JCC2-R Support Capability PWS 20 MAR 2025.pdf

JCC2-Readiness (JCC2-R) Performance Work Statement (PWS)

20 March 2025

Name: JCC2-Readiness (JCC2-R)

Organization: Cryptologic and Cyber Systems Division

(AFLCMC/HNCJ)

Address: 230 Hall Blvd San Antonio, TX 78226

Executive Summary

This JCC2-R Task Order will provide rapid capability development and operational readiness leveraging industry best-practices and innovative solutions to ensure Joint Cyber Command and Control (JCC2) meets operational requirements and matures existing government owned software in an efficient and effective manner. Tasks may include but are not limited to new software development, sustainment, cradle to grave engineering analysis, software modification, maintenance, and enhancement, along with maturing of existing architecture and infrastructure. Additional tasks include providing support for interoperability with other systems, developing and facilitating system integration services, managing operational deployments, and modeling current application architecture and interdependencies.

JCC2-R requirements have primarily targeted high value and specific workflows for rapid development, delivery, and adoption. The requirements have centered on the tactical and operational layers due to lack of standardized, reliable inputs to populate strategic views.

During the period of performance (PoP) for the JCC2-R effort, JCC2 will build upon the lessons learned, and leverage day-to-day operational data and operational workflows to feed the development of the information and intelligence required for top-level joint strategic decisions. Additionally, JCC2 invests heavily on joint operational solutions with wide adoption, thus building a foundational understanding of persistent shared problem sets across the DOD.

As a result, the level of expertise required to fulfill JCC2-R requirements is very high; it is a must that the contractor has qualified and experienced programmers, testers, developers, integrators, automation engineers, and subject matter experts. The contractor’s ability to increase and decrease the number of staff and development teams to match dynamic support requirements is critical. This PWS identifies the overarching requirements of the JCC2-R effort.

Table of Contents

1 Purpose

2 Scope

3 Requirements and Description of Services

3.1 Life Cycle Support

3.2 Integration

3.3 Development

3.4 Enterprise Services

3.4.1 General Requirements

3.5 Risk Management Framework

3.6 Accreditation

3.6.1 General Requirements

3.7 Test and Evaluation

3.8 Systems Security Engineering

3.9 Cybersecurity, Cyber Survivability, and Cyber Resiliency

3.10 Program Protection

3.10.1 General Requirements

3.11 Supply Chain Risk Management

3.11.1 General Requirements

3.12 Trainer of Trainer

3.13 Tier 3 Support

3.14 Planning Increments (PI) Metrics

4 Team Composition and Special Qualifications

4.1 Workforce Management

4.2 JCC2-R Team: JCC2-R Application

4.3 Security Clearances

5 Project Management/Requirements Processing

6 Contractual Requirements

6.1 Key Personnel

6.2 Performance Reporting

6.3 Program Management / Project Management

6.4 Services Delivery Summary

6.5 Task Order Management

6.6 Configuration and Data Management

6.7 Records, Files and Documents

6.8 Security Management

7 Deliverables

8 Normal Hours of Operation

1 Purpose This effort is to provide maintenance and engineering services in line with standard Air Force (AF) General Cyberspace Support and Management procedures for multiple mission application systems and initiatives for JCC2. The period of performance (PoP) is one (1) year base, plus four (4) one-year options.

During the PoP for the JCC2-R effort, the API services may change, and the configuration of the system may evolve significantly.

2 Scope The services required under JCC2-R include all disciplines required for software development and maintenance/sustainment of JCC2 systems in accordance with (IAW) applicable guidance, policies, and directives. Support services will be applied to all systems and activities within the JCC2 portfolio supporting mission operations locally and remotely.

The contractor shall:

1. Sustain existing applications and API services to include but not limited to JCC2 Readiness

(JCC2-R).

2. Modernize or refactor software applications, services, architectures, and component technologies to support industry standards and best practices to include but not limited to, containerized technologies, modularization, and microservices as directed by JCC2.

3. Integrate JCC2-R capabilities with internal or external solutions or technologies, as directed, for system, data, and technology stack interoperability. Integration efforts shall include but not be limited to API development and integration. Integration and interoperability enhance the JCC2 portfolio of service offerings based on growing needs and changing requirements.

4. Develop new capabilities and software products in response to requirements and priorities identified through the respective United States Cyber Command (USCYBERCOM), Service Cyber Components, when directed by JCC2 PMO.

5. Provide enterprise services including:

o Develop, design, provision, manage, integrate, and automate software CI/CD pipelines, as directed, to deliver software based on the development and security requirements defined by hosting environments to streamline workflows through built-in automation, testing, and collaboration.

o Support accreditation activities for the deployment and production environments for JCC2-R and its primary target deployment environments.

6. Perform and report on Contractor Testing to include but not limited to unit testing, integration testing, system testing, regression testing and support developmental test (DT), coordinate and support the Lead Developmental Test Organization (LDTO), the 47th CTS; coordinate with and support operational test (OT) and test artifact development with the Air Force Operational Test and Evaluation Center (AFOTEC) as the Operational Test Agency (OTA); support the Director, Operational Test and Evaluation (DOT&E) oversight process and the Joint Cyber Warfighter Architecture (JCWA) Integration Office (JIO) JCWA Test and Evaluation (T&E) process to evaluate capabilities in the context of the JCWA. Establish and report on metrics associated with software development and maintenance/sustainment, infrastructure, and operational measures of performance as directed by JCC2 Project Management Office (PMO).

7. Provide application metrics for each deployment of each application to ensure the operational customers are known and JCC2 requirements are inclusive to all operators of each application.

The JCC2 JCC2-R team shall provide application sustainment engineering support, documentation support (maintain and update JCC2 documents), integration services, Train-the-Trainer support, and other forms of support for JCC2. JCC2 is composed of Mission Applications, Cloud based infrastructure on which the Mission Applications run, which the Contractor shall provide necessary support, security patches, upgrades, and bug fixes for all applications on the infrastructures deployed.

3 Requirements and Description of Services This section provides a broad scope of services required under this task order focusing on direct mission support.

3.1 Life Cycle Support

3.1.1 General Requirements

3.1.1.1 The contractor shall sustain, test, deploy Battle Management applications (JCC2-R) while integrating best of breed functionality into the JCC2 designated environment.

3.1.1.2 The contractor shall support requirement analysis, engineering impact assessments, and course of action (COA) creation in response to operational requirements (JCC2 CRs, JCWA requirements process, and/or change requests).

3.1.1.3 The contractor shall submit advanced or efficient software technologies, processes, or engineering methods to the government for evaluation to improve software lifecycle management of JCC2 applications.

3.1.1.4 The contractor shall sustain applications that provide context-aware error messages to end users to communicate application errors and/or exceptions.

3.1.1.5 The contractor shall maintain applications, on the JCC2 designated development and operational environments, in accordance with DoD Security directives (for example, STIGs, IAVAs for OS, etc.).

3.1.1.6 The contractor shall sustain interfaces and exchange information with Big Data Platforms (BDPs) as directed by the JCC2 PMO.

3.1.1.7 The contractor shall support technical interchanges with operational stakeholders, to include but not limited to, elicitation, analysis, and system requirements management, ensuring traceability and alignment with system models. The contractor shall ensure that JCC2 is represented in all communications with operational stakeholders.

3.1.1.8 The contractor shall provide design services of User Interface/User experience (UI/UX), UX flows, graphics design, videos, and associated materials to facilitate instructive communications to operational community of delivered capability.

3.1.1.9 The contractor shall have subject matter expertise of USCYBERCOM and service cyber component network architecture, organizational structure of cyber defenders and assigned responsibilities, cyber sensors, and other critical defensive technologies, reporting requirements and processes.

3.1.1.10 The Contractor shall develop COA documentation supporting the technical or administrative justification for advocating against supporting a government approved DevOps process and CI/CD pipeline.

3.1.1.11 The contractor shall deploy user-facing software updates into all production environments with a threshold of once a week and an objective of once a month.

3.1.1.12 The Contractor shall conform to a cloud based, containerized, microservice architecture that is compatible with JCC2 production environment on NIPR, SIPR, and JWICS.

3.1.1.13 The contractor shall support all three enclaves (NIPR, SIPR, JWICS) ensuring operational capability, security, and COOP capability supporting a one (1) hour recovery point objective.

Note: This is expected to be an automated Amazon Web Service (AWS) failover process.

However, some applications may react differently to infrastructure changes (e.g. one Domain Controller drops, and the application should automatically look to the secondary Domain Controller).

3.1.1.14 The contractor shall provide a minimum of two (2) Systems Administrators eligible for and/or holding the proper certifications to manage deployments, patches, etc. on JCC2 environments (NIPR, SIPR, and JWICS).

3.1.1.15 The contractor shall generate and maintain a Software Bill of Materials (SBOM) for all applications. The SBOM shall contain, but is not limited to, supplier name, component names, component versions, unique identifiers (i.e., Common Platform Enumeration (CPE), Software Identification (SWID) tags, Package Uniform Resource Locators (PURL), etc.), dependency relationships, author of SBOM data, timestamps, source code location/URL, history of code submissions, and cryptographic signatures, as designated by the JCC2 PMO.

3.1.1.16 The contractor shall format the SBOM using the [Software Package Data eXchange (SPDX) or CycloneDX] open standard or equivalent.

3.1.1.17 The contractor shall deliver an updated SBOM to the PMO Chief Engineer (CE) and Lead Battle Management Engineer (LBME) at the end of each quarter.

3.1.1.18 The contractor shall incorporate build tools that automatically create SBOMs, in both human-and machine-readable formats, based on the actual build of the software and reduce the need for manual updating (i.e., Software Composition Analysis tools). The contractor shall ensure the SBOM is machine-readable to facilitate automation and tool integration.

3.1.1.19 The contractor shall assist the government in reducing costs by conducting analysis of Commercial-Off-The-Shelf (COTS) tools used by the cyber community that offer similar operational features like JCC2-R.

3.1.1.20 The contractor shall use the JCC2 designated architecture tooling to develop required architectural viewpoints such as Cameo.

3.1.1.21 The contractor shall provide subject-matter-experts to develop content of architecture viewpoints.

3.1.1.22 The contractor shall use a user-driven design approach to determine the information requirements for the UX and shall be supported by corresponding data within the application. Contractor designers will produce artifacts during the design process, such as but not limited to, product design diagrams, workflow diagrams, and mockups which will be provided to stakeholders. Stakeholder feedback shall be provided to JCC2 and used to drive design refinements as directed by the PMO.

3.2 Integration

3.2.1 General Requirements

Development

3.2.1.1 The contractor shall develop interfaces and exchange information with Big Data Platforms

(BDPs) as directed by the JCC2 PMO.

3.2.1.2 The contractor shall develop APIs to ingest data from authoritative data sources as designated by the USCYBERCOM Chief Data Officer in coordination with the USCYBERCOM directorates.

3.2.1.3 The contractor shall develop APIs to transmit and/or receive information with other systems, as directed by the PMO, conforming to specifications (e.g., OpenAPI) and data standards/specifications (e.g., SchemaOne, STIX, etc.) designated by JCC2.

3.2.1.4 The contractor shall implement data standards/specifications, data interfaces, data models, and data schemas necessary to support capability integration with other systems and conform to JCC2 system requirements for interoperability and integration across JCC2 applications.

3.2.1.5 The contractor shall produce an integration and runtime document that defines the interface architecture and data exchanges that serves as a reference to other developers of JCC2 applications for sharing data across applications and/or using common data stores. This document shall be updated once per quarter (at a minimum) and delivered to the JCC2 CE and LBME.

3.2.1.6 The contractor shall deliver a software development toolkit (SDK) and diagrams that serves as a reference implementation for the orchestration of APIs to facilitate data integration and software reuse.

3.2.1.7 The contractor shall develop applications that provide context-aware error messages to end users to communicate application errors and/or exceptions.

3.2.1.8 The contractor shall assist the government in identifying data and interface integration opportunities to deliver data products to the operational community. The contractor shall present any such opportunities to the PMO.

3.2.1.9 Upon PMO direction, the contractor shall refactor capabilities and migrate datasets into shared data stores with data interfaces to facilitate purposeful integration within the JCC2 portfolio.

3.2.1.10 The contractor shall implement automated ingestion of structured and unstructured data to minimize user workload or errors. The automated process should include artificial intelligence/machine learning algorithms that meet the operation requirements for data quality and integrity.

3.2.1.11 The contractor shall research the plausibility of using hardened containers from DoD Centralized Artifacts Repository (DCAR). Currently the Iron Bank is operated at https://ironbank.dsop.io and consumers can download containers via native command line interface commands from https://registry1.dsop.io. The contractor shall deliver the research results to the PMO, including COAs for implementation.

3.2.1.12 The contractor shall rearchitect the system UI/UX flows and information architecture of services, as directed by the JCC2 PMO, to reduce duplication of features and increase operator ease of use across JCC2 applications.

Agile Methodology

3.2.1.13 The contractor shall support PMO-driven sessions with operational users to identify capabilities needs and construct journey maps. The contractor shall deliver any resulting journey maps or associated documentation to the PMO

3.2.1.14 The contractor shall use JCC2 designated collaboration tools.

3.2.1.15 The contractor shall work with JCC2 PMO to develop and prioritize epics, objectives, features, task-NFRs, etc. in support of capabilities development. The JCC2 PMO shall be the final authority on all prioritization decisions.

3.2.1.16 The contractor shall work with the JCC2 PMO to refine and maintain the backlog to identify aging items, enablers, and changes to existing items.

3.2.1.17 The contractor shall assist JCC2 product owners and engineers in the decomposition of operational requirements to define a government owned feature backlog.

3.2.1.18 The contractor shall provide technical support on the deployment, installation and troubleshooting of JCC2-R application as directed by JCC2 PMO.

https://ironbank.dsop.io/ https://registry1.dsop.io/

3.2.1.19 The contractor shall analyze requirements, software design documentation and UIX journey maps to cross reference custom features developed exclusively for other SCCs to reduce duplication and maximize reuse.

3.2.1.20 The contractor shall evaluate AI/ML algorithms that improve data quality such as, but not limited to, reducing the number of false positive query results and enhancing existing functionalities via predictive analysis. The contractor shall evaluate AI/ML applications in the construction of filters to remove undesirable data. The contractor shall deliver the research results to the PMO, including COAs for implementation.

3.2.1.21 The contractor shall evaluate AI/ML algorithms to suggest workflows for DCO and OCO operations to cyber operators. The contractor shall deliver the research results to the PMO, including COAs for implementation.

3.2.1.22 The contractor shall update and extend existing BDP integration services/applications to ensure backwards compatibility with integrations with older versions of the BDP platform (e.g., 5.0, IONIC, etc.).

3.2.1.23 The contractor shall alert and report when data feeds are no longer being received or are inactive and associated API Services, integration points, etc. Upon PMO direction, inactive data feeds shall be deprecated.

3.2.1.24 The contractor shall establish and report on metrics associated with operational utility and operationalization to inform design decisions and technical roadmaps.

3.2.1.25 The contractor shall use a Modular Open System Approach to enable cyber operators to selectively adopt capabilities that enable mission workflows.

3.2.1.26 The contractor shall use a system architecture that allows application and services to be incrementally added, removed, or replaced throughout the product life cycle.

3.2.1.27 The contractor shall develop a catalog of workflows with associated data products to include those shared via backend API services. These workflows will be tailored to operational use cases of JCC2 applications and will be labeled accordingly. The catalog shall be updated as necessary, to include each new relevant capability release. The catalog shall be accessible to entities as directed by the JCC2 PMO.

3.2.1.28 The contractor shall develop data analytics, applications, and services on Lower Echelon Analytic Platform Tactical (LTAC) or government designated equivalent environments for the purpose of geographically isolated, remote, non-connected systems.

3.2.1.29 The contractor shall provide the PMO with instructional and technical artifacts to build a knowledge repository that is accessible online to PMO staff and users. The contractor shall update and rerelease these artifacts as necessary.

3.3 Development

3.3.1 General Requirements

3.3.1.1 The contractor shall develop software using a DevOps process based on a commercial Agile methodology in government designated environment.

3.3.1.2 All active development shall occur in the JCC2 owned and managed GovCloud environment.

3.3.1.3 The contractor shall implement test-driven development.

3.3.1.4 The Contractor shall develop software using a government approved software pipeline. This includes all code checkout and code check-in for all building, automated and unit test, along with manual testing and deployment rehearsals. Development history shall be tracked and maintained throughout the lifecycle of the software supported.

3.3.1.5 The contractor shall have all build artifacts and deployment scripts source code documented within the government owned and managed environment.

3.3.1.6 The contractor shall provide all build containers, mirrors, dependencies, packing, packages, bundles and their associated bundling processes. These artifacts shall be maintained, sustained, and source controlled within the government owned and managed environment.

3.3.1.7 The contractor shall develop, test, deploy JCC2-R while integrating best of breed functionality into the

JCC2 designated environment.

3.3.1.8 The contractor shall develop and deploy capabilities within government-provided Amazon Web Services (GovCloud/Unclassified Commercial Cloud Services (UC2S)/Secret Commercial Cloud Services (SC2S)/C2S, other) environments as directed.

3.3.1.9 The contractor shall develop new capabilities and software products in response to requirements and priorities identified through the respective JCWA and JCC2 requirements governance processes.

3.3.1.10 The contractor shall develop digital engineering models to define system level requirements in JCC2 PMO provided tools such as Cameo and follow JCC2 PMO style guides.

3.3.1.11 The contractor shall use JCC2 PMO designated enterprise software development platforms and tools to design, code, build, test, integrate, and deploy new capabilities.

3.3.1.12 The contractor shall demonstrate three years or more of experience building ingress and egress pipelines for different sizes of data platforms such as, but not limited to, BDP, LTAC, LEAP, IONIC, and Postgres.

3.3.1.13 The contractor shall apply Model-Based Systems Engineering (MBSE) principles and practices to define, design, and document complex systems and architectures using Systems Modeling Language (SysML), Unified Architecture Framework (UAF) and UML.

3.3.1.14 The contractor shall develop, maintain, and update system models that represent system requirements, components, integrations, data flows, characteristics, behaviors, interactions, and designs in a complete, accurate, and consistent manner and format. The contractor shall ensure these models meet project objectives, standards, and performance requirements and shall provide them to the JCC2 PMO upon creation.

3.3.1.15 The contractor shall ensure a specific focus on the Human Systems Integration, Human Factors Engineering, and UX design to ensure a common look and feel of the user-facing features, as directed by the JCC2 PMO.

3.3.1.16 The contractor shall design UX that minimize operator workload, streamline workflow of operations, are accessible to individuals with color deficient vision, etc., as directed.

3.3.1.17 The Prime contractor shall maintain and operate at a minimum Capability Maturity Model Integration (CMMI) Services or Development Level 4.

3.4 Enterprise Services

3.4.1 General Requirements

3.4.1.1 The contractor shall possess Certified GovCloud skills required to support all AWS application deployments to include but not limited to Impact Level (IL) 2,4,5, 6, 7.

3.4.1.2 The contractor shall ensure all production systems and capabilities have a one (1) hour restoration to service timeframe.

3.4.1.3 The contractor shall design and provide Infrastructure as Code (IaC) & Config as Code (CaC) to ensure reliability and repeatability across all security domains.

3.4.1.4 The contractor shall design, provide, and execute the semi-automated deployment process, across NIPR, SIPR, and JWICS as directed by the JCC2 PMO.

3.4.1.5 The contractor shall perform installations and deliver instructions for installing and operating the system with a rigorous definition of the runtime execution environment.

3.4.1.6 The contractor shall conform to external instrumentation tools to collect metrics for observability on the runtime environment.

3.4.1.7 The contractor shall establish and report on metrics associated with operational utility and operationalization of the JCC2-R application.

3.4.1.8 The contractor shall provide subject matter expert services and mentoring support to assist members in Tier 1, Tier 2 and JCC2 Field Operations support contractors.

3.4.1.9 The contractor shall adhere to established government directed escalation, resolution, reporting guidelines for problem, incident management across all affected systems and tiered levels of support. The contractor shall support Technical Engineering Management (TEMs) with other JCC2 contractor support.

3.4.1.10 The contractor shall provide training materials, such as online help and training to assist members in Tier 1 and Tier 2 troubleshoot problems reported by users.

3.4.1.11 The contractor shall, as directed by the JCC2 PMO, provide Ask Me Anything sessions, technical services, and mentoring support to assist product owners, product managers, engineers, and any PMO designated representative in understanding and demonstrating product lines with block diagram requests delivered within 30 days of request and approved by Product Manager or Lead Engineer.

3.4.1.12 The contractor shall provide zero-downtime deployments as well as blue/green deployments to support agile software delivery on all security domains.

3.4.1.13 The contractor shall maintain and support the JCC2-R DevSecOps stack at the unclassified level with deliveries across multiple security classifications.

3.4.1.14 The contractor shall leverage existing JCC2 infrastructure to containerize and deploy software in accordance with a Kubernetes-based platform for PMO-directed environments.

3.4.1.15 The contractor shall develop JCC2 IaC/CaC to be cloud deployable; they shall automate patching, STIG implementations, production deployments, leveraging technologies such as Cloud Formation, Ansible, Helm and Kubernetes Operators and/or similar.

3.4.1.16 The contractor shall provide systematic patching, STIG implementations, and upgrade strategies for production deployments. Strategies shall be deterministic in an unclassified development, test or pre-production/staging environment and shall be leveraged to reduce operational risk. These maintenance efforts shall be automated for rapid implementation and cannot delay production application capability upgrades.

3.4.1.17 The contractor shall adhere to Air Force cybersecurity standards and the JCC2-designated software security processes across all classified and unclassified environments.

3.5 Risk Management Framework

3.5.1 General Requirements

3.5.1.1 The contractor shall assist or provide any accreditation documentation following DoD best practices such as the Risk Management Framework (RMF) process.

3.5.1.2 The contractor shall produce DODAF artifacts required for acquisition compliance and/or JCC2 architecture/security compliance.

3.5.1.3 The contractor shall assist with compiling System Security Packages (SSPs) within eMASS and Xacta, to include drafting network diagrams, completing security control checklists, validating configurations, reviewing logs, collecting backup documentation for security controls inherited from the platform, and collecting documentation for an overlay of security controls for data stored and processed by the application.

3.5.1.4 The contractor shall utilize HP Fortify to run security scans of JCC2-R on a monthly basis.

Upon receiving the results of these Fortify scans, the contractor shall analyze them to determine which results are false positives and which results are genuine vulnerabilities. Any vulnerabilities found shall be reported to the PMO along with a remediation plan. The remediation plan shall include the level of effort and resources needed to remediate any found vulnerabilities. The contractor shall remediate all vulnerabilities, accordingly, prioritizing critical and high vulnerabilities.

3.5.1.5 The contractor shall support Portfolio processes and activities for Risk Management Framework (RMF), Assessment and Authorization (A&A), and Certification and Accreditation (C&A) across multiple programs on multiple domains.

3.5.1.6 The contractor shall provide support with FISMA, RMF, Defense Information Systems Agency (DISA) STIGs, and NIST publications, as they apply to apply DoD security processes for assessment of Information Systems.

3.5.1.7 The contractor shall perform routine review of documentation and compare against live information systems to ensure information is up to date and accurate.

3.5.1.8 The contractor shall perform patching, and implementing DISA STIGs (Security Technical Implementation Guide), and DoD IAVM (Information Assurance Vulnerability Management).

3.5.1.9 The contractor shall support and develop POA&Ms (Plans of Action & Milestones) to remedy system security shortfalls.

3.5.1.10 The contractor shall perform Tenable Nessus or similar vulnerability scans, to scan targeted systems to meet security needs.

3.5.1.11 The contractor shall support Implementation of NIST Special Publication 800-53 controls and ensure they protect an information system.

3.5.1.12 The contractor shall support creation of any reference material and/or updating data sources for internal/external use between the JCC2 PMO and stakeholders, upon JCC2 PMO direction.

3.5.1.13 The contractor shall support all Information System Security Officer (ISSO) / Information System Security Manager (ISSM) activities and support all Information System security engineering efforts.

3.5.1.14 The contractor shall create and continuously update the JCC2 DevSecOps documents, such as a Developer Guide. All resulting documentation shall be delivered to the JCC2 PMO.

3.5.1.15 The contractor shall maintain and converge CI/CD pipelines into as few as possible, to support a wide variety of software languages and software product teams as directed by the government.

3.5.1.16 The contractor shall work with software development product teams to troubleshoot different aspects of JCC2’s CI/CD pipelines or other developer’s issues.

3.5.1.17 The contractor shall continuously monitor and deploy JCC2 software products into a multitude of classified and unclassified environments.

3.5.1.18 The contractor shall modify infrastructure software based on approved CRs, JCWA operational requirements, capability needs statements (CNS), and other validated requirements.

3.5.1.19 The contractor shall provide support to the JCC2 developmental and operational test agencies as directed.

3.5.1.20 The contractor shall follow JCC2 designated processes in attaining Authority to Operate (ATOs) or CTFs for new capabilities/applications on NIPRnet, SIPRNet, and

JWICS.

3.5.1.21 The contractor shall maintain the application, and both the development and operational environments in accordance with DoD Security directives (for example, STIGs, IAVAs for OS, application, third party applications).

3.5.1.22 The contractor shall report metrics on mission applications performance and resource availability.

3.6 Accreditation

3.6.1 General Requirements

3.6.1.1 The contractor shall support, as directed by JCC2, the individual DoD BDP owners to facilitate RMF processes to maintain application accreditation when deployed on operational systems to include NIPR, SIPR, and JWICS instances.

3.6.1.2 The contractor shall develop and deploy capabilities within authorized government provided platform i.e. Amazon Web Services (GovCloud/UC2S/SC2S/C2S).

3.6.1.3 The contractor shall ensure, unless an exception to policy is issued from the Program Manager, all enclaves will be current within the timeframe required by the Information Assurance Vulnerability Alert/Bulletin, patch, Security Technical Implementation Guide (STIG), or Computer Network Defense (CND) directive.

3.6.1.4 The contractor shall update all IAVA, patching, STIG, or related tracking databases within five (5) business days of the successful corrective action.

3.6.1.5 The contractor shall continuously coordinate with JCC2 infrastructure personnel to maintain compatibility with configuration management and configuration control over all aspects of the development environment, operational environment, and software version control.

3.6.1.6 The contractor shall support internal and external audits.

3.6.1.7 The contractor shall ensure that all services meet the requirements of RMF and applicable standards and guidance.

3.6.1.8 The contractor shall take actions to prevent and halt the compromise of the JCC2 systems.

3.6.1.9 The contractor shall implement technical solutions to meet certification and accreditation requirements.

3.6.1.10 The contractor shall assist in defining user and registration requirements to Local Registration Authorities (LRAs).

3.6.1.11 The contractor shall support user creation (identity confirmation, credentialing, and enrollment), user management (provisioning across single or multiple systems and services, automated provisioning workflow and self-service), user access (identification, authentication, and authorization) and user revocation (de-provisioning and disablement). Provide access controls with rights, roles, and privileges. Authorize access to data based on groups and roles as approved in DD Form 2875 and other approved methods.

3.6.1.12 The contractor shall use government-approved methods of authentication such as, but not limited to, the following:

• Public Key Infrastructure (PKI) based authentication

• AccessIT provided services or other enterprise ICAM solutions

• One-Time Password Tokens

3.6.1.13 The contractor shall support and implement Disaster Recovery and Continuity of Operations Plans (COOP) upon direction by the government.

3.6.1.14 The contractor shall monitor logging activities to provide for both real time assessment and historical analysis and build dashboards with the reported metrics to support IT OPs.

3.6.1.15 The contractor shall coordinate with JCC2 infrastructure personnel to maintain cross-domain information sharing across networks operating at different classification levels (e.g., SIPRNet, NIPRNet and JWICS).

3.6.1.16 The contractor shall determine applicability of Information Assurance Vulnerability Alert (IAVA) Time Compliance Tech Orders (TCTOs) and Time Compliance Network Orders (TCNOs) and evaluate for integration impacts to ensure systems are in compliance by required order date or by approved alternate date as documented on a Plan of Action and Milestone (POA&M) document. Also, ensure all associated engineering drawings and models are updated with system changes and provided to the Program Office.

3.7 Test and Evaluation

3.7.1 General Requirements

3.7.1.1 The contractor shall provide test support to the JCC2 developmental test and evaluation activities and deliver test results.

3.7.1.2 The contractor shall provide test support to the JCC2 operational test, version release test, user acceptance test, cyber security testing, and any other JCC2 approved evaluation activities, and deliver test results.

3.7.1.3 The contractor shall provide test support to the JCWA test and evaluation activities and deliver test results.

3.7.1.4 The contractor shall design and provide automated testing processes and services.

3.7.1.5 The contractor shall identify, track, and report test deficiencies to JCC2 PMO with change recommendations.

3.7.1.6 The contractor shall conduct unit, security and integration testing and provide test data, test results, and test reports.

3.7.1.7 The contractor shall conduct Contractor Testing (CT) that enables independent Development Testing (DT) and Operational Testing (OT).

3.7.1.8 The contractor shall provide JIRA/Confluence access to PMO, DT, and OT organizations to support independent testing.

3.7.1.9 The contractor shall provide a workflow to enable PMO, DT, and OT organizations the ability to input deficiency reports

3.7.1.10 The contractor shall support AFOTEC when conducting Operational Test events.

3.7.1.11 The contractor shall support PMO engineers in the review of 47th Cyber Test Squadron bug reports on JCC2-R application. Upon approval by the PMO engineers, the contractor shall implement any necessary patches to resolve these bugs.

3.8 Systems Security Engineering

3.8.1 General Requirements

3.8.1.1 The Contractor shall define a Systems Security Engineering approach captured in the Systems Engineering Management Plan (SEMP) to meet the technical and management requirements as part of the overall systems engineering process documented in the Systems Engineering Plan (SEP).

3.8.1.2 Shall trace all Systems Security Engineering requirements including Program Protection, Cybersecurity, Cyber Survivability, Cyber Resiliency, Trusted Systems and Networks (TSN), Anti-Tamper, and Information Protection (IP) in the Requirements Traceability Verification Matrix (RTVM).

3.8.1.3 Shall establish Cybersecurity, Cyber Survivability and Cyber Resiliency requirements into architectural designs that incorporates NIST 800-53 controls in accordance with DoDI 8500.01, DoDI 8510.01, DoDI 5200.44, DoDI 5200.39, and DoD Zero Trust Reference Architecture.

3.8.1.4 Shall extract the lower-level Cyber Survivability Attributes for SS KPPs as defined by the Cyber Survivability Endorsement Implementation Guide (CSEIG).

3.8.1.5 Shall integrate and verify Safety Critical Functions (SCFs), Mission Critical Functions (MCFs), and Critical Program Information (CPI) identified have appropriate segregation and redundancy in the architectural design for successful mission execution.

3.8.1.6 Shall develop a Test and Evaluation Program Plan that includes cyber testing and is aligned to the Government developed Test and Evaluation Master Plan.

3.8.1.7 Shall support Government participation in all Cyber Table-Top activities and cyber testing, including Government laboratories testing.

3.8.1.8 Shall update cyber risks identified during Cyber Table-Top activities and during risk assessments to include Supply Chain Risks.

3.8.1.9 Shall participate in Government-led IPT or System Security Working Group (SSWG) to provide technical contribution to the Government’s program protection planning and SSE activities.

3.8.1.10 Shall produce hardware and System/Software Integration Library (SIL) for the Government to conduct cyber testing.

3.8.1.11 Prepare the Software Metrics Data Report (SMDR) in accordance with DI-MISC- 80508B.

3.9 Cybersecurity, Cyber Survivability, and Cyber Resiliency

3.9.1 General Requirements

3.9.1.1 The contractor shall provide a cybersecurity strategy implementation plan that corresponds to the Government’s Cybersecurity Strategy detailing, at a minimum, the cybersecurity environment, cyber survivability, cyber resiliency, requirements, and assessments which includes items from the Cybersecurity Implementation Plan.

3.9.1.2 Shall align to the Government Security Classification Guide to ensure appropriate level of classification for specific information elements determined to be a risk to National security in accordance with DoDM 5200.45.

3.9.1.3 Shall conduct a Failure Modes, Effects and Criticality Analysis (FMECA) for the identification of all conceivable method of potential failures.

3.10 Program Protection

3.10.1 General Requirements

3.10.1.1 Shall deliver a Program Protection Implementation Plan (PPIP) in accordance with the Government established Program Protection Plan (PPP) detailing, at a minimum, the contractor’s approach for implementing the Government PPP, process for identifying CPI during developmental phases and protection, assessment, and special handling measures for CPI as well as the Supply Chain Management, OPSEC, and Anti- Tamper plans.

3.10.1.2 Shall implement a formal incident response reporting plan in accordance with AFI 17- 203, AFMAN 10-206, and CJCSM 6510.01B.

3.10.1.3 Shall conduct a Functional Thread Analysis and Atack Path Analysis to assess entry access points and associated risks in accordance with DoDI 5200.44, DoDD 5200.47E, and DoDI 5000.39 for use during risk assessments.

3.10.1.4 Shall identify and document all internal and external system interfaces in accordance with the Interface Control Document (ICD).

3.10.1.5 Shall deliver a Contractor Data Management Plan (CDMP) that shall be used throughout the lifecycle.

3.10.1.6 Shall provide an Anti-Tamper plan in accordance with DoDD 5200.47E and shall include an Anti-Tamper Verification Plan.

3.11 Supply Chain Risk Management

3.11.1 General Requirements

3.11.1.1 Shall conduct a Software Assurance Evaluation on Non-Developmental Item (NDI) software to assess supply chain and cybersecurity vulnerabilities which shall include a Software Assurance Evaluation Report.

3.11.1.2 The contractor shall develop a Supply Chain Risk Management (SCRM) plan describing, at a minimum, the strategy for identifying, assessing, handling, and monitoring risks in the supply chain lifecycle along with detailed training to promote SCRM practices.

3.11.1.3 Shall include in the SCRM plan a strategy to protect the supply chain from exploitation via various means such as insertion of counterfeits, malicious software and hardware, etc. that adversaries could leverage to affect system operations.

3.11.1.4 Shall provide a Supply Chain Risk Register for the identification and tracking to include system level parts down to the lowest level components. Tracking of supply chain risks including a risk reporting matrix.

3.11.1.5 Shall perform acceptance testing on lowest Critical Component and components containing CPI in accordance with the Counterfeit Prevention Plan.

3.11.1.6 Shall produce a Bill of Materials (BOM) for the identification, forecasting, mitigation and management of hardware and software

3.12 Trainer of Trainer

3.12.1 General Requirements

3.12.1.1 The contractor shall develop and sustain interfaces and exchange information with the

JCC2-directed cyber training environment for JCC2 applications training.

3.12.1.2 The contractor shall develop, deploy, and update training material and technical specifications for each release.

3.12.1.3 The contractor shall provide application sustainment engineering support, documentation support (maintain and update JCC2 documents), integration work, training support to JCC2 third party Field Application Engineering training contractors, and other forms of support for

JCC2.

3.12.1.4 The contractor shall collaborate with the JCC2 Field Engineering and training efforts for on-site training and exercise support, as required. All training shall be coordinated and approved with the JCC2 PMO offices.

3.12.1.5 The contractor shall deliver training material in digital formats (e.g. video, manuals, etc.) as defined by the PMO, showing step-by-step completion of tasks (e.g., fill in a SIGACT report), and include a section for troubleshooting common problems that users may encounter while using the system. The material must be available to users through the JCC2 Landing Page.

3.12.1.6 The contractor shall develop, deploy, and update training material and technical specifications for each program increment cycle.

3.12.1.7 The contractor shall provide direct training and instruction to personnel as instructed by JCC2. The content and/or medium of each instance of training will be tailored to JCC2 specification. Any materials or resources developed to support this training must be available to all users through the JCC2 Landing Page with appropriate labeling conventions to convey the specific audience and operational need addressed by the training.

3.12.1.8 The contractor will support JCC2 in reviewing current online training suites for JCC2-R application and will modify them as necessary, up to and including the creation of a completely original online curriculum. The contractor will ensure the online training provided will include training for basic operators of each system as well as an in-depth instructor level curriculum. Instructor training will provide students with the knowledge and materials to provide an operator level training themselves. Ensure the Instructor training includes all the roles and visibilities necessary to provide the operator level training themselves. The Contractor will include recommendations for which system workflows, capabilities, and integrations would be beneficial to accomplish the current and future mission requirements.

3.12.1.9 The contractor shall develop and sustain interfaces and exchange information with the Persistent Cyber Training Environment (PCTE) for training of JCC2 applications.

3.13 Tier 3 Support

3.13.1 General Requirements

3.13.1.1 The contractor shall sustain, modify, migrate, evaluate, test, and package system and software changes, and provide problem resolutions for JCC2. This includes all supporting software and any future applications added to the JCC2 portfolio on all security domains. The contractor shall manage and sustain the current and future JCC2 baseline and integrate changes, problem fixes, modifications, and modernizations to the baseline as required.

3.13.1.2 The contractor shall adhere to established government directed escalation, resolution, reporting guidelines for problem, incident management across all affected systems and tiered levels of support.

3.14 Planning Increments (PI) Metrics

3.14.1 General Requirements

3.14.1.1 The contractor shall adhere to JCC2 agile governance as it applies to Program Increment planning process.

3.14.1.2 The contractor shall synchronize software development with JCC2 agile cadence.

3.14.1.3 The contractor shall report metrics on mission applications performance and resource availability.

3.14.1.4 The contractor shall provide the Program Office all modified or converted processes, programs, scripts, operating instructions, installation procedures, documentation, test files and test conditions used to satisfy each approved system’s Change Request (CR).

4 Team Composition and Special Qualifications Section 4 addresses the team composition and special qualifications.

4.1 Workforce Management

4.1.1 General Requirements

The list of requirements detailed in this section changes frequently to meet emerging requirements and priorities established by the operational community due to the continuously evolving cyber threat and the variety of techniques used by cyber adversaries along with the maturation of cyber concepts of employment with the joint community. As a result, these requirements are representative, but not comprehensive.

4.1.1.1 The contractor shall demonstrate their ability to respond to the changing environment through its proposed staff training programs and system modification processes.

4.1.1.2 The contractor shall support/manage JCC2 capability baselines on NIPR, SIPR, & JWICS within JCC2-directed GovCloud environments.

4.1.1.3 The contractor shall fill key positions, at the locations identified, with the clearances, qualifications, and access required to fulfill this contract within 15 business days of contract award date.

a. Key positions cannot be dual hatted.

b. Residual billets must be filled within 20 business days of contract award date.

c. One means of demonstrating this ability is to furnish sanitized resumes, or acceptable evidence of qualifications of the individuals the contractor would place into each of the positions.

The following section describes the services for JCC2-R. The government approach to team composition is to construct each development team as an integrated product team that excels in requirements gathering, decomposition, prioritization, development, testing, deploying, and sustaining feature deliveries.

4.1.1.4 The contractor shall be responsible for the employment, guidance, supervision, and training of all personnel assigned to perform tasks under this contract.

JCC2-R Development Team

Objective: JCC2-R Development and Support is a part of the JCC2 Battle Management portfolio. It includes mission application development, maintenance/sustainment, integration support, and/or containerization/modernization of JCC2-R application. This team will be required to work with other teams within the JCC2 portfolio to achieve an integrated and interoperable functionality and common visual design to the JCC2 user community.

4.2 JCC2-R Team: JCC2-R Application

Summary:

JCC2-R leverages an established Development team which delivers capability for the Department of Defense (DoD) operational community. JCC2 established a pipeline that quickly reacts to operational needs in the form of operational requirements, prioritized by the Functional Area Requirements Working Group (FARWG). JCC2-R takes this requirement, rapidly develops features, and deploys operational prototype capabilities, then continuously iterates on those capabilities to incorporate operational feedback. The PMO is not looking for new applications but to maintain the current baseline and iterate continuous development on current JCC2-R application.

JCC2 delivers integrated solutions that provide decision makers, planners, analysts, and operators at all JCC2 echelons with capabilities that facilitate cyber situational awareness, rapid planning, course of actions selection, orders development, dynamic mission management, decision support, and unified direction of cyber mission forces. JCC2-R provides curated operational mission data and force readiness information using cloud-based platforms that enable teams to plan, track, execute, and report on cyber operations in near real time across the DoD.

Background:

• Common applications include but not limited to: Apache Spark, Apache Airflow, and MapReduce

• Common Application Programming Interface (API) include but not limited to: JAX-RS, Javalin, OpenAPI, Jackson, Java, Scala, Python, R, R-Shiny, Swagger

• Common build automation tools include but not limited to: Git Enterprise (or derivatives such as Git), Jenkins, Artifactory, Docker, Docker Registry, Apache Maven, Selenium, Satellite, and HP Fortify

• Common Infrastructure as Code (IaC) and Configuration as Code (CaC) for deploying and managing various Cloud Native Computing Foundation (CNCF)-compliant Kubernetes distributions include but not limited to: EKS, Terraform, Apache Zookeeper, HashiCorp Consul, Spring, RedHat Enterprise Linux.

• Additional technologies include but not limited to: Python (with Flake8, PyLint),…