J-01_-_ARC_Follow_On_-_PWS_-_23_Jul_18.pdf

HQ0147-18-R-0009

Attachment J-01 ARC

Advanced Research Center

Performance Work Statement

July 23, 2018

1.0 Introduction

The Missile Defense Agency’s (MDA) Advanced Research Center (ARC) facility is a contractor-owned General Service Administration (GSA) leased Research, Development, Test and Evaluation (RDT&E) facility designed and operated to support Ballistic Missile Defense System (BMDS) Hardware-in-the-Loop (HWIL) Ground Test (GT) and Flight Test (FT) activities. The ARC facility will be provided as Government Property (GP) to this contract. The Government is responsible to maintain the premises to the conditions of the GSA lease, and MDA/Director of Facilities Military Construction and Environmental Management (DPF) will coordinate with the ARC contractor for facility repairs, maintenance, or improvements.

The ARC is part of MDA’s designation as a Special Purpose Processing Node (SPPN), supporting special purpose functions that cannot (technically or economically) be supported by Core Data Centers (CDCs) or Installation Processing Nodes (IPNs) due to its association with mission specific infrastructure or equipment (e.g., communications and networking, manufacturing, training, education, metrology, medical, modeling & simulation, test ranges, etc.). No general purpose processing or general purpose storage can be provided by or through a SPPN. SPPNs will connect to the CDCs via IPNs. This contract includes SPPN, Unclassified Networks, and other Government Furnished Equipment components that comprises the ARC.

The Director of Test (DT)-ARC Mission is to perform network/infrastructure design, house and maintain the BMDS test assets located within the ARC, maintain Cybersecurity compliance, and perform lab asset management to realistically emulate/simulate the complex weapon systems of the BMDS in support of BMDS Ground Testing and BMDS Flight Test Risk Reduction activities. The BMDS lab assets include guided missiles and space vehicles tactical hardware and software; these systems will be expanded under this contract to include additional new sensors and tactical systems requiring ARC system design and development activities to properly integrate new programs into a complex BMDS.

Over half of all equipment housed within the ARC is comprised of tactical and modeling and simulation equipment representing BMDS elements. These HWIL Test assets include representations for the Army Navy/Transportable Radars Surveillance and Control Model 2 (AN/TPY-2), the Sea-based X-band Radar (SBX), the Cobra Dane radar, and multiple Upgraded Early Warning Radars (UEWR) with plans to expand to encompass the Long Range Discrimination Radar (LRDR) and the Medium Range Discrimination Radar -Pacific (MRDR-P) Additionally, the Integrated System Test Laboratories (ISTC) contain the various components that make up the Ground-based Midcourse Defense (GMD) weapon system representation. The ISTC Labs will undergo a redesign study under this construct as part of the implementation of Continuous Integration (CI) and Continuous Agile Testing (CAT) to improve GT throughput by distributing these assets, along with those in the PCIL, across the ARC infrastructure. A thorough knowledge of the BMDS and the interdependency of these labs is required to manage the assets.

MDA is transitioning to a new ground test concept that includes CI/CAT. The CI/CAT concept will drive a significant increase in the op-tempo for ground test resources, requiring a more effective method of resource allocation and communications at the ARC.

Continuous Integration (CI) testing consists of both Continuous Development Integration (CDI) and Continuous System Integration (CSI) testing. CDI is defined as the Early Integration between the Framework and participating Element sites. During CDI the facility shall be able to support early tactical software checkout, Framework and test case install and check-out (I&CO), 1-on-1, 1-on-Many, and standalone testing. Dedicated assets within the facility may be required to support this informal testing in addition to communication to external assets. CDI activities are intended to minimize ground test integration and execution risk and improve the efficiency of BMDS development, test, and fielding. Providing a venue for early test of BMDS Element and system capability upgrades, CDI reduces the likelihood of problem discovery during preparation for and execution of formal ground testing. Discovery of Element functional or system interoperability issues during CDI provides developers with time to correct those issues before scheduled formal testing. CDI activates will take place 3-6 months prior to formal Sprint events.

As a result of CDI objectives, the contractor will be required to develop new processes and tools to respond to changes driven by CDI to include network design and expansion as well as installation and integration of Software (SW)/Hardware (HW) updates provided by elements as a result of CDI discoveries.

During CSI, Sprint test cases will be exercised to certify the event architecture and verify test objectives as expected. CSI testing could include the following phases: Full Architecture Integration (FAI), Test Case Integration (TCI) and Event Architecture Certification (EAC).

During this testing phase the facility shall be prepared to support formal lockdown processes.

Dedicated assets within this facility may be required for testing in addition to communication to external assets. CSI testing is required prior to entering a CAT Sprint. CSI testing rigor is twenty days prior to CAT Sprint testing periods as outlined in a baselined Integrated Master Test Plan

(IMTP).

Formal CAT periods will be around six weeks in length and be focused on runs for record (RFR) execution. During this testing period all assets will be in configuration control. CAT architectures will be much larger than those in CI. Testing shall be executed out of an available Advanced Research Center Technical Execution Center(ARCTEC); dedicated assets within this facility may be required for testing in addition to communication to external assets. Testing will be managed via a Resource Management cell and this contract.

MDA has approved budget to begin design and development on the new Combined Test Center, which will be a Government owned and managed facility on Redstone Arsenal that will house the Missile Defense Data Center, the Advanced Research Center, and other related test assets.

Under this contract, the Contractor will participate in the system design activities to implement improvements that contribute to CI/CAT, asset management, and data flow across all MDA systems to be housed in the CTC.

2.0 Data Rights

The contractor shall comply with government data rights in accordance with (IAW) the Defense Federal Acquisition Regulations Supplement (DFARS), as identified below and incorporated in the contract:

All data deliverable items as currently anticipated under this effort shall be delivered by the contractor with data rights no more restrictive than Government Purpose Rights. Beyond the data deliverable items as currently anticipated under this effort, all concepts, models, hardware, software developed under this contract shall have data rights no more restrictive than Government Purpose Rights, unless asserted by the contractor and validated by the Government."

3.0 Contract and ARC Management (CLIN 0001, 1001, 2001, 3001) The Contractor shall operate and sustain ARC activities during core test hours (0800-1700 Central Time) and support during extended hours up to and including 24/7 operations as required.

Definitions:

Test Asset – A representation of the BMDS tactical weapon system or the Modeling & Simulation (M&S) needs to stimulate said representations. Test Assets may include networks that emulate components of the BMDS.

Infrastructure – All material that is not a test asset, but is required to support the ARC test mission. This may include, but is not limited to, workstations, servers, phones, routers, displays, and networks.

Facilities – The General Services Administration (GSA)-leased building and all assets that are provided as part of said lease.

Project - Any non-recurring task that has a dedicated labor effort of more than 40 hours, whether the driver is test, test asset, infrastructure, or facility related.

3.1 Program Management

(a.) The contractor shall manage and maintain program cost, schedule, performance, risk, subcontracts, vendors, test assets and associated maintenance agreements, infrastructure, and data to sustain ARC operations. The contractor shall maintain a Program Management Plan (PMP) that details the complete structure of contractor support, and aligns with industry-standard PMP templates (e.g. www.pmi.org). The PMP shall include the Contractors Work Breakdown Structure (CWBS), Personnel Qualification Standard, and Technical Training Plan. The PMP shall be approved by the Government within 30 days of contract award and subsequent updates require COR approval. The contractor shall deliver to the Government, the source code and executable/operating code for all non-commercial computer software and/or algorithms developed, in computer readable format, during this contract, and will deliver to the Government, software, algorithms associated operating manuals and documentation.

Deliverable: CDRL A001-- DI-MGMT-81797: Program Management Plan; CDRL A003 -- DI- MGMT-81808: Contractor’s Risk Management Plan; CDRL A004 -- DI-MGMT-81453B: Data Accessions List; CDRL A008—DI-ADMIN-81505: Report, Record of Meeting/Minutes; CDRL A022—DI-MGMT-81580: Contractor’s Standard Operating Procedures; CDRL A026—DI- MGMT-81334D: Contractor Work Breakdown Structure; CDRL A028—DI-MGMT-82035:

Software Resources Data Report.

(b.) The Contractor shall develop a Monthly Status Report (MSR), Contract Funds Status Report (CFSR), Common Cost Methodologies (CCM) and Cost Data Summary Report. The MSR shall include a Funds and Labor Hour Expenditure Report (FLER), Travel Status Report (TSR), Technical Training Plan Status and Monthly Manpower Report (MMR).

Deliverable: CDRL A005--DI-MGMT-80368A: Monthly Status Report; CDRL A006--DI- MGMT-81468: CDRL A016--DI-FNCL-81537: Funds and Labor Hour Expenditure Report;

CDRL A023--DI-FNCL-81537: Common Cost Methodologies (CCM); CDRL A024--DI-FNCL- 81565C: Cost Data Summary Report; CDRL A027--DI-FNCL-81992: Sustainment Functional Cost-Hour Report.

(c.) The contractor shall plan, host, and conduct Program Management Reviews (PMR) on a monthly basis. PMRs should contain the latest financial status available relevant to both labor and materials as well as any issues that need to be discussed. The contractor shall participate in working groups, weekly status meetings, and daily interactions with the Government to conduct planning for strategic, management and program support.

(d.) The contractor shall maintain a working relationship with the MDA/DT-ARC, GSA and the building owner for any facility mechanical, electrical, heating, ventilation, and air conditioning (HVAC), flooring, painting, or other facility maintenance, repair, or refresh activities. The contractor shall work with MDA/Facilities and Services (FDF) and GSA to comply with MDA facility safety, environmental and incident/emergency management guidance.

(e.) The contractor shall participate in any facility expansion or modification planning meetings that the building owner, MDA/DPF, or the GSA personnel conduct to ensure proper coordination with on-going ARC long-range planning, testing activities, security requirements, and MDA guidance.

(f.) The contractor shall maintain floor plans of the facility to reflect the location of test assets, server and workstation computers, local and wide area networks (LAN and WAN), visual equipment, emergency exits, restrooms, break rooms, secure areas, heating/air-conditioning ducts and units, power units, electrical conduits, and water pipelines.

Deliverable: Floor plans CDRL A009 – DI-MISC-81489A: Real Property Facilities As-Built Drawings.

3.2 Network Monitoring

(a.) The contractor shall monitor all ARC networks (classified and unclassified) for proper operation, throughput, quality of service, and security compliance.

(b.) The contractor shall integrate with the government customer to ensure that MDA and DoD cybersecurity policies and guidelines are followed in all aspects of network operations and system administration.

3.3 Procurement

(a.) The contractor shall manage the procurement process for Other Direct Cost (ODC) and Material for the ARC.

(b.) The contractor shall procure ODCs and Material with the COR or the PCO’s approval through a signed Request to Purchase Other Direct Costs form (attachment J-09). ODCs without an approved Request to Purchase Other Direct Costs form will not be reimbursed as an allowable cost.

(c.) The contractor shall maintain a list of spare BMDS test and evaluation lab hardware requirements, where applicable. The Contractor shall maintain a current list of software and hardware licenses with applicable expiration dates and impacts to Ground Test Activities.

Deliverable: CDRL A001-- DI-MGMT-81797: Program Management Plan;

(d.) The contractor shall develop a maintenance plan for ARC test assets and obtain/maintain SW licensing. The maintenance plan shall incorporate vendor maintenance contracts and a sparing process where feasible.

Deliverable: CDRL A001-- DI-MGMT-81797: Program Management Plan;

(e.) The contractor shall manage and operate a shipping and receiving department/Property Office that is capable of the following:

(1) Receiving or shipping, packing or unpacking, and marking as appropriate classified and unclassified documents, Materials, or ODC.

(2) Maintaining records of all items received into and distributed within the ARC

(3) Inspect and verify deliveries match ARC Purchase Orders and are operational or function as requested/orders; developing documentation and return shipment procedures that involve Government concurrence when appropriate.

(4) Maintains Property Control Records to include items’ value, and create and affix Government Property Code stickers. Maintain a photographic record of all property received

(5) Track and record property locations within the ARC using the barcode system. Tracks inventory both on and off site and performs an inventory audit quarterly.

(f.) The contractor shall evaluate, test, and integrate all software to include, but not limited to COTS (Commercial off-the-shelf), into the ARC networks through standard processes that comply with MDA security guidelines.

3.4 Quarterly Self-Assessment (Attachment J-09; CDRL A001)

The contractor shall deliver a quarterly self-assessment that addresses contract performance.

These quarterly reports are due on the 15th of the month following the end of each quarter from the beginning of the period of performance. The report shall be submitted to the PCO with a copy to the designated COR via electronic means. The report shall be in narrative format and address contract performance. All aspects of this contract to include Scope of Work requirements, contract clauses, attachments and delivered products may be measured during quarterly assessments and subsequently in Contractor Performance Assessment Reports (CPARs). The contractor’s self-assessment should not exclude any portions of the contract they believe are relevant to their performance, and all self-assessments with ratings above

“Satisfactory” must show what contract requirement was exceeded and what corresponding benefit to the government was realized in Cost, Schedule, and Performance in either this contract or another BMDS related program/contract vehicle. While this data is collected quarterly, the Contractor may, at its discretion, include this data in the Monthly Status Reports, in lieu of a separate Quarterly Self-Assessment.

Deliverable: CDRL A001-- DI-MGMT-81797: Program Management Plan;

3.5 Performance Objectives/Metrics

The Government's assessment of the contractor's performance in achieving the performance objectives contained in this PWS will utilize the standards, acceptable quality levels, and surveillance methods as described herein and in the quality assurance surveillance plan (QASP), attachment J-03.

3.6 Identification of Contractor Employees

All contract personnel attending meetings and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They shall ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

3.7 Data Accession List (DAL)

The contractor shall provide the Government team access to and the ability to download all data listed in the Data Accession List (DAL) (CDRL A004) by actively using the Integrated Digital Environment (IDE). All items posted to the IDE, including drafts of deliverables not being final versions, shall be considered delivered for purposes of the DFARS data rights clauses (and subject to the same rights asserted for final deliveries) and shall be properly marked with the correct security classification. However, these non-final versions shall not constitute acceptance for purposes of Inspection and Acceptance requirements or the DFARS data rights clauses. The DAL shall contain the list of all data generated in support of this contract. Deliveries of data, in addition to the IDE, shall be as indicated in the CDRL attachment; delivery and subsequent distribution of technical data may be in storage media other than paper, including direct electronic exchange of data between two computers. The DAL shall be updated via a delivered data item each month, provided as an attachment and concurrently with the Monthly Status and Progress Report (CDRL A005), which shows the data added each month (incremental reporting), except for the first month deliverable report, which shall be provided as a separate data item showing the current and comprehensive listing. The procedures shall provide for the identification of any portions of the data provided with restrictive legends, when appropriate.

The acceptance criteria shall be consistent with the authorized delivery format.

4.0 Network Management (CLIN 0002, 1002, 2002, 3002)

4.1 Project Management

(a.) The contractor shall maintain a comprehensive schedule of all ARC activities/projects in Microsoft Project or Microsoft Project compatible software that contains all tasks being conducted within the ARC.

Deliverable: CDRL A007—DI-MGMT-81861A: Integrated Master Schedule (IMS).

4.1.1 Schedule Management

(a.) The contractor shall maintain a fully resource loaded IMS and conduct a weekly IMS review meeting where all schedule activities are reviewed, prioritized and accepted by the government.

(b.) The contractor shall facilitate asset allocation, de-confliction, configuration management, and test event certification; and provide utilization and integration metrics. The contractor shall develop a tool for scheduling, configuration management, asset de-confliction and system availability.

Deliverable: CDRL A014-- DI-NDTI-80566A: Test Plan.

(c.) The contractor shall integrate ARC test asset schedules with the ARC Master Schedule, and resolve any conflicts between test asset requests, infrastructure needs, and facility maintenance. Test asset data shall include the hardware version, software versions, System Adjustable Parameters settings, and dependencies between test assets necessary to build executable test architectures.

4.2 Backup Management and Recovery

(a.) The contractor shall maintain ARC configuration files (ex: DE SSF Software; SN analysis on SUN 229/400 servers) in a Back-up data location for all network libraries, documentation, and files at an alternative site at a minimum 1-mile standoff distance and update the disaster recovery plan.

(b.) The contractor shall develop, deliver, implement, execute, and sustain documentation, processes and procedures for IT Contingency and Disaster Recovery (DR) IAW MDA guidance.

Deliverable: CDRL A001-- DI-MGMT-81797: Program Management Plan.

(c.) The contractor shall successfully conduct quarterly DR tests.

Deliverable: CDRL A005--DI-MGMT-80368A: Monthly Status Report.

4.3 Help Desk and Incident Management

4.3.1 Helpdesk U/C VTC and Conference Room Support

(a.) The contractor shall establish and maintain a centralized helpdesk to respond to customer problems. The contractor shall be maintain, track and report a log of the status of all incidents and/or requests.

(b.) The contractor shall provide support services to the Government technical leads to conduct briefings and demonstrations including, but not limited to, audio/visual displays, security services (entry rosters and receiving, transmitting or repackaging of classified/unclassified information); resources required to accomplish the brief or demonstration; video teleconferencing (U/C VTC).

(c.) The contractor shall manage, monitor, and schedule unclassified / classified video teleconferencing systems and phone systems needed to connect with other MDA locations for contractor and government meetings and Ground Test events to include screen and Communication Network Configuration.

(d.) The contractor shall establish procedures using the helpdesk to respond to tenant and stakeholder reported facility, hardware, software, and communications problems. The contractor shall report metrics regarding problem resolution status monthly. During the conduct of tests, the Contractor shall provide initial assessment within 30 minutes from receipt of ARC test issue. If issue is not resolved within the first 30 minutes, the contractor shall provide a status report every hour thereafter.

(e.) Help desk responses must be closed within:

(1) Normal; One regularly scheduled work day. Tickets opened on Friday would be completed on Monday.

(2) Test tickets reporting: 30 minutes. Tickets opened in support of testing require hourly status updates to the Government. Test tickets open for more than one day require a root cause analysis (RCA) report in the Monthly Status Report. Urgent, Non-Test, Network Down reporting: 4 hours

4.3.2 Incident Management

(a.) The contractor shall establish incident management procedures to identify, trace, isolate, and address all facility, software, hardware, and communications problems. The problem reporting and tracking system shall work in concert with the helpdesk.

(b.) The contractor shall report the root cause analysis of closed incidents monthly.

Deliverable: RCAs (monthly) CDRL A010—DI-MGMT-80368A: Incident Management Status Report.

4.4 Configuration Management

(a.) The contractor shall develop, implement and maintain a Configuration Management (CM) Plan for hardware and software components, disks, tapes, as well as library system configurations and facility and test asset configurations that provide: 1) configuration identification (drawings and specifications); 2) configuration control; and 3) support for reviews and audits.

Deliverable: CDRL A011-- DI-SESS-80858C: Suppliers Configuration Management Plan

(b.) The contractor shall maintain configuration records, and obtain the Governments approval for any configuration changes through the Configuration Control Board (CCB) process on all test assets and infrastructure, whether unclassified or classified.

(1) Engineering Change Requests: Required for any changes to the Technical baseline of the ARC facility, hardware-in-the-loop or other network infrastructure. All Engineering Change Requests (ECRs) require a Preliminary Design Review prior to being accepted into the CCB.

ECRs are not for day-to-day operations. The day-to-day operations are processed through the CCB via Help Desk tickets, where applicable.

(2) Software Change Requests: COTS or Government provided software changes/updates must be approved and coordinated through the CCB process. The Software Change must include a test plan, if applicable, to confirm the functionality and cybersecurity of the new software or software upgrade prior to being implemented within the ARC’s test infrastructure.

(c.) The contractor shall maintain the data for ARC test assets and operate software systems that records, reserves, and schedules ARC test assets.

4.5 SPPN Management

(a.) The contractor shall plan, implement, and operate the ARC IAW the Information Technology Infrastructure Library (ITIL) standards.

(b.) The contractor shall maintain the ARC in compliance with DoD and MDA standards for operations and security.

(c.) The Contractor shall review removable media within 48 hours of receipt. If data size exceeds the ability to review within 48 hours, the government asset management team shall be notified prior to the 48 hour timeline.

(d.) The contractor will utilize government provided software (Vandyke) for data transfer between the Development, Test and Management enclaves/system housed at the ARC.

(e.) The contractor shall provide utilization metrics on all ARC test assets to include informal testing, formal testing, integration, maintenance, and upgrade activities. Deliverable: CDRL CDRL A005--DI-MGMT-80368A: Monthly Status Report.

(f.) The contractor shall develop and implement software/hardware solutions to support performance profiles of traffic flow to predict problems before they occur. Evaluate new hardware and software technologies to better configure, instrument, and protect ARC networks.

Deliverable: CDRL A019 –-DI-MISC-80048: Scientific and Technical Reports Summary.

(g.) The contractor shall provide strategic planning and recommend approaches in designing system configurations, network configurations, software/script development, power usage, and Reliability, Availability and Maintanability (RAM) engineering support in the development of new ARC systems.

(h.) The contractor shall provide network analysis and communications engineering support to procure, monitor, maintain, enhance, secure and expand telecommunications and network systems for the ARC, including the ARC side of remote nodes, ARC based customers, or other designated sites.

(i.) The contractor shall support Communications Security (COMSEC) maintenance and engineering activities for BMDS test and evaluation networks within the ARC.

(j.) The contractor shall collaborate and coordinate with MDA, other Government agencies, and contractor organizations to plan, document, and execute network communication interfaces between ARC network infrastructure and other network infrastructures in support of the ARC operations and mission requirements.

(k.) The contractor shall manage IT infrastructure and networks comprised of commercial and tactical systems to include asset allocation and de-confliction, configuration management, and Integrated Master Schedule development, management, and execution.

(l.) The contractor shall manage network bandwidth allocation to ensure it is appropriate for testing requirements and provide systems administration. The contractor shall manage and maintain metrics monitoring the utilization and downtime for all Laboratories, HWIL, and formal ground test activities.

Deliverable: CDRL A020 Technical Report-Study/Services-DI-MISC-80508B Network Monitoring Report.

(m.) The contractor shall develop network diagrams for all ARC networks / enclaves to be compliant with the Connection Process Guide (CPG) 5.0 format, or more current guidance.

(n.) The contractor shall perform all GFE Original Equipment Manufacturer (OEM) recommended preventive maintenance (PM). PM shall be done with minimal disruption in services to the tenants and stakeholders. PM will be primarily performed outside official MDA schedule test events. The contractor shall maintain a log of all PM activities and report activities monthly.

Deliverable: CDRL A005--DI-MGMT-80368A: Monthly Status Report

4.6 Technology Refresh

(a.) The contractor shall develop an itemized Technology Refresh plan for a 5-year refresh of the IT Infrastructure to include cost and schedule requirements. This refresh plan must take into account synergies derived from the CI/CAT, Combined Test Center design and BMDS expansion activities.

Deliverable: CDRL A001-- DI-MGMT-81797: Program Management Plan.

5.0 Cybersecurity (CLIN 0003, 1003, 2003, 3003)

The ARC handles, processes, stores, receives/transmits, or participates in the decision process involving Restricted Data (RD), and Critical Nuclear Weapon Design Information (CNWDI) on a daily basis when executing the requirements of this contract. Refer to Section 9.0 “Security Requirements” for further guidance on Security Clearance requirements. The contractor shall control access to information systems within the ARC. The contractor will create, maintain and manage all BMDS test and evaluation assets and infrastructure user accounts. The contractor shall establish an account system allowing ARC tenants and stakeholders to access specified equipment. The COR shall approve requests for an account and the contractor shall establish, monitor, review, and remove accounts that are inactive, and/or rescinded by the Government.

Cybersecurity is comprised of:

• Security Technical Implementation Guides (STIGs) / Cyber Tasking Orders (CTOs) Implementation and Computer Network Defense (CND)

• Operations Security (OPSEC) Management

• Integrated Management Control Plan (IMCP).

5.1 STIG / CTO Implementation and CND

(a.) The contractor shall monitor and comply with all requisite DOD 8500 Instructions and MDA Policy Memos 68/69 for applicable STIGs. In addition, the contractor is required to respond promptly and comply with MDA CTOs.

(b.) The contractor shall perform a system wide analysis every week on all IT systems and infrastructure to identify vulnerabilities and implement risk mitigation recommendations. A Scan-Patch-Scan Weekly and Monthly is allowable between Ground Test Configurations.

Deliverable: CDRL A005--DI-MGMT-80368A: Monthly Status Report.

(c.) The contractor shall scan and monitor all networks for vulnerabilities, intrusions, and alerts. Automatically report all scan and alert information to the tier two monitoring center and centralized EPO for higher level monitoring and reporting. Work closely with the tier three monitoring staff in order to quickly resolve any and all issues associated with alerts that require investigation.

(d.) The Contractor shall safeguard and protect Controlled Unclassified Information (CUI) provided by or generated for the Government (other than public information) that transits or resides on any non-Government information technology system. Information shall be protected from unauthorized access, disclosure, incident or compromise by extending the safeguarding requirements and procedures in DFARS clause 252.204-7012, Safeguarding of Unclassified Controlled Technical Information. The NIST 800-171 security controls specified in 252.204- 7012 shall be extended to include CUI which resides on, or transits through the contractor’s (prime and all sub-contractors) unclassified information technology systems.

(e.) The Contractor shall develop and institute a training program for ARC Contractor personnel as directed by the Government IAW with DoDD 8140.01 and DoDI 8570.01-M and monitor training and certification status of all personnel with Cybersecurity responsibilities.

Deliverable: CDRL A001-- DI-MGMT-81797: Program Management Plan; CDRL A005--DI- MGMT-80368A: Monthly Status Report.

(f.) The contractor shall be responsible for the development and maintenance of security accreditation packages for the ARC Network and Infrastructure hardware, software and networks. The Contractor shall support BMDS Element Accreditation activities to include providing drawings, facilitate scans, and providing patching as necessary.

(g.) The contractor shall support all activities required to maintain MDA system/enclave Cybersecurity approvals IAW all current DoD, MDA, and DT guidance, such as but not limited to, DoD Instruction 8500.01, DoD Instruction 8510.01, MDA Policy Memo 68 and 69, Defense Federal Acquisition Regulation Supplement (DFARS), Defense Information System Agency (DISA) STIG, Information Assurance Vulnerability Assessments (IAVA), and CTOs. All

IAVA’s Complied with IAW Category; Respond to all IAVA’s within 48 hours and all CTOs within required (per CTO guidance) timeline.

(h.) The contractor shall develop Risk Management Framework (RMF) packages and artifacts necessary to maintain and achieve MDA authorization for classified and unclassified networks.

Deliverable: CDRL A012-- Technical Report-Study/Services-DI-MGMT-82001: RMF documentation.

(i.) The contractor shall develop, update, as necessary, and execute the Concept of Operations to include Cybersecurity, Information Assurance, and Risk Management Framework (RMF). Develop, plan, and execute cybersecurity requirements in accordance with NIST 800- 171 Revision 1.

5.2 Operations Security (OPSEC) Management

(a.) The contractor shall mitigate security and program risks associated with the collection and analysis of MDA information by adversaries, and actions against the MDA mission and its personnel. The contractor shall manage the Operational security for Secure Telephone Unit (STU)/Secure Terminal Equipment (STE), CNET interface and other communication devices.

(b.) The contractor shall be required to have all contractor personnel requiring unescorted access to the ARC to possess and maintain a Government certified Secret security clearance commensurate with the level of information for which they require access.

(c.) The contractor shall continually demonstrate to MDA that it is properly staffed and capable of handling, processing, and protecting classified data IAW with DoD and MDA security requirements by providing personnel to support day-to-day security operations within the MDA Advanced Research Center and associated labs operating under the Government purview to include, but not limited to receipt, processing, and distribution of data, and implementation of day-to-day security procedures to provide appropriate protection of BMDS data and information.

(d.) The contractor shall design or procure, incorporate and operate the resources required to support the necessary security requirements of the programs, projects and assets located within the ARC.

(e.) The contractor shall implement a cybersecurity program for all classified and unclassified networks that complies with DFARS clause 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting” as directed by the MDA AO (Authorization Official). All networks shall comply with applicable cybersecurity guidelines, instructions and policies per AO guidance.

(f.) The contractor shall support a broad-based capability of general Cybersecurity services protection for the MDA ARC test labs and assets to include but not limited to hardware/software products, computer systems and subsystems, network and communications resources including voice communications and audio visual systems.

(g.) The Contractor shall continually monitor 100% of all external/internal traffic and report through the Monthly Status Report the Health, Status, and Utilization of the Network(s). The

Contractor shall notify the government asset management team within 24 hours when configuration modifications are complete.

Deliverable: CDRL A020 Technical Report-Study/Services-DI-MISC-80508B Network Monitoring Report.

5.3 Information Management Control Plan (IMCP)

(a.) The Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204- 7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting” (hereafter referred to as “DFARS 7012”) requires the contractor to provide adequate security on covered contractor information systems.

(1) “Covered defense information” means unclassified controlled technical information or other information (as described in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html) that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is

i. Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract; or

ii. Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

(2) Hereafter, Covered Defense Information (CDI), CUI, Technical Data, or Operationally Critical Support information is referred to as CUI.

(3) Within five (5) business days after contract award the successful offeror shall meet with MDA to specifically identify programmatic information that will be categorized as CUI. The government intends that all CUI will be identified and categorized NLT 30 days after award.

(4) The Contracting Officer will determine final resolution of unresolved differences in the categorization of Covered Defense Information (CDI), CUI, Technical Data, Operationally Critical Support Information or other programmatic information.

(b.) Distribution and Accountability of CUI: The Contractor shall implement practices to restrict the unnecessary sharing and/or flow of CUI down the entire supply chain based on need-to-know; to include, but not limited to, minimizing the information provided on contracts/purchase orders for procurement of logistics and transportation services, systems, or critical components.

(c.) The Contractor shall develop and deliver via encrypted email or secure file transfer site at ARC_IMCP@mail.com an Information Management and Control Plan (IMCP) to its direct customer (i.e. the Government or the Contractor’s next-level up contractor). The IMCP is limited to five (5) pages (CDRL A025) that shall:

(1) Identify practices the contractor implements to restrict the unnecessary sharing and/or flow of CUI down the entire supply chain based on need-to-know, to include, but not limited http://www.archives.gov/cui/registry/category-list.html mailto:ARC_IMCP@mail.com to, minimizing the information provided on contracts/purchase orders for procurement of logistics and transportation services, systems, or critical components (see #2).

(2) Address procedures for reporting a cyber-incident as defined in DFARS 7012.

(3) Document the process by which the contractor System Security Plans (SSPs) and Plan of Action and Milestones (POAMs) are developed and maintained to protect CUI within the contractor’s/subcontractor’s unclassified information technology systems.

(4) Include a high-level summary of the Contractor’s SSP and POAM for their applicable network as Appendix A, SSP & POAM Summary, to the IMCP, to include each of the 14 NIST 800-171 control families (not at the individual control level). The SSP and POAM summary (Appendix A) are exempt from the five (5) page limitation of the IMCP.

(5) Representation from the Contractor that Paragraph 4 has been completed.

(d.) IMCP Supplier Compliance Supplement (Appendix B): If the Contractor has suppliers that receive or generate CUI in performance of the contract, the Contractor shall document and maintain on file an IMCP Supplier Compliance Supplement (“Appendix B”). The Supplement will contain the following:

(1) List the Contractor’s direct customer (i.e. the Government or the Contractor’s next-level up contractor), contract number, address and contract point of contact information.

(2) List the Contractor’s first-tier suppliers that receive or generate CUI in performance of the contract. Company Name, DUNS, Address, Contract Number. If CUI is not passed to or generated by any next-tier supplier, follow instructions 1-6 in paragraph 4.i and state NA in the “Supplier Name” field of the Supplier Compliance Supplement (Appendix B). All other fields (instructions 7-11) of the Supplier Compliance Supplement (Appendix B) should remain blank.

(3) Confirm Contractor has identified and flowed only CUI which is needed for their first-tier suppliers

(4) Confirm the 7012 clause is flowed to their first-tier suppliers

(5) Prime Contractor will include the IMCP Supplier Compliance Supplement (Appendix B) with delivery of IMCP CDRL to its direct customer (i.e. the Government).

(6) Non-Prime Contractors (within the extended supply chain) shall securely deliver the IMCP Supplier Compliance Supplement (Appendix B) via encrypted email at ARC_IMCP@mail.com directly to the Government within 1000 business days after their mailto:ARC_IMCP@mail.com subcontract is awarded. The prime contractor will confirm with MDA when their 1st Tier Subcontracts are awarded.

(7) All IMCP Supplier Compliance Supplements shall be updated semiannually at a minimum but no more than four (4) times per year.

(8) Subcontractor information delivered under paragraph 4.e or 4.f shall be marked as “Company Name – Proprietary” and will be protected accordingly.

(9) Template Instructions:

i. Submitted by: Prime or Non-Prime contractor submitting the IMCP Compliance

Supplement

ii. Subcontracted by: State the Company Name, the submitting Non-Prime is supporting under this government contract. If the Prime contractor to the government state “Prime Contractor” in this field

iii. Purpose: Identify Non-Prime contractors/Suppliers who collect, develop, receive, transmit, use or store CUI

iv. Date: Date of submission

v. Government Contract Number: List the Government Contract number you are supporting

vi. Supplier Name: List all suppliers that collect, develop, receive, transmit, use or store CUI in support of this contract.

vii. DUNS: Dun & Bradstreet number

viii. Supplier Point of Contact: Name, email and phone number from each supplier.

ix. Does the Subcontract contain DFARS 252.204-7012: Yes or no.

x. Has the supplier completed the Self-Assessment IAW NIST 800-171r: Yes or no.

xi. Does the supplier have a System Security Plan and Plan of Action and Milestones IAW NIST 800-171r: Yes or no.

Template for submission of IMCP Supplier Compliance Supplement (Appendix

B) Example

Submitted By:

Knight Industries

Subcontracted By:

Dynamic Safety Systems

Purpose:

Suppliers with

CUI

Date: 6/6/2018

Government Contract Number

Supplier Name DUNS Supplier POC (email and phone)

Subcontract contains

DFARS

252.204-

NIST 800-

171r1 Self- Assessment complete

SSP &

POAM

Complete

HQ0147-17-D-

0001 ABC Corp 12345678 lisa.smith@abc.com 202-123-4567 Y Y Y

ArCCOM 78945612 jed.jones@arccom.net

234-567-8911 Y Y Y

Vartan Inc. 45612378 tom.a.smith@vareng.com

753-519-4566 Y Y Y

Daniel

Armoring 15975312 alan.rogers@darmor.com

225-465-1788 Y Y N

(e.) Flow Down to next-tier suppliers: The successful offeror (PRIME) shall flow down their accepted IMCP procedures and requirements to their next tier suppliers and require flow down iteratively to any next tier supplier.

(f.) The Government reserves the right to request, review and/or inspect the contractor/subcontractor IMCP (including all appendices) to verify implementation of the Information Management and Control Plan and DFARS 7012. Further, the Government reserves the right to use the IMCPs to iteratively navigate through the tiered supply chain. A contractor will only have visibility to their next-tier supplier(s) IMCP’s – sections 3a-e. Government reserves the right to request delivery of the SSP and POAM from the prime contractors and any applicable Non-Prime or subcontractors included in the supply chain. All delivered data provided as part of the IMCP will be handled and classified by the government as source selection sensitive information and stored accordingly.

6.0 Test Support (CLIN 0004, 1004, 2004, 3004)

6.1 Test Asset Laboratories

(a.) The contractor shall facilitate test asset hardware and software upgrades, design and implementation.

(b.) The contractor shall develop and implement a configuration control process by which lockdown is implemented prior to a test event and rescinded following test event’s completion.

Deliverable: CDRL A013-- Technical Report-Study/Services-DI-MISC-80508B: Lockdown Procedures.

(c.) The contractor shall provide infrastructure, network design and configuration design to meet test event and training requirements and issue resolution in support of Test, Integration Management, Test Execution Center (TEC) management, Advance Training Operational Center (ATOC) training exercises.

(d.) The contractor shall perform technical analysis to identify, coordinate, and implement solutions approved by the Government to support design, development, integration, execution, and analysis of experiments, test, exercises, and demonstrations of distributive software technology, real-time algorithms, and information assurance.

6.2 Test Configuration Management

The contractor shall develop an automated system for test set-up and related configuration control activities.

6.3 TECs / CDPs

(a.) The contractor shall support Test Event Certification (TECs) process and activities as requested by the government and ensure formal certification is received prior to test execution.

(b.) The contractor shall develop Certification Data Packages (CDPs) of ARC assets in support of formal ground tests.

Deliverable: CDRL A014-- DI-NDTI-80566A: Test Plan; CDRL A015-- DI-NDTI 80809B:

Test/Inspection Reports.

6.4 Test Integration Management

(a.) The contractor shall support BMDS Integration and Development (BID) testing in the Test Execution Centers (TECs) and ARC test assets. This includes risk reduction, software checkout, keep alive runs and other non-IMTP events.

(b.) The contractor shall provide video projection engineering and support for test execution and operator control rooms requiring situational awareness and visualization during IMTP testing or BMDS test and execution element checkouts. The contractor shall configure Test Support System (TSS) equipment to allow routing of situational awareness screens to the TECs in accordance with test execution team requirements.

(c.) The contractor shall provide personnel to integrate Ground Based Midcourse (GM) defense and Sensor (SN) assets, and act as test “Conductor” for related test activities. The contractor shall provide statistics on integration runs for GM and SN assets.

6.5 Test Data Management

(a.) The contractor shall perform data collection operations for MDA test events, shall provide sufficient on-site storage to facilitate successful test execution and coordinate data collection with stakeholders to include the Missile Defense Data Center (MDDC).

(b.) The contractor shall design, develop and execute network scripts or other software solutions for data collection, storage and eventual dissemination of generated test data from the ARC to the MDDC.

7.0 Real World Events/Urgent Unknowns Task Instructions (CLIN 0005, 1005, 2005, 3005) Performance under this Task Instruction (TI) Contract CLIN will be in support of activities for “real world” events. Examples of Task Instruction type work include analysis assigned to elements from external agencies to include Warfighter Request for Analysis/Requests for Real World Events/Urgent Unknowns.

The contractor shall be required to support any real world event identified by the Government and perform by reprioritizing work and adjusting work schedules to ensure mission success.

Real world events and changes to mission requirements may require the government to relocate mission areas, as needed to support objectives.

The Government will provide TIs in accordance with Attachment J-12.

8.0 Network Design Task Instructions (CLIN 0006, 1006, 2006, 3006) Performance under this TI Contract CLIN will include research and development/Engineering activities. The Government will provide TIs in accordance with attachment J-12.

8.1 Software Development

(a.) The contractor shall be required to develop network scripts and new software tools to manage:

(1) Design, Develop and implement a solution to support CI/CAT through Rapid Reconfiguration of System Test Architectures,

(2) Design and develop automated health and status tools that are compatible with the HWIL GT environment,

(3) Design, develop and implement cost effective, automated, network Independent Verification & Validation (IV&V) processes, systems, software or hardware, to support the acceptance and integration of new BMDS design elements into the ARC infrastructure. New design elements could include additional HWIL assets, or new BMDS representation/HWIL assets such as new sensors, interceptors, and systems such as Patriot and Integrated Air and Missile Defense (IAMD).

(b.) The contractor shall comply with the DoD CIO Test and Development STIGs, guidelines and instructions.

(c.) The contractor shall provide a process by which all software development activities are commensurate with Integrated Capability Maturity Model Level-3 (CMMI L-3) and ensure all custom-developed software complies with DoD and MDA software assurance standards.

Deliverable: CDRL A013-- Technical Report-Study/Services-DI-MISC-80508B: CMMI L-3 Implementation Plan.

8.2 CI/CAT Implementation and Management

The new Continuous Integration (CI) concepts will require that ARC assets are managed in pools and rapidly allocated for simultaneous tests.

(a.) The contractor shall design, develop and prepare an Analysis of Alternatives (AoA) for Hardware and Software solutions for rapid reconfiguration to support improvements in system reconfiguration and Configuration Management necessary to support Agile Testing (Continuous Integration/Continuous Agile Testing).

Deliverable: CDRL A019--DI-MISC-80048: CI/CAT Scientific and Technical Report.

(b.) The contractor shall re-design network architecture to support increased data transmission for CI/CAT.

Deliverable: CDRL A017--DI-MISC-80508B: CI/CAT Technical Report-Study/Services.

8.3 Health and Status

The contractor shall design, develop and prepare an AoA for the implementation of automated Health and Status and Configuration Control to tactical HWIL systems that do not interfere or adversely impact the System’s ability to accurately reflect tactical…