RAINFIRE_SOW_v2_18_Sep_2018.docx

UNCLASSIFIED

(U) RAINFIRE

(U) STATEMENT OF WORK (SOW)

(U) Version 2.0

(U) 18 September 2018

Contents

1. (U) BACKGROUND

(U) United States Cyber Command (USCYBERCOM) established the Capability Development Group (CDG) to coordinate, integrate, and prioritize cyberspace capability development efforts to rapidly deliver joint operational products through integrated project delivery, enabling full-spectrum cyberspace operations. The CDG plans and synchronizes joint capability development for the cyberspace domain, rapidly delivers mission-ready operational products and services required for generating, facilitating, or monitoring effects; and operates and maintains USCYBERCOM’s technical baseline to enable mission execution.

(U) The CDG Analytics Portfolio requires analytics support capabilities, to include analytic development, transition, and optimization. The analytic capabilities procured under this effort support cyber warfighters within the Department of Defense (DoD). The USCYBERCOM CDG has been working in collaboration with the broader strategic cyber and information technology (IT) initiatives of the United States Government, to include: DoD/DISA’s Big Data Platform (BDP), the Unified Platform (UP), the Joint Regional Security Stacks (JRSS), the Joint Information Environment (JIE), the Intelligence Community IT Enterprise (IC ITE), the Joint Cyber Command and Control, (JCC2), the Joint Cyber Situational Awareness (JCSA), the Enterprise Logging (EL), and Army Defensive Cyber Operations (DCO-A) Programs of Record. These efforts will be key influencers for the analytic support provided under this planned effort.

2. (U) SCOPE

(U) The contractor shall develop, test, deliver, and optimize analytic capabilities for the USCYBERCOM. The contractor shall develop each analytic based upon the target operational environment and granular functional and non-functional requirements. The contractor shall deliver capabilities that are diverse and leverage expertise from across the cyber industrial bases, to include innovators, emerging businesses, and non-traditional sources. The contractor’s shall provide domain expertise and approach use of developers in the unclassified domain to expand the base of available solutions.

(U) The contractor shall perform analytic work on other efforts, such as prototypes developed in a lab environment, as directed by the Government to transition to the RAINFIRE contract. The contractor shall enhance analytic capabilities or optimize operational effectiveness on transferred prototypes.

(U) For the purpose of this effort, an analytic will be defined as software in a computing environment (e.g., cloud infrastructure, streaming environment, etc.) that summarize and characterize data, allowing users to derive meaning and interpret desired results. Analytics are the set of functions that provide for technical capabilities operating on behalf of analysts. Analytics perform routine tasks better left to automation or are those analytic functions that defy work by humans, based on the scope of the problem(s) at hand. Analytics involve, at a minimum, the following capabilities: Action plans, Data access and delivery, standardization, annotation, association, and services execution.

(U) The contractor shall provide joint analytic development in two categories: Standard and Non-Standard:

· Standard analytic requirements follow the majority of development efforts from refined requirements, through physical development, test, and delivery.

· Non-standard analytic requirements take on a number of unique qualities. These non-standard activities require the application of extremely specialized skillsets, including: Artificial intelligence, streaming analytics, behavioral science based analytics, edge analytics, and analytic infrastructure support.

(U) The following are the standard and non-standard analytic development categories:

(U) Section 2, Table 1

3. (U) APPLICABLE DOCUMENTS

· (U) Section 508 of the Rehabilitation Act (29 U.S.C. 791d): Electronic and Information Technology Standards, Accessibility, 36CFR1194.

4. (U) REQUIREMENTS

(U) The contractor shall provide analytic development support to the complete array of Cyber Mission Forces (CMF), to include the Cyber National Mission Force (CNMF) and Cyber Protection Team (CPT) Cyber missions. The contractor shall provide analytic capabilities that meet the operational requirements for cyber capabilities across Department of Defense (DoD) data sources and mission data. The contractor shall provide analytic support, including systems engineering, testing, training, and transition of analytic needs.

(U) The contractor shall provide and maintain the necessary SCIF and unclassified development and test environments to support program management, analytics development, analytics test and evaluation, and any other requirement in this SOW.

(U) The contractor shall support all analytics related activities needed to support the development lifecycle, to include: program management, hardware acquisition, software development, systems engineering, integration, systems acquisition, systems certification and accreditation, technically documenting developed systems, and developing training materials to ensure that developed systems can be effectively operated, supported, and maintained.

4.1. (U) Program Management

(U) The contractor shall provide effective program management and program reporting that enables and supports the contractor’s task execution. The contractor shall:

· Coordinate with the Contracting Officer / Contracting Officer’s Representatives (COR);

· Apprise senior management on productivity and quality assurance;

· Support Government efforts for document review and approval;

· Manage project schedules and coordinate contractor and subcontractor activities;

· Identify and communicate issues and risks to the Government and offer recommendations on how issues/risks should be mitigated to successfully satisfy the requirements;

· Manage and mitigate risks when it may impact performance, schedule or cost;

· Provide comprehensive cost management and control functions;

· Provide comprehensive schedule management and control functions.

(U) The contractor shall collaborate with the cyber analytic operators and users, the Cyber Immersion Lab (CIL), other divisions within CDG, and other organizations, when directed by the COR, to prototype, develop, test, field, and maintain mission analytic capabilities. The contractor shall support ad hoc meetings and shall provide subject matter expertise to the Government and other stakeholders on an ad-hoc basis regarding the technical aspects of each analytic.

4.2. (U) Standard Analytic Development

(U) The contractor shall develop descriptive cyber analytics of data (describing the present state of a system) in order to meet defined operational objectives.

(U) The Government will perform an initial analysis. This analysis will determine if holistic new analytic development is required or if existing analytic capabilities (that are under Government configuration control) can be modified/enhanced to achieve new desired effects based on each analytic capability need. Based on the Government’s determination, the contractor shall develop cyber analytics or modify/enhance existing analytic packages that are provided as Government Furnished Information.

(U) The contractor shall perform development at the lowest classification level possible. Developed analytics shall preclude the use of any proprietary software or solutions, unless explicitly granted permission by the Government.

(U) Under Standard Analytic Development, the contractor shall apply the following skillsets and provide the following capabilities:

· Supporting cyber-specific mission need and activities, to include:

· Cyber hunt and advanced threat hunting

· Operational Detect and Response

· Cyber Capture the Flag

· Net Defense

· Document Analysis

· Offensive Cyber Operations

· Defensive Cyber Operations;

· Analyzing analytic requirements (to include applying systems engineering, decomposing requirements, and allocating requirements);

· Application of Data Science to solve analytical cybersecurity problem sets;

· Developing analytics with

· Either existing, modified, or new visualizations

· Various data throughput requirements

· Either existing or new platform data and target environments

· Known sets of selectors or known selectors (e.g., signatures and watch lists) of interest to operate across stored data structures for enrichment;

· Applying various tools, data management, and programing techniques to include Hadoop, Spark, Java, Python, and R;

· Performing statistical analyses;

· Developing for USCYBERCOM’s targeted platforms, to include, at a minimum either or both of the following:

· The Big Data Platform (BDP) used by DoD and the Defense Information Systems Agency (DISA), or

· The Distributed Cyber Analytic Framework (DCAF);

· Providing Data visualization;

· Mining and Auditing Data;

· Synchronizing unconventional, unstable, and unstructured data. (to include preparing and structuring data for analysis).

4.2.1. (U) Systems Engineering

(U) The contractor shall apply systems engineering activities throughout the development lifecycle of the analytic. The contractor shall implement systems engineering processes and procedures to satisfy analytic development requirements. Systems engineering shall include: decomposing and managing requirements, conducting design tradeoff analyses, selecting/implementing effective and efficient designs, managing architectures, and assessing system performance after implementation. The contractor shall also create technical documentation, maintain technical documentation and analyze impacts of technical changes.

(U) The contractor shall:

· Collect analytic use cases and lead decomposition of requirements;

· Analyze design issues, consider design alternatives, and present recommendations for solutions;

· Perform architecture management:

· Collect, integrate, generate, and analyze systems, technical architectures, organizational structures, workflows, governance, and applicable tools for the development, maintenance, and evolution of cyber analytics,

· Develop comprehensive architectures to include related system and stakeholder interfaces,

· Assess capability gaps of existing architectures and develop architecture roadmaps and transition plans;

· Determine the necessary hardware and sustainment requirements for successful system deployment and sustainment;

· Produce design documentation that serve as the basis for all staging, configuration and testing efforts. Support design review sessions to validate design information, when required;

· Conduct simulation modeling, data traffic flow analysis, and network bandwidth analyses to maximize efficiency and effectiveness of deployed analytics.

4.2.2. (U) Development

(U) As tasked, the contractor shall develop cyber analytics in support of cyber operations requirements and cyber analytic initiatives.

(U) Development efforts shall enable USCYBERCOM to quickly fuse and analyze data sets in support of cyberspace operations, to include: identifying and defining governing data structures, developing mission analytics, identifying opportunities to apply data science tradecraft on disparate data sets, and applying advanced algorithms and techniques. The contractor shall:

· Maximize the use of industry best practices for software development (e.g., Scrum, DevOps, Scaled Agile Framework (SAFe), Software Configuration Management (SCM), etc.), that support maximum flexibility;

· Manage and integrate the holistic suite of processes needed to develop analytic software, control code, and build analytic software (to include providing coding, scripting, and compiling skills);

· Identify and track expectations from the Government and dependencies on other organizations (including within the Government);

· Apply coding expertise to analytic development;

· Maintain the necessary environments to support analytics development, based upon any Government development environments, if provided;

· Deliver new analytic capabilities that meet operational requirements and apply the following skillsets:

· Data acquisition,

· Data mining,

· Data auditing,

· Statistical analysis,

· Data visualization,

· Other skillsets, to include computer science, that are not driven by Artificial Intelligence based approaches;

· Implement analytic solutions within identified analytic platforms, to include DoD/DISA’s Big Data Platform (BDP) or the Distributed Cyber Analytic Framework (DCAF);

· Ensure analytics can be installed, integrated and operated;

· Implement a robust cybersecurity program throughout the analytic development lifecycle that takes into consideration:

· Active measures to identify and deny unauthorized access or denial of service attacks,

· Malicious code protection; intrusion detection; security function verification; software, firmware, and information integrity; and incident monitoring, handling, reporting, and response,

· Integration of secure coding principles into the software development lifecycle,

· Automated application security testing as part of the testing process;

· Manage quality control for the development of analytics (to include applying SCM and other industry standards for enhancing quality).

(U) The contractor shall provide the Source Code and Installable Analytic Software for each analytic to the Government.

4.2.3. Test and Evaluation

(U) The contractor shall implement a comprehensive test program that includes robust evaluation and verification, quality control, and peer reviews to ensure the delivery of high-quality products.

(U) Testing shall be based on the concept of continuous testing from the lowest level of operational software, and testing shall include: module, unit, thread, and system level testing; regression testing; security testing; developmental testing; operational verification; and user acceptance testing. All testing (up to operational verification and user acceptance testing) shall be conducted in contractor facilities, at the appropriate classification level (driven by specific requirements in each call). Operational Verification and User Acceptance Testing, which may occur in Government spaces (as defined in each call). For test designed to assess deployed functionality, testing shall occur in an environment that is representative of the target environment.

(U) As needed, the Government will provide the contractor access to a test environment which is representative of the production environment. For additional development and test requirements, the contractor shall provide and maintain the necessary SCIF and unclassified development and test environments required to support the contractor’s analytics development, test and evaluation approaches.

(U) The contractor’s testing program shall execute all requisite testing activities to ensure the delivery of a high-quality product. The contractor shall:

· Perform end-to-end regression testing;

· Demonstrate developed capabilities;

· Perform functionality testing;

· Provide security product testing;

· Furnish subject matter expertise throughout user acceptance testing, ensuring that the analytic meets specified requirements and is suitable for deployment and operations;

· Track and resolve any defects or issues discovered during testing;

· Conduct testing and evaluation in accordance with applicable standards identified in the call order;

· Execute performance and throughput testing, to include evaluating how well analytics scale. Scaling can include:

· Analytic processing rate on input data

· How well the analytic works in conjunction with other analytics

· How well analytic algorithms operate inside an analytic system.

4.2.4. (U) Transition

(U) The contractor shall conduct transition activities, handing over operational control of each analytic to the Government, in a timely manner. Transition shall include operational verification and user acceptance testing.

(U) The Government will introduce the analytic into the target analytic environment and run contractor-developed test procedures against the analytic. The Government may provide test plans and procedures, which may be modified by the contractor to support specific evaluations. To support transition, the contractor shall:

· Coordinate delivery and deployment timeframes and resource requirements with the COR;

· Deliver tested analytics to the Government;

· Support operational verification and user acceptance testing with subject matter expertise throughout the transition, operational verification, and user acceptance processes;

· Advise on local configuration modifications and tests that validate successful installation and deployment at the operational level(s);

· Provide guidance on tools and procure tools that are necessary to test the integration of analytic capabilities with the systems used by various customers;

· Track and resolve any defects or issues discovered during testing.

(U) Once operational verification, user acceptance testing, and transition are successfully completed, without any outstanding issues, and verified by the Government, the Government will provide confirmation of acceptance to the contractor.

4.2.5. (U) Training

(U) The contractor shall develop training material and provide live training to the cyber workforce. Training materials shall adequately inform users on operationally using developed analytics. The contractor shall:

· Assess training requirements through collaboration with the Government and user community;

· Develop training materials (as required by each call) which includes:

· An Analytic Standard Operating Procedure, including any Tactics, Techniques, and Procedures unique to the analytic

· A User Guide and Quick Start Guide

· Training slides to support a live, interactive training event;

· Provide one live, interactive training event for each analytic capability.

(U) The contractor shall provide continued on-call subject matter expertise for a period of six months following the acceptance of each analytic. The contractor shall answer ad-hoc questions and provide technical expertise regarding each delivered analytic.

4.2.6. (U) Post-Delivery Maintenance Support

(U) The contractor shall provide continued maintenance and sustainment of delivered analytics for a period of 180 days following the transition and acceptance (e.g., delivery) of each analytic based on USCC core hours.

(U) Maintenance and sustainment shall be provided for any issue that impacts the operability of the delivered analytic, as defined by the requirements of the call to develop that analytic. During this period of time, the contractor shall provide bug fixes, develop patches, track issues, and resolve issues with fielded analytics. Upon delivery of a bug fix, the contractor shall deliver updates to any documentation, training, software, and other deliverables that are impacted by the bug fix. During the maintenance support period, the contractor shall:

· Maintain configuration control of each analytic, unless relieved of configuration control by the Government;

· Track analytic issues that arise and coordinate all solutions and/or resolutions to those issues;

· Develop, install, and implement patches and bug fixes;

· Provide maintenance to any commercial licenses or third-party products used in conjunction with the analytic.

(U) For all changes the contractor shall deliver updates to the applicable deliverables, as called out in the order, such as: Training Materials, Source Code, Installable Analytic Software, Source Code Internal Documentation, Requirements Traceability Matrix, SDD, SRS, Test Plans and Procedures, Test and Evaluation Reports, and Regression Test Materials.

(U) Post-Delivery Maintenance Support will be not be utilized to effect enhancements to analytics that are outside the requirements of the call (e.g., unforeseen changes in target data, computing environments, or throughput requirements).

4.3. (U) Analytic Maintenance and Sustainment

(U) The contractor shall maintain and sustain cyber analytics that are provided as Government prototypes to effect modifications, effect enhancements, and/or ensure continued analytic operability. The contractor shall update and upgrade existing analytics to account for changes in target data, computing environments, throughput requirements, and/or other characteristics. Maintenance and Sustainment activities shall include, at a minimum:

· Modifying or updating cyber analytics for any purpose that ensures continued operability:

· Produce, install, and implement patches and bug fixes,

· Modify analytics to ensure operability on updated and/or evolving mission platforms,

· Update analytics to ensure operability within operational computing environments;

· Tracking and resolving issues with fielded analytics.

(U) During the 180 day sustainment period, the contractor shall provide on-call support, but shall be limited to USCC core hours.

4.4. (U) Analytic Optimization and Customization

(U) The contractor shall optimize and customize analytics, on an individual basis, including analytics that are provided by the Government. The contractor shall transition analytics from research and development organizations (e.g., DoD Advanced Research Projects Agency (DARPA)), enhance analytics as required, and enable operational support.

(U) The contractor shall effect optimization and customization activities to enhance analytic operability or respond to unique customer needs (e.g., scaling an analytic to handle larger mission data sets and/or optimizing an analytic for operations in a defined computing environment). Analytic optimization and customization activities shall follow the contractor’s developmental methodology and include: Systems Engineering, Stakeholder Collaboration, Test and Evaluation, Training, and Transition. Optimization may also include modifying existing analytics to better perform in a target computing environment or reduce computing resource (e.g., cloud) usage and cost through the application of enhanced data management techniques.

4.5. (U) Non-Standard and Specialized Analytic Efforts [footnoteRef:1] [1: Section 4.5 will be edited by successful offeror to include only sections in which they were deemed technically acceptable. If the section is noted as “Removed” at time of award, the Contract holder is ineligible to compete for calls in that technical requirements area.]

(U) The contractor shall develop analytics based on the application of advanced and specialized skillsets. The contractor shall develop cyber analytics to effect descriptive cyber analytics, predictive cyber analytics (describing the likelihood of future outcomes), and prescriptive cyber analytic (generating recommendations about managing circumstances and optimizing outcomes, based on analyzing previous situations). The contractor may be required to develop analytics for data-in-motion and should have the expertise to support that request.

(U) Based on the Government’s initial evaluation of the cyber need, the contractor shall develop cyber analytics or modify/enhance existing analytic packages that are provided as Government Furnished Information. The contractor shall base their development approach on this initial analysis.

(U) Non-standard Analytic Development requires the application of one (or more) advanced or specialized analytic development skillsets. The following describe the tasking for non-standard analytics:

4.5.1. (U) Artificial Intelligence and Deep Learning Analytics

(U) The contractor shall apply artificial intelligence techniques, to include machine learning and deep learning to the development of an analytic. The contractor shall utilize artificial intelligence techniques including supervised or unsupervised algorithms, to enhance cyber analytic capabilities. The contractor shall effectively create dynamic systems that are able to classify data, cluster data, and build predictive models. The contractor shall apply artificial intelligence techniques to enhancing existing cyber analytics. The contractor shall effectively create dynamic systems that are able to effectively learn from humans and adapt to local threat surfaces. The contractor shall appropriately manipulate datasets, including labelling datasets, as necessary, to effect the required artificial intelligence, machine learning, and deep learning requirements.

4.5.2. (U) Streaming Analytics

(U) The contractor shall develop capabilities that can analyze large, in-motion, and dynamic datasets. These datasets may evolve and change based on varying measurable trigger events. The contractor shall develop streaming analytic capabilities that minimize batch processing and be able to generate real-time insight into systems and enable enhance decision making based on live, streaming data sets, based on defined time limits.

4.5.3. (U) Behavioral Science Based Analytics

(U) The contractor shall provide behavioral science support and apply behavioral analytics to guide courses of action for mission operations. The contractor shall apply behavioral science techniques to both targets and users. These activities shall complement analyst automation and increase mission impacts through effective decision-making frameworks. The contractor shall identify and create cognitive decision-making models and prototypes; develop requirements for automation; support the development of behavioral science implementation roadmaps; and create easily accessible behavioral science resources.

4.5.4. (U) Edge Analytics

(U) The contractor shall develop capabilities based on edge analytics, where automated analytic computations are performed on data at a specific architectural structure (such as a sensor) instead of waiting for data to be centralized.

4.5.5. (U) Analytic Infrastructure Support

(U) The contractor shall support analytic infrastructure needs, to include standing up analytic environments, modifying analytic environments, and installing analytic computing environment instantiations.

5. (U) DELIVERABLES

(U) The contractor shall provide deliverables in accordance with the calls associated with the contract. Deliverable products will be reviewed, validated, and tested to ensure sure that they meet the appropriate standards, policy, business requirements, and quality measures.

6. (U) SECURITY CLEARANCE REQUIREMENTS

6.1 (U) PERSONNEL SECURITY REQUIREMENTS

(U) The contractor shall staff the contract with qualified personnel with the appropriate clearances to meet technical requirements. All personnel shall have the appropriate technical certifications, experience, knowledge, skills, and abilities such that the contractor can fully meet requirements. In order to perform on the some of the calls, some personnel may be required to have (or be eligible for) a TOP SECRET clearance with SCI based on a Single Scope Background Investigation (SSBI) or Periodic Review (PR).

(U) For the purposes of this effort, clearance requests must be accurate and complete. The contractor shall submit Security In-Process (SIP) forms on individuals with an active Top Secret (TS) Clearance, or who are requesting a clearance, with Sensitive Compartmented Information (SCI) eligibility (within scope - five years) and a current adjudicated Counterintelligence (CI) polygraph (within scope - seven years) to the USCYBERCOM SSO. If inaccuracies are identified, the forms will be rejected by the USCYBERCOM SSO and resubmission may be required. The Government will not be held responsible for inaccurate or inconsistent SIP forms that delay staffing. For tracking purposes, the COR shall be copied on all final or updated SIP form submissions to the USCYBERCOM SSO.

(U) The contractor shall submit, update, and maintain a current Contractor Position Roster Log (CPRL). The CPRL is to be managed according to published guidelines from the Office of Security Services Policy Issuance 10-10, Industrial Security Program, dated March 1996.

(U) All personnel performing work on this effort shall be U.S. Citizens.

6.2 (U) SECURE COMMUNICATIONS

All technical documentation and data exchanged between the contractor and the Government shall be protected from unauthorized disclosure with appropriate classification markings, in accordance with the appropriate security classification directives and guides.

6.3 (U) FACILITY REQUIREMENTS

(U) Performance under this contract may be up to the TOP SECRET level. Therefore, all contractor shall have a current TOP SECRET facility clearance and fully comply with the requirements of the Contract Security Classification Specification, DD Form 254. The Government will identify in the calls if a Secure Compartment Information Facility is required to perform the work. It will be the Contractors responsibility at time of responding to the call to identify how they will be the requirement.

(U) The Government will try to keep all program related activities and deliverables at the lowest classification level possible.

(U) In general, the analytic algorithms, development, and testing shall be performed at the UNCLASSIFIED level at the Contractor’s facility, as the approved places of performance. The contractor performing operational testing shall require a clearance to support operational testing in the Government facility.

(U) The contractor shall be fully conversant and comply with all risk based information security policies, procedures, and control techniques throughout the lifecycle of each developed analytic; additionally, the contractor shall:

· Develop all appropriate plans for providing adequate information security;

· Ensure all staff receive appropriate information security awareness training;

· Oversee all personnel with significant responsibilities for information security with respect to such responsibilities;

· Periodically test and evaluate the effectiveness of information security policies, procedures, and practices;

· Develop and implement procedures for detecting, reporting, and responding to security incidents.

7. (U) TRAINING

(U) Contractor personnel are required to have the training and expertise necessary to perform against the issued calls. Contractor personnel may be authorized to attend Government sponsored training that is unique for this effort, are essential to the performance of this contract, and are not available commercially. The Contracting Officer shall approve all Government sponsored training. It is the responsibility of the contractor to keep all personnel current on commercial technology and trends through contractor provided education. The contractor must maintain staff with critical analytic development skillsets, to include: Hadoop, Spark, Java, Python, R, and Cyber Operations, cloud execution, and cloud usage experience. The contractor shall ensure that training provided to the contractor personnel does not negatively impact the schedule of efforts and deliverables.

8. (U) GOVERNMENT FURNISHED EQUIPMENT/ INFORMATION

(U) Government furnished equipment and information will be identified in the call, if applicable.

9. (U) TRAVEL

(U) The contractor may be required to travel within the Continental United States (CONUS) during the performance of this contract. All contractor travel shall be approved by the COR, in writing, prior to occurrence. Travel shall be in accordance with current Joint Travel Regulations (JTR).

(U) Local travel around the Fort Meade, MD area may be required to support RAINFIRE. The Government will not provide direct reimbursement for local travel, defined as within fifty (50) miles of USCC.

10. (U) SECTION 508 COMPLIANCE

(U) Any materials, job aids, and reference materials provided under this contract, as well as vendor furnished information technology (software and hardware) delivered, shall meet the requirements of the Section 508 refreshed standards.

UNCLASSIFIED

image1.png