18R0001 SOW for the Unrestricted MAC 16 May 2018.pdf

UNCLASSIFIED

STATEMENT OF WORK

FOR

CYBERSPACE SCIENCE, RESEARCH, ENGINEERING AND TECHNOLOGY

INTEGRATION

UNRESTRICTED MULTIPLE AWARD CONTRACT (MAC)

16 May 2018

1.0 INTRODUCTION

1.1 BACKGROUND

Cyberspace Operations are the employment of cyberspace capabilities where the primary purpose is to achieve objectives in or through the cyberspace domain. This domain is defined by the Secretary of Defense (SecDef) as "a global domain within the information environment consisting of the interdependent network of information technology infrastructures, including the internet, telecommunications networks, computer systems and embedded processors and controllers." The successful execution of Cyberspace Operations requires the integrated and synchronized employment of offensive, defensive, and Department of Defense Information Network (DODIN) operations, underpinned by effective and timely operational preparation of the Operating Environment. Cyberspace Operations missions encompass Offensive Cyberspace Operations (OCO), Defensive Cyberspace Operations (DCO), and DODIN Operations, based on their intent, not on the specific effects created, or the capabilities used.

OCO are intended to project power by the application of force in and through cyberspace; they include operations to attack automated systems (e.g., Command, Control, Communications, Computers, Intelligence, Surveillance and Reconnaissance (C4ISR)), and the interaction between the physical, social and biological networks that define human-machine interaction. DCO are intended to defend DoD or other friendly cyberspace domains, including network operations that encompass friendly C4ISR and Information Operations (IO) functions that occur within the cyberspace domain. DODIN Operations are actions taken to design, build, configure, secure, operate, maintain, and sustain DoD communications systems and networks in a way that creates and preserves data availability, integrity, and confidentiality, as well as user/entity authentication, authorization, and non-repudiation. DODIN Operations includes cyber security activities, security engineering, and all other activities and actions taken to ensure the integrity of systems, networks, and nodes that enable friendly use of the cyberspace domain. These missions are planned and executed at all levels of military operations, and commanders use Joint Functions concepts to integrate cyberspace capabilities into operational planning and execution, and to synchronize Cyberspace Operations with other operations and effects within the battlespace.

The Space and Naval Warfare Systems Center, Pacific (SSC Pacific), as the principle Navy Research, Development, Test and Evaluation (RDT&E) and Acquisition Center for C4ISR and IO is responsible for functions that include: mission analysis, assessment and development of technology base, basic and applied research, demonstration of technology, engineering in support of production, support to operating forces; supporting doctrine, policy, and strategy development; and integration of numerous National and Tactical systems in the area of Cyberspace Operations.

Increasingly, SSC Pacific, DoD and other Government customers require advice, assistance, coordination and products necessary to support operational planning, assessment, integration, execution and technology development to assure superiority for the warfighter in the cyberspace domain. Specific activities of interest required to achieve superiority in cyberspace include, but are not limited to:

- Cyberspace Operations (e.g., Offensive, Defensive, DoD Information Network, and ISR, Operational Preparation of the Environment (OPE), and other supporting functions) as they relate to the interdependent network of information technology infrastructures, including the internet, telecommunications networks, computer systems and embedded processors and controllers.

- Offensive Cyberspace Operations (OCO) against automated systems, and the interaction between the physical, social and biological networks that define human-machine interaction.

- Defensive Cyberspace Operations (DCO), includes both active and passive cyberspace defense operations, and utilizes cybersecurity, Security Engineering, and computer network defense measures to protect and defend friendly Naval, Joint and National systems.

- Department of Defense Information Network (DODIN) Operations, including cybersecurity planning, Security and Network Engineering, and Risk Management Framework to provide friendly forces with survivable defended communications and networks to support military operations.

- Cyberspace Intelligence, Surveillance and Reconnaissance (ISR) conducted in support of OCO, DCO and DODIN, and Space Operations mission planning and execution.

- Cyberspace Operational Preparation of the Environment (OPE) conducted in support of OCO, DCO, and DODIN, and Space Operations mission planning and execution.

- Cyberspace Operations Mission Assurance and Mission Planning.

- Cyberspace Situational Awareness (CSSA) and Understanding of the Operational Environment

(OE).

- Understanding aspects of human behavior and cognitive functions to influence adversary decision making (e.g., Military Information Support Operations (MISO), and Military Deception

(MILDEC)).

- Electronic Warfare (EW) to include Electronic Attack (EA) Electronic Support (ES) and Electronic Protect (EP) in the RF, millimeter wave, and optical environments.

- Electromagnetic Maneuver Warfare (EMW) – the area of EMW is closely related to Cyberspace Operations since cyber quite often flows through the electromagnetic spectrum (EMS) and in some instances can impact the ability of U.S., Allied and Coalition use of it. EMW is defined by OPNAV N2/N6 as, “Navy’s initiative to understand all activity in the spectrum, control our signature, and command the EMS as critical maneuver space. It includes all actions that create combat advantage in and through the EMS by disrupting the adversary’s kill chain while optimizing our own.” As such, EMW will be critical to warfighting in cyberspace.

- Monitoring, analyzing and mitigating Operations Security (OPSEC) vulnerabilities.

- The Joint Functions as they relate to Cyberspace Operations, including:

o Command and Control (C2) o Intelligence o Fires/Integrated Fires o Movement and Maneuver o Sustainment o Protection

- Protecting, storing, disseminating and managing information in the realm of cyberspace.

- Ubiquitous Communications and Computing Environment.

- Countermeasures including the capabilities and expertise to develop source identification tools, data management, and methodologies for object correlation and referencing.

- Analytical processing of data, including machine learning techniques, that enable an essential

Cyberspace Operations function or capability through features like predictive analysis or automation.

- Modeling, Simulation and Visualization of the future environment in which communications, computing, data, sensors and networks are interoperable, ubiquitous and transparent to humans.

- Understanding networks as a science and developing models which can provide clarity into how networks operate and resist or deter attack.

- Convergence of physical, biological and social networks and how this will effect human interactions and decision cycles.

- Understanding of Joint and Naval Cyberspace Operations Doctrine, and Tactics, Techniques and Procedures (TTP).

- Understanding Cyberspace Operations training objectives and sustainment strategy.

- Understanding Cyberspace Operations capabilities to include cryptology, cryptography, signals intelligence and analysis, and cybersecurity.

The work to be conducted under this contract will support SSC Pacific in creating capabilities and providing technical services to support technical and operational activities in the cyberspace domain by the Navy, DoD and other Government agencies.

1.2 SCOPE

The scope of this contract will include efforts to examine the architecture, engineering, functionality, interface and interoperability of Cyberspace Operations systems, services and capabilities at the tactical, operational and strategic levels, to include all enabling technologies. This will include operational exercise design and construction, operations and requirements analysis, concept formulation and development, feasibility demonstrations and operational and technical support. This will include efforts to analyze and engineer operational, functional and system requirements in order to establish national, theater and force level architecture and engineering plans, interface and systems specifications and definitions, and implementation, including hardware acquisition for turnkey systems. Additional efforts will include requirements verification and validation, engineering analysis, technical documentation, software and hardware design and implementation as well as systems integration, test and evaluation and demonstration, and applying a systems engineering approach to development.

Research and development in advanced technology and special technical operations requires periodic Contractor augmentation of a technical or scientific nature to meet technical as well as operational commitments and/or requirements. Contractor support is also required to supplement or provide personnel with specific expertise that is limited or not available at SSC Pacific. Areas of expertise that may be required include, but are not limited to: Cyberspace Operations doctrine/tactics, techniques and procedures (TTP); policy and strategy; operational planning, analysis and intelligence assessment;

measures of effectiveness (MOE) and measures of performance (MOP) development and evaluation;

electronic warfare; wargaming, modeling and simulation; systems engineering, systems analysis;

computer hardware and software engineering and development, implementation and integration;

operational research and analysis; communications and networking hardware; protocols; and security.

The work described below is representative of the type of requirements that currently exist or can reasonably be anticipated through fiscal year 2025. Because of the variety of tasks that may be required, specific work efforts will be initiated by means of delivery/task orders which will be issued in accordance with the provisions of this Statement of Work (SOW) and other provisions of the contract.

- Perform basic and applied research in Cyberspace Operations, its enabling technologies, techniques, and theory.

- Design and develop network, system, services and application architectures that support the rapid development and implementation of new technologies and capabilities that reflect the rapidly evolving techniques that characterize cyber attacks.

- Analyze, design, develop, document, integrate, test, install and maintain Cyberspace Operations enabling capabilities.

- Develop, implement, and integrate solution sets that enable a holistic command and control capability, with appropriate underpinning technologies and capabilities that provide for interagency communication and collaboration of cyber activities, and that appropriately support execution in an integrated joint fires framework.

- Serve as the test site (via the SSC Pacific labs and other Government facilities) for interoperability testing among Cyberspace Operations systems, tools, technologies and processes (both existing and new) prior to their introduction into operational environments.

- Serve as Integration, Validation, and Verification (IV&V) site for DoD certification of cyber tools, systems, and capabilities.

- Participate in cyber technology forums.

- Provide operational support to assist in technical and programmatic oversight of Cyberspace

Operations enabling systems, programs and functions.

- Provide Systems Engineering and Integration support to improve overall effectiveness of

Cyberspace Operations enabling systems, services and functions.

- Demonstrate and evaluate the application of advanced software and hardware concepts and technology to Cyberspace Operations enabling systems and functions.

- Associate information posted in cyberspace to a physical identity and originating location.

- Conduct analyses and systems engineering to develop initiatives in support of emerging

Cyberspace Operations requirements.

- Develop capabilities to detect and identify complex, multi-dimensional attacks on an adversary, including precursor activities, and to be able to correlate disparate events with their greater implications to the warfighter.

- Provide computer and network forensic capabilities.

- Perform analysis, algorithm development and implementation, and display for Cyberspace

Operations tools and data fusion drawn from various sources of information.

- Provide support for Cyberspace Operations experiments, exercises, and other events.

- Ensure cybersecurity Test and Evaluations (T&E) are conducted throughout the acquisition life cycle, integrated with interoperability and other functional testing,

- Ensure a cybersecurity representative participate in planning, execution and reporting of integrated T&E activities.

- Perform analysis of adversarial cyber threat capabilities to develop courses-of-action and response options under a variety of hypothetical scenarios.

- Conduct Cyberspace Operations Modeling and Simulation, wargaming and analysis.

- Perform risk assessment and mitigation planning.

1.3 REFERENCE DOCUMENTS

The following documents were used in the development of this SOW and may be invoked for individual delivery/task orders:

a. Cyberspace Policy Review, May 2009

b. U. S. Cyber Operations Policy, Presidential Policy Directive-20 (PDD-20, 2010)

c. Improving Critical Infrastructure Cybersecurity (Executive Order), 12 Feb 2013

d. International Strategy for Cyberspace, May 2011

e. Comprehensive National Cybersecurity Initiative, 2008

f. The National Security Strategy, February 2015

g. Department of Defense Strategy for Operations in Cyberspace, May 2011

h. Director of Central Intelligence Directive 7/3 Information Operations and Intelligence Community

Related Activities (U)

i. DODD O-8530.1 (CND)

j. DODI O-8530.2 (CND)

k. DoD Directive O-3600.3, Technical Assurance Standard for Computer Network Attack (CNA)

Capabilities, 13 May 2005

l. DoD Instruction O-3600.03, Technical Assurance Standard for Computer Network Attack (CNA) Capabilities, 22 Apr 2010

m. CJCSM 6510.01(Series) Cyber Incident Handling Program, 10 Jul 12

n. Joint Doctrine for Cyberspace Operations, Joint Pub 3-12, 5 Feb 2013

o. Joint Doctrine for Information Operations, Joint Pub 3-13, 27 Nov 2012

p. Naval Warfare Publication 3-12, Cyberspace Operations

q. Naval Warfare Publication 3-13, Navy Information Operations

r. Naval Warfare Pub 3-63 CNO Vol 1 and 2

s. NTTP 3.13.x series on Navy IO

t. SECNAVINST 5239.19 (Series), DON Incident Response/Reporting

u. SECNAVINST 5000.2 (Series), Implementation and Operation of the Defense Acquisition System and the Joint Capabilities Integration and Development System

v. NAVSEA Instruction 3900.8A, Human Systems Integration (HSI) Policy in Acquisition and

Modernization, 20 May 2005

w. Joint Force Component Commander-Network Warfare (JFCC-NW) Document, Computer

Network Attack Technical Assurance, 2009

x. JFCC-NW Document, Technical Assurance Evaluation Standards for Evaluated Level of

Assurance I, II, III, and IV, 2009

y. National Institute of Standards and Technology (NIST) Publications

z. SSC Pacific Organizational Set of Standard Processes (OSSP)

aa. OPNAVINST F3300.53C (Series),Navy Antiterrorism Program

bb. DOD 5220.22-M (Series), National Industrial Security Program Operating Manual (NISPOM)

cc. National Security Decision Directive 298 (Series), National Operations Security Program

(NSDD) 298

dd. DOD 5205.02 (Series), DOD Operations Security (OPSEC) Program

ee. OPNAVINST 3432.1 (Series), DON Operations Security

ff. SPAWARINST 3432.1 (Series), Operations Security Policy

gg. U.S. Cyber Operations Security Classification Guidance 1.0, 18 Jul 2013

hh. DOD 5200.01,Information Security Program Manual, 24 February 2012

ii. DoDI 5200.02, DoD Personnel Security Program (PSP), 9 September 2014

jj. DoD 5220.22-M, DoD Manual – National Industrial Security Program Operating Manual

(NISPOM), 28 February 2006

kk. DoDI 5220.22, DoD Instruction – National Industrial Security Program, 18 March 2011

ll. DoDI 6205.4, Immunization of Other Than U.S. Forces (OTUSF) for Biological Warfare Defense, 14 April 2000

mm. DoDI 8500.01, Cybersecurity, 14 March 2014

nn. DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), 12

March 2014

oo. DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19 December 2005 with Change 3 dated 24 January 2012

pp. DoDD 8140.01, Cyberspace Workforce Management, 11 August 2015

qq. SECNAV M-5239.2, DON Information Assurance Workforce Management Manual, May 2009

rr. SECNAV M-5510.30, DON Regulation – Personnel Security Program, 6 October 2006

ss. SECNAVINST 4440.34, Secretary of the Navy Instruction – Implementation of Item Unique

Identification within the DoN, 22 December 2009

tt. SECNAVINST 5239.20A, DON Cybersecurity Policy, 2 May 2016

uu. SECNAVINST 5239.3C, DON Cybersecurity Policy, 2 May 2016

vv. SECNAVINST 5510.30, DON Regulation – Personnel Security Program, 6 October 2006

ww. DON CIO Memorandum, Acceptable Use of Department of the Navy Information Technology

(IT), 12 February 2016

xx. SPAWARINST 4440.12, Management of Operating Materials and Supplies (OM&S), Government Furnished Property (GFP), Contractor Acquired Property (CAP), Property, Plant and Equipment (PP&E), and Inventory

yy. SPAWARINST 5721.1B, SPAWAR Section 508 Implementation Policy, 17 November 2009

zz. COMUSFLTFORCOM/COMPACFLTINST 6320.3A, Commander US Fleet Forces

Command/Commander US Pacific Fleet Instruction, Medical Screening For US Govt Civilian Employees, Contractor Personnel, and Guests prior to embarking Fleet Units, 7 May 2013 aaa. Navy Telecommunications Directive (NTD 10-11), System Authorization Access Request (SAAR) – Navy bbb. DoD Cybersecurity Test and Evaluation Guidebook, 1 July 2015

2.0 TECHNICAL REQUIREMENTS

The Contractor shall be required to provide a wide range of expertise supporting full spectrum Cyberspace Operations and enabling activities.

2.1 GENERAL

The Contractor shall provide technical and management services to support SSC Pacific in establishing and maintaining Cyberspace Operations and enabling product lines, programs and projects. The Contractor shall engage in identifying, and developing core technical and functional services in support of full spectrum Cyberspace Operations and enabling capabilities. The Contractor shall provide technical and management services that enable rapid development and deployment of new capabilities to conduct Offensive, Defensive, and DODIN Operations and missions on friendly, adversary, and potential adversary networks, systems and services in response to emerging requirements; to develop and deploy holistic systems and tool sets for developing, maintaining, and disseminating comprehensive Cyber Situational/Battlespace Awareness (CS/BA) across the range of military operations; and to provide for Command and Control (C2) of Cyberspace Operations at all levels of war, across all components of the joint services and allied and partner nations. The Contractor shall support the development of tools and processes for developing, maintaining, and increasing Understanding of the Cyberspace Operational Environment. The Contractor shall investigate and research improved techniques and solutions meeting the requirements documents or specifications IAW applicable documents.

2.2 TECHNOLOGY ASSESSMENT, DEVELOPMENT AND TRANSITION

The Contractor shall identify and perform research, analysis, analysis of alternatives (AoA), evaluation, development and test of technologies from industry, academia, and other government organizations, to include Commercial Off-The-Shelf (COTS), Government Off-The-Shelf (GOTS), and open source technologies, for applicability to solving Cyberspace Operations deficiencies and capability gaps, improving existing Cyberspace Operations and enabling capabilities and/or generating new Cyberspace Operations capabilities.

To address the timely challenges of cybersecurity deficiencies, the Contractor shall establish core technology evaluation criteria, metrics, datasets, and test protocols, and build a repository of technology to more easily automate the evaluation process for emerging technologies under consideration for use in cyber infrastructures. Unclassified and classified laboratories with common synthetic data sets, representative of actual data, shall be constructed to enable proper systems engineering analysis and common criteria for comparison, concept refinement, and selection for more advanced analysis and study.

2.2.1 INNOVATIVE TECHNOLOGY ASSESSMENT AND DEVELOPMENT

The Contractor shall identify and analyze innovative technology applicable to problems and opportunities related to Offensive and Defensive Cyberspace Operations (OCO/DCO); Cybersecurity; Cyberspace Operational Assessment (OA), and Cyber Intelligence, Surveillance, and Reconnaissance (ISR).

2.3 REQUIREMENTS ANALYSIS

The Contractor shall perform analyses of existing and emerging Operational and Functional Requirements at the force, theater, Combatant Command (COCOM) and national levels to support the formulation, development and assessment of doctrine, strategy, plans, concepts of operations, and tactics, techniques and procedures in order to provide the full spectrum of Cyberspace Operations and enabling capabilities to the warfighter. This shall include the analysis of Cyberspace Operations organizations including tactics, techniques and procedures to develop new doctrine, operational methodologies and missions, identification of potential threats, vulnerabilities, risks, safeguards, performance indicators and countermeasures. The Contractor shall analyze social and cultural factors and attributes of potential adversaries and cognitive, behavioral, skill, and knowledge requirements derived from these considerations. The Contractor shall also perform feasibility analyses of systems or operational concepts, including a cost/benefit analysis. The Contractor shall research and develop technical analyses and assessment reports for integration of cyber requirements, capabilities and training. The Contractor shall research and develop reports, documents and assessments for mapping naval, theater and joint plans and programs to cyber capability requirements. The Contractor shall perform Cyber Military Utility Assessments (MUA)/Operational Utility Assessments (OUA), to include assessments of cyber warfighting capability and the utility of new and emerging technologies.

2.4 SYSTEMS ENGINEERING

The Contractor shall perform system analysis, architecture, engineering, and integration services at the system, intra/inter-node, force, theater and national levels. The Contractor shall perform analyses of current Cyberspace Operations and enabling capabilities and deficiencies, identify and derive system and sub-system requirements and associated architectures and perform all aspects of systems engineering support required to implement the full spectrum of Cyberspace Operations capabilities and systems. The Contractor shall perform and report technical trade studies which shall lead to the development of new Cyberspace Operations architectures and detailed engineering designs. The Contractor shall utilize a Systems Engineering approach. The contractor shall conduct assessments on proposed solution architectures, proposed designs, and strategic roadmaps and provide recommendations for improvement.

2.5 OPERATIONAL AND TECHNICAL SUPPORT

The Contractor shall provide on and off site operational and technical support to SSC Pacific Cyberspace Operations and enabling efforts.

2.5.1 Operational Support.

The Contractor shall provide operational support to SSC Pacific Cyberspace Operations and enabling efforts by reviewing and analyzing national security policy and military strategy, including defense transformation and planning guidance, intelligence estimates, threat projections, and other relevant material and activities. The Contractor shall support the production and implementation of concepts of operations, standard operating procedures, rules of engagement, pre-planned responses, and supporting Annexes/Tabs to Combatant Commanders', Joint Force/Service/Functional Component Commanders', and Joint Task Force (JTF) Commanders’ Operational and Contingency Plans (OPLAN/CONPLAN).

This support shall include preparation for, and presentation of technical briefs.

The Contractor shall participate in cyber focused forums, boards, conferences, seminars, exercises, and planning sessions.

2.5.2 TECHNICAL SUPPORT

The Contractor shall provide technical support to SSC Pacific Cyberspace Operations and enabling efforts by conducting technical vulnerability assessments and other relevant material and activities. The Contractor shall support the production and implementation of technical concepts of operations, standard operating procedures, and technical recommendations that support the development of Memoranda of Understanding/Memoranda of Agreement (MOU/MOA) among theater, national, and global stakeholders.

The Contractor shall provide theater focused full spectrum security test and evaluation activities, to include Blue, Green, White, and Red Team support to provide training, as well as assess vulnerabilities and/or deficiencies of Cyberspace Operations capabilities to the latest threats emanating from adversaries and other malicious sources, identifying solutions and/or tradeoffs to correct any deficiencies.

Contractor shall implement cybersecurity vulnerability alerts, bulletins, and technical advisories for Transport components per Government (e.g., DoD, DON, National Security Agency (NSA), Defense Information Systems Agency (DISA)) directives.

The Contractor shall provide forensic support of compromised systems as well as captured systems. This support shall include analysis of software, firmware, hardware (analog and digital sections), as well as protective measures including tamper prevention/evidence systems.

2.5.2.1 SYSTEM TECHNICAL SUPPORT

The Contractor shall provide system and system of systems level security test and evaluation activities, to include Blue, Green, White, and Red Team support to assess vulnerabilities and/or deficiencies of Cyberspace Operations capabilities, identifying solutions and/or tradeoffs to correct any deficiencies.

The Contractor shall provide forensic support of compromised systems as well as captured systems. This support shall include analysis of software and firmware, as well as protective measures.

2.6 EXERCISE AND EXPERIMENTATION SUPPORT

The Contractor shall propose and participate in Exercise and Experimentation (including war gaming) to support the development and assessment of Cyberspace Operations and enabling capabilities and their utility, to identify new tactics, techniques and procedures for the full spectrum of Cyberspace Operations.

This shall include all planning, logistics and scheduling and manning requirements for exercises and experiments. Additional requirements include, but are not limited to:

a) Conduct detailed exercise and experiment design, planning and scheduling, including specification of equipment, platforms, systems (including their configuration), exercise code/scripts, and personnel.

b) Develop simulation capabilities and/or models for validation of functional operation of Cyberspace Operations and enabling capabilities or activities.

c) Provide logistics support, including configuration management, quality assurance, reliability/maintainability analysis, material/data control and classification / information security oversight.

d) Participate in exercise and experiments, observe systems or activity and collect data.

e) Develop Data Collection and Analysis Plans (DCAP) and support post-exercise/experiment data analysis.

f) Analyze and reconstruct exercise and experiment data from actual collected information.

g) Develop Cyberspace Operations training objectives to stimulate training audiences, assess capability shortfalls, and develop Plans of Action and Milestones.

h) Research, gather data, analyze and develop intelligence and IO concept development and experimentation planning documents and execution planning.

2.6.1 SPECIAL EXERCISE SUPPORT

The Contractor shall participate in Exercises (including war gaming) to support the development and assessment of Cyberspace Operations and enabling capabilities and their utility, to identify new tactics, techniques and procedures for Cyberspace Operations. These requirements include:

a) Develop simulation capabilities and/or models for validation of functional operation of Cyberspace Operations and enabling capabilities or activities.

b) Participate in exercise and experiments, observe systems or activity and collect data.

c) Analyze exercise and experiment data and provide assessments on the results to enable new cyberspace operations capabilities.

2.7 SOFTWARE DEVELOPMENT AND PROTOTYPING

The Contractor shall specify, design, develop, code, test, integrate and document software modules, systems and subsystems to provide new functional capabilities and improve existing Cyberspace Operations and enabling systems. The Contractor shall perform reverse engineering of software components and systems to support vulnerability and exploitation analysis. The functions to be implemented include the full spectrum of Cyberspace Operations. The Contractor shall adhere to open standards and modern software development methodologies, including what is considered ‘best’ practices by the industry. The Contractor shall support compliance testing for software system components.

2.7.1 RAPID SOFTWARE DEVELOPMENT AND PROTOTYPING

The Contractor shall design, develop, code, test, integrate and document software modules to provide specialized capabilities related to Offensive Cyberspace Operations (OCO). The Contractor shall design, develop, code, test, integrate and document software modules to provide specialized capabilities related to Defensive Cyberspace Operations (DCO). The Contractor shall perform reverse engineering of software components and systems, including but not limited to, exploits, malicious attachment, malware, and post-exploit tools, to support vulnerability and exploitation analysis. The Contractor shall adhere to open standards and modern software development methodologies, including what is considered ‘best’ practices by the industry. This also includes rapid prototyping to meet time critical requirements. The Contractor shall support compliance testing for software system components.

2.8 HARDWARE DEVELOPMENT AND PROTOTYPING

The Contractor shall provide hardware engineering support to design, develop, prototype and implement, test, integrate, and document hardware based solutions for the full spectrum of Cyberspace Operations and enabling capabilities. The Contractor shall perform reverse engineering of hardware components and systems to support vulnerability and exploitation analysis. This includes mixed signal integrated circuit design and development. The Contractor shall adhere to modern hardware development and fabrication methodologies, including what is considered ‘best’ practices by the industry. This also includes rapid prototyping to meet time critical requirements. The Contractor shall support compliance testing for hardware systems and components.

2.9 MODELING AND SIMULATION

The Contractor shall architect, design and develop Modeling and Simulating (M&S) infrastructure and capabilities to investigate systems and their interdependencies, enhance preparedness, protection, response, mitigation, and recovery activities of Cyberspace Operations. The M&S capabilities shall address network contingency analysis, cyber-attack analysis, situation assessment, course-of-action analysis and optimization. The M&S shall also support the integration of multiple pre-existing M&S capabilities and the creation of new capabilities. Specific M&S capabilities shall include, as a minimum, the ability to model and simulate at scale and individually:

- Computer systems, software, and networks;

- The interconnection of these systems at the scale of individual subnets, enclaves, service provider, and wide-area networks;

- The propagation, protection, and dynamics of information flows on these simulated systems;

and

- Attacks, effects, and remediations in the context of simulated systems, networks, and dynamics.

Additional capabilities may include, but are not limited to:

- Novel environments which are incongruous with the broader internet or commercial uses (i.e.

shipboard ICS)

- Tactical networks

- Novel scenarios dealing with military communication systems and cyber-physical systems

- Electromagnetic Maneuver Warfare (EMW)

- Hardened military overlay networks.

The contractor shall incorporate cloud and virtualization technology to substitute physical hardware (e.g., desktops, servers, routers) and applications where feasible to support M&S.

The contractor shall ensure that all data can be archived in a standard format and made available to any larger effort.

2.10 TRAINING SUPPORT

The Contractor shall plan, develop, implement, and deliver Cyberspace Operations training plans, educational and training courses, and formal exercises that enable full spectrum Cyberspace Operations capabilities in accordance with NIST SP 800-181, National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework. The Contractor shall provide training at designated locations.

Training includes but is not limited to:

a. Development of formal courseware for classroom delivery;

b. Delivery of formal courseware to either a training audience or a "train the trainers" audience;

c. Development of training architectures for structured, multi-expertise level training pathways;

d. On the job training (OJT);

e. Informal training conducted in conjunction with technical support, exercises, and operations;

f. Development of computer based training (CBT) material;

g. Development of formal training materials and curricula

h. Development of system specific training.

2.10.1 ENABLING CAPABILITY TRAINING SUPPORT

The Contractor shall plan, develop, and implement Cyberspace Operations training plans and courses that enable offensive and defensive capabilities for Cyberspace Operations. The Contractor shall provide informal training at designated locations. Training support includes, but is not limited to:

a. On the job training (OJT);

b. Informal training conducted in conjunction with technical support, exercises, and operations;

c. Development of computer based training (CBT) material;

d. Development of formal training materials and curricula;

e. Development of system specific training.

2.11 SECURITY ENGINEERING/CYBERSECURITY

The Contractor shall provide engineering services to ensure that key management and cryptographic solutions meet the goals and objectives of the DoD cryptographic modernization effort. This applies to the following key management and cryptographic solutions: Network, RF communications, and wireless.

The Contractor shall support the development of the security architecture for the Department of the Navy’s information infrastructure including but not limited to Consolidated Afloat Network and Enterprise Services (CANES), Navy-Marine Corps Intranet (NMCI), Next Generation Enterprise Network (NGEN), Outside the Continental United States (OCONUS) Naval Enterprise Network (ONE- NET), Joint Information Environment (JIE), and Information Dominance Enterprise Architecture (IDEA).

The Contractor shall provide security engineering services including but not limited to, firewalls, virtual private network devices, intrusion detection/prevention systems, biometrics technologies, wireless technologies, network vulnerability scanning and remediation technologies, cross domain solutions, and DoD PKI identity and access management systems, and newer technologies for Key Management. The Contractor shall provide security engineering services for securing private and public Cloud architectures and Cloud applications as a service. The Contractor shall develop vulnerability detection and correction technologies. The Contractor shall develop predictive cyber attack technologies to enable full spectrum Defensive Cyberspace Operations.

The Contractor shall execute all phases of the US Department of Defense Information Assurance Certification and Accreditation Process (DIACAP)/Risk Management Framework (RMF) transformation, conducting all activities in achievement of required authorities to operate. The Contractor shall plan and execute security tests and evaluations and provide a comprehensive risk assessment as part of their individual delivery/task order fulfillment. The Contractor shall support the certification and accreditation (C&A) of programs using DIACAP/RMF, Secret and Below Interoperability (SABI), and Director of Central Intelligence Directive (DCID) 6/3 processes. The Contractor shall also perform analysis related to the development of security test plans, procedures, reports, and assessments.

The Contractor shall develop, implement, and integrate solution sets that enable holistic Cyber Situational Awareness (CSA) Cyber Operations tools to support Command and Control, Computers and Communications, Computers, and Intelligence (C4I) capability, with appropriate underpinning technologies and capabilities that provide for interagency communication and collaboration of cyber activities.

The Contractor shall provide security technical and engineering services for the purpose of supporting SPAWAR as the Navy’s Cybersecurity Technical Authority (TA) for National Security Systems (NSS) and Defense Business Systems (DBS) for Navy General Services (GENSER) systems. Cybersecurity TA is applicable to a broad range of NSS and DBS systems to include C4I systems; Business Systems;

Weapon Systems; Combat Systems; Hull, Mechanical and Electrical (HM&E) systems; and Aviation and Aviation support systems.

All cybersecurity functions to be performed under this contract will be identified at the task order level in the performance work statement. Task order performance work statements will specify, as applicable, Cybersecurity Workforce category, level, training, and certification requirements for Contractor personnel with privileged access working in cybersecurity technical environments, cybersecurity management personnel with significant cybersecurity tasks, Computer Network Defense Service Providers (CND‐SPs), and cybersecurity systems architects and engineers. Task orders with cybersecurity functions will include a requirement for the Contractor to report cybersecurity certification status and compliance.

2.11.1 SECURITY ENGINEERING SUPPORT AND RAPID PROTOTYPING

The Contractor shall provide security engineering services for development and rapid prototyping of Cybersecurity systems, including but not limited to, firewalls, virtual private network devices, intrusion detection/prevention systems, biometrics technologies, wireless technologies, and network vulnerability scanning and remediation technologies. The Contractor shall support correction of vulnerabilities in the absence of source code. The Contractor shall support development of predictive cyber attack technologies to enable Active Defensive Cyberspace Operations.

2.11.2 CYBERSECURITY RISK MANAGEMENT

The Contractor shall support Government execution of the US Department of Defense Information Assurance Certification and Accreditation Process (DIACAP)/Risk Management Framework (RMF) transformation. The Contractor shall support security tests and evaluations and provide a comprehensive risk assessment as part of their individual delivery/task order fulfillment. The Contractor shall support the certification and accreditation (C&A) of programs using DIACAP/RMF, Secret and Below Interoperability (SABI), and Director of Central Intelligence Directive (DCID) 6/3 processes. The Contractor shall also perform analysis related to the development of security test plans, procedures, reports, and assessments.

2.11.3 INFORMATION TECHNOLOGY SYSTEMS SUPPORT

The Contractor shall provide Information Technology Systems Support to SSC Pacific for Department of Defense classified and unclassified networks, including System Administration; Cybersecurity compliance; network monitoring and intrusion detection and prevention; system security vulnerability assessment and correction; and asset risk assessment.

3.0 SOFTWARE ENGINEERING APPROACH

The contractor shall define a software development approach appropriate for the computer software effort to be performed under this contract. This approach shall be documented in a Software Development Plan (SDP) (see DID No. DI-IPSC-81427A for required format and content). Once defined, the contractor shall follow this SDP for all computer software to be developed or maintained under this contract.

The SDP shall define the offeror’s proposed life cycle model and the processes used as a part of that model. In this context, the term “life cycle model” is as defined in IEEE/EIA Std. 12207.0. The SDP shall describe the overall life cycle and shall include primary, supporting, and organizational processes based on the work content of this contract. In accordance with the framework defined in IEEE/EIA Std.

12207.0, the SDP shall define the processes, the activities to be performed as a part of the processes, the tasks which support the activities, and the techniques and tools to be used to perform the tasks. Because IEEE/EIA Std. 12207 does not prescribe how to accomplish the task, the offeror must provide this detailed information so the Government can assess whether the offeror’s approach is viable.

The SDP shall contain the information defined by IEEE/EIA Std. 12207.1, section 5.2.1 (generic content) and the Plans or Procedures in Table 1 of IEEE/EIA Std. 12207.1. In all cases, the level of detail shall be sufficient to define all software development processes, activities, and tasks to be conducted. Information provided must include, as a minimum, specific standard, methods, tools, action, strategies, and responsibilities associated with development and qualification.

The contractor’s software engineering approach shall afford opportunities for input and oversight by the Government.

4.0 CYBERSECURITY COMPLIANCE

Cybersecurity (which replaced the term Information Assurance (IA)) is defined as prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation.

Contractor personnel shall perform tasks to ensure Navy applications, systems, and networks satisfy Federal/DoD/DON/Navy cybersecurity requirements.

4.1 CYBER IT AND CYBERSECURITY PERSONNEL

(a) The Cyberspace workforce elements addressed include contractors performing functions in designated Cyber IT positions and Cybersecurity positions. In accordance with DFARS Subpart 239.71, DoDD 8140.01, SECNAVINST 5239.20A, and SECNAV M-5239.2, contractor personnel performing cybersecurity functions shall meet all cybersecurity training, certification, and tracking requirements as cited in DoD 8570.01-M prior to accessing DoD information systems. Proposed contractor Cyber IT and cybersecurity personnel shall be appropriately qualified prior to the start of the contract performance period or before assignment to the contract during the course of the performance period.

(b) The contractor shall be responsible for identifying, training, tracking, and reporting cybersecurity personnel, also known as Cybersecurity Workforce (CSWF) and Cyber IT workforce personnel.

Reporting requirements will be specified at the task order level. Although the minimum frequency of reporting is monthly, the task order can require additional updates at any time.

- The contractor employer shall be responsible for ensuring contracted employee receive training on new vendor, and emergent technologies in support of task orders on the contract.

- The contractor employer shall be responsible for ensuring contracted employees maintain appropriate training and certifications in accordance with DoDD 8140.01and DoD 8570.01

- The contractor employer shall ensure the contracted employee maintain technical proficiency in the Navy Enterprise Network current platform – proficiency is inspectable by the government.

- The contractor employer shall be responsible for any required vendor training in cases where a manufacturer requires certifications.

- The contractor employer shall be responsible for any Continuing Education Fees associated with vendor certifications.

(c ) Contractors that access Navy IT shall also follow guidelines and provisions documented in Navy Telecommunications Directive (NTD 10-11) and are required to complete a System Authorization Access Request (SAAR) – Navy form.

When a contractor requires logical access to a government IT system or resource (directly or indirectly), the required CAC will have a Public Key Infrastructure (PKI). A hardware solution and software (e.g., ActiveGold) is required to securely read the card via a personal computer. Pursuant to DoDM 1000.13- M-V1, CAC PKI certificates will be associated with an official government issued e-mail address (e.g.

.mil, .gov, .edu). Prior to receipt of a CAC with PKI, contractor personnel shall complete the mandatory Cybersecurity Awareness training and submit a signed System Authorization Access Request Navy (SAAR-N) form to the contract’s specified COR. Note: In order for personnel to maintain a CAC with PKI, each contractor employee shall complete annual cybersecurity training. The following guidance for training and form submittal is provided; however, contractors shall seek latest guidance from their appointed company Security Officer and the SSC Pacific Information Assurance Management (IAM) office:

1. For annual DoD Cybersecurity/IA Awareness training, contractors shall use this site:

https://twms.nmci.navy.mil/ or http://iatraining.disa.mil/. For those contractors requiring initial training and do not have a CAC, contact the SSC Pacific IAM office at phone number (619) 221- 5639 or e-mail questions to roc@spawar.navy.mil. for additional instructions. Training can be taken at the IAM office or online at http://iase.disa.mil/index2.html.

2. For SAAR-N form, the contractor shall use OPNAV 5239/14 (Rev 9/2011). Contractors can obtain a form from the SSC Pacific IAM office at or from the website:

https://navalforms.documentservices.dla.mil/. Digitally signed forms will be routed to the IAM office via encrypted e-mail to roc@spawar.navy.mil.

(d) Contractor personnel with privileged access will be required to acknowledge special responsibilities with a Privileged Access Agreement (PAA) IAW SECNAVINST 5239.20A.

4.2 DESIGN, INTEGRATION, CONFIGURATION OR INSTALLATION OF HARDWARE AND

SOFTWARE

The contractor shall ensure any equipment/system installed or integrated into Navy platform will meet the cybersecurity requirements as specified under DoDI 8500.01. The contractor shall ensure that any design change, integration change, configuration change, or installation of hardware and software is in accordance with established DoD/DON/Navy cyber directives and does not violate the terms and conditions of the accreditation/authorization issued by the appropriate Accreditation/Authorization official. Contractors that access Navy IT are also required to follow the provisions contained in DON CIO Memorandum: Acceptable Use of Department of the Navy Information Technology (IT) dtd 12 Feb

16. Use of blacklisted software is specifically prohibited and only software that is registered in DON Application and Database Management System (DADMS) and is Functional Area Manager (FAM) approved can be used as documented in para 4.2.2. Procurement and installation of software governed by DON Enterprise License Agreements (ELAs) – Microsoft, Oracle, Cisco, Axway, Symantec, ActivIdentity, VMware, Red Hat, NetApp, and EMC shall be in accordance with DON CIO Policy and DON ELAs awarded.

4.3 CYBERSECURITY WORKFORCE (CSWF) REPORT

DoD 8570.01-M and DFARS PGI 239.7102-3 have promulgated that contractor personnel shall have documented current cybersecurity certification status within their contract. The contractor shall develop, maintain, and submit a CSWF Report as applicable at the task order level. IAW clause DFARS 252.239- 7001, if cybersecurity support is provided, the contractor shall provide a Cybersecurity Workforce (CSWF) list that identifies those individuals who are IA trained and certified. Utilizing the format provided at the task order level, the prime contractor shall be responsible for collecting, integrating, and reporting all subcontractor personnel. Additional reporting details and distribution instructions will be specified at the task order level. Contractor shall verify with the COR or other government representative the proper labor category cybersecurity designation and certification requirements.

5.0 INFORMATION TECHNOLOGY (IT) SERVICES REQUIREMENTS

According to the FAR, Information Technology (IT) is defined as any equipment or interconnected system(s) or subsystem(s) of equipment, that is used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data of information by the agency. IT includes computers, ancillary equipment, peripherals, input, output, and storage devices necessary for security and surveillance. Electronic and

Information technology (EIT) is IT that is used in the creation, conversion, or duplication of data or information.