Bidders Library Ref - Red Team Ground Operations PWS.pdf

Defense Threat Reduction Agency (DTRA)

DoD Red Team Ground Operations Statement of Work

September 24, 2019

1. BACKGROUND/INTRODUCTION

The Defense Threat Reduction Agency (DTRA), Nuclear Enterprise Support Directorate (NE), Mission Assurance Department (MA) performs DoD Red Team Assessments. The DoD Red Team delivers a unique assessment capability in that it emulates an independent, multidisciplinary adversary providing a true “outside looking in” perspective. Adversarial types emulated by the DoD Red Team include foreign intelligence entities, Level II Asymmetric threats, insider threats, and terrorist organizations.

In accordance with mission objectives as prescribed by the Nuclear Enterprise Support Directorate, Mission Assurance Department (NE-MA) Chief, and in coordination with the NE- MAR Chief, contractors will provide support to any NE-MA mission set. Support will be within the scope, responsibilities/tasks, qualifications, expertise, level of effort and other provisions identified in this Statement of Work.

2. APPLICABLE DOCUMENTS (and as amended)

1.1 DoDD 5105.62: Defense Threat Reduction Agency

1.2 DoDI 3000.08: Balanced Survivability Assessments

1.3 DoDD O-5100.30: DoD Command and Control

1.4 DoDD O-5100.44: Defense and National Leadership Command Capability

(DNLCC) (U)

1.5 National Military Command System Concept of Operations

1.6 DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM)

1.7 Standard Operating Procedures (SOP) 5-1, DoD Red Team, (Classified)

1.8 DoD 8570.01-M, Information Assurance Workforce Improvement Program

1.9 Joint Publication 3- 13, Information Operations

1.10 CJCSM 6510.03, Department of Defense Cyber Red Team Certification and Accreditation

3. SCOPE

The DoD Red Team performs assessments from an adversarial viewpoint and uses the full spectrum of adversarial capabilities to test and evaluate protection strategies and demonstrate the possible exploitation of identified vulnerabilities. The Red Team’s adversarial acts are limited only by restrictions of the target organization and legal, safety, and security constraints.

The Contractor shall provide adequate personnel with the requisite skills, certifications and/or licenses in order to maintain a fully operable DoD Red Team assessment program to accomplish the mission as defined in DoDI 3000.08. The DTRA DoD Red Team consists of a mix of contractor personnel and Government personnel. Each DoD Red Team project will be led by Government personnel. The Contractor is responsible for ensuring that its personnel are cleared at the TS/SCI level, ready to be in-processed at DTRA, and ready to begin to complete DTRA training as a White Cell or Red Cell team member.

4. GENERAL REQUIREMENTS

4.1 Project Management

The Contractor shall provide on-site integration, coordination and daily management and oversight of its personnel. The Contractor shall meet and coordinate with NE-MA to validate the project schedules. The Contractor shall ensure that sufficient contractor personnel and resources are provided to fully support each assessment and/or project. The Contractor shall submit deliverables in accordance with CDRLs A001-A005. These deliverables shall be the written record of the Contractor’s performance and shall accurately and adequately demonstrate how the Contractor is monitoring cost, schedule, and performance.

The Contractor shall be responsible for providing a liaison to each of DTRA’s external customers and shall initiate and maintain routine correspondence with these external customers. The Contractor shall provide support in all aspects of assessment operations, including tracking the status and locations of DTRA provided equipment to these external customers.

4.2 Recruitment and Retention

The Contractor shall provide names of qualified contractor personnel within 30 business days of contract award. Thereafter and as soon as practicable, the Contractor shall be ready to in-process its personnel through DTRA security in accordance with DTRA’s on-boarding procedures. Prior to removing, replacing, or diverting assigned key personnel, the Contractor shall notify the COR as soon as practicable of any departures. The Contractor shall also propose a substitution as soon as practicable, but no later than 30 business days after the departing of the employee. Personnel substitutions or replacements shall be closely coordinated with the COR to ensure the personnel has all required qualifications, licenses, and/or certificates and that the personnel is eligible for access to the DTRA SCIF.

4.2.1 When hiring personnel, the Contractor shall keep in mind that stability and continuity of the workforce are essential. The Contractor shall establish a transition plan for its personnel to ensure a seamless transition between in-coming and out-going contractor personnel. The Contractor shall also maintain a Personnel Recruitment, Retention, Replacement, and Surge Personnel plan to ensure that it remains agile and ready to meet the DoD Red Team mission requirements.

4.2.2 The Contractor shall comply with and attend all DTRA mandatory training requirements including deployment readiness training, security training, computer-based training, and quarterly and annual department training. Furthermore, the Contractor shall ensure that personnel assigned to this contract complete any and all specialized training in order to maintain professional expertise and certifications in their functional areas. The Contractor shall maintain and keep updated training records, including certifications, for all personnel assigned to this contract for the duration of the contract. Additionally, the Contractor shall identify certifications attained and schools/conferences attended to maintain required professional expertise in the Progress Report. Contractor personnel assigned to this contract will support and participate in MA Department Training as directed by the Mission Assurance Department Chief, the DoD Red Team Chief, and/or the DTRA COR.

The Contractor personnel must be ready to brief, present or collaborate on its area of expertise.

4.3 Place of Performance

The Contractor is responsible for providing services to DTRA at the Fort Belvoir, VA location or other locations as the mission requires. On Federal holidays or when DTRA is closed for business due to local or national emergencies, administrative closings, or similar Government directed closings, the Contractor is not expected to report to DTRA unless the mission requires performance. When DTRA is open for business but the DTRA facility is closed, the Contractor may conduct business offsite as directed by the DTRA COR. The Contractor will have access to the facility 24 hours a day, seven days a week but must coordinate reporting times and dates with Government personnel prior to reporting to the building outside of normal business hours. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance, except as noted in paragraph 4.2.2, of all tasks identified within this document when the Government facility is not closed for one of the above reasons.

4.4 Communication

The Contractor shall coordinate discussions, communications, and meetings with DTRA and any other stakeholders that DTRA identifies. The Contractor shall conduct regular meetings to incorporate inputs from facility users/stakeholders at priority organizations/facilities into all contract deliverables.

The Contractor is responsible for recording meeting minutes for meetings it attends and distributing the meeting minutes to the COR, except that meeting minutes are not required for any ad-hoc or informal conversations. To the fullest extent possible, the Contractor shall document overall goals of the meeting, any agreements reached and all action items. This will ensure that the Red Team goals are aligned between the Contractor and DTRA team members.

4.5 Materials, Supplies and Government Furnished Property

Contractor personnel performing work under this contract on-site will be provided with a Government workspace, a laptop, computer peripheries, Common Access Cards (CACs), DTRA e-mail accounts, access to Government file servers while off-site, and office supplies.

The Contractor shall provide all other materials, supplies, and/or equipment necessary to complete its assessments. Prior to the procurement of these items, the Contractor shall obtain the COR’s approval to ensure that DTRA does not already have the item(s) in its possession and that the costs are allowable and allocable to this contract. Any accommodations not identified in this section are the responsibility of the Contractor for their personnel.

4.5.1 The contractor personnel shall not use Government furnished equipment (GFE) for personal use. GFE may only be used by the Contractor for the execution of the tasks specified in this contract.

4.5.2 The Contractor shall submit requests for replacement of GFE to the COR for processing. Lost or stolen GFE shall be verbally reported immediately and followed up in writing within 24 hours of incident to the COR.

4.5.3 The Contractor shall submit a Master Government Property List (MGPL) IAW

CDRL A004 and the contract clauses.

4.6 Travel

The contractor personnel shall travel both CONUS and OCONUS in support of the DTRA NE- MA mission and in execution of the requirements herein. When traveling to locations designated by the Department of State as a danger/hazard pay post, the Contractor shall allocate the cost of the danger/hazard pay, consistent with the allowances provided by the Department of State, to the Travel CLIN on this contract.

4.6.1 All travel must be compliant with the Joint Travel Regulations (JTR) unless otherwise specified by the COR. The Contractor shall follow CDRL A003 for submittal/approval of all proposed and actual travel.

4.6.2 The Contractor shall at all times use reasonable efforts to pursue the most economical travel arrangements and minimize the cost of travel.

4.6.3 The Contractor shall coordinate closely with the COR to arrange travel overseas, specifically when contractor personnel are to fall under a Status of Forces Agreement (SOFA) or other host nation agreement and/or when Synchronized Pre-deployment & Operational Tracker (SPOT) requirements are triggered. The Contractor shall comply with all requirements of the SPOT clauses included in the contract in a timely manner.

4.6.4 The contractor employees shall comply with all DTRA mandatory travel reporting policies.

5. SPECIFIC OPERATIONS REQUIREMENTS

The Contractor shall perform emulative DoD Red Team assessments using a phased approach.

Phase I – Pre-Assessment Phase. In this phase, the Contractor is responsible for gaining an understanding of the mission so that it can properly define the parameters of the assessment, identify assessment objectives, prepare assessment plans, coordinate with customers and partners, and schedule overall assessment operations. The Contractor shall be responsible for conducting or participating in meetings with assessment customers and partners. The pre-assessment phase may take several weeks to complete. At the conclusion of this phase, the Contractor shall prepare a project plan to document the assessment approach. Upon approval of the project plan, the team will be ready to enter into Phase II. Travel may be required during this phase depending on location of the customer and partners. Ensuring that assessments are conducted in a legal, safe, and secure manner is the priority.

Phase II – Assessment Phase. During the assessment phase, the Contractor, in coordination with other stakeholders, shall identify and gather information, perform initial analysis, conduct on-site assessments, conduct formal analysis, and develop and conduct assessment courses of action. The Contractor shall also prepare and distribute progress reports on all actions taken during this phase.

Travel will be required during this phase.

Phase III – Post-Assessment Phase. The final briefing and report is prepared during the post-assessment phase. The Contractor shall prepare briefings and reports of all assessment activities and conduct an out brief of these products with all stakeholders in order to ensure all issues are addressed and resolved. The Contractor shall be required to provide briefings to the customer and finalize and distribute reports as required by the project plan. The Contractor shall also provide continuing technical support after an assessment to address follow up issues that may arise and assist with implementing the recommendations offered by the DTRA Red Team. Travel may be required during this phase.

In order to carry out the assessments, the Contractor shall provide White Cell and Red Cell support. The Contractor may be required to provide management for cyber operations in addition to the tasks listed below. Each cell is led by a Government Project Manager (GPM). The Contractor is responsible for:

providing support to guide the technical and design direction for each project or assessment;

ensuring timely completion of the tasks, key deliverables, and sub-projects; and providing quality assurance of deliverables and services.

The Contractor shall provide analysts with specialized knowledge, skills, and/or experience as a(n):

All Source Analyst, Information Operations/Counterintelligence Analyst, Geo-Spatial Analyst, Threat/Target Analysis, Insider Threat Analyst, Financial/Contracting/Business Analyst, Freedom of Information Act/Declassified Document Researcher, Supply Chain/Logistics Analyst, Nuclear Surety Analyst. Other appropriate areas of expertise may be requested in execution of this contract.

5.1 White Cell

For White Cell operations, the Contractor shall support the GPM by coordinating resources across all projects and partner organizations to ensure the NE-MAR Division’s program goals and requirements are met. This support includes goal management and tracking work progress and status.

5.2 Red Cell

Red Cell tasks include, but are not exclusive of:

providing technical expertise in the performance of analytic techniques and processes, research methodologies, data interpretation, adversary emulation, alternative analysis;

providing expert support, analysis, research, and advice into complex problems and processes relating to the project; and gathering information based on program objectives, identifying gaps in information gathering, analysis, and course of action development pertaining to the assessment.

6. SECURITY

The Contractor shall possess a DOD TOP SECRET clearance with an SCI caveat Facility Clearance.

Contractor employees working on this program must be U.S. citizens and will require a DOD TOP SECRET clearance with an SCI caveat granted by the Defense Security Service (DSS). Clearances must be in place prior to contract award. A Visit Authorization Letter (VAL) must be provided for each contractor employee working on this contract who will require access to any DTRA site. The VALs for collateral security clearance shall be submitted in JPAS, contain the information specified in paragraphs 6-103, 6-104 and 6-105 of the National Industrial Security Program Operating Manual (NISPOM), and be submitted to the DTRA Security Support Branch (Visitor Control). The term of the

VAL shall be for the term of the contract. The Contractor shall provide proof of U.S. citizenship for all contracted employees prior to entering the DTRC. The Contractor shall comply with all terms of the DD 254, the NISPOM, the DoD 5220.22-M, NATIONAL INDUSTRIAL SECURITY PROGRAM, and any revisions to that manual. The Contractor shall provide all forms and information, apply for clearances, and be responsible for any expense incurred in obtaining TOP SECRET/SCI security clearances for the contractor employees.

The Contractor will produce some SECRET and/or TOP SECRET documents. The Contractor shall comply with all DoD requirements for marking, handling, storing and transporting classified documents, working papers, notes, media, etc. (herein referred to as documents) while in the possession of the Contractor. This includes any document the Contractor may generate in performance of this contract.

The Contractor shall demonstrate sound and proven OPSEC practices, ensuring unclassified/sensitive information will be properly protected at all times, and abide by all DTRA OPSEC policies.

The Contractor shall adhere to all facility access control policies and procedures. Contractor personnel shall wear security identification badges at all times while in DTRA facilities, as access cards and Identification Cards (IDs) are presented upon request at all entry control points. Lost or stolen IDs or badges shall be verbally reported immediately and followed up in writing within 24 hours of incident to the DTRA COR.

The Contractor shall be responsible for safeguarding all Government property provided for contractor use. At the end of each work period, all Government property, equipment, and materials must be secured.

7. PERFORMANCE REQUIREMENTS SUMMARY

The contractor service requirements specified above are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success. Contractor service requirements, performance metrics, and remediation plans are provided below.

PWS

Section

Performance Objective

Performance Threshold

Method of Surveillance

Incentive/Disincentive

Section 4 Perform all tasks specified in Section 4 without interruption and in accordance with DTRA DoD Red Team SOPs.

Tasks and deliverables are completed and submitted in accordance with DTRA –DoD Red Team SOPs & CDRLS 100% of the time with accurate and complete information.

100% review and inspection of documents submitted, and daily surveillance of performance.

If Contractor meets or exceeds the performance threshold, it will:

(i) Contribute to a positive Schedule rating in CPARS.

(ii) Increase likelihood of option exercise.

If Contractor does not meet contract performance, remedies at FAR Clause 52.246-4 will be pursued, and/or likelihood of option exercise will be decreased.

Section 4 Provide sufficient personnel to perform all tasks specified in Section 4 without interruption.

Replace any departing personnel within 45 days.

Onsite surveillance.