CYBER_BAA_N68335-15-R-0179__11-16.doc

011515 BAA

Broad Agency Announcement – N68335-15-R-0179 V 1.0 NAVAIR Cyber Warfare Det.

Broad Agency Announcement (BAA) N68335-15-R-0179 Resilient Cyber Warfare Capabilities for NAVAIR Weapon Systems

POSTED DATE: MAY 15

Prepared by: NAVAL AIR WARFARE CENTER AIRCRAFT DIVISION, Lakehurst (NAWCADLKE)

(Code 2.5.2), Highway 547, Bldg 562, Lakehurst, NJ 08733 Table of Contents

11. Introduction

2. Background

2.1 Naval Research Areas of Interest

3. Specific Areas of Interest

3.1 Technologies Being Sought

4. Proposal Submission

4.1 Phase I - Proposal Abstracts

4.2 Phase II – Full Proposal

4.2.1 General Information

5. Evaluation Criteria

5.1 Primary Evaluation Criteria

5.2 Additional Evaluation Criteria

6. Awards

Table of Contents

2Table 1 – General Areas of Interest

6Table 2 – Technology Readiness Levels and Descriptions

7Table 3 - Quad Chart Format

SOL – Broad Agency Announcement (BAA)

TITLE – Resilient Cyber Warfare Capabilities for NAVAIR Weapon Systems RESPONSE DATE – Phase I: Responses may be submitted at any time up until the closing date of the BAA (15 May 2016). Reviews will be conducted on a quarterly basis: Quarterly (PHASE I ONLY):

15-AUG-15 // 15-NOV-15

15-FEB-16 // 15-MAY-16

Phase II: BY REQUEST ONLY

AGENCY –

NAVAL AIR WARFARE CENTER AIRCRAFT DIVISION (NAWCAD)

(Code 2.5.2), Highway 547, Bldg 562, Lakehurst, NJ 08733

TPOC:

This notice constitutes a BAA as contemplated by FAR 6.102(d)(2). This BAA is also listed at http://www.navair.navy.mil/doing_business/open_solicitations/ (Business Opportunities/Open Solicitations).

1. Introduction The NAVAIR Cyber Warfare Detachment is soliciting technical/cost proposals for research support in technologies that are applicable to Resilient Cyber Warfare Capabilities for NAVAIR Weapon Systems.

2. Background The NAVAIR Cyber Warfare Detachment (CWD) develops and assesses cyber warfare capabilities for mission assurance and to defend NAVAIR weapon systems (aircraft, unmanned vehicles, weapons, sensors, etc.) and directly corresponding support systems (data link, mission planning, maintenance, logistic, etc.). The strategy of the CWD is to defend the access points to our weapon systems (detect, prevent), survive and continue to operate during close quarters battle (resilience and response), and to conduct cyber-smart acquisition to achieve this. The foundation of the CWD strategy for NAVAIR weapon systems is to develop the cyber workforce, invest in infrastructure and research and development (R&D) and establish standards and best practices.

The objective of this BAA is principally to orchestrate germane R&D to fill the gaps in cyber warfare capabilities for NAVAIR weapon systems to achieve the CWD strategy, i.e., secure weapon systems able to survive and exploit cyber warfare. It is the finding of the CWD that there is a paucity of cyber R&D and threat information for weapon systems and supporting systems that directly or indirectly “connect” to weapon systems. As well, most business systems Information Technology (IT) cybersecurity measures are mis-applied and ill-designed for weapon systems, especially given air vehicle Size, Weight and Power (SWaP) restrictions, and their operational environments. Therefore, this BAA solicits R&D, not to simply apply IT solutions, concepts and underlying business environment assumptions, but to address cyber issues for weapon systems in a system of systems warfare environment with often intermittent or indirect “connectivity” to other systems. It is also a finding of the CWD that there has been little attention given to these intermittent connections, such as maintenance laptops, mission loaders, etc. As well, there has been little R&D concerning critical physical and industrial control system interfaces with air vehicles, such as aircraft launch and recovery equipment (ALRE), power and navigation umbilicals. In fact, this BAA assumes that the cyber R&D problem space for weapons systems even reaches back to concept development, supply chain management and software (SW) development and assurance / configuration management and as far forward as battle damage assessment (BDA) and equipment sanitization and disposal which all could involve anti-tamper as well.

It is assumed that R&D efforts solicited by this BAA would address the most critical access point and resiliency (close quarters battle) issues for both legacy and future systems. However, this should not cause presumptive focus on any specific cybersecurity controls, concepts or preconceptions, i.e., the “Maginot line” effect. Traditional Information Assurance (IA) controls that assume continuous monitoring, patching, and imply the installing of a COTS solution, e.g., the Host Based Security System (HBSS), are not only not implementable as is, but may also decrease security and system performance by offering greater adversary access.

Achievement of integrated warfare and kill chain effects while preventing that of the adversary is critical, so it is assumed that all R&D efforts would be mission relatable with germane threat assumptions vice standalone concepts /solutions. It is not desired to employ layer upon layer of costly defenses that only prevent cyber resiliency, dynamic re-configurability / response or, essentially, cyberspace maneuverability.

2.1 Research Areas of Interest

The NAVAIR CWD is interested in, but not limited to, researching the following areas:

Table 1 – General Areas of Interest

3. Specific Areas of Interest Proposals are being solicited in following areas for NAVAIR Weapon Systems:

(1) SWaP sensitive cyber resiliency for RTOS and aviation warfare environment

(2) Access point identification, prioritization and defense

(3) Cyber-EW convergent capabilities

(4) Full acquisition cycle cybersecurity measures

(5) Cyber test, inspection, and incident response concepts

(6) Cyber warning system techniques

(7) Cyber fault, risk and threat assessment methodologies

(8) Resilient Network concepts

3.1 Technologies Being Sought

Examples of technologies sought include, but are not limited to (in no particular order): RTOS malware / C2 detection, protection, response and recovery; non-destructive/disruptive inspection; dynamic reconfiguration / re-host / compilation; etc.

4. Proposal Submission The submission process is two-phased as described below. PHASE II IS BY INVITATION ONLY. No further request for information (RFI), solicitation or other announcement of this opportunity will be made. Phase I proposals may be submitted at any time up and to the closing date of the BAA (15 May 2016). Offerors are instructed to submit proposals only for actual technologies within the areas of interest listed in previous paragraphs.

Offerors shall submit their phase I proposals to both contracts point of contacts: Mrs. Allison Miller, Phone: (732) 323-2902, E-mail: allison.miller1@navy.mil and Mr. Hank Bell, Phone: (732) 323-1613, E-mail: hank.bell@navy.mil. Offerors shall submit their proposals electronically via E-mail and shall not exceed 7 MB in size. Proposals submitted to individuals other than the two email addresses above will not be accepted. Documents may be submitted in Adobe Acrobat and Microsoft Office formats.

4.1 Phase I - Proposal Abstracts

Submit a technical abstract, not to exceed five pages, any time during the above stated open periods. Classified submissions shall not be accepted under this solicitation. If a determination is made that the award instrument may result in access to classified information, a DD Form 254, “DoD Contract Security Classification Specification,” will be issued and attached as part of the award. A DD Form 254 will not be provided to proposers at the time of submission. DD Form 254 is available at http://www.dtic.mil/dtic/pdf/formsNguides/dd0254.pdf.

The concept-abstracts will be evaluated (at a minimum) quarterly with an approximate Government response time of 90 days after submission. All proprietary portions of the abstract shall be clearly identified and will be treated in the strictest confidence. The technical abstract shall include the following: The need for the project research and how the fleet will benefit after transition (including commercial applications); the technology challenges that must be overcome; the brief technical approach; a brief description of the facilities involved, the Operational Payoff using measures of performance and any potential cost / resource savings; potential PMA sponsors and/or users; a rough order magnitude cost estimate (per year) for each concept paper with type of acquisition vehicle (contract/agreement) being proposed and, if applicable, the anticipated sharing arrangement; anticipated Department of Defense Technology Readiness Level (TRL), defined in Table 1, and brief resume of the key personnel. A Quad Chart, defined in Table 2, for each concept paper will be required in addition to the three page technical abstract. Offerors are hereby notified that non-Government participants will have access to the offeror’s proposals, and that submission of an offer shall constitute consent to the disclosure of proprietary information to all non-Government participants in proposal reviews. The non-Government participants are employees of commercial firms under contract to the Government, and if they serve as technical advisors they will be authorized access to only those portions of the concept data and discussions that are necessary to enable them to provide specific technical advice on specialized matters or on particular problems. NOTE: Typically, research findings result in the need for additional services, which are not possible to anticipate or project in the future. Contract modifications may be executed to satisfy these requirements; thereby providing for flexibility in technology assessment (with technology transition the ultimate goal). In the event that this is required, it shall be considered to be within the scope of this BAA and the resulting contract, and therefore will have met the requirements of the FAR/DFARS and the Competition in Contracting Act.

The additional cover sheet for the abstracts shall identify the following:

BAA Number;

Organization Name;

Other Team Members and type of business for each;

Technical Points of contact (including phone, fax, and e-mail information);

Administrative Point of Contact;

One paragraph that summarizes the relationship of the proposal to the BAA.

Overview of the Proposed Work to include: A summary of proposed concept (including commercial applications), an estimated timeframe for project completion, a brief description of the facilities involved, and a brief resume of the principle investigator(s); and a rough order of cost magnitude with type of acquisition vehicle (contract/agreement) being proposed and, if applicable, the anticipated sharing arrangement.

IMPORTANT INFORMATION FOR PROSPECTIVE CONTRACTORS: Current registration in the DoD’s Central Contractor Registration (CCR) database will be a prerequisite for receiving an award resulting from this BAA. For more information please contact the CCR Assistance Center at 1-888-227-2423 or go to the website at: http://www.ccr.gov/vendor.asp.

Offerors shall complete the on-line Representations and Certifications Application (ORCA) before submission of a proposal. The information pertaining to ORCA can be found at http://www.bpn.gov/orca.

Table 2 – Technology Readiness Levels and Descriptions and Supporting Information

test compare with expectations? What problems, if any, were encountered? What are/were the plans, options, or

TRL Definitions, Descriptions, and Supporting Information (Continued)

if any, were encountered? What are/were the plans, options, or actions to resolve problems before moving to the next level?

be expected to operate. Assessment of whether it will meet its operational requirements. What problems, if any, were encountered? What are/were the plans, options, or actions to resolve problems before finalizing the design?

Table 3 - Quad Chart Format

4.2 Phase II – Full Proposal

4.2.1 General Information

ONLY OFFERORS WHOSE PHASE I – PROPOSAL ABSTRACT IS CONSIDERED CAPABLE OF MEETING EXISTING OR FUTURE PROGRAM REQUIREMENTS WILL BE ASKED TO SUBMIT PHASE II – FULL PROPOSAL. REQUEST FOR SUBMISSION OF A FULL PROPOSAL DOES NOT GUARANTEE AWARD SELECTION.

Proposals shall be submitted in original, with the signature of an authorizing official, with five (5) copies to the address noted above. Proposal submission is not restricted in any way to any particular entity. Historically Black Colleges and Universities, Minority Institutions, Tribal Colleges and Universities, Small, Small Disadvantaged, Service Disabled Veteran Owned Small, HUBZone Small, Veteran Owned Small, and Women Owned Small Businesses are encouraged to participate. The NAICS Code for this BAA is 541712.

Submit Full Proposals in two (2) volumes;

(1) VOLUME I – TECHNICAL PROPOSAL, not to exceed thirty (30) pages, should include the following three sections:

1) Section 1 - Executive Summary: Provide a brief technical and business description of the contents of the proposal. The technical area should address the proposal's technical goals, approach, and expected results. The business area should address business and/or commercial applications of the proposal technology.

2) Section 2 - Technical Issues: Detail the technical approach, objectives, staffing and resources relating to the development of the proposed technology for military and commercial (if applicable) use; discuss specifically in realistic terms the technical objectives of this proposed effort; provide a Performance Work Statement that discusses the specific tasks to be accomplished, tied to the specific approach and goals of the project; provide resumes for key research personnel; describe the current and planned facilities and equipment to accomplish the research objectives; and give a description of past performance on similar efforts.

Section 3 - Business Issues: Discuss the business issues relating to the commercial applications of the proposed development and its impact on the market; detail benefits to the Department of Defense (DoD).

VOLUME II - COST/FUNDING PROPOSAL. Cost/funding proposals are not restricted in length, have no specific page layout requirements, and should address funding periods of performance. Formal work breakdown structures (WBS) and certified cost or pricing data may be required, depending upon the type of FAR/DFARS contract utilized.. Upon completion of negotiations and agreement on contract price, a Certificate of Current Cost or Pricing Data may be required in accordance with FAR 15.406-2. Furthermore, any offeror who is required to submit and certify cost or pricing data shall submit accurate, current, and complete cost or pricing data from prospective subcontractors. Offerors’s proposals may be subject to DCAA audit. Please review the Information for Contractor’s link found on http://www.dcaa.mil for more information.

Organize Cost/Funding proposals to include four (4) sections in the following order:

1) Section 1 - Total Project Cost: This section will give a detailed breakdown of costs of the project. Cost should also be broken for each task appearing in the Performance Work Statement (PWS) and should include all of the proposed costs to the Government and cost shared by the offeror. Present the following information for each phase of the effort: total cost of the particular project phase; total offeror cost share (mandatory for certain "other transaction agreements" see below); funding requested from the Government; and elements of cost (labor, direct materials, travel, other direct costs, equipment, software, patents, royalties, indirect costs, and cost of money). Sufficient information should be provided in supporting documents to allow the Government to evaluate the reasonableness of these proposed costs, including salaries, overhead, equipment purchases, fair market rental value of leased items, and the method used for making such valuations. Profit should not be included as a cost element if the contract type to be awarded will be cost sharing. If subcontractors with costs higher than $650,000 are proposed, those contractors may also be required to submit cost and pricing data. Small Business Sub-Contracting Plans will be required for large businesses in accordance with FAR 52.219-9. See Table 15-2 in the FAR for information on the content of cost proposals.

2) Section 2 - Cost Sharing and In-Kind Contributions: This section will include: (i) the sources of cash and amounts to be used for matching requirements; (ii) the specific in-kind contributions proposed, their value in monetary terms, and the methods by which their values were derived; and (iii) evidence of the existence of adequate cash or commitments to provide sufficient cash in the future. Affirmative, signed statements are required from outside sources of cash. Provide sufficient information regarding the sources of the offerors’ cost share so that a determination may be made by the Government regarding the availability, timeliness, and control of these resources. For example: How will the funds and resources are applied to advance the progress of the proposed effort? What is the role of any proposed in-kind contributions?

3) Section 3 - Cost to the Government: This section will specify the total costs proposed to be borne by the Government and any technical or other assistance including equipment, facilities, and personnel of Federal laboratories, if any, required to support these activities. The cost to the Government should be that portion of the proposed effort, which is not covered, by the contractor's portion of the cost share. The costs incurred and work performed by any DoD or national laboratory "partnering" with the offeror under the proposal shall normally be considered costs of the Government and not costs of the offeror for purposes of the cost-sharing requirement. Present sufficient information regarding the resources to be provided by the Government so that an evaluation of their availability, timeliness, and control may be made.

4) Section 4 - Off-Budget Supporting Resources: This section will show cash or in-kind resources which will support the proposed activity but which are not intended to be included in the total project cost. Items in this category do not count as cost share or as Federal funds, which must be matched. Examples of items to place in this category include: Commitments of cash or in-kind resources from other Federal sources, such as national laboratories, and projections of fee-based income where there is substantial uncertainty about the level which will actually be collected and where the income is not needed to meet cost-share requirements.

5. Evaluation Criteria

The Government will evaluate proposals responsive to any or all of the areas of interest discussed herein. Proposals will not be evaluated against each other since each is a unique technology with no common work statement. Determination of total value of the concepts will have the following evaluation criteria:

5.1 Primary Evaluation Criteria

The primary evaluation criteria are:

(A) Scientific and technical merits of the proposed research to include, (1) the degree to which proposed research and development objectives support the targeted technical topic and (2) validity of the technical basis for the approach offered; and

(B) Potential contributions to the NAVAIR CWD, and other competency (test, engineering, etc.) and program organizations to include (1) relevance to the stated technology areas of interest; (2) anticipated operational military (or commercial, if applicable) utility; (3) ability of proposed system/study to be rapidly ready for field-testing; (4) suitability for inclusion in a warfighting experiment; and, (5) projected affordability of transitioning the technology to the fleet or a commercial activity (for any developed hardware), (6) logistics and Fleet supportability of proposed solution (7) data rights.

5.2 Additional Evaluation Criteria

Other evaluation criteria, of lesser importance than (A) and (B) above, but equal to each other, are:

(A) The offeror’s capabilities, related experience, past performance on similar efforts, research personnel, facilities, techniques or unique combination of these which are integral factors for achieving the proposal objectives; and

(B) The realism and reasonableness of cost, including proposed cost sharing.

6. Awards Depending on funds availability, NAVAIR is willing to consider various types of acquisition vehicles including, but not limited to, traditional FAR/DFARS type contracts and/or non-procurement agreements (e.g. Cooperative Agreements and Other Transactions). Other Transactions will be entered into under the authority of 10 U.S.C. 2371 (Congressional direction requires that at least 50 percent (50%) of the cost of a project under this initiative be provided by industry) and Section 845, Authority to Carry Out Certain Prototype Projects. Information concerning Other Transactions can be found at http://www.darpa.mil/cmo/pages/other_trans.html and http://www.acq.osd.mil/ddre/research. Final decision(s) on acquisition type (contract/agreement) will be made by the Government.

NAVAIR is planning to make awards within the overall Program Objectives stated in Section 2 “Background”. All awards will be based on merit competition. The Government reserves the right to select all, some, or none of the proposals received in response to this announcement. Any awards are subject to the availability of appropriations. There is no commitment by the Navy to be responsible for any monies expended by the offeror before award of a contract/agreement. For awards made as contracts, the socio-economic merits of each proposal will be evaluated based on the commitment to provide meaningful subcontracting opportunities with Historically Black Colleges and Universities, Minority Institutions, Tribal Colleges and Universities, Small, Small Disadvantaged, Service Disabled Veteran Owned Small, HUBZone Small, Veteran Owned Small, and Women Owned Small Businesses.

NOTE: Firms may be removed from award consideration should parties fail to reach an agreement on contract terms, including intellectual property rights, conditions and cost/price within a reasonable time, or if the offeror fails to provide requested information in a timely manner.

Contracts Point of Contact: Mrs. Allison Miller, Phone: (732) 323-2902, E-mail: allison.miller1@navy.mil and Mr. Hank Bell, Phone: (732) 323-1613, E-mail: hank.bell@navy.mil

PAGE