H9225721Q0007 Vendor Questions_with Answers_18Nov2020.pdf

The information displayed in this document represents the submitted vendor questions and the corresponding Government answers with regards to the Statement of Work (SOW) for Solicitation H9225721Q0007 TRX Support:

2.1

Is the exercise a 24 hour operation or are their operational hours?

Answer: There will be irregular hours, no day will be the same time block, and 24 hour operations are not required.

4.1

Is there an approved daily observation checklist that will be provided to the contractor?

Answer: An observation checklist will be provided at the beginning of the exercise and adjusted as needed.

4.2

Are the SMEs expected to operate in parallel with VEO role players that are provided outside of the scope of this SOW, or are the SMEs expected to create the signals environment for the exercise as role players?

Answer: SMEs will not be required to create the signals environment and will operate outside of the requirements that is expected of the role players. They will coordinate with the exercise control group but will be independently operating for the majority of the exercise.

4.3

What is the requirement for development of tools and TTPs for the ECG integration?

Answer: Willingness to flex red cell activities (TTPs) to fit what the ECG fits into the scenario.

Ability to adjust and modify their gear to monitor friendly activities.

4.4

What types of modifications are required in “modify COTs equipment"?

Answer: The collection cell will be near peer threat, so if the gear can fulfill the requirement there is no modification needed.

Does developing and modifying COTs equipment involve hardware fabrication and to what extent?

Answer: Must be able to modify their own equipment in order to meet the requirements.

What open source software is to be used?

Answer: Kali Linux operating system or similar penetration testing/information assurance operating systems IE Parrot OS. Software: Aircrack-ng suite, Kismet, SDR#, SDR Console, MSF Console, Metasploit, NMap, ZenMap.

What level of software development, open source or otherwise, is required?

Answer: Basic Linux Bash, Python, and Windows command prompt and power shell commands.

Describe what if any COTs equipment will be required or utilized to supplement the COTs active and passive capabilities?

Answer: RasPi, Monitor mode capable network interface controller, IE duel band Alfa card, RTL-SDR or similar SDR interface device IE HackRF, Airspy, etc.

Will SMEs be expected to provide, develop and/or modify the COTs equipment necessary to create the entire signals environment for the exercise, or are the SMEs only required to provide hardware/software for their own capabilities?

Answer: SME’s will only be required to provide tools to enhance capabilities. The signals environment for the contractor should be the exercise audience itself.

What are the expectations for near-pear threats in the visual environment (telephoto, video, ISR, satellite, etc)?

Answer: The visual environment should be reflective of the signals environment to enhance the final product to detail information obtained by the SMEs (example:

photos of vehicle or location identifying expected RF location). There is no additional requirement to provide aerial ISR or satellite like products.

4.4.1

What are the expectations for training and assessment of signature management?

Answer: The final assessment should be demonstrated with a network characterization both physically and logically. Enough detail to show the training audience the signature/footprint coverage throughout the training evolution.

When will signature management training occur (before, during, or after the exercise, or a combination)?

Answer: Signature management training will be in the form of an out brief to the training audience with discovery and mitigation techniques/recommendations reflective of the characterization.

4.4.2

Describe what is meant by “develop COT’s equipment?

Answer: Utilizing Open Source software in conjunction with COTS equipment capable of identifying 802.11 enabled devices, enumerating associated and disassociated clients, identify ports and services being employed, identifying potential vulnerabilities or overtly attributable information being displayed. Additionally utilizing Software Defined Radio interfaces with Open Source software to identify any/all push-to-talk communications that can be directly attributed to friendly force presence. Evidence to support should include screen captures of spectral display, waterfall display of modulated waveforms, and any location based analysis that can be derived from time and distance correlation.

Describe what level of development is required for COT’s equipment?

Answer: Fundamental computer hardware installation and management. Install preferred OS to MicroSD, boot RasPi, run preferred suite of penetration testing software. External power source, display, mouse, keyboard, etc will be required. Multiple units are preferred to be utilized as remote access terminals or non-attributable passive leave behind systems.

Describe what Software Defined Radios (SDRs) are intended to be used as COTs equipment?

Answer: RTL-SDR, AirSpy, HackRF

Are the COTS equipment government furnished equipment? If COTS are not Government furnished, please add what comms systems will get targeted so that offeror can ensure proper COTS capability is brought to the exercise.

Answer: COTS will not be provided by the government. Contractors will need to collect on all standard military and SOF specific communication methods to include government furnished cellular devices, hotspots, tablets, etc. Example: Harris radios.

4.4.4

Regarding "regionalized" enemy and friendly TTPs, what regions are to be focused on?

Answer: Regionalization to be discussed post award of contract in a secure medium.

4.4.7

What drives the requirement for SMEs to have CEH, Security+ and Network+ certifications?

Answer: Having knowledge of network infrastructure, penetration testing methodologies, industry standard software, known exploits, ability to produce thorough reporting on assessed vulnerabilities, and provide feedback or recommendations on policy development to remedy issued identified.

4.5

Is there a format that will be provided for the debrief?

Answer: Debrief format will be the choice of the SMEs but should be written with enough detail for utilization in lessons learned without the need for the SMEs explanation of the product.