ATTACHMENT_A_-_Statement_of_Work.pdf

ATTACHMENT A

STATEMENT OF WORK

SYSTEMS AND SOFTWARE ASSURANCE SERVICES

(SAS)

RFP NNG16544506R

ATTACHMENT A – STATEMENT OF WORK

Date: May 31, 2016

Systems and Software Assurance Services (SAS)

Statement of Work

1. Introduction

1.1. NASA IV&V Program Mission and Objectives

The mission of the NASA Independent Verification and Validation (IV&V) Program is to reduce the inherent risk in the Agency’s ability to procure, develop, deploy and operate software within desired cost, schedule and performance goals.

1.2. Scope

The purpose of this contract is to acquire specialized system and software engineering and development as well as system and software assurance services. These services are performed on selected systems being developed by or for NASA, other Federal, State and local government agencies, commercial entities and/or other organizations and institutions as directed by the Government. These services can include work on classified information systems. These services are described in detail in section 3.0.

1.3. Statement of Work Structure

Overall, the Task Orders (TO) will describe projects and activities that will be supported, the services to be performed, and the products to be provided by the Contractor for a period of performance. The Task Orders may be modified during the course of the period of performance, if circumstances warrant, which may require the Contractor to submit an updated response for Government approval.

1.4. Systems and Software Assurance Services

The types of services being requested in this SOW are primarily performed on (but not limited

to) national assets, highly complex systems and software of both NASA and other entities such as the Dept. of Defense, Dept. of Energy, Dept. of Justice and Federal Bureau of Investigation. Examples of past Missions and Projects include:

• Spacecraft Flight Software Assurance on the MARS 2020 Mission

• Spacecraft Flight Software Assurance on the James Webb Space Telescope Mission

• Independent Oversight of the IV&V for NASA Commercial Crew Program

• Independent Oversight of the IV&V for the City of New York’s 911 System

• Software Engineering and Development of a Risk Management Tool for NASA’s Office of Safety and Mission Assurance

1.5. NASA Project Interfaces

The NASA IV&V Program’s paradigm for interfacing with a Development Project in the performance of IV&V is as follows. While none of the following are requirements, they do represent a typical approach to IV&V of projects.

1. Most of the Contractor staff is located at the IV&V Facility (Fairmont, WV) to promote synergism across projects.

2. The Contractor staff is composed of project domain experts, systems engineering and software engineering experts, and software assurance experts.

3. Some of the Contractor staff may be located at the Development Project site(s) to function as the “eyes, ears, and advocates” of the IV&V effort (when determined to be advantageous or necessary).

4. Contractor management is located at the IV&V Facility to promote timely and effective working relationships with the NASA staff and management.

5. NASA IV&V Project Managers are located at the IV&V Facility.

6. The Development Projects do not have representatives at the IV&V Facility.

As described in IVV 09-4, Project Management (located on the IV&V Management System (IMS) website at http://www.nasa.gov/centers/ivv/ims/slps/index.html), some form of formal agreement is used to establish and govern the relationship between the IV&V Program and the Development Project. The formal relationship between the Development Project and the IV&V Project is through the NASA IV&V Project Manager and the Development Project’s designated IV&V Point of Contact (POC). This POC is sometimes a dedicated individual, but is usually someone in the Development Project who has other assigned duties, as well. This path is used for all formal deliverables to the Development Project as well as formal interchange of data.

Formal submission of deliverables to the Development Project is performed by the NASA IV&V Project Manager, unless otherwise directed. This path is also used for any other formal coordination necessary between the IV&V effort and the Development Project (e.g., schedule changes, access to Development Project facilities, scope changes).

Ideally, normal IV&V team interaction with the Development Project shall be through the various developer/design teams on an informal basis. This is the desired primary path for conveying IV&V analyses results (e.g., issues) in a timely manner to the Development Project.

Utilizing this path of communication with the Development Project also ensures the developer is not surprised by analysis results being communicated through the chain of authority. This "no surprises" policy helps to build effective and cooperative relationships between the developers and the IV&V team. Ideally, the informal path is also the primary path for transmission of software artifacts and Development Project data to the IV&V effort.

Internally, Contractor personnel performing the Safety and Mission Assurance (SMA) Support function shall interface with the IV&V SMA Support Office (SSO) Lead, SSO support staff (civil servants) and personnel within other functional areas (both Contractor and civil servant staff). Externally, Contractor personnel shall interface directly with other SMA professionals at various Centers. These interactions shall be coordinated with the Government.

It is expected that the Contractor shall proactively coordinate all activities and efforts within and across all function areas defined in this SOW. As such, the Government expects routine dialogue and interactions amongst personnel supporting the function areas defined in this SOW to be standard practice. The Government expects that, on some occasions, personnel supporting other IV&V initiatives may need to interface with IV&V customers and stakeholders (Development Projects, SMA organizations, Center Management and associated personnel, etc.).

The Government will coordinate with the Contractor in these instances. The Contractor shall ensure these types of interactions are collaborated with the appropriate Government representative.

For management, it is expected that the Contractor shall conduct and maintain dialogue at various levels of the IV&V Program. It is expected that the Contractor will interact and have dialogues at the most appropriate levels of the IV&V Program given the topic/matter. At times, the Government may request Contractor management to support interactions external to the IV&V Program. The Government will notify the Contractor of these instances. The Contractor shall ensure these types of interactions are coordinated with the appropriate Government representative. Additionally, the Contractor shall notify the Government if they initiate or are invited to interface or interact with external interfaces regarding IV&V Program information.

1.6. Contract Management

The Contract Management activities include all necessary functions for management at the contract and project levels. Activities include but are not limited to planning, maintaining, monitoring, and adjusting program and project plans as the SOW functions are executing. The contractor shall provide reports defined in this SOW as well as those requested as a result of performing activities.

All tools, methods, capabilities and supporting data developed by the Contractor as a part of this contract will be owned by the Government. Where applicable, the Contractor shall provide all data and information pertaining to such items to the Government. This data and information shall be at an appropriate level and formatted such that they can be easily replicated or repeated.

This data and information shall be maintained on Government furnished data/information repositories.

The Contractor shall institute and maintain an effective, efficient and responsive management approach and organization responsible for management and oversight of Contractor personnel, subcontractors, other contract resources, Government furnished equipment/software/data, contract performance, deliverables and costs as applicable.

The Contractor shall manage, control, and report on the Contractor’s overall effort to ensure compliance with cost, schedule and technical requirements. The Contractor shall provide graphs showing planned versus actual costs.

The Contractor shall promptly notify the Government of any issues/concerns that may adversely impact the timely and cost-effective delivery of products and services associated with this contract.

The Contractor shall ensure the overall integration of services, products and activities across the functional areas defined in this SOW. The Contractor shall ensure communications in support of the performance of this contract are coordinated and consistent across all functional areas defined in this SOW. Such communications include internal (within the IV&V Program) as well as external (outside of the IV&V Program - IV&V stakeholders and customers).

The Contractor shall optimize the utilization of Contractor resources (personnel, tools, process assets) within projects, across projects and amongst function areas defined in this contract. The Contractor shall ensure that Contractor resources are fully engaged.

The Contractor shall manage and ensure the performance of all of its subcontractor(s) throughout the period of performance of each subcontract.

The Contractor shall support the IV&V Program’s metric processes and associated practices consistent with IVV 12, NASA IV&V Metrics.

The Contractor shall support, coordinate and participate in the following meetings and reviews with the Government and/or other Government invited attendees (customers, etc.) as required:

• Planning and coordination Meetings/Program Reviews

• Office Level Meetings

• Status Briefings (both internal to IV&V and with the Development Project and/or

SMA personnel

The Contractor shall participate in a semi-annual performance review/meeting with the Government.

The Contractor shall utilize the IV&V Program’s established data repositories in performing all activities and services associated with this contract. Data/information to be maintained in these repositories includes but is not limited to:

• Data and documentation received from Development Projects, IV&V and SMA customers or their contractors;

• Work products generated as part of performance of all activities and services associated with this contract;

• Correspondences generated and/or received related to the performance of all activities and services associated with this contract;

• Deliverables provided under this contract.

Only under special circumstances shall data/information be stored on Contractor information systems/repositories. These circumstances shall require authorization from the contracting officer with concurrence from the Contracting Officer Representative (COR) and applicable Government office lead(s). In these events, the Contractor is to establish a configuration management plan, a security plan and a migration plan to be used upon IV&V Project close-out as applicable or if the IV&V work transitions to another Contractor.

The Contractor shall support the Government’s records management processes and associated practices consistent with IVV 16, Control of Records.

The Contractor shall employ configuration management practices to ensure product integrity and traceability in performing activities associated the functional areas defined in this SOW.

Specific practices should include but are not limited to configuration identification, configuration control, configuration status accounting and configuration authentication. The Contractor’s configuration management practices shall be consistent with, integrated with and supportive of the Government’s configuration management practices. Where applicable, the Contractor shall perform configuration management consistent with the Government’s configuration management process (IVV 10, Software and Hardware Configuration Management).

The Contractor shall identify success stories for activities and efforts associated with the performance of this contract. The Contractor shall coordinate the generation of any such success stories with the Government. The Contractor shall document and communicate success stories consistent with the NASA IV&V success stories process (IVV 24, Success Stories). The Contractor shall maintain an understanding of success stories that are documented in the IV&V Program’s success story repository. The Contractor shall proactively integrate relevant aspects (best practices, etc.) of success stories into current and future activities associated with this contract.

The Contractor shall identify lessons to be learned from past and/or existing efforts associated with the performance of this contract. The Contractor shall coordinate the generation of lessons learned with the Government as applicable. The Contractor shall document and communicate lessons learned consistent with the NASA IV&V Lessons Learned process (IVV 23, Lessons Learned). The Contractor shall maintain an understanding of lessons learned that are formally documented in the NASA IV&V Program’s lessons learned repository, NASA Lessons Learned repository and other applicable industry/government repositories. The Contractor shall proactively integrate relevant aspects of lessons learned into current and future activities associated with this contract.

2. Reference Documents

The following documents provide useful reference material. Unless called out specifically in section 3.0 of this SOW or TOs, they are for informational purposes only and are not requirements under this contract.

2.1. Government Documents

1. NASA Procedural Requirements (NPR) 1600.2, NASA Classified National Security Information (CNSI)

2. NASA Policy Directive (NPD) 7120.4D, NASA Engineering and Program/Project Management Policy

3. NPR 7120.5E, NASA Space Flight Program and Project Management Requirements

4. NPR 7123.1B, NASA Systems Engineering Processes and Requirements

5. NPR 7150.2B, NASA Software Engineering Requirements

6. NASA Standard (NASA-STD) 8719.13, Software Safety Standard

7. NASA-STD 8739.8, Software Assurance Standard

8. IV&V Management System documents (http://ims.ivv.nasa.gov)

2.2. Industry Documents

1. ISO/IEC/IEEE Std 15288-2008 Standard for Systems and Software Engineering – System life cycle processes

2. ISO/IEC/IEEE Std 12207-2008 Standard for Systems and Software Engineering – Software Life Cycle Processes

3. IEEE Std 24748-1-2011 IEEE Guide- Systems and Software Engineering – Life Cycle Management – Part 1: Guide for Life Cycle Management

4. IEEE Std 24748-2-2012 IEEE Guide – System and Software Engineering – Life Cycle Management – Part 2: Guide to the Application of ISO/IEC 15288 (System Life Cycle Processes)

5. IEEE Std 24748-3-2012 IEEE Guide – Systems and Software Engineering – Life Cycle Management – Part 3: Guide to the Application of ISO/IEC 12207 (Software Life Cycle Processes)

6. IEEE Std 1012-2012, Standard for System and Software Verification and Validation

7. IEEE Std 730-2014 Standard for Software Quality Assurance Processes

8. IEEE Std 15026 – 1 – 2014 Systems and Software Engineering – Systems and Software

Assurance – Part 1: Concepts and Vocabulary

9. IEEE Std 15026 – 2 – 2011 Systems and Software Engineering – Systems and Software

Assurance – Part 2: Assurance Case

10. IEEE Std 15026 – 3 – 2013 Systems and Software Engineering – Systems and Software

Assurance – Part 3: System Integrity Levels

11. IEEE Std 15026 – 4 – 2013 Systems and Software Engineering – Systems and Software

Assurance – Part 4: Assurance in the Life Cycle

12. RTCA/DO-178B/C Software Considerations in Airborne Systems and Equipment Certification, B version 1 Dec 1992 w/ errata 3/26/1999, C version 13 Dec 2011

13. A Guide to the Project Management Body of Knowledge (PMBOK Guide) 5th Edition, Project Management Institute, 2013

3. Requirements

This section defines requirements that are applicable to activities described within this SOW.

This section outlines all the services that can be provided under this contract. When services are needed, the work to be performed will be identified in a separate Statement of Work and issued under a TO. The amount of work to be performed under this section varies depending on Program requirements. The Government will identify the specific set of services and requirements that the Contractor shall perform for a given period of performance in specific TOs.

Each TO will describe the specific requirements for a work element.

The contractor shall provide sufficient and appropriate qualified personnel to comply with any and all TOs issued. The following requirements are representative of the types of services that may be accomplished through the issuance of individual task orders under this contract.

The principal requirements of this SOW relate to the assurance services that the IV&V Program provides to NASA Missions. The NASA missions are selected by the Chief of the Office of Safety and Mission Assurance (OSMA). NASA missions are selected by the following criteria:

1. Category 1 missions as defined in NPR 7120.5

2. Category 2 missions as defined in NPR 7120.5 that have Class A or Class B payload risk classification per NPR 8705.4

3. Missions specifically selected by the NASA Chief of OSMA to have software IV&V

IV&V is a systems engineering process designed to reduce the operational risk of the software by employing analytical techniques that produce evidence revealing the correctness and completeness of the software as it evolves through a development life cycle. Verification and Validation are grounded in technical references and complemented with analytical techniques.

Leveraging Institute of Electrical and Electronics Engineers (IEEE) 1012 Standard for System and Software Verification and Validation, Independent V&V complements the developer’s assurance activities by formulating an understanding of the operational needs of the system and its software. This understanding is relied upon, along with additional technical data from the developer, when evaluating the system’s software artifacts (e.g., requirements, architecture, design, code, or tests) and determining whether or not the information contained within is correct and complete. IV&V is performed by an organization that is technically, managerially, and financially independent from the developing organization.

3.1. IV&V for NASA Projects

The Contracting Officer (CO) will issue TOs for NASA Missions requiring IV&V Services. The Contractor will provide a written response which, once approved by the Government, will be the official plan under which the Contractor shall operate. Task Orders will identify the IV&V Projects to be supported, the services to be performed and products to be generated during its lifecycle. An IV&V Project will go through five potentially overlapping states that comprise the project lifecycle: Initiation, Planning, Execution, Review, and Close. These states are detailed in Section 4.1 of IVV 09-4 “Project Management.” In addition, for each IV&V Project, the TO may identify specific items from IVV 09-1 “IV&V Technical Framework” for the Contractor to perform.

IV&V Initiation The Contractor shall provide a Heritage Review as a means to identify and communicate relevant knowledge and associated data from past and current IV&V Projects than can be leveraged and used to better scope, plan and execute future IV&V Projects. Relevant knowledge and data may include but is not limited to: data from previous missions and/or IV&V efforts and associated results, Agency and/or IV&V lessons learned, Development Project and IV&V issues, IV&V risks, current and past system operational anomalies and information contained within NASA’s knowledge network.

IV&V Project Planning The Contractor shall support the development of and/or develop the IV&V Project Execution Plans (IPEPs) and Technical Scope and Rigor documents. IPEPs are utilized by the IV&V Program to communicate IV&V interactions, interfaces, roles and responsibilities, Assurance Objectives, technical products and reporting methods with the Development Project as well as serve as the operational document for the IV&V efforts. The Technical Scope and Rigor document describes the overall IV&V approach to implementing the Assurance Design that drives the IV&V efforts.

The Contractor shall plan and/or support the Government in planning the IV&V effort by identifying methods from the IV&V Catalog of Methods that will satisfy the Assurance Objectives of the IV&V Project. The IV&V Catalog of Methods consists of a set of approaches that are utilized to implement the Assurance Design of the IV&V Project. The Contractor may also propose the use of engineering approaches that are not in the current IV&V Catalog of Methods. In such cases, the Contractor shall collaborate and coordinate these approaches with the Government, prior to execution, to establish agreement amongst all parties.

The Contractor shall identify and document the highest risk system- and software-level capabilities on IV&V-supported Missions. This information should be utilized to capture the specific elements of the Mission that warrant IV&V.

IV&V Project Execution The Contractor shall manage and provide IV&V services consistent with IVV 09-01, Independent Verification and Validation Technical Framework and IV&V Catalog of Methods.

IV&V efforts span entire system and software development cycles on both human rated and non-human rated NASA projects/missions. Specific IV&V services include:

- Verification and Validation of Mission/Project Documentation

- Requirements Verification and Validation

- Test Documentation Verification and Validation

- Verification and Validation of System and/or Software Design

- Verification and Validation of System and/or Software Implementation

- Verification and Validation of Operations and Maintenance Content

The Contractor shall execute the tasks planned for each IV&V as defined in the Task Order, and other Government provided documentation (execution plans, schedules, etc.) are accomplished effectively and efficiently. Enough information should be captured to demonstrate that the Assurance Objectives have been met for each IV&V Project.

The Contractor shall support the Government, as directed, in performing Project Management related activities consistent with IVV 09-04. The Contractor will ensure resources are managed appropriately to accommodate changes to agreed-upon work as defined in Task Order and other Government provided documentation (execution plans, schedules, etc.). The Contractor will proactively identify and manage any concerns and/or impacts to accomplishing the defined and agreed upon work. The Contractor will coordinate and collaborate with the Government on such concerns/impacts. The Contractor will collaborate and coordinate with the Government proposed actions to resolving or mitigating such concerns/impacts.

The Contractor shall develop a quality assurance plan to identify quality assurance related activities; and implement continuous improvement activities to ensure that IV&V services are provided effectively and efficiently.

The Contractor shall generate and/or support the generation of technical reports that represent the technical analyses conducted. All technical results and technical reports should provide the necessary evidence to demonstrate progress towards fulfillment of the planned Assurance Objectives.

IV&V Project Review The Contractor shall document and maintain the IV&V Assurance Objectives of the mission and identify the necessary evidence to confirm the Assurance Objectives will be met.

The Contractor shall establish, document and maintain information with respect to the coverage provided by the NASA IV&V Program on the system’s software.

The Contractor shall support internal IV&V milestone reviews that provide status of IV&V Projects to NASA IV&V management as well as demonstrate that IV&V activities are adequately planned and executing the agreed upon plan/approaches. The Contractor will support such reviews by actively discussing, at a minimum, the status of fulfilling the planned Assurance Objectives, the technical work completed, status of issue and risk resolution, lessons learned, future IV&V work and associated approaches.

The Contractor shall deploy risk management approach, consistent with the NASA IV&V risk management process (IVV 22, Risk Management and S3001 Guidelines for Risk Management) throughout the system and/or software development, Verification and Validation (V&V) or IV&V Project lifecycle. Tracking and Resolution of IV&V concerns will need to be communicated with the Development Project. IV&V concerns should be re-assessed regularly and resolved in a timely manner.

The Contractor shall identify and/or support the identification of performance measures to ascertain IV&V performance. Such performance measures may include but are not limited to measures to understand IV&V efficiency in executing tasks, quality of the work being performed, etc. Performance measures will help demonstrate that services are of the highest quality as well as IV&V activities resulted in an appreciable reduction in system and software risk.

The Contractor shall generate NASA IV&V Project status to support major NASA Project milestone reviews, Development Project meetings, and internal NASA IV&V Program reporting.

The Contractor shall support NASA Project milestone reviews and other IV&V Project-related meetings such as informal Development Project tag-ups and internal meetings with other IV&V Program groups (TQE, SWAT, JSTAR, IV&V Management).

IV&V Project Close-out The Contractor shall support the closing out of IV&V Projects. The Contractor should gather, organize and compile all applicable data associated with IV&V Projects (including but not limited to formally delivered products and informal data). The Contractor should organize and compile this data into a Close Out Report that supports future IV&V heritage reviews, government records management requirements and mishap investigations.

3.2. Directed Projects (DP)

The IV&V Program often time solicits or is solicited to support Government (Federal, State and Local) Agencies, commercial entities, and institutions to provide assurance, systems and/or software development or other related services. These services are negotiated (with Contractor input as necessary) with the customer and specific requirements will be specified in individual task orders.

NASA may issue tasks for Assurance Services in accordance with the requirements identified in SOW 3.1. These tasks can comprise a full-lifecycle support, or minimally independent assessment of critical systems.

NASA may issue tasks for designing, developing, enhancing, and testing of systems and/or software for the Agency or other IV&V Program customers. These tasks may include providing technical support for full and/or partial life cycle development work to include, but not limited to, activities such as concept and feasibility studies, requirements definition, subsystem design, software design, software implementation, system/software testing, software certification support activities, and cyber security.

3.3. Capability Development (CD)

CD is focused on understanding the trends, challenges, emerging requirements/needs and problems in conducting IV&V and SMA and integrating practical solutions into the engineering approaches employed by IV&V and SMA. CD advances the IV&V and SMA processes, tools, and knowledge through the exploration and integration of practical solutions. Emphasis is geared towards practical solutions for validated problems and seamless integration of CD solutions into the engineering approaches.

For CD, Task Orders will describe the technical areas of interest that are to be researched and advanced and/or direction for the Contractor to identify such areas. In addition to the technical areas in which CD will be conducted, specific tasking may be called out to include the knowledge transfer and integration of CD results into operations. The purpose of the CD initiatives is to ensure the IV&V Program continually evaluates methods, tools and approaches for improvement and to innovate in areas of system and software assurance to enable IV&V Program strategic goals and outcomes.

NASA may issue tasks to support Capability Development to further identify, communicate and discuss technical challenges experienced on IV&V Projects.

NASA may issue tasks to ensure that such problems/challenges are understood to the point that potential solutions can be researched and developed.

NASA may issue tasks to develop solutions identified which have been approved by the Government.

3.4. Project Management Support

The Contractor shall support the Government in performing Project Management related activities consistent with the Project Management Institute (PMI) Guide to the Project Management Body of Knowledge (PMBOK) and as specified within the Task Order. For any IV&V Project, the project management related activities shall be consistent with IVV SLP 09-

04. When the Contractor is providing project management support, the Contractor may be working with another Contractor responsible for the work (i.e. IV&V Office (IVVO), Safety and Mission Assurance (SMA), Program Support Office (PSO), Strategic Communications Office (SCO), etc.). In such cases, the Contractor shall not be responsible for the following:

A. Personnel management of the other Contractor B. Evaluation of that contractors products (i.e. formal deliverables) C. Contractor Performance Evaluations, where applicable D. Resource (e.g. personnel) allocation of the other Contractor

3.5. Technical Quality & Excellence (TQE)

TQE is an internally-focused function to ensure that the best services and products are being provided to our customers. The TQE team works directly with IV&V Projects to assist in and review work products. Primarily, it ensures that high quality IV&V products and services result from consistent and acceptable adherence to expectations, procedures, and processes across the IV&V function. This function also ensures that IV&V engineering approaches are effective and efficient.

For TQE, Task Orders will describe the specific IV&V Projects that require support, as well as any other generic (across multiple IV&V Projects) services that are needed from a TQE perspective. The purpose of Technical Quality and Excellence is to ensure the IV&V Program’s products are of the highest quality, and excel at providing value to our customers and stakeholders.

TQE Task Orders may include, but are not limited to:

NASA may issue tasks to provide technical insight and recommendations on/for IV&V Projects regarding improvement options during the execution of IV&V projects to ensure technical quality is maintained and advanced.

NASA may issue tasks to support the development, improvement and maintenance of IV&V process assets. Applicable assets include but are not limited to the IV&V Technical Framework, IV&V Catalog of Methods, standards, guidelines, procedures, and work instructions.

NASA may issue tasks to support product reviews, conducted by both NASA IV&V Office Management and the TQE function, to improve the quality of the products being produced. The Contractor shall resolve all concerns and recommendations that are identified as part of such product reviews.

NASA may issue tasks to support the review of IV&V technical products (e.g., technical reports, issues/observations).

NASA may issue tasks to ensure IV&V Project adherence to applicable IV&V processes, standards and guidelines.

NASA may issue tasks to support the review of the engineering solutions requested for adoption into the IV&V Catalog of Methods.

NASA may issue tasks to support the exchange and dissemination of information pertaining to updates to IV&V process assets.

NASA may issue tasks to support a rigorous continuous improvement strategy to help establish the IV&V as a center of excellence in providing IV&V services to Development Projects. In addition to the supporting initiatives that support IV&V advancement in its disciplines, the Contractor shall support IV&V Program initiatives chartered around the vision and mission statements of the IV&V Program (see Government Documents 6 and specifically the Quality Manual).

NASA may issue tasks to identify, assess and make recommendations to the Government regarding training needs and areas for improvement for its workforce (Civil Service and Contractor).

NASA may issue tasks to address identified training needs. The Contractor shall take necessary corrective and/or improvement action to address any shortcomings, risks and areas of concern with regard to workforce (Civil Servant and Contractor) skills and capabilities.

3.6. Software Assurance Tools (SWAT) Support

SWAT Support is an enabling function responsible for the Computer Aided Software Engineering (CASE) tools needed to support IV&V, CD, TQE, SMA and Management functions. This function integrates tools advanced through CD into the operational environment.

SWAT Support maintains both CD and procured/licensed tools. SWAT Support provides knowledge and assistance in the use of the tools and tool based solutions. This SOW describes the need to interact with SWAT.

NASA may issue tasks to have the Contractor support SWAT activities as directed.

3.7. Jon McBride Software Testing and Research (JSTAR) Support

The IV&V’s Test Capability is housed in the Jon McBride Software Testing and Research (JSTAR) lab. JSTAR support is a simulation and test environment function that is responsible for the acquisition, development, maintenance and deployment of embedded system test environments for the NASA IV&V Program. This function includes supporting the IV&V Projects in planning, development, and execution of independent testing of in-scope system and software test scenarios.

JSTAR is managed under a separate contract. This SOW describes the need to interact with JSTAR. For JSTAR Support, Task Orders will describe the services needed to be provided in support of this IV&V function.

NASA may issue tasks to provide simulation and test environment support services. Support may be required in the following domains:

• Operational ground systems

• Flight data system (on-board processors, flight software, data buses, external interfaces)

• Environmental Simulators

• Space-Ground Link

• Bus Monitors

3.8. Safety & Mission Assurance Support Office (SSO)

The SMA Support function focuses on supporting SMA organizations, primarily NASA Center SMA organizations, to provide software assurance support. The SMA Support function performs focused tasks and provides trained staff to support SMA personnel, including NASA Center SMA personnel, in accomplishing their SMA objectives, particularly where focused knowledge such as software analysis is required.

For SMA Support, Task Orders will describe the services required in support of the SMA activities being conducted at the various Centers. The SMA Support Office works with the Office of Safety and Mission Assurance (OSMA), Center SMA organizations and other NASA Headquarters (HQ) Support offices (as identified and approved) to benefit the Agency by providing additional level of safety and mission assurance, specifically as it relates to Software Assurance (SA).

The following includes the related tasks for SA services. Tasks will be on an “as directed” basis and will not be required for every effort. However, on any one effort one or more of these tasks may be assigned so the Contractor needs to be prepared to evaluate, schedule and perform the effort/activity.

NASA may issue tasks that require the Contractor to support the development, review, and maintenance of the SA documentation (e.g., Requirements, Standards, Manuals, and Handbooks).

NASA may issue tasks to participate in and collaborate with the various working groups, software assurance community and SMA organizations meetings and events as directed by the Government including but not limited to the NASA Software Assurance Working Group (SAWG) and SA community and the NASA Software Working Group (SWG).

NASA may issue tasks to support development and packaging of technical documentation, including briefings to be utilized during formal and informal project meetings.

NASA may issue tasks to review, evaluate and support the creation of development project software related documents (e.g., plans, procedures, requirements, design documents, verification documents, reports, schedules, and records) for compliance to the relevant Software Assurance requirements and standards as well as any additional Center/project-specific requirements.

NASA may issue tasks to perform Software Assurance Classification Assessments to determine the level of SA to be applied is consistent with Government identified standards and/or requirements including but not limited to NASA SA Standard (NASA-STD 8739.8). The Contractor shall document and maintain assessment results in a report.

NASA may issue tasks to investigate, audit, review and/or evaluate the execution of software procedures and processes for SA compliance. The contractor shall perform internal process audits and/or assessments to ascertain development organization’s adherence to applicable standards and requirements.

NASA may issue tasks to participate, conduct, and attend formal (reviews, audits and inspections) and informal project meetings to assure software quality issues are addressed.

NASA may issue tasks to support development and packaging of information to be utilized during formal and informal project meetings.

NASA may issue tasks to evaluate and/or support the development of Software Assurance Plans.

NASA may issue tasks to review and assess software safety related documents (e.g., plans, procedures, requirements, design documents, verification documents, reports, schedules, and records) for adherence to applicable standards and requirements.

NASA may issue tasks to perform software hazard analysis, identifying software hazards, potential mitigation measures for such hazards and document analysis results in software hazard analysis reports.

NASA may issue tasks to perform software safety classification assessments (Software Safety Litmus Tests) to determine if software is safety-critical according to the criteria in the Government identified standards and/or requirements including but not limited to NASA-STD

8739.8 and NASA-STD 8719.13. The Contractor shall document and maintain assessment results in a report. The Contractor may also be required to provide these results to SMA organizations.

NASA may issue tasks to identify and document safety-critical software and, working with Systems Safety, help evaluate the software for its contribution to the system hazard causes, controls, and mitigations. All Hazard controls and mitigations performed in part or in whole by software shall be verified to work within the system. Tests and verifications may need to be created, performed, and documented in the hazard reports as part of the software safety activities.

NASA may issue tasks to report any safety-related risks and support the resolution of any software findings (issues, observations, risks) with the project SA organization or appropriate safety organization.

NASA may issue tasks to evaluate and support development of the software safety plans, and/or information incorporated within other project documentation or plans.

NASA may issue tasks to support the development and review of project software related documents (e.g., plans, procedures, requirements, design documents, verification documents, reports, schedules, and records) to assure software is analyzed for reliability and any resulting best practices (e.g.. fault detection, isolation, tolerance and recovery) provided for potential incorporation into the software products.

NASA may issue tasks to review and evaluate software reliability related products and associated data to evaluate/ascertain software reliability.

NASA may issue tasks to identify, document and analyze defect related data to support reliability analysis, trends and metrics products.

NASA may issue tasks to evaluate project software related documents and products to assure they conform to SA standards and procedures.

NASA may issue tasks to participate in formal and informal reviews to assure that software verification and validation tasks are being performed according to the Agency and project plans, policies, requirements, procedures, and standards.

NASA may issue tasks to participate in witnessing software testing and demonstrations when requested by the Government.

NASA may issue tasks to collect, maintain and provide to the SMA organizations software assurance records documenting V&V efforts.

NASA may issue tasks to review, evaluate, document and improve NASA policies and standards relative to software development or software assurance.

NASA may issue tasks to assess complex electronics and programmable logic devices.

3.9. Information Assurance (IA)

The goal of Information Assurance services within the IV&V Program is to conduct analysis, simulation and test to provide assurance of information systems and cybersecurity services as it applies to mission critical systems and assets.

NASA may issue tasks to perform Threat, Vulnerability, and Risk Assessments

NASA may issue tasks to provide assurance that software developers are following a secure development life-cycle (SDLC).

NASA may issue tasks to perform vulnerability assessment and penetration testing. Minimally, familiarity with the below tools is recommended:

• Kali Linux, Metasploit, Nessus, Burp Suite, HP Webinspect, RedSeal, HP Fortify

NASA may issue tasks to aid in developing penetration testing and vulnerability assessment labs and training material

NASA may issue tasks to aid in maintenance and enhancements (e.g. research, training, demonstration of tools virtualizations of customer systems) of cybersecurity laboratory.

Minimally, knowledge of VMware’s product line is desired (vCloud, vCenter, ESXi, vSphere)

NASA may issue tasks to perform security assessments according to Federal Risk and Authorization Management Program’s (FedRAMP) standards. IV&V Program will be 3PAO certified FedRAMP assessor and contractor will support security assessments. This may include assistance in standing up and maintaining a security operations center at various levels of designations.

NASA may issue tasks which require staff to be knowledgeable with National Institute of Standards and Technology’s (NIST) Risk Management Framework (RMF), FIPS-199, FIPS-140- 2 as well as the NASA decomposition of the NIST requirements (NPR 2810).

NASA may issue tasks which require security cleared analysts to perform assessments at the TS//SI//TK//G//HCS level, in accordance with the Contract security classification.

NASA may issue tasks to assess NASA’s project adherence to Security of Information Technology NPR 2810 and NASA Software Engineering Requirements NPR 7150.2B.

NASA may issue tasks which require staff proficient in secure coding principles to aid in the development and maintenance of a Secure Coding Portal.

NASA may issue tasks to assess Insider Threat Programs for other government agencies;

therefore, Contractor shall understand the Insider Threat Executive Order and its requirements.

Glossary

1. Assurance Objectives refers to the desired outcomes of performing assurance services of a given Project or Mission. Assurance Objectives should be expressed in terms of the software’s role in accomplishing the mission objectives or mission-level capabilities.

2. Assurance Design refers to how the IV&V Team will perform the necessary analysis and capture the correct evidence to ensure the Assurance Objectives have been fulfilled.

3. Contractor refers to the contractor organization performing the functions, or support of those functions, identified in this contract.

4. Development Project refers to an IV&V customer that is developing software.

5. Formal Agreement is a document that captures the planned technical and management activities on an IV&V Project. A formal agreement may be in the form of an IV&V Project Execution Plan (IPEP), Memorandum of Agreement (MOA) or some other formal document.

6. Government – Unless otherwise specified in this document, Government refers to NASA IV&V Program civil service personnel.

7. IV&V Catalog of Methods is a set of documented methods that can be applied to perform IV&V. An IV&V Method is a set of activities that when executed under the specified conditions and assumptions achieves a specified technical goal or goals (based on the IV&V Technical Framework).

8. IV&V effort refers to a set of tasks being performed on an IV&V Project (e.g., the International Space Station IV&V effort).

9. IV&V Facility is located in Fairmont, West Virginia.

10. IV&V Project refers to an IV&V, Independent Assessment, or software assurance activity/task being performed by the NASA IV&V Program for a specific customer.

11. IV&V Services is a generic term used to encompass the scope of work described in the IV&V Technical Framework and the selected engineering approaches described in the IV&V Catalog of Methods.

12. IV&V Technical Framework is a standardized description of IV&V services provided to a Development Project. This framework is written in terms of “what” must be done but not “how” it is to be done. The current IV&V Technical Framework can be found in System Level Procedure (SLP IVV 09-1) at http://ims.ivv.nasa.gov

13. IV&V Technical Reference is the collection of data and knowledge regarding IV&V’s independent understanding of the system’s software. The Technical Reference serves as the basis for IV&V analysis. This information includes but is not limited to system goals and needs, software interactions amongst system design elements, normal and abnormal behaviors and conditions of the system’s software and the operational environment.

14. NASA IV&V Project Manager refers to IV&V Program civil service or contractor personnel who perform project management functions on IV&V Projects.

15. IV&V Metrics The IV&V Program maintains a metrics program to evaluate and improve performance Program-wide. The intent of the metrics program is to ascertain the effectiveness and efficiency of the services and products as well as to provide insight into potential improvement areas with regards to the development and assurance of system’s software.

Acronyms

CASE Computer Aided Software Engineering CD Capability Development CNSI Classified National Security Information (CNSI) CO Contracting Officer COR Contracting Officer Representative DP Directed Projects FedRAMP Federal Risk and Authorization Management Program’s HQ Headquarters IA Information Assurance IEEE Institute of Electrical and Electronics Engineers IEC International Electrotechnical Commission IMS IV&V Management System IPEP IV&V Project Execution Plans ISO International Organization for Standardization

IV&V Independent Verification and Validation IVVO IV&V Office JSTAR Jon McBride Software Testing and Research MOA Memorandum of Agreement NASA National Aeronautics and Space Administration NASA-STD NASA Standard NIST National Institute of Standards and Technology NPD NASA Policy Directive NPR NASA Procedural Requirements OSMA Office of Safety and Mission Assurance PMBOK Project Management Body of Knowledge PMI Project Management Institute POC Point of Contact PSO Program Support Office RMF Risk Management Framework RTCA Radio Technical Commission for Aeronautics SA Software Assurance SAS Systems and Software Assurance Services SAWG Software Assurance Working Group SCO Strategic Communications Office SDLC Secure Development Life-cycle SLP System Level Procedure SMA Safety and Mission Assurance SOW Statement of Work SSO SMA Support Office SWAT Software Assurance Tools SWG Software Working Group TO Task Order TQE Technical Quality and Excellence V&V Verification and Validation WBS Work Breakdown Structure