MADO - SOO.pdf

UNCLASSIFIED

Statement of Objectives V 1.0

WAN 1.0 10JUN2020

(U) United States Cyber Command

(USCYBERCOM)

(U) Statement of Objectives (SOO)

MARITIME DONCASTER (MADO)

27 AUG 2020

WAN 1.0 10JUN2020

UNCLASSIFIED

Contents

1. Scope or Mission

1.2 Background

2. Performance Objectives

2.1 Overall Objectives

2.2 Design Objectives

2.2.1 Minimum Configuration and Performance Requirements

2.2.2 WAN Uplinks

2.2.3 WAN Downlinks

2.2.4 WAN Automated Recovery

2.2.5 Out-of-Band Management Zone

2.2.6 Workstations

2.2.7 WAN Security Requirements

2.3 Technical Objectives

2.4 Program Objectives

2.5 Other Direct Costs

3. Period of Performance

3.1 Place of Performance

4. Delivery

5. Contractor Access to Government Facilities

6. Security

6.1. Security Controls

6.1.1 NIST 800-53

6.1.2 Security Categorization of FIPS 199 Assessment

7. Section 508 standards

8. Special Requirements

Appendix A: Acronyms

1. Scope or Mission

This is a prototype to provide system development services to achieve and maintain superiority in the cyberspace domain, deliver strategic and operational advantages for the Joint Force, and defend and advance our national interests. In order to achieve this United States Cyber Command

(USCYBERCOM) has developed a strategic plan to provide a joint cyber warfare architecture that includes operations platforms. As a means to develop the underpinning infrastructure to deliver the operations platforms USCYBERCOM has authorized an Wide Area Network (WAN) ring that will serve as foundational infrastructure for follow on services and capabilities to utilize.

1.2 Background

USCYBERCOM desires a new enterprise WAN capability to enable communication among geographically separated sites, while ensuring the stability, security and speed needed to support mission-critical operations and other business functions. USCYBERCOM meets our nation's demands for uninterrupted vigilance, fail-safe cyber security, adaptive response and engineering excellence by delivering secure, integrated and innovative solutions . USCYBERCOM serves joint and national warfighters' unified efforts to best cope with the dangers of the 21st century and beyond by enabling them to respond to any situation, anywhere, at any time.

The WAN provides valuable benefits to USCYBERCOM by improving operational efficiencies that enable network communications and sharing of remote resources while also enabling

USCYBERCOM to achieve cost-effective operations and administration of its own infrastructure.

2. Performance Objectives

In order to provide the Contractor with broad discretion to structure and define the tasks, schedule, requirements and cost as they apply to the Contractor’s approach and solution, the Government has prepared this SOO. It will be the responsibility of the Contractor to prepare a Statement of

Work (SOW) in response to the SOO which demonstrates the Contractor’s understanding of the

WAN.

USCYBERCOM desires to create a prototype for a next-generation WAN to support cloud computing and data center efforts. The WAN shall serve as an underlay network, connecting multiple, geographically distinct Communities of Interest (COIs) together. The WAN shall provide

Internet Protocol (IP) interconnectivity for multiple, discrete enterprise networks, which shall operate at different security, classification, and trust levels from the WAN.

The prototype shall successfully demonstrate all network functionality required to connect independent COIs together. The prototype shall implement the security functionality required for the production system to be accredited and then deployed in a Department of Defense (DoD) environment. The Contractor shall create the documentation required for security accreditation.

Certification and Accreditation (C&A) activities are in scope for the prototype.

WAN 1.0 10JUN2020

UNCLASSIFIED

Objectives for the prototype are to provide automated network operations, provide a pathway to reduce manpower required for operations of the network, and identify how the administrative functions might be integrated with the enterprise network administration.

USCYBERCOM desires this vehicle to have an option for follow-on production. This SOO is scoped to deliver a prototype system. Once the prototype is delivered, evaluated and accepted as complete, USCYBERCOM may choose or may not choose to enter production and may choose or may not choose to utilize this vehicle for follow on production work.

2.1 Overall Objectives

Objective 2.1.1 – The Contractor shall create a prototype for a next generation WAN to support cloud computing and date center efforts. The underlay circuits shall provide the transport to connect multiple, geographically distinct COIs together.

Objective 2.1.2 – The prototype shall successfully demonstrate all network functionality required to connect the independent COIs together.

Objective 2.1.3 – The protoype shall implement the security functionality that is required for the prototype to be accredited and then deployed in a DoD environment.

Objective 2.1.4 – The Contractor shall complete C&A activities to certify and accredit the

WAN.

Objective 2.1.5 – The WAN shall provide IP interconnectiveity for multiple, discrete enterprise networks, which operate at different security, classification, and trust levels from the WAN.

Objective 2.1.6 – Contractor shall include a preliminary design, the level of effort required to build a working prototype, and a realistic timeline for integrating and developing the complete prototype. The timeline shall include routine technical discussions and capability demonstrations with the Government in order to reduce risk and provide feedback on the prototype.

Objective 2.1.7 – The prototype shall focus on core design and functionality. The design shall include the hardware necessary to demonstrate the functionality of the system.

Hardware implementation during this pre-production, prototyping phase of the 4 site WAN is necessary. Virtualization shall be leveraged to demonstrate functionality and analysis can be used to demonstrate scalability and full system performance. System engineering and design artifacts shall capture the differences between the demonstrated prototype and proposed production level system.

Objective 2.1.8 – Informal technical exchanges shall be supported by the Government at the Contractors request. At the conclusion of prototype development, the Government shall observe the Contractor execution of a Test and Evaluation Plan (TEP). If the prototype test and evaluation event demonstrates capabilities that meet Government requirements, the

WAN 1.0 10JUN2020

UNCLASSIFIED

Government shall execute procurement of the final prototype system. The Contractor shall then deliver, install and deploy the prototype system within the Contractor facility. The

Contractor shall also assist with Government acceptance testing.

Objective 2.1.9 – The Contractor shall provide a definitive milestone and/or deliverable schedule with its proposed pricing structure which identifies at a minimum:

2.2 Design Objectives

The Contractor is responsible for the architecture, configuration, and technology used to meet

USCYBERCOM requirements and technologies must be reliable Commercial-Off-the-Shelf

(COTS) hardware and software and have been previously deployed in support of other commercial and/or Government networks.

2.2.1 Minimum Configuration and Performance Requirements

Objective 2.2.1 – The Contractor-owned WAN equipment shall connect four geographically distinct USCYBERCOM sites in a closed access network environment.

Objective 2.2.2 – The Contractor-owned, on premises architecture providing WAN access will interface with existing Government provided 8 - 10 Gigabit (Gb) dedicated Subscriber

Connector (SC), single-mode point-to-point fiber circuits for transport between four

USCYBERCOM sites.

2.2.2 WAN Uplinks

Objective 2.2.3 – The WAN access design and equipment must be able to support a 100

Gb circuit upgrade between sites without removal or replacement of the entire system. The upgrade process must be performed without a complete outage.

2.2.3 WAN Downlinks

Objective 2.2.4 – The WAN shall provide 48 connections to support concurrent connection to up to 48 Community of Interest (COI) enclaves. The 48 connections shall support 10Gb

Lucent Connector (LC) fiber and 1 Gb if a COI requires it.

Objective 2.2.5 – At each site, the WAN shall interface with multiple, discrete COI networks concurrently with the ability to scale to add COIs if the Government desires.

COIs will have connectivity at all four USCYBERCOM sites with the ability to configure connectivity at a subset of the sites.

Objective 2.2.6 – The WAN must provide security measures to ensure protection of the confidentiality and integrity of the COI at each interface as well as when the COI data is traversing the WAN uplinks.

2.2.4 WAN Automated Recovery

Objective 2.2.7 – All WAN services shall automatically recover in the event of a failure.

Failures include, but are not limited to:

o WAN circuit failures o Single device failures o Entire site failures

WAN 1.0 10JUN2020

UNCLASSIFIED

2.2.5 Out-of-Band Management Zone

Objective 2.2.8 – The WAN shall include an out-of-band (OOB) management zone at each of the four (4) sites. There must be a full stack of OOB management hardware and software at two sites: the primary and secondary. The primary OOB site shall be capable of managing all four USCYBERCOM sites. The secondary OOB site shall be capable of becoming the primary site. All OOB services shall automatically failover in the event of a failure at one site. Failover is limited to the Government provided circuits.

Objective 2.2.9 – The primary and secondary OOB sites shall implement services required to operate and maintain the WAN including, but not limited to:

o Network Management (control of routers, switches, etc.)

o Authentication, Authorization and Accounting (AAA) o Directory Services o Domain Name Service (DNS) o Host Intrusion Prevention Service (IPS) (e.g. Host Based Security System (HBSS)) o Antivirus (AV) o Vulnerability Scanning (e.g. Assured Compliance Assessment Solution (ACAS)) o Multi-Factor Authentication (MFA) o Security Information Event Management (SIEM) or similar dashboard for alerts/health & status – o Security Infrastructure Management and Log Collection o Network Time Protocol (NTP)

Objective 2.2.10 – The OOB traffic site shall be encrypted when traversing a circuit between sites and the traffic being received from a circuit will be inspected. All traffic must be logged. All traffic being received from a circuit shall be configurable to be dropped or saved.

Objective 2.2.11 – There must be a minimal OOB at the two remote sites providing software, automation, and graphical interfaces reduce administrative burden for common tasks. OOB remote sites shall provide equipment and software shall be present for an administrator to login and troubleshoot incidents. The OOB remote sites shall provide localized logging and minimize OOB overhead on the WAN.

2.2.6 Workstations

Objective 2.2.12 – There shall be rack mount hardware (workstations, Keyboard, Video, Mouse (KVM), etc.) to operate and maintain the WAN at all four sites. The primary and secondary sites must have a fault tolerant configuration. The remotely administered sites must have a workstation configuration that allows for local control in the contingency that there are connectivity issues to the primary and secondary OOB sites.

Objective 2.2.13 – There shall be a minimum of two administration desktop workstations provided to the primary and two administrative desktop workstations provided to the secondary OOB sites for administration from a desk.

Note: Workstations cannot have camera, microphone, Bluetooth or any wireless devices.

WAN 1.0 10JUN2020

UNCLASSIFIED

2.2.7 WAN Security Requirements

Objective 2.2.14 – The following system capabilities are the responsibility of the

Contractor:

o Separate traffic between COI networks o Encrypt all traffic traversing WAN links utilizing Government approved encryption technologies o Prioritize traffic between security zones o Provide defense-in-depth such that if one security control function fails another security control function would be in place to prevent a security incident.

Objective 2.2.15 – The WAN shall implement DoD security guidance including Risk

Management Framework (RMF), Security and Technical Implementation Guidance

(STIG), and vulnerability scan requirements, including appropriate paperwork, to support

USCYBERCOM pursuing a full assessment and authorization package. See Section 7.1 –

Security Controls for specifics.

Objective 2.2.16 – The Contractor shall ensure that the WAN meets current security and privacy requirements defined by USCYBERCOM, DoD and Federal laws, regulations, and policies. Security and privacy requirements apply to individuals and organizations having contractual arrangements with the DoD, including Prime Contractors, sub-Contractors, and outsourcing partners.

Objective 2.2.17 – The Contractor shall provide system security in compliance with: the

Federal Information Security Management Act (FISMA), security-related guidelines and requirements for federal agencies issued by the National Institute of Standards and

Technology (NIST), security-related Office of Management and Budget (OMB) Circulars and Memorandums (e.g., OMB Circular A-130), and any future statutes, regulations, requirements, or guidelines for federal agencies relating to information and/or information system security. USCYBERCOM understands that future security requirements may require an increase in cost to meet these requirements.

Objective 2.2.18 – The Contractor shall provide security to protect the confidentiality, integrity and availability of information and systems developed and maintained on behalf of USCYBERCOM, commensurate with the risk and magnitude of harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction.

Objective 2.2.19 – The WAN shall segregate traffic between COIs using security measures

(e.g. encryption).

Objective 2.2.20 – The WAN shall enforce port security.

Objective 2.2.21 – The Contractor shall develop, and maintain a System Assessment

Package (SAP) for the WAN in accordance with the latest guidance contained in NIST

800-37.

Objective 2.2.22 – The Contractor shall incorporate the controls described in accordance with the latest NIST 800-53. After contract award, USCYBERCOM shall discuss with the

Contractor the applicable baseline security controls.

2.3 Technical Objectives

The Contractor shall identify the functional and non-functional requirements for this requirement through a Requirement Traceability Matrix (RTM) for Government validation and prioritization.

WAN 1.0 10JUN2020

UNCLASSIFIED

Objective 2.3.1 – The Contractor shall setup a development environment emulating the full network architecture in a Contractor-owned lab environment that approximates all storage, compute, and network required to implement and demonstrate the security controls identified in Section 7.1 – Security Controls. The development environment must be secured in compliance with USCYBERCOM Cybersecurity Guidelines and NIST guidance.

Objective 2.3.2 – The Contractor shall notify USCYBERCOM when the working model is operational and provide Government Approving Authority with access to the network. The

Approving Authority shall run any scans and determine the validity of the infrastructure from an operational and security standpoint.

Objective 2.3.3 – Throughout the design, testing, and system authorization phase, the

Contractor shall provide USCYBERCOM with remote access to all devices for the purpose of allowing designated Government personnel to track and validate the configuration progress. The exception to this requirement is the portion that requires the Contractor to disconnect the system in preparation of shipment to government data centers.

Objective 2.3.4 – Network configuration baselines shall be managed by software that automates services across network. This shall allow validation of:

o Configurations against security standards o Configurations prior to deployment o Roll back to a previous configuration in the event a configuration does not work as expected.

Objective 2.3.5 – The Contractor shall minimize the system size, weight, power, and cooling requirements.

2.4 Program Objectives

The Contractor shall provide a SOW/PWS which addresses establishing and managing a program management process, providing an accurate and timely schedule and performance information throughout the life cycle of the contract.

Objective 2.4.1 - Provide a Project Management Plan which explains how the Contractor will manage and coordinate the project based on the objectives in the SOO.

Objective 2.4.2 - Provide a Staffing Plan which explains how the Contractor will employ organizational resources and management controls to meet the cost, performance and schedule requirements for this effort.

Objective 2.4.3 - Provide a Quality Assurance Surveillance Plan which will set forth the

Contractor’s staffing and procedures for self-inspecting the quality, timeliness, responsiveness and customer satisfaction of all deliverables and tasks.

Objective 2.4.4 - Provide a sound risk management system through the integration of metrics to monitor program status to mitigate program risks and provide for special emphasis on the development efforts.

2.5 Other Direct Costs

The Contractor shall identify any other direct costs including travel in its response.

WAN 1.0 10JUN2020

SCHEDULE OF DELIVERABLES:

The Company shall, create, maintain, and update the deliverables in the performance of this effort, as indicated below in Table 1. Any deliverable defined in this Statement of Agreement shall be submitted in writing, under official company letterhead signed by representative designated by the company unless otherwise noted.

Milestone Description Completion Date

Contract Kickoff Meeting Contract Kickoff Meeting Award + 4 calendar days

Preliminary Design Review (PDR) Hold PDR Meeting Award + 10 calendar days

Critical Design Review (CDR) Hold CDR Meeting Award + 30 calendar days

Procure Hardware Procure Hardware Award + 45 calendar days

Receipt of Hardware Receipt of Hardware Award + 90 calendar days

Network Infrastructure Installation Installation at Contractor Lab Award + 95 calendar days

Configure WAN Configure servers, network devices, applications Award + 100 calendar days

Government Acceptance Test Hold Government Acceptance Test Award + 110 calendar days

Implement Security Controls Implement security controls Award + 120 calendar days

Security Scans and Remediation Run initial Security scans on all hardware and mitigate findings Award + 130 calendar days

Approving Authority Inspection Provide list of finding to mitigate Award + 140 calendar days

Final Approval Issued IATT Award + 170 calendar days

IOC WAN installed and tested Award + 180 calendar days

Monthly Status Report (MSR)

Monthly status report: monthly expenditures, project status, project risk/mitigation, POA&M updates

NLT 10th of the month

Vendor Documentation The Vendor shall complete and submit the following documentation

Project Management Plan (PMP) Shall be available at contract kickoff meeting Award + 4 calendar days

Project Schedule Shall be available at contract kickoff meeting Award + 4 calendar days

Configuration Management Plan

(CMP)

Shall be available at contract kickoff meeting Award + 4 calendar days

DoDAF Artifacts Shall be available at PDR and updated at

CDR

Award + 10 calendar days

OV-1

Shall be available at PDR and updated at

CDR

Award + 10 calendar days

OV-4

Shall be available at PDR and updated at

CDR

Award + 10 calendar days

CV-2

Shall be available at PDR and updated at

CDR

Award + 10 calendar days

OV-5a Shall be available at PDR and updated at

CDR

Award + 10 calendar days

OV-2

Shall be available at PDR and updated at

CDR

Award + 10 calendar days

TEP

Shall be available during Government

Acceptance Test Award + 110 calendar days

System Assessment Package

(SAP)

Shall be available during Accreditation

Activities Award + 110 calendar days

Hardware and Software

Configuration Profiles

Shall be available during Implementation of Security Controls Award + 10 calendar days

Discrepancy Reports Shall be available during Secuirty Scans and Remediation Award + 130 calendar days

Virtual Machine Images and/or

Containers to include

Shall be available during Secuirty Scans and Remediation Award + 130 calendar days

WAN 1.0 10JUN2020

UNCLASSIFIED

Milestone Description Completion Date

Software Build Environments" Shall be available during Secuirty Scans and Remediation Award + 130 calendar days

Software Licensing Shall be available during Secuirty Scans and Remediation Award + 130 calendar days

Software Source Code Shall be available during Secuirty Scans and Remediation Award + 130 calendar days

3. Period of Performance

The contract performance period is 6 months.

TO Period Months Description

Base Period 6 Prototype and Proof of Concept

3.1 Place of Performance

Performance shall be in the following locations:

Contractor facilities

Travel shall be authorized and planned for in performance of this Statement of Objectives (SOO).

For planning purposes travel to the following locations is provided:

Baltimore, MD

Augusta, GA

San Antonio, TX

Wahiawa, HI

4. Delivery

The Contractor shall include in its response the deliverables to be provided in conduct of this contract.

5. Contractor Access to Government Facilities

The Contractor shall identify in its response any government facilities access required in conduct of this SOO.

6. Security

As specified in the DoD Contract Security Classification Specification, DD Form 254, the

Contractor shall perform classified work under this task order. At time of task order award, the

Contractor shall have TOP SECRET (TS) facility clearance (FCL).

U.S. Government security clearance eligibility is required to access and handle classified and certain controlled unclassified information (CUI), attend program meetings, and work within

WAN 1.0 10JUN2020

UNCLASSIFIED

restricted areas unescorted. Access to SCI is limited to U.S. Government Facilities or other U.S.

Government sponsored SCI Facilities (SCIFs) authorized on the DD254. The Contractor shall not generate any SCI deliverables.

The Contractor shall comply with all applicable installation/facility access and local security policies and procedures, which may be obtained from the Contracting Officer’s Representative

(COR). The Contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office.

Note. If any conflicts exist between the information provide in this PWS and the DD254, the information in the DD254 takes precedence.

6.1. Security Controls

6.1.1 NIST 800-53

The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-53 (NIST SP

800-53), or establish a SSP(s) and POA&M that varies from NIST 800-53 only in accordance with

DFARS 252.204-7012(b)(2), for all covered Contractor information systems affecting this task order.

6.1.2 Security Categorization of FIPS 199 Assessment

System Classification: The WAN is classified as a National Security System (NSS)

Information Type

[ ] Administrative, Management and Support Information:

[X] Mission Based Information:

Security Categories and Levels:

Confidentiality Level: [ ] Low [X] Moderate [ ] High

Integrity Level: [ ] Low [X] Moderate [ ] High

Availability Level: [ ] Low [X] Moderate [ ] High

Overall Level: [ ] Low [X] Moderate [ ] High

7. Section 508 standards

The Contractor shall conform to all Section 508 requirements when developing, procuring, or maintaining electronic and information technology products or systems. The following Section

508 accessibility standards are applicable (if checked) to this effort:

Technical Standards

1194.21 - Software Applications and Operating Systems

1194.22 - Web Based Intranet and Internet Information and Applications

1194.23 - Telecommunications Products

1194.24 - Video and Multimedia Products

WAN 1.0 10JUN2020

UNCLASSIFIED

1194.25 - Self-Contained, Closed Products

1194.26 - Desktop and Portable Computers

1194.41 - Information, Documentation and Support

The Technical Standards above facilitate the assurance that the maximum technical standards are provided to the Offerors. Functional Performance Criteria is the minimally acceptable standards to ensure Section 508 compliance. This block is checked to ensure that the minimally acceptable electronic and information technology (E&IT) products are proposed.

Functional Performance Criteria

1194.31 - Functional Performance Criteria

8. Special Requirements

The Contractor shall identify in its response all labor categories and functional positions key to the successful performance of this contract.

The Contractor shall report all Organizational Conflict of Interest (OCI). The Contractor shall submit details for all contracted support to the contracting officer (to include subContractor team members) performed as either a prime awardee or subContractor, which could be interpreted as perceived, potential or actual OCI issues. OCI includes, at minimum, support provided on any contract at any time which may have resulted in the

Contractor obtaining an actual or perceived unfair advantage and could preclude them from receiving award.

The Contractor shall identify in its response if a Service Level Agreement (SLA) will be required for this SOO.

WAN 1.0 10JUN2020

UNCLASSIFIED

Appendix A: Acronyms

Acronym Description

AAA Authentication, Authorization and Accounting

ACAS Assured Compliance Assessment Solution

ATO Authority to Operate

AV Antivirus

C&A Certification and Accreditation

CDR Critical Design Review

CISO Chief Information Security Officer

COI Community of Interest

COR Contracting Officer Representative

COTS Commercial Off the Shelf

CUI Controlled Unclassified Information

DNS Domain Name Service

DoD Department of Defense

E&IT Electronic & Information Technology

FCL Facility Clearance

FISMA Federal Information Security Management Act

FTE Fullt-Time Equivalent

Gb Gigabit

HBSS Host Based Security System

IP Internet Protocol

IPS Intrusion Prevention Service

IV&V Independent Validation and Verification

JCWA Joint Cyber Warfare Architecture

KVM Keyboard Video Mouse

LC Lucent Connector

MFA Multi-Factor Authentication

NIST National Institute of Standards and Technology

NSS National Security System

NTP Network Time Protocol

OCI Organization Conflict of Interest

OEM Original Equipment Manufacturer

OMB Office of Management and Budget

OOB Out-of-Band

WAN 1.0 10JUN2020

UNCLASSIFIED

Acronym Description

PDR Preliminary Design Review

PMP Project Management Plan

POA&M Plan of Action and Milestones

RMF Risk Management Framework

RTM Requirements Tracebility Matrix

SAP System Assessment Package

SC Subsciber Connector

SCIF Sensitive Compartemented Information Facility

SIEM Security Information Event Management

SLA Service Level Agreement

SOO Statement of Objectives

SOW Statement of Work

STIG Security and Technical Implementation Guidance

TEP Test and Evaluation Plan

TS Top Secret

TS//SCI Top Secret//Sensitive Compartmented Information

USCYBERCOM United States Cyber Command

WAN Wide Area Network