SOW_OASD_JFAC_SwA_Tools_Code081418.pdf

Statement of Work (SOW) Office of Deputy Assistant Secretary of Defense (Systems Engineering) (OASD(SE))

Joint Federated Assurance Center (JFAC) CodeDx Enterprise Software

18 January 2018

1. Background: ODASD(SE) leads the JFAC, an initiative chartered by Department of the

Secretary of Defense and required by National Defense Authorization Act (NDAA) 2014 section 937. The JFAC is a federation of Department of Defense (DoD) organizations that have a shared interest in promoting software and hardware assurance in defense programs, systems, and supporting activities. The JFAC member organizations and their technical service providers work with defense acquisition program offices and other interested parties to provide software and hardware assurance expertise and support, to include vulnerability assessment, detection, analysis, and remediation services, and information about emerging threats and capabilities, software and hardware assessment tools and services, and best practices.

2. Scope: ODASD(SE) and JFAC requires software tools to support systems security engineering processes in acquisition and engineering development of software generated or used in DoD systems, including weapons systems. Specifically, these tools are needed to detect and help remediate vulnerabilities, weaknesses, and defects throughout the software development life cycle, in sustainment, and in operations. The Contractor shall provide software on a Brand Name or Equal basis to the items listed in the Bill of Materials.

3. Bill Of Materials: CodeDx Enterprise Software

Item Part number Description Unit Measure License Type Term

Length (Months)

Quantity

1 CDX-SRVR CodeDx Enterprise Software Server License

1 Software Server License

Term 12 15

2 CDX-E-250P CodeDx Enterprise Bundle for up to 250 Projects

250 Projects Term 12 1

3 CDX-E-25U CodeDx Enterprise for up to 25 Users

25 Users Term 12 1

a. All licenses and license keys shall be fully transferable within the DoD without requiring intervention from the vendor. The DoD assumes responsibility for limiting the number of active licenses to the total number purchased and will provide quarterly reports of the total number of licenses in active use.

b. Vendor will make available guidance and training material for installation, use, operation, and reports produced by its tools, preferably via the JFAC website.

c. Licenses distributed to classified software systems, classified programs, or classified organizations, including software installation, configuration, operation, findings, reporting, auditing, and all related tool and remediation metadata will not be provided in order to increase national security and prevent adversaries from obtaining information that can be used to breach our systems. A proxy will be established for point of contact and helpdesk support.

4. Applicable Documents

In the event of a conflict between the Applicable Documents and instructions in this SOW, the Contractor shall immediately contact the Contracting Officer Representative (COR) for resolution.

a. Department of Defense

i. NSTISSI No.7003, PROTECTIVE DISTRIBUTION SYSTEMS (PDS), 13 December 1996.

ii. DISA Internet Protocol Telephony & Voice over Internet Protocol, Security Technical Implementation Guide, ver. 2, rel. 2.

iii. DISA Video Tele-Conference, Security Technical Implementation, Guide ver. 1, rel. 1.

iv. Defense Information Systems Agency DISN Connection Process Guide.

v. USAISEC Installation Information Infrastructure Modernization Program (I3MP)

Guide for Facilities Requirements of Core Communications Nodes.

vi. USAISEC Technical Guide for Installation Information Infrastructure

Architecture.

vii. Department of Defense Unified Capabilities Requirements 2008 (UCR 2008), Section 5.3.3.

viii. MIL-STD-188-124B, Grounding, Bonding and Shielding for Common Long

Haul/Tactical Communication Systems including Ground Based Communications-Electronics Facilities and Equipments.

ix. MIL-HDBK-419A, Grounding, Bonding and Shielding for Electronic Equipment and Facilities.

b. Federal

i. 29 CFR Part 1910, Occupational Safety and Health Standards

c. Industry

i. NFPA 70, National Electrical Code (NEC), 2008 Edition.

ii. IEEE C2-2007, National Electrical Safety Code

iii. ANSI/TIA/EIA-569A, Commercial Building Standard for Telecommunications

Building Wiring Standards

iv. TIA/EIA-568B and C series Commercial Building Cabling Standards

v. EIA/TIA-606-A, Administration Standard for Commercial Telecommunications

Infrastructure.

vi. NSTISSAM TEMPEST 2/95A, 3 Feb 00.

5. Security Requirements

a. Antiterrorism (AT) Level I Training. All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities, controlled access areas, or require network access, shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. Upon request, the contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website: http://jko.jten.mil/courses/atl1/launch.html.

b. iWATCH Training. The Contractor and all associated subcontractors shall brief all employees on the USACE iWATCH program. This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 days of new employees commencing performance on the contract. The Contractor shall provide certification of completion to the COR within 10 days of training completion. Training documents will be provided by the Security Office.

c. Operations Security (OPSEC) Training. All new contractor employees will complete Level

I OPSEC Training within 30 calendar days of their reporting for duty. Additionally, all contractor employees must complete annual OPSEC awareness training. The contractor shall submit certificates of completion for each affected contractor and subcontractor employee, to the COR within 5 calendar days after completion of training.

d. Information Assurance (IA) / Information Technology (IT) Training. All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter.

e. Information Assurance (IA)/Information Technology (IT) Training Certification. All

Contractor employees supporting IA/IT functions shall be appropriately certified upon contract award IAW DoD 8570.01-M, DFARS 252.239-7001 and AR 25-2. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

f. Handling/Access to Classified Information. The Contractor shall comply with AR 380-67 (Personnel Security Program) and Homeland Security Presidential Directive 12 (Policy for a Common Identification Standard for Federal Employees and Contractors) as well as FAR 52.204-2, Security Requirements.

6. Delivery and Performance:

a. Period of Performance: 12 months starting from date of award

b. Delivery: Delivery and installation required as soon as possible, but not more than 30 days. The government will neither pay, nor authorize payment for expedited delivery. Electronic delivery is acceptable. Physical media or hardcopy licenses may be shipped to the address below.

http://jko.jten.mil/courses/atl1/launch.html

c. Delivery address:

Office of the Assistant Secretary of Defense Joint Federal Assistance Center (Thomas Hurt) 4800 Mark Center Drive, Suite 16E-08 Alexandria, VA 22350-3600

Email:

7. Government POCs: Any questions about this order should be directed to the Government

Points of Contact listed below:

a. Delivery:

Thomas (Tom) Hurt

b. Project Manager:

Chris Harvel Phone: 256-895-7011 Email: Christopher.A.Harvel@usace.army.mil

c. Contracting Officer:

8. Invoicing Instructions & Release of Claims: The Contractor shall provide invoices in accordance with FAR 32.905(b). Electronic invoice submissions must be created in black and white and in Adobe’s Portable Document Format (PDF) and comply with the requirements specified within this contract. At a minimum, invoices will contain the following elements:

• Name and address of the contractor (Note: Differences between the remittance address on the invoice and the data on record in the System for Award Management (SAM) can potentially cause delays in payment. Please verify these data agree exactly.)

• Invoice date and number

• Entire Contract number, contract line item number, the order number and modification number as applicable.

• Description, quantity, unit of measure, unit price and extended price of the item delivered. Item description must match those contained in the purchase order/contract description.

• Delivery tracking information to include tracking number and name of the person accepting delivery.

• In cases where there is no physical delivery, please include all email correspondence to the electronic delivery POC (the customer) when the product becomes available for download or is renewed in accordance with the statement of work. Read receipts may help substantiate electronic delivery.

• Name and address of official to whom payment will be sent mailto:Christopher.A.Harvel@usace.army.mil

All invoices for this contract action shall be emailed to the following locations for processing:

• ITS_CIS_INVOICES@usace.army.mil

• christopher.a.harvel@usace.army.mil (Acquisition PM)

Final invoices with respect to a specific contract/delivery order/task order shall be clearly marked “FINAL” and submitted within 45 days after period of performance end date specified in contract. NOTE – In some cases the first invoice may also be the final invoice.

Release of Claims: A Release of Claims shall accompany a final invoice. The Release of Claims shall be signed, include the final Purchase Order/Contract/Task Order amount. The Release of Claims template is attached and is available upon request from the Acquisition PM.

Payment Processing will begin: 1) after the Government accepts delivery of the supplies and/or services being billed, 2) receipt of invoice in accordance with these instructions and 3) a release of claims (with the final invoice).

NOTE - The acquisition PM is responsible for determining the acceptability of the invoice and annotating the Government’s official “received” date. The received date is used on occasions where interest must be calculated for late payment. Deficient invoice submissions will be rejected.

mailto:ITS_CIS_INVOICES@usace.army.mil mailto:christopher.a.harvel@usace.army.mil