Attach_1_AMP_Inc_V_IDIQ_PWS_22_Jun_17.pdf

HTC71117RD001

Attachment 1

CONTRACT LEVEL PERFORMANCE WORK STATEMENT

ANALYSIS OF MOBILITY PLATFORM

22 June 2017

1.0 DESCRIPTION OF SERVICES

1.1 Background.

The Analysis of Mobility Platform (AMP) is a comprehensive transportation modeling, simulation, and optimization environment used to analyze and assess the movement of military-related cargo and personnel within the Defense Transportation System (DTS).

Primary AMP users include analysts at the United States Transportation Command

(USTRANSCOM) Joint Distribution Process Analysis Center (JDPAC), Military Surface

Deployment and Distribution Command Transportation Engineering Agency (SDDCTEA), Air Mobility Command (AMC) A9, Joint Staff J4 and J8, Office of the Secretary of Defense

(OSD) Cost Assessment and Program Evaluation (CAPE), Headquarters, Air Force (HAF)

A9, and the Center for Army Analysis (CAA). JDPAC is the functional manager for AMP.

AMP provides a comprehensive representation of end-to-end deployment and distribution, to include movement by all transportation modes within the continental United States (CONUS), inter-theater (strategic), within theater, and combinations thereof.

AMP includes quick-look tools for assessing air and seaport enabler requirements and port throughput, as well as highly detailed simulation tools for airport, seaport, and distribution nodal modeling:

- Airport Rapid Analysis Tool (ARAT)

- Airport Throughput Tool (ATT)

- Airport Simulation Tool (AST)

- Seaport Rapid Analysis Tool (SRAT)

- Seaport Throughput Tool (STT)

- Seaport Simulation Tool (SST)

- Distribution Performance Nodal Model (DPNM)

The AMP suite also includes the Rapid Course of Action (COA) Analysis Tool (RCAT) for rapidly developing and accessing transportation COAs, as well as the Joint Mobility Closure

Estimator (JMCE), a formula-based, rough order of magnitude (ROM) deployment estimator application.

AMP supports answering force closure, infrastructure, lift asset, process, and policy analysis questions. Analysts use AMP to support a variety of use cases, to include programmatic analysis, deliberate planning, crisis action planning, operational planning, exercises, and war games. AMP has served as the Department of Defense’s (DOD’s) model of record for OSD-level major mobility programmatic studies since 1995. AMP Theater modeling capability is the long-standing program of record for theater Reception, Staging, Onward Movement, and

Integration (RSO&I) analysis. JDPAC has conducted multiple Research, Development, Test, and Evaluation (RDT&E) projects within the AMP program to infuse mathematical optimization technology within the core AMP discrete event simulation environment, resulting in capabilities to enable AMP to optimally allocate and schedule air assets to movement requirements and to optimally make mode and node determination decisions.

Analysts can yield solutions which drive effectiveness (velocity), efficiency (least cost), or best value combinations while also accommodating asset readiness constraints.

AMP provides aerial refueling modeling capabilities and JDPAC has leveraged RDT&E to significantly enhance these capabilities to address such modeling and analysis requirements as track switching, tanker-to-tanker refueling, disruptive events, tanker CONOPS/schedule repair, large-scale campaign scenarios, and AR receiver demand modeling.

AMP has numerous features, all of which have been incorporated to address user requirements. Following is a short subset of these features:

- End-to-end deployment and distribution modeling environment, accommodating deployment/re-deployment and sustainment/retrograde operations of military cargo and personnel over the DTS

- Joint Operation Planning and Execution System (JOPES) time-phased force deployment data (TPFDD) movement requirements

- Extensive, detailed, geospatial representation of multi-modal transportation networks and nodes

- Extensive, detailed representation of organic and commercial lift assets

- Integrated strategic and theater airlift and sealift; channel/Special Assigned Airlift

Missions (SAAM), Voluntary Intermodal Sealift Agreement (VISA)

- Integrated origin-to-destination planners and schedulers

- End-to-end and nodal discrete event simulation (DES)

- Heuristics-based mode and node determination/optimization

- Virtual Requirement Line Number (RLN) unit integrity modeling

- Schedule Optimization (i.e., Mixed Integer Programming (MIP) and Linear

Programming (LP) mathematical optimization integrated within DES) and Stochastic

Simulation in support of operational airlift, providing effectiveness/efficiency objective trade-offs and plan robustness

- Network Optimization (i.e., Mixed Integer Programming (MIP) and Linear

Programming (LP) mathematical optimization integrated within DES) in support of strategic mode/node/transshipment determination to provide effectiveness/efficiency objective trade-offs

- Air/Sea trade-offs, multi-modal operations

- Dynamic, multi-echelon organization-based sustainment generation with inventory management and dynamic source selection

- Ashore and afloat prepositioning

- Joint Logistics Over-the-Shore (JLOTS) modeling

- Large (e.g., over 100,000 movement requirements) multi-theater, multi-OPLAN, multi-year scenario modeling, within two-hour run-time

- Simulation start-stop and exogenous event handling

- Extensive theater Reception, Staging, Onward movement, and Integration (RSOI) modeling

- Costing

- Detailed tabular, graphical, and animation output

- Aerial refueling modeling

1.2 Scope.

The contractor shall plan for all general tasks identified in this Performance Work Statement

(PWS) required to develop, maintain, and support AMP. Note: Any reference to AMP within the document includes AMP-PAT. Contractor estimates and timelines shall be determined based on the specific tasks and deliverable due dates specified in each individual task order

(TO). The contractor shall coordinate with the AMP Program Manager (PM) to ensure that all activities are well synchronized and integrated with other USTRANSCOM modeling and simulation (M&S) efforts, and that replicated or overlapping efforts do not occur. All reports, studies or policies identified in the PWS shall be prepared and submitted for Government approval or acceptance. All functions and activities shall be task driven and work performed shall be in accordance with (IAW) all applicable regulations and guidelines.

1.3 General Tasks.

Each TO shall include the scope of one or more of the task areas listed below. Specific tasks shall be specified and performed under individual TOs.

Contract Management

Technical Support for Studies and Analyses

Requirements Management

Support for Design and Development

Software Maintenance

Application Administration

Security Engineering and Cyber Security Requirements

Support for Annual AMP Contingency Plan Review

Configuration Management

Sustainment Enhancements

New Capability

1.3.1 Task Area 1 - Contract Management.

This task area shall encompass overall contract management that tracks the performance of the work and consists of the functional activities relating to the administration and management of this effort. These activities shall include administrative, clerical, documentation, and related duties that provide general support for the program. The contractor shall provide program management for all contractor tasks, personnel resources, and costs, and shall ensure all deliverables meet schedule and budget constraints under this PWS. The contractor shall provide support by preparing documents such as required briefings, point papers and meeting minutes related to status of the performance of this PWS. The contractor shall work with the

AMP Program Office, process owners/stakeholders, Federal and DOD Government representatives, and other contractors to accomplish required tasks. All decisions regarding

Government requirements or Government actions will be made by Government personnel.

The contractor’s representative will submit required evaluations and recommendations to the

Contracting Officer’s Representative (COR) and/or Contracting Officer (CO) for further action.

Point of Contact (POC) information for the person(s) performing the contract management function shall be designated in writing to the CO with a copy to the COR no later than the date of the Post-Award Conference. POC information shall include name, title, phone number, and e-mail address. The contractor shall ensure all personnel assigned to this contract meet the minimum requirements specified in the contractor’s proposal.

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Air Force and Army via a secure data collection site, Enterprise-wide Contractor Manpower Reporting Application

(eCMRA). The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2018.

Contractors may direct questions to the help desk at: http://www.ecmra.mil.

-The eCMRA site associated with this contract is: to be determined (TBD) at the Task

Order level.

-The Command of the Requiring Activity is: TBD at Task Order level.

The Unit Identification Code (UIC) for this requirement is: TBD at Task Order level.

The Federal Service Code for this contract is: D308.

The contractor also shall provide demonstrations of software and participate in weekly teleconferences.

Deliverables to support task order contract management may consist of one or more of the following deliverables.

Deliverables

Task Order Management Plan (TOMP)

Monthly Status Reports (MSR)

In-Process Reviews (IPR)

Integrated Master Schedules (IMS)

1.3.1.1 Data Protection. Data (technical data and computer software) shall be protected IAW

AMP Program Protection Plans (PPP), System Security Plans, and cyber security guidelines as defined in Task Area 7, Security Engineering and Cyber Security Requirements. The

Government reserves the right to witness all contractor efforts to accomplish PWS requirements and maintains the right to comment on processes.

The contractor shall indemnify the Government from any liability to data owners or licensors resulting from, or as a consequence of, a release or disclosure of technical data and computer software made by this contractor or its officers, employees, agents, or representatives.

All computer software and technical data developed under this contract shall be delivered with unlimited data rights, as defined in Paragraph 1.4 (Deliverables) of each Task Order PWS. In this context, technical data and computer software developed under this contract do not include embedded open source software or Commercial Off-the-Shelf (COTS) software products. The contractor must identify these products to the Government and obtain the respective licenses.

http://www.ecmra.mil/ http://www.ecmra.mil./

The contractor shall comply with the requirements of the Contract Security Classification

Specification DD Form 254 and the security requirements contained in Paragraphs 5.0

Security (Physical, Personnel, Information, Antiterrorism/Force Protection and Industrial

Security and 6.0 Cyber Security of this PWS to ensure proper safeguarding of classified material, events, and processes.

1.3.2 Task Area 2 – Technical Support for Studies and Analyses.

The contractor shall support planning and execution of analytical studies that involve the use of AMP software, and that could be conducted by USTRANSCOM, the CAA, OSD CAPE, or other agencies. This shall require software modifications, analysis of study requirements and products, and on-site support. For specific studies, the contractor may be required to work with other model development contractors to define upgrades and enhancements to AMP software and other models, and to coordinate release and testing schedules. The contractor also shall modify AMP software and enhance the graphical user interfaces (GUI) and/or charts. In support of this requirement, the contractor shall conduct integration and testing, and perform trouble-shooting to repair or modify software problems identified during model execution.

1.3.3 Task Area 3 - Requirements Management.

The contractor shall facilitate and support the administration of the AMP requirements management process. The contractor shall manage the activities necessary to receive, verify, analyze, refine, and confirm requirements provided by the AMP PM or Functional Manager

(FM). The contractor shall employ an automated requirements tracking tool to maintain the traceability of all requirements from capability needs through design and test; document all changes to those requirements and record the rationale for those changes throughout the system lifecycle. Requirements traceability shall be confirmed at each technical review (e.g., IPRs, test readiness reviews (TRR), operational readiness reviews (ORR), production readiness reviews (PRR), and Requirements Definition Document (RDD) reviews).

As requirements are entered into the automated tracking tool, the contractor shall assess each requirement and provide the level of effort and impacts to program costs and program schedule. The contractor shall record these assessments in its automated requirements management tool. The contractor shall provide the Government (Program Management Office

(PMO) and FM personnel) remote access to this tool. The contractor shall employ this tool as a repository and to input, track, trace, and manage requirements, including software problem reports (SPR). The contractor shall document its internal requirements management process in a Requirements Management Plan (RMP) to be delivered in contractor format.

The contractor also shall provide a Software Requirements Specification (SRS) that describes the user’s functional requirements in detail and in a form that will support design and development of software to satisfy the PM-approved functional and technical requirements of each software release.

Deliverables

Requirements Management Plan

Software Requirements Specification

1.3.4 Task Area 4 – Support for Design and Development.

The contractor shall design and develop software to provide new capability for AMP. The contractor shall define a software development approach appropriate for the computer software effort to be performed under this PWS. This approach shall be documented in a

Software Development Plan (SDP) and followed for all computer software to be developed and/or maintained under this effort. The SDP shall define the contractor's proposed life cycle model and the processes used as a part of that model. In this context, the term “life cycle model” is as defined in ISO/IEC/IEEE Std. 15289-2017. The SDP shall describe the overall life cycle and shall include primary, supporting, and organizational processes based on the work content of this PWS.

The SDP shall contain the information defined by ISO/IEC/IEEE Std. 15289-2017 and the

Plans or Procedures in the Table of ISO/IEC/IEEE Std. 15289-2017. In all cases, the level of detail shall be sufficient to define all software development processes, activities, and tasks to be conducted. At a minimum, information provided must include specific standards, methods, tools, actions, strategies, and responsibilities associated with development and qualification.

In addition, the contractor shall:

(a) Propose release content and schedules based upon Government requirements and priorities

(b) Provide necessary models and simulations to support the verification, validation, and authentication (VV&A) process

(c) Provide software size (executable lines of code and function points), cost, and schedule estimates, and include justification and methodology used to derive the estimates

The contractor shall consider use of third-party products that may be innovative or new to

AMP and could improve system performance. The contractor shall provide its recommendations concerning use of third-party products to the Government. In particular, the

Government’s goal is to encourage reuse of software and components, especially in cases where the Government has unlimited data rights.

The contractor shall ensure that the AMP software is developed to be compatible with the current and any projected USTRANSCOM software configuration standards (e.g., United

States Air Force (USAF) Standard Desktop Configuration (SDC), network, security, Internet browser). The contractor can download the USAF SDCs from https://ceds.gunter.af.mil/Default.aspx for use within its development environment.

Deliverable: Software Development Plan, Software Design Description

1.3.4.1 Software Testing. To ensure all Government specifications for each requirement at each release are met, the contractor shall employ a comprehensive Government-approved testing program to verify Government-approved requirements, software patches, fixes or maintenance releases, replacement of COTS software, and replacement of hardware.

1.3.4.1.1 The contractor’s test and evaluation (T&E) processes shall complement the

Government T&E processes to include the Government T&E Master Plan (TEMP). Activities shall include developing a master T&E strategy that shall be included in the SDP; determining testability of change requests; producing test plans; tracing requirements through multiple documents to test procedures; supporting application certification efforts; performing test and operational readiness reviews and supporting production readiness reviews; supporting

Government T&E observation of the contractor’s T&E (e.g., Government Witness Testing

(GWT)); documenting test results; objectively analyzing data; participating in weekly teleconferences with functional and program management representatives; conducting risk analyses; capturing T&E metrics; testing performance; supporting operational test events; and improving T&E processes.

1.3.4.1.2 The contractor shall support Government participation in test events. These events include GWT and User Acceptance Testing (UAT) of the software to ensure it is validated and verified against the provided requirements or problem reports. The purpose of

GWT is to observe contractor software integration testing (SIT) of the software planned for use during UAT. During UAT, the contractor shall record and track deficiencies discovered by functional users participating in UAT and by contractor personnel, but shall not issue a new version of software for continuation of UAT without PM approval. In accordance with

PM and FM prioritization and PM direction, the contractor shall resolve these deficiencies and present another software version for either GWT or UAT. The contractor shall conduct a TRR before contractor software integration testing commences and an ORR before UAT commences. The goals of these reviews are to confirm the readiness of the application and test infrastructure (e.g., test environment and documentation) to start each test event, to identify the proper exit criteria necessary to complete each test event, and obtain

Government approval to proceed toward the next milestone leading ultimately to software fielding.

1.3.4.1.3 The contractor shall prepare briefing slides for each TRR and ORR and provide them for Government review before either TRR or ORR occurs. For each release (with the exception of an emergency release), the contractor shall prepare a Software Test Description

(STD) that describes the developer’s test methodology and traces requirements from https://ceds.gunter.af.mil/Default.aspx contractual and/or requirements documentation through to test cases. This requirements trace shall be documented as a Requirements Traceability Matrix (RTM) and included within the

STD. The contractor shall create test cases for each requirement that shall provide detailed test instructions, any pre-conditions or inputs, and expected results for each required functional capability or defect. These test cases shall be included in the STD. The STD also shall describe the contractor’s approach to conduct regression testing on changes made to commercial off-the-shelf components and application software components. In addition, the contractor shall provide documentation that records the status and results of the contractor’s test efforts. The contractor shall deliver a Software Test Report (STR) that details test results following completion of SIT.

Deliverables:

TRR and Briefing Slides

Software Test Description (with test cases and RTM)

Software Test Report

1.3.4.1.4 The purposes of the ORR are to review the results of SIT and GWT, and to determine the readiness of the software to undergo UAT. To support the ORR, the developer shall produce the test artifacts along with a description of any open SPRs for review by the PMO and functional representatives. During ORR, the contractor shall brief the results of SIT and GWT. The developer shall deliver all artifacts, including a draft

Software Version Description (SVD), to the PMO and place them under Configuration

Management (CM) control. The successful outcome of this review should result in

Government PM approval to proceed to UAT.

1.3.4.1.5 Once the software is delivered to the Government for UAT, the contractor shall not implement changes to the software baseline under test until the Government has completed (or postponed) testing, prioritized software or test problem reports, and has accepted the change(s) proposed to resolve the problem(s). The contractor shall identify and track deficiencies discovered during UAT, but shall not issue a new version of software for continuation of UAT without PM approval. In accordance with PM and FM prioritization and PM direction, the contractor shall resolve these deficiencies and present another software version for either GWT or UAT. After completion of UAT, the

Government will conduct a PRR, with developer participation, that demonstrates readiness of the application and infrastructure to support fielding to the production environment, and to issue a fielding decision.

1.3.4.1.6 If the contractor has used automated test scripts to verify software problem fixes for a software version entering a scheduled test event involving Government participation, the contractor shall provide a user-readable version of the automated test script(s) and expected test result(s) for each test case; these shall be included in the STD. The contractor shall provide the results of automated testing of the software build to be used at the start of scheduled test events, and any builds occurring during scheduled test events. The contractor shall include these automated test result(s) as an addendum to the STR.

1.3.4.1.7 The contractor shall meet all government specifications for each requirement at each release. The PM will make the final decision concerning software acceptance.

Deficiencies will be documented, prioritized, tracked, and may result in non-acceptance of the software release by the Government. The software shall be resubmitted for testing and only accepted by the Government once it passes government testing. In this contract, deficiencies are defined as the difference between the functional specifications stated by the

Government and the capability provided in the software being delivered to the Government.

This definition includes capability previously delivered to the Government that was not a part of the new functional specifications or code changed due to fixing problems with the software that the Government Configuration Control Board (CCB) authorized.

Deliverables:

ORR and briefing slides

Software Version Description (SVD)

Maintenance Releases. For maintenance releases, the contractor shall conduct a regression test of the revised software to ensure the software changes do not degrade system operation. The contractor shall brief results of the regression test during TRR.

1.3.4.2 Software Release Process. The contractor shall follow the software release process described in the Government AMP Configuration Management Plan (CMP). Using the processes described in the Government CMP, the program’s CCB, chaired by the PM, will determine the contents of each software release after consideration of the Configuration

Working Group’s recommendations and the functional user’s priorities. Software releases are categorized into major, minor, maintenance, or emergency releases. Releases are classified as

“major” if they include change(s) in the system architecture (e.g., introduction or elimination of a database, transition from client-based application to web-based access) or security posture. Major releases also include new functionality, and also may contain fixes to software problem reports. Releases are classified as “minor” if they include new functionality, but no changes to the system architecture or security posture. Minor releases also may contain fixes to software problem reports. Maintenance releases may contain fixes to software problem reports and needed enhancements. Emergency releases normally contain only fixes to software problem reports, but may include new capability rushed to the field to support a high-priority requirement. The Government will establish the number of releases expected by type for each fiscal year in the first task order of each fiscal year. The contractor shall deliver software source code with each release.

Each release must undergo cyber security review to determine the degree to which the changes incorporated into the software impact the security or hardware architectures of the system, or include the implementation of a new operating system, database, or interface.

This review is accomplished once the contractor submits software security scans (current scan tool is Fortify) for analysis. The frequency of contractor delivery of Fortify scans for analysis will be as described in the Deliverables Table that appears in the first task order placed on contract at the beginning of each fiscal year. Once all Category 1 faults are corrected and the USTRANSCOM Cyber-Security Branch (TCJ6-I) accepts risks identified as Category 2 and 3 faults, the AMP Government engineer, supported by PEO-T security engineer, will submit the necessary documentation (normally a minor modification checklist) for Government approval. Other forms of review include requests for interim authority to test or completion of the reaccreditation process. The contractor shall assist the

Government in achieving software acceptance by accomplishing tasks described in

Paragraph 1.3.7 Security Engineering and Cyber Security Requirements. AMP currently is accredited under the DOD Information Assurance Certification and Accreditation Process

(DIACAP), and will complete its transition to Risk Management Framework (RMF) during

FY18.

The contractor shall update the Software User Manual to provide USTRANSCOM functional personnel appropriate guidance for system operation.

Code Scans

Source Code

Executable Programs

1.3.5 Task Area 5 – Software Maintenance.

The contractor shall provide software maintenance for AMP, Joint Mobility Closure Estimator

(JMCE), AMP-PAT, the Rapid Course of Action Analysis Tool (RCAT), and Agile

Transportation for the 21st Century (AT21)-related AMP capability. The contractor shall correct software defects that AMP users have identified and documented in Change Requests

(CRs), and shall conduct unit, integration, regression, and security testing of these fixes. The contractor shall maintain the data objects and run-time infrastructure, and adapt to changes in the AMP component models to ensure federated runs are operational. The contractor shall adhere to the test and release requirements described in Paragraph 1.3.4 above.

The contractor shall:

(a) Facilitate and support the administration of the AMP problem reports management process;

(b) Propose release content and schedules based upon software maintenance priorities directed by the AMP CCB;

(c) Provide software level of effort, cost, and schedule estimates, and include justification and methodology used to derive the estimates;

(d) Code, test, document, and support full integration of software and software releases in accordance with AMP CCB direction and Paragraph 1.3.4;

(e) Include a list and brief description of software defects that will be fixed in a given release in the SVD associated with that release; and

(f) Provide CM, quality assurance (QA), and documentation for all AMP software to include any necessary updates to the Software User’s Manual.

1.3.6 Task Area 6 - Application Administration.

The contractor shall provide on-site application administration and support to

USTRANSCOM system administrators and functional users. This shall include model user training and the following activities:

(a) Plan, schedule, and support installation of AMP software, to include application patches and updates. Troubleshoot AMP installation problems. Support

Functional Area Communications Computer System Manager installation of AMP application software on Secure Internet Protocol Router Network (SIPRNET) clients, as necessary;

(b) Support optimization, operation, troubleshooting, backup, recovery, modification, and upgrade of software. Debug AMP software and support testing of the application (e.g., USTRANSCOM Test Lab, support of GWT and UAT);

(c) Provide technical support for hardware refresh efforts;

(d) Provide Help Desk support to assist functional users to troubleshoot and correct

AMP problems;

(e) Keep information located on the AMP webshare site current, including keeping the web pages updated with the latest downloadable AMP software releases, sample data, and AMP User Group materials; and

(f) Assist Government security and networking personnel to resolve application-related issues.

The contractor shall keep the AMP Application Administration Manual updated. The contents of the manual shall include account administration; software installation; obtaining, generating, and updating reference files, shared drives, and web pages; troubleshooting and resolving operating system conflicts; maintaining logs; and creating reports.

The contractor shall provide training on the use of the AMP modeling tools. USTRANSCOM will coordinate and provide the training classroom (including hardware) if such training is required. Training shall be consistent with industry standards.

The contractor shall update training materials for classroom, self-paced, or computer-based training. The training materials shall include descriptions of course content, scenario descriptions, and practical exercises.

Application Administration Manual

Updated Training Materials

1.3.7 Task Area 7 – Security Engineering and Cyber Security Requirements.

1.3.7.1 Task 7 Subtask 1 – Security Engineering Requirements.

The contractor shall evaluate all AMP software releases to ensure security issues are identified and addressed using the Defense Information System Agency (DISA) Application Security and Development Checklist and Security Technical Implementation Guide (STIG). The contractor shall conduct code reviews and apply required security features for all AMP software.

1.3.7.1.1 Information Assurance Vulnerability Management. The contractor shall monitor and analyze Information Assurance (IA) Vulnerability Management (IAVM) Notices, USTRANSCOM Security Notifications, United States Cyber Command (USCYBERCOM) and vendor security advisories and make recommendation to the Government for applicability to AMP.

The contractor shall submit an initial analysis and assessment for high impact (risk) advisories

(based on the STIG Finding Severity Category listed in the IA Vulnerability Advisories

(IAVA), IA Vulnerability Bulletins (IAVB), and Technical Advisories) to the Government

AMP PM, engineer, and security engineer. All STIG Finding Severity Category I and II

IAVAs and IAVBs are considered high impact.

The contractor shall prepare an analysis for other than high impact advisories and provide it to the USTRANSCOM AMP Engineer.

The contractor shall provide a summary of security analysis and assessment results during weekly teleconferences and an update in the MSR.

1.3.7.1.2 IA Security Bulletins. The contractor shall analyze applicable security bulletins to determine impact, identify mitigating factors, and develop recommendations to the

Government regarding potential courses of action. Contractor recommendations shall be compliant with AMP, USTRANSCOM, and DoD security requirements and industry best practices. The contractor shall ensure that patch deployments and other significant security activities are documented in the IMS.

The contractor shall develop and update mission criticality analyses, vulnerability assessments, risk assessments, and identification and counter measure implementations for

Mission-Critical Functions.

The contractor shall protect unclassified DoD data from unauthorized access or disclosure in accordance with DoDI 8582.01, “Security of Unclassified Information on Non-DoD

Information Systems,” DoDM 5200.01, Volume 4, and classified information under DoD

5220.22-M, National Industrial Security Program Operating Manual (NISPOM), and the program’s Security Classification Guide.

1.3.7.1.3 Security Testing. The contractor shall conduct an automated code scan of the application using an approved code scan tool (currently Fortify) with the current rule packs, signatures, engines, etc. installed. A qualified developer security engineer and programmer shall review the results of the automated code scan, determine and mark false positives, and provide rationale for recommendations. The contractor shall analyze and comment on respective analysis options (Not an Issue, Reliability Issue, Bad Practice, Suspicious, Exploitable, or custom). The contractor shall provide the results and a detailed analysis 15 business days prior to software delivery.

For all software releases, the contractor shall conduct software security testing in accordance with the DISA Application Security and Development Checklist and STIG, and shall submit the completed checklist to the Government in accordance with Paragraph 1.4, Deliverables.

As validation of continued compliance with the STIG, the developer shall submit application code scan reports for each software release as indicated in the deliverables table. Delivery should coincide with the other programmatic documentation deliveries: 120 business days prior to program need-by date (required accreditation/authorization date) to support the DoD certification and accreditation methodology.

Deliverables:

Pre-Software Delivery Automated Code Scan

DISA Application Security and Development Security Implementation Guide

(STIG) Checklist

1.3.7.1.4 Use of Automated Code Scanning Tool. The contractor shall use an automated tool to scan the application source code to identify and remediate vulnerabilities or weaknesses in the application design/coding, such as those described in the Common

Weakness Enumeration/System Administration, Networking, and Security Institute

(CWE/SANS) TOP 25 Most Dangerous Programming Errors (http://www.sans.org/top25-programming-errors) and OWASP Top Ten

(http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project), that could be exploited by unauthorized sources.

1.3.7.2 Task 7 Subtask 2 – AMP Security Assessment and Authorization.

1.3.7.2.1 Under DoD Information Assurance Certification and Accreditation Process

(DIACAP). AMP has been designated Mission Assurance Category (MAC) III, Classified for the purposes of applying information assurance (IA) controls. The contractor shall develop and maintain the System Security Plan (SSP) and below list of documentation required to support DIACAP accreditation decisions. In addition, the contractor shall support

USTRANSCOM's use of selected tools, currently eMASS, for automated accomplishment of the RMF process. The contractor shall update cyber security documentation a minimum of once per year or as needed when software weaknesses are discovered.

The SSP shall serve as the overarching document. The SSP shall address all of the applicable

DoDI 8500.2 cyber security controls, and shall be recognized as the official system security policy and will be signed by the AMP PM, Functional Manager, and Information Assurance

Manager. The Contractor shall deliver the documents listed below as appendices to the SSP:

Audit Design Artifact *

Cryptographic Subsystem Artifact *

IA Acquisition Artifact *

Identification and Authentication Subsystem Artifact *

Incident Response Plan (IRP) Artifact *

Interconnections Artifacts *

Personnel Security Artifact *

Remote Access Artifact Security *

Security Design Document (SDD) Artifact *

Security Test Plan (STP) Artifact *

Vulnerability Management Plan (VMP) Artifact *

Completed DISA Application Security and Development Checklist and STIG. Each

STIG rule shall include comments supporting respective status for Open/Not a

Finding/Not Applicable. Open STIG items shall include proposed fix actions. The contractor shall submit completed STIG in accordance with the deliverables table.

Static Source Code Scan Report - The contractor shall conduct analysis and provide comments on respective analysis options (Not an Issue, Reliability Issue, Bad Practice, Suspicious, Exploitable, or custom). Results shall be provided in accordance with the deliverables table.

Ports, Protocols, and Services Management (PPSM); including ports for internal and external traffic and a list of source and destination Internet Protocol (IP) Addresses.

AF-DoD approved PPSM worksheet will be used.

Note: The Government will provide templates for the items denoted with an asterisk (*).

1.3.7.2.2 Transition from DIACAP to the RMF. To maintain authorization, the contractor will transition security documentation from DIACAP to the RMF. RMF cybersecurity control assessments will be documented on an assessment procedures worksheet for inclusion in the

SSP. Delivery of the RMF assessment procedures worksheet will be in accordance with the deliverables table in each TO.

1.3.7.2.3 Under Risk Management Framework Process. The contractor shall participate in

AMP Security Assessment and Authorization activities. The contractor shall assume responsibility for development and/or update of existing system security documentation developed to facilitate AMP security authorization IAW the RMF. The contractor shall perform Security Control Assessment activities as required to maintain current authorization and support follow-on authorizations. The contractor shall support USTRANSCOM's use of eMASS for automated accomplishment of the RMF process. The contractor shall update cyber security documentation a minimum of once per year or as needed when software weaknesses are discovered.

The Contractor shall develop and maintain the following documentation required to support the RMF authorization decisions.

RMF deliverables identified below can be grouped or combined as necessary as long as the resultant document or documents address the RMF requirements and support the implementation and validation of the controls.

Deliverables:

System Security Plan (SSP). The contractor shall develop a SSP IAW DoDI

8510.01, DoDI 8500.01. Ref: NIST SP 800-18 (Guide for Developing Security Plans for Federal Information Systems).

Incident Response Plan. The contractor will develop a plan that describes the procedures for responding to incidents affecting the system. Ref: NIST SP 800-61

(Computer Security Incident Handling Guide).

Ports, Protocols, and Services Management (PPSM). Include ports for internal and external traffic and source and the list of destination IP addresses. AF-DoD approved

PPSM worksheet will be used; available at https://cs.eis.af.mil/sites/10060/Documents/Forms/AllItems.aspx?RootFolder=/sites/10

060/Documents.

Security Test Plan. The contractor will develop a security test plan that describes its

Software Development Lifecycle (SDLC) and procedures used by the developer to test the application code for security vulnerabilities prior to delivery to the government.

Risk Analysis and Assessment Report. Relating to the system applicable

Information Assurance Vulnerability Assessments.

Static Source Code Scan Report. The contractor shall conduct analysis and provide comments on respective analysis options (Not an Issue, Reliability Issue, Bad Practice, Suspicious, Exploitable, or custom). Results will be provided in accordance with the deliverables table.

Completed DISA Application Security and Development Checklist and STIG.

Each STIG rule shall include comments supporting respective status for Open/Not a

Finding/Not Applicable. Open STIG rules shall include proposed fix actions. The contractor shall submit completed STIG in accordance with the deliverables table.

1.3.7.3 Task 7 Subtask 3 – Cyber Security Requirements.

1.3.7.3.1 Requirements for Contractor Provision of Security Plan and Cyber Security

Controls. The contractor shall establish a cyber security program to implement and sustain appropriate cyber security management, operational, and technical controls and processes required to safeguard DoD non-public information resident on or transiting the contractor's unclassified information systems from unauthorized access and disclosure. Protection measures applied must be commensurate with the risks (i.e., consequences and their probability) of loss, misuse, unauthorized access, or modification of information. The contractor shall submit for Government approval an overarching security plan that describes its strategy for implementation of cyber security and Industrial Security requirements throughout the life of the contract. The security plan shall address the security controls described in National Institute of Standards and Technology (NIST) Special Publication 800-

53 Series, Recommended Security Controls for Federal Information Systems and

Organizations (http://csrc.nist.gov/publications/PubsSPs.html), and shall be tailored in scope and depth appropriate to the effort, the specific unclassified DoD information.

1.3.7.3.2 Information Assurance Workforce Improvement Program (IAWIP). The contractor shall:

(a) Ensure that personnel accessing information systems and who perform cyber security functions have the proper and current information assurance certification

(IAT Level II) and (IAM Level I) to perform information assurance functions in accordance with DoD 8570.01-M, IAWIP. The contractor shall meet the applicable information assurance certification requirements, including:

1) DoD-approved cyber security workforce certifications ( IAT Level II), as listed in DoD 8570.01-M; and

2) Appropriate operating system certification for cyber security technical positions as required by DoD 8570.01-M

(b) Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing cyber security functions.

The contractor shall provide documentation verifying IAWIP certifications to the COR.

1.3.7.3.3 Support of Cybersecurity Service Provider (CSSP) / Host-Based Security

System (HBSS). The contractor shall comply with all applicable subscriber-related CSSP /

HBSS requirements as stipulated under subscriber responsibilities as listed in the CSSP Roles and Responsibilities document, 13 October 2016.

(a) Remote Access. Contractor Furnished Equipment (CFE) employed for remote access to a Government network shall meet equivalent Government Furnished Property (GFP)

IA computing requirements. The Contractor shall ensure that all CFE (e.g., hardware and software) employed to access these environments meet the following minimum Government

IA requirements and provide periodic certification of compliance as a pre-requisite to being granted network access.

1 Use of all personal systems shall be prohibited;

2 OSs and applications shall be configured for compliance with the DISA Gold Disk and applicable STIGs;

3 DoD approved anti-virus and anti-spyware software shall be installed and signatures shall be configured to automatically update on a daily basis;

4 DoD approved personal firewall shall be utilized and configured to permit traffic by exception only, dropping all other traffic. If the personal firewall provides intrusion detection or prevention; the signatures or rules shall be updated at the same intervals as the anti-virus software;

5 Computers shall be IAVM compliant;

6 Computers shall be scanned with the DoD version of E-eye Retina vulnerability scanner (or current approved DoD scanner solution) at a minimum of every twenty (20) business days. All vulnerabilities shall be remediated and reported to the DPS Information

Assurance Manager (IAM).

7 Contractor employees shall possess a current Government issued CAC and install

Government certified CAC readers; and

8 Verification of compliance with these requirements shall be provided to an appointed Government representative on a monthly basis.

(b) Periodic Government Inspections. The Contractor shall authorize periodic

Government inspections and reviews to assure compliance with DoD IA requirements throughout the contract performance period. The Contractor shall take corrective action based upon the impact and severity of identified weaknesses.

1.3.8 Task Area 8 - Support for Annual AMP Contingency Plan Review.

Each year the PMO engineer selects certain possible scenarios from the AMP Contingency

Plan for review. The contractor shall participate in this annual review and shall modify portions of the program contingency plan applicable to the application administrator’s role as the Government representatives deem necessary.

1.3.9 Task Area 9 - Configuration Management (CM).

CM support is required to meet USTRANSCOM technical and security requirements. The

CM process facilitates orderly configuration identification, change identification and control, status reporting, and configuration auditing of product information for such beneficial purposes as to revise capability; improve performance, reliability, or maintainability; extend life; reduce cost; reduce risk and liability; or reduce defects. CM ensures that changes take place in an identifiable and controlled process and do not adversely affect the properties of the other system or interfaces.

CM establishes and maintains the integrity of the products of a project throughout the project life cycle. CM involves identifying the configuration items of products developed and delivered to the customer, systematically controlling changes to the configuration, and maintaining configuration traceability. The contractor’s configuration management processes must complement the Government CM processes. Contractor activities shall include developing a CMP; identifying hardware or software configuration items; implementing a change control process and providing an automated configuration management tool to assist in change control; evaluating change requests; tracking hardware and software, warranties, maintenance support agreements, and software licensing; participating in configuration working groups or, by PM request, configuration control boards; conducting configuration status accounting and audits and providing associated reports; and improving CM processes.

Configuration Management Plan

Hardware Configuration Item Listing

Software Configuration Item Listing

1.3.10 Task Area 10 - Enhancements.

For purposes of this PWS, an enhancement is a refresh or a minor improvement to a capability that already resides in the software, but that does not rise to the level of changing the inherent capability of the software. An enhancement does not include a fix to a problem with the software. As directed by the PM via the CCB process described in the government CMP, the contractor shall provide new software that will include enhancements to AMP. Enhancements shall be identified on a task order basis. Projected enhancements are included in Appendix D.

1.3.11 Task Area 11 – New Capability.

For purposes of this PWS, new capability consists of capability that currently does not exist in the software. As directed by the PM via the CCB process described in the Government CMP, the contractor shall provide software that will include new capability in AMP. AMP may be designated to migrate to a cloud environment. The contractor may be required to support such effort. The contractor shall design, develop, and fully integrate all new capabilities and, as specified by requirement, provide requisite documentation for each new capability. New capability shall be identified on a task order basis. Projected new capability requirements are included in Appendix E.

1.4 Deliverables.

Deliverables shall be identified in each individual task order. The contractor shall deliver data and software (with applicable data rights) according to the delivery schedule identified in the deliverable table of each task order. IAW Defense Federal Acquisition Regulation

Supplement (DFARS) 252.227-7013 and DFARS 252.227-7014, the Government obtains under this contract “unlimited rights” to all non-commercial computer software, software source code, computer software documentation, enhancements, technical data, and similar non-commercial data developed exclusively at Government expense and delivered to the

Government under this contract. “Unlimited rights” means rights to use, modify, reproduce, release, perform, display or disclose in whole or in part, in any manner and for any purpose whatsoever, and to have the ability to authorize others to do so. The contractor agrees that regardless of how contractor provided data/software is developed or modified during contract performance, the contractor will deliver data/software marked IAW requirements in DFARS

252.227-7013, 252.227-7014, and other applicable references.

For all other non-commercial data delivered under this contract, the Government has the right to use, modify, reproduce, release, display or disclose, in whole or in part, in any…