occupancy Date (JOD) for each facility, according to their respective construction schedules. Vendors may acquire the equipment for all facilities in a task order at one time and will be responsible for securing that equipment until it is installed in each facility.

SECTION V - GENERAL INFORMATION

5.1 Location.

All work will be performed at Tyndall AFB.

5.2 Security and Training Requirements

Information processed on the IROC system shall be treated CUI.

SECTION VI – FACILITIES LIST

6.1 GFGI Facilities Requirements List

6.2 CFCI Facilities Requirements List (Configuration Labor Only)

FACILITY

NUMBER

(Note 1)

FACILITY NAME

Joint

Occupancy Date (JOD)

CURRENT

BOD

COMM

Closets

OT

COMM

Closet

Secure

COMM

Closets

Total Ports /

Devices

OTG

OTS -

12 Port

OTS - 24

Port

OTS -

48 Port

UPS

Fiber

Patches Ethernet Patches

0120M

F-35 MAINTENANCE

SQUADRON COMPLEX

6/2/2025 9/12/2025 3 3 17 1 1 2 1 3 4 2

TBD HYDRAZINE 6/27/2025 10/7/2025 1 1 0 7 0 1 0 0 1 1 0

TBD WASH RACK 6/27/2025 10/7/2025 1 1 0 2 0 1 0 0 1 1 0

0125M

F-35 AEROSPACE GROUND

EQUIPMENT (AGE)

FACILITY

7/3/2025 10/13/2025 3 3 18 1 2 1 0 3 4 2

0110M

AIRCRAFT MX FUEL CELL

HANGAR

8/2/2025 11/12/2025 1 1 1 18 1 0 1 0 1 0 2

0420M F-35 SIMULATOR 10/4/2025 1/14/2026 2 2 1 52 1 0 0 2 2 2 2

0160M OPS / AMU / HANGAR 1 10/5/2025 1/15/2026 8 4 2 60 1 0 0 4 4 6 2

1090M BASE ENGINEER ADMIN 10/28/2025 2/7/2026 3 2 46 1 0 1 1 2 2 2

1093M

BASE ENGINEER

MAINTENANCE SHOP &

COVERED STORAGE

FACILITY

10/28/2025 2/7/2026 2 2 26 1 1 1 0 2 2 2

1150M SUPPLY ADMIN HQ 10/28/2025 2/7/2026 1 1 23 1 0 0 1 1 0 2

1152M VEHICLE OPERATIONS

ADMIN - VEHICLE

10/28/2025 2/7/2026 2 2 30 1 0 2 0 2 2 2

1154M SUPPLY WAREHOUSE 10/28/2025 2/7/2026 3 3 1 15 1 1 2 0 1 4 2

1154SES SUPPLY EQUIPMENT SHED 10/28/2025 2/7/2026 1 1 0 5 1 1 0 0 1 0 2

1156M VEHICLE WASH RACK 10/28/2025 2/7/2026 1 1 1 1 1 0 0 1 0 2

1158M HAZARDOUS STORAGE 10/28/2025 2/7/2026 1 1 12 1 1 0 0 1 0 2

Note 1: CES Real Property reserves the right to amend facility titles prior to or upon receipt of the DD Form 1354

FACILITY

NUMBER

(Note 1)

FACILITY NAME

Joint

Occupancy Date (JOD)

CURRENT BOD

COMM

Closets

OT

COMM

Closet

Secure

COMM

Closets

Total Ports /

Devices

7000M

MUNITIONS

ADMINISTRATION FACILITY

6/10/2025 9/20/2025 1 1 17

7062M

ANCILLARY EXPLOSIVE

FACILITY / MAC PAD

6/10/2025 9/20/2025 1 0 1 15

Note 1: CES Real Property reserves the right to amend facility titles prior to or upon receipt of the DD Form 1354

SECTION VII - APPENDIX

7.1 Component Descriptions

OT Gateway (OTG). The OTG is a VPN appliance and firewall to encrypt and control network traffic from OT devices across the base area network (BAN) to the IROC enclave within the base data center.

The OTG is uses a custom, government-owned and provided operating system image, or firmware, on an industrial PC platform. This image has been hardened and tested to meet cybersecurity requirements and is a key part of the IROC accreditation package, or Authority to Operate (ATO). The critical nature of this component means that replacement with alternatives would require [costly] [re-]accreditation and delays in implementation timetables.

Likewise, alteration of the existing image to support different hardware would incur additional unacceptable engineering cost and timetable delays. Suppliers of the OTG must meet the following specifications:

• TAA-Compliant manufacture and parts supply

• Motherboard/chipset: Intel Atom 4 Core X6211E / X6413E / X6414RE with system on a chip

(SoC) and graphics controller

• Operating System: Capable of running government-packaged Linux-based image

• RAM: Minimum of 4GB

• Storage: Minimum of 256GB solid state drive (SSD)

• Interfaces: (3) 10/100/1000 Mbps Ethernet ports, (4) USB 3.1 (USB-A), 1 COM serial connection

• Size/Mounting: DIN rail mount capable for mounting in standard 19-inch rack.

Space requirements shall not exceed 4U for all cable and connector clearances.

• Power: 24V DC supplied via external power supply/transformer with standard 110/120V wall or UPS plug

• Environment: Designed for harsh environments with fanless, sealed enclosure in continuous operations at up to 55°C, minimum of IP40 rating

• Configuration Stability: Product life of 10 years, ensuring future supply chain availability for ease of replacement or expansion as USAF needs dictate.

• An example of a suitable, commercially available model is the Siemens Simatic IPC227G.

The Simatic IPC may be supplied with other operating systems, but the government’s image must be installed on the device. Alternative makes and models may be proposed, but the vendor is responsible for evaluating compatibility with the government image.

OT Network Switch. The OT Switch is used when there are more than two OT devices to connect to the OTG. The switch is the first line of defense in preventing unauthorized devices from connecting to the network and communicating with other devices. Using the principle of “configuration through code,” the OT Switch is configured via command scripts to automate configuration to streamline operations and eliminate errors. This capability ensures switch configuration security and is as key component of the IROC accreditation. Command scripts are vendor and model specific, and use of an alternative make or model would require significant security engineering, testing, and accreditation rework. The only model(s) currently supported is(/are) the Cisco 9200 family.

Uninterruptible Power Supplies (UPS). The OT Stack requires dedicated uninterruptible power to manage power outages, both to protect the equipment from electrical damage and to continue passing network traffic from unaffected portions of the facility. The UPS needs to meet the following specifications:

• TAA compliant

• 1- or 2U 19” rack mount

• Enough 120VAC receptables to match the number of OT stack devices at that location

• Provide a runtime of 30 minutes, and power demands including powering the OTG and all

OT switches (if needed for that location) with 50% of the ports using PoE+

• The OTG will communicated with the UPS via Network UPS Tools (NUT) package, and the UPS must be a supported model with this library (https://networkupstools.org/stable- hcl.html) at or above level 3 (denoted by 3 stars in the legend on this page.

• Lifecycle management will be a factor when considering proposals. Vendors may choose to size UPS equipment above the specific needs for a given location, for the purposes of and with the acknowledged benefit to provide the Air Force with reduced model variability/complexity across the installation. There are currently three makes employed across the installation in communications closets, including American Power Conversion (APC), Eaton, and Tripp-Lite.

Vendors are not restricted to these choices, but they are provided for vendor awareness when considering lifecycle cost factors.

Patch Cables. Patch cables shall be CAT5E or greater with sufficient length to connect between patch panels and devices utilizing cable management raceways. Patch cables for devices connected to CE systems shall be colored orange. Patches for devices connect to SF systems shall utilize grey (gray) cabling. Connections between the OT switch and gateway, and between the gateway and the Comm Squadron switch shall both be orange.

Media Converter. Media converter shall utilize un-managed, non-aggregating converters where identified to convert between fiber and copper (i.e. CAT 5e/6) media. Where multiple converters are required in one location (typically in primary COMM rooms) a high-density rack-mountable chassis shall be used. Existing locations have employed a Perle MCR1900 modular chassis system. Identification of this make and model is not an endorsement or requirement but is intended to communicate the type of equipment already deployed which matches this requirement description.

7.2 IMPLEMENTATION OF DISCLOSURE OF INFORMATION

To comply with DFARS 252.204-7000, Disclosure of Information, the Contractor should submit two copies of the information to be released to the Air Force Program Manager (PM) and/or Contracting Officer’s Representative (COR) and Contracting Officer at least 10 days prior to the scheduled release date. The PM or COR will follow the same review process as for in-house authors and will provide the Public Affairs (PA) clearance number and date cleared (or denial reason) to the Contractor upon completion of Security and Policy Review (S&PR).

7.3 ACRONYMS

AFB – Ai r Force Base

AFCEC – Air Force Civil Engineering Center

AFIMSC – Air Force Installation Management Support Center ATO – Authority to Operate

CFCI – Contractor-Furnished/Contractor-Installed CIA – Confidentiality, Integrity, Availability

FRCS – Facility Related Control System

GFGI – Government-Furnished/Government Installed IotF – Installation of the Future

IROC – Installation Resilience Operations command and Control JOD – Joint Occupancy Date https://networkupstools.org/stable-hcl.html https://networkupstools.org/stable-hcl.html

OT – Operational Technology OTG – OT Gateway

SSD – Solid State Drive

UPS – Uninterruptible Power Supply

USB – Universal Serial Bus