Attachment 1 - Statement of Work (SOW).pdf

DISTRIBUTION STATEMENT A: Approved for public release, distribution is unlimited (4 DECEMBER 2017)

INFORMATION ASSURANCE AND CYBER SECURITY PROGRAM OFFICE

PMW 130

KGV-11 MODERNIZATION (KGV-11M)

CONTRACT STATEMENT OF WORK (SOW)

09 January 2018

Table of Contents

1.0 INTRODUCTION

1.1 Scope

1.2 Background

2.0 APPLICABLE DOCUMENTS

2.1 Military Standards

2.2 Other Publications

3.0 REQUIREMENTS

3.1 Program Management (RDTE) (CLINs 0001, 0002, 0102)

3.1.1 Post Award Conference (RDTE) (CLIN 0001)

3.2 Meetings and Reviews (RDTE) (CLINs 0001, 0002, 0102)

3.2.1 Program Management Reviews (RDTE) (CLINs 0001, 0002, 0102)

3.2.2 Technical Interchange Meetings (RDTE) (CLIN 0001, 0002, 0102)

3.2.3 Weekly Status Meetings (RDTE) (CLINs 0001, 0002, 0102)

3.3 Reporting (RDTE) (CLINs 0001, 0002, 0102)

3.3.1 Monthly Status Report (RDTE) (CLINs 0001, 0002, 0102)

3.3.2 Integrated Master Schedule (RDTE) (CLIN 0001)

3.3.3 Risk Management and Reporting (RDTE) (CLINs 0001, 0002, 0102)

3.3.4 Quality Assurance (RDTE) (CLIN 0001)

3.4 Configuration Management (RDTE) (CLIN 0001)

3.5 Design Reviews (RDTE) (CLIN 0001)

3.5.1 System Requirements Review (SRR) (RDTE) (CLIN 0001)

3.5.2 Preliminary Design Review (PDR) (RDTE) (CLIN 0001)

3.5.3 Critical Design Review (CDR) (RDTE) (CLIN 0001)

3.6 Development and Fabrication (RDTE) (CLIN 0001)

3.6.1 Software and Programmable Logic Integration (RDTE) (CLIN 0001)

3.6.2 Engineering Drawings (RDTE) (CLIN 0001)

3.6.2.1 Engineering Drawings, Software, and Configuration Item Database (CLIN 0001) 15

3.6.2.2 Product Drawings and Associated Lists (CLIN 0001)

3.7 Test Readiness (RDTE) (CLIN 0001)

3.8 Testing (RDTE) (CLIN 0001)

3.8.1 Testing Simulator (RDTE) (CLIN 0001)

3.9 Post-SVT NSA Certification Support (RDTE) (CLIN 0001)

3.10 Conversion of PRAs to CCI (RDTE) (CLIN 0001)

3.11 Production Readiness Review (PRR) (RDTE) (CLIN 0001)

3.12 Engineering Services (RDTE) (CLIN 0002, 0102)

3.13 Production (OPN) (CLINs 1001, 1002, 1004, 2001, 2002, 2004, 3001, 3002, 3004, 3005)

3.13.1 Program Management (OPN) (CLINs 1001, 2001, 3001)

3.13.1.1 Meetings and Reviews (OPN) (CLINs 0001, 0002, 0102, 1001, 1002, 2001, 2002, 3001, 3002)

3.13.1.2 Program Management Reviews (OPN) (CLINs 1001, 1002, 2001, 2002, 3001, 3002)

3.13.1.3 Weekly Status Meetings (OPN) (CLINs 1001, 1002, 2001, 2002, 3001, 3002) ... 22

3.13.2 Reporting (OPN) (CLINs 1001, 1002, 2001, 2002, 3001, 3002)

3.13.2.1 Monthly Status Report (OPN) (CLINs 1001, 1002, 2001, 2002, 3001, 3002)

3.13.2.2 Risk Management and Reporting (OPN) (CLINs 1001, 1002, 2001, 2002, 3001, 3002)

3.13.2.3 Quality Assurance (OPN) (CLINs 1001, 2001, 3001)

3.13.2.4 Configuration Management (OPN) (CLINs 1001, 2001, 3001)

3.13.3 Engineering Change Proposal (ECP) (OPN) (CLINs 1001, 2001, 3001)

3.13.4 Item Unique Identification (IUID) (OPN) (CLINs 1001, 2001, 3001)

3.13.5 Quality Conformance Inspection (OPN) (CLINs 1001, 2001, 3001)

3.13.5.1 Failure Analysis and Corrective Actions (OPN) (CLINs 1001, 2001, 3001)

3.13.6 Provisioning Items (OPN) (CLIN 1004, 2004, 3004)

3.13.7 Support Equipment (OPN) (CLIN 3005)

3.13.8 Engineering Services (OPN) (CLINs 1002, 2002, 3002)

4.0 DELIVERABLES (CLINS 0004, 0005, 1003, 2003, 3003)

5.0 GOVERNMENT FURNISHED PROPERTY (GFP)

6.0 SECURITY REQUIREMENTS

6.1 Personnel Requirements

7.0 PLACE OF PERFORMANCE AND TRAVEL

7.1 Place of Performance

7.2 Travel (CLIN 0003, 0103)

8.0 POINTS OF CONTACT

1.0 INTRODUCTION

1.1 Scope

This Statement of Work (SOW) defines the requirement for the development, fabrication, integration, testing, production, and delivery of modernized KGV-11 (KGV-11M) appliqué units.

The end product of the development effort shall be fully tested, National Security Agency (NSA)-certified, Controlled Cryptographic Items (CCI) operational KGV-11M units that meet the requirements of the KGV-11M Technical Requirements Document (TRD), the KGV-11M Information Assurance Security Requirements Directive (IASRD), and the KGV-11M Telecommunications Security Requirement Document (TSRD).

The KGV-11M units will replace the currently fielded legacy KGV-11A units and will provide upgraded NSA-certified encryption/decryption of 25 kilohertz (kHz) Demand Assigned Multiple Access (DAMA) orderwire messages for the Navy TD-1271 Ultra High Frequency (UHF) DAMA multiplexer.

1.2 Background

The legacy KGV-11A Electronic Key Generator device is a general purpose, half duplex module that supports Communications Security (COMSEC) and Transmission Security (TRANSEC) functions over data rates of 16 kilobits per second (kbps) to 10 megabits per second (mbps).

The KGV-11A appliqué unit, which attaches to the TD-1271 terminal system host, performs decryption of Channel Control Orderwire (CCOW) and encryption of Return CCOW (RCCOW) messages exchanged between the TD-1271 user terminal and the Joint Military Satellite Communications (MILSATCOM) Network Integrated Control System (JMINI CS) 25 kHz DAMA controller. The orderwire messages provide for timing, configuration, and satellite control, and DAMA TD-1271 terminal identification.

2.0 APPLICABLE DOCUMENTS

The Contractor shall comply with the following specifications, standards, handbooks, and other reference documents as defined herein. If a conflict exists between the stated and referenced documents, the following order of precedence shall be used:

1. Contract (to be completed at contract award); and

2. The stated versions of the documents referenced in Section 2.1 and 2.2.

2.1 Military Standards

Document Title Date MIL-STD-130N(1) Standard Practice: Identification Marking of

U.S. Military Property 16 Nov 2012

MIL-STD-167/1A Test Method Standard: Mechanical Vibrations of Shipboard Equipment (Type I-Environmental

02 Nov 2005 and Type II-Internally) MIL-STD-188-183A Interoperability Standard for 25-kHz

TDMA/DAMA Terminal Waveform (Including 5- and 25-kHz Slave Channels)

20 Mar 1998

MIL-STD-202H Test Method Standard: Electronic and Electrical Component Parts

18 Apr 2015

MIL-STD-461G Interface Standard: Requirements for the Control of Electromagnetic Interference Characteristics of Subsystems and Equipment

11 Dec 2015

MIL-STD-464C Interface Standard: Electromagnetic Environmental Effects, Requirements for Systems

1 Dec 2010

MIL-STD-740/2 Structure-Borne Vibratory Acceleration Measurements and Acceptance Criteria of Shipboard Equipment

30 Dec 1986

MIL-STD-810G

(w/CHANGE-1)

Test Method Standard: Environmental Engineering Considerations and Laboratory Tests

15 Apr 2014

MIL-STD-882E Standard Practice: System Safety 11 May 2012

MIL-STD-883K

(w/CHANGE-2)

Test Method Standards: Microcircuits 22 Feb 2017

MIL-STD-1310H Standard Practice: Shipboard Bonding, Grounding, and Other Techniques for Electromagnetic Compatibility, Electromagnetic Pulse (EMP) Mitigation, and Safety

12 Aug 2014

MIL-STD-1399/300B Interface Standard: Electric Power, Alternating Current

24 Apr 2008

MIL-STD-1472G Design Criteria Standard: Human Engineering 11 Jan 2012 MIL-STD-1474E Design Criteria Standard: Noise Limits 15 Apr 2015 MIL-STD-1686C Electrostatic Discharge Control Program for

Protection of Electrical and Electronic Parts, Assemblies and Equipment (excluding Electrically Initiated Explosive Devices)

25 Oct 1995

MIL-STD-2073-1E(1) Standard Practice for Military Packaging 07 Jan 2011

MIL-STD-3018

(w/CHANGE-2)

Standard Practice: Parts Management 02 June 2015

MIL-STD-31000A Technical Data Packages 26 Feb 2013

2.2 Other Publications

Document Title Date N/A

Technical Requirements Document (TRD) to Cryptographically Modernize the KGV-11A for the TD-1271 UHF DAMA Terminal

N/A Information Assurance Security Requirements July 2016

Document Title Date Directive (IASRD)

N/A Technical Security Requirements Document

(TSRD) KGV-11M

Feb 2016

N/A Software Analysis and Assessment Process Description (SAAPD) KGV-11M

June 2016

N/A THORNTON TRANSEC Algorithm Modernization (TTAM) for AES Algorithm

30 Sept 2015

NSA No. 87-8A Interface Specification for KGV-11A/C General Purpose COMSEC/TRANSEC Module

12 Aug 1988

DS-56 NSA Data Standard for the Preparation of INFOSEC Technical Manuals

11 Dec 2007

NSA-2J Nameplates/Labels and Marking of Electronic and Electromechanical Equipment

09 Aug 1988

EE163-GA-OMI-

010/E106-TD1271B

Operator and Maintenance Instructions Organizational Level Multiplexer TD-1271/B/U

15 May 1984

ASQ/ANSI/ISO

Q9001-2015

Quality Management Systems Requirements 23 Sept 2015

ANSI EIA-649B Configuration Management Standard 01 Apr 2011 DoDI 5000.64 Accountability and Management of DoD

Equipment and Other Accountable Property 21 July 2017

N/A DoD Integrated Master Plan and Integrated Master Schedule Preparation and Use Guide

21 Oct 2005

N/A DoD Risk, Issue, and Opportunity Management Guide for Defense Acquisition Programs

Jan 2017

NSTISSAM

TEMPEST/1-92

Compromising Emanations Laboratory Test Requirements Electromagnetics

15 Dec 1992

ISO/IEC/IEEE

15288:2015

System and Software Engineering – System Life Cycle Processes

07 Jul 2015

MIL-HDBK-263B Electrostatic Discharge (ESD) Control Handbook for Protection of Electrical and Electronic Parts, Assemblies, and Equipment (Excluding Electrically Initiated Explosive Devices)

31 July 1994

GEIA-HB-649A Configuration Management Standard Implementation Guide

01 Mar 2016

MIL-S-901D Requirements for Shock Tests. H.I. (High- Impact) Shipboard Machinery Equipment, and Systems

17 Mar 1989

NAVSEA Instruction 4734.1B

NAVSEA Test, Measurement, and Diagnostic Equipment (TMDE) and Calibration Programs

08 Sept 2004

Federal Information Processing Standard

Advanced Encryption Standard 26 Nov 2001

SPAWAR Instruction 4440.12A

Management of Operating Materials and Supplies, Government Furnished Property, and

11 Apr 2016

Document Title Date Inventory

CNSSI 4000 Maintenance of COMSEC Equipment 12 Oct 2012 N/A ASN/RDA Memorandum, Department of the

Navy (DON) Software Measurement Policy for Software Intensive Systems

22 July 2008

3.0 REQUIREMENTS

This section identifies the efforts that shall be accomplished by the Contractor during the design, development, production, and testing of the KGV-11M units. The Contractor shall perform the efforts set forth in this SOW and shall comply with all other provisions as called for in the Contract Data Requirements List (CDRL) (DD Form 1423), invoked specifications, and other referenced documents. The Contractor shall conduct testing (pursuant to SOW Section 3.7) to ensure that a fully compliant product is delivered to the Government for acceptance.

The KGV-11M TRD establishes the functional requirements and performance baseline for the KGV-11M. If changes are deemed required by the Government, which result in a need for modification to the current baseline, the Government will assess the impact of the proposed modifications and consider the potential inclusion as a revision to the scope of this effort.

Additionally, the Contractor shall perform related Test and Evaluation activities and achieve NSA High Assurance (previously known as Type-1) certification for the KGV-11M units, utilizing an existing NSA-certified cryptographic engine with an NSA-approved randomizer design.

3.1 Program Management (RDTE) (CLINs 0001, 0002, 0102)

As a general requirement of the contract, the Contractor shall provide program management efforts as described below during the performance of this contract commencing the date of contract award. The Contractor shall provide a management plan that describes the Contractor’s organization, assignment of functions, duties, responsibilities, management procedures and policies, and reporting requirements for the conduct of contractually imposed tasks. Clear lines of authority and responsibility between all organizational elements for the Contractor are to be established and defined.

The Contractor shall establish a formal organization responsible for accomplishing the efforts outlined in this SOW. The Contractor shall maintain an integrated management control system for performance of the efforts associated with this SOW. This system shall provide the framework for assigning work responsibility, and summarizing planned vs. actual accomplishments. The Contractor shall appoint a Program Manager (PM) who shall be responsible for the management of the tasks set forth in this SOW. The PM shall have the authority and responsibility for performing the efforts set forth in the contract. The PM shall develop a Program Management Plan (PMP). The PMP shall be made available for Government inspection. The Contractor PM shall be the principal Point of Contact (POC) for all program communications between the Government and the Contractor. The Contractor shall maintain records of such communications and these records will be made available to the Government upon request.

The Contractor shall maintain and implement a management program that clearly defines how the KGV-11M effort will be managed and controlled. The Contractor shall organize, coordinate, and control all internal project activities (including those that are assigned to subcontractors) during all phases of the KGV-11M program to ensure the correct and timely delivery of all supplies and services specified in this contract.

The Contractor shall use the KGV-11M Contracting Officer Representative (COR) as the primary POC for all program activities. The Contractor shall deliver the data required under this contract as specified in the CDRLs (DD Form 1423). Deliverable data, including subcontractor and vendor data for uniquely developed items, shall be consistent with the requirements of the

CDRL.

The Contractor shall provide electronic-mail (e-mail) notification to the COR and other Government personnel identified on the CDRL Addressee List within twenty-four (24) hours of CDRL delivery. Classified documents shall be delivered on optical media (i.e., Digital Versatile Disc (DVD)) only.

Unless otherwise approved by the Government, the Contractor shall use Microsoft (MS) Office 2010 and MS Project 2010 for the preparation of documents that are to be electronically transferred to the Government. Adobe Acrobat formatted files are acceptable only for documents such as test reports that require original documents to be scanned.

The Contractor shall provide the following deliverable:

CDRL A001 – Program Management Plan (PMP)

3.1.1 Post Award Conference (RDTE) (CLIN 0001)

The Contractor shall host a Post Award Conference (PAC) with the Government Program Office and Contracting representatives. The PAC will be scheduled by the Procurement Contracting Officer (PCO) and will occur approximately thirty (30) calendar days after contract award. The Contractor shall present business and technical management procedures that shall be implemented in order to accomplish the requirements of the contract.

The Contractor shall provide updates to the Software Development Process Description Document (SDPDD) and the Integrated Master Schedule (IMS) provided during the Request for Proposal process.

The Contractor shall provide the following deliverables at the PAC:

CDRL A002 – Integrated Program Management Report, Format 6 (IMS) CDRL B004 – Software Development Process Description Document (SDPDD)

3.2 Meetings and Reviews (RDTE) (CLINs 0001, 0002, 0102)

In addition to the System Engineering Technical Review (SETR) events, and the meetings and reviews described below, the Government reserves the right to schedule additional reviews or working groups if critical issues arise or significant events/changes have occurred.

3.2.1 Program Management Reviews (RDTE) (CLINs 0001, 0002, 0102)

The Contractor shall conduct quarterly Program Management Reviews (PMR), aligning reviews with other planned reportable activities, such as Technical Interchange Meetings (TIM) and SETR events, where feasible. These reviews shall be no more than two (2) days in duration and shall occur at the Contractor’s facility or via teleconference unless specifically requested by the Government to occur elsewhere.

The PMR content shall include all aspects of the contract addressing cost (Cost Type efforts only), schedule, and performance. This shall include, but not be limited to: schedule status, progress against major milestones, cost/funding status, subcontractor performance and subcontractor critical item identification status, risk management, action items, close-out of program reviews, manpower, Configuration Management (CM), hardware and software engineering, logistics, Quality Assurance (QA), safety status, Technical Direction Letter (TDL) status, and any factors affecting contract deliverables.

The reviews during the Development phase of the contract shall address the status of all ongoing tasks and the task progress relevant to the IMS, progress of deliverables toward the next SETR event, and expenditure tracking.

The Contractor shall make information available regarding software design and status, hardware design and status, task status, test results, drawings and production status, upon Government request to demonstrate contract and specification compliance.

The Contractor shall provide the following deliverables at the PMR:

CDRL A004 – Presentation Materials CDRL A005 – Report, Record of Meeting/Minutes

3.2.2 Technical Interchange Meetings (RDTE) (CLIN 0001, 0002, 0102)

The Contractor shall conduct TIMs at the Government’s request (but not more frequently than monthly) to discuss topics and review documentation including the KGV-11M design, requirements, integration, testing, security, production, logistics, and analysis shall be conducted via teleconference, unless otherwise directed. The Contractor shall assume up to three formal classified TIMs, as required, with the NSA during the Development phase. During the TIMs, the Contractor shall address algorithm implementation details and NSA security requirements for certification.

The Contractor shall provide the following deliverables at every TIM:

CDRL A003 – Presentation Materials CDRL A004 – Report, Record of Meeting/Minutes

3.2.3 Weekly Status Meetings (RDTE) (CLINs 0001, 0002, 0102)

The Contractor shall conduct Weekly Status Meetings beginning after the Post Award Conference, except when superseded by a PMR, in the performance of this contract. Weekly Status Meetings shall be conducted via teleconference and shall include discussion of any information that has impact upon the task activities.

3.3 Reporting (RDTE) (CLINs 0001, 0002, 0102)

3.3.1 Monthly Status Report (RDTE) (CLINs 0001, 0002, 0102)

The Contractor shall provide a monthly report to the Government containing current status/progress of efforts, significant events during the reporting period, identification of issues/risks, status and mitigation of existing risks, and outstanding and incomplete issues from prior Monthly Status Reports (MSR). Additionally, the Contractor shall forecast efforts planned over the next two (2) months, and provide a list of planned trips during the reporting period.

The Contractor shall provide the following deliverables:

CDRL A005 – Contractor Progress, Status, and Management Report (MSR)

3.3.2 Integrated Master Schedule (RDTE) (CLIN 0001)

The Contractor shall maintain and deliver an IMS. The IMS shall contain the planned events and milestones, all activities from contract award to contract completion, activity entrance and exit criteria, and risks/risk mitigation activities. The IMS shall reflect the mutually agreed upon tasks, dates (baseline, forecast, and actual), external and internal dependencies, and relationships necessary to support independent accurate forecasts of contract milestone delivery dates.

The Contractor shall provide the following deliverables:

CDRL A002 – Integrated Program Management Report, Format 6 (IMS)

3.3.3 Risk Management and Reporting (RDTE) (CLINs 0001, 0002, 0102)

The Contractor shall establish a risk management and reporting process consistent with the guidance in the Risk Management Guide for DoD Acquisition or equivalent internal Contractor processes throughout the life of the contract. The Risk Management Plan (RMP) must define and assess program cost, schedule, and technical performance risks associated with the program. The Contractor shall address risk assessment and subsequent management of any risk associated with non-compliance to the TRD and KGV-11M design.

The risk management process and reporting activities shall be addressed as part of the PMP and known risk areas and risk management activities shall be briefed as part of the PMRs. If the Contractor becomes aware of a risk that may impact cost, technical, or schedule performance, the Contractor shall notify the COR within five (5) business days, via e-mail, of the risk that has been identified.

The Contractor shall provide the following deliverables:

CDRL A006 – Risk Management Plan (RMP)

3.3.4 Quality Assurance (RDTE) (CLIN 0001)

The Contractor shall utilize its existing quality engineering system, which shall be International Organization for Standardization (ISO) 9001:2015 compliant.

The Contractor shall document, implement, and maintain a QA system, including reviews, inspections, tests, reports, procedures, and process and product evaluations. The Contractor shall provide a QA Plan at the PAC, and updates upon Government request. The QA Plan shall include a transition process from the Development phase to the Production phase. The Contractor’s QA system will ensure conformance to all SOW requirements.

The Contractor shall provide the following deliverables:

CDRL A007 – Quality Assurance (QA) Plan

3.4 Configuration Management (RDTE) (CLIN 0001)

Using GEIA-HB-649A as guidance, the Contractor shall establish and maintain a CM Program that includes an organizational structure and CM process. The Contractor shall establish CM procedures for internal and external coordination and approval. As specified in the CM Plan, each Contractor/Subcontractor-provided KGV-11M configuration item and deliverable shall be under formal configuration control. The CM Program shall include, but not be limited to:

Configuration Identification Process;

Configuration Control Process;

Configuration Control Board responsibilities;

Configuration Status Accounting and Reports;

Configuration Audit Process;

Interface Control Process;

Subcontractor CM; and Subcontractor Engineering Document Control.

The Configuration Control Process shall identify the forms and methods that will be used to submit and process Engineering Change Proposals (ECP).

The Contractor shall provide the following deliverable:

CDRL A008 – Configuration Management (CM) Plan

3.5 Design Reviews (RDTE) (CLIN 0001)

The Contractor PM shall ensure that all Contractor action items are understood and implemented.

The Contractor shall provide the analyses and methodologies used in arriving at specific recommendations and conclusions for a design approach. The Contractor shall make applicable engineering data, specifications, drawings, schematics, design and test documentation, software development files (including design documentation), schedules, working papers, and results of studies and analyses available for reference and Government inspection at the reviews. The Contractor’s key personnel supporting review topics shall be available to respond to Government inquiries. Subcontractors of critical items shall be present at all design reviews, as directed by the Government. The Contractor shall present the data from the Risk Management (refer to Section

3.3.3 of this SOW) and testing strategy during all design reviews.

3.5.1 System Requirements Review (SRR) (RDTE) (CLIN 0001)

The SRR event is used to ensure that system requirements have been completely and properly identified and that a mutual understanding exists between the Government and the Contractor.

During the SRR phase leading up to the SRR event, the Contractor shall review all applicable Government Furnished Information (GFI), develop its technical approach to meet the contract requirements, and develop all deliverables for the SRR event.

At the SRR event the Contractor shall present their understanding of the requirements, and describe how its technical concept is expected to meet these requirements; the process that will be used to develop the product baselines; and the risks involved and how they will be managed.

In anticipation of the SRR event, the Contractor shall provide the following deliverables to the Government in accordance with the delivery timelines specified in the individual CDRL items:

An initial Interface Design Description (IDD), which shall provide analysis to verify and document the interface design for the KGV-11M to TD-1271 interfaces and recommend any additional verification testing or retesting necessary to finalize the IDD;

The initial Subsystem Specification (SSS), which shall address how all Government requirements will be met and verified, with cross references to NSA security documentation, such as the Software/Hardware Requirements Specification (SHRS), as applicable;

The initial SHRS, which shall be developed in accordance with TSRD Paragraph 2.6, shall detail the plans for developing the controls in the development of the software and firmware, including details of how the existing software and firmware will be reused. The SHRS shall include the Software Interface Requirements Specification (SIRS) which documents all hardware and software interfaces; and

An update to the SDPDD.

The SRR shall be considered complete after the Government acceptance of deliverable items, and adjudication and closure of all Government comments.

The deliverables for the SRR event correspond to the following CDRL items:

CDRL A003 – Presentation Material CDRL A004 – Report, Record of Meeting/Minutes CDRL A009 – Interface Design Description (IDD) CDRL A010 – Subsystem Specification (SSS) CDRL B004 – Software Development Process Description Document (SDPDD) CDRL B005 – Software/Hardware Requirements Specification (SHRS)

3.5.2 Preliminary Design Review (PDR) (RDTE) (CLIN 0001)

The PDR event is used to ensure the KGV-11M design has a reasonable expectation of satisfying the requirements within the currently allocated budget and timeline.

During the PDR phase leading up to the PDR event, the Contractor shall perform initial hardware and software design activities to develop the initial KGV-11M design, which shall utilize an already NSA High Assurance certified cryptographic engine with an NSA approved randomizer.

The design shall implement the software and firmware requirements delineated in the SSS and

SHRS.

At the PDR event, the Contractor shall present the strategy for the design of the KGV-11M and include considerations such as form and fit to the TD-1271, design partition, integration approach of components, reuse of existing equipment/components, cost/weight/volume estimation, and environmental design factors. The Contractor shall also demonstrate how the design complies with the specification, contractual requirements, and NSA security requirements.

Prior to the PDR event, the Contractor shall provide the following deliverables to the Government in accordance with the delivery timelines specified in the individual CDRL items:

The initial Security Evaluation Document (SED), developed in accordance with TSRD Paragraph 2.2, which shall provide information about the architectural design of the Information Assurance (IA) product and its intended detailed implementation throughout the development/design of the product;

An update to the SSS and SHRS with any requirement changes that result from the design activities;

A proposed spare parts list, which shall identify the Contractor’s recommended spare parts required to maintain the KGV-11M. The Contractor shall recommend quantities of each item down to the board level for the KGV-11M units, as well as consumable items;

A Software/Hardware Design Description (SHDD), which shall be developed in accordance with TSRD Paragraph 2.7;

An update to the SDPDD;

A final IDD;

The initial Key and Certificate Management Plan (KCMP), which shall be developed in accordance with TSRD Paragraph 2.9; and An initial Key/Certificate Specification (KCS), which shall be developed in accordance with TSRD Paragraph 2.9.3.

The PDR phase shall be considered complete after the Government acceptance of the associated CDRL items, and adjudication and closure of all critical comments and action items.

The deliverables for the PDR event correspond to the following CDRL items:

CDRL A003 – Presentation Material CDRL A004 – Report, Record of Meeting/Minutes CDRL A009 – Interface Design Description (IDD) CDRL A010 – Subsystem Specification (SSS)

CDRL A011 – Proposed Spare Parts List CDRL B001– Security Evaluation Document (SED) CDRL B004 – Software Development Process Description Document (SDPDD) CDRL B005 – Software/Hardware Requirements Specification (SHRS) CDRL B006 – Software/Hardware Design Description (SHDD) CDRL B008 – Key and Certificate Management Plan (KCMP) CDRL B009 – Key/Certificate Specification (KCS)

3.5.3 Critical Design Review (CDR) (RDTE) (CLIN 0001)

The CDR event is used to present the detailed design of the KGV-11M, to include hardware, software, firmware, reliability, and security requirements, and to establish the PBL.

Prior to the CDR event, the Contractor shall perform additional hardware and software design activities to develop the final KGV-11M design, incorporating all Government requested changes into the PDR documentation.

The CDR phase shall be considered complete after the Government acceptance of the associated CDRL items, and adjudication and closure of all critical comments and action items.

Prior to the CDR event, the Contractor shall provide the following deliverables to the Government in accordance with the delivery timelines specified in the individual CDRL items:

An updated SSS which shall include a Requirements Traceability Matrix capable of demonstrating that the design implements the performance requirements;

A reliability prediction and a corrective maintenance analysis of all components and associated quantities comprising the KGV-11M;

The second SED to include Fail Safe Design Analysis (FSDA) date if traditional FSDA is chosen, Covert Channel Analysis (CCA), and Theory of Compliance (TOC) data;

An update to the SHRS with any requirement changes that result from the design activities;

An update to the SDPDD;

An update to the SHDD;

An initial Security Verification Plan and Procedures, developed in accordance with

TSRD Paragraph 2.3;

A verification of the KCMP and KCS, in accordance with TSRD Paragraphs and all subparagraphs of 2.9;

An In-Process Accounting Procedures Document, which shall be developed in accordance with TSRD Paragraph 2.12.1 and shall document any NSA-approved use of FOCI Material;

An Information Security (INFOSEC) Anonymity Plan, which shall be developed in accordance with TSRD Paragraph 2.16; and

A Physical Configuration Audit (PCA) plan, which shall be developed in accordance with TSRD Paragraph 2.10.

The deliverables for the CDR event correspond to the following CDRL items:

CDRL A003 – Presentation Material

CDRL A004 – Report, Record of Meeting/Minutes CDRL A010 – Subsystem Specification (SSS) CDRL A012 – Reliability and Maintainability Predictions Report CDRL B001 – Security Evaluation Document (SED) CDRL B002 – Security Verification Plan and Procedures CDRL B004 – Software Development Process Description Document (SDPDD) CDRL B005 – Software/Hardware Requirements Specification (SHRS) CDRL B006 – Software/Hardware Design Description (SHDD) CDRL B008 – Key and Certificate Management Plan (KCMP) CDRL B009 – Key/Certificate Specification (KCS) CDRL B010 – Physical Configuration Audit Plan CDRL B014 – In-Process Accounting Procedures Document CDRL B017 – INFOSEC Anonymity Plan (IAP)

3.6 Development and Fabrication (RDTE) (CLIN 0001)

During the Development and Fabrication phase, the Contractor shall develop, release, and integrate hardware, software, and firmware for the KGV-11M in accordance with the SDPDD, SHRS, and SSS. All development work shall be conducted in an isolated environment.

The Contractor shall deliver to the Government three (3) Production Representative Article (PRA) KGV-11Ms at least sixty (60) days prior to TRR, for purposes of Government evaluation and NSA testing.

3.6.1 Software and Programmable Logic Integration (RDTE) (CLIN 0001)

After CDR and until Security Verification Testing (SVT), on a monthly basis the Contractor shall analyze the software that has been built to date against the issues described in TSRD Paragraph 2.4.1(a). The Contractor shall record and maintain the results of the analysis. The analysis results shall be accessible to the Government for informal review at the Contractor’s facility or via remote access. The monthly analysis results shall address, at a minimum, the issues described in Section 2.4 of the TSRD.

The Contractor shall provide the following deliverables:

CDRL B007 – Software and Programmable Logic Evaluation Report (SPLER)

3.6.2 Engineering Drawings (RDTE) (CLIN 0001)

3.6.2.1 Engineering Drawings, Software, and Configuration Item Database (CLIN 0001)

The Contractor shall develop and maintain technical documentation consisting of:

Engineering drawings that accurately reflect the custom Configuration Items (CI) composing the INFOSEC Boundary;

Executable software and source files for operational and custom support software utilized within the INFOSEC Boundary, including any batch, command, data, or other software files needed to successfully install/operate the software and a version description of the software;

CI database reflecting the INFOSEC Boundary; and Custom CI engineering drawings, executable software and source files, and the CI database.

After the CI and CI database have been baselined in accordance with TSRD 2.10, all proposed changes and variances within, or which affect, the INFOSEC Boundary shall be submitted to the NSA for processing and approval. The Contractor shall obtain NSA approval of changes and variances prior to incorporation of changes or the shipment of any product affected by the change or variance.

3.6.2.2 Product Drawings and Associated Lists (CLIN 0001)

The Contractor shall prepare and deliver Product Drawings/Models and Associated Lists to provide the design, engineering, manufacturing, and QA requirements information necessary to enable the manufacture or procurement of items essentially identical to the original item. The Product Drawings and Associated Lists shall be developed in accordance with TSRD Paragraph 2.14.2.

The Contractor shall provide the following deliverables:

CDRL B016– Product Drawings/Models and Associated Lists

3.7 Test Readiness (RDTE) (CLIN 0001)

The TRR event is used to verify that test planning is adequate to proceed to formal Government-witnessed testing. System deficiencies that may have an impact on the test results shall be presented for Government approval. The review shall address what testing the Contractor has already accomplished and the results of those tests, and a proposed approach to resolve outstanding deficiencies. Test procedures to be used shall also be presented along with any recommended modifications.

Leading up to the TRR event, the Contractor shall develop all test plans and procedures for the following tests: Requirements Verification; Environmental; Electromagnetic Interference/Electromagnetic Compatibility (EMI/EMC); Security Verification; and TEMPEST.

The TRR phase shall be considered complete after the Government acceptance of the associated CDRL items, and Government approval of the Contractor’s Test and Evaluation Program Plan.

Prior to the combined SVT/TRR event, the Contractor shall provide the following plans and procedures to the Government in accordance with the delivery timelines set forth in the individual CDRL items:

A Requirements Verification Plan and Procedures for the purpose of test planning and tracking of test results, and to demonstrate compliance with all system functional, performance, environmental, and product quality requirements;

An Environmental Test Plan and Procedures, which shall contain a complete listing of all tests to be conducted to demonstrate compliance with the environmental requirements in the TRD and identify planned activities for implementation of environmental tests (e.g.

salt, fog, temperature);

Electromagnetic Interference Control Procedures (EMICP) and Electromagnetic Interference Test Procedures (EMITP) which shall contain a complete listing of all tests to be conducted to demonstrate compliance with the EMI requirements in the TRD and shall identify planned Contractor activities for implementation of EMI tests;

A final Security Verification Plan and Procedures;

An Interface Control Document (ICD), which shall document the final interface design;

A TEMPEST Test Plan, which shall be developed in accordance with TSRD Paragraph

2.11.2;

A pre-SVT SPLER Report, which shall contain the as-built Source and Executable

Software Code and Hardware Description Language (HDL), and shall be developed in accordance with TSRD Paragraphs 2.8.1.1 through 2.8.1.5;

An update to the SHRS to include assigned test procedure numbers;

An update to the SED to describe final design data;

An update to the SHDD to describe final design data;

A final KCMP and KCS; and A Security Production Assurance program plan, which shall be developed in accordance with TSRD Para 2.13.

The Contractor shall provide the following deliverables:

CDRL A003 – Presentation Material CDRL A004 – Report, Record of Meeting/Minutes CDRL A013 – Requirements Verification Plan and Procedures CDRL A014 – Environmental Test Plan and Procedure CDRL A015 – Electromagnetic Interference Control Procedures (EMICP) CDRL A016 – Electromagnetic Interference Test Procedures (EMITP) CDRL B001 – Security Evaluation Document (SED) CDRL B002 – Security Verification Plan and Procedures CDRL B005 – Software/Hardware Requirements Specification (SHRS) CDRL B006 – Software/Hardware Design Description (SHDD) CDRL B007 – Software and Programmable Logic Evaluation Report (SPLER) CDRL B008 – Key and Certificate Management Plan (KCMP) CDRL B009 – Key/Certificate Specification (KCS) CDRL B012 – TEMPEST Test Plan CDRL B015 – Quality Program Plan (Security Production Assurance Description) CDRL B019 – Interface Control Document (ICD)

3.8 Testing (RDTE) (CLIN 0001)

The Contractor shall produce seven (7) PRAs, in addition to the three (3) PRAs delivered prior to TRR, for the purposes of testing. The Contractor shall conduct all planned tests, witnessed by the Government, to verify the KGV-11M performance complies with the requirements in the TRD.

The Contractor shall perform regression testing, analyze and fix defects, and perform potential redesign associated with the identified corrective actions in accordance with the CM Plan processes. All results of the tests shall be documented in the specified test reports.

Upon testing completion having been verified by the Government, the Contractor shall provide the following deliverables:

CDRL A017 – Test/Inspection Report – Environmental Test CDRL A018 – Electromagnetic Interference Test Report (EMITR) CDRL B003 – Security Verification Report CDRL B007 – Software and Programmable Logic Evaluation Report (SPLER) CDRL B013 – TEMPEST Test Evaluation Report

3.8.1 Testing Simulator (RDTE) (CLIN 0001)

The Contractor shall develop a TD-1271 simulator which shall be utilized to exercise the KGV- 11M in operation as necessary to support testing. The simulator shall be able to conduct a series of tests to confirm correct operation of the KGV-11M on an individual pass/fail test basis and shall include capability to run continuous operation tests with keyed KGV-11M (encrypt/decrypt/alarm, etc.). The use of simulation to support test purposes shall be approved by the Government on a case-by-case basis where use of the TD-1271s is not available or practical.

The Contractor shall deliver the simulator to the Government upon request, in accordance with SOW Section 3.13.6.

3.9 Post-SVT NSA Certification Support (RDTE) (CLIN 0001)

After the successful completion of SVT, the Contractor shall conduct a Hardware Physical Configuration Audit (PCA) and a software/firmware/HDL PCA, witnessed by the Government.

The Contractor shall be responsible for the disassembly and subsequent reassembly of the product/system unit audited during the Hardware PCA.

The Contractor shall develop the following documents and provide as deliverables to support NSA certification of the KGV-11M:

A PCA Summary Report, which shall be developed in accordance with TSRD Paragraph 2.10, and shall be delivered after the completion of the PCA and shall validate the executable software/firmware/HDL file(s) and verify the accuracy of the “as built” configuration of the INFOSEC Boundary against the technical documentation package;

An operator’s manual for the KGV-11M which shall be developed in accordance with TSRD Paragraph 3.4.1, and shall utilize NSA Data Standard for the Preparation of INFOSEC Technical Manuals (DS-56) as a guide to ensure format and content are consistent with other operations and maintenance manuals currently in use by the Government. The Operator’s Manual shall include: Installation procedures, including pre-installation preparation, with applicable safety and product usage warnings; a description of the KGV-11M and its operation within the TD-1271 UHF DAMA terminal; step-by-step operating instructions; an operator’s troubleshooting guide; and a quick start guide;

A maintenance manual for the KGV-11M, which shall be developed in accordance with TSRD Paragraph 3.4.2 and shall utilize NSA Data Standard for the Preparation of

INFOSEC Technical Manuals (DS-56) as a guide to ensure format and content are consistent with other operations and maintenance manuals currently in use by the Government; and

A Written Course of Instruction for Key Personnel to support the KGV-11M, which shall be developed in accordance with TSRD Paragraph 3.3.

The Contractor shall develop and provide the following deliverables for NSA certification in accordance with the following CDRL items:

CDRL A019 – Operator’s Manual CDRL A020 – Maintenance Manual CDRL A021 – Written Course of Instruction for Key Personnel CDRL B007 – Software and Programmable Logic Evaluation Report (SPLER) CDRL B011 – Physical Configuration Audit (PCA) Summary Report

3.10 Conversion of PRAs to CCI (RDTE) (CLIN 0001)

After NSA Certification, and prior to the Production Readiness Review event, the Contractor shall convert six (6) of the seven (7) PRA units that were delivered for testing to CCI and deliver these units to the Government.

3.11 Production Readiness Review (PRR) (RDTE) (CLIN 0001)

During the PRR, the Contractor shall determine the status of completion of the specific actions that must be satisfactorily accomplished prior to the Government executing a production go-ahead decision. The Contractor shall demonstrate and document how the final design meets all Government requirements. The Contractor shall assess the risks associated with production including any manufacturing concerns, processes, and long lead materials that may impact production. The Contractor shall demonstrate progress toward completion of process documentation, inventory and supplier management, attaining the program's production goals, resolving manufacturing problems (or that a plan for their resolution acceptable to the Government has been developed), and mitigating all production risks. The Contractor shall show that the system design has included those key production factors (e.g., least cost, minimum manufacturing time, manufacturing simplicity/flexibility, resource availability) necessary to assure the system can be acquired on schedule at minimum cost.

The Contractor shall address the below questions for the production go-ahead decision:

Has the system product baseline been established and documented to enable hardware fabrication and software coding to proceed with proper configuration management?

Are adequate processes and metrics in place for the program to succeed?

Are risks known and manageable?

Is the program schedule executable (technical/cost risks)?

Is the program properly staffed?

Is the detailed design producible?

Identify required production processes and manufacturing techniques not currently available, and the risks associated with deployment;

Characterize manufacturing risks and identify mitigation strategies;

Identify potential impact of critical and long lead items and production equipment;

Identify potential production bottlenecks and limiting factors to rate production;

Identify process prove-out methods;

Validate work instructions;

Identify manpower and equipment requirements; and Identify supply chain and parts obsolescence issues.

Prior to the PRR event, the Contractor shall present the following deliverables:

A Requirements Verification Report that documents the results of the requirements verification process as described in the Requirements Verification Plan and Procedures.

The report shall indicate any requirements verified in other test reports by document and section (e.g., Security Verification Report, TEMPEST, etc.); and

A Production Readiness Report that includes the following: Outline Design Configuration for Production Representative KGV-11M; Summary of all authorized requirement deviations; summary of NSA certification and releaseability status;

assessment of any constraints that could affect future production, along with proposed mitigation strategies; assessment of activities required to support production; production test approach, including how the Contractor proposes proving that units will meet QA and performance requirements, prior to delivery; in-service support and obsolescence plan.

The deliverables for the PRR correspond to the following CDRL items:

CDRL A022 – Requirements Verification Report CDRL A023 – Production Readiness Report

3.12 Engineering Services (RDTE) (CLIN 0002, 0102)

The Contractor shall perform Cost Plus Fixed Fee (CPFF) activities to support development of the KGV-11M in accordance with TDLs received and consistent with the contract. The specific activities will be defined in the individual TDL issued by the Government, but will likely include the tasks listed below:

Enhanced software/firmware capability;

Modifications to support enhancements to the user interface;

Addition of new functionality to support interoperability; and Forward compatibility with future systems.

3.13 Production (OPN) (CLINs 1001, 1002, 1004, 2001, 2002, 2004, 3001, 3002, 3004, 3005)

Upon exercise of the Production option(s) by the Government, the Contractor shall procure parts/components, build, test, and deliver one thousand six hundred seventy-one (1,671) KGV- 11M units.

3.13.1 Program Management (OPN) (CLINs 1001, 2001, 3001)

As a general requirement of the contract, the Contractor shall provide program management efforts as described below during the performance of this contract commencing the date of contract award. The Contractor shall provide a management plan that describes the Contractor’s organization, assignment of functions, duties, responsibilities, management procedures and policies, and reporting requirements for the conduct of contractually imposed tasks. Clear lines of authority and responsibility between all organizational elements for the Contractor are to be established and defined.

The Contractor shall establish a formal organization responsible for accomplishing the efforts outlined in this SOW. The Contractor shall maintain an integrated management control system for performance of the efforts associated with this SOW. This system shall provide the framework for assigning work responsibility, and summarizing planned vs. actual accomplishments. The Contractor shall appoint a Program Manager (PM) who shall be responsible for the management of the tasks set forth in this SOW. The PM shall have the authority and responsibility for performing the efforts set forth in the contract. The PM shall develop a Program Management Plan (PMP). The PMP shall be made available for Government inspection. The Contractor PM shall be the principal Point of Contact (POC) for all program communications between the Government and the Contractor. The Contractor shall maintain records of such communications and these records will be made available to the Government upon request.

The Contractor shall maintain and implement a management program that clearly defines how the KGV-11M effort will be managed and controlled. The Contractor shall organize, coordinate, and control all internal project activities (including those that are assigned to subcontractors) during all phases of the KGV-11M program to ensure the correct and timely delivery of all supplies and services specified in this contract.

The Contractor shall use the KGV-11M Contracting Officer Representative (COR) as the primary POC for all program activities. The Contractor shall deliver the data required under this contract as specified in the CDRLs (DD Form 1423). Deliverable data, including subcontractor and vendor data for uniquely developed items, shall be consistent with the requirements of the

CDRL.

The Contractor shall provide electronic-mail (e-mail) notification to the COR and other Government personnel identified on the CDRL Addressee List within twenty-four (24) hours of CDRL delivery. Classified documents shall be delivered on optical media (i.e., Digital Versatile Disc (DVD)) only.

Unless otherwise approved by the Government, the Contractor shall use Microsoft (MS) Office 2010 and MS Project 2010 for the preparation of documents that are to be electronically transferred to the Government. Adobe Acrobat formatted files are acceptable only for documents such as test reports that require original documents to be scanned.

3.13.1.1 Meetings and Reviews (OPN) (CLINs 0001, 0002, 0102, 1001, 1002, 2001, 2002, 3001, 3002)

In addition to the System Engineering Technical Review (SETR) events, and the meetings and reviews described below, the Government reserves the right to schedule additional reviews or working groups if critical issues arise or significant events/changes have occurred.

3.13.1.2 Program Management Reviews (OPN) (CLINs 1001, 1002, 2001, 2002, 3001, 3002)

The Contractor shall conduct quarterly Program Management Reviews (PMR).