RGT_DRAFT_Performance_Work_Statement_24JAN19.pdf

Performance Work Statement (PWS) For

Remote Ground Terminal Engineering Services

1. General

This is a non-personnel services contract to provide systems engineering to the Army Geospatial Center (AGC) and software development for the enhancement and information assurance processes for the Remote Ground Terminal (RGT) system in support of U.S. Army geospatial-intelligence (GEOINT) requirements.

1.1 Description of Services/Introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personnel services necessary to perform RGT systems engineering, software development, system deployment, and operations and maintenance as defined in this Performance Work Statement. The Contractor shall perform to the standards in this contract.

1.2 Background: This acquisition is intended to provide the Army Geospatial Center (AGC) and System Acquisition Support Directorate with RGT system and engineering services. The RGT consists of a processing suite and a receive suite which contains a GATR TRAC 2.4m antenna. Historically, the RGT has the ability to directly downlink imagery GEOEye, Worldview 1, WorldView 2, RADARSat-2, and Deimos2 sensors. The RGT is intended to transition to Distributed Common Ground System – Army (DCSG-A) an Army program of record. DCGS-A is a major system that is deployed globally and will utilize RGT ability for near-real time Direct Downlink (DDL) and processing of commercial imagery in Disconnected, Intermittent, and Limited bandwidth (DIL) environments. Commercial imagery provides Army and supported users with unclassified, timely, accurate and ever-increasing resolution products capable of satisfying multiple requirements in peace, crisis and wartime. Due to the unclassified nature of commercial imagery, properly licensed data is available with no security constraints and may be shared throughout coalition operations, as well as in Humanitarian Assistance/Disaster Relief (HADR) situations. The first prototype RGT is currently deployed with the 501st MI Brigade at Camp Humphrey’s Korea. The 501st MI Brigade requires an organic capability to access imagery to support split-based, real-world, and contingency operations. The Remote Ground Terminal, when operationally deployed, will give the tactical unit an organic capability for commercial imagery and the ability to remotely access imagery data sets in support of split-based theater operations.

The Remote Ground Terminal was developed by Radiant Solutions, a MAXAR company, (formerly, MacDonald, Detwiler and Associates). Currently, the RGT also relies upon Radiant Solutions’ proprietary software. Interested contractors are strongly encouraged to coordinate with Radiant Solutions.

1.3 Objectives:

• Build and field at least one, potentially two (based upon Army needs) RGT system(s) to

Government determined location(s) in support of Mission needs

• Provide Information Assurance Services on all RGT systems. Provide Operations and

Maintenance support to deployed RGT systems and laboratory systems

• Integrate new sensors into current RGT system, as well as new RGT systems when built and fielded

• Relocate and install the current RGT system to a Government determined location

1.4 Scope: Provide systems engineering and software development services to deploy, maintain, and enhance the RGT.

1.5 Period of Performance: The period of performance of this contract varies by task and award date as follows:

1.5.1 Information Assurance Period of Performance:

Base Period: 1 year Option Year 1: 1 year Option Year 2: 1 year

1.5.2 Operations and Maintenance Period of Performance:

Base Year: 1 year Option Years: To be determined at task order level

1.5.3 New Sensor Integration Period of Performance:

To be determined at task order level

1.5.4 Deploy a Remote Ground Terminal Period of Performance:

To be determined at task order level

1.5.5 Installation of the Relocated RGT

To be determined at task order level

1.6 Type of Contract: The Government is intended on awarding an Indefinite-Delivery, Indefinite –Quantity (IDIQ) contract.

1.7 General Information

1.7.1 Quality Control: The Contractor shall adhere to the approved Quality Control (QC) measures for this contract. The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS.

The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s quality control program is the means by which they assure themselves that their work complies with the requirement of the contract. This plan will ensure product completeness through each monthly reporting period and ensure that the delivered technical services, training and maintenance are of the highest quality. The first draft of the Quality Control Plan (QCP) will be included in the Contractor’s proposal. The final QCP will be delivered within five days after contract award. The QCP shall be submitted to the KO and COR within five working days when changes are made thereafter. After acceptance of the QCP the Contractor shall receive the contracting officer’s acceptance in writing of any proposed change to their QC plan.

1.7.2 Quality Assurance: The Government shall evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP).

This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.7.3 Recognized Holidays: The Contractor is not required to perform services on the following holidays unless the factory support is expanded up to 24 hours/7 days a week in times of conflict or crisis.

New Year’s Day Labor Day Martin Luther King Jr’s Birthday Columbus Day President’s Day Veterans Day Memorial Day Thanksgiving Day Independence Day Christmas Day

1.7.4 Hours of Operation: The Contractor is responsible for conducting business between the hours of 8 a.m. and 6 p.m. Monday through Friday except if factory support is expanded up to 24 hours/7 days a week in times of conflict or crisis.

1.7.5 Place of Performance: Work shall be performed at the contractor location and deployed operational location(s).

1.7.6 Clearance Requirements: TS/SCI security clearances will be necessary for portions of this contract as determined by the Government.

1.7.7 AT Level I Training: All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities, controlled access areas, or require network access, shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. Upon request, the Contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website:

http://jko.jten.mil/courses/atl1/launch.html; or it can be provided by the RA ATO in presentation form which will be documented via memorandum.

1.7.8 Access and General Protection/Security Policy Procedures: All contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The Contractor shall also provide all information required for background checks to meet installation/facility access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any installation or facility change, the Government may require changes in contractor security matters or processes.

1.7.9 For Contractors requiring Common Access Card (CAC): The Contractor and all sub-contractors employees will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an interim CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

1.7.10 For Contractors who do not require a CAC, but require access to a DoD facility or installation: Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05 / AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative, as NCIC and TSDB are available), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

1.7.11 AT Awareness Training for Contractor Personnel Traveling Overseas: All US based contractor employees and associated sub-contractor employees traveling overseas will receive the government provided AOR specific AT awareness training. The documentation of training completion must be provided to the COR prior to departure.

1.7.12 Suspicious Activity Reporting Training: The Contractor and all associated sub- Contractors shall receive a brief/training (provided by the RA) on the local suspicious activity reporting program. This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the project manager, security representative or law enforcement entity. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 5 calendar days after the completion of the training.

1.7.13 Contractor Employees Who Require Access to Government Information Systems: All contractor employees with access to a government info system must be registered in the Army Training Certification Tracking System (ATCTS) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the information systems and then annually thereafter in accordance with personnel security standards listed in AR 25-2 (Information Assurance), an appropriate background investigation will be conducted prior to accessing the government information systems.

1.7.14 For Contracts that Require OPSEC Training: All new contractor employees will complete Level I OPSEC Training within 30 calendar days of their reporting for duty. Additionally, all contractor employees must complete annual OPSEC awareness training. The Contractor shall submit certificates of completion for each affected contractor and subcontractor employee, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training. OPSEC awareness training is available at the following websites: https://www.iad.gov/ ioss/ or http://www.cdse.edu/catalog/operations-security.html; or it can be provided by the RA OPSEC Officer in presentation form which will be documented via memorandum.

1.7.15 For Information assurance (IA)/Information technology (IT) certification: All new contractor employees will complete Level I OPSEC Training within 30 calendar days of their reporting for duty. Additionally, all contractor employees must complete annual OPSEC awareness training. The Contractor shall submit certificates of completion for each affected contractor and subcontractor employee, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training.

OPSEC awareness training is available at the following websites: https://www.iad.gov/ ioss/ or http://www.cdse.edu/catalog/operations-security.html; or it can be provided by the RA OPSEC Officer in presentation form which will be documented via memorandum.

1.7.16 For Contractors Authorized to Accompany the Force: All contractor employees shall ensure the following AT/OPSEC requirements are met prior to deploying personnel authorized to accompany U.S. Armed Forces outside the United States; to include compliance with laws, regulations, pre-deployment requirements, and required training in accordance with combatant command guidance.

1.7.17 For Contracts Requiring Performance or Delivery in a Foreign Country: All non-local contracting personnel will comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor's compliance with combatant commander and subordinate task force commander policies and directives.

1.7.18 For Contracts that Require Handling or Access to Classified Information:

Contractor shall comply with AR 380-67 (Personnel Security Program) and Homeland Security Presidential Directive 12 (Policy for a Common Identification Standard for Federal Employees and Contractors) as well as FAR 52.204-2, Security Requirements.

Additionally, Contractors must comply with - (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); any revisions to DOD 5220.22-M, notice of which has been furnished to the contractor. For classified contracts, the DD Form 254 will be attached with the contract.

1.7.19 Will be escorted in areas where they may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas: All contract employees, including subcontractor employees who are not in possession of the appropriate security clearance or access privileges, will be escorted in areas where they may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas.

1.7.20 Contractor Company to obtain a Facility Clearance and individual clearances at the appropriate level: The Prime Contractor Company must have a Facility Clearance (FCL) at the appropriate level (IAW the NISPOM DOD 5220.22-M and AR 380-49) prior to the start of the contract awarded period of performance. Contractor personnel performing work under this contract must have the required security clearance, per AR 380-67, at the appropriate level at the start of the period of performance. Security Clearances and FCL requirements are required to be maintained for the life of the contract IAW the DD Form 254 attached to the contract. If no FCL, the supporting Government Contracting Activity will sponsor the prime contract company in obtaining the FCL.

1.7.21 Pre-screen candidates using E-Verify Program: The Contractor must pre-screen Candidates using the E-verify Program (http://www.uscis.gov/e-verify) website to meet the established employment eligibility requirements. The Vendor must ensure that the Candidate has two valid forms of Government issued identification prior to enrollment to ensure the correct information is entered into the E-verify system. An initial list of verified/eligible Candidates must be provided to the COR no later than 3 business days after the initial contract award." *When contracts are with individuals, the individuals will be required to complete a Form I-9, Employment Eligibility Verification, with the designated Government representative. This Form will be provided to the Contracting Officer and shall become part of the official contract file.

1.7.22 Threat Awareness Reporting Program: All new contractor employees will complete annual Threat Awareness and Reporting Program (TARP) Training provided by a Counterintelligence Agent, IAW AR 381-12. The Contractor shall submit certificates of completion for each affected contractor and subcontractor employee(s) or a memorandum for the record, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training. Authorized webbased TARP training for CAC card holders is available at the following website:

https://www.us.army.mil/suite/page/655474

1.7.23 Other Direct Costs: This category includes travel, reproduction, and shipping expenses associated with training activities and visits to other contractor facilities. It could also entail the renting of suitable training venues.

1.7.24 Data Rights: The Government has Government Purpose Data Rights to all data, documents, and material produced under this contract. All data, documents, and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These data, documents, and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.7.25 Contractor Travel: The Contractor will be required to travel to both military and non-military locations, both in CONUS and OCONUS. Some travel may support crisis action and/or contingency operations. The Contractor shall execute all travel IAW DoD, COCOM and local commander regulations and policies. Travel costs will be executed and reimbursed in accordance with FAR 31.205-46.

1.7.25.1 CONUS Travel: The Contractor shall obtain written COR approval a minimum of seven calendar days prior to date of travel. The Government anticipates 6 to 8 CONUS travel events annually. Travel events typically consist of 1–4 contractors per event and 3–5 days in duration.

1.7.25.2: OCONUS Travel: The Contractor shall obtain written COR approval and complete SPOT registration at least 30 calendar days prior to date of travel.

When OCONUS travel is required, the Contractor shall abide by U.S. SOFA and local laws in performance of this contract. The Contractor shall submit essential documentation to obtain country clearance before travel begins. The Government anticipates 8 to 12 OCONUS travel events annually. Trips typically consist of 1– 4 contractors per event and 7–14 days in duration.

1.7.26 Disclosure of Information: According to DFAR 252.204-7000, (a) The Contractor shall not release to anyone outside the Contractor’s organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless – (1) The Contractor Officer has given prior written approval. (b) Requests for approval under paragraph (a)(1) shall identify the specific information to be released, the medium to be used, and the purpose for the release. The Contractor shall submit its request to the Contracting Officer at least 10 business days before the proposed date for release. (c) The Contractor agrees to include a similar requirement, including this paragraph (c), in each sub-contract under this contract. Subcontractors shall submit requests for authorization to release through the prime contractor to the Contracting Officer.

1.7.27 Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5.

The Contracting Officer, Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced.

Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.7.28 Contracting Officer’s Representative: The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions; assure that the contractor performs the technical requirements of the contract, perform inspections necessary in connection with contract performance, maintain written and oral communications with the contractor concerning technical aspects of the contract, issue written interpretations of technical requirements, including Government drawings, designs, specifications, monitor contractor's performance and notifies both the Contracting Officer and contractor of any deficiencies, coordinate availability of government furnished property, and provide site entry of contractor personnel.

A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

Part 2 Definitions & Acronyms

2. Definitions and Acronyms

2.1 Definitions

CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S.

Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

QUALITY ASSURANCE. The government procedures to verify that services being performed by the contractor are performed according to acceptable standards.

QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

QUALITY CONTROL. All necessary measures taken by the contractor to assure that the quality of an end product or service shall meet contract requirements.

RADARSAT-2. A Canadian commercial radar satellite

SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

WORK DAY. The number of hours per day the contractor provides services in accordance with the contract.

WORK WEEK. Monday through Friday, unless specified otherwise.

2.2 Acronyms

ACOR Alternate Contracting Officer's Representative AFARS Army Federal Acquisition Regulation Supplement AGC Army Geospatial Center AR Army Regulation AT Antiterrorism ATCTS Army Training Certification Tracking System ATO Authority to Operate C&A Certification and Accreditation CAC Common Access Card CCB Configuration Control Board CCE Contracting Center of Excellence CDP Commercial Data Provider CDRL Contract Data Requirements List CFR Code of Federal Regulations CIO Chief Information Officer CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative COTS Commercial-Off-the-Shelf DA Department of the Army DCGS-A Distributed Common Ground System - Army DD250 Department of Defense Form 250 (Receiving Report) DD254 Department of Defense Contract Security Requirement List DDL Direct Downlink DFARS Defense Federal Acquisition Regulation Supplement DIL Disconnected, Intermittent, and Limited bandwidth DMDC Defense Manpower Data Center DoD Department of Defense DoDD Department of Defense Directive FAR Federal Acquisition Regulation FBI Federal Bureau of Investigation FFP Firm-Fixed Price FPCON Force Protection Condition GEOINT Geospatial Intelligence HIPAA Health Insurance Portability and Accountability Act of 1996 HADR Humanitarian Assistance/Disaster Relief

HQDA Headquarters, Department of the Army IA/IT Information Assurance/Information Technology JTR Joint Travel Regulation KO Contracting Officer NACI National Agency check with Inquiries NIPRNet Non-Secure Internet Protocol Router NETwork NLT No later than OCI Organizational Conflict of Interest OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs OIC Officer’s In- Charge OPSEC Operational Security PCS Permanent Change of Station PIPO Phase In/Phase Out POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program RGT Remote Ground Terminal RMF Risk Management Framework SCA Security Controls Assessor SIA Security Impact Assessment SOP Standing Operating Procedures TARP Threat Awareness and Reporting Program (TARP)

Part 3 Government Furnished Property, Equipment, and Services

3. Government Furnished Property, Equipment, and Services

3.1 Information and Data:

3.1.1 Government furnished imagery data.

3.2 Hardware and Software: The Government will provide hardware and software as determined necessary by the Government for use by the Contractor at the Contractor’s facilities.

3.3 Facilities: The work performed under this contract will take place at the Contractor facility and the Government-determined locations.

Part 4 Contractor Furnished Items

4. Contractor Furnished Items

4.1 The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform RGT Technical Services as defined in this Performance Work Statement except for those items specified as government furnished property and services. The Contractor shall perform to the standards in this contract.

Part 5 Specific Tasks

5. Specific Tasks:

5.1 Information Assurance (IA)

For systems that only process data at the SECRET classification level and below and/or connect to only SIPRNet/NIPRNet, the Contractor shall follow DODI 8510.01 “Risk Management Framework (RMF) for DoD Information Technology (IT)”, National Institute of Standards and Technology Special Publication (NIST) 800-37 “Guide for Applying the Risk Management Framework to Federal Information Systems”. The Contractor shall implement Information Assurance (IA) controls required to safeguard the data and software IAW Certification and Accreditation, the Committee on National Security Systems (CNSS) Instruction No. 1253, “Security Categorization and Control Selection for National Security Systems” and NIST 800- 53, “Recommended Security Controls for Federal Information Systems and Organizations” as well as any applicable overlays that are determined to be applicable to the system and Army Regulation (AR) 25-2, “Information Assurance”. The information system shall be configured IAW the appropriate Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs). Any new information systems and/or accountable property purchased to meet IA requirements will be coordinated with the Government IA Point of Contact and through the COR, and approved in advance by the Contract Officer. In some instances, the information system may be accredited by an authorizing official when a system operates at different classification levels/different connectivity. The authorizing agency/authority will be determined via coordination with the PM.

The Remote Ground Terminal seeks an Authority to Operate (ATO) on NIPRnet. In order to do this, vulnerabilities identified through the RMF processes will need to be remedied and the Body of Evidence will need to be updated. Once the ATO is acquired, the system requires continuous monitoring in order to maintain the most updated security posture of the system and the ATO.

Base Period- PoP of 1 Year

• Review of Monthly ACAS scan results. Update software to address ACAS scan vulnerabilities not covered by the Network Enterprise Center.

• Maintain awareness of the DISA STIG update schedule and update applicable STIG checklists on a quarterly basis. Updates must be done for all new and updated applicable STIGs. Update software to address STIG vulnerabilities not covered by the Network Enterprise Center; if not immediately correctable, create a new PO&AM item for the vulnerability(ies).

• Run SCAP Scans in conjunction with the STIG release to support STIG checklist updates at least quarterly.

• Update applicable body of evidence (BOE) documents and correct remaining POA&M items identified during self-assessment prior to SCA-V testing.

• Provide onsite support to SCA-V testing on site: support includes, but is not limited to:

o Facilitating/launching ACAS/SCAP scans o Performing technical assessment of all hardware, software, and firmware with applicable STIGs explaining configurations and BOE language related to the RGT system, etc.

o Providing access to system by a System Administrator, answering technical questions on the RGT system, running system scans and checks.

• Conduct initial remediation actions on all system or software/applications security controls based on the findings and recommendations from the Security Assessment Report (SAR) following the SCA-V event. Once corrected, the remediated or mitigated vulnerabilities should be reassessed for compliance and BoE should be updated in preparation for submission of ATO request.

• Develop and follow a continuous monitoring strategy that includes assessment, analysis, reporting and updates based on Security Control Traceability Matrix (SCTM) review timelines to perform ongoing security control assessments.

• Create/Update POA&M if new items arise from future STIG checklist, ACAS, EOL items, etc. that cannot be remediated.

• Incorporate analysis, flaw remediation, and patch management within the Configuration Control Board (CCB). Perform security impact analysis to assess risk in anticipation for future minor/major modifications to the system or its software/applications (e.g. new sensor integration). Security impact analysis may also include but not limited to reviewing security plans to understand security control requirements, reviewing current or new system design documentation to understand or plan security control implementation, and specific changes that may impact the system.

• All personnel with privileged access or performing IA roles must maintain certification DoD 8570.01M requirements

Option Year 1-

• Follow plan for continuous monitoring activities (both automated and manual) requiring assessment, analysis, reporting and updates of all applicable security controls and information security-related risk based on SCTM review timelines.

• Facilitate ongoing awareness of threats, vulnerabilities, and information security to support organization risk management decisions.

• Maintain awareness of the DISA STIG update schedule and access on a quarterly basis.

Update IS to address STIG vulnerabilities for items not covered by the Network o Generate the appropriate risk response actions based on analysis from STIG checklist, ACAS, SCAP, EOL items, etc.

o Perform SCAP scans to support manual STIG and STIG benchmark updates based on continuous monitoring strategies.

o Review of monthly ACAS scan results and update IS to address vulnerabilities for items not covered by the Network Enterprise Center.

o Initiate CCB process to plan and execute flaw remediation and patch management tasks o Update Plan of Action & Milestones (PO&AM) with vulnerabilities that are open and/or remediated.

• Update body of evidence (BoE) to support assessment activities prior to SCA-V testing and after receipt of approval to operate (ATO) as part of the continuous monitoring strategy.

• Maintain authorization status of information systems and common controls over time due to changes in mission/business needs, threats, vulnerabilities, and technology upgrades.

• Perform security impact analysis to assess risk in anticipation for future minor/major modifications to the system or its software/applications (e.g. new sensor integration).

Security impact analysis may also include but not limited to reviewing security plans to understand security control requirements, reviewing current or new system design documentation to understand or plan security control implementation, and specific changes that may impact the system.

• All personnel with privileged access or performing IA roles must maintain certification DoD 8570.01M requirements

Option Year 2-

• Follow plan for continuous monitoring activities (both automated and manual) requiring assessment, analysis, reporting and updates of all applicable security controls and information security-related risk based on SCTM review timelines.

• Facilitate ongoing awareness of threats, vulnerabilities, and information security to support organization risk management decisions.

• Maintain awareness of the DISA STIG update schedule and access on a quarterly basis.

Update IS to address STIG vulnerabilities for items not covered by the Network o Generate the appropriate risk response actions based on analysis from STIG checklist, ACAS, SCAP, EOL items, etc.

o Perform SCAP scans to support manual STIG and STIG benchmark updates based on continuous monitoring strategies.

o Review of monthly ACAS scan results and update IS to address vulnerabilities for items not covered by the Network Enterprise Center.

o Initiate CCB process to plan and execute flaw remediation and patch management tasks o Update Plan of Action & Milestones (PO&AM) with vulnerabilities that are open and/or remediated

• Update body of evidence (BOE) to support assessment activities as part of the continuous monitoring strategies.

• Maintain authorization status of information systems and common controls over time due to changes in mission/business needs, threats, vulnerabilities, and technology upgrades.

• Perform security impact analysis to assess risk in anticipation for future minor/major modifications to the system or its software/applications (e.g. new sensor integration).

Security impact analysis may also include but not limited to reviewing security plans to understand security control requirements, reviewing current or new system design documentation to understand or plan security control implementation, and specific changes that may impact the system.

• All personnel with privileged access or performing IA roles must maintain certification DoD 8570.01M requirements

5.2 Operations and Maintenance

The Remote Ground Terminal requires routine maintenance of hardware and software. This maintenance includes providing support agreements for the RT Logic modem and GATR TRAC antenna within the system. In addition, the RGT requires factory support to provide support for deployed RGT(s). In addition, the RGT requires a Field Service Representative (FSR) at each deployed location. The FSR shall provide operational, onsite support and maintenance for the Remote Ground Terminal at the Government-determined location. The FSR must reside with the deployed system and travel with the system if it deploys on exercises or real-world deployments.

This individual must be a Privileged User with at least one of the certifications under the IAT Level 1 box noted on DoD 8570 as well as certification in Windows and Linux operating systems. The FSR must be fully qualified to operate, demonstrate, maintain and provide training on the RGT system.

Base Year- PoP of 1 Year

• Hardware and software maintenance for deployed and laboratory systems o Maintain the system functionality via troubleshooting of hardware and software problems o Repair hardware as necessary or integrate spare hardware within the RGT o Provide regular software updates to the system as they are released

• The Field Service Representative shall:

o Be a Privileged User o Have and maintain a Top Secret/SCI clearance o Be Fully qualified to operate, demonstrate, maintain, provide training on the system o Reside at the Government-determined location o Responsibilities include, but are not limited to:

Coordinate with gaining Unit to support system and mission operations Provide assistance to users and maintenance personnel for on-site diagnostics and correction of problems/failures which render the system or any of its components inoperative or results in degraded performance

Provide advice and assistance to system users (operators and maintenance personnel) with regard to proper performance, maintenance (scheduled and unscheduled), and operation of the equipment and software

Document all hardware and software problems, failures, analysis, and repair/fixes

• Report immediately to Radiant Factory Support and Government program office

Provide a monthly report detailing all work performed during the month Keep the Officer In Charge at deployed location and Government Program office informed of RGT status o FSR shall travel with the system if it deploys on exercises or real-world deployments as required/directed by the COR If the FSR is not available to support the exercise or deployment, an individual from the factory may travel with system as long as the individual is capable of performing FSR duties

Note: Local exercises are defined as exercises in which the system stays within the local geographic site area allowing the FSR to return home nightly. A deployed exercise requires the FSR to travel out of the site area with the system.

• Factory Support o Must be available during operational hours of the factory with an email and voicemail established for the FSR to message during his/her operational hours.

o Assist personnel located at the Government-determined location with correction of hardware and software problems o The operation of Factory Support may be expanded up to 24 hours/7 days a week in a time of conflict or crisis

• Provide Hardware maintenance for additional RGT components o RT Logic Receiver o GATR TRAC Antenna

• Provide Software Licenses within the RGT

• Maintain RadarSat Ground Station Certification

Additional periods of performance of one year are expected for these tasks to accommodate up to 3 Fielded Remote Ground Terminals, and are to be determined at task order level.

5.3 New Sensor Integration

The Remote Ground Terminal is unique in its scalability; new sensors can be integrated into the software without increasing the hardware footprint. This software is incorporated into the common imagery processing software entire Remote Ground Terminal software suite. This software must be accessible from all functionalities of the Remote Ground Terminal. The software must be fully accessible for Information Assurance and allow for the RGT to retain its Authority to Connect on NIPRnet.

PoP to be determined at task order level and will be based on sensor chosen. Can run concurrently.

• Integrate the new sensor into the common image processor.

o Code must be accessible for IA related activities in order to not jeopardize the current NIPR ATO

• Integrate the sensor into all RGT functionalities including LOKTR, DASH, Feasibility software

• Integrate updated RGT software into deployed RGTs to enable the deployed RGTs to access newly integrated sensor

• Update training materials to reflect new sensor and provide onsite training at deployed

RGT locations

• Incorporate analysis, flaw remediation, and patch management within the CCB. Perform security impact analysis to assess risk in anticipation for future minor/major modifications to the system or its software/applications (e.g. new sensor integration).

Security impact analysis may also include but not limited to reviewing security plans to understand security control requirements, reviewing current or new system design documentation to understand or plan security control implementation, and specific changes that may impact the system.

• Provide licenses and certifications for downlinking new sensor downlinks

Additional periods of performance of varying times are expected for these tasks to accommodate 6 unique sensors and will be determined at task order level.

5.4 Deploy a Remote Ground Terminal

In order to meet operational needs of units around the world, the Army Geospatial Center requires the ability to deploy multiple, field-worthy Remote Ground Terminals. The deployed RGT must include all receive and processing suite hardware and software The deployed RGTs must be supported by existing lab RGT hardware and software, operations and maintenance procedures, and all Information Assurance protocols. Once at the government-determined location, the RGT must be integrated into the sites infrastructure and networks.

PoP to be determined at task order level. Can run concurrently with other Task 3 periods (estimated 10 months)

• Purchase GATR TRAC antenna for integration into the complete system

• Purchase and integrate hardware and software to complete the RGT system

• Deployment of the system o Ship system to Government-determined location o Deploy and standup system at the Government-determined location o Conduct training and provide training materials for new Unit Operators o Integrate RGT into Government-determined location’s site infrastructure and network

• Provide all necessary software licenses for RGT operations

• Certify RGT as a RadarSat-Certified Ground Station

This task may be awarded again for the fielding of an additional, third, Remote Ground Terminal.

5.5 Installation the Relocated RGT

The Remote Ground Terminal is currently deployed at Camp Humphreys, Korea as a pilot deployment in support of the 501st MI Brigade. This system will be moved to a second Government-determined location. The Contractor will need to set up and adapt the equipment to the new location for full functionality. This includes integration of the system into the local site infrastructure and network.

PoP to be determined at task order level (estimated 3 months)

• Set-up the RGT at the Government-determined location for operational use

• Check out the system to ensure system full functionality at Government-determined location

• Integrate the RGT to function on local site architecture and networks

• Conduct training and provide training materials for new Unit Operators

Part 6 Applicable Publications

6. Applicable Publications

6.1 The Contractor must abide by all the applicable regulations, publications, manuals, and local policies and procedures including:

• AR 25-2

• AR 530-1

• DOD 8570.01 M Information Assurance Workforce Improvement Program, Incorporating Change 4, 11/102015

• Department of Defense Directive (DoDD) 8140.01, Cyberspace Workforce Management

DoD Instruction (DoDI) 8510.10, Risk Management Framework (RMF) for DoD Information Technology (IT)

• National Institutes of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev. 4 (or latest final version) National Security and Privacy Controls for Federal Information Systems and Organizations

• NIST SP 800-37 Rev. 1 (or latest final version) Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach

• Federal Information Processing Standards Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems

• Federal Information Processing Standards Publication (FIPS) 200 Minimum Security Requirements for Federal Information and Information Systems

• FAR, DFARS, and AFARS

Part 7 Attachment List

7. Attachment List:

7.1 Performance Requirements Summary

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

More information to follow with formal solicitation.

Performance Requirement

Standard Acceptable Quality Level

Method of Surveillance

Project Management Kickoff Meeting and Project Plan

Project Plan Acceptance

95% USACE Project Manager and COR review

Biannual Program Management Review

Meeting minutes and technical documents

95% USACE Project Manager and COR review

IA Package- RMF and

BOE

Technical documents acceptance

95% USACE Project Manager and COR review

RADARSAT-2 Station Certification

Completion of

RADARSAT-2

Certification Course

95% USACE Project Manager and COR review. Customer feedback

Technical documentation reviews

Technical documents acceptance

95% USACE Project Manager and COR review. Customer feedback

Monthly Project Status Reports Meetings

Meetings held monthly

95% USACE Project Manager and COR review

Factory Acceptance Test Successful, functional demonstration

95% USACE Project Manager and COR review. Customer feedback

SCA Testing Activities Support

RFT C&A Process 95% USACE Project Manager and COR review

Operational Test Successful, functional demonstration

95% Customer feedback

System Deployment Check out

Successful, functional demonstration

95% Customer feedback

Orbit Logic CPS Software Delivery and integration of Orbit Logic CPS Software License

100% USACE Project Manager and COR review and functionality testing

Software Licenses Delivery of software licenses

100% USACE Project Manager and COR review and functionality testing

Safety Assessment Report Technical documents assessment

95% USACE Project Manager and COR review- CDRL A309

RGT at Government-determined Location

System test and check out

100% USACE Project Manager and COR review and functionality testing- CDRL A306

STIG Scan Checklists STIG Checklists and Reports Quarterly

100% USACE Project Manager, COR Review, and ISSO/Government IA Expert Review

SCAP SCANS SCAP Scan results quarterly

100% USACE Project Manager, COR Review, and ISSO/Government IA Expert Review

CDRL Schedule

Deliverable Technical and Management Work Plan

Contractor Progress, Status, and Management Report

Maintenance Support Plan

Training Materials

Acceptance Test Plan

Acceptance Test Report

DoD Architecture Framework Documentation

Equipment Technical Manuals

System Manuals

Training Materials

System Check Out Test Plan

System Check Out Test Report

DoD RMF Package Deliverables