PEO IWS 4.0 RFI Questionnaire.docx

Request For Information Questionnaire PEO IWS 4.0 and PEO IWS X envision eight (8) main areas that industry can provide value to the Government:

1. Requirements Derivation and Document Processes

2. Software Development Capabilities

3. Hardware Design Capabilities

4. Hardware Production Capabilities

5. Solution Design and Integration

6. Verification Events/Testing

7. Logistics

8. Solution Design Interests and Limitations

The Government does not expect a single vendor to fulfill the entirety of the scope of these elements. Companies may choose to respond to one or more areas or subareas. PEO IWS 4.0 acknowledges that there are parts of this RFI that are for Navy-specific requirements and could be difficult for many companies/vendors to address. There will be fact-of-life limitations on some requirements in the NGS 3 Program. Our goal is to abstract those areas to the maximum extent practicable so that we can collaborate with more companies looking to provide value.

For the following sections, provide inputs on how your company can provide services or products to fulfill the NGS 3 program requirements.

1. Requirements Derivation, Documentation Development, and SE Process

a) Requirements Derivation and Traceability

i. Requirements generation and derivation from top level down to verifiable requirements

ii. Generation of a Requirements Verification Traceability Matrix (RVTM)

b) Classified Technical Documentation Development

i. Development and Configuration Management (CM) of documentation at the SECRET//NOFORN level

ii. Development of Anti-Tamper (AT) Plans to include Concept, Initial and Final deliverables

iii. Development of supplemental documentation/artifacts as required for AT Plan development (i.e. Containerization, Attack/Countermeasure Trees (ACMT), Key Management Plan (KMP))

iv. Development of Verification Plans IAW the Verification Plan template

c) Metrics

i. Tracking and reporting of metrics with regards to cost, schedule, and contract performance to facilitate required government oversight

d) Configuration Management, Data Management, HW/SW Governance and Change Control

i. Retaining, controlling, and disseminating classified information as lawfully required for the period of performance

ii. Implementation and use of a defined engineering change proposal (ECP) or similar engineering rigor process that includes retaining artifacts of engineering decisions

iii. Use of CM applications to store and manage models and/or requirements

1. Examples would be DOORS or Cameo

iv. Use of CM methods to retain and manage key material IAW a programs KMP

2. Software Development Capabilities

a) Development

i. Use of Git or similar tools to perform version control of developed software

ii. Development of software intended to be used in a Linux environment

iii. Use of Agile software development methodologies to break down required work and communicate progress

iv. Use of software assurance tools and adherence to secure coding practices to limit vulnerabilities in software

b) Test

i. Development of tests at the system to unit level to prove functionality and requirement compliance

ii. Development of test harnesses or similar tools to facilitate testing in a variety of configurations

iii. Development and communication of a testing schedule to ensure contract performance

iv. Performance of tests to verify requirements during a formal verification event

c) Embedded

i. Development and deployment of software intended to be used on embedded systems

ii. Development of software with constrained SWaP-C space considerations

d) Linux Kernel

i. Building or Re-building Linux Kernel Modules (LKMs) or Linux Kernels as needed for the intended solution

ii. Device drivers and other tools that run at various stages of the linux boot process

e) Software Release and Maintenance

i. Experience tracking and managing SW asset licenses across multiple software releases and installation cycles

ii. Management of software releases to program office specified entities

iii. Tracking of software releases and related artifacts

iv. Managing software release constraints and schedules

v. Signing software to ensure software integrity for fielding

f) Software Deployment

i. Coordinating with other vendors and contractors to deploy software to air-gapped networks or forward deployed assets

ii. Coordinating with other vendors and contractors to support the integrations and test of software as part of an overall solution

3. Hardware Design Capabilities

a) Product Design

i. Integration of IP from various suppliers to achieve a desired security posture

ii. Experience with integrating FPGA and ASIC based complexes with the intent to interface with an x86 compute node

iii. Experience with the Open Compute Project and general design with the intent to be modular and interchangeable

b) Secure Hardware:

i. Hardware design intended to detect or impede reverse engineering efforts

ii. Experience performing failure analysis on HW solutions down to the component level

iii. Experience providing support for hardware fingerprinting or similar efforts to ensure product integrity

iv. Experience adapting commercially available security components to best fit with government requirements

c) Product Support

i. Experience providing product support to government and/or commercial customers

ii. Utilization of industry best practices and tools to meet or exceed cost, schedule and performance requirements

iii. Tools used to efficiently manage product support through configuration management, inventory, coordination, data-sharing, and planning

iv. Identify key metrics to monitor Product Support outcomes against system requirements, and minimize risk given limited available resources

v. Experience with lifetime support and strategic approaches that reduce the demand for product support throughout a products lifecycle

vi. Experience with dynamic resource allocation necessary for timely product support

d) Production of equipment, electronic assemblies/sub-assemblies

i. Capacity to provide short-term production in any of these technological areas discussed

ii. Discuss ideas on increasing small business and non-traditional involvement in the production phase

iii. Experience overcoming challenges encountered in coordinating deliveries with the Government and/or other supporting vendors

4. Hardware Production Capabilities

a) Form Factors

i. Experience producing and adapting hardware designs to other form factors with a focus on 19” rack servers as well as 3U and 6U VPX cards

ii. Experience working with government and contractor personnel to identify and specify SWaP-C constraints and needs

b) Government Specific Needs

i. Use of trusted foundries and trusted suppliers to ensure provenance of parts used in fielded and test equipment

ii. Experience with building and testing to government shock and vibe standards

5. Solution Design and Integration

a) Solution Design:

i. Experience designing solutions IAW with DoDi 5200.39 and DoDi 5200.47e

ii. As possible provide examples of previously designed and released solutions

iii. Experience integrating AT solutions within a Linux based IaaS or PaaS architecture

iv. Experience coordinating with Government organizations and third-party vendors to evaluate design progress and viability

v. Integrating HW/SW solutions across multiple vendors to assemble a final product that meets cost, schedule and protection requirements

vi. Experience in building and maintaining the appropriate secure environment/facilities to support the classified integration of systems

6. Verification Events (Component, Subsystem, and System Verification and Validation)

a) Systems Integration and Testing

i. Experience working with a Technical Direction Authority (TDA) and Design Agent (DA)

ii. Experience working with companies providing Government Furnished Equipment (GFE) in the forms of hardware and software

iii. Experience in building and maintaining the appropriate secure environment/facilities to support the classified test of systems

iv. Experience creating and adjudicating Test Observation Reports (TORs) at the unclassified level or higher

v. Experience hosting and coordinating test events required for verification and validation of AT solutions

vi. Experience performing Formal Verification witnessed by the Naval Anti-Tamper Verification Team (NATIVT)

7. Logistics

a) Diminishing Manufacturing Sources and Material Shortages (DMSMS)

i. What current activities does your company carry out to track hardware DMSMS and obsolescence issues and successfully mitigate the associated supply chain impacts?

ii. Provide current activities used to track HW DMSMS and obsolescence issues and mitigations to supply chain impacts

1. Capable of Monitoring and Forecasting DMSMS risks for COTS Hardware.

2. Capable of actively monitoring and assessing supply chain to ensure in-time availability, quality, affordability, and specifications compliance for all COTS Hardware within imposed sourcing constraints.

b) Life Cycle Maintenance/Logistics Support

i. Experience in planning, management, and coordination of a logistics program that encompasses tracking of Line Replaceable Units (LRUs), failure analysis and remediation down to the component level, creating ECPs with regard to DMSMS risks.

c) Domestic Sourcing/Export Control

i. The Navy anticipates that some of the technology/technical data may be restricted from disclosure based on export control. Domestic sourcing restrictions may also be implicated. The Navy requests that respondents address these areas with respect to the capability they offer. In particular, and for example, respondents shall explain anticipated compliance with “DFARS 252.225-7007 Prohibition on Acquisition of Certain Items from Communist Chinese Military Companies” if their capabilities fall within the export control jurisdiction and classification described in that clause.

8. Solution Design Interests and Limitations

a) All or part of this solution and the technologies used will be classified please request an SCG from the PoC listed in the Classified Responses and Exchanges section

i. If a non-traditional defense contractor, why haven’t you bid on DoD Production efforts in the past?

b) For first time defense contract bidders additional company background and information is appreciated

c) Please provide any products in IRAD that may fulfill all or part of the needs listed here or expressed at the classified information session

d) For any applicable products of interest please provide the licensing models used or available

e) For the purposes of this design the program is interested in technologies that will enable the following:

i. Secure startup and shut down

ii. Secure data at rest

iii. Secured runtime of software

iv. Distributed Architecture

v. Technologies both HW and SW that implement or facilitate the AT Open Mission System (OMS) ICD

vi. Technologies that enable above to be integrated seamlessly with IaaS and PaaS environments

f) Please include TRL levels and schedules for any provided products

g) Capacity to provide representative units where possible is of interest