A23_LADSS_PWS_ATTACHMENTS.pdf

LADSS PWS ATTACHMENTS

Contents

VIDEO COMPLEXITY LEVELS

Information Technology and Information Assurance Requirements ..................................................................3-5

NON-DISCLOSURE AGREEMENT………………………………………………………………………....………...…...6-7

ATTACHMENT A

VIDEO COMPLEXITY LEVELS

Factor Level I Level II Level III

Course Intention / Desired Outcomes

Introduce definitions, basic concepts, processes, regulations and roles

Present and reinforce knowledge and skills (K&S) to the point that learners can apply / demonstrate performance at a rudimentary level.

Items that present an application situation similar to ones provided in material and that require to student to apply the concepts and skills to a slightly different situation

Reinforce K&S to the point that learners can select and integrate information presented to solve problems and generate solutions into their work environment Items that present a novel and more complex situation than that presented in course material. The student is required to analyze the situation, determining where, when and how to apply the K&S presented in the courseware.

Bloom Levels Performances: recall, recognize, identify information presented

Performances: apply (at simple level), interpret, distinguish

Performances: apply (at more complex level), analyze, synthesize

Techniques Simple examples and scenarios (Definitions, diagrams and charts)

Examples and scenarios (Case studies and real-world examples, interactive or animated illustrations)

Complex demonstrations Simulations (dynamically user inputs; multimedia or text branching requiring complex programming logic)

Complexity Single-subject live-action video with narrator against a static background, using simple text-based graphics and images to reinforce learning.

Single-subject live-action video with narrator/avatars against a static background, using simple text-based or 2D graphics and images to reinforce learning.

Single-subject live-action video with narrator/Avatar against a static background, using 2D graphics and images to reinforce learning.

Animatic that include motion graphics, motion stock footage, and professional voiceover.

Live-action video featuring the potential addition of set design, multiple actors, multiple locations, 3D animation, motion capture, and other elements as needed to meet the design requirements Single-subject live-action video with narrator, complex motion graphics, green screen compositing, or travel for on-location filming (if needed)..

ATTACHMENT B

Information Technology and Information Assurance Requirements Information Technology (IT).

IT Standards

Before beginning any application or system development effort the Contractor will propose the IT Standards they intend to use for the development effort in writing to the PCO, DAU PM/COR and the DAU Director of Information Technology (IT). The DAU Director of IT will verify that any proposed application or system conforms to current or planned DAU IT standards. This is to ensure that new development aligns to DAU’s “To Be” Enterprise Architecture and validates sustainability throughout the system or application lifecycle.

Certification and Accreditation (DIACAP)

DAU must ensure that its networks meet DoD security and information assurance requirements as outlined in DoDD

8000.01 and DoDD 8500.01E, DAU Policies and Directives, as well as site-specific requirements found at individual campus host locations. As such, the Contractor shall assist government staff, as required in developing related security and information assurance certification and accreditation documentation for any systems that are developed under this contract. This is to ensure DAU continues to maintain network accreditation in accordance with DoD Instruction

8510.01 DoD’s Information Assurance Certification and Accreditation Process (DIACAP). DIACAP is the process to ensure that risk management is applied on DoD systems to maintain the information assurance posture throughout a system’s lifecycle. The Contractor shall provide input to the Government in support of required Plan of Action & Milestones (POA&M) submissions indicating identified risks to allow the Government appropriate remediation and mitigation of risks through the POA&M process.

Information Systems Security

Because of the sensitive nature of much of its data (e.g., student records), DAU must ensure that data is stored in a secure network environment. To ensure that adequate levels of protection are maintained, the Contractor may be requested to provide DAU with documentation to ensure the confidentiality, integrity, availability, accountability, restoration, authentication, non-repudiation, and protection of data. The Contractor shall work with government staff to identify, evaluate, and recommend potential security solutions to protect DAU data and network communications tied in with any proposed system development. The Contractor shall recommend measures and controls to protect systems from denial of service, unauthorized disclosure, modification of data, or destruction of information systems, system components or the information processed on them.

Where directed, the Contractor shall design and implement security and controls that will ensure appropriate role-based access, operational efficiency and effectiveness, and compliance with DAU policies and/or applicable National Institute Standards & Technology (NIST) technical standards. These efforts may include activities to design, build, test, and deliver security and controls for the non-production and production environment. (Refer to DAU Directives 303 and 304, Paragraph 6.0 Compliance and Reference Documents, Publications, and Forms.).

The Contractor shall recommend Information Security requirements in the design, operation, or upgrade of IT systems/subsystems under this contract. When necessary to accommodate changing Information Security requirements and emerging technologies, the Contractor shall propose updated or revised architecture designs for Government review and approval.

Two-factor authentication shall be used for anyone who has access to a significant number of Privacy Act data records from the Internet. Record and/or field level access controls shall be implemented on all databases. Security audit logging shall be implemented for all Privacy Act data accesses.

IT systems developers will only have access to Privacy Act data when it is required in the performance of their duties and compensating controls are in place, discussed and monitored.

Privacy Impact Assessments

Privacy Impact Assessments (PIAs) must be completed for IT systems that are new, under development, or undergoing major modifications, which impact Privacy Act data.

The Contractor/sub-Contractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93- 579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

The Contractor/sub-Contractor agrees to:

Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

The Systems of Records (SOR); and The design, development, or operation work that the Contractor/sub-Contractor is to perform

In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a SOR on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the Contractor/sub-Contractor is considered to be an employee of the agency.

“Operation of a System of Records” means performance of any of the activities associated with maintaining the SOR, including the collection, use, maintenance, and dissemination of records.

“Record” means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and contains the person’s name, or identifying number, symbol, or any other identifying particular assigned to the individual, such as a fingerprint or voiceprint, or a photograph.

“System of Records” means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

Information Assurance.

The contractor shall prepare and deliver information assurance documents as required. The contractor is responsible for correcting vulnerabilities that are identified and ensure that the game is in compliance with DoD STIGs (Security Technical Implementation Guides). The contractor shall respond to initial vulnerabilities that are reported within 3 business days, with remediation of all issues within 15 business days.

In addition to DoD STIGs compliance, the contractor shall ensure the game passes web vulnerability scans for common critical and high risk vulnerabilities.

The contractor shall prepare and deliver the following technical documents as requested by DAU IT Ops.

The required documentation includes:

Schematic diagrams

Database requirements/diagrams

Back-up and COOP documents

For software-based solutions, the contractor shall provide an IT lead point-of-contact to interact with the DAU IT Ops project lead in deploying the game engine and scenarios on the DAU servers. The contractor shall coordinate with the DAU IA team to load the entire game engine and infrastructure into DAU’s environment. The contractor shall coordinate with other contractors and the DAU team to submit documents and final deliverables, including the source files and source files inventory.

ATTACHMENT C

NON-DISCLOSURE AGREEMENT

I, (Individual Name), (hereinafter RECIPIENT), an employee of (Company Name), a Contractor providing support services to the Defense Acquisition University (DAU) and likely to have access to nonpublic information, agree to and promise the following:

WHEREAS RECIPIENT is engaged in delivering support services to DAU under (Task Order Number TBD); and

WHEREAS it is the intention of DAU to protect and prevent access to and disclosure of nonpublic information, including but not limited to Planning, Programming, Budgeting and Execution (PPBE) information, to anyone other than employees of the United States Government and others who have a need to know, unless so authorized by the Contracting Officer's Representative; and

WHEREAS DAU acknowledges that RECIPIENT will have or require access to such nonpublic information in the course of delivering the contract services; and therefore, WHEREAS RECIPIENT will be given or otherwise have access to nonpublic information while providing such services; and finally, WHEREAS "nonpublic information" includes such information as PPBE information, proprietary information (e.g., information submitted by a Contractor marked as proprietary), advance procurement information (e.g., future requirements, statements of work, and acquisition strategies), source selection information (e.g., bids before made public, source selection plans, and rankings of proposals), trade secrets and other confidential business information (e.g., confidential business information submitted by a Contractor), attorney work product, information protected by the Privacy Act (e.g., social security numbers, home addresses and telephone numbers), and other sensitive information that would not be released by DAU under the Freedom of Information Act (e.g. PPBE data);

NOW THEREFORE, RECIPIENT agrees to and promises as follows:

RECIPIENT shall not seek access to nonpublic information beyond what is required for the performance of the support services contract;

RECIPIENT will ensure that his or her status as a Contractor employee is known when seeking access to and receiving such nonpublic information from Government employees;

As to any nonpublic information to which RECIPIENT has or is given access, RECIPIENT shall not use or disclose such information for any purpose other than providing the contract support services, and will not use or disclose the information for any personal or other commercial purpose; and

If RECIPIENT becomes aware of any improper release or disclosure of such nonpublic information, RECIPIENT will advise the Contracting Officer's Representative in writing as soon as possible.

The RECIPIENT agrees to return any nonpublic information given to him or her pursuant to this agreement, including any transcriptions by RECIPIENT of nonpublic information to which RECIPIENT was given access, if not already destroyed, upon RECIPIENT leaving the contract.

RECIPIENT understands that any unauthorized use, release or disclosure of nonpublic information in violation of this Agreement will subject the RECIPIENT to administrative, civil or criminal remedies, as may be authorized by law.

SIGNATURE AND DATE

PRINTED NAME: ____________________________________________________

TITLE: _____________________________________________________________

EMPLOYER: ________________________________________________________

ATTACHMENT C