UC_TEC_SOW.pdf

TEC Services Contract Page 1 of 49 Pages Actual Task Order 2016-06-02

Joint Interoperability Test Command Unified Capabilities (UC) Product Test, Evaluation, and Certification (TEC)

Services and Facility Support

-UC TEC Services & Facility Support- Statement of Work

Contract Number:

Task Order Number:

Tracking Number:

Follow-on to Previous Contract and Task Order Number:

1. Contracting Officer’s Representative (COR).

1.1. Primary COR.

Name:

Organization:

Department of Defense Activity Address Code (DODAAC):

Address:

Phone Number:

Fax Number:

E-Mail Address:

1.2. Alternate COR.

Name:

Organization:

DODAAC:

Address:

Phone Number:

Fax Number:

E-Mail Address:

2. Contract or Task Order (TO) Title. Joint Interoperability Test Command (JITC) Department of Defense (DoD) Enterprise Unified Capabilities (UC) Product Test, Evaluation, and Certification (TEC) Services and Facility Support – UC TEC Services & Facility Support.

3. Background.

3.1. JITC provides DoD Enterprise UC Approved Products List (APL) TEC Services in accordance with (IAW) the most current UC Requirements (UCR) document and mandated by the DoD Instruction (DoDI) 8100.04.

3.2. The DoD UC APL process is developed IAW DoDI 8100.04.

3.3. The UC APL process provides for an increased level of confidence through Cybersecurity (Cyber) Accredita-tion (formerly Information Assurance (IA)) and Interoperability (IO) Certification.

3.4. The Defense Information Systems Agency (DISA) UC Certification Office (UCCO) manages the UC APL pro-cess. The UCCO acts as the staff element for DISA to manage the UC APL. The UCCO provides process guid-

TEC Services Contract Page 2 of 49 Pages Actual Task Order 2016-06-02 ance, coordination, information, and support to government sponsors and vendors throughout the entire process – from the registration phase to the attainment of DoD UC APL status. In addition, the UCCO manages the UC APL removal list, which consists of products that have been removed from the UC APL.

3.5. The UC APL Process Guide defines the processes, roles, and responsibilities for testing IAW UCR and support-ing directives, instructions, and guidance.

3.6. DISA/JITC is the single approving authority for all equipment listed on the UC APL. The UC APL is the single approved source for the acquisition of telecommunications equipment that is to be connected to the DISN. The UC APL is used by all Military Departments and DoD agencies in the acquisition of communications equipment that is to be connected to the Defense Information Systems Network (DISN) as defined by the UCR. Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6211.02D, DISN Responsibilities, 24 January 2012, Enclosure B. Policy. Para 1.c. (4) states: “CC/S/As shall procure or operate UC products listed on the DoD UC APL, as applicable, unless granted an exception to policy IAW DoDI 8100.04.”

3.7. Testing for certification of UC APL products occurs either at the JITC or at other DoD component test labs.

Cyber accreditation of UC products is the responsibility of the appropriate Service/Agency Certification Authority (CA), and IO Certification of UC APL products is the responsibility of JITC.

3.8. DoD DISA Enterprise UC efforts will integrate Joint Information Environment (JIE) efforts, incorporate UC technology advances, and standardize the framework to provide an enterprise solution in both strategic and tactical environments – available at both the desktop and mobile devices of DoD users.

3.9. In the DoD distributed testing environment, the UCCO is the primary Point of Contact (POC) for scheduling and coordination of partnering test labs.

3.10. The UC testing schedule is extremely dynamic and is updated every 2 weeks by the UCCO with new vendor products, and occasionally, vendor requested changes to the schedule. All changes to the schedule are managed by the UCCO in coordination with JITC and the UC TEC facility.

3.11. The UCR establishes standards for development of unified capability solutions. The UCR defines and identi-fies the minimum requirements and features to support the UC Reference Architecture. Additional requirements may be added by sponsors based on mission needs.

3.12. A DoD Component shall sponsor each vendor product. The DoD Component sponsors or associated vendors shall reimburse the respective Component labs for costs associated with UC testing.

3.13. The UCR defines product categories for the UC APL. A product category is a logical grouping of UC prod-ucts. The various UC products for each UC product category are identified under their appropriate section of the UC APL. UC products may be comprised of one or more components or appliances.

3.14. Vendors can submit their product to be tested against any of the UCR categories by applying to the UCCO.

Vendors submit products for testing via the APL Integrated Tracking System (APLITS) IAW the UC APL Process Guide to the UCCO.

3.15. The UCCO will process the submittal package when all required documents are received and complete. Once the submittal process is complete, an Initial Contact Meeting (ICM) is conducted to determine the assignment of an APL product type, the applicable UCR requirements, testing model determination, System Under Test (SUT) con-figuration, Cyber and IO requirements, test location, products included by similarity (when applicable), and certifi-cation document deliverables.

3.16. JITC provides DoD UC TEC Services for DISA and commercial vendor products. JITC is one of several ac-credited UC testing labs for testing and certifying DoD sponsored commercial vendor products.

3.17. JITC provides services to DISA including Cyber and IO testing for UC APL products, maintenance of the overall format and content of the UC test and certification documentation (test procedures, certification memoran-dum, letters of compliance (LOC), etc.), and the development and staffing of the IO test certification memorandums.

3.18. JITC certifies UC products rather than UC categories, components, or appliances. All components/appliances submitted as the SUT must collectively meet the UCR requirements for that product type.

TEC Services Contract Page 3 of 49 Pages Actual Task Order 2016-06-02

3.19. There are 13 product categories within the UCR sorted into two primary groups, Network Infrastructure and Voice, Video, and Data Services, which then equate to 66 product types. Currently, there are 49 of the 66 product types on the UC APL.

3.20. JITC rigorously conducts the Cyber and IO testing IAW the UCR which specifies the functional requirements, performance objectives, and technical specifications for DoD networks and operations of UC devices.

3.21. JITC follows the DoD UC APL Process Guide that outlines the process for getting UC products on the UC APL and defines the roles and responsibilities for participants within the UC APL process.

3.22. JITC maintains the UC Document Depot on the public JITC website – a central repository that includes Test Plans (UCTPs) with detailed procedures, LoC, and IO Certification Templates for UC testing.

3.23. JITC provides a very detailed and scheduled driven service to the DoD in support of UC.

3.24. All efforts within this TO will promote JITC’s mission to support the DISA UC APL process. The UC APL process is simplified below.

3.24.1. Product submitted for UC APL testing with complete documentation per the UC APL Process Guide

3.24.2. UC APL Tracking Number (TN) assigned and stakeholders notified: vendor, sponsor, test teams, DISA

3.24.3. ICM held to determine the testing center, device type, applicable requirements, business models (both testing and cost)

3.24.4. Cyber and/or IO tests are scheduled

3.24.5. Testing Set-up

3.24.6. Cyber Testing (as determined by testing model)

3.24.7. DISA CA or DoD Component Designated Approving Authority (DAAs) provide Cyber Certification

3.24.8. IO Testing (as determined by testing model)

3.24.9. JITC issues IO Certification

3.24.10. Product placed on APL

3.25. The UC products are listed in the UCR and other applicable UC documents. They are grouped by categories and then listed by type. Of significant note is that some UC products will require at least two IO testers to perform specific test procedures such as manual telephone calls. The majority of the Voice, Video and Data Services prod-ucts will require two persons to complete a subset of the detailed test procedures. It is not anticipated (typical) that two persons will be required to conduct UC Product Group – Network Infrastructure testing. Also, the length of each test event is based on the test model, the product/SUT, and any complexities.

3.26. The JITC UC Product Testing Model is defined by the submission to the UCCO. The models include Origi-nal/Initial Evaluation, Verification and Validation (V&V), and Desktop Reviews (DTRs).

3.26.1. Initial/Original Submission: This is comprised of an original, not previously tested, UC product submitted to the UCCO for UC APL testing. The process with general rules, required items, and documents is provided in the UC APL Process Guide. Products that are submitted for Initial UC Testing require both full and complete Cyber and IO testing.

3.26.2. V&V Submission: In addition to the initial product testing for Cyber and IO, there is often follow-on testing

– V&V. Testers conduct V&V in order for the product to complete the test requirements that were either not tested or had failed during the initial test timeframe. The product vendors must go through the UCCO process and request V&V to be placed on the schedule. V&V testing will also be categorized at level of complexity. V&V is conducted prior to a SUT receiving the Special Interoperability Test Certification. Closed deficiencies or findings will result in the test certification. A vendor can schedule numerous V&Vs in order to complete testing requirements.

3.26.3. DTR Submission: A DTR is for a SUT to add additional capabilities or close deficiencies or findings with additional testing after the initial Special Interoperability Test Certification was granted. For any changes and/or patches to a product that is already on the APL, and /or Plan of Actions and Milestones (POA&M) closures, a DTR application must be submitted to the UCCO.

TEC Services Contract Page 4 of 49 Pages Actual Task Order 2016-06-02

3.26.3.1. A DTR is for changes/updates to an existing APL-approved software release, not major platform changes, which would require a new submission (Initial).

3.26.3.2. DTR requests will result in an update to the APL memo when no additional testing is required; when min-imal testing as same TN identifies that test requirements and criteria are met);or when a new submission for testing results in a new TN.

3.26.3.3. JITC reviews the provided information and determines the course of action. The Government has five business days per the UC APL to evaluate a DTR and provide an answer to the UCCO. JITC must update the IO certification letter within 10 business days of the DTR approval or completion of the DTR test event.

3.27. JITC also provides support to the UC Fast-Track (FT) process which is intended to expedite new UC product types onto the UC APL, or to use existing artifacts (test results, LOCs, etc.) to aid in placing products on the UC

APL.

3.28. The FT process is structured to accommodate DoD sponsors that may need products for which they have well-established requirements, and in some cases, test results, yet these products do not appear in the UCR that is pub-lished on an annual basis. If it is agreed by the Government that new product categories and/or new products should be in the UCR, the DoD sponsors and vendors do not have to wait for the next UCR publication in order for their product to be tested and placed on the APL.

3.29. The FT process APL testing can begin based on existing requirements that will be placed in the next version of the UCR. FT Testing submissions will receive a TN and will be considered an Initial Submission (normal UC APL Process Guide and testing functions apply).

3.30. JITC Action Officers (AOs), including the COR, are the Government personnel assigned to manage, oversee, guide, and conduct UC TEC Services & Facility operations and testing.

3.31. The AO’s have two major roles within the UC process

3.31.1. Act as the UC Test Officer (UC TO) for test events assigned to them

3.31.2. Act as the JITC IO certification authority representative for tests that occur at a DoD component test lab.

3.32. The UC TO is responsible for all test and certification decisions that occur through the test lifecycle. Any “test deviations” proposed by assigned UC Task Leads (UC TLs) must be authorized by the UC TO and documented ac-cordingly. Testing deviations should be coordinated with the UC TO to ensure certification decisions are consistent with policy.

3.33. The UC TL is guided by the UC TO for conducting the UC test event IAW with the UC APL guide. Depend-ing upon the testing model, there may be combined (single lead for Cyber and IO) or separate test leads for Cyber and IO. In either case, UC TLs need knowledge of the system before the formal test process starts.

3.34. To meet the UC Process timeline, the UC TLs must be familiar with the product, its limitations, test configura-tion, and requirements, before the official start of the process.

3.35. Reporting of JITC UC testing efforts occurs during and after Cyber and IO test events. The input, output, and specific documentation are described within the task requirements section of this Statement of Work (SOW).

3.36. JITC provides the network infrastructure, operation, and maintenance of the collective internetworked JITC UC Labs at Fort Huachuca, AZ (FHU).

3.36.1. The UC TEC Facility currently consists of internet worked laboratories called the Global Information Grid (GIG) Network Test Facility (GNTF), located in two areas on the JITC FHU compound: Room 156 (inside 1st Floor TEMPEST) Building 57305, commonly referred to as the “GNTF"; and, the west end of Building 57439B, com-monly referred to as the “GNTF Annex”.

3.36.2. The equipment in the UC TEC Facility is permanently internetworked with: Defense Red Switch Network test-bed equipment which is co-located with the main GNTF, DISN Video Teleconference Test Facility equipment which is co-located with equipment in the GNTF Annex, re-locatable voice switching and internet protocol network-ing equipment located in trailers parked inside the JITC compound, and equipment located off the JITC compound which is networked within the UC TEC Facility test enclave zone, including equipment located in the DISA owned and operated Network Engineering Assessment Facility (NEAF) at DISA Headquarters, Fort George G. Meade, MD

(FGGM).

TEC Services Contract Page 5 of 49 Pages Actual Task Order 2016-06-02

3.36.3. The UC TEC Facility is comprised of equipment from multiple major network manufacturers which repre-sent the DISN, DoD UC converged voice, video, and data internet protocol products. The UC TEC Facility pro-vides support to DoD components and commands worldwide via the JITC Warfighter HOTLINE support system.

3.36.4. There are many support functions needed to maintain the viability of the UC TEC Facility defined in this task. Presently the network includes Juniper routers, Cisco routers, Brocade/Foundry Assured Services; ACME Packets Edge Boundary Controller; Avaya Multifunction Softswitch (MFSS); Juniper, Dell, Brocade Local Area Network (ASLAN) switches; Local Session Controller (LSC), REDCOM LSC, Cisco LSC switches; and 3COM ASLAN equipment. These components represent most of the major vendor items.

3.36.5. The network is not fixed, it changes normally every week and occasionally on a daily basis due to frequent departing and arriving of vendors for test activities.

3.36.6. The UC TEC Facility has a managed connection to the Non-Secure Internet Protocol Router Network (NIPRNET) for the purpose of downloading necessary patches or updates, and so that systems under test may re-quest and receive Online Certificate Status Protocol (OCSP) responses from the test OCSP responder accessible via the NIPRNET and physically located elsewhere on the JITC compound. A specially controlled, contractor operated, DISN multi-function switch is also connected to the Public Switched Telephone Network.

3.36.7. Equipment managed within the UC TEC Facility areas regularly connect to equipment located elsewhere in support of exercises. All external connections are strictly controlled by members of the JITC Cybersecurity work-force, including contractors who will execute duties under this task.

3.37. When providing support to JITC’s UC, JITC has and can face many challenges. Below provides a simplified overview of challenges that are important for the Contractor to know.

3.37.1. Dynamic Scheduling: The overall UC TEC test schedule is dynamic and can fluctuate due to many factors, including but not limited to, the vendor of the product is not prepared for test, the product equipment is incomplete, the product has significantly failed Cyber testing and therefore IO testing is cancelled, the funding to test is not cur-rently available, or the test timeframe is inadequate time to complete the test due to either technical limitations of the product or discrepancies found during test.

3.37.2. Emerging Technologies: Due to the speed of emerging and new technologies, the facility has difficulty in-corporating the latest and most suitable advanced technology to assist in meeting TEC missions. For example, there are current test limitations due to being unable to create the 100GB environment to fully and successfully test a product such as an Assured Services (AS) Local Access Network (LAN) (ASLAN).

3.37.3. Evolving UC Categories & Types: Again, due to the speed of emerging and new technologies, DISA and UC are always in a state of updating hardware, software, requirements, and criteria to meet continuously changing DoD mission requirements. For example, over the last few years, product categories and types have evolved to meet IT requirements such as centralizing the infrastructure of the Session Controllers (SC) (Session Border Controller (SBC), LSC, and Enterprise Session Controller (ESC)) into an Enterprise Services Area (ESA).

3.37.4. Network Configuration Management/Transformative Environment: One of the biggest challenges that can occur daily is the programming and installation of network and test equipment and SUTs. Due to the fluid nature of the lab and the constant changes required, such as daily in and out products and maintaining the baseline network, there are constant challenges to the facility operations and maintenance (O&M) that directly impact the Govern-ment, management, testers, customers, and vendors. The SUTs set-up and configuration requirements can be com-plex and have a tendency to trickle throughout the network environment, causing difficulties and problems within the network that may influence other tests ongoing or upcoming.

3.37.5. SUT Product Setup: Some larger solutions submitted for testing rely on sub-devices to operate properly.

For example, a Voice over IP (VoIP) solution may require a network management server, a firewall, etc., to be oper-ational in a secure manner to support and complete certification testing. Any additional devices and specifications outside of the main solution need to be described in the auxiliary components section of the test submittal package.

Also, setup must include expectations that vendors should not have to wait for their products to be installed into racks with sufficient power and connections, etc., and testing must adhere to the schedule.

3.38. Within the last 3 years, there were a total of 875 UC evaluations resulting in 480 products being placed on the APL. As an example of JITC workload in Fiscal Year (FY) 2015, 115 DTRs were submitted to be worked at JITC, Fort Huachuca, AZ. These DTRs resulted in 37 full Cyber and IOP tests, 12 Cyber-only tests, 8 IO-only tests, and

TEC Services Contract Page 6 of 49 Pages Actual Task Order 2016-06-02

58 products that required no testing. Also submitted were 31 Initial submissions requiring both Cyber and IO test-ing. The total number of products posted to the APL in FY2015 resulting from JITC Fort Huachuca, AZ testing was 115 from DTRs and 46 from Initial submissions. In FY2014, the workload metrics captured reflect a lesser amount than FY2015. This is because (1) the metrics were not captured the same way as in FY2015 and (2) there were other factors that challenged the completion of UC tests at JITC labs. However, for historical purposes, the FY 2014 workload was 87 DTRs submitted that were evaluated at JITC Fort Huachuca, AZ of which 30 required no testing.

There were also 57 Initial submissions. The total number of products posted to the APL in FY2014 resulting from testing was 79 from DTRs and 36 from Initial submissions.

3.38.1.1. JITC FHU only tests specific product types based on current testing and technical capabilities.

3.38.1.2. JITC has conducted the following UC test events over the last two and-a-half years. This is for general information purposes only and does not indicate that the level of testing effort required will be the exact same amount in the future.

JITC UC Historical Test Efforts

Product Type Test Type Test Effort Test Length (note 1)

Test Events (note 2)

ACCESS IP SWITCH INITIAL Cyber & IO 6 1 ACCESS IP SWITCH INITIAL Cyber & IO 3 1 ACCESS IP SWITCH DTR Cyber & IO 4 5 ACCESS IP SWITCH V&V Cyber 0.5 1

ASLAN, MPLS INITIAL IO 4 1

ASLAN-A INITIAL Cyber & IO 3 2 ASLAN-A INITIAL Cyber & IO 7 6 ASLAN-A INITIAL Cyber & IO 10 2 ASLAN-A INITIAL Cyber 1.25 1

ASLAN-A INITIAL IO 4 1

ASLAN-A INITIAL IO 1.25 3

ASLAN-A V&V IO 1.5 1

ASLAN-A DTR Cyber & IO 1 1 ASLAN-A DTR Cyber & IO 3 1 ASLAN-A DTR Cyber 2 2 ASLAN-A,C,D INITIAL Cyber & IO 3 1 ASLAN-A,C,D INITIAL Cyber & IO 6 1 ASLAN-A,C,D INITIAL Cyber & IO 9 13 ASLAN-A,C,D INITIAL Cyber & IO 10 8

ASLAN-A,C,D INITIAL IO 4 1

ASLAN-A,C,D V&V Cyber & IO 4 5 ASLAN-A,C,D DTR Cyber 2 2 ASLAN-C,D INITIAL Cyber & IO 7 2

ASLAN-C,D INITIAL IO 4 2

ASLAN-C,D V&V IO 2 1

ASLAN-C,D DTR Cyber 2 2 ASLAN-D INITIAL Cyber & IO 5 1 CER INITIAL Cyber & IO 3 2 CER INITIAL Cyber & IO 5 6 CER INITIAL Cyber & IO 6 6 CER INITIAL Cyber & IO 7 4 CER INITIAL Cyber & IO 10 3

TEC Services Contract Page 7 of 49 Pages Actual Task Order 2016-06-02

Product Type Test Type Test Effort Test Length (note 1)

Test Events (note 2)

CER INITIAL IO 1.25 4

CER V&V Cyber 0.5 1 CER DTR Cyber & IO 5 1

CER DTR IO 2 1

CPE INITIAL Cyber & IO 3 2 CPE INITIAL Cyber & IO 4 5 CPE INITIAL Cyber & IO 6 4 CPE DTR Cyber & IO 3 3 CPE DTR Cyber & IO 2 1 CPE DTR Cyber 2 4 CPE DTR Cyber 1.25 2

CPE DTR IO 1.5 1

CPE, EMS INITIAL Cyber & IO 4 1

CPE, EMS DTR IO 1.25 1

DFW, VPN, IPS INITIAL Cyber 1 1

DFW, VPN, IPS INITIAL IO 3 1

DFW, VPN, IPS/IDS, EMS INITIAL IO 5 2

DFW, VPN, IPS/IDS, EMS V&V Cyber & IO 1.25 2

DFW, VPN, IPS/IDS, EMS V&V IO 1.25 2

DFW, VPN, IPS/IDS, IAT INITIAL IO 3 6

DFW, VPN, IPS/IDS, IAT, ISS, RSF INITIAL IO 3 4

DNE, FNE INITIAL Cyber & IO 4 2 DNE, FNE INITIAL Cyber & IO 7 1

DSC INITIAL IO 1 2

DSCD INITIAL Cyber & IO 5 1

DSCD INITIAL IO 2 1

DSCD DTR IO 1 2

E-911 DTR Cyber & IO 3 1 EDS GATEWAY INITIAL Cyber & IO 3 1 EI DTR Cyber 2 1 EMS INITIAL Cyber & IO 2.25 1 EMS DTR Cyber 2 1

EMS INITIAL IO 3.25 2

ESC INITIAL Cyber & IO 12 1 ESC DTR Cyber & IO 3 1 FNE INITIAL Cyber & IO 4 2 FNE INITIAL Cyber & IO 6 1 FNE INITIAL Cyber & IO 8 3

FNE INITIAL IO 3 2

FNE DTR Cyber & IO 3 2 H.323 VIDEO GW INITIAL Cyber & IO 7 1 H.323 VIDEO GW DTR Cyber 2 1 IAT INITIAL Cyber 2.5 3 IAT DTR Cyber 1.25 3 IPS & IDS INITIAL Cyber & IO 5 2

TEC Services Contract Page 8 of 49 Pages Actual Task Order 2016-06-02

Product Type Test Type Test Effort Test Length (note 1)

Test Events (note 2)

IPS & IDS DTR Cyber 1 1 LSC INITIAL Cyber & IO 6 3 LSC INITIAL Cyber & IO 8 1 LSC INITIAL Cyber & IO 10 2

LSC INITIAL IO 6 1

LSC V&V Cyber & IO 1.5 1 LSC DTR Cyber & IO 3 4 LSC DTR Cyber & IO 6 2 LSC DTR Cyber & IO 7 2

LSC, ESC V&V IO 2.5 5

LSC, ESC DTR Cyber & IO 3.5 2 LSC, ESC DTR Cyber & IO 4 4 LSC, ESC DTR Cyber & IO 6 9 LSC, SS DTR Cyber & IO 6 2 NAC DTR Cyber 2 1

PEI DTR IO 1 1

PON INITIAL Cyber & IO 7 1

PON INITIAL IO 3 1

RADIO GATEWAY INITIAL Cyber & IO 5 6 RADIO GATEWAY INITIAL Cyber & IO 6 2 SBC DTR Cyber & IO 1.25 5

SBC DTR IO 1.25 1

SOFTPHONE DTR Cyber & IO 3 1 UCCP INITIAL Cyber & IO 4 2 UCCP V&V Cyber & IO 3 1 UCCP DTR Cyber & IO 8 1 UCCS INITIAL Cyber & IO 5 3

UCCS INITIAL IO 2.25 1

UCCS V&V Cyber & IO 2 1 UCCS DTR Cyber & IO 3 2 UCCS DTR Cyber & IO 4 1 UCCS DTR Cyber 1.25 2

UCCS DTR IO 2 2

UCCS DTR IO 1.25 1

VDS INITIAL Cyber & IO 2.5 2 VDS INITIAL Cyber & IO 6 3 VDS DTR Cyber 1 1 VDS DTR Cyber 2 1 VDS DTR Cyber 4 1 VTC DTR Cyber & IO 1 1

VTC DTR IO 4 1

WAB, WLAS INITIAL Cyber & IO 4.5 1

WEI DTR IO 2 2

WIDS INITIAL Cyber & IO 4.5 1 Notes:

TEC Services Contract Page 9 of 49 Pages Actual Task Order 2016-06-02

Product Type Test Type Test Effort Test Length (note 1)

Test Events (note 2)

1. Test Length includes Set-up and Test Event and is presented in Weeks

2. This number presents the number of Test Events that were conducted.

Legend:

A Access IP Internet Protocol ASLAN Assured Services LAN IPS Intrusion Protection System C Core ISS Integrated Security Solution CER Customer Edge Router LAN Local Area Network CPE Customer Premise Equipment LSC Local Session Controller Cyber Cybersecurity MPLS Multiprotocol Label Switching D Distribution NAC Network Access Controller DFW Deployed FW PEI Proprietary IP Voice EI DNE Deployable Network Element PON Passive Optical Network DoD Department of Defense RSF RTS Stateful FW DSC Deployed Session Controller RTS Real Time Services DSCD DoD Secure Communications Device SBC Session Border Controller DTR Desktop Review SS Softswitch E911 Enhanced Emergency Service UC Unified Capabilities EDS Enterprise Directory Services UCCP UC Collaboration Product EI End Instrument UCCS UC Conference Center EMS Element Management System V&V Validation and Verification ESC Enterprise Session Controller VDS Video Distribution System FNE Fixed Network Element VPN Virtual Private Network FW Firewall VTC Video Teleconference GW Gateway WAB Wireless Access Bridge IA Information Assurance WEI Wireless EI IAT IA Tool WIDS Wireless IDS IDS Intrusion Detection System WLAS Wireless LAN Access System IO Interoperability

3.39. Historically, this task has been successfully supported using approximately 20-25 Full-time Equivalent (FTE) Contractor personnel. Over the last few years, the number of testers has fluctuated due to outside influences such as the number and types of tests that are conducted by JITC. In addition, traditionally, there are functions that are worked “part-time,” i.e., .25 or .5 FTE, by Contractor personnel who support other tasks orders within JITC for the same or similar functions, i.e., switch operators or system administrators. The following list presents historical FTE and Labor Categories (LCATs) per overall task function. This is for general information purposes only and does not indicate that the level of effort required will be exactly the same in the future.

3.39.1. Two FTE for management, technical expertise, and engineering. The most frequently identified LCATs supporting these functions historically are Program Manager (PM), Systems Analyst, Computer Scientist, Engineer, or Engineering Technician.

3.39.2. Fourteen (14) FTE technical and certified testers. Typically these have been split as 10 supporting IO and four supporting Cyber. The most frequently identified LCATs supporting these functions historically are Functional Area Analyst (FAA), Information/ Computer/ Telecommunications Specialist (ICTS), and Information Assurance Specialist.

3.39.3. Three and one-half (3.5) FTE providing specialized telecommunications systems support for Operation and Maintenance (O&M), equipment and system installation, and network and system administration. The most fre-quently identified LCATs supporting these functions historically are Engineering Technician, FAA, ICTS, Electron-ic Technician Maintenance/Cable Splicer, Network Administrator, and System Administrator.

3.39.4. Three FTE in support of administrative functions. The most frequently identified LCATs supporting these functions historically are Secretary, Technical Writer, Word Processor, and FAA.

TEC Services Contract Page 10 of 49 Pages Actual Task Order 2016-06-02

3.40. JITC is a reimbursable (RMB) fee-for-service (FFS) organization. It must meet the policies applicable to be-ing a Major Range and Test Facility Base (MRTFB). For UC APL testing, funding may be provided by PMs or service managers, sponsors, or vendors. The primary funding models in use by JITC are DISA UC core funding, DISA PM (FFS), or vendor provided funding (FFS). JITC coordinates the cost model for vendor products with the UCCO. Cost models are either FFS or UCCO (No-Cost) Cooperative Research and Development Agreement (CRADA). The UCCO CRADA applies to DISA sponsored products. Although there is no vendor funding re-quired for a UCCO CRADA test, all the vendor equipment tested under the UCCO CRADA becomes the property of the testing center.

4. Objectives.

4.1. The overall goal of this Firm Fixed Price (FFP) TO is divided into two primary task areas: UC TEC Product Test Menu and UC TEC Services & Facility Support. The first task is the actual UC Product Test Menu, presented in table format. The second task includes the subtasks and specific functions identified as the management, testing and reporting, O&M telecommunication switches/systems, network administration, systems and server administra-tion, equipment installation, maintenance, repair, test set-up, and test teardown, engineering support, and office management and administration. These task areas are in direct support of JITC’s overall UC mission.

4.2. This TO must be performed IAW the following DoD directives, instructions, guidelines, and standards:

4.2.1. DoDI 8100.04, "DoD Unified Capabilities," 9 December 2010. The purpose of this document is to establish policy, assign responsibilities, and prescribe procedures for the following: test, certification, acquisition, procure-ment, or lease, effective, efficient, and economical transport, connection, and operation of DoD networks to support UC and establish the governing policy for UC products and services supported on DoD networks. In addition, per this instruction, all networks that support UC shall use certified products on the DoD UC APL.

4.2.2. DoDI 8500.01, "Cybersecurity”, 14 March 2014. The purpose of this document is to outline the Cybersecuri-ty policy for DoD and establish a DoD Cybersecurity program to protect and defend DoD information and Infor-mation Technology (IT).

4.2.3. DoD Unified Capabilities Requirements 2013 (UCR 2013), Change 1, June 2015. The purpose of the UCR is to specify the functional requirements, performance objectives, and technical specifications for DoD networks that support UC, and shall be used to support test, certification, acquisition, connection, and operation of UC devices.

4.2.4. DoD Unified Capabilities Approved Products List (UC APL) Process Guide, version 2.3, December 2014.

The purpose of the UC APL Process Guide is to define the process for getting UC products onto the UC APL and define the roles and responsibilities for participants within the UC APL process.

4.2.5. DoD Unified Capabilities Framework 2013 (UC Framework 2013), January 2013. The purpose of the UC Framework is to describe the technical context for DoD networks that provides end-to-end (E2E) UC.

4.2.6. DoD Unified Capabilities (UC) Extensible Messaging and Presence Protocol (XMPP) 2013 (UC XMPP 2013), Change 1, June 2015. The UC XMPP 2013 defines functional requirements for XMPP for both client and server implementations. The primary objective of the UC XMPP 2013 is to create a well-defined and unambiguous set of requirements that facilitates multivendor interoperability and UC APL certification testing.

4.2.7. DoD UC Assured Services (AS) Session Initiation Protocol (SIP) 2013 (AS-SIP 2013), Change 1, June 2015.

The AS-SIP 2013 document defines the technical specifications for the UCR signaling protocol. AS-SIP is the standard signaling protocol used within the DoD information systems networks that provide E2E Assured Services.

4.2.8. DoD Unified Capabilities Master Plan (MP), August 2015. The purpose of the UC MP is to define the im-plementation strategy for converged, net-centric, IP-based enterprise UC as required by DoDI 8100.04.

4.2.9. DoD Unified Capabilities Reference Architecture (UC RA), Version 1.0, January 2013. The purpose of the DoD UC RA is to articulate and explain the DoD’s strategy for implementing converged, net-centric, IP-based en-terprise UC as required by DoDI 8100.04. The UC RA serves as a DoD Architecture Framework (DoDAF) 2.0 compliant guideline to the DoD Components in the preparation of implementation and acquisition plans for phasing in voice and video over IP services, and other UC that shall operate in converged voice, video, and/or data networks.

4.2.10. DoD UC Approved Products List Integrated Tracking System (APLITS) User Guide

4.2.11. DoDI 8510.01, "Risk Management Framework (RMF) for DoD Information Technology," 12 March 2014.

http://www.dtic.mil/whs/directives/corres/pdf/810004p.pdf

TEC Services Contract Page 11 of 49 Pages Actual Task Order 2016-06-02

4.2.12. DoDI 8570.01M, "Information Assurance Workforce Improvement Program,” 19 December 2005, incorpo-rating Change 3, 24 January 2012.

4.2.13. DoD Chief Information Officer (CIO) Build and Operate a Trusted DoD Information Network (DoDIN) chart, available at http://iac.dtic.mil/csiac/ia_policychart.html. This chart reflects the current full set of controlling authorities – cybersecurity laws, policies, regulations, and instructions that direct DoD system acquisition and De-fensive Cyber Operations (DCO).

4.2.14. CJCSI 6211.02D, "Defense Information Systems Network (DISN) Responsibilities," 24 January 2012, cur-rent as of 4 August 2015.

4.2.15. JITC UC Implementation Guide, Draft, April 2015

4.2.16. JITC’s Strategy and Policy documentation guidance including Joint Interoperability Certification templates and instructions and the JITC Guide to Test Documentation.

4.2.17. CJCSI 5705.01D, “Standardization of Military and Associated Terminology”, 10 Nov 2010 – Current as of 18 Mar 2014.

4.2.18. Joint Pub 1-02, "Department of Defense Dictionary of Military and Associated Terms”, 8 November 2010 (as Amended Through 15 December 2014.

Listed references may be updated and published at any time; therefore, the updated versions should be utilized. The references and other valuable information can be found on the websites listed:

Joint Electronic Library: http://www.dtic.mil/doctrine/ UCCO: http://www.disa.mil/network-services/UCCO APLITS: https://aplits.disa.mil/CAS/login Information Assurance Support Environment (IASE): http://iase.disa.mil/stigs/ UC Document Depot: http://jitc.fhu.disa.mil/projects/ucdepot/index.aspx JITC: http://jitc.fhu.disa.mil/index.aspx JITC System Tracking Program (STP) Tool: https://stp.fhu.disa.mil/ JITC Electronic Record Distribution (ERD) Tool: https://jitcnet.fhu.disa.mil/scripts/erd/index.aspx

5. Scope.

5.1. The Government, with oversight, guidance, and direction to the Contractor, manages the JITC UC mission, pro-cess, and the facility.

5.2. This TO requires the Contractor to schedule all resources and report on all UC TEC efforts, activities, and test status to the Government.

5.3. Contractor operational management of this TO includes managing personnel, information, documentation, net-works, and equipment resources; adhering to a dynamic schedule which is updated every two weeks; creating, up-dating, and publishing test documentation and artifacts; and conducting all aspects of Test and Evaluation (T&E) including framework and design, standardized procedures, troubleshooting, execution, data collection and analysis, and reporting, as well as applicable test process metrics.

5.4. Activities include review of all product related information (submitted through the UC APL Process), develop-ment and modifications of test plans, conducting IO and Cyber status and outbrief meetings, creating IO and Cyber outbrief minutes, documenting and updating test deficiencies, attending deficiency adjudication meetings, and creat-ing and posting of reports and certifications. The Contractor shall:

5.4.1. Support and provide Cyber and IO T&E functions including following the UC APL test process, conducting technically detailed test plans and procedures, collecting and analyzing data, documenting test planning and execu-tion, and summarizing and formally reporting on test results.

5.4.2. Support and provide specific operational and technical functions including engineering, O&M telecommuni-cations equipment, network operation, network administration, and systems and server administration.

5.4.3. Support and provide numerous administrative functions including office management, technical writing and editing, property accountability, purchasing, monitoring visitor access, and providing escort of uncleared (no securi-ty access) visitors within the secure facility. .

http://iac.dtic.mil/csiac/ia_policychart.html http://www.dtic.mil/cjcs_directives/cjcs/instructions.htm http://www.dtic.mil/cjcs_directives/cdata/unlimit/5705_01.pdf http://www.dtic.mil/cjcs_directives/cdata/unlimit/5705_01.pdf http://www.dtic.mil/cjcs_directives/cdata/unlimit/5705_01.pdf http://www.dtic.mil/doctrine/new%20pubs/jp1%2002.pdf

TEC Services Contract Page 12 of 49 Pages Actual Task Order 2016-06-02

5.5. The Contractors performing these functions must have specific technical certifications and/or authorizations from the JITC Information System Security Manager (ISSM) prior to completing any actions on equipment or with-in the network. See section 12.

5.6. This TO will utilize Contractor support and will acquire UC TEC Services via a menu model for product test-ing.

5.7. The Government will “order” a fixed-price “test” from the menu.

5.8. This is a new method of acquiring testing services tests for UC products that supports a streamlined ability to request test support in a more expedient manner while maintaining JITC’s high-level of customer service and tech-nical capabilities.

5.9. This model is based on Optional CLIN (OCLIN) support for UC products that requires UC TEC services by the Contractor.

5.10. Each UC product that requires UC APL testing will be assigned an OCLIN.

5.11. The Government will request the service via the Change Scope (CS) process referencing the OCLIN identifier/ number and providing the appropriate funding.

5.12. This menu is based on the cost for the total product test effort – the entire process (UC APL Process with JITC facility and testing costs) from initial contact with the UCCO and vendor/sponsor through posting of the product certification letter.

5.13. This TO supports reimbursable funded customers. All costs associated with the OCLIN must be charged to the appropriate OCLIN. All costs associated with the UC Facility that are not directly associated to a single custom-er (OCLIN) must be charged to the Core CLIN.

5.14. This method of using multiple funding lines will require meticulous tracking and oversight by both the Con-tractor and the Government to ensure Contractor compliance. In order to enable accurate project tracking and ac-counting for each customer’s funding, a Sub Contract Line Item Number (SLIN) will be created on the TO when funding is received from a new customer.

5.15. The test models identified within this TO that must be supported are Initial, V&V, and DTR submissions.

Other special business models that the government may apply to UC testing, and at only the discretion of JITC and approval by DISA/UCCO, are Fast-Track (FT) and Certification Extensions. These business models follow the pro-cesses similar to the test models.

5.16. Changes and updates to the UC Product Testing Menu will be provided via CS. Updates to the menu can in-clude (but are not limited to) updates to the UCR, such as a new product category/type or the required number of tests (OCLINs) in a given POP.

5.17. This TO execution will be monitored by the assigned Government Contracting Officer Representatives (COR).

A UC TO (JITC AO Test Officers) is individually assigned to each product submission and will work directly with the COR and the Contractors during execution for complete mission success.

6. Specific Tasks.

As stated in Section 4, Objectives, this TO is divided into two primary task areas: UC TEC Product Test Menu and UC TEC Services & Facility Support.

6.1. Task 1: UC TEC Product Test Menu

The UC TEC Product Test Menu contains the required UC TEC Services including the management, planning, set-up, T&E, and reporting to support JITC’s UC TEC mission IAW with the UCR and the APL Process Guide. The T&E process associated with the menu are defined in Task 2. JITC UC TEC Services support is encompassed as individual OCLINs. OCLINs may or may not be exercised by the Government. The Contractor shall:

6.1.1. Provide UC TEC Services via the UC TEC Product Test Menu. The Government will use the UC Product Test Type Menu as the means to order UC TEC Services. The menu items are based on product category and type, test model (Initial, V&V, or DTR), type testing (Cyber and/or IO), and any other pertinent information for each spe-

TEC Services Contract Page 13 of 49 Pages Actual Task Order 2016-06-02 cific product UC TEC Service requested. This Menu represents an appropriate variety of tests that can be ordered.

The Government does not anticipate ordering every menu item each year.

6.1.2. Propose a per-cost OCLIN amount for each menu item. The menu costs must be produced and account for the total product test effort – the entire process from initial contact with the customer through posting of the certification letter.

6.1.3. Ensure that costs relating to a meu ordered product test are charged to the specific OCLIN/SLIN and not the Core CLIN.

UC TEC Product Test Menu

Product Type Test Type Test Effort Test Length (note 1)

Test Events (note 2)

ACCESS IP SWITCH INITIAL Cyber & IO 6 2 ACCESS IP SWITCH INITIAL Cyber & IO 3 2 ACCESS IP SWITCH V&V Cyber 0.5 4

ACCESS IP SWITCH V&V IO 0.5 2

ACCESS IP SWITCH DTR Cyber & IO 4 6 ACCESS IP SWITCH DTR Cyber & IO 2 2 ACCESS IP SWITCH DTR Cyber 1 2

ACCESS IP SWITCH DTR IO 1 2

ACCESS IP SWITCH DTR Cyber 0.5 2

ACCESS IP SWITCH DTR IO 0.5 2

ASLAN INITIAL Cyber & IO 1.5 2 ASLAN INITIAL Cyber & IO 2 2 ASLAN INITIAL Cyber & IO 3 8 ASLAN INITIAL Cyber & IO 4 8 ASLAN INITIAL Cyber & IO 5 2 ASLAN INITIAL Cyber & IO 6 4 ASLAN INITIAL Cyber & IO 7 8 ASLAN INITIAL Cyber & IO 8 8 ASLAN INITIAL Cyber & IO 9 8 ASLAN INITIAL Cyber & IO 10 10 ASLAN V&V Cyber & IO 1 4 ASLAN V&V Cyber & IO 2 12 ASLAN V&V Cyber & IO 3 4 ASLAN V&V Cyber & IO 4 8 ASLAN V&V Cyber 05 2 ASLAN V&V Cyber 1 4 ASLAN V&V Cyber 1.5 2 ASLAN V&V Cyber 2 4

ASLAN V&V IO 05 2

ASLAN V&V IO 1 4

ASLAN V&V IO 105 2

ASLAN V&V IO 2 4

ASLAN DTR Cyber & IO 1 8 ASLAN DTR Cyber & IO 2 8 ASLAN DTR Cyber & IO 3 6 ASLAN DTR Cyber 1 10

TEC Services Contract Page 14 of 49 Pages Actual Task Order 2016-06-02

Product Type Test Type Test Effort Test Length (note 1)

Test Events (note 2)

ASLAN DTR Cyber 2 6

ASLAN DTR IO 1 8

ASLAN DTR IO 2 6

CER INITIAL Cyber & IO 3 2 CER INITIAL Cyber & IO 4 6 CER INITIAL Cyber & IO 6 6 CER INITIAL Cyber & IO 8 4 CER INITIAL Cyber & IO 10 3

CER INITIAL IO 1.25 4

CER V&V Cyber & IO 2 2 CER V&V Cyber & IO 1 2 CER V&V Cyber 0.5 2

CER V&V IO 0.5 2

CER DTR Cyber & IO 5 2 CER DTR Cyber & IO 3 2 CER DTR Cyber & IO 1 2 CER DTR Cyber 2 2 CER DTR Cyber 1 2

CER DTR IO 2 2

CER DTR IO 1 2

CPE INITIAL Cyber & IO 3 4 CPE INITIAL Cyber & IO 4 6 CPE INITIAL Cyber & IO 6 4 CPE V&V Cyber & IO 1 2 CPE V&V Cyber & IO 2 2 CPE V&V Cyber 1 2

CPE V&V IO 1 2

CPE DTR Cyber & IO 3 4 CPE DTR Cyber & IO 2 2 CPE DTR Cyber & IO 1 2 CPE DTR Cyber 2 4 CPE DTR Cyber 1.25 2

CPE DTR IO 2 2

CPE DTR IO 1.5 2

DFW, VPN, IPS INITIAL Cyber & IO 3 2 DFW, VPN, IPS INITIAL Cyber & IO 1 2 DFW, VPN, IPS V&V Cyber & IO 1 2 DFW, VPN, IPS V&V Cyber & IO 0.5 2 DFW, VPN, IPS DTR Cyber & IO 1 2 DFW, VPN, IPS DTR Cyber & IO 0.5 2 DFW, VPN, IPS/IDS, EMS INITIAL Cyber & IO 5 2 DFW, VPN, IPS/IDS, EMS INITIAL Cyber & IO 3 2 DFW, VPN, IPS/IDS, EMS V&V Cyber & IO 2 2 DFW, VPN, IPS/IDS, EMS V&V Cyber & IO 1 2 DFW, VPN, IPS/IDS, EMS DTR Cyber & IO 2 2

TEC Services Contract Page 15 of 49 Pages Actual Task Order 2016-06-02

Product Type Test Type Test Effort Test Length (note 1)

Test Events (note 2)

DFW, VPN, IPS/IDS, EMS DTR Cyber & IO 1 2 DFW, VPN, IPS/IDS, IAT INITIAL Cyber & IO 5 2 DFW, VPN, IPS/IDS, IAT INITIAL Cyber & IO 3 2 DFW, VPN, IPS/IDS, IAT V&V Cyber & IO 2 2 DFW, VPN, IPS/IDS, IAT V&V Cyber & IO 1 2 DFW, VPN, IPS/IDS, IAT DTR Cyber & IO 2 2 DFW, VPN, IPS/IDS, IAT DTR Cyber & IO 1 2 DFW, VPN, IPS/IDS, IAT, ISS, RSF INITIAL Cyber & IO 6 3 DFW, VPN, IPS/IDS, IAT, ISS, RSF INITIAL Cyber & IO 4 3 DFW, VPN, IPS/IDS, IAT, ISS, RSF V&V Cyber & IO 2 2 DFW, VPN, IPS/IDS, IAT, ISS, RSF V&V Cyber & IO 1 2 DFW, VPN, IPS/IDS, IAT, ISS, RSF DTR Cyber & IO 2 2 DFW, VPN, IPS/IDS, IAT, ISS, RSF DTR Cyber & IO 1 2 DNE, FNE INITIAL Cyber & IO 8 2 DNE, FNE INITIAL Cyber & IO 6 2 DNE, FNE INITIAL Cyber & IO 4 2 DNE, FNE V&V Cyber & IO 2 2 DNE, FNE V&V Cyber & IO 1 2 DNE, FNE V&V Cyber 1 2

DNE, FNE V&V IO 1 2

DNE, FNE DTR Cyber & IO 3 2 DNE, FNE DTR Cyber & IO 2 2 DNE, FNE DTR Cyber & IO 1 2 DNE, FNE DTR Cyber 2 2 DNE, FNE DTR Cyber 1 2

DNE, FNE DTR IO 2 2

DNE, FNE DTR IO 1 2

FNE INITIAL Cyber & IO 8 4 FNE INITIAL Cyber & IO 6 4 FNE INITIAL Cyber & IO 4 4

FNE INITIAL IO 2 4

FNE V&V Cyber & IO 2 2 FNE V&V Cyber & IO 1 2 FNE V&V Cyber 1 2

FNE V&V IO 1 2

FNE DTR Cyber & IO 3 2 FNE DTR Cyber & IO 2 2 FNE DTR Cyber & IO 1 2 FNE DTR Cyber 2 2 FNE DTR Cyber 1 2

FNE DTR IO 2 2

FNE DTR IO 1 2

DSC INITIAL Cyber & IO 1.5 2

DSC INITIAL IO 1 2

DSC V&V Cyber 0.5 2

TEC Services Contract Page 16 of 49 Pages Actual Task Order 2016-06-02

Product Type Test Type Test Effort Test Length (note 1)

Test Events (note 2)

DSC V&V IO 1 2

DSC DTR Cyber 0.5 2

DSC DTR IO 1 2

DSCD INITIAL Cyber & IO 5 2 DSCD INITIAL Cyber & IO 3 2 DSCD INITIAL Cyber & IO 1 2 DSCD V&V Cyber & IO 2 2 DSCD V&V Cyber 0.5 2

DSCD V&V IO 1 2

DSCD DTR Cyber & IO 2 2 DSCD DTR Cyber 0.5 2

DSCD DTR IO 1 2

E-911 INITIAL Cyber & IO 3 2 E-911 INITIAL Cyber & IO 2 2 E-911 V&V Cyber & IO 2 2 E-911 V&V Cyber 1 2

E-911 V&V IO 1 2

E-911 DTR Cyber & IO 3 2 E-911 DTR Cyber 1 2

E-911 DTR IO 1 2

EDS GATEWAY INITIAL Cyber & IO 3 2 EDS GATEWAY INITIAL Cyber & IO 2 2 EDS GATEWAY V&V Cyber & IO 2 2 EDS GATEWAY V&V Cyber 1 2

EDS GATEWAY V&V IO 1 2

EDS GATEWAY DTR Cyber & IO 3 2 EDS GATEWAY DTR Cyber 1 2

EDS GATEWAY DTR IO 1 2

EI INITIAL Cyber & IO 3 2 EI INITIAL Cyber & IO 2 2 EI V&V Cyber & IO 2 2 EI V&V Cyber 1 2

EI V&V IO 1 2

EI DTR Cyber & IO 2 2 EI DTR Cyber 1 2

EI DTR IO 1 2

EMS INITIAL Cyber & IO 3 2 EMS INITIAL Cyber & IO 2.5 2 EMS INITIAL Cyber & IO 2 2 EMS V&V Cyber & IO 3 2 EMS V&V Cyber 2 2

EMS V&V IO 1 2

EMS DTR Cyber & IO 2 2 EMS DTR Cyber 2 2

EMS DTR IO 1 2

TEC Services Contract Page 17 of 49 Pages Actual Task Order 2016-06-02

Product Type Test Type Test Effort Test Length (note 1)

Test Events (note 2)

ESC INITIAL Cyber & IO 12 2 ESC INITIAL Cyber & IO 8 2 ESC V&V Cyber & IO 4 2 ESC V&V Cyber & IO 2 2 ESC V&V Cyber 2 2 ESC V&V Cyber 1 2

ESC V&V IO 2 2

ESC V&V IO 1 2

ESC DTR Cyber & IO 3 2 ESC DTR Cyber & IO 2 2 ESC DTR Cyber 2 2 ESC DTR Cyber 1 2

ESC DTR IO 2 2

ESC DTR IO 1 2

H.323 VIDEO GW INITIAL Cyber & IO 7 2 H.323 VIDEO GW INITIAL Cyber & IO 5 2 H.323 VIDEO GW V&V Cyber & IO 5 2 H.323 VIDEO GW V&V Cyber & IO 3 2 H.323 VIDEO GW V&V Cyber 3 2 H.323 VIDEO GW V&V Cyber 1 2

H.323 VIDEO GW V&V IO 3 2

H.323 VIDEO GW V&V IO 1 2

H.323 VIDEO GW DTR Cyber & IO 3 2 H.323 VIDEO GW DTR Cyber & IO 1 2 H.323 VIDEO GW DTR Cyber 3 2 H.323 VIDEO GW DTR Cyber 1 2

H.323 VIDEO GW DTR IO 3 2

H.323 VIDEO GW DTR IO 1 2

IAT INITIAL Cyber & IO 3 3 IAT INITIAL Cyber & IO 2 2 IAT V&V Cyber & IO 2 2 IAT V&V Cyber & IO 1 2 IAT V&V Cyber 1 2 IAT V&V Cyber 0.5 2

IAT V&V IO 1 2

IAT V&V IO 0.5 2

IAT DTR Cyber & IO 2 2 IAT DTR Cyber 1 2 IAT DTR Cyber 0.5 2

IAT DTR IO 1 2

IAT DTR IO 0.5 2

IPS & IDS INITIAL Cyber & IO 3 3 IPS & IDS INITIAL Cyber & IO 2 2 IPS & IDS V&V Cyber & IO 2 2 IPS & IDS V&V Cyber & IO 1 2

TEC Services Contract Page 18 of 49 Pages Actual Task Order 2016-06-02

Product Type Test Type Test Effort Test Length (note 1)

Test Events (note 2)

IPS & IDS V&V Cyber 1 2 IPS & IDS V&V Cyber 0.5 2

IPS & IDS V&V IO 1 2

IPS & IDS V&V IO 0.5 2

IPS & IDS DTR Cyber & IO 2 2 IPS & IDS DTR Cyber 1 2 IPS & IDS DTR Cyber 0.5 2

IPS & IDS DTR IO 1 2

IPS & IDS DTR IO 0.5 2

LSC INITIAL Cyber & IO 10 2 LSC INITIAL Cyber & IO 8 2 LSC INITIAL Cyber & IO 6 4 LSC V&V Cyber & IO 4 2 LSC V&V Cyber & IO 2 2 LSC V&V Cyber & IO 1 2 LSC V&V Cyber 2 2 LSC V&V Cyber 1 2

LSC V&V IO 2 2

LSC V&V IO 1 2

LSC DTR Cyber & IO 7 2 LSC DTR Cyber & IO 6 2 LSC DTR Cyber & IO 3 4 LSC DTR Cyber 2 2 LSC DTR Cyber 1 2

LSC DTR IO 2 2

LSC DTR IO 1 2

LSC, ESC INITIAL Cyber & IO 8 4 LSC, ESC INITIAL Cyber & IO 4 4 LSC, ESC INITIAL Cyber & IO 6 4 LSC, ESC V&V Cyber & IO 6 8 LSC, ESC V&V Cyber & IO 4 4 LSC, ESC V&V Cyber & IO 2 2 LSC, ESC V&V Cyber 3 2 LSC, ESC V&V Cyber 2 2

LSC, ESC V&V IO 3 4

LSC, ESC V&V IO 2 4

LSC, ESC DTR Cyber & IO 6 8 LSC, ESC DTR Cyber & IO 4 4 LSC, ESC DTR Cyber & IO 2 2 LSC, ESC DTR Cyber 2 2 LSC, ESC DTR Cyber 1 2

LSC, ESC DTR IO 2 2

LSC, ESC DTR IO 1 2

LSC, SS INITIAL Cyber & IO 8 4 LSC, SS INITIAL Cyber & IO 4 4

TEC Services Contract Page 19 of 49 Pages Actual Task Order 2016-06-02

Product Type Test Type Test Effort Test Length (note 1)

Test Events (note 2)

LSC, SS INITIAL Cyber & IO 6 4 LSC, SS V&V Cyber & IO 6 4 LSC, SS V&V Cyber & IO 4 2 LSC, SS V&V Cyber & IO 2 2 LSC, SS V&V Cyber 3 2 LSC, SS V&V Cyber 2 2

LSC, SS V&V IO 3 4

LSC, SS V&V IO 2 2

LSC, SS DTR Cyber & IO 6 4 LSC, SS DTR Cyber & IO 4 2 LSC, SS DTR Cyber & IO 2 2 LSC, SS DTR Cyber 2 2 LSC, SS DTR Cyber 1 2

LSC, SS DTR IO 2 2

LSC, SS DTR IO 1 2

NAC INITIAL Cyber & IO 3 2 NAC INITIAL Cyber & IO 2 2 NAC V&V Cyber & IO 2 2 NAC V&V Cyber 1.5 2

NAC V&V IO 1.5 2

NAC DTR Cyber & IO 2 2 NAC DTR Cyber 1.5 2

NAC DTR IO 1.5…