JTT_Follow-On_PWS_20241029_DRAFT.docx

CUI

KESSEL RUN (C3C)

JOINT TARGETING TOOLBOX (JTT)

JTT Follow-On Performance Work Statement (PWS)

Prepared by

AFLCMC/C3C

Version Date: 29 October 2024

DISTRIBUTION STATEMENT C: Distribution authorized to U.S. Government Agencies and their contractors Information Systems Vulnerability Information 25 Oct 2024. Other requests for this document shall be referred to AFLCMC/C3C (DoD Controlling Office), 11 Barksdale Street, Building 1614, Hanscom AFB MA 01731-1700.

HANDLING AND DESTRUCTION NOTICE: Comply with distribution statement and destroy by any method that will prevent disclosure of contents or reconstruction of the document.

Controlled Unclassified Information (CUI) Controlled By: AFLCMC/C3C CUI Category: Controlled Technical Information Dissemination: FEDCON POC: Lauren Cheslofska; lauren.cheslofska@us.af.mil

REVISION HISTORY

TABLE OF CONTENTS

INTRODUCTION

Purpose The purpose of this acquisition is to obtain high qualified professional services from a Contractor with demonstrated expertise to plan, develop, field, sustain, and support the Joint Targeting Toolbox (JTT) software application.

System Description The JTT program is a cloud-based software application used to support operations and targeting requirements throughout the full spectrum of conflict at the national, theater, and tactical levels. It connects to National Military Intelligence databases (i.e. Modernized Integrated Database – MIDB) to enable target creation, target queries, and nomination of targets.

The program is managed under the Kessel Run (C3C) Division at Hanscom Air Force Base (AFB), Massachusetts (MA). While it is sponsored by U.S. Air Force’s Air Combat Command at Joint Base Langley-Eustis, VA, it is the Joint system of record for targeting and target list management. Therefore, in addition to ACC, Headquarters Air Force (HAF) and Joint Staff (JS) are two other primary stakeholders. Furthermore, JTT supports users across the rest of the Department of the Defense (DoD), the U.S. Intelligence Community, and Coalition and Allied targeting communities.

Scope The projected Period of Performance (PoP) is 5 years, with one-year Base Period and 4 one-year Option Periods.

The scope of this effort is for the Contractor to provide the following professional services:

· Collaborate with incumbent JTT 5.x vendor to transition from JTT 5.x to JTT 6.x series

· Field JTT software to cloud and on-premises environments

· Train JTT users on the features and capabilities of JTT 6.x

· Sustain and develop secure JTT software to meet current and future requirements

· Maintain compatibility and interoperability with legacy systems and establish new integrations, as directed by the Government

· Provide Help Desk services to resolve end-user issues

· Provide exercise, test, and real-world support to ensure successful usage and operations of JTT software

· Provide remote and in-person technical support to organizations with on-premises instances of JTT software

· Scale, as needed, services to adapt to real-world events and increases in requirements to rapidly deliver new or improved features in an accelerated timeline

· Support, as needed, JTT software services for U.S DoD, Coalition, Allied, and Foreign Military Sales (FMS) Applicable Documents (Reserved) Terms and Definitions

· Capability Solution Packages (CSP): a weaponeering recommendation to achieve specific effects based on tactical tasks against a Critical Target Element; core elements of Target Engagement Packages

· Change Success Rate: the percentage of change initiatives that are completed successfully and achieve their intended goals

· Critical Elements/Critical Target Elements (CE/CTE): discrete aspects of a larger object or target that could be nominated for a strike (i.e. a communications receiver on the roof of a facility)

· Deployment Frequency: a metric that measures how often an organization releases code to production

· Integrated Digital Environment (IDE): a collection of data, tools, and models that allow users to collaborate, analyze, and visualize work

· JTT Instance: JTT software deployment on a given domain, platform, or environment for a specific purpose (i.e. UNCLASSIFIED training server deployed to the cloud)

· Mean Lead Time for Changes: a software development metric that measures the time it takes to deploy a code change from commit to production

· Mean-Time-To-Restore-Service: the average time it takes to recover from a software system failure or outage

· On-Premises (OP): software that is installed and run on an organization's own hardware and servers, rather than on a third-party server or in the cloud.

· Operational Availability: a metric that measures how often a system is working compared to how often it should be working

· Staging Environment: a pre-production software environment for final security testing and validation prior to Authority to Operate (ATO) assessment

· Target Engagement Package (TEP): a combination of one or more Capability Solution Packages (CSPs) used to achieve a specific outcome towards a Tactical Objective

PROGRAM MANAGEMENT REQUIREMENTS

Management The Contractor shall employ effective program management processes and approaches in the execution of the contract.

The Contractor shall collaboratively work with the Government to establish goals, objectives, and a plan to meet performance requirements in this Performance Work Statement (PWS).

The Contractor shall focus on continuous development and implementation strategies to ensure transparency in all processes and services performed to meet the requirements in this PWS.

The Contractor shall develop and maintain a detailed quality control plan for executing contract requirements. The plan shall address the processes and measures to meet the Performance Objectives of the contract stated in the Services Delivery Summary (SDS) section of this PWS.

The Contractor shall propose or recommend innovative collaborative approaches for any software tools, manpower, and support required for successful execution of the contract.

The Contractor shall appoint a Program Manager (PM) at the contract award to serve as the primary focal point for communications with the Government.

The Contractor shall participate and contribute to quarterly Program Management Reviews (PMR).

The Contractor shall conduct quarterly Program Increment (PI) events to assess work accomplished in the previous quarter and determine work to be accomplished in the next quarter.

The Contractor shall participate in and contribute to Quarterly JTT Strategy Sessions, including roadmap and milestone updates that reflect changes in priorities as directed by the Government. The Contractor may suggest alternatives to the cadence and format of these events.

The Contractor shall provide the Government an Integrated Master Schedule (IMS) as described in the Contract Data Requirements List (CDRLs).

The Contractor shall advise the Government on collaborating with and supporting stakeholders, including, but not limited to Joint and Coalition partners, as necessary.

The Contractor shall support external engagements with stakeholders in support of the JTT mission, including, but not limited to: Technical Exchange Meetings (TEMs), Test Events, Conferences, and Working Groups.

The Contractor shall use a cost management system to define, monitor, manage, and report on the use of task resources.

The Contractor shall ensure that planned costs are in accordance with the Contract Line Item Number (CLIN) structure and compliant with the CLIN deviation memorandum to charge and track costs against specific Account Classification Reference Numbers (ACRNs).

The Contractor shall report on contract costs to the Government as described in the CDRLs.

The Contractor shall implement an effective risk management program to identify, analyze, mitigate and monitor program risks.

The Contractor shall provide timely, accurate, and relevant technical, cost, schedule, and risk assessment inputs to the Government to support Government decisions.

Transition The Contractor shall provide technical and engineering services to support the transition from JTT 5.x to JTT 6.x software.

The Contractor shall lead a kick-off meeting for the Government within seven (7) business days of contract start to introduce team members and staffs as well as discuss as a minimum:

· General overview of the overall approach to execute this contract

· Organizational structure

· Administrative operations pertinent to the scope of work

· Technical approaches and preliminary plans for performing contract tasks

· Format of reports and quarterly reviews

· Transition-In Plan Plan for controlling costs and schedules while maintaining quality The Contractor shall complete the transition-in, to include adding properly cleared and skilled personnel working on the contract.

The Contractor shall develop and execute a Transition-In Plan. The plan shall include as a minimum:

· How the transition will be managed to ensure that it is low-risk and enables complete transition within 60 days

· Provide detailed steps of the transition-in activities with completion dates for each activity

· Milestones will be reported at a minimum of in 15-day increments

· Describes how talent will be recruited and onboarded effectively during the 60-day transition period

· A clear description of risks and dependencies, including mitigation measures, as appropriate Explain the initial recruitment and hiring process for this requirement Identify how personnel will meet all qualifications and have the appropriate personnel security clearances prior to day one of task order performance

· Identification, by name and position, of each team member on the Transition Team, along with each person’s associated responsibilities In the event an Option Period is not exercised by the Government or at the expiration of the final performance period, the Contractor shall provide a Transition-Out Plan at the direction of the Government within a reasonable timeframe.

The Contractor shall develop the Transition-Out Plan to facilitate the accomplishment of a seamless transition with incoming Contractor and/or Government personnel. It shall at minimum address:

· Points of contact

· Project and technical management processes

· Location of technical and project management documentation

· Status of ongoing technical initiatives

· Appropriate coordination plan with incoming personnel to ensure a seamless transition Identify schedules and milestones Identify actions required of the Government

· Defines outgoing transition, to include agreed knowledge capture, transition artifacts, and transfer to ensure programmatic continuity and incoming Contractor’s success Personnel The Contractor shall provide Key Performance Personnel (KPP) that are essential to accomplish contractual requirements. At a minimum, the KPP for this contract shall include:

· One (1) Program Manager: The KPP Program Manager shall have at least seven (7) years’ experience as a program manager for Agile software development programs including at least three (3) years’ experience working with Department of Defense customers.

· One (1) Product Manager: The KPP Product Manager shall have at least seven (7) years’ experience as a senior product manager of Agile software development teams for large scale applications, with extensive experience managing the expectations of multiple stakeholders, developing product visions, strategies, and outcome-based roadmaps to deliver value to the user.

· One (1) Lead Systems Engineer: The KPP Lead Systems Engineer shall have at least seven (7) years’ experience in Agile, DevSecOps (development, security, and operations), microservices architecture, and application development, working as part of a product team to deliver value and outcomes to the user and stakeholders.

· One (1) Product Designer: The KPP Product Designer shall have at least seven (7) years’ experience as a senior designer of Agile, user-centered, development programs which deliver validated capabilities to a large array of user types.

The Government reserves the right to designate additional KPP.

The Contractor shall furnish all management and labor necessary to perform the requirements contained herein. Unless otherwise directed, the Contractor shall provide all the tools, staffing, and support required for successful execution of the contract.

The Contractor and execute a strategy to recruit, hire, and retain talent.

The Contractor shall provide and maintain an accurate, current team structure page on a Government-approved Integrated Digital Environment (IDE) to ensure the Government stays informed on a near real-time basis of when personnel change positions, are supporting multiple programs, positions are vacated, backfills are authorized and when new hires will start, and other personnel related information.

The Contractor shall provide a surge in staffing, in a timely manner, to meet evolving mission needs when directed by the Government.

Travel The Contractor shall travel to various locations within the Continental United States (CONUS) and Outside the Continental United States (OCONUS) in performance of this contract, as directed by the Government.

The Contractor shall ensure that all travel arrangements are pre-approved by the Contracting Officer (CO) or Contracting Officer Representative (COR) prior to all travel. Travel may be required to support meetings with the Government, conferences, software test events, exercises, training, or for other purposes authorized by the Government in support of this contract.

The Contractor shall travel using the lowest cost mode transportation commensurate with the mission requirements.

When necessary to use air travel, the Contractor shall use the tourist class, economy class, or similar accommodations to the extent they are available and commensurate with the mission requirements.

IAW DFARS 252.225-7040, the Contractor shall use the Synchronized Pre-deployment and Operational Tracker (SPOT) web-based system, to enter and maintain the data for all Contractor Accompanying Armed Forces (CAAF) and, as designated by the Undersecretary of Defense for Acquisitions, Technology, and Logistics (USD AT&L) or the Combatant Commander, non-CAAF supporting U.S. Armed Forces deployed outside the United States. Under this contract, the Contractor will be designated as Non-CAAF.

The Contractor shall complete, in a timely manner, the submittal of the necessary information and forms directly to the appropriate Government agency(ies) for the required security clearance, passports, visas, licenses, and permits.

The Contractor shall be responsible for the sponsorship of its employees and their dependents and shall process any necessary permits directly through the appropriate Government agency(ies).

The Contractor shall ensure proper coordination with the applicable security office to ensure visit request(s) are timely submitted and processed.

The Contractor shall obtain special theater and/or country clearances and comply with theater/country specific requirements for applicable OCONUS work. The DoD 4500.54-E and DoD Foreign Clearance Guide states the requirements for travel to specific countries.

The Contractor shall complete all required training prior to deployments to OCONUS locations.

The Contractor shall complete any Letter of Identification (LOI), Letter of Accreditation (LOA), or other forms that may be required under applicable Status of Forces Agreements (SOFAs), in a timely manner, and submit them to the CO or COR for approval.

Configuration and Data Management The Contractor shall employ data management discipline for developing, acquiring, controlling and delivering all required technical, management and other data.

The Contractor shall employ detailed configuration management approaches to maximize quality and ensure consistent baselines across installations, environments, time zones, and classifications.

The Contractor shall ensure proper identification, marking, control and distribution of proprietary, sensitive, Controlled Unclassified Information (CUI), and classified data.

All processes used in the execution of this effort shall be fully documented. The processes and corresponding documentation shall be regularly reviewed/updated for currency and accuracy.

The Contractor shall prepare and generate a Data Accession List (DAL) in accordance with the CDRL which lists all internally generated documentation, not otherwise deliverable to the Government, used by the Contractor to design and manage the project.

The Contractor shall ensure all documentation and updates be made available in the Government-approved IDE.

The Contractor shall submit all deliverables through the Government-approved IDE, unless otherwise directed by the Government.

The Contractor shall ensure accurate timely updates, revisions and corrections to data as required and requested by the Government.

The Contractor shall adhere to the Government Configuration Management process and provide required information for Security Impact Assessments, Change Requests, Firewall Change Request (FCR), Configuration Control Board (CCB) forms, release notes, and/or software version changes.

The Government retains unlimited rights to all intellectual property created by the Contractor per DFARS 227.7203-5 The Contractor shall provide the Government with unrestricted access to all source code under development and related documentation Procurement The Contractor shall procure materials, as directed and approved by the Government, to support integration, modification and fielding activities to include software warranties, software licenses, and other articles for the Contractor and Government facilities and enterprise sites.

The Contractor shall ensure full transparency with the Government on software procurements, to include licenses and warranties.

The Contractor shall work with the Government to ensure that all software purchases reduce future transfer liability to the maximum extent possible.

The Contractor shall purchase perpetual software licenses to the maximum extent possible.

The Contractor shall procure all materials in support of the requirements in this PWS in the most cost-effective manner, to include use of Government supply sources, such as the DoD Enterprise Software Initiative (ESI), when they are determined to be the most cost-efficient source.

The Contractor shall submit a Bill of Material (BOM) or a Software Bill of Material (SBOM) to the Government for approval prior to purchases in an approved format.

The Contractor shall provide regular status updates on the procurement to the Government. At the time of procurement delivery, the Contractor shall provide, at a minimum, the following to the Government:

· Terms of coverage for support, warranty, and license(s)

· Description of services provided by original equipment manufacturer (OEM)

· Shipping tracking information (if applicable)

· Serial numbers (for modular components include serial numbers for all modules/sub-modules) and license key information

· Software product registration information

SYSTEM REQUIREMENTS

Technical Requirements Management The Contractor shall develop and implement a process for identifying and monitoring technical requirements.

The Contractor shall document and maintain a flexible Agile development plan that accounts for elements such as user and mission requirement priorities and estimation of complexity, size, and scalability.

The Contractor shall establish, manage and update a product backlog to prioritize tasks under the Government’s direction.

The Contractor shall inherit the product backlog for JTT 5.x when it sunsets and incorporate it into its current product backlog for prioritization.

The Contractor shall continuously capture system requirements at the strategic, operational, and tactical levels via engagements and feedback from primary stakeholders, end-users, and others, as determined by the Government.

The Contractor shall assess the potential value proposition of gathered requirements and validate assumptions with stakeholders, users, and mission needs to inform the Government’s requirements development process. The Contractor shall present its findings to the Government and provide recommendations as part of PMR, at least annually, or as needed, to ensure requirements remain relevant.

The Contractor shall collaborate with the Government team to develop and deliver a product/capability roadmap based on user-defined outcomes and the product backlog. This roadmap shall be kept current and available in the software development task management tool (Jira, GitLab, etc.) hosted in the Government-approved IDE.

The Contractor shall develop an automated report, delivered monthly within the IDE, that captures the baseline and any changes to the dates of all activities connected to the roadmap.

The Contractor shall maintain a flexible development strategy that accounts for factors such as user and mission requirements, complexity of new features, time, cost, man-hours required to implement functionality, etc. with the ability to quickly respond to changes in Government priority.

The Contractor shall maintain a continuous-improvement mindset by researching and implementing processes to optimize and accelerate product development. Prior to any significant changes, the Contractor shall inform the Government for approval.

The Contractor shall conduct regular increment or Sprint reviews to receive feedback on work accomplished in the previous period, assess work to be performed in the upcoming period, evaluate collaboration and integration effectiveness across the Command and Control (C2) enterprise, and implement continuous improvement/industry best practices in their development processes.

The Contractor shall develop and implement applicable Information Technology Service Management (ITSM) processes (incident management, problem management, service level management, change enablement, etc.) using Information Technology Infrastructure Library (ITIL) v.4 best practices.

Development The Contractor shall adopt Agile software development best practices based on industry standards and Government guidance (e.g. Kessel Run User Interface).

The Contractor shall adhere to user-centered design that aligns with current mission requirements and feedback when developing new features and capabilities.

The Contractor shall possess and maintain an UNCLASSIFIED software Platform as a Services (PaaS) DevSecOps development environment accredited to DoD Impact Level-5 (IL-5) or equivalent (for OP environments), as defined the Defense Information Systems Agency’s Cloud Computing Security Requirements. Upon request, the Contractor shall make this DevSecOps environment accessible to the Government.

The Contractor shall be prepared to transition JTT source code (and other software development assets, such as documentation, tests, and scripts) to Government directed DevSecOps environment(s) in a timely manner, as required.

The Contractor shall not disable or mute any software compiler warnings without express permission granted through a formal waiver request to the Government.

The Contractor shall develop automation, where directed by the Government, within legacy and emerging software connections, configurations, and workflows.

The Contractor shall update JTT to maintain currency with future Government-directed workflows and data structures, including, but not limited to:

· Critical Elements/Critical Target Elements (CE/CTE)

· Capability Solution Packages (CSP)

· Target Engagement Packages (TEP) The Contractor shall support the development of future capabilities, standards, and technologies into JTT, as directed by the Government, including, but not limited to:

· Space targeting abilities

· Multi-domain targeting

· Dynamic targeting The Contractor shall ensure any new capabilities integrated into JTT do not introduce additional deficiencies or bugs with the existing capabilities.

The Contractor shall not utilize or provide any proprietary technical/engineering processes, solutions or implementations to meet the requirements without prior Government approval.

Integrations and Interoperability The Contractor shall implement any software, integrations, interoperability, and infrastructure technologies necessary to support JTT, as directed by the Government.

The Contractor shall develop and maintain integration with databases and software applications, as directed by the Government. This includes, but is not limited to:

· Digital Imagery Exploitation Engine (DIEE)

· Integrated Munitions Effectiveness Assessment (IMEA)

· Workflow Application for Recording Production and Targeting History (WARPATH)

· Machine-Assisted Analytic Rapid-Repository System (MARS)

· Kessel Run All-Domain Operations Suite (KRADOS) The Contractor shall ensure JTT maintains integration with all existing workflows and downstream software, including, but not limited to:

· Modernized Integrated Database (MIDB)

· Theater Battle Management Core System (TBMCS)

· Master Air Attack Planning Toolkit (MAAP-TK) Testing The Contractor shall employ Agile-style Test & Evaluation (T&E) processes.

The Contractor shall implement automated testing to the furthest extent possible in the build/pipeline process.

The Contractor shall develop and run automated unit tests as part of Test-Driven Development (TDD) to guide the development of new features.

The Contractor shall perform UNCLASSIFIED testing prior to Government testing, including, but not limited to:

· Unit code tests

· Smoke tests

· Regression tests

· Quality assurance tests

· Security/vulnerability tests

· Interface integration tests The Contractor shall develop, deliver, and use a Software Test Plan to conduct Contractor Testing, as stated in the CDRL.

The Contractor shall support JTT test events, as well as any associates preparation activities, as directed by the Government. The test events may include, but are limited to:

· Risk Reduction Events (RRE)

· Integration test events

· Development Test and Evaluation (DT&E)

· Cyber Security Testing/Security Impact Assessments

· Operational Test and Evaluation (OT&E)

· Theater-Level Test Events The Contractor shall, at the end of each test event, assist and support the Government in gathering, categorizing and documenting each finding. This includes, nut is not limited to, Test Problem Report (TPR), Deficiency Report (DR), Engineering Change Request (ECR), or a Baseline Change Request (BCR).

The Contractor shall address, and/or resolve any findings before, during, or after each test event as directed by the Government.

The Contractor shall support all third-party integration and testing as directed by the Government.

The Contractor shall provide integration support to Government testing environment(s), including, but not limited to (e.g. NGA CORE Dev, Staging):

· Remote support for software deliveries

· Security patching/updates

· Troubleshooting Software Security The Contractor shall assess all code and software against applicable Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs), Common Weakness Enumeration (CWE), Common Vulnerability Enumeration (CVE), and Open Web Application Security Project (OWASP) guidelines throughout the effort.

The Contractor shall utilize a Government approved static code analyzer (e.g. Fortify or equivalent) to scan all code, at least monthly. The Contractor shall resolve or mitigate critical and high security findings as they are discovered and/or prior to deployment or delivery to the Government.

The Contractor shall deliver the details and results of code scans to the Government, in the form of raw results, analyzed reports, dashboards embedded in Government directed DevSecOps environment(s), and/or additional formats as directed by the Government. The scans shall be delivered to the Government at least once a quarterly, and prior to major software releases.

The Contractor shall conduct vulnerability scanning of the software and/or when new vulnerabilities potentially affecting the system/applications are identified. The Contractor shall use Government approved tools, which may include Gripe Docker scanner, Fortify, Red Hat Advanced Cluster Security (ACS), and Assured Compliance Assessment Solution (ACAS). The Contractor shall conduct the vulnerability scanning, at a minimum, once a month.

The Contractor shall apply cybersecurity updates, upgrades, patches, and fixes to all JTT instances at least once a month.

The Contractor shall use the most current Government approved cybersecurity tools, with the latest definitions/service packs, to automate and/or enhance security processes and vulnerability management.

The Contractor shall review, analyze, and mitigate/remediate vulnerabilities discovered by all cybersecurity tools and processes.

The Contractor shall ensure there are no known, unmitigated Critical, or High levels of risk attributed to unaddressed vulnerabilities and/or Non-Compliant (NC) RMF security controls present in delivered software, as defined by the NIST SP 800-30, Rev 1.

The Contractor shall document all open findings/vulnerabilities with a raw risk level of low (CAT III) or higher in a Plan of Action & Milestones (POA&M). The Contractor shall document in the POA&M details of each finding, impacted security control(s), associated raw and residual levels of risk, current mitigations, estimated milestone and completion dates, and a plan to mitigate or eliminate risks in the future, which must be delivered to and approved by the Government quarterly.

The Contractor shall ensure that the JTT software undergoes a Government software evaluation process to receive and/or maintain a current and valid software certificate authorizing the use of JTT on Intelligence, Surveillance, and Reconnaissance (ISR) systems for each software version. The Contractor shall obtain the certification through the Air Force (AF) Intelligence Community (IC) Authorizing Official (AO) Certificate to Field (CTF) process or per a reciprocal certification process such as the National Geospatial-Intelligence Agency (NGA) Software Approval Process (SWAP) Certification.

The Contractor shall support all tasks required to obtain, maintain, and renew all cybersecurity authorizations and approvals across all relevant security domains and enclaves, as necessary, including, but not limited to:

· Authority to Proceed (ATP)

· (Interim) Authority to Test (IATT/ATT)

· Authority to Operate (ATO)

· Authority to Connect (ATC)

· Certificate to Field (CTF), SWAP Certification, or equivalent software certification Fielding The Contractor shall provide support to field and deploy cloud and OP instances of JTT within open and closed networks.

The Contractor shall coordinate with the Government to develop and implement a schedule for software deployments.

The Contractor shall supply a technical support team upon contract award, equipped to install and deploy JTT 6.x at all OP locations worldwide.

Sustainment The Contractor shall implement incremental formal code inspection with each planned fielding release delivery.

Once fielded, the Contractor shall ensure JTT remains operational and secure by executing tasks that include, but are not limited to: bug fixes and security patches.

SYSTEM SUPPORT REQUIREMENTS

Technical/Engineering Support The Contractor shall provide remote-based and on-premises technical and engineering support for field exercises, as directed by the Government.

The Contractor shall provide engineering expertise and technical support for new installations of cloud-based and on-premises JTT software, as directed by the Government.

The Contractor shall provide engineering expertise and technical support for existing cloud-based and on-premises JTT software instances, as directed by the Government. This includes, but is not limited to:

· Air Operation Centers (AOCs)

· DoD Combatant Commands (CCMDs)

· Foreign Military Sales (FMS) instances Help Desk The Contractor shall provide around-the-clock Help Desk assistance and technical support for the global user base across various security domains, including, but not limited to:

· Non-classified Internet Protocol (IP) Router Network (NIPRNet)

· Secret Internet Protocol Router Network (SIPRNet)

· Joint Worldwide Intelligence Communication System (JWICS) Training The Contractor shall provide initial, schoolhouse, ongoing, and pre-exercise training at CONUS and OCONUS sites when directed by the Government.

The Contractor shall support up to 24 training sessions per year. These sessions shall be either at the Contractor’s facility, user locations, or virtually. This includes 12 annual trips for the Mobile Training Team (MTT): six (6) CONUS and six (6) OCONUS. Comment by RUSANGIZA, DIDIER N CTR USAF AFMC AFLCMC/C3CW: Are these 12 in addition to the 24 or part of them:

2.2.1.1.1 The Contractor shall provide up to twelve (12) onsite training sessions per year at CONUS and OCONUS sites.

The Contractor shall provide three (3) personnel to conduct JTT user training. Of the three personnel, one (1) personnel shall be based at the Contractor facility to provide general user training while the other two (2) are mobile trainers that shall provide site-specific training.

The Contractor shall ensure that user training materials are created and kept up-to-date with the fielded software. Training material may include, but is not limited to, user training manuals, administrator training documentation, training videos, and other material related to training users and administrators of JTT.

The Contractor shall deliver updated training materials with each JTT software release.

SECURITY REQUIREMENTS

Personnel Security (PERSEC) The Contractor shall maintain appropriate security clearances for personnel to meet the performance requirements in this PWS.

The Contractor shall ensure that all personnel who require access to or may generate classified data must be a U.S. citizen and hold an active security clearance to the level of data being accessed or generated in accordance with the DD Form 254 for this effort.

The Contractor shall staff the necessary personnel with Top Secret/Sensitive Compartmented Information (TS/SCI) security clearance eligibility required to support the transition from the incumbent upon contract award.

All Contractor personnel shall, at a minimum, have an Interim Secret level security clearance or be eligible to obtain a Secret level security clearance to work on this contract.

The Contractor shall ensure that personnel requiring Top Secret/Sensitive Compartmented Information (TS/SCI) access obtain an interim TS/SCI clearance within 120 calendar days of direction. Comment by RUSANGIZA, DIDIER N CTR USAF AFMC AFLCMC/C3CW: Calendar or business days?

The Contractor shall ensure personnel whose clearances have been denied, suspended or revoked cease work on the contract and are immediately denied access to classified information and/or CUI and classified items. Furthermore, the Contractor shall confirm to the Government CO and COR that such actions have been completed.

The Contractor shall inform the Government CO and COR of that all the personnel requiring access to a DoD and/or Government computer networks/systems and/or facilities to ensure that they obtain and maintain a Government Common Access Card (CAC).

The Contractor shall ensure that Contractor personnel working on this contract shall sign a nondisclosure agreement (NDA) and shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

The Contractor shall provide all signed NDAs by Contractor personnel to the Government CO and COR.

Cyber Security The Contractor shall implement requisite and best-practice security and cybersecurity procedures, including, but not limited to those defined by: National Institute of Standards & Technology (NIST), DoD, Air Force, the Intelligence Community, DFARS and/or Cybersecurity Maturity Model Certification (CMMC).

The Contractor shall ensure that all personnel that require administrator access to DoD Information Systems and/or hold cyber work roles are compliant with DoD 8140 Cyber Workforce Qualification Program (formerly DoD 8570) and meet intermediate proficiency level qualifications.

The Contractor shall maintain, throughout the execution of the contract, at least one cybersecurity staff member who meets advanced proficiency level qualifications for the Information System Security Manager role as defined in DoD 8140 Cyber Workforce Qualification Program (formerly DoD 8570).

The Contractor shall inform the Government within one (1) business day when personnel system access is no longer required. This includes, but is not limited, to when personnel are terminated, transferred, changes in personnel’s system usage and/or need-to-know.

The Contractor shall notify the Government within two (2) hours of any suspected or actual security incidents/violations involving the JTT system(s) and/or system information IAW DFARS Clause 252.204-7011 and the JTT Incident Response Plan.

The Contractor shall regularly perform required internal cybersecurity testing, such as self-assessments, consistent chaos, and audits, and support third-party cybersecurity assessments, including penetration testing and security control assessments. Upon request, the Contractor shall provide cybersecurity test results to the Government.

The Contractor shall develop recommendations addressing how to maintain and/or improve the JTT security posture and execute upon such recommendations with Government approval.

The Contractor shall continuously implement and support a Zero Trust Architecture (ZTA) in accordance with the DoD Zero Trust Strategy, Air Force directives, and in collaboration with the Government.

The Contractor shall support a secure software development lifecycle IAW the Risk Management Framework (RMF) process per DoD Rules and Regulations, Department of Air Force Instructions/Manuals, and any applicable Intelligence Community Directives (ICDs).

The Contractor shall create, contribute to, and deliver Risk Management Framework (RMF) and other security artifacts as required to earn or maintain an Authorization to Operate (ATO) on both Joint Worldwide Intelligence Communication System (JWICS) and Secure Internet Protocol Router Network (SIPRNET). Documents and information may include but is not limited to:

· System Security Plan inputs

· Security scans and STIG results

· Security control traceability matrix inputs

· Software versions and applicable certifications

· System diagrams

· Vulnerability and patch management plans

· Incident response plan

· Contingency/Disaster recovery plan

· Configuration management inputs

· Ports, Protocols and Services Matrix

· Continuous Monitoring Plan, Reviews, and Updates The Contractor shall complete STIG reviews, and deliver the results to the Government quarterly.

Physical Security The Contractor shall furnish and maintain facilities, network connectivity, and material through this contract to server as the primary Place of Performance for the perform the requirements in this PWS.

The Contractor shall possess and maintain a Top-Secret Facility Security Clearance (FCL) through the performance of this contract per the requirement specified in the DD Form 254.

The Government will provide or facilitate Contractor access to all facilities, as required, to perform its duties IAW this PWS.

The Contractor shall be subject to all DoD, Air Force and local unit rules and regulations while working on or visiting military installations or Government facility.

SERVICES DELIVERY SUMMARY (SDS)

(Reserved)

CUI

image1.jpeg