Draft_RFP_Section_C H.pdf

USYCBERCOM IDIQ Advance Notice

ADVANCE NOTICE

Indefinite Delivery/Indefinite Quantity (IDIQ) in support of:

United States Cyber Command (USCYBERCOM)

Conducted under FAR Part 15

Issued by:

The Federal Systems Integration and Management Center (FEDSIM)

1800 F Street, NW

Suite 3100 (QF0B)

Washington, D.C. 20405

DRAFT SECTION C – PERFORMANCE STATEMENT OF WORK

USYCBERCOM IDIQ Advance Notice PAGE C - 1

C.1 BACKGROUND

On June 23, 2009, the Secretary of Defense directed the Commander of United States Strategic

Command (USSTRATCOM) to establish a sub-unified command, USCYBERCOM. The newly established USCYBERCOM developed a mission to plan, coordinate, integrate, synchronize and conduct activities to: direct the operations and defense of specified Department of Defense DOD information networks (DODIN) and prepare to, and when directed, conduct full spectrum military cyberspace operations in order to enable actions in all domains, ensure United States

(US)/Allied freedom of action in cyberspace and deny the same to our adversaries.

USCYBERCOM is located at Fort George G. Meade, Maryland (MD).

USCYBERCOM conducts and synchronizes activities to: secure, operate, and defend the

DODIN; attain freedom of action in cyberspace while denying same to adversaries; and, when directed, conduct full spectrum cyberspace operations in order to deter or defeat strategic threats to US interests and infrastructure, ensure Department of Defense (DOD) mission assurance, and achieve force commander objectives. USCYBERCOM accomplishes this by organizing supporting forces to achieve unity of effort across three lines of effort: PROTECT & defend US cyberspace interests, PROJECT power in & through cyberspace, and PARTNER with interagency & partner nations. Each line of effort is applied to three mission objectives; deter or defeat strategic threats to US interests and infrastructure, ensure DOD mission assurance, and achieve Joint Force Commander objectives.

The Cyber Mission Force (CMF), which includes the Services and trained and certified teams, and therefore ready teams, will improve defenses and expand the operational options for national decision makers, DOD leadership, and joint force commanders. The missions of these teams will be aligned with intelligence capabilities and military requirements. Currently, the DOD has three command forces (Cyber National Mission Force (CNMF), Cyber Combat Mission Force, and

Cyber Protection Force) that were created to help defend and react to a cyberattack on the nation:

1. Cyber National Mission Force (CNMF) – comprised of National Mission Teams

(NMTs), National Support Teams (NSTs), and National Cyber Protection Teams

(CPTs) and are assigned the mission to defend the nation in cyberspace and, if directed, defend our critical infrastructure and key resources (CIKR) against Nation

State and Non-State actors.

The CNMF was officially activated on 17 January 2014 with a dedicated mission focused on cyberspace operations: to plan, direct and synchronize cyberspace operations to deter, disrupt, and if necessary, defeat adversary cyber actions in order to defend the nation. USCYBERCOM supports the CNMF by providing acquisition support.

2. Cyber Combat Mission Force – comprised of Combat Mission Teams (CMTs) and

Combat Support Teams (CSTs) are assigned to provide support to Combatant

Command priorities and mission areas.

3. Cyber Protection Forces - comprised of Service, Defense Information Systems

Agency (DISA), and Combatant Command CPTs. They are assigned to the mission area of securing, operating and defending the DODIN. These teams are specialized to prepare and protect key military cyber terrain to provide mission assurance.

USYCBERCOM IDIQ Advance Notice PAGE C - 2

C.1.1 USCYBERCOM MISSION

As a result of its establishment and mission, USCYBERCOM is charged with accomplishing the following:

a. Unifying existing cyberspace resources, creating synergy that does not currently exist, and synchronizing war-fighting effects to defend the information security environment;

b. Centralizing command of cyberspace operations strengthens DOD cyberspace capabilities and integrates and bolsters the DOD’s cyber expertise; and

c. Improving the DOD’s capabilities to ensure resilient, reliable information and communication networks, counter cyberspace threats, and assure access to cyberspace.

d. Support the Armed Services’ ability to confidently conduct high-tempo, effective operations, as well as, protect command and control systems and the cyberspace infrastructure supporting weapons system platforms from disruptions, intrusions and attacks.

C.1.2 CURRENT ENVIRONMENT

Background information relating to each of the task areas below is detailed in Appendix A. Also detailed in Appendix A, is the contract history for the work related to the core disciplines below.

C.1.3 JOINT DIRECTORATES

J0 – Chief of Staff: Provides enterprise level staff leadership, strategic communications coordination, logistics requirements, command information, business management, support, and enabling functions.

J1 - Manpower & Personnel: Leads the command in creating an integrated, agile, responsive and ready cyber workforce capable of conducting full spectrum cyberspace operations.

J2 - Intelligence: Provides decision-quality, timely all-source intelligence which informs and enables USCYBERCOM across the full spectrum of military cyberspace operations.

J3 - Cyberspace Operations: Plans, coordinates, integrates, synchronizes, and conducts activities directing the operation and defense of the DODIN and, when directed, conducts full spectrum military cyberspace operations in order to enable actions in all domains, ensure

US/Allied freedom of action in cyberspace, and deny the same to our adversaries..

J4 - Logistics: Provides integrated logistics capabilities enabling USCYBERCOM and components to achieve desired global effects.

J5 - Plans and Policy: Responsible for cyberspace strategies, policies, doctrine, deliberate plans, assessments, and partnerships.

J6 – Command and Control (C4) Systems and Information Technology (IT): Provides premier C4 and IT capabilities for USCYBERCOM to conduct full spectrum military cyberspace

USYCBERCOM IDIQ Advance Notice PAGE C - 3 operations.

J7 - Joint Exercises and Training: Develops and prepares world-class fully capable cyber forces for the present and future, ready to conduct military operations, build partner capacity, and promote engagement through doctrine, education, training, exercises, simulation, wargames, and readinesss.

J8 - Capability and Resource Integration: Guides the Planning, Programming, Budgeting, and

Execution (PPBE) process in acquiring resources to satisfy mission requirements. Provides procurement and financial management services for effective expenditure of funding. Conducts analyses and assessments to ensure investments are balanced to achieve maximum benefit.

J9 – Advanced Concepts and Technology: Drives delivery of Tactics, Techniques, and

Procedures (TTPs) and corresponding material capability solutions designed to meet

USCYBERCOM and Combatant Command (CCMD) cyberspace requirements across full spectrum cyberspace operations.

C.2 SCOPE

The scope of these requirements includes capabilities, knowledge, and expertise in the full range of technologies, intelligence, training and exercises, and business areas needed to support

USCYBERCOM’s operational mission. In addition, the scope includes cyberspace operations, planning, research and development, test, and evaluation services.

C.3 OBJECTIVE

The objective of this requirement is an Indefinite Delivery/Indefinite Quantity (IDIQ) contract dedicated to providing mission support services of USCYBERCOM and CMF. These disciplines will include C4, Intelligence, and cyber Mission support areas, and elements of the DODIN and

Joint Information Environment (JIE) in support of the United States Cyber Command mission.

C.4 OVERACHING IDIQ PROGRAM MANGEMENT SUPPORT

The contractor shall designate one (1) individual as the IDIQ Program Manager (IDIQ PM) and one (1) individual as the Corporate Contract Manager (CCM).The contractor shall ensure that the

CO has current point-of-contact information for both the IDIQ PM and CCM. In the event of a change, the contractor shall notify the CO and provide all Point of Contact information within five calendar days of the change. All costs associated with designated PM and CCM duties shall be handled in accordance with the contractor’s standard accounting practices; however, no costs for the PM and CCM may be billed at the IDIQ contract level. Failure of the contractor to effectively and efficiently perform their duties will be construed as conduct detrimental to contract performance and may result in Off-Ramping (see Sections H.20).

IDIQ PM

The IDIQ PM will serve as the single point of contact for coordination of program issues with the FEDSIM COR/USCYBERCOM TPOC. The IDIQ PM shall have full authority (overarching)

USYCBERCOM IDIQ Advance Notice PAGE C - 4 to act for the contractor on all contract matters relating to daily operation of this contract and

TOs issued under this contract. The PM shall be responsible for the overall management of the contract and TOs under this contract to include oversight of all activities performed by contractor personnel, subcontractors, cost, schedule, and technical quality. The PM shall take immediate corrective action when performance is not acceptable to the FEDSIM COR/USCYBERCOM

TPOC. The qualifications for the IDIQ PM are listed in section H.1.1. Key Personnel IDIQ PM.

The IDIQ PM is not required to be on-site.

CCM

The contractor shall also assign a Corporate Contract Manager (CCM) to represent the contractor as primary points-of-contact to resolve issues, perform administrative duties, and other functions that may arise relating to the IDIQ contract and TOs solicited and awarded under the IDIQ.

There is no minimum qualification requirements established for CCM. Additionally, the CCM does not have to be a full-time position; however, the CCM is expected to be fully proficient in the performance of their duties. The CCM is not required to be on-site.

C.5 CORE DISCIPLINES

The following describes the services required for each core discipline. The specific support requirements will be the subject of fully defined Task Orders (TOs) that will be executed and administered in accordance with the terms and conditions defined in the IDIQ Basic Contract and

TO. The evolving responsibilities of USCYEBRCOM may require additional missions/requirements not currently identified. Each TO will apply performance-based outcomes and standards as appropriate to the type of work. High quality products and services delivered in a timely and cost effective manner will be the primary criteria for the work performed under the

Basic Contract. The specific application of these criteria will be supplied with the individual

TOs.

C.5.1 CORE DISCIPLINE 1 – BUSINESS ADMINISTRATION AND PROGRAM

MANAGEMENT SUPPORT

Support provided at the individual TO level will require coordination with other contractors working in the USCYBERCOM environment. All core disciplines within the scope of this Basic

Contract and at the individual TO level require coordination with other contractors in order to be performed effectively. Particularly in the case of responding to a specific threat, all personnel need to be involved, including contractors, and integrated to produce results quickly. Quick response times required to counter threats are unique to the domain of warfare and require tightly coupled integration for mission success. This need for tightly coupled integration of support bleeds into every aspect of the USCYBERCOM. As such, as part of the Program Management core discipline, the contractor shall ensure that the required coordination is understood and closely coordinate, as necessary, with the other contractors so that the USCYBERCOM mission is supported effectively.

C.5.1.1 SUB CORE DISCIPLINE 1 – ADMINISTRATIVE SUPPORT

USYCBERCOM IDIQ Advance Notice PAGE C - 5

Administrative Support includes general office support; coordination between organizations for day-to-day operations; scheduling and coordinating meetings, visits, conferences, and events;

preparing, processing and tracking correspondence; preparing meeting minutes and meeting notes; preparing briefings; conducting data collection and reporting; conducting workflow/project tracking; and tracking action items. The Government also requires support for providing specialized administrative support in offices throughout USCYBERCOM such as the

Command Section, Public Affairs Office, Records Management Office, Publications

Management Office, Knowledge Management Office, and the History Office.

Administrative Support also includes providing support to cyber exercise planning conferences including Joint Worldwide Planning Conference, Joint Event Life Cycle (JELC) planning conferences (Concept Development Conference, Initial Planning Conference, Main Planning

Conference, Final Planning Conferences), and Master Scenario Events List (MSEL)

Development Conference. Conference design, facilitation and analysis also fall under this core discipline.

This core discipline includes providing routine administrative and clerical assistance, including receiving/screening telephone calls and visitors. For example, support includes, but is not limited to, the following:

a. Responding to routine, non-technical requests for information; scheduling appointments, making arrangements for conferences, meetings, and presentations, including location, schedule, and agenda; and coordinating all other arrangements with staff/participants.

b. Providing specialized administrative support to USCYBERCOM Joint Directorates, organizations, and special staff offices such as the Legislative Affairs Office, Public

Affairs Office, Command Secretariat, Command Engagements/Visits, Inspector General, and the Commander’s Action Group.

c. Assisting with office procedures, command protocol, correspondence, messages, reports, forms, filing, mail, training, travel security, personnel procedures, and preparation for office moves.

d. Composing routine/non-technical correspondence and preparing reports, and making corrections to internal Command administrative/clerical correspondence or other appropriate subjects.

e. Providing support to initiate travel arrangements, complete travel orders, and prepare vouchers for Command leadership.

f. Preparing PowerPoint presentations in support of management briefings.

Supporting this task may require contractors to work within Government-provided software packages with emphasis on the Defense Travel System, Microsoft Word, Microsoft Excel, Microsoft PowerPoint, and Microsoft SharePoint 2013 and later upgrades or additional software based upon the requirements in individual TOs.

Support for this core discipline also includes providing administrative and clerical expertise to support the achievement of operations and research objectives, information analysis, exercise and training development, and implementation of training objectives. For example, support includes maintaining Microsoft SharePoint and shared file locations for knowledge management of documentation and office-related information. Administrative Support also includes providing

USYCBERCOM IDIQ Advance Notice PAGE C - 6 administrative support for exercise and training design, planning, preparation, execution, analysis, evaluation, and reporting; Joint Training Plans and After-Actions Programs development; and individual, team, and collective mission area training.

Administrative Support services may also include providing administrative coordination activities for obtaining spaces to accommodate meetings, working groups, events, conferences, conference support, materials required to support such events, and the IT and audio/visual/video teleconferencing (VTC) services and equipment that may be needed at the unclassified, secret, and top secret levels.

C.5.1.2 SUB CORE DISCIPLINE 2 – KNOWLEDGE MANAGEMENT

Knowledge Management is defined as providing technical expertise in Knowledge Management to support various directorates within USCYBERCOM and the Chief Knowledge Officer (CKO) to formulate Knowledge Management strategies and policies to enable USCYBERCOM to create and maintain records in accordance with the DOD Knowledge Management Policy requirements to document the roles and responsibilities of USCYBERCOM in the conduct of its mission.

Comprehensive Knowledge Management support to USCYBERCOM is defined as providing support to plan, manage, and integrate the USCYBERCOM and CMF joint exercise and training programs and after action processes to achieve and sustain USCYBERCOM mission-essential task proficiency. Knowledge management support will be required across all network domains.

a. Records Management

The contractor shall provide records management support in accordance with the Executive

Office of the President Memorandum M-12-18, Managing Government Records Directive, 24 August 2012, DOD 5015.02-STD, and DOD 5015.2-STD (2007). For example, this support will include: identifying, classifying, prioritizing, storing, securing, preserving, retrieving, tracking, and archiving records.

Records management is defined as providing technical expertise to support the formulation of records management strategies and policies to enable USCYBERCOM to create and maintain records in accordance with the DOD Record Management Policy requirements and to document the roles and responsibilities of USCYBERCOM in the conduct of its mission.

Furthermore, records management includes assisting the Chief of Command Secretariat, Command Publications Manager, and several directorates within USCYBERCOM with the development and maintenance of a Command Publications Library as appropriate on the three network domains. Support will include accounting for work product history in conjunction with the record.

b. Business Process Reengineering

Business Process Reengineering is defined as providing Enterprise Business Transformation expertise, including Lean Six Sigma and Process Change Management methodology, to http://en.wikipedia.org/wiki/Design_Criteria_Standard_for_Electronic_Records_Management_Software_Applications

USYCBERCOM IDIQ Advance Notice PAGE C - 7 support the CKO in analyzing current USCYBERCOM workflows and processes to identify process inefficiencies and areas of improvement, reduce redundancy, and re-engineer applicable processes to increase efficiency. Services that are included in this core discipline include, but are not limited to the following:

i. Developing approaches for improving organizational performance and the activities needed to implement new or revised business or functional processes arising from business process reengineering undertakings.

ii. Identifying the necessary development and/or integration of IT to enable improvements in processes.

iii. Providing technical expertise to ensure approved solutions to re-engineer processes are implemented and their effectiveness is measured against current processes.

iv. Revising performance measures in alignment with new business processes.

c. Logistics

Logistics support is defined as providing logistics planning and management expertise for obtaining offsite facilities as needed for the conduct of crisis action planning, simultaneous planning events, cyber event management, and planning for periods of non-disruption and continuity of operations.

This support includes providing management logistical oversight for facility management, asset management, and procurement support. This support includes utilizing existing

Government proprietary systems/protocols for automation purposes of asset management and equipment tracking within Government-owned Sensitive Compartmented Information

Facilities (SCIFs) in the local travel area and within satellite facilities. For example, Logistics support includes, but is not limited to the following:

i. Providing support in management of Government-owned SCIFs in multiple locations.

ii. Managing the flow of resources between the point of origin, procurement, configuration management, and through disposal, to include purchasing, handling, controlling, and transportation of material and other property.

iii. Maintaining proper retention of logs, files, and supporting documentation for all movement of materials.

iv. Communicating and coordinating with all parties involved in materials movements.

Support for this core discipline includes assisting the Government in managing the development of upgrades and system improvements, tracking and reporting material, establishing and maintaining material handling procedures, and providing asset management, configuration management, and scheduling. Logistics support also includes developing and manage power/space/cooling requests, and Baseline Exemption Requests (BERs). The contractor’s Logistics support shall adhere to and be provided in accordance with Federal and

DOD policy.

d. Project Analysis

USYCBERCOM IDIQ Advance Notice PAGE C - 8

Project Analysis is defined as providing technical expertise to assist with the following project analysis functions to ensure proper and efficient execution and performance of programs, and that capabilities are successfully developed and acquired to meet

USCYBERCOM's requirements. These requirements include, but are not limited to the

1. Tracking and analyzing the status of programs fulfilling USCYBERCOM requirements for remaining within scope, within budget, and on schedule, while mitigating risks.

2. Maintaining program information and status of ongoing program activities.

3. Analyzing and refine initial user needs and assist in defining requirements.

4. Analyzing validated and prioritized requirements to manage timelines and risks.

5. Assisting with validating and prioritizing requirements.

6. Collaborating with teams managing related and dependent requirements to maintain status of collective progress.

7. Supporting execution and delivery of capabilities to end-users.

8. Providing lifecycle support to close out capability development and implementation.

9. Analyzing project risks and develop risk mitigation plans.

10. Developing courses of action to fulfill gaps and requirements.

11. Conducting analysis of programs, managing deliverables, and preparing graphs, tables, diagrams, and presentations to present analysis conclusions and recommendations.

Project Analysis support is also defined as assisting the USCYBERCOM with proper and efficient execution of programs, requirements identification and definition, and course of action development for the integration, management, and sustainment of Offensive Cyber

Operations (OCO) and Defensive Cyber Operations (DCO) capabilities, and efforts to secure, operate, and defend the DODIN.

Project Analysis support includes, but is not limited to: providing support to prepare, review, and update program documentation and status in support of milestone decisions, leadership, and external reviews. Project Analysis support also includes assisting with organizing and preparing for program meetings and conferences.

Project Analysis support includes preparing white papers, graphs, tables, diagrams, and briefings to present analysis conclusions and recommendations. Support for the Project

Analysis core discipline also includes, but is not limited to, the following:

i. Developing methods for tracking program performance and refining project analysis processes, methods, and tools.

ii. Maintaining program plans and coordinating with the program managers to ensure programs fulfill requirements upon delivery.

iii. Developing and maintaining program files in accordance with records management processes.

e. Program Management

USYCBERCOM IDIQ Advance Notice PAGE C - 9

Program Management support is defined as assisting in the management of program efforts to scope, schedule, budget, and risk management to ensure the accomplishment of program goals. Support includes, but is not limited to, developing program documentation, risk management documentation, plans, and program schedules. Program Management support includes tracking program and budget status in Government-approved formats, evaluating operational and technical alternatives, and performing risk assessments. Support also includes identifying the program critical path and risk mitigation strategies.

Program Management support includes, but is not limited to the following:

i. Developing work breakdown structures and integrated master schedules.

ii. Preparing charts, tables, graphs, and diagrams to assist in analyzing problems, program risks, and issues, and preparing program management plans, program documentation, and reports.

iii. Coordinating schedules to facilitate completion of contract deliverables, briefings/presentations, and program reviews, perform analysis, and developing and review program administrative operating procedures.

C.5.2 CORE DISCIPLINE 2 - CYBERSPACE OPERATIONS

Cyberspace Operations support is defined as providing technical expertise to assist in the planning, coordination, and synchronization of OCO and DCO, and operation of the DODIN. At award, the Government will provide concerning the training, format of the forms, and appropriate use of the tools, roles, and reporting procedures in accordance with DOD 5240.1-R.

Cyberspace Operations support is also defined as providing technical expertise during the conduct of assessments of cyberspace operations, including the development and deliberate comparison of forecasted outcomes with actual events utilizing Measures of Effectiveness

(MOE) and Measures of Performance (MOP) when determining progress toward desired end-states and satisfying objectives. Support for this core discipline includes participating in and contributing to the development of the Joint Operations Center (JOC) Emergency Action

Procedures in preparedness to defend the nation through inter-agency emergency cyber procedures.

Cyberspace Operations support also includes assisting in providing maneuver, fires, and effects through the application of capabilities in and through the cyber domain. This core discipline includes supporting the creation and dissemination of orders and directives to provide guidance to the DOD community.

Support for this core discipline also includes assisting with USCYBERCOM’s efforts in the

DOD and whole of Government by contributing to the development of policies, doctrine and processes, courses of action, input for the situational awareness report (SAR), and input for the

National Defense Authorization Act (NDAA) 935 report.

Services that are included in Cyberspace Operations also include providing technical expertise to assist in fulfilling USCYBERCOM’s responsibilities to the Joint Information Environment (JIE)

USYCBERCOM IDIQ Advance Notice PAGE C - 10 initiative by identifying requirements and CONOPS that focus on the execution of DODIN

Operations and DCO Internal Defensive Measures (DCO-IDM); in addition to assisting in the development, synchronization, integration, and assessment of operational standards in support of achieving the JIE end-state.

C.5.3 CORE DISCIPLINE 3 - CYBERSPACE PLANNING

Cyberspace Planning support is defined as providing comprehensive strategic planning support to USCYBERCOM to plan, manage, and integrate the USCYBERCOM and CNMF joint exercise and training programs and after action processes to achieve and sustain

USCYBERCOM mission-essential task proficiency.

Support for this core discipline includes, but is not limited to, providing in-depth deliberate planning expertise for the development of policy, plans, processes, procedures, and governing directives for the operation, protection, and defense of the DODIN projection of power through cyberspace. Contractors shall provide input to address shortfalls, prioritize and validate requirements, and being prepared to modify development planning efforts based on the changing cyberspace environment.

a. Deliberate Planning includes the management and implementation of the Adaptive

Planning Process from strategic guidance to completion of USCYBERCOM level one through level four contingency plans, synchronization of USCYBERCOM’s missions into plans through internal and external collaboration, and coordination with all mission partners. Deliberate planning encompasses the preparation of plans that occur in non-crisis situations.

b. Crisis Action Planning is defined as providing technical input and content recommendations to assist in short-term crisis action plans through internal and external collaboration and coordination with all mission partners. Support includes assisting with crisis action planning and the development of all orders and plans to meet time sensitive event horizons.

c. Future Operations Planning is defined as providing technical input and content recommendations to assist in future operations plans through internal and external collaboration and coordination with all mission partners. Support includes assisting with future operations planning and the development of all orders and plans to meet mid-range time horizons.

d. Joint Operational Planning support includes, but is not limited to, providing technical expertise to assist with the development of operational plans that contain a variety of viable cyberspace options, including following the Joint Operation Planning Process

(JOPP) of planning initiation, mission analysis, courses of action (COA) development, COA analysis war gaming, COA comparison and approval, and plan or order development.

USYCBERCOM IDIQ Advance Notice PAGE C - 11

e. National Mission Team/Execution Planning. This support includes, but is not limited to, providing technical and joint planning expertise to assist with the development of tactical joint operational plans in coordination with higher headquarters, mission partners, and tactical teams. Support for this functional area also includes assisting with future operations and mission planning for the development of tactical-level plans and execution of orders.

f. Joint Exercise and Training Planning. Contractors shall provide comprehensive strategic planning support to USCYBERCOM to plan, manage, and integrate the

USCYBERCOM and CNMF joint exercise and training programs and after action processes to achieve and sustain USCYBERCOM mission essential task proficiency.

C.5.4 CORE DISCIPLINE 4 – ALL-SOURCE INTELLIGENCE

All-Source Intelligence analysis is defined as support for planning efforts, from strategic to the tactical level. This discipline area will include conducting research and analysis, collection management, indications and warning, targeting, imagery analysis, signals intelligence analysis, joint intelligence preparation of the battlespace, and crisis planning to standing and deployed cyberspace forces engaged in operations. Support for this core discipline includes, but is not limited to, screening all source intelligence reporting, accessing and summarizing evaluated and previously unevaluated information, discriminating threat information from all source intelligence into actionable intelligence, and disseminating warning and threat analysis for real-world contingencies. Support also includes researching all source reporting to produce predictive and current finished intelligence products and coordinating all analytical products and support national level organizations and theater staffs for dissemination across tactical, operational, and strategic environments. All-Source Intelligence support also includes communicating factual information clearly and concisely, both orally and in writing, often under pressure and tight deadlines.

Services in support of All-Source Intelligence include, but are not limited to the following:

a. Analyzing all source intelligence information to produce assessments, reports, articles, threat analyses, special studies etc., responsive to user needs; complying with suspense dates for draft and final products.

b. Maintaining all source databases on area of responsibility; using multiple source intelligence tools to perform all source threat force analysis.

c. Analyzing and fusing reports from multiple intelligence sources (Human Intelligence

(HUMINT), Signals Intelligence (SIGINT), Imagery Intelligence (IMINT), Measurement and Signatures Intelligence (MASINT)) to provide intelligence preparation of the battlespace, target development, and early warning of emerging threats.

d. Screening and researching all source reporting, accessing and summarizing previously unevaluated information, and discriminating threat information into actionable intelligence.

USYCBERCOM IDIQ Advance Notice PAGE C - 12

e. Monitoring all sources of intelligence to ensure adequacy of coverage and timeliness of assessments; tasking incoming Requests for Information (RFIs) to appropriate cyberspace division.

f. Identifying intelligence gaps and requesting solutions via collections process.

C.5.5 CORE DISCIPLINE 5 - CAPABILITY MANAGEMENT AND DEVELOPMENT

Capability Management and Development is defined as providing technical assurance, engineering and architecture analysis, and research for the creation and updating of system architectures’ initial capability documents, capability development documents, capability production documents, and engineering guidance documents (standards, specifications, technical architectures, systems). Support for this core discipline includes conducting tests and evaluations to support the analysis and testing of cyber-related capabilities.

Tasks in support of Capability Management and Development include, but are not limited to the

a. Research, develop, demonstrate, integrate, and test innovative technology in support of cyberspace threat defense and management in an effort to facilitate proactive development and test of cyberspace offensive and defensive capabilities.

b. Evaluate and validate sensor system performance capabilities and effectiveness, assess risk, and determine operational feasibility and benefits of USCYBERCOM’s systems or technology prototypes, to include recommending assessments of system performance, identifying deficiencies, and investigation of physical science phenomena.

c. Provide IT support and perform studies, analyses, and experimentation in both laboratory and non-laboratory environments. Research & Development (RDT&E) tasks shall address any life cycle phase(s) and include science and technology efforts.

d. Evaluate unproven technology applications, identify potential risks, and document and submit results in support of evaluation findings.

e. Provide drawing support services.

f. Participate in technical reviews and meetings in support of capability management and development activities.

Support for this core discipline also includes providing technical expertise and collaborate with

USCYBERCOM and its partners to identify and capture capability development requirements.

Service in support of this core discipline includes developing artifacts for capability development requirements, including white papers and Concepts of Operations (CONOPS). Support for

Capability Management and Development also includes providing technical expertise and participating in activities to identify courses of action for fulfilling capability development requirements, and collaborating with stakeholders to determine the best course of action. Support also includes conducting requirements decomposition and requirements elicitation activities for capability development efforts. Services to be supported also include, for example, providing technical expertise during participation in program reviews to ensure the capability development program is fulfilling the requirement.

USYCBERCOM IDIQ Advance Notice PAGE C - 13

Additional tasks in support of Capability Management and Development include, but are not limited to the following:

a. Supporting the capability management and development process by coordinating with

International Community (IC) tool developers, Combined Mission Forces (CMF) tool developers, and other weapon/tool/capability providers and submit data on cyber capabilities, and reviewing, analyzing, and maintaining data provided by end users and developers on operational cyber capabilities and associated data.

b. Conducting cyber capability analysis to pair operational requirements with cyber capabilities.

c. Conducting critical and technical research and analysis to define Commander’s Critical

Information Requirements (CCIR), Priority Intelligence Requirements (PIR), and

Essential Elements of Friendly Information (EEFI) for reporting cybersecurity incidents.

d. Contributing technical expertise to develop Tactics, Techniques, and Procedures (TTP) for conducting cyberspace operations, measures, and countermeasures and supporting their implementation, and develop and implement incidence reporting, event handling and secure configuration guidance to protect, mitigate, and remediate service outages and adversarial activities.

e. Providing technical input for the development of requirements and support the development of both offensive and defensive cyberspace capabilities to achieve

USCYBERCOM goals, and for achieving situational awareness and a common operating picture of activities happening in cyberspace.

f. Supporting the Government in providing situational awareness of cyber incidents, health, performance, availability, and reliability of the DODIN.

C.5.6 CORE DISCIPLINE 6 – CYBERSPACE TRAINING AND EXERCISES

Cyberspace Training and Exercises support is defined as providing technical expertise for the development of training programs that provide for, enhance the quality for, and enhance the quality of, the Cyber Forces in support of command mission objectives. Cyberspace Training and

Exercises also includes supporting the creation of sustainable, repeatable training programs to meet this demand.

Services in support of the Cyberspace Training and Exercises discipline includes providing comprehensive cyber training support for USCYBERCOM to plan, manage, conduct, and integrate the cyber training program. Services in support of this core discipline also include assisting in the analysis of training requirements in order to ensure that both individual members and cyber teams are adequately trained and prepared to maintain the requisite level of readiness standards as set forth by USCYBERCOM and/or the Services.

Support of this core discipline also includes assisting in the analysis of the training curriculum, performance objectives, training plans, certification standards, exercise objectives and evaluation standards. For example, as part of the analysis, contractors shall project future performance objectives and assist with the development of training materials to support Joint Cyber Training

USYCBERCOM IDIQ Advance Notice PAGE C - 14 objectives in order to ensure Command personnel possess the necessary skills required to accomplish their missions.

Services that are included in support of the Cyberspace Training and Exercises core discipline include, but are not limited to the following:

a. Providing instructors for cyberspace curriculum developed by the Government. For example, as part of the curriculum, the contractor shall provide instructors that have the ability to follow curriculum plan, coordinate with Government guest speakers to ensure support to those modules of the curriculum, and also ensure materials are prepared for the module block of instruction.

b. Providing technical expertise and input to ensure the training curriculum provides an emphasis on the application of skill with opportunities for students to demonstrate the attainment of the learning objects is required.

c. Developing updates to the curriculum, which will be incorporated periodically.

Requirements for updates will come as a result of feedback from student evaluations as well as Government input. For example, the contractor shall incorporate recommended changes to the course, obtained from student feedback, Government direction, or the contractor’s suggested alterations.

d. Preparing to support Mobile Training Teams (MTT) that will be utilized to instruct curriculum for a two week period in a Government facility. MTT support for each of these sites will be on a by-request basis only.

e. Assisting with continuous performance improvement and standardization efforts based on future capabilities needs, alternate approaches, flexible applications, and adversary modifications.

f. Assisting in the maintenance of training databases to ensure accuracy and timeliness of records.

g. Assisting in the training waiver process through facilitation of the process and coordination with individuals for completeness of documentation.

h. Assisting with maintaining training schedules, enrollments, and associated travel plans.

i. Assisting with and conduct cyber training across USCYBERCOM to support the cyber training program.

C.5.6.1 SUB CORE DISCIPLINE 1 – CYBERSPACE EXERCISES

The Cyberspace exercises, war games, and Table Top Exercises (TTXs) that occur regularly throughout every fiscal year are anticipated as follows:

USYCBERCOM IDIQ Advance Notice PAGE C - 15

Type of Event Estimated Number of Events per year Average # of Participants

Team

Certification

Events

9 50-60

CCMD Exercise

Support 10-15

Cyber Knight or similar 9 50-60

Cyber Flag or similar 3 (2 mini & 1 full) Mini = 50-60/Full = 800

Cyber Guard or similar 5 (4 mini and 1 full) Mini = 50-60/Full = 500

Cyber Wargame 3 150

TTX 25 15-30

Cyberspace exercises support is defined as analyzing outputs stemming from USCYBERCOM exercises and supporting the development, architecture, and infrastructure capabilities of persistent training and test environments. Support for this sub core discipline includes providing technical input for the development of requirements of training and test environments including the physical infrastructure and facilities.

Services in support of this sub core discipline include, but are not limited to, collaborating with

Command elements to implement objectives, priorities, and plans for the USCYBERCOM joint exercise program. Support also includes contributing to the development of exercises utilizing inputs from the cyberspace operations planning process, and to focus on Joint Mission Essential

Tasks (JMETs) for known and anticipated operational missions, capabilities, and improving of

Command processes through lessons learned. Cyberspace exercises shall simulate alternative operational scenarios and provide insights into how issues may play out in the real world and the real cyber world.

Services in support of the Cyberspace exercises sub core discipline include providing research, analysis, and recommendations to conceive, develop, execute, and support Joint Event Lifecycle events including Combatant Command (CCMD) exercises, tabletop exercises, and scenario development/synchronization. Each year, USCYBERCOM will determine which CCMD exercises it will support.

Services in support of the Cyberspace exercises sub core discipline includes providing technical expertise and participate in the lifecycle events of conducting an exercise which include, but are not limited to, the following:

a. Incorporation of CCMD Training Objectives and/or Cyberspace Training Objectives to be included in the exercise, and if required, participation in Concept development conference/meetings.

USYCBERCOM IDIQ Advance Notice PAGE C - 16

b. Initiation of exercise planning (objectives, storylines and themes, CONOPs, development of exercise scenarios, MSEL, exercise design documents, exercise orders and directives, supporting plans, exercise schedule, and exercise control plans.

c. Participation and/or refinement of materials that result from the initial planning, mid-planning, and final planning conferences.

d. Exercise build-up/preparation.

e. Exercise hosting and system support.

f. Exercise execution (blue team/white cell participation).

g. Exercise analysis, evaluation, review, assessment, after action reporting.

Examples of services in support of the Cyberspace exercises sub core discipline include, but are not limited to, the following:

a. Providing comprehensive cyber exercise support to USCYBERCOM to plan, manage, and integrate the USCYBERCOM and CNMF joint exercise and training programs and after action processes to achieve and sustain USCYBERCOM mission-essential task proficiency.

b. Contributing to the development of Certification and Proficiency Standards, which are required for each of the CMF teams.

c. Conducting post-exercise lessons learned studies and incorporate these in future exercises.

d. Developing COAs in response to training objectives.

e. Identifying, tracking, and resolving issues impacting training, exercises, and daily operations.

f. Providing technical expertise for the continuous development and refinement of exercises, wargames, and TTXs design constructs and concepts in order to continuously identify future manpower, organizational, technical, policy, and procedural requirements for the cyber environment.

C.5.7 CORE DISCIPLINE 7 – INFORMATION TECHNOLOGY

(IT)/COMMUNICATIONS (COMMS)

The requirements for supporting the USCYBERCOM environment encompass the planning and implementation of hosting solutions for capabilities and the maintenance of technology solutions.

C.5.7.1 SUB CORE DISCIPLINE 1 - INTEGRATED TECHNOLOGY

Integrated Technology support is defined as providing technical expertise for the planning and engineering of enterprise architectures management, system configuration, system administration support, and system engineering support. For example, the contractor shall provide technical expertise to perform the various roles required to support the technical and administrative management of USCYBERCOM’s Enterprise IT Service Desk. To ensure un-disruptive and secure operation of USCYBERCOM’s Enterprise IT, the contractor shall provide personnel to serve as a point of contact in managing and responding to USCYBERCOM customer requests for IT support, and provide network/systems administration, configuration management, and web development support to USCYBERCOM web-based initiatives and functions in accordance with mission requirements.

USYCBERCOM IDIQ Advance Notice PAGE C - 17

Examples of services in support of the Integrated Technology sub core discipline include, but are not limited to following:

a. Performing specialized tests to support analysis and evaluation of technologies and systems.

b. Conducting test and evaluation planning; preparation, logistical, and transportation planning; prototype assessments in field environments; operate test instrumentation; and support remote testing, war game seminars, and capstone events.

c. Providing network, systems, and software engineering, analysis of system concepts, system design and interoperability, and provide recommendations for optimization.

d. Identifying and contributing to the development of IT/Comms requirements, and provide expertise for determining the best course of action to fulfill IT/Comms requirements. For example, the contractor shall be required to review and analyze development, production, and system support plans as well as participate in program reviews and make evaluations of technical performance and progress.

e. Assisting the Government in the preparation of technical documents, specifications, and requirements for developmental projects, and making trade-off/best technical approach analyses. Examples of deliverables that shall be prepared are as follows: System

Engineering Plans (SEPs), design plans, technical reports, and engineering studies.

Integrated Technology services also include providing comprehensive IT/Comms support to

USCYBERCOM to plan, manage, and integrating the USCYBERCOM and CNMF joint exercise and training programs and after action processes to achieve and sustain

USCYBERCOM mission-essential task proficiency. For example, the contractor shall provide technical assistance and data and information management for analysis, coordination, planning, execution, and after action reporting.

An additional service in support of this sub core discipline includes, but is not limited to, providing technical expertise to support joint architectural and systems engineering analysis to validate that proposed Command, Control, Communications, and Computers (C4) designs can be fully integrated with existing, projected, and targeted Information System (IS) enterprise architectures, and that they facilitate effective communications and authorized exchange of information. This is to ensure effective implementation of cyberspace operations employed by multiple DOD program community partners and the synchronization of DOD CIO policy directives with the operational community.

An additional example of the support required under this core discipline includes providing technical expertise and participate in JIE working groups, systems, and network engineering activities, and provide analysis and input to the architecture development efforts supporting JIE and Joint Force Headquarters (JFHQ)–DODIN (e.g., JIE Operations Center Reference

Architecture).

C.5.7.2 SUB CORE DISCIPLINE 2 – ASSET MANAGEMENT AND PURCHASING

Asset Management and Purchasing is defined as conducting vendor research and analysis and recommend IT equipment that best meet USCYBERCOM requirements. In addition, support for

USYCBERCOM IDIQ Advance Notice PAGE C - 18 this sub core discipline is defined as initiating, facilitating, and participating in the IT purchasing process for acquiring and integrating IT/Comms materials.

Services that are required under this Asset Management and Purchasing core discipline include, but are not limited to, the following:

a. Coordinating the receipt of materials and accounting for the inventory of IT/Comms materials, as well as, confirming assets assigned to the contractor on a recurring 90-day basis.

b. Initiating the processes and obtain requisite permissions for introducing new materials into the network. For example, the contractor shall coordinate with required parties and conduct network preparation activities for…