DRAFT_SOW_0335.doc

Statement of Work JRE Cybersecurity Updates

1. INTRODUCTION

This effort is to ensure that cybersecurity requirements are incorporated into the current design of the system and changes in cybersecurity are maintained / updated throughout the systems development life cycle.

2. BACKGROUND

In order to comply with DoD Instruction 8500.01, Cybersecurity Requirements, NSWC Corona, Range Systems Division, is seeking Cybersecurity Sustainment support for the JRE systems used on the Navy Tactical Training Ranges.

3. SCOPE

NSWC, Corona, Code RS29 requires JRE Software Cybersecurity support for systems operating on Combined Tactical Training Range networks.

3.1.1 Applicable NSWC/SCORE JRE Serials:

· NSWC Beaufort – 4211

· NSWC Cherry Point – 4210

· NSWC Cherry Point – 12057

· NSWC Fallon – 4217

· NSWC Fallon - 4216

· NSWC Jacksonville - 1114

· NSWC Key West – 4212

· NSWC Lemoore – 4218

· NSWC Oceana – 4209

· NSWC Oceana – 13034

· NSWC Yuma – 3071

· NSWC Yuma – 3236

· SCORE - 4219

4. APPLICABLE DOCUMENTS

DoD Instruction 8500.01

5. REQUIREMENTS

CLIN

QTY

Description

JRE Cybersecurity Updates

The following section specifies the task requirements for the contract:

5.1 JRE Baseline Establishment –

5.1.1 The contractor shall utilize a CTTR-provided Windows 10 DISA SHB as a CTTR JRE baseline image.

5.2 Maintain Security Compliance –

5.2.1 The contractor shall ensure the JRE software maintains complete functionality while maintaining compliance, remediating (close), mitigating, or recommending disposition of the most recent quarterly release of all applicable DISA STIGs. NSWC will notify the contractor when updates to applicable STIGs are released. Applicable DISA STIGs will include:

· Microsoft Windows 10 STIG

· Oracle JRE (X) Windows STIG

· Microsoft .NET Framework STIG

· Microsoft Internet Explorer (X) STIG

5.2.2 The contractor shall test both CTTR JRE baseline images against any newly-released STIG configuration requirements provided by CTTR. Confirmation of this testing and/or any applicable changes to CTTR JRE baseline images shall be delivered no later than 30 days after new quarterly releases.

5.3 Vulnerability Management –

5.3.1 The contractor shall maintain and patch all applicable vulnerabilities and IAVM releases that require support to remediate (close) or mitigate, or recommend disposition. NSWC will require these actions within 30 days for CAT I vulnerabilities and 180 days for CAT II vulnerabilities. The contractor shall conduct patch testing on both CTTR JRE Baselines, ensuring JRE software sustains full functionality upon remediation and mitigation or other disposition actions, and inform NSWC of all testing results.

5.3.2 Engility will make an effort to reply within 30 days. However, Engility will commit to 12 1-month cycles. Any applicable Microsoft or Oracle patches that are released to the public by the fifteenth of the month will be tested by Engility during the second half of the month. Any items released within the test period will be held for the fifteenth of the following month.

5.4 Host Based Security System Support –

5.4.1 The contractor shall provide support for development and testing of HBSS Firewall rules HIPS Signatures and Application Control Whitelisting and shall provide NSWC Corona with the following items and updates to the items when changes are required:

· Ports, Protocols and Services required for operation

· Applications required for operation

5.4.2 The contractor shall provide on-call support while establishing a JRE HBSS baseline. Government test environments that include HBSS server capabilities can be provided to facilitate baseline testing, if required.

A. REQUIRED DELIVERY DATE