JCO SOW Draft rev A.1.pdf

Joint Cyber Command and Control (JCC2) Cyber Operations Development and Sustainment (JCO) Statement of

Work (SOW)

30 January 2026

Name: JCO Development and Sustainment

Organization: Cryptologic and Cyber Systems Division (AFLCMC/HNCJ)

Address: 230 Hall Blvd San Antonio, TX 78226

Executive Summary

The JCO Development and Sustainment contract will provide rapid capability development and operational readiness leveraging industry best-practices and innovative solutions to ensure Joint Cyber Command and Control (JCC2) meets operational requirements and matures existing government owned software in an efficient and effective manner. Tasks may include but are not limited to new software development, sustainment, cradle to grave engineering analysis, software modification, maintenance, and enhancement, maturing of existing architecture and infrastructure. Along with providing support for interoperability with other systems, developing and facilitating system integration services, supporting operational deployments, and modeling the current application architecture and interdependencies.

JCO requirements have primarily targeted high value and specific workflows for rapid development, delivery, and adoption. JCC2 will build upon the lessons learned and leverage day-to-day operational data and operational workflows to feed the development of the information and intelligence required for joint strategic decisions. Additionally, JCO relies heavily on operational solutions with wide adoption, thus building a foundational understanding of persistent shared problem sets across the Department of War (DoW).

As a result, the level of expertise required to fulfill JCO requirements is very high; it is a must that the contractor has qualified and experienced, manual and automation testers, full stack developers, Front End developers, Back End developers, system engineers, integrators, release management engineers, DevOps engineers, Data Model Engineers, subject matter expertise, and product designers. The contractor’s ability to quickly increase and decrease the number of staff and development teams to match dynamic support requirements is critical. This SOW identifies the overarching requirements of the JCO effort.

Table of Contents:

• 1. Purpose

• 2. Scope

• 3. Requirements and Description of Work

• 4. Team Composition and Special Qualifications

Table 1: JCO Mission Application (subect to change)

Table 2: JCO Personnel Staffing

Table 3: Minimum Skills, Experience, Required Certifications

• 5. Surge Requirements

• 6. Project Management/Requirements Processing

Table 4: Staffing Timeline Requirement

Table 5: Services Delivery Table

• 7. Security Management

• 8. Deliverables

Table 6: JCC2 required CDRLs

Table 7: Applicable Publications

Table 8: Directive Documents

• 1. Purpose This effort is to provide development, maintenance, and engineering services for the JCO application and related initiatives for JCC2. The Period of Performance (PoP) is one (1) year base, plus four (4) one-year options. The purpose of the JCO effort is to provide Joint Cyber Command and Control (JCC2) Scaled Agile Framework (SAFe) Agile software development and maintenance/sustainment support deployment of capabilities through application releases, containerization, integration, and data engineering work. JCO shall fulfill this purpose by leveraging Continuous Integration/Continuous Deployment (CI/CD) workflows, while providing responsive engineering and technical support to JCC2 and external organization’s systems.

• 2. Scope The services required under JCO include all disciplines required for software development and maintenance/sustainment of the JCO application Support work will be applicable to all systems and activities within the JCO portfolio supporting mission operations locally and remotely. The contractor shall:

2.1 Modernize or refactor the JCO software application, services, architecture, and component technologies to support industry standards, best practices and capability optimization to include but not limited to, containerized technologies, modularization, and microservices.

2.2 Integrate JCO capabilities with internal or external solutions or technologies, as needed, for system, data, and technology stack interoperability. Integration and interoperability enhance the JCC2 portfolio of service offerings based on growing needs and changing requirements as directed by JCC2.

2.3 Develop new capabilities and software products in response to requirements and priorities identified through the Joint Cyber Warfighting Architecture (JCWA) requirements process and/or JCC2 Program Management Office (PMO) directives.

2.4 Provide enterprise services that include:

2.4.1 Develop, design, provision, manage, integrate, and automate software CI/CD pipelines to deliver software based on the development and security requirements defined by hosting environments to streamline workflows through built-in automation, testing, and collaboration.

2.4.2 Support Cyber Security/Accreditation activities for the deployment of the JCO application in the hosting environments.

2.4.3 The contractor shall provide Tier 4 support to all production systems and capabilities within a one (1) hour restoration to service timeframe.

2.5 Perform and report on Contractor Tests to include but not limited to: (CDRL 013)

2.5.1 Perform unit testing, integration testing, system testing, regression testing, and Performance Testing;

2.5.2 Support the Lead Developmental Test Organization (LDTO) in its Developmental Testing efforts;

2.5.3 Support Mission Based Cyber Risk Assessments (MBCRA) including

Cooperative Vulnerability Identification (CVI) and Cyber TableTop (CTT) events.

2.6 Support Operational Test (OT) and test artifact development with the Operational Test Agency (OTA):

2.6.1 Support the Joint Integration Office (JIO) Test and Evaluation (T&E) process to evaluate capabilities in the context of the JCWA;

2.6.2 Establish and report on metrics associated with software development and maintenance/sustainment, infrastructure, and operational measures of performance as directed by JCC2 PMO.

2.7 Provide application metrics as directed by the PMO.

2.8 Create, maintain, and update JCO documentation.

2.9 Provide training support as directed by the PMO to include, but not limited to, train-the-trainer and 3rd party vendor support.

2.10 Support the JCC2 Enterprise Service Center (ESC) on JCO Infrastructure related requirements

• 3. Requirements and Description of Work This section provides a broad scope of work required under this contract focusing on direct mission support.

3.1 Lifecycle Support

3.1.1 The contractor shall develop, test, and sustain the JCO application within the JCC2 designated environment while adhering to industry best practices, including but not limited to: coding standards, version control, defined levels of testing, comprehensive documentation, and software configuration control.

3.1.2 The contractor shall manage enterprise-level application software releases and maintain configuration management baseline standards and document changes within Government-directed environments.

3.1.3 The contractor shall support requirement analysis, security impact analysis (SIA), engineering impact assessments, and multiple courses of action (COAs) in response to requirements as directed by JCC2 PMO. The contractor shall develop capabilities and support the deployment of a new capability releases within government-managed cloud service(s).

3.1.4 The contractor shall propose progressive or efficient software technologies, management tools, processes, architectural changes, security solutions, or engineering methods to the government for evaluation to improve software lifecycle management of the JCO application.

3.1.5 The contractor shall maintain the JCO application on the JCC2 designated development, test, exercise, and operational environments in accordance with DoW Security directives (for example, STIGs, Information Assurance Vulnerability Alerts (IAVAs) for OS, application code scans, infrastructure scans, and other applicable third-party security applications).

3.1.6 The contractor shall provide design services or wireframes of User Interface/User experience (UX), UX flows, graphics design, videos, information architecture (IA), and associated materials enhancing user adoption, as directed by the JCC2 PMO. (CDRL A007)

3.1.7 The contractor shall develop software using a DevOps process based on JCC2’s approved software pipeline and SAFe Agile methodology in government designated environment.

3.1.8 The Contractor shall develop COA documentation supporting any alternative to Government directed DevOps process and CI/CD pipeline when requested by the JCC2 PMO.

3.1.9 The contractor shall support the transition from one cloud broker to another cloud broker as requested by JCC2.

3.1.10 The contractor shall release software updates and associated/supporting documentation (release notes, training documentation, and user/feature guides) in accordance with the Program Increment planned/committed work, and/or when critical updates are required.

3.1.11 The contractor shall generate and maintain a Software Bill of Materials (SBOM) for all applications enabling the understanding of the application lifecycle. The SBOM shall contain, but is not limited to, supplier name, component names, component versions, unique identifiers (i.e., Common Platform Enumeration (CPE), Software Identification (SWID) tags, Package Uniform Resource Locators (PURL), etc.), dependency relationships, author of SBOM data, timestamps, source code location/URL, history of JCO code submissions, licensing/registration/warranty information, costs, utilization, risk management, and cryptographic signatures, as designated by the PMO.

(CDRLL A008)

3.1.12 The contractor shall prepare and provide a Software Metrics Data Report.

(CDRL A007)

3.1.13 The contractor shall deliver an updated SBOM to the Program Manager, COR, Lead Engineer, Cybersecurity, and Product Support at the end of each quarter or as directed by JCC2 PMO.

3.1.14 The contractor shall incorporate build tools that automatically create SBOMs based on the actual build of the software and reduce the need for manual updating (i.e., Software Composition Analysis tools).

3.2 Integration

3.2.1 The contractor shall develop, retire, and sustain interfaces and exchange information with Big Data Platform (BDP)s as directed by the JCC2 PMO.

3.2.2 The contractor shall develop APIs to ingest/publish data from authoritative data ges as designated by the JCWA requirements process.

3.2.3 The contractor shall develop APIs to share information with other systems conforming to specifications (e.g., OpenAPI) and data standards/specifications (e.g., SchemaOne, STIX) as directed by JCC2 PMO.

3.2.4 The contractor shall implement data standards/specifications, data interfaces, data models, and data schemas necessary to support capability integration with other systems and conform to JCC2 system requirements for interoperability and integration across JCC2 applications.

3.2.5 The contractor shall produce an integration and runtime document that defines the interface architecture and data exchanges that serves as a reference to other developers of JCC2 applications for sharing data across applications and/or using common data stores. This document shall be updated once per quarter (at a minimum) along with the Change Management System of Record and delivered to the JCC2 Chief Engineer (CE), Battle Management Lead Engineer (BMLE) and COR.

3.2.6 The contractor shall deliver and maintain an up-to-date topology diagram that serves as a reference for APIs to facilitate data integration and software reuse.

3.2.7 For every new API connection, the contractor shall collaborate with the Cybersecurity Team to complete/answer all necessary security controls to secure formal integration approval from the Designated Authorizing Official (DAO) and/or Authorizing Official (AO) responsible for their approved environments. The contractor shall create and deliver a JCO Error Messaging & UX Content Guide. This document shall govern the content and design of all-user-facing error messages and exception, ensuring they are context-aware and provide clear guidance to the end-user.

3.2.8 The contractor shall implement and document an Automated/Manual Error Reporting Process. This process/tool shall be configured to capture and report on all application errors and code bugs, providing the necessary technical detail for efficient triage and resolution by the development team.

3.2.9 The contractor shall produce DOWAF artifacts required for acquisition compliance and/or JCC2 architecture compliance as required.

3.2.10 The contractor shall assist in decomposing data and interface integration requirements pertaining to JCC2 applications to deliver data products to the operational community, as directed by the JCC2 PMO.

3.2.11 The contractor shall refactor capabilities and migrate datasets into shared data stores with data interfaces to facilitate purposeful integration pertaining to the JCO application.

3.2.12 The contractor shall implement automated analysis and fusion of workflow related structured and unstructured data to minimize user workload or errors. The automated process should include artificial intelligence (AI)/machine learning (ML) algorithms that meet the operation requirements for data quality and integrity.

3.2.13 The contractor shall modernize the UX flows and information architecture of the JCO application as directed by the JCC2 PMO, to prevent duplication of features across JCC2 applications.

3.2.14 The contractor shall support the JCC2 PMO in conducting sessions with cyber warfighters to identify capabilities needs and construct journey maps.

3.2.15 The contractor shall work with JCC2 PMO to develop and prioritize objectives and features in support of capabilities development.

3.2.16 The contractor shall work with JCC2 PMO to refine and maintain the Agile Release Train (ART) and Product Owner (PO) level backlog items to identify aging items, enablers, and changes to existing items.

3.2.17 The contractor shall support the POs in the decomposition of JCC2 PMO accepted requirements to define a government owned feature backlog.

3.2.18 The contractor shall support the evaluation and resolution of field operational requests as directed by the JCC2 PMO.

3.2.19 The contractor shall provide technical support on the installation and troubleshooting of the JCO application as directed by the JCC2 PMO.

3.2.20 The contractor shall evaluate and/or develop AI/ML algorithms to suggest workflows for DCO and OCO operations to cyber operators.

3.3 Big Data Platform Integration

3.3.1 The contractor shall support technical exchange meetings as directed by the JCC2 PMO to support existing and new data integration efforts associated with the Big Data Platform (BDP) of the PMO’s choice in support of JCWA’s objectives.

3.3.2 The contractor shall develop technical solutions as directed by the JCC2 PMO to support the collaboration and information sharing of technical artifacts associated with the BDP of the PMO’s choice in support of JCWA’s objectives.

3.3.3 The contractor shall provide metrics and activity logs of the data shared with the BDP. (CDRL A007)

3.3.4 The contractor shall provide the JCC2 PMO with instructional and technical artifacts to support a knowledge repository that is accessible JCC2 PMO.

(CDRL A006; CDRL A007)

3.4 Development

3.4.1 The contractor shall develop new capabilities and software products in response to requirements and priorities identified through the respective JCC2 PMO requirements governance processes.

3.4.2 Strategic investment activity will focus on development of new approaches and stay technologically current to inform the spiral delivery of data analytics, visualization, dashboards, with an emphasis of delivering capabilities that empower users at organizational levels to plan and manage all-domain operations and facilitate decision making.

3.4.3 Development shall include improving visualization dashboard creation and utilization to improve the management and planning of OCO and DCO missions.

3.4.4 To align to the JCC2 PI Planning, sprint review, and IPT processes and reflect JCWA objectives along with operational priorities, the software development team:

3.4.4.1 Shall be responsible for JCO capability development, support, and reporting within the JCC2 SAFe Agile framework.

3.4.4.2 Shall support PI-Planning activities, in which development priorities are selected, evaluated for technical scope, risks and dependencies, then formally committed to as PI deliverables.

3.4.4.3 Shall support Scrum reviews with members of the PMO to review development progress, prioritize subsequent development, and curate the long-term development backlog.

3.4.4.4 Shall support Technical Exchange Meetings (TEMs) as needed to gain clarity on requirements, decompose them into their corresponding development efforts, and confirm the way forward with the requirement owner(s).

3.4.4.5 Shall support a showcase of capabilities developed over the course of each JCC2 Program Increment, as directed by the JCC2 PMO, to include but not limited to the creation of videos, documentation and live demonstrations.

3.4.4.6 Shall support the JCC2 PMO with the mapping of development efforts to the respective requirement(s).

3.4.5 The contractor shall develop and support the maintenance of digital engineering models to define system level requirements in JCC2 PMO provided tools, such as Cameo. (CDRL A017)

3.4.6 The contractor shall apply Model-Based Systems Engineering (MBSE) principles and practices to define, design, and document complex systems and architectures using Systems Modeling Language (SysML), Unified Architecture Framework (UAF) and Unified Modelling Language (UML).

3.4.7 The contractor shall develop, maintain, and update system models that represent system requirements, components, integrations, data flows, characteristics, behaviors, interactions, and designs in a complete, accurate, and consistent manner and format.

3.4.8 The contractor shall create and maintain system architecture models, ensuring they meet project objectives, standards, and performance requirements.

3.4.9 The contractor shall collaborate with stakeholders to elicit, analyze, and manage system requirements, ensuring traceability and alignment with system models.

3.4.10 The contractor shall ensure a specific focus on the Human Systems

Integration, Human Factors Engineering, and UX design to ensure a common look and feel of the user-facing features, in coordination with JCC2 PMO.

3.4.11 The contractor shall use a user-centered design approach to determine the information requirements for the UX and shall be supported by corresponding data within the application.

3.4.12 The contractor shall design UX that minimize operator workload, streamline workflow of operations, are accessible to individuals in accordance with section 508 of the Rehabilitation Act of 1974, as directed by the JCC2 PMO.

3.4.13 The Contractor shall develop, document and institute a backup and restore/recover plan ensuring availability and integrity of JCO in all environments, integrated and decoupled, in the event of loss, corruption or failure. The plan shall include a structured approach to regularly saving critical data and defining procedures for recovering the data to minimize downtime, prevent loss, and ensure JCO continuity. It is a crucial aspect of disaster recovery and risk management.

3.5 System/Capabilities/Application Metrics

3.5.1 Strategic Key Metrics, the contractor shall:

3.5.1.1 Track the number of application views and visits to provide an overview of user activity. (CDRL A007)

3.5.1.2 Measure the overall level of user engagement and identifying the most and least sections or features utilized.

3.5.1.3 Click-Through Rates (CTR): Measure the proportion of users who click on the application assessing the effectiveness of various elements, banners, buttons, or suggested content driving engagement.

3.5.1.4 Bounce Rates: Identify the percentage of users who visit but leave without interacting further or exploring other content. Identify potential issues with content relevance, user experience, or navigation that may hinder engagement.

3.5.1.5 Funnel Analysis: Track user behavior and engagement through a predefined sequence of steps or events identifying which apps are typically used for cross correlation, etc.

3.6 Risk Management Framework

3.6.1 The contractor shall assist or provide any accreditation documentation following DoD best practices such as the Risk Management Framework (RMF) process. (CDRL A010)

3.6.2 The contractor shall assist with compiling System Security Packages (SSPs) within eMASS, Xacta, and/or any other government system to include drafting network diagrams, completing security control checklists, validating configurations, reviewing logs, collecting backup documentation for security controls inherited from the platform, and collecting documentation for an overlay of security controls for data stored and processed by the application.

3.6.3 The contractor shall support Portfolio processes and activities for Risk Management Framework (RMF), Assessment and Authorization (A&A), and Certification and Accreditation (C&A) across multiple programs on multiple domains.

3.6.4 The contractor shall provide support with FISMA, RMF, Defense Information Systems Agency (DISA) STIGs, and NIST publications, as they apply to DoD security processes for assessment of Information Systems.

3.6.5 The contractor shall perform routine review of documentation and compare against live information systems to ensure information is up to date and accurate.

3.6.6 The contractor shall perform patching, and implementing DISA STIGs (Security Technical Implementation Guide), and DoD IAVM (Information Assurance Vulnerability Management).

3.6.7 The contractor shall support and develop POA&Ms (Plans of Action & Milestones) to remedy system security shortfalls.

3.6.8 The contractor shall perform Tenable Nessus or similar vulnerability scans, to scan targeted systems to meet security needs.

3.6.9 The contractor shall support the Implementation of NIST Special Publication 800-53 controls and ensure they protect an information system.

3.6.10 The contractor shall support creation of reference material and updating data sources for internal/external use between the PMO (Program Management Office) and stakeholders.

3.6.11 The contractor shall support all Information System Security Officer (ISSO) / Information System Security Manager (ISSM) activities and support all Information System security engineering efforts.

3.6.12 The contractor shall create and continuously update the JCC2 DevSecOps documents. The contractor shall maintain and converge CI/CD pipelines into as few as possible, to support a wide variety of software languages and software product teams as directed by the government.

3.6.13 The contractor shall work with software development product teams to troubleshoot different aspects of JCC2’s CI/CD pipelines or other developer issues.

3.6.14 The contractor shall continuously monitor and deploy JCC2 software products into a multitude of classified and unclassified environments.

3.6.15 The contractor shall modify infrastructure software based on approved CRs, JCWA operational requirements, capability needs statements (CNS), and other validated requirements.

3.6.16 The contractor shall provide support to the JCC2 developmental and operational test agencies as directed.

3.6.17 The contractor shall follow JCC2 designated processes in attaining ATOs or

CTFs for new capabilities/applications on NIPRnet, SIPRNet, and JWICS.

3.6.18 The contractor shall provide a Security Plan that identifies each security control with corresponding implementation and evaluation information.

(CDRL A012)

3.6.19 The contractor shall maintain the application, and both the development and operational environments in accordance with DoD Security directives (for example, STIGs, IAVAs for OS, application, third party applications)

3.6.20 The contractor shall report metrics on mission applications performance and resource availability as directed by the JCC2 PMO. (CDRL A007)

3.7 Accreditation

3.7.1 The contractor shall support, as directed by JCC2, the RMF processes to maintain application accreditation on systems to include, but not limited to, NIPR, SIPR, and JWICS instances.

3.7.2 The contractor shall develop capabilities deployable within authorized government provided DoD Cloud environments.

3.7.3 The contractor shall ensure, unless an exception to policy is issued by the Program Manager, all enclaves will be current within the timeframe required by the Information Assurance Vulnerability Alert/Bulletin, patch, Security Technical Implementation Guide (STIG), or Computer Network Defense (CND) directive.

3.7.4 The contractor shall update all IAVA, patching, STIG, or related tracking databases within five (5) business days of the successful corrective action.

3.7.5 The contractor shall maintain configuration management and configuration control over all aspects of the development environment, operational environment, and software version control and provide release notes and application software changes to the JCC2 Enterprise Service Center, ensuring they are prepared to deploy the application. (CDRL A009)

3.7.6 The contractor shall support internal and external audits.

3.7.7 The contractor shall ensure all services within the application meet the requirements of RMF and applicable standards and guidance.

3.7.8 The contractor shall scan JCO for vulnerabilities using JCC2 PMO approved tools.

3.7.9 The contractor shall take actions to prevent and halt the compromise, and recovery of the JCO system.

3.7.10 The contractor shall implement technical solutions to meet certification and accreditation requirements.

3.7.11 The contractor shall assist in defining user and registration requirements to Local Registration Authorities (LRAs).

3.7.12 The contractor shall support user creation (identity confirmation, credentialing, and enrollment), user management (provisioning across single or multiple systems and services, automated provisioning workflow and self-service), user access (identification, authentication, and authorization) and user revocation (de-provisioning and disablement).

Provide access controls with rights, roles, and privileges. Authorize access to data based on groups and roles as approved in DD Form 2875 and other approved methods.

3.7.13 The contractor shall use government-approved methods of authentication such as, but not limited to, the following:

• Public Key Infrastructure (PKI) based authentication

• AccessIT provided services

• One-Time Password Tokens

3.7.14 The contractor shall support and implement Disaster Recovery and Continuity of Operations Plans (COOP) upon direction by the government.

3.7.15 The contractor shall monitor logging activities to provide for both real time assessment and historical analysis and build dashboards with the reported metrics to support the JCC2 PMO. (CDRL A007)

3.7.16 The contractor shall support cross-domain information sharing across networks operating at different classification levels to include, but not limited to, NIPRNET, SIPRNET, and JWICS.

3.8 Test and Evaluation

3.8.1 The contractor shall provide a Software Test Plan (STP) which includes a Software Test Description resulting in a Software Test Report IAW JCC2 test activities as defined by JCC2. (CDRL A013)

3.8.2 The contractor shall provide test support and test results as directed by the JCC2 PMO. Test support includes, but not limited to, operational tests, user acceptance tests and evaluations. (CDRL A013)

3.8.3 The contractor shall design and provide automated testing processes and services. These testing processes and services shall be documented in the Transition Plan. (CDRL A016)

3.8.4 The contractor shall support Development Testing (DT) as directed by the

JCC2 PMO.

3.8.5 The contractor shall identify, track and report test deficiencies with change recommendations to the JCC2 PMO and implement associated changes as directed by the JCC2 PMO.

3.8.6 The contractor shall conduct unit, security and integration testing and provide the test plan, test data, test results, and test reports as directed by

JCC2 PMO. (CDRL A013)

3.8.7 The contractor shall conduct Contractor Testing (CT) and send the test plan/results to the JCC2 PMO. (CDRL A013) This will also support independent DT and Operational Testing (OT).

3.8.8 The contractor shall utilize the JCC2 PMO workflow to review and act upon deficiency reports.

3.8.9 The contractor shall support Air Force Operational Test and Evaluation Center (AFOTEC) when conducting OT events as directed by the JCC2 PMO.

3.9 Systems Security Engineering

3.9.1 The contractor shall define a Systems Security Engineering approach captured in the Systems Engineering Management Plan (SEMP) to meet the technical and management requirements as part of the overall systems engineering process documented in the Government established Systems Engineering Plan (SEP).

3.9.2 The contractor shall construct a solution architecture document (SAD) capturing a holistic high-level design and system structure of system components, relational connections, and governing principles of the design to guide the development ensuring the solution meets business requirements.

3.9.3 The contractor shall develop a deployment and operations guide detailing the environmental configurations, software components/versions, location of all configuration files, keys, secrets, build and package process, deployment steps, rollback/backup and recovery procedures, post-deployment verifications, system monitoring/alerting/logging, maintenance schedule, scaling procedures, and common troubleshooting steps.

3.9.4 The contractor shall create and deliver a Technical Requirements Document.

This document shall detail all technical specifications, including but not limited to, system functionalities, data formats, third-party service integrations, and API endpoint requirements necessary for the implementation of the solution.

3.9.5 The contractor shall define, document, and deliver a Non-Functional Requirements (NFR) Document. This document shall establish the measurable criteria for the system’s operational qualities, including performance (e.g., response times, throughput), scalability (e.g., concurrent user load), security (e.g., data encryption standards), reliability (e.g., uptime, availability), and maintainability.

3.9.6 The contractor shall produce and deliver a High-Level Architecture Diagram.

This diagram will provide a comprehensive, technology-agnostic visual overview of the solution, illustrating the key system components, their interactions, and their relationships with external systems and user interfaces. (CDRL A017)

3.9.7 The contractor shall conduct a formal feasibility review for all key user flows and interactive prototypes and shall obtain a formal, documented Feasibility Review Sign-Off from JCC2 PMO. This sign-off shall serve as the official confirmation that the proposed designs are technically achievable within the project's scope and constraints before they are approved for development.

3.9.8 The contractor shall trace all Systems Security Engineering requirements including Program Protection, Cybersecurity, Cyber Survivability, Cyber Resiliency, Trusted Systems and Networks (TSN), Anti-Tamper, and Information Protection (IP) in the Requirements Traceability Verification Matrix (RTVM).

3.9.9 The contractor shall establish Cybersecurity, Cyber Survivability and Cyber Resiliency requirements into architectural designs that incorporate NIST 800-53 controls in accordance with DoDI 8500.01, DoDI 8510.01, DoDI 5200.44, DoDI 5200.39, and DoD Zero Trust Reference Architecture.

3.9.10 The contractor shall extract the lower-level Cyber Survivability Attributes for System Security (SS) Key Performance Parameters (KPP) as defined by the Cyber Survivability Endorsement Implementation Guide (CSEIG).

3.9.11 The contractor shall integrate and verify Safety Critical Functions (SCFs), Mission Critical Functions (MCFs), and Critical Program Information (CPI) identified have appropriate segregation and redundancy in the architectural design for successful mission execution.

3.9.12 The contractor shall develop a Test and Evaluation Program Plan that includes cyber testing and is aligned to the Government developed Test and Evaluation Master Plan.

3.9.13 The contractor shall support Government participation in all Cyber Table- Top activities and cyber testing, including Government laboratories testing.

3.9.14 The contractor shall update cyber risks identified during Cyber Table-Top activities and during risk assessments to include Supply Chain Risks.

3.9.15 The contractor shall participate in Government-led IPT or System Security Working Group (SSWG) to provide technical contribution to the Government’s program protection planning and SSE activities.

3.9.16 The contractor shall produce hardware and System/Software Integration Laboratory (SIL) for the Government to conduct cyber testing.

3.9.17 The contractor shall prepare and deliver a Software Metrics Data Report

(SMDR). (CDRL A007)

3.10 Cybersecurity, Cyber Survivability and Cyber Resiliency

3.10.1 The contractor shall provide a cybersecurity strategy implementation plan that corresponds to the Government’s Cybersecurity Strategy detailing, at a minimum, the cybersecurity environment, cyber survivability, cyber resiliency, requirements, and assessments which include items from the Cybersecurity Implementation Plan.

3.10.2 The contractor shall align with the Government Security Classification Guide to ensure appropriate level of classification for specific information elements determined to be a risk to National security in accordance with

DoDM 5200.45.

3.10.3 The contractor shall include applicable identification of potential failures, aligned with the cybersecurity strategy implementation plan, using Failure Modes, Effects and Criticality Analysis (FMECA) techniques.

3.11 Program Protection

3.11.1 The contractor shall deliver a Program Protection Implementation Plan (PPIP) in accordance with the Government established Program Protection Plan (PPP) detailing, at a minimum, the contractor’s approach for implementing the Government PPP, process for identifying CPI during developmental phases and protection, assessment, and special handling measures for CPI as well as the Supply Chain Management, OPSEC, and Anti- Tamper plans.

3.11.2 The contractor shall implement a formal incident response reporting plan in accordance with AFI 17-203, AFMAN 10-206, and CJCSM 6510.01B.

3.11.3 The contractor shall conduct a Functional Threat Analysis, Vulnerability Analysis Report and Attack Path Analysis to assess entry access points and associated risks in accordance with DoDI 5200.44, DoDD 5200.47E, and DoDI

5000.39 for use during risk assessments. (CDRL A011)

3.11.4 The contractor shall identify and document all internal and external system interfaces in accordance with the Interface Control Document (ICD). (CDRL A014)

3.11.5 The contractor shall deliver a Contractor Data Management Plan (CDMP) within 15 days that shall be used throughout the lifecycle.

3.11.6 The contractor shall provide an Anti-Tamper plan in accordance with DoDD 5200.47E and shall include an Anti-Tamper Verification Plan.

3.12 Supply Chain Risk Management

3.12.1 The contractor shall conduct a Software Assurance Evaluation on Non- Developmental Item (NDI) software to assess, source, supply chain and cybersecurity vulnerabilities which shall include a Software Assurance Evaluation Report.

3.12.2 The contractor shall develop a Cyber Supply Chain Risk Management (C- SCRM) plan describing, at a minimum, the strategy for identifying, assessing, handling, and monitoring risks in the supply chain lifecycle along with detailed training to promote SCRM practices. (CDRL A008)

3.12.3 The contractor shall include in the SCRM plan a strategy to protect the supply chain from exploitation via various means such as insertion of counterfeits, malicious software and hardware, etc. that adversaries could leverage to affect system operations.

3.12.4 The contractor shall provide a Supply Chain Risk Register for the identification and tracking of supply chain risks including a risk reporting matrix.

3.12.5 The contractor shall perform acceptance testing on lowest Critical Component and components containing CPI in accordance with the Counterfeit Prevention Plan.

3.12.6 The contractor shall produce a Software Bill of Materials (SBOM) for the identification, forecasting, mitigation and management of hardware and software to include system level parts down to the lowest level components. (CDRL A008)

3.13 Trainer of Trainer

3.13.1 The contractor shall prepare instructors identified by the JCC2 PMO to present information effectively, respond to participant questions, and lead activities that reinforce learning. Other goals include ensuring that trainers can: Direct participants to supplementary resources and reference materials and lead discussions.

3.13.2 The contractor shall deliver training material in digital formats (for example, but not limited to, videos, demonstrations and manuals) as defined and directed by the PMO. The training materials will include a section for known problems and interim solutions for troubleshooting common problems that operators may encounter while using the system. The material must be compatible for uploading to the JCC2 Landing page. (CDRL A006)

3.13.3 The contractor shall develop, deploy, and update training materials following each program increment or software release, as directed by the

JCC2 PMO. (CDRL A006)

3.13.4 The contractor shall support the JCC2 Liaison Officers on training efforts, demonstrations, and exercises, as directed by the JCC2 PMO office.

3.14 Tier 3 Support

3.14.1 The contractor shall work with the JCC2 ESC Contractor to sustain, modify, migrate, evaluate, test, and package system and software changes, and provide problem resolutions for JCO.

3.14.2 The contractor, in support of the JCC2 Enterprise Service Center (ESC), by managing and sustaining the current and future JCO baseline with integrating changes, problem fixes, modifications, and modernizations to the baseline as required by the JCC2 PMO.

3.14.3 The contractor shall adhere to established government directed escalation, resolution, reporting guidelines for problem, incident management across all affected systems and tiered levels of support.

3.14.4 The contractor shall support Technical Exchange Meetings (TEMs) as directed by the JCC2 PMO.

3.15 Planning Increments (PI) Metrics

3.15.1 The contractor shall create internal team practices that align with the JCC2 modified SAFe management style framework. This framework is always evolving, and is based on current SAFe standards, unless deemed necessary to change to a different Agile construct.

3.15.2 The contractor shall adhere to JCC2 Agile governance as it applies to Program Increment planning process.

3.15.3 The contractor shall synchronize software development with JCC2 Agile cadence.

3.15.4 The contractor shall report Agile and development related metrics. (CDRL A007)

3.15.5 The contractor shall provide a Capacity Planning Report as a part of each Program Increment Planning Process. (CDRL A015)

3.16 Transition Plan

The contractor must plan for the transfer of work control, delineating the method for processing and assigning tasks during the phase in/phase-out periods of this task order and develop, maintain and be prepared to implement a Phase Out Transition Plan NLT 60 days prior to the end of the Period of Performance. the contractor must comply with the following clause, as related to the Transition Plan: 52.237-3, Continuity of Services, found here: https://www.acquisition.gov/far/52.237-3 (CDRL A016).

• 4. Team Composition and Special Qualifications This section addresses team composition, estimated level of effort, and special qualifications.

4.1 Workforce Management

The list of requirements detailed in this section changes frequently to meet emerging requirements and priorities established by the operational community due to the continuously evolving cyber threat and the variety of techniques used by cyber adversaries along with the maturation of cyber C2 concepts of employment with the joint community. As a result, these requirements are representative, but not comprehensive.

4.1.1 The contractor shall demonstrate their ability to respond to the changing environment through its proposed staff training programs and system modification processes.

4.1.2 The contractor shall manage JCO capability baselines on NIPR, SIPR, & JWICS across the JCC2 PMO approved/designated hosting environments.

4.1.3 The contractor shall provide Systems Administrator(s) with the ability to access NIPR, SIPR, and JWICS systems at USCYBERCOM or other JCC2 PMO approved locations.

4.1.4 The contractor shall provide personnel with subject matter expertise of network architecture, organizational structure of cyber warfighters and assigned responsibilities, sensors, and other critical cyber technologies, reporting requirements and processes.

4.1.5 The contractor shall fill key positions at the locations identified, with the clearances, qualifications, and access required to fulfill this contract within 15 business days of contract award date.

4.1.6 Key positions cannot be dual hatted.

4.1.7 Residual positions filled within 20 business days of the contract award date.

4.1.8 One means of demonstrating this ability is to furnish sanitized resumes, or acceptable evidence of qualifications of the individuals the contractor would place into each of the positions.

4.1.9 The following section describes the work for JCO. The government approach to team composition is to construct each development team as an integrated product team that excels in requirements decomposition, prioritization, development, testing, deploying, and sustaining feature deliveries.

4.1.10 The contractor shall be responsible for the employment, guidance, supervision, and training of all personnel assigned to perform tasks under this contract.

4.2 JCO Team:

4.2.1 Summary:

JCO leverages an established Development team which delivers capability for the Department of War (DoW) operational community. JCO established a pipeline that quickly reacts to operational needs in the form of operational requirements, prioritized by the Functional Area Requirements Working Group (FARWG). JCO takes these requirements, rapidly develops features, provides prototype capabilities, then continuously iterates on those capabilities to incorporate operational feedback. The JCC2 PMO is not looking for new applications but to maintain the current baseline and iterate continuous development on the current JCO application.

4.2.2 Background:

4.2.2.1 Common Application Programming Interface (API) include but not limited to: JAX-RS, OpenAPI, JSON, Java, Python.

4.2.2.2 Common build automation tools include but are not limited to: Git Enterprise (or derivatives such as Gitlab), Jenkins, goCD, Packer, Nexus, Docker, Flake8, Bandit, Selenium, Buildgraph, Packer Ansible, Maven, ACAS, and HP Fortify.

4.2.2.3 Common Infrastructure as Code (IaC) and Configuration as Code (CaC) for deploying and managing various Cloud Native Computing Foundation (CNCF)- compliant Kubernetes distributions include but not limited to: Amazon Elastic Kubernets Service (EKS), Terraform, Ansible, Spring, vCenter, Artifactory, RedHat Enterprise Linux.

4.2.2.4 Additional technologies include but not limited to: PostgresSQL, Bash, Jira, ELK, Zabbix, AWS Diode, and Confluence.

Table 1: JCO Mission Application (subject to change)

JCO

A mission orchestration, automation, and analysis platform that empowers users at organizational levels to plan and manage all-domain operations and facilitate decision making.

It is the authoritative data source for all Offensive Cyber Operations (OCO) and Defensive Cyber Operations (DCO) mission planning.

4.3 JCO Personnel

Key personnel shall align with the contractor’s proposed Staffing Plan which meets the minimum criteria as defined in the table below. Key personnel shall not be dual hatted to perform more than one key position or labor category function. Upon receiving the award, the JCO Personnel Staffing table will be updated IAW the awarded offer.

Table 2: JCO Personnel Staffing (53 FTEs Maximum)

Position Title Qty Performance Location Clear ance

Key Position

Technical Task Lead (Program Manager) 1

CONUS

(Desired JBSA-Lackland, TX or Fort

Meade, MD) TS/SCI

Key

Technical Advisor (Full Stack Developer) 1

CONUS

(Desired JBSA-Lackland, TX or Fort

Meade, MD) TS/SCI

Key

Front End Developer (Senior) TBD

CONUS

(Desired JBSA-Lackland, TX (1) or Fort

Meade, MD (1)) Desired

TS/SCI

(2) Key

Front End Developer (Mid) TBD

CONUS

(Desired JBSA-Lackland, TX (1) or Fort

Meade, MD (1)) Desired

TS/SCI

(2) Key

Back End Developer – (Senior) TBD

CONUS

(Desired JBSA-Lackland, TX (1) or Fort

Meade, MD (1)) Desired

TS/SCI

(2) Key

Back End Developer – (Mid) TBD

CONUS

(Desired JBSA-Lackland, TX (1) or Fort

Meade, MD (1)) Desired

TS/SCI

(2) Key

Database Engineer TBD CONUS Desired

TS/SCI

(1) Key

System Test Engineer (Manual and/or

Automated) TBD

CONUS

Desired

TS/SCI

(1) Key

System Administrator TBD CONUS Desired

TS/SCI

(1) Key

Application SME / Trainer-of-Trainer TBD

CONUS

JBSA-Lackland, TX (minimum 1) Fort Meade, MD (minimum 1) Fort Gordon, GA (minimum 1)

TS/SCI

w/Poly

Required

UI/UX Designer 2 CONUS Desired

TS/SCI

AI/ML SW Developer TBD CONUS Desired

DevOps Engineer/Release

Management Engineer 1

CONUS

Desired

Cyber Security Engineer 1

CONUS

4.4 Security Clearances

Facility Security Clearance. The work to be performed under this contract/order is up to the Top-Secret level and will require Sensitive Compartmented Information (SCI) access eligibility for some personnel including polygraph to obtain a USCYBERCOM and/or National Security Agency (NSA) retention badge. The contractor shall require access to NIPRNet, SIPRNet, JWICS, and potentially NSANet.

All Contractor personnel assigned to work on classified activities shall be cleared at the Top Secret/Sensitive Compartmented Information (TS/SCI) level clearance in accordance with "Personnel Security Requirements for Contractor Access to NSA/CSS Sensitive Compartmented I (Attachment to DD 254)". Fully unclassified development efforts may be performed by uncleared personnel.

Contractor personnel without a security clearance may perform unclassified tasks. However, non-U.S. citizens, to include immigrant aliens, are not authorized access to any portions of this contract or to commence performance of any work under this contract without express written approval from the Contracting Officer. In accordance with the conditions as prescribed by 352.204-9014, NOTIFICATION OF NON-U.S. CITIZEN PARTICIPATION, the contractor shall provide all the requested information for processing of each non-U.S. citizen seeking access to or being proposed to perform work on this contract.

Table 3: Minimum Skills, Experience, Required Certifications

Title Clearance and Certifications

Experience

Technical Task Lead (Program Manager)

Project Management Professional (PMP) is desirable;

PMI-ACP is desirable;

CISSP Certification is desirable

Responsible for the development and implementation of assigned projects. Responsible for the technical planning, establishment, execution, and evaluation of a multifaceted program/project. Provides day-to-day technical/professional guidance and leadership as appropriate to the area of expertise. Drives technical vision of systems as provided by the JCC2 PMO and has oversight into and understanding technical system capabilities and specifications. Reviews technical documentation produced by contractor team, provides this documentation to the JCC2 PMO, and is responsible for project tracking and analysis. Serves as primary touchpoint to the JCC2 PMO regarding overarching technical vision for the JCO system. Ensures adherence to technical quality standards and reviews project deliverables.

Provides technical and analytical guidance to the project team. Recommend and take action to direct the analysis and technical solutions of problems.

Required Qualifications:

• Bachelor’s degree in related field required.

• 10 years of experience in the functional area. A Master’s degree may substitute for 2 years of experience.

• 5 years of relevant experience, experience leading complex DevSecOps programs with an emphasis on cloud, cyber and platform technologies.

• 3 years of experience managing subcontractors and projects using agile, and/or spiral development models.

• Software Engineering experience or equivalent field.

• 3 years of Scaled Agile Framework (SAFe) experience.

• Broad understanding of theoretical concept on cloud computing solutions.

• Broad knowledge of distributed systems architecture and microservices.

• Broad Understanding of data analytics development.

• Practical experience using JIRA and Confluence for project management.

• 5 years of experience with CI/CD software development.

Desired Qualifications:

• Experience with integrating data from unclassified to classified application deployments (using AWS diode).

Experience managing DOW cyber related contracts.

Technical Advisor (Full Stack Developer) TS/SCI, IAT Level II

Responsible for the development and implementation of assigned projects. Responsible for the technical planning, development, testing, supporting deployment, and evaluation of system capabilities. Performs high-level systems analysis, evaluation, design, integration, documentation, and implementation of very complex systems, requiring a thorough knowledge of technical skills. Provides day-to-day technical/professional guidance and leadership. Provides subject matter proficiency for work described in the task.

Responsible for providing analytical skills and technical expertise to support technical development, process improvement, specialized studies, and definition of requirements.

Exercises…