Bidders Library Ref - Red Team Cyber PWS.pdf

Defense Threat Reduction Agency (DTRA)

DoD Red Team Cyber Operations Statement of Work

March 3, 2020

1. BACKGROUND/INTRODUCTION

The Defense Threat Reduction Agency (DTRA), Nuclear Enterprise Support Directorate (NE), Mission Assurance Department (MA) performs DoD Red Team Assessments. The DoD Red Team delivers a unique assessment capability in that it emulates an independent, multidisciplinary adversary providing a true “outside looking in” perspective. Adversarial types emulated by the DoD Red Team include foreign intelligence entities, Level II Asymmetric threats, insider threats, and terrorist organizations.

In accordance with mission objectives as prescribed by the Nuclear Enterprise Support Directorate, Mission Assurance Department (NE-MA) Chief or Deputy Chief, and in coordination with the NE-MAR Chief, contractors will provide support to any NE-MA mission set. Support will be within the scope, responsibilities/tasks, qualifications, expertise, level of effort and other provisions identified in this Statement of Work.

2. APPLICABLE DOCUMENTS (and as amended)

1.1 DoDD 5105.62: Defense Threat Reduction Agency

1.2 DoDI 3000.08: Balanced Survivability Assessments

1.3 DoDD O-5100.30: DoD Command and Control

1.4 DoDD O-5100.44: Defense and National Leadership Command Capability

(DNLCC) (U)

1.5 National Military Command System Concept of Operations

1.6 DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM)

1.7 Standard Operating Procedures (SOP) 5-1, DoD Red Team, (Classified)

1.8 DoD 8570.01-M, Information Assurance Workforce Improvement Program

1.9 Joint Publication 3- 13, Information Operations

1.10 CJCSM 6510.03, Department of Defense Cyber Red Team Certification and Accreditation

3. SCOPE

The DoD Red Team performs assessments from an adversarial viewpoint and uses the full spectrum of adversarial capabilities to test and evaluate protection strategies and demonstrate the possible exploitation of identified vulnerabilities. The Red Team’s adversarial acts are limited only by restrictions of the target organization and legal, safety, and security constraints.

The Contractor shall provide adequate personnel with the requisite skills, certifications and/or licenses in order to maintain a fully operable DoD Red Team assessment program to accomplish the mission as defined in DoDI 3000.08. The DTRA DoD Red Team consists of a mix of contractor personnel and Government personnel. Each DoD Red Team project will be led by Government personnel. The Contractor is responsible for ensuring that its personnel are cleared at the TS/SCI level, ready to be in-processed at DTRA, and ready to begin to complete DTRA training as a White Cell or Red Cell team member.

4. GENERAL REQUIREMENTS

4.1 Project Management

The Contractor shall provide on-site integration, coordination and daily management and oversight of its personnel. The Contractor shall meet and coordinate with NE-MA to validate the project schedules. The Contractor shall ensure that sufficient contractor personnel and resources are provided to fully support each assessment and/or project. The Contractor shall submit deliverables in accordance with CDRLs A001-A005. These deliverables shall be the written record of the Contractor’s performance and shall accurately and adequately demonstrate how the Contractor is monitoring cost, schedule, and performance.

The Contractor shall be responsible for providing a liaison to each of NE-MA’s partner organizations and shall initiate and maintain routine correspondence with these partners. The Contractor shall provide support in all aspects of assessment operations, including tracking the status and locations of DTRA provided equipment to these external customers.

4.2 Recruitment and Retention

The Contractor shall provide names of qualified contractor personnel within 30 business days of contract award. Thereafter and as soon as practicable, the Contractor shall be ready to in-process its personnel through DTRA security in accordance with DTRA’s on-boarding procedures. Prior to removing, replacing, or diverting assigned personnel, the Contractor shall notify the COR as soon as practicable of any departures. The Contractor shall also propose a substitution as soon as practicable, but no later than 30 business days after the departure of the employee. Personnel substitutions or replacements shall be closely coordinated with the COR to ensure the personnel has all required qualifications, licenses, and/or certificates and that the personnel is eligible for access to the DTRA

SCIF.

4.2.1 When hiring personnel, the Contractor shall keep in mind that stability and continuity of the workforce are essential. The Contractor shall establish a transition plan for its personnel to ensure a seamless transition between in-coming and out-going contractor personnel. The Contractor shall also maintain a Personnel Recruitment, Retention, Replacement, and Surge Personnel plan to ensure that it remains agile and ready to meet the DoD Red Team mission requirements.

4.2.2 The Contractor shall comply with and attend all DTRA mandatory training requirements including deployment readiness training, security training, computer-based training, and quarterly and annual department training. Furthermore, the Contractor shall ensure that personnel assigned to this contract complete any and all specialized training in order to maintain professional expertise and certifications in their functional areas. The Contractor shall maintain and keep updated training records, including certifications, for all personnel assigned to this contract for the duration of the contract. Additionally, the Contractor shall identify certifications attained and schools/conferences attended to maintain required professional expertise in the Progress Report. Contractor personnel assigned to this contract will support and participate in MA Department Training as directed by the Mission Assurance Department Chief, the DoD Red Team Chief, and/or the DTRA COR.

The Contractor personnel must be ready to brief, present or collaborate on its area of expertise.

4.3 Place of Performance

The Contractor is responsible for providing services to DTRA at the Fort Belvoir, VA location or other locations as the mission requires. On Federal holidays or when DTRA is closed for business due to local or national emergencies, administrative closings, or similar Government directed closings, the Contractor is not expected to report to DTRA unless the mission requires performance. When DTRA is open for business but the DTRA facility is closed, the Contractor may conduct business offsite as directed by the DTRA COR. The Contractor will have access to the facility 24 hours a day, seven days a week but must coordinate reporting times and dates with Government personnel prior to reporting to the building outside of normal business hours. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance, except as noted in paragraph 4.2.2, of all tasks identified within this document when the Government facility is not closed for one of the above reasons.

4.4 Communication

The Contractor shall coordinate discussions, communications, and meetings with DTRA and any other stakeholders that DTRA identifies. The Contractor shall conduct regular meetings to incorporate inputs from facility users/stakeholders at priority organizations/facilities into all contract deliverables.

The Contractor is responsible for recording meeting minutes for meetings it attends and distributing the meeting minutes to the COR, except that meeting minutes are not required for any ad-hoc or informal conversations. To the fullest extent possible, the Contractor shall document overall goals of the meeting, any agreements reached and all action items. This will ensure that the Red Team goals are aligned between the Contractor and DTRA team members.

4.5 Materials, Supplies and Government Furnished Property

Contractor personnel performing work under this contract on-site will be provided with a Government workspace, a laptop, computer peripheries, Common Access Cards (CACs), DTRA e-mail accounts, access to Government file servers while off-site, and office supplies.

The Contractor shall provide all other materials, supplies, and/or equipment necessary to complete its assessments. Prior to the procurement of these items, the Contractor shall obtain the COR’s approval to ensure that DTRA does not already have the item(s) in its possession and that the costs are allowable and allocable to this contract. Any accommodations not identified in this section are the responsibility of the Contractor for their personnel.

4.5.1 The contractor personnel shall not use Government furnished equipment (GFE) for personal use. GFE may only be used by the Contractor for the execution of the tasks specified in this contract.

4.5.2 The Contractor shall submit requests for replacement of GFE to the COR for processing. Lost or stolen GFE shall be verbally reported immediately and followed up in writing within 24 hours of incident to the COR.

4.5.3 The Contractor shall submit a Master Government Property List (MGPL) IAW

CDRL A004 and the contract clauses.

4.6 Travel

The contractor personnel shall travel both CONUS and OCONUS in support of the DTRA NE- MA mission and in execution of the requirements herein. When traveling to locations designated by the Department of State as a danger/hazard pay post, the Contractor shall allocate the cost of the danger/hazard pay, consistent with the allowances provided by the Department of State, to the Travel CLIN on this contract.

4.6.1 All travel must be compliant with the Joint Travel Regulations (JTR) unless otherwise specified by the COR. The Contractor shall follow CDRL A003 for submittal/approval of all proposed and actual travel.

4.6.2 The Contractor shall at all times use reasonable efforts to pursue the most economical travel arrangements and minimize the cost of travel.

4.6.3 The Contractor shall coordinate closely with the COR to arrange travel overseas, specifically when contractor personnel are to fall under a Status of Forces Agreement (SOFA) or other host nation agreement and/or when Synchronized Pre-deployment & Operational Tracker (SPOT) requirements are triggered. The Contractor shall comply with all requirements of the SPOT clauses included in the contract in a timely manner.

4.6.4 The contractor employees shall comply with all DTRA mandatory travel reporting policies.

5. RED TEAM CYBER OPERATION AND SUPPORT

The Contractor shall provide adequate personnel with the requisite skills, certifications and/or licenses, in order to maintain a fully operable DoD Red Team cyber assessment program to accomplish the mission as defined in DoDI 3000.08. DTRA DoD Red Teams consist of a mix of contractor personnel and Government personnel. The Contractor is responsible for ensuring that its personnel are cleared at the TS//SCI level, ready to be in-processed, and ready to begin training as a program or project team member. The Contractor is responsible for the overall conduct of an assigned program and is responsible for maintaining NE-MAR’s relationship with the customer.

Phase I – Pre-Assessment Phase. In this phase, the Contractor is responsible for gaining an understanding of the mission so that it can properly define the parameters of the assessment, identify assessment objectives, prepare assessment plans, coordinate with customers and partners, and schedule overall assessment operations. The Contractor shall be responsible for conducting or participating in meetings with assessment customers and partners. The pre-assessment phase may take several weeks to complete. At the conclusion of this phase, the Contractor shall prepare a project plan to document the assessment approach. Upon approval of the project plan, the team will be ready to enter into Phase II. Travel may be required during this phase depending on location of the customer and partners. Ensuring that assessments are conducted in a legal, safe, and secure manner is the priority.

Phase II – Assessment Phase. During the assessment phase, the Contractor, in coordination with other stakeholders, shall identify and gather information, perform initial analysis, conduct on-site assessments, conduct formal analysis, and develop and conduct assessment courses of action. The Contractor shall also prepare and distribute progress reports on all actions taken during this phase.

Travel will be required during this phase.

Phase III – Post-Assessment Phase. The final briefing and report is prepared during the post-assessment phase. The Contractor shall prepare briefings and reports of all assessment activities and conduct an out brief of these products with all stakeholders in order to ensure all issues are addressed and resolved. The Contractor shall be required to provide briefings to the customer and finalize and distribute reports as required by the project plan. The Contractor shall also provide continuing technical support after an assessment to address follow up issues that may arise and assist with implementing the recommendations offered by the DTRA Red Team. Travel may be required during this phase.

In order to carry out the assessments, the Contractor shall provide Red Cell support, which is led by a Government Project Manager (GPM). The Contractor shall coordinate with the other areas of the NE-MAR and NE-MA to ensure proper execution of the activities stated within this PWS.

The Contractor is responsible for:

providing support to guide the technical and design direction for each project or assessment;

ensuring timely completion of the tasks, key deliverables, and sub-projects; and providing quality assurance of deliverables and services.

Red Cell Red Cell tasks include, but are not exclusive of:

providing technical expertise in the performance of analytic techniques and processes, research methodologies, data interpretation, adversary emulation, alternative analysis;

providing expert support, analysis, research, and advice into complex problems and processes relating to the project; and gathering information based on program objectives, identifying gaps in information gathering, analysis, and course of action development pertaining to the assessment.

5.1 RED CELL

The Red Cell is broken into two operational areas, the Close Access Cyber Team and Remote Access Cyber Team for each project. The Contractor shall provide Red Cyber Operators for the close access team and the Remote Access Cyber Team to support up to 10 Red Team projects.

Red Cyber Operator: emulates a potential adversary’s cyber reconnaissance and exploitation techniques and attack capabilities against a targeted mission, system, network, component, or capability. By acting as a realistic adversary, identifies exposed/compromised information as well as potential vulnerabilities and misconfigurations. Based on these compromises, the Red Team is able to demonstrate a loss of confidence to the targets functional and security posture forcing the target to operate in a degraded, disrupted, or denied cyber environment.

The skills and qualifications required for this position are as follows:

Possess a Bachelor's degree in a Computer Science, Computer Engineering, Electrical Engineering, or a related technical discipline. In lieu of a degree, commensurate operational experience may be substituted.

Possess IAT Level III certification and CSSP Auditor certification as defined and described in Joint Publication 3-13 Information Operations and 3-12 Cyberspace Operations, DoDI 8500.1and DoD 8570.01 and 8570.01-M, and as amended.

Possess a working knowledge of computer network architecture and network diagraming.

Possess a working knowledge of Computer Network vulnerability/compliance analysis software.

6. TRAINING

The Contractor shall comply with and attend all DTRA mandatory training requirements including deployment readiness training, security training, computer-based training, and quarterly and annual department training. Furthermore, the Contractor shall ensure that personnel assigned to this contract complete any and all specialized training in order to maintain professional expertise and certifications in functional areas. The Contractor shall maintain and keep updated training records, including certifications, for all personnel assigned to this contract for the duration of the contract. Additionally, the contractor shall identify certifications attained and schools/conferences attended to maintain required professional expertise in the Monthly Status and Progress Report. Contractor personnel assigned to this contract will support and participate in MA Department Training as directed by the Mission Assurance Department Chief and/or the DTRA COR.

7. SECURITY

The Contractor shall possess a DOD TOP SECRET clearance with an SCI caveat Facility Clearance.

Contractor employees working on this program must be U.S. citizens and will require a DOD TOP SECRET clearance with an SCI caveat granted by the Defense Security Service (DSS). Clearances must be in place prior to contract award. A Visit Authorization Letter (VAL) must be provided for each contractor employee working on this contract who will require access to any DTRA site. The VALs for collateral security clearance shall be submitted in JPAS, contain the information specified in paragraphs 6-103, 6-104 and 6-105 of the National Industrial Security Program Operating Manual (NISPOM), and be submitted to the DTRA Security Support Branch (Visitor Control). The term of the VAL shall be for the term of the contract. The Contractor shall provide proof of U.S. citizenship for all contracted employees prior to entering the DTRC. The contractor shall comply with all terms of the DD 254, the NISPOM, the DoD 5220.22-M, NATIONAL INDUSTRIAL SECURITY PROGRAM, and any revisions to that manual. The contractor shall provide all forms and information, apply for clearances, and be responsible for any expense incurred in obtaining TOP SECRET/SCI security clearances for the contractor employees.

7.1 The contractor will produce some SECRET and/or TOP SECRET documents. The contractor shall comply with all DoD requirements for marking, handling, storing and transporting classified documents, working papers, notes, media, etc. (herein referred to as documents) while in the possession of the contractor. This includes any document the contractor may generate in performance of this contract.

7.2 The contractor shall demonstrate sound and proven OPSEC practices, ensuring unclassified/sensitive information will be properly protected at all times, and abide by all DTRA OPSEC policies.

7.3 The contractor shall adhere to all facility access control policies and procedures. Contractor personnel shall wear security identification badges at all times while in DTRA facilities, as access cards and Identification Cards (IDs) are presented upon request at all entry control points. Lost or stolen IDs or badges shall be verbally reported immediately and followed up in writing within 24 hours of incident to the DTRA COR.

7.4 The contractor must be responsible for safeguarding all Government property provided for contractor use. At the end of each work period, all Government property, equipment, and materials must be secured.