USCYBERCOM_IDIQ_Attach_E_TO1_-_Amendment_07.pdf

Attachment E

SEED TASK ORDER 1 (TO1)

for

Cyberspace Operations Support Services in support of:

United States Cyber Command

(USCYBERCOM)

SECTION B – SUPPLIES OR SERVICES AND PRICES/COSTS

GSC-QF0B-15-32959

Attachment E

Amendment 07 PAGE B-1

NOTE: Section B of the Contractor’s multiple award (MA) Indefinite Delivery/Indefinite

Quantity (IDIQ) is applicable to this Task Order (TO) and is hereby incorporated by reference.

In addition, the following applies:

B.1 GENERAL

The work shall be performed in accordance with all Sections of this TO and the contractor’s

Basic Contract, under which the resulting Task Order (TO) will be placed. An acronym listing to support this Task Order Request (TOR) is included in Section J (Attachment I).

B.2 ORDER TYPES

The contractor shall perform the effort required by this TO on a Cost-Plus-Fixed-Fee (CPFF) basis for Contract Line Item Numbers (CLINs) 0001, 0002, 0003, 1001, 1002, 1003, 2001, 2002, 2003, 3001, 3002, 3003, 4001, 4002, 4003 and Not-to-Exceed (NTE) basis for CLINs 0004, 0005, 0006, 1004, 1005, 1006, 2004, 2005, 2006, 3004, 3005, 3006, 4004, 4005, and 4006.

B.3 SERVICES AND PRICES/COSTS SCHEDULE

All CPFF CLINs are TERM and CPFF CLIN work will end based on the period of performance

(PoP).

Long-distance travel is defined as travel over 50 miles from the primary place of performance.

Local travel will not be reimbursed.

The following abbreviations are used in this price schedule:

CLIN Contract Line Item Number

CPFF Cost-Plus-Fixed-Fee

NTE Not-to-Exceed

ODC Other Direct Cost

Attachment E

Amendment 07 PAGE B-2

B.3.1 BASE PERIOD

MANDATORY CPFF LABOR CLIN

CLIN Description

Level of

Effort/ # of Hours

Cost Fixed Fee Total Cost

Plus Fixed Fee

0001 Labor (Tasks 1-7, excluding Subtasks

2.2, 2.7, 6.2, 7.5, 7.6)

OPTIONAL CPFF LABOR CLINs

CLIN Description

Level of

Effort/ # of

Hours

Cost Fixed Fee Total Cost

Plus Fixed Fee

0002 Labor (Subtasks 2.2, 2.7, 6.2, 7.5, & 7.6)

0003 Labor (Task 8) $ $ $

COST REIMBURSEMENT TRAVEL, TOOLS and ODC CLINs

CLIN Description Total Ceiling Price

Long-Distance Travel Including Indirect

Handling Rate up to ______%

NTE $100,000

Tools Including Indirect Handling Rate up to

NTE $75,000

ODCs Including Indirect Handling Rate up to

NTE $20,000

TOTAL BASE PERIOD CLINs: $________________

Attachment E

Amendment 07 PAGE B-3

Attachment E

Amendment 07 PAGE B-4

B.3.2 FIRST OPTION PERIOD:

MANDATORY CPFF LABOR CLIN

CLIN Description

Level of

Effort/ # of Hours

Cost Fixed Fee Total Cost

Plus Fixed Fee

1001 Labor (Tasks 1-7, excluding

Subtasks2.2, 2.7, 6.2, 7.5, & 7.6)

OPTIONAL CPFF LABOR CLIN

CLIN Description

Level of

Effort/ # of

Hours

Cost Fixed Fee Total Cost

Plus Fixed Fee

1002 Labor (Subtasks2.2, 2.7, 6.2, 7.5, & 7.6)

1003 Labor (Task 8) $ $ $

COST REIMBURSEMENT TRAVEL, TOOLS and ODC CLINs

CLIN Description Total Ceiling Price

Long-Distance Travel Including Indirect

Handling Rate up to ______%

NTE $100,000

Tools Including Indirect Handling Rate up to

NTE $75,000

ODCs Including Indirect Handling Rate up to

TOTAL FIRST OPTION PERIOD CLINs: $________________

Attachment E

Amendment 07 PAGE B-5

B.3.3 SECOND OPTION PERIOD:

MANDATORY CPFF LABOR CLIN

CLIN Description

Level of

Effort/ # of Hours

Cost Fixed Fee Total Cost

Plus Fixed Fee

2001 Labor (Tasks 1-7, excluding

Subtasks2.2, 2.7, 6.2, 7.5, & 7.6)

OPTIONAL CPFF LABOR CLIN

CLIN Description

Level of

Effort/ # of

Hours

Cost Fixed Fee Total Cost

Plus Fixed Fee

2002 Labor (Subtasks2.2, 2.7, 6.2, 7.5, & 7.6)

2003 Labor (Task 8) $ $ $

COST REIMBURSEMENT TRAVEL, TOOLS and ODC CLINs

CLIN Description Total Ceiling Price

Long-Distance Travel Including Indirect

Handling Rate up to ______%

NTE $100,000

Tools Including Indirect Handling Rate up to

NTE $75,000

ODCs Including Indirect Handling Rate up to

TOTAL SECOND OPTION PERIOD CLINs: $________________

Attachment E

Amendment 07 PAGE B-6

B.3.4 THIRD OPTION PERIOD:

MANDATORY CPFF LABOR CLIN

CLIN Description

Level of

Effort/ # of Hours

Cost Fixed Fee Total Cost

Plus Fixed Fee

3001 Labor (Tasks 1-7, excluding

Subtasks2.2, 2.7, 6.2, 7.5, & 7.6)

OPTIONAL CPFF LABOR CLIN

CLIN Description

Level of

Effort/ # of

Hours

Cost Fixed Fee Total Cost

Plus Fixed Fee

3002 Labor (Subtasks2.2, 2.7, 6.2, 7.5, & 7.6)

3003 Labor (Task 8) $ $ $

COST REIMBURSEMENT TRAVEL, TOOLS and ODC CLINs

CLIN Description Total Ceiling Price

Long-Distance Travel Including Indirect

Handling Rate up to ______%

NTE $100,000

Tools Including Indirect Handling Rate up to

NTE $75,000

ODCs Including Indirect Handling Rate up to

NTE $25,000

TOTAL THIRD OPTION PERIOD CLINs: $________________

Attachment E

Amendment 07 PAGE B-7

B.3.5 FOURTH OPTION PERIOD:

MANDATORY CPFF LABOR CLIN

CLIN Description

Level of

Effort/ # of Hours

Cost Fixed Fee Total Cost

Plus Fixed Fee

4001 Labor (Tasks 1-7, excluding

Subtasks2.2, 2.7, 6.2, 7.5, & 7.6)

OPTIONAL CPFF LABOR CLIN

CLIN Description

Level of

Effort/ # of

Hours

Cost Fixed Fee Total Cost

Plus Fixed Fee

4002 Labor (Subtasks2.2, 2.7, 6.2, 7.5, & 7.6)

4003 Labor (Task 8) $ $ $

COST REIMBURSEMENT TRAVEL, TOOLS and ODC CLINs

CLIN Description Total Ceiling Price

Long-Distance Travel Including Indirect

Handling Rate up to ______%

NTE $100,000

Tools Including Indirect Handling Rate up to

NTE $75,000

ODCs Including Indirect Handling Rate up to

NTE $20,000

TOTAL FOURTH OPTION PERIOD CLINs: $________________

GRAND TOTAL ALL CLINs: $________________

Attachment E

Amendment 07 PAGE B-8

B.4 INDIRECT/MATERIAL HANDLING RATE

Long Distance Travel, Tools, and ODC costs incurred may be burdened with the contractor’s indirect/material handling rate in accordance with the contractor’s disclosed practices.

a. If no indirect/material handling rate is allowable in accordance with the contractor’s disclosed practices, no indirect/material handling rate shall be applied to or reimbursed on these costs

b. If no rate is specified in the basic contract, no indirect rate shall be applied to or reimbursed on these costs

c. If no rate is specified in the schedule of prices above, no indirect rate shall be applied to or reimbursed on these costs

The indirect handling rate over the term of the TO shall not exceed the rate specified in the schedule of prices above.

B.5 DIRECT LABOR RATES

Labor categories proposed for the prime and all subcontractors shall be mapped to existing multiple award (MA) Indefinite Delivery Indefinite Quantity (IDIQ) labor categories.

B.6 INCREMENTAL FUNDING LIMITATION OF GOVERNMENT’S OBLIGATION

Incremental funding in the amount of $***,***,*** for CLINs 0001, 0002, 0003, 0004, 0005, 0006 is currently allotted and available for payment by the Government. Additional incremental funding for these CLINs will be allotted and available for payment by the Government as the funds become available. The estimated PoP covered by the allotments for the mandatory CLINs is from award through ** months of the base period, unless otherwise noted in Section B.3. The

TO will be modified to add funds incrementally up to the maximum of $***,***,*** over the

PoP of this TO. These allotments constitute the estimated cost for the purpose of Federal

Acquisition Regulation (FAR) Clause 52.232-22, Limitation of Funds, which applies to this TO on a CLIN-by-CLIN basis.

When the work required under any CLIN is completed, and that work is within the total estimated cost shown above, the contractor shall be entitled to payment of fixed fee for that

CLIN. The contractor may present, with its monthly vouchers for costs, a fee voucher in an amount bearing the same percentage of fixed fee as the certification of incurred costs bears to the total estimated cost for each CLIN. However, after payment of 85 percent of the fixed fee for the total TO, the Contracting Officer (CO) may withhold further payment of fixed fee until a reserve shall have been set aside in an amount which the CO considers necessary to protect the interest of the Government. This reserve shall not exceed 15 percent of the total fixed or $100,000, whichever is less.

Incremental Funding Chart - See Section J, Attachment A.

SECTION C – PERFORMANCE WORK STATEMENT

Attachment E

Amendment 07 PAGE C-1

C.1 BACKGROUND

The United States Cyber Command (USCYBERCOM) Directorate of Operations (J3) establishes and provides cyber warfare capabilities to meet both deterrent and defensive National Security objectives. The J3 optimizes planning, integration, coordination, execution and force management of the cyber warfare mission in support of (ISO) the Joint warfighter. The J3 provides situational awareness of adversary attack opportunities and exercises operational and tactical control of cyber forces and capabilities, as directed. Currently, the J3 is organizationally divided into a Current Operations and Future Operations construct. Current Operations encompasses operating and defending the Department of Defense (DoD) Information Network

(DODIN) and includes the Fires & Effects Division, which manages both the Joint Fires Process and the Joint Targeting Cycle and is responsible for publishing a daily Cyberspace Tasking

Order (CTO) via the USCYBERCOM Command and Control (C2) portal. Future Operations spans planning for a range of potential activities from those impacting DoD information networks to those with regional and/or global implications. USCYBERCOM operates in a dynamic and changing environment and must remain flexible to achieve its mission.

C.2 SCOPE

This TO provides Cyberspace Operations support services to USCYBERCOM. This TO falls within the scope of the following IDIQ core disciplines:

1. Cyberspace Operations

2. Cyberspace Planning

3. Cyberspace Training & Exercises

4. Strategy/Policy/Doctrine Development and Campaign Assessments

5. Information Technology/Communications (IT/Comms)

6. Business Area Support and Project Management

Key areas to be performed within the scope of this TO include, but are not limited to:

1. Provide Mission Essential coverage to support Cyberspace Operations

2. Identify requirements and concept of operations (CONOPS) that focus on the execution of DODIN Operations and Defensive Cyberspace Operations Internal Defensive

Measures (DCO-IDM) and assist in the development, synchronization, integration, and assessment of operational standards ISO achieving the Joint Information Environment

(JIE) end-state

3. Contribute to efforts to secure, operate, and defend the DODIN and its critical dependencies in order to (IOT) provide full spectrum Cyberspace Operations, ensuring freedom of maneuver in that domain and denying our adversaries the same

4. Contribute to USCYBERCOM strengthening relationships with key partner nations, coordinating, synchronizing, deconflicting, and integrating operational planning efforts for full spectrum Cyberspace Operations

5. Plan, coordinate, and deconflict Offensive Cyberspace Operations (OCO), DCO, and

DODIN Operations throughout the entire Joint Operational Planning Process (JOPP)

Attachment E

Amendment 07 PAGE C-2

6. Identify requirements to fill gaps and identify capabilities IOT achieve an effect in accordance with (IAW) tactical objectives, operational goals, and strategic end-states

7. Prepare Courses of Action (COAs), to include advanced level targeting, capabilities pairing, and operational assessments

C.3 OBJECTIVE

The objectives of this TO are as follows:

1. Define and analyze cyberspace capabilities needed and Cyberspace Operations to meet both deterrent and decisive National Security objectives

2. Conduct planning, integration, coordination, and execution, of the Cyberspace Operations mission ISO the Joint warfighter

3. Receive, track, and resolve cyber issues and provide input to the Commander Situational

Awareness Reports of Cyberspace Operations

C.4 TASKS

C.4.1 TASK 1 – PROVIDE TASK ORDER PROJECT MANAGEMENT

The contractor shall provide TO project management support. This includes the management and oversight of all activities performed by contractor personnel, including subcontractors, to satisfy the requirements identified in this Performance Work Statement (PWS). The TO project management support also includes identifying and coordinating cross-Directorate projects to ensure consistency of progress towards accomplishing the project goals. The contractor shall identify a Project Manager (PM) by name who shall provide management, direction, administration, quality assurance, and leadership of the execution of this TO.

C.4.1.1 SUBTASK 1.1 – COORDINATE A PROJECT KICK-OFF MEETING

The contractor shall schedule, coordinate, and host a Project Kick-Off Meeting (Section F.3, Deliverable 01) at the location approved by the Government. The meeting will provide an introduction between the contractor personnel and Government personnel who will be involved with the TO. The meeting will provide the opportunity to discuss technical, management, and security issues, and travel authorization and reporting procedures. At a minimum, the attendees shall include Key Contractor Personnel, representatives from the Directorates, the FEDSIM

Contracting Officer’s Representative (COR), the Contracting Officer (CO), the Technical Point of Contact (TPOC), and other relevant Government personnel. The contractor shall provide a

Kick-Off Agenda and Kick-Off Meeting Presentation (Section F.3, Deliverables 02 and 03) that shall provide, at a minimum, the following type of information:

1. Introduction of team members and personnel

a. Roles and Responsibilities, including staffing plan and project organization

b. Overview of the contractor organization to support varying locations of work

2. Communication Plan/Lines of Communication overview (between the contractor and

Government)

3. Approach to reaching proposed staffing levels to allow for operational support for time constraint occurrences identified in Section C.4.1.9, Transition-In Plan

Attachment E

Amendment 07 PAGE C-3

4. TO Management

a. Overview/outline of the Project Management Plan (PMP)

b. Overview of project tasks

c. Overview of the Quality Control Plan (QCP)

d. TO logistics

5. TO Administration

a. Review of Government-Furnished Information (GFI) and Government-Furnished

Equipment (GFE)

b. Invoice review and submission procedures

c. Travel notification and processes

d. Security requirements/issues/facility/network access procedures

e. Sensitivity and protection of information.

f. Reporting requirements, e.g., Monthly Status Report (MSR)

6. Additional administrative items

The contractor shall draft and provide a Kick-Off Meeting Report (Section F.3, Deliverable 04)

IAW Section C.4.1.7, Prepare Meeting Reports, documenting the Kick-Off Meeting Discussion and capturing any action items.

C.4.1.2 SUBTASK 1.2 – PREPARE A MONTHLY STATUS REPORT (MSR)

The contractor shall develop and provide an MSR (Section F.3, Deliverable 05) using Microsoft

(MS) Office Suite applications, by the tenth of each month via electronic mail to the TPOC and the FEDSIM COR. The MSR shall include the following:

1. Activities during reporting period, by task (include: on-going activities, new activities, activities completed; progress to date on all above mentioned activities). Start each section with a brief description of the task.

2. Problems and corrective actions taken. Also include issues or concerns and proposed resolutions to address them.

3. Personnel gains, losses, and status (security clearance, etc.)

4. Government actions required

5. Summary of trips taken, conferences attended, etc. (attach Trip Reports to the MSR for reporting period)

6. Accumulated invoiced cost for each CLIN up to the previous month

7. Projected cost of each CLIN for the current month

The MSR shall be prepared IAW the sample provided in Section J, Attachment C.

C.4.1.3 SUBTASK 1.3 – CONVENE TECHNICAL STATUS MEETINGS

The contractor PM shall convene a monthly Technical Status Meeting with the TPOC, FEDSIM

COR, and other Government stakeholders. The purpose of this meeting is to ensure all stakeholders are informed of the monthly activities and the MSR, provide opportunities to identify other activities and establish priorities, and coordinate resolution of identified problems

Attachment E

Amendment 07 PAGE C-4 or opportunities. The contractor PM shall provide minutes of these meetings, including attendance, issues discussed, decisions made, and action items assigned, to the FEDSIM COR within five workdays following the meeting (Section F.3, Deliverable 10).

C.4.1.4 SUBTASK 1.4 – PREPARE A PROJECT MANAGEMENT PLAN (PMP)

The contractor shall document all support requirements in a PMP. The contractor shall prepare and deliver a Final PMP (Section F.3, Deliverable 07).

The PMP shall contain at a minimum the following:

1. Describe the proposed management approach

2. Contain detailed Standard Operating Procedures (SOPs) for all tasks

3. Include milestones, tasks, and subtasks required in this TO

4. Provide for an overall Work Breakdown Structure (WBS) and associated responsibilities and partnerships between Government organizations

5. Include the contractor’s QCP

The contractor shall provide the Government with a draft PMP (Section F.3, Deliverable 06) on which the Government will make comments. The final PMP shall incorporate the Government’s comments.

C.4.1.5 SUBTASK 1.5 – UPDATE THE PROJECT MANAGEMENT PLAN (PMP)

The PMP is an evolutionary document that shall be updated annually at a minimum (Section F.3, Deliverable 08). The contractor shall work from the latest Government-approved version of the

PMP.

C.4.1.6 SUBTASK 1.6 – PREPARE TRIP REPORTS

The contractor shall submit a Trip Report(s) (Section F.3, Deliverable 09), as requested by the

TPOC and/or FEDSIM COR. The contractor shall submit Trip Reports five working days after completion of a trip for all long-distance travel. The Trip Report shall include the following information:

1. Personnel traveled

2. Dates of travel

3. Destination(s)

4. Purpose of trip

5. Summarized cost of the trip

6. Approval authority

7. Summary of action items and deliverables

The contractor shall keep a historical summary/spreadsheet of all long-distance travel, to include, at a minimum, the name of the employee, location of travel, duration of trip, and trip estimate.

Attachment E

Amendment 07 PAGE C-5

C.4.1.7 SUBTASK 1.7 – PREPARE MEETING REPORTS

The contractor shall prepare and submit Meeting Reports (Section F.3, Deliverable 10) as requested by the TPOC and/or FEDSIM COR, to document results of meetings. The Meeting

Report shall include the following information:

1. Meeting attendees and their contact information – at minimum identify organizations represented

2. Meeting dates

3. Meeting location

4. Meeting agenda

5. Purpose of meeting

6. Summary of events (issues discussed, decisions made, and action items assigned)

C.4.1.8 SUBTASK 1.8 –QUALITY CONTROL PLAN (QCP)

The contractor shall prepare a QCP (Section F.5, Deliverable 11) identifying its approach to ensure quality control in meeting the requirements of each Task Area of the TO (i.e., not just the corporate generic quality control process). The contractor shall describe its quality control methodology and approach for determining and meeting performance measures identified.

The QCP shall contain at a minimum the following:

1. Performance Monitoring Methods

2. Performance Measures

3. Approach to ensure that cost, performance, and schedule comply with task planning

4. Methodology for continuous improvement of processes and procedures

5. Government Roles

6. Contractor Roles

The contractor shall provide a final QCP that incorporates the Government’s comments (Section

F.3, Deliverable 12). The contractor shall periodically update the QCP, as required in Section F, as changes in program processes are identified (Section F.3, Deliverable 13).

C.4.1.9 SUBTASK 1.9 – TRANSITION-IN

The contractor shall ensure that there will be minimum service disruption to vital Government business and no service degradation during and after transition. All transition activities will be completed within 90 days after approval of final Transition Plan (Section F.3, Deliverable 15).

The contractor shall update the proposed Transition-In Plan (Section F.3, Deliverable 14), submitted with the contractor’s proposal, as appropriate, within five workdays of project start.

For the purposes of this TO, staffing is defined as the submission of current, accurate, and complete Security In-Process (SIP) forms on individuals with an active Top Secret (TS)

Clearance with Sensitive Compartmented Information (SCI) eligibility (within scope – five years) and a current adjudicated Counter-Intelligence (CI) polygraph (within scope – seven years at the discretion of the government) to the USCYBERCOM Staff Security Office (SSO). If inaccuracies are identified, the forms will be rejected by the USCYBERCOM SSO and resubmission may be required. The Government will not be held responsible for inaccurate or

Attachment E

Amendment 07 PAGE C-6 inconsistent SIP forms that delay staffing. For tracking purposes, the FEDSIM COR shall be copied on all final or updated SIP form submissions to the USCYBERCOM SSO. The

Transition-In Plan shall describe a solution for attaining the following minimum staffing levels:

1. All TO Positions: All TO requirements require a minimum of 50 percent staffing at project start and 100 percent staffing within 60 days. The apportionment of the appropriate staff, until reaching full staffing level at 100 percent, shall be coordinated with, and approved by, the FEDSIM COR. Staffing is defined as submitting a complete, accurate security package to USCYBERCOM, as stated above.

2. During the transition-in period, the contractor shall prepare to meet all TO requirements and ensure all incoming personnel are trained and qualified to perform no later than

(NLT) the full performance start date.

3. During the transition-in period, the contractor’s personnel shall interface with

Government personnel and other contractor personnel for purposes of transferring knowledge, lessons learned, and continuity of information and documents for the commencement of performance.

4. When optional support services are executed, the requirements require a minimum of 50 percent staffing upon receipt of funding and 100 percent staffing within 60 days. The apportionment of the appropriate staff, until reaching full staffing level at 100 percent, shall be coordinated with, and approved by, the FEDSIM COR.

5. The contractor shall respond to providing surge support in response to identified crisis action matters with the urgency the matter entails. Surge support may be required to be staffed and worked within USCYBERCOM spaces, following the first notification informing the contractor of a request for surge support.

All Government Furnished Equipment will be accessible to contractor personnel during the transition-in period. The contractor shall implement its Transition-In Plan when the Government accepts the Plan as final.

C.4.1.10 SUBTASK 1.10 – TRANSITION-OUT

The Transition-Out Plan shall facilitate the accomplishment of a seamless transition from the incumbent to an incoming contractor/Government personnel at the expiration of the TO. The contractor shall provide a Transition-Out Plan (Section F.3, Deliverable 16) NLT 120 calendar days prior to expiration of the TO. The contractor shall identify how it will coordinate with the incoming contractor and/or Government personnel to transfer knowledge regarding the following:

1. Project management processes

2. Points of contact

3. Location of technical and project management documentation

4. Status of ongoing technical initiatives

5. Appropriate contractor to contractor coordination to ensure a seamless transition

6. Transition of Key Personnel

7. Schedules and milestones

8. Actions required of the Government

Attachment E

Amendment 07 PAGE C-7

The contractor shall also establish and maintain effective communication with the incoming contractor/Government personnel for the period of the transition via weekly status meetings.

The contractor shall implement its Transition-Out Plan NLT 90 calendar days prior to expiration of the TO. All facilities, equipment, and material utilized by the contractor personnel during performance of the TO shall remain accessible to the contractor personnel during the transition-out period pursuant to the applicable security in-processing and out-processing guidelines.

C.4.2 TASK 2 – PROVIDE CYBERSPACE OPERATIONS SUPPORT

The contractor shall provide Cyberspace Operations support. Cyberspace Operations support includes operational requirements development, gap analysis activities, orders development process, operations assessment process, and critical technical research and analysis as described in one through six below and apply to all subtasks of Task 2:

1. Operational Requirements Development

The contractor shall assist in identifying requirements and making recommendations for the prioritization of requirements for development. The contractor shall support

USCYBERCOM’s requirements process through facilitation of and participation in requirement boards and working group activities.

2. Gap Analysis Activities

The contractor shall support gap analysis activities by comparing, documenting, and reporting shortfalls in proposed cyber capabilities. The contractor shall assess how well the capability meets the requirements and intent of the development objective, document any gaps that may exist, and assess the alignment of the capability with DoD policies.

The contractor shall provide written documentation to address areas of concern for shortfalls and recommended COAs (Section F.3, Deliverable 20).

3. Operations Orders Process

USCYBERCOM J3 is responsible for the USCYBERCOM orders development process, as well as ensuring plans and orders are feasible, acceptable, and compliant with

USCYBERCOM guidance and doctrine. J3 facilitates the transition of plans to orders by developing, implementing, and managing the operational orders process.

The contractor shall perform the following operations orders process support:

a. Develop, coordinate, and maintain USCYBERCOM orders IAW with

USCYBERCOM Instruction 3300-09

b. Develop, coordinate, and maintain USCYBERCOM directives

c. Coordinate and collaborate on draft orders and directives from external partners, as required

d. Gather and prepare supporting documentation, coordinate drafts, obtain approval, and provide the final documents for publishing

e. Update orders and directives based upon evolving cyberspace environments

f. Advise USCYBERCOM leadership on all aspects of orders processing

Attachment E

Amendment 07 PAGE C-8

4. Operational Assessment Process

The operational assessments process feeds the USCYBERCOM Commander’s decision cycle, helping to determine the results of tactical actions in the context of overall mission objectives and providing potential recommendations for the refinement of future plans.

Operational assessments provide the Commander with the current state of the operational environment, the progress of the campaign or operation, and recommendations to account for discrepancies between the actual and predicted progress. The contractor shall provide expertise in Operations Research/System Analysis (ORSA) and/or mathematics/statistics.

The contractor shall perform the following operations assessment process support:

a. Develop, analyze, and update metrics to assess J3 operational performance and effectiveness

b. Incorporate metrics into a strategic assessment process

c. Maintain a repository of Measures of Performance (MOPs) and Measures of

Effectiveness (MOEs) metric results

d. Continuously monitor and provide updates to a current situation within the construct of an operation and the progress of that operation

e. Evaluate an operation against MOEs and MOPs to determine progress relative to the mission objectives and end states

f. Develop recommendations and guidance for improvement in the operation to help drive the Commander’s decision cycle

5. Critical Technical Research and Analysis

The contractor shall conduct critical and technical research and analysis and assist efforts to define Commander’s Critical Information Requirements (CCIR), Priority Intelligence

Requirements (PIR), and Essential Elements of Friendly Information (EEFI) for reporting cybersecurity incidents (Section F.3, Deliverable 20).

6. Executive Summaries

The contractor shall develop one page, topically and technically accurate, executive summaries that summarize specific operations efforts for senior leaders.

Attachment E

Amendment 07 PAGE C-9

C.4.2.1 SUBTASK 2.1 – PROVIDE DODIN OPERATIONS SUPPORT

DODIN Operations conducts global, operational planning to secure, operate and defend the

DODIN and its critical dependencies IOT provide full spectrum Cyberspace Operations ensuring freedom of maneuver in that domain and denying our adversaries the same. The contractor shall provide expertise in DODIN Operations, cyber defense, Tactics, Techniques, and Procedures

(TTP) and systems, Cyberspace Operations community architecture, current and emerging cyber threats, and potential offensive and defensive capabilities for countering cyber threats.

Additionally, the contractor shall provide expertise in electronic communications concepts to include the systems development life cycle, equipment specifications, network management, and analytical techniques.

The contractor shall provide the following DODIN Operations support:

1. Assess boundary protection statistics as provided by the Defense Information Systems

Agency (DISA) and/or other organizations, and determine readiness of the DODIN and contribute input to reports for USCYBERCOM leadership (Section F.3, Deliverable 20)

2. Publicize the current defense policy to the DoD community and evaluate requests for boundary defense policy changes or exceptions from applicable staff elements, Joint

Forces Headquarters (JFHQs), subordinate headquarters, Service Cyber components, Combatant Command (CCMD), and components and agencies with cyber-related missions

3. Conduct research and produce, white papers (Section F.3, Deliverable 19), reports

(Section F.3, Deliverable 20), and presentations that focus on rapidly emerging cyber threats and cyber adversary TTP

4. Conduct proof of concept development of cyber capabilities for countering ongoing or impending cyber adversary actions against United States (U.S.) Government networks

5. Recommend TTPs for countering cyber threats

C.4.2.1.1 SUBTASK 2.1.1 – PROVIDE INFORMATION NETWORK DEFENSE

SUPPORT

Information network defense is responsible for identifying and integrating network defense requirements into DoD programs and projects that execute the “operate and defend” aspect of

USCYBERCOM’s mission. The contractor shall provide telecommunications, networking, and

DoD network design expertise.

The contractor shall provide the following information network defense support:

1. Monitor testing of systems, plan and direct Rehearsal of Concept (ROC) drills in coordination with DISA and applicable USCYBERCOM staff elements, JFHQs, subordinate headquarters, Service Cyber components, CCMD, and components and agencies with cyber-related missions (as required) in efforts to validate operational procedures throughout the development of new defensive tools, from before Initial

Operational Capability (IOC) to Full Operational Capability (FOC)

2. Coordinate with applicable USCYBERCOM staff elements, JFHQs, subordinate headquarters, Service Cyber components, CCMD, and components and agencies with cyber-related missions to identify, assess, and develop effective options for cyberspace defense strategies

Attachment E

Amendment 07 PAGE C-10

3. Support DCO planning, CONOPS development, and mission execution through expert knowledge of USCYBERCOM components, infrastructure, processes, capabilities, authorities, and partner operations

4. Provide expert information and recommendations to applicable USCYBERCOM staff elements, JFHQs, subordinate headquarters, Service Cyber components, CCMD, and components and agencies with cyber-related missions to support implementation of strategies and plans

5. Coordinate and collaborate with partners and stakeholders to ensure seamless integration of services, systems, and networks into existing and future joint DODIN infrastructure

6. Coordinate with applicable USCYBERCOM staff elements, JFHQs, subordinate headquarters, Service Cyber components, CCMD, and components and agencies with cyber-related missions to identify, assess, develop, and codify across the enterprise a common Cyber Key Terrain (CKT) Program

7. Conduct research and produce white papers (Section F.3, Deliverable 19), reports

(Section F.3, Deliverable 20), and presentations that focus on rapidly emerging cyber threats and cyber adversary TTP

C.4.2.1.2 SUBTASK 2.1.2 – PROVIDE PLATFORM INFORMATION TECHNOLOGY-

CONTROL SYSTEMS (PIT-CS) SUPPORT

USCYBERCOM coordinates securing and defending DoD-owned PIT-CS as required to keep the operational environment safe, secure, and resilient against current and emerging cyber threats. The contractor shall provide expertise in PIT-CS cybersecurity threats and vulnerabilities and current safeguards for PIT-CS.

The contractor shall provide the following PIT-CS support:

1. Develop guidance on PIT-CS incident prevention, information, and analysis

2. Develop input to organizational policies and procedures related to PIT-CS incident response

3. Analyze the operational impacts of PIT-CS incidents, coordinate, and provide the information to the applicable DoD organization

4. Create and participate in test PIT-CS incident response plans

5. Participate, assist, and advise various Operational Planning Groups (OPGs) and

Operational Planning Teams (OPTs) by providing functional expertise and guidance on

PIT-CS incidents

6. Develop after action reports (Section F.3, Deliverable 18) for post-PIT-CS assessment and incident response activities

7. Gather forensic information to support PIT-CS incident analysis

8. Recommend safeguards to prevent PIT-CS intrusions

9. Remediate PIT-CS after an incident

10. Conduct research and produce, white papers (Section F.3, Deliverable 19), reports

(Section F.3, Deliverable 20), and presentations that focus on rapidly emerging cyber threats and cyber adversary TTP

Attachment E

Amendment 07 PAGE C-11

C.4.2.1.3 SUBTASK 2.1.3 – PROVIDE MOBILE DEFENSE OPERATIONS SUPPORT

The USCYBERCOM J3 must understand the threat from mobile devices that house distributed sensitive data storage and access mechanisms, lack consistent patch management and firmware updates, and have a high probability of being hacked, lost, or stolen. Mobile phones and tablets have become critical systems for a wide variety of production applications from Enterprise

Resource Planning (ERP) to project management. The contractor shall provide expertise in mobile hardware and software (hands-on experience), security tools for mobile systems, common mobile exploit methods, and wireless network analysis tools for identifying and exploiting wireless networks used by mobile devices.

The contractor shall provide the following mobile defense operations support:

1. Conduct analysis of post-forensic reports and research of compromised mobile devices on the DODIN and provide an analysis of and recommendations report (Section F.3, Deliverable 20) for mitigation and planning

2. Conduct security assessments of mobile applications and platforms and provide analysis and recommendation report (Section F.3, Deliverable 20)

3. Participate, assist, and advise various OPGs and OPTs by providing functional expertise and guidance on mobile devices

4. Coordinate with applicable USCYBERCOM staff elements, JFHQs, subordinate headquarters, Service Cyber components, CCMD, and components and agencies with cyber-related missions to identify, assess, and develop effective options for mobile defense strategies

5. Conduct research and produce white papers (Section F.3, Deliverable 19), reports

(Section F.3, Deliverable 20), and presentations that focus on rapidly emerging cyber threats and cyber adversary TTP

C.4.2.2 SUBTASK 2.2 – PROVIDE SPACE DOMAN CYBERSPACE OPERATIONS

SUPPORT (OPTIONAL)

Cyberspace Operations in the space domain is performed IOT thwart attacks and risks against space-based platforms and resources that collect, process, store, disseminate, and manage information.

The contractor shall provide the following space domain Cyberspace Operation support:

1. Provide Satellite Communications (SATCOM) and space-related deliberate planning support for Cyberspace Operations

2. Provide Positioning, Navigation, and Timing (PNT), SATCOM, and other Space Force

Enhancement (SFE) capability planning support for DCO

3. Support working groups to define Cyberspace Operations and planning requirements, synchronization of resources, and prioritization of sustainment issues between the cyberspace and space domains

4. Coordinate with partners and stakeholders to define strategies, policies, plans, and procedures to affect the holistic planning and management of the DODIN and JIE from existing to future SFE, Global Positioning System (GPS), and SATCOM system configurations in a manner transparent to customers and ongoing operations

Attachment E

Amendment 07 PAGE C-12

5. Provide GPS and SATCOM system-level planning support for Cyberspace Operations

6. Conduct research and produce reports (Section F.3, Deliverable 20) and presentations that focus on rapidly emerging cyber threats and cyber adversary TTP

C.4.2.3 SUBTASK 2.3 – PROVIDE INTERNATIONAL/NATIONAL CYBERSPACE

OPERATIONS SUPPORT

The USCYBERCOM J3 conducts activities ISO the various CCMDs, including strengthening relationships with key partner nations, coordinating, synchronizing, deconflicting, and integrating operational planning efforts for Cyberspace Operations. This task will require the contractor to maintain a broad, expert knowledge of the Command’s cyber missions, authorities, and capabilities as well as equivalent information regarding the roles and responsibilities of the

Command’s external program partners, which includes (but is not limited to) other DoD commands and agencies, other U.S. Government agencies and key partners.

The contractor shall provide the following international/national Cyberspace Operations support:

1. Communicate complex programmatic cyber planning information, orally and in writing, to elicit understanding and support from professional peers and non-specialists

2. Contribute to the development and refinement of COAs and other cyber guidance materials utilized by the Command and its external cyber program partners

3. Evaluate national/international operations and recommend opportunities for

USCYBERCOM to execute authorities to meet DoD cyber objectives

4. Provide expert information and recommendations to applicable USCYBERCOM staff elements, JFHQs, subordinate headquarters, Service Cyber components, CCMD, and components and agencies with cyber-related missions to support implementation of strategies and plans

5. Assist and advise various OPGs and OPTs by providing functional expertise and guidance as to the intent of negotiated and established national/international agreements

6. Participate in post-event analyses to determine the success of cyber strategies, initiatives, or plans

7. Attend strategic working group meetings, facilitate discussions, gather information, analyze the data, and produce written products ISO USCYBERCOM’s force management efforts

8. Review and provide feedback on cyber-related strategy, policy, and doctrine received from higher headquarter(s)

9. Report on evolving cyberspace policy trends and issues within the U.S. Government

10. Review and evaluate cyberspace policy directives and CONOPS

11. Assist with responses to Congressionally Directed Actions (CDA) and Congressional

Questions for the Record (QFR)

12. Provide input to the Joint Quarterly Readiness Review (JQRR) submission for

USCYBERCOM

13. Provide support with technical and policy analyses of cyber issues

14. Attend conferences, seminars, and special meetings as identified by the Government

Attachment E

Amendment 07 PAGE C-13

15. Contribute to the Office of the Secretary of Defense (OSD) and U.S. Strategic Command

(USSTRATCOM)/USCYBERCOM policies and directives on cybersecurity and internet access

16. Provide substantive input in converting cybersecurity policies into operational plans for defense of the DODIN, as well as maintain a set of detailed options and filtering/defense policies for expected DODIN Operations and defense scenarios, attacks, and changes in

DODIN defensive posture

17. Assist in advocating USCYBERCOM cyberspace policy and doctrine within the DoD and across the U.S. Government through the Joint Interagency Coordination Group

(JIACG). Provide analysis, recommendations, and guidance on cyberspace policy

18. Assist in establishing USCYBERCOM engagement through a JIACG and provide representation to policy and doctrine forums of the DoD

19. Recommend policy for the deconfliction of military Cyberspace Operations with other

U.S. Government organizations, specified partners, and allies as necessary

C.4.2.4 SUBTASK 2.4 – PROVIDE JIE OPERATIONS SPONSOR GROUP (JOSG)

OPERATIONS SUPPORT

The JIE effort will realign, restructure, and modernize how the DoD IT networks and systems are constructed, operated, and defended. JIE will consolidate and standardize the design and architecture of the DoD’s networks to improve mission effectiveness, increase cybersecurity, and optimize resources and IT efficiencies. USCYBERCOM leads the JOSG, which serves as the operational sponsor for the JIE. The JOSG is responsible for developing, integrating, and synchronizing operational procedures ISO the JIE initiative. The JOSG follows the direction of the JIE Planning and Coordination Cell (PCC) and updates the JIE Executive Committee through the PCC.

The contractor shall provide the following JOSG operations support:

1. Develop operational artifacts required to support delivery of JIE

2. Support the JIE Technical Synchronization Office (JTSO) in identifying gaps and overlaps across existing DODIN Operations and DCO technical capabilities

3. Assess and deconflict JIE with DODIN Operations and DCO, and provide an analysis and recommendation report (Section F.3, Deliverable 20) to align DODIN planning efforts with JIE

4. Assist in the development and refinement of the JIE C2 Construct and the JIE

Operational CONOPs

5. Develop, integrate, and maintain operational TTPs and SOPs ISO the JIE

6. Coordinate and collaborate with JTSO and the USCYBERCOM Command, Control, Communications, Computers & Information Technology (C4IT) Directorate (J6) to ensure seamless integration of services, systems, and networks into existing and future joint DODIN infrastructure

7. Assess and recommend network management policies and procedures for implementation in JIE in coordination with JIE partners, stakeholders, and the C4IT Directorate

8. Organize, coordinate, and participate in JOSG working groups and other JIE workshop type of events

Attachment E

Amendment 07 PAGE C-14

9. Develop, staff, and maintain accurate USCYBERCOM orders and directives

10. Develop and conduct update briefs, presentations, and papers to USCYBERCOM leadership to ensure situational awareness and status are conveyed related to the assigned project areas (Section F.3, Deliverable 17)

11. Contribute to the development and refinement of JIE documentation, to include cohesiveness of message, consistency of content, version control, and adjudication of comments.

C.4.2.4.1 SUBTASK 2.4.1 – PROVIDE JOSG REQUIREMENTS SUPPORT

The JOSG is responsible for developing the operational requirements needed to drive the implementation of JIE. The JOSG tracks the requirements from creation to implementation.

The contractor shall provide the following JOSG requirements support:

1. Coordinate with JIE stakeholders to identify JIE operational requirements

2. Develop recommended prioritization and sequencing of JIE operational capability implementation and transition

3. Ensure capabilities align with DoD governing policies and meet the intent of the development objective or capability

4. Analyze proposed capabilities, recommend COAs, and develop solutions to address areas of concern for shortfalls in JIE implementation

5. Develop processes and procedures (Section F.3, Deliverable 21) to implement and ensure JIE operational requirements are met DoD-wide

6. Identify DODIN Operations and DCO enterprise management tool requirements and evaluate operational standards and tools for use within JIE

7. Coordinate with JIE stakeholders to advise and assist with the planning and identification of cyber defense requirements associated with JIE operational requirements

C.4.2.4.2 SUBTASK 2.4.2 - PROVIDE JOSG OPERATIONS COMPLIANCE AND

IMPLEMENTATION SUPPORT

The JOSG is responsible for shaping operational performance metrics for JIE and tracking JIE implementation and ensuring compliance with established standards.

The contractor shall provide the following JOSG operations compliance and implementation support:

1. Coordinate with the Office of the DoD Chief Information Officer (CIO) and other stakeholders to develop, distribute, and sustain operational metrics for the JIE

2. Track all DoD components’ compliance with JIE MOEs/MOPs and applicable DoD JIE policies

3. Devise methods to test and evaluate each component’s compliance with JIE requirements and all other applicable standards

4. Develop and maintain processes, procedures, and TTPs for the Operations Center accreditation process (Section F.3, Deliverable 21)

5. Develop and monitor JIE Service Level Agreement (SLA) performance and metrics

Attachment E

Amendment 07 PAGE C-15

6. Provide evaluation results, reports, and recommendations (Section F.3, Deliverable 20) to USCYBERCOM and JIE leadership

7. Support DCO planning and mission execution through expert knowledge of

USCYBERCOM components, processes, capabilities, authorities, and partner operations

8. Analyze and evaluate voice/video/data system solutions, provide an analysis and recommendation report (Section F.3, Deliverable 20), and provide support for joint full spectrum (terrestrial and space) system and network integration in the JIE

C.4.2.5 SUBTASK 2.5 – PROVIDE CYBER FIRES PLANNING AND ANALYSIS

SUPPORT

Cyber fires planning and analysis supports planning in OCO and DCO throughout the entire

JOPP. Cyber fires planning and analysis requires the coordination of joint strategic and operational planning and execution of joint fires, to include targeting, capability pairing, and threat mitigation ISO Cyber Mission Force (CMF) and other operations. Knowledge of cyber

TTPs is required IOT provide recommendations to USCYBERCOM leadership on all aspects of joint fires and threat mitigation.

The contactor shall provide the following cyber fires planning and analysis support:

1. Plan, organize, determine, and recommend necessary policies, regulations, directives, programs, doctrine, and procedures for the establishment and maintenance of assigned and anticipated joint fires coordination and execution

2. Provide support to future operations planners to integrate cyber capabilities into plans

3. Collaborate with DISA, the National Security Agency (NSA), service providers, and other organizations to ensure that USCYBERCOM requirements are implemented

4. Collaborate with operators in the Joint Operations Center (JOC), subordinate headquarters, and cyber teams to integrate capabilities

5. Coordinate with all applicable USCYBERCOM staff elements, JFHQs, subordinate headquarters, Service Cyber components, CCMD, and components and agencies with cyber-related missions

6. Act as liaison between capability Subject Matter Experts (SMEs) and the planning teams

IOT assist the planners in understanding the technical aspects of specific capabilities ISO a specific planning effort

7. Identify and develop cyber TTPs that advise the future operations planners on achieving cyberspace operations ISO operations and exercise objectives

8. Recommend requirements and prioritization for the development of automated cyberspace capabilities ISO operations and assessments

9. Participate in USCYBERCOM requirements working groups as a capability SME to define cyber capabilities/tools and recommend COAs

10. Assess and provide an analysis and recommendation report (Section F.3, Deliverable 20) on technical issues relating to current and future DoD plans, programs, policies, and activities related to Cyberspace Operations

11. Participate in special programs and teams for fires planning and analysis

Attachment E

Amendment 07 PAGE C-16

12. Support the collateral Review and Approval Process for Cyberspace Operations (RAP-

CO) process.

C.4.2.5.1 SUBTASK 2.5.1 – PROVIDE CYBER TASKING CYCLE (CTC) SUPPORT

The CTC is the official method used to task cyber forces to execute missions. The CTC is utilized at all echelons of a joint command to globally synchronize and deconflict forces. The

USCYBERCOM J3 is responsible for managing the products that are driven by the CTC.

The contactor shall provide the following cyber tasking cycle support:

1. Assist with the creation, implementation, and management of the Master Cyber

Operations Plan (MCOP) creation and implementation

2. Synchronize and deconflict the CTO

3. Attend and provide input during the Operations Synchronization meetings

4. Coordinate with CMF and other subordinate units to facilitate the CTC processes

5. Provide time-sensitive, critical data inputs into the C2 system and validate data

6. Make recommendations on changes in the C2 system based upon evolving task cycle

C.4.2.5.2 SUBTASK 2.5.2 – PROVIDE FIRES OUTREACH AND EXERCISE

PROGRAM SUPPORT

The fires outreach program provides information and knowledge to different groups, courses, units, and organizations outside of USCYBERCOM on the USCYBERCOM fires process as it continues to evolve. This program has become even more important with the standup of the

CMF units.

The contactor shall provide the following fires outreach and exercises program support:

1. Conduct outreach programs on USCYBERCOM Fires processes

2. Maintain the master Fires Brief with the most updated information

3. Represent USCYBERCOM and brief at selected courses and events (Section F.3, Deliverable 17), to include, but not limited to, selected exercise academics, the Joint

Advanced Cyber Warfare Course (JACWC), the Army Cyberspace Operations Course, the Air Force Weapons School, and the Joint Targeting School

4. Maintain contact with the external groups, courses, units, and…