Performance Work Statement (PWS).pdf

Performance Work Statement (PWS) Development, Operation, Major Event Support and Maintenance of Roll-On-Roll-Off (RORO) Processing, Exploitation and Dissemination (PED) System in support of Networking and Communications in Contested and Austere Environments

21 March 2022

C.1 BACKGROUND

The Computational and Information Sciences Directorate (CISD) at the Army Research Laboratory (ARL) requires end-to-end research and development (R&D) services for the continued development, operation, major event support, and maintenance of a Roll-On-Roll-Off (RORO) Processing, Exploitation and Dissemination (PED) tactical edge processing system. The RORO system is designed for use in contested and austere environments, Artificial Intelligence/Machine Learning (AI/ML) at the tactical edge, and component support within the context of larger technology events. In its current implementation, RORO consists of three (3) physical servers running VMware’s vSphere virtualized environment connected by a network switch and managed using a system control laptop.

RORO’s original design is flexible, versatile, and modular.

C.2 OBJECTIVE

ARL has a need to support Artificial Intelligence / Machine Learning (AI/ML) capabilities; enhanced data collection support to include contextual data surrounding an event; support for Major Events; and to have the RORO system operated and maintained on an ongoing basis at Army Research Labs in Adelphi, MD and thereby advance the state-of-the-art in deployable PED systems at the tactical edge in networking and communications in contested and austere environments. In addition, ARL needs to provide support to emerging technologies that ARL intends to showcase at technology events. Emerging technology support includes hosting capabilities on RORO, network design and support, and cybersecurity support.

C.3 REQUIREMENT

The Contractor shall provide the research and development services necessary to develop solutions to the current requirements for AI/ML and event data context; support the RORO system and ARL emerging technologies at Major Events in the US and abroad; and support and maintain the RORO system as an operational PED testbed at ARL in Adelphi, MD. Support for Major Events is highly concentrated at specific times of the year, and includes pre-event preparation, event support, and post-event support activities. In addition, the system is required to be operated and maintained consistently over time in terms of both hardware and software updates and upgrades, including vendor firmware updates and software and operating system patches. System security (Cybersecurity) support is also required.

C.3.1 Artificial Intelligence Strategic Challenge (AISC) Major Event Support, (CLIN 0001)

C.3.1.1 The Contractor shall support Artificial Intelligence Strategic Challenge (AISC) and exercises across the United States and in coalition partner countries. [AISC is a follow-on initiative that builds upon the Contested Urban Environment (CUE) initiative from 2017-2021.] These activities can be as simple as conducting field testing for a particular sensor in a specific environment or as complex as participating in a coalition exercise with multiple sensor packages and multiple system interfaces with coalition partners. The Contractor shall provide onsite operation and support of the RORO system, including but not limited to pre-event preparations, onsite event support, and post-event support activities.

C.3.1.2 Pre-event support provided by the Contractor may include, but is not limited to, integration of the supported technology demonstration or exercise system on the RORO platform, including virtual machine creation, software installation, configuration, testing, documentation, and system pack-up for transport to the event location. RORO system routing and switching configurations may also be tailored to individual research programs on an as-needed basis, with services provided either pre-event or onsite depending on event requirements. Pre-event cybersecurity support for RORO and ARL emerging technologies may include, but is not limited to, system configuration, system scans, and associated documentation to meet Risk Management Framework (RMF) requirements for participation in a technology event. Pre-event data collection support may include, but is not limited to, coordinating with participating technologies to develop a data collection plan and defining a data collection strategy for the event, including specification of hardware/software/services that may be required. Pre-event support also includes attendance/participation in meetings and conference calls related to the event.

C.3.1.3 The Contractor shall provide onsite event support including system administration support for the RORO system at the event. This generally includes onsite networking configuration and support, RORO system administration, end user support, on-demand re-configuration and deployment of virtual machines to support event requirements, and similar functions. The Contractor shall also provide support for collecting data, including tactical data and network data, as required by the COR for each event.

C.3.1.4 The Contractor shall provide post-event support including archiving of virtual machines and system configurations, data copying and distribution, RORO pack-up for transport back to ARL, re-configuring RORO for ARL analyst use at ARL, and configuration of RORO for exploitation of acquired data. The Contractor shall also provide support for archiving data collected at the event as well as distribution of the data to appropriate parties at the discretion/approval of the COR.

C.3.1.5 The Contractor shall be required to travel to and from locations in the US and abroad to provide onsite support.

C.3.1.6 To the maximum possible extent, the Contractor shall provide electronic media over existing secure high bandwidth or other secure communications links rather than by Contractor travel. When travel between the Contractor’s facility, ARL and various CONUS locations are required, the Contractor shall ensure that all travel is performed in accordance with the Joint Travel Regulations (JTR). The Contractor shall request approval for travel from the COR in writing four (4) weeks prior to scheduling the travel arrangements. The COR will provide approval in writing within two (2) weeks after receipt of the travel request.

C.3.1.7 The Contractor shall document the results of C.3.1 within the monthly report (reference section C.4.2).

C.3.2 RORO System Development, Operation, Maintenance, Other Technology Events, (CLIN 0002)

C.3.2.1 RORO System Development

C.3.2.1.1 The Contractor shall develop additional capabilities and enhancements to advance the state-of-the-art in tactical edge information processing systems. In particular, the RORO system development shall focus on implementing Artificial Intelligence / Machine Learning (AI/ML) capabilities and developing and implementing a methodology for capturing the context of an exercise surrounding particular data sets (the Data Context capability).

C.3.2.1.2 For AI/ML, the Contractor shall work with ARL research programs that develop AI/ML algorithms to modify the RORO hardware and software environment to implement AI/ML algorithms on live and/or archived data sets and evaluate the performance and utility of such implementations in a tactical edge environment. This effort may require the reconfiguration of the RORO environment, implementation of new software and hardware, testing for functional capability, and evaluation of the resulting capability.

C.3.2.1.3 For development of the Data Context capability, the Contractor shall work with other contractors supporting ARL to identify solutions to capturing a more complete context for data captured at a Major Event or other technology event. The goal of this development effort is to provide post-event context for the utilization of data captured at an event.

C.3.2.2 Operations Support

C.3.2.2.1 The Contractor shall provide ongoing operational support for the RORO system. Operational support requirements include the instantiation, operation, and support of ARL Research Program software and applications within the RORO system.

C.3.2.2.2 The Contractor shall modify the baseline RORO configuration to create new virtual machines as required by the COR to meet requirements of specified research programs on an as-needed basis. The Contractor shall document and backup each new virtual machine and restore the baseline lab to the original configuration upon completion of an event or exercise.

C.3.2.2.3 The Contractor shall support the RORO platform in the laboratory environment at ARL offices in Adelphi, MD. Typical examples of supported activities include configuration of RORO to support an ARL Program for laboratory testing in a PED environment and configuration of RORO as an analyst PED to exploit data collected at an event or exercise (whether collected on RORO or provided by third party). In support of these activities, the Contractor shall provide onsite operation and support of the RORO system, including but not limited to, system configuration, system administration, networking, data management, and related support activities.

C.3.2.2.4 The Contractor shall provide testing support including integration of the supported ARL Program system on the RORO platform, including but not limited to, virtual machine creation, software installation, configuration, testing, and documentation. The Contractor shall support tailoring RORO system routing and switching configurations for individual research programs on an as-needed basis.

C.3.2.2.5 The Contractor shall provide system administration and networking support including onsite networking configuration and support, RORO system administration, end user support, on-demand re-configuration and deployment of virtual machines to support event requirements, and similar functions. The Contractor shall provide backups of system and network configurations as well as the ARL Program virtual machines as required by individual programs.

C.3.2.2.6 The Contractor shall provide data management support including deploying data sets in the RORO environment and configuring access for virtual machines. The Contractor shall back up smaller data sets where storage capacity is available.

C.3.2.2.7 The Contractor shall create or update, as applicable, a test plan for the hardware, software, and network configurations of the RORO system. The Contractor shall ensure the test plan validates network connectivity, data throughput, and functionality of each configuration individually and as a whole. The Contractor shall conduct network testing in accordance with the COR approved test plan and document the results within a RORO Configuration Test Results Document. The Contractor shall provide the test plan and the RORO Configuration Test Results Document to the COR no later than (2) weeks prior to the end of contract PoP.

C.3.2.3 Maintenance Requirements

The RORO system comprises of both hardware and software, both of which shall be supported and maintained by the Contractor. In addition, the documentation package for RORO shall be maintained and updated to reflect changes and enhancements to the system. The contractor shall provide backups which are also a required function of system maintenance support, including the baseline infrastructure as well as the ARL Program virtual machine library.

C.3.2.3.1 The Contractor shall provide ongoing maintenance activities on all configurations and virtual environments, including identification and implementation of updates and patches for operating systems and applications, to ensure the configurations and virtual environments remain fully functional. The Contractor shall provide similar maintenance and update support for hosted systems (virtual machines) at the discretion of the COR.

The Contractor shall create or update, as applicable, a System Update Plan for each hardware and Operating System (OS) infrastructure to include all recommended updates, patches and upgrades for the operating systems and applications to remain fully functional. The Contractor shall check for any updates, patches, and upgrades on a monthly basis for all virtualization environments and update (and provide to the COR) the Systems Update Plan accordingly. The COR will review the Systems Update Plans within five (5) business days of receipt. Upon COR approval of each Systems Update Plan, the Contractor shall implement each Systems Update Plan to ensure all configurations and virtual environments remain fully functional. The Contractor shall deliver a finalized System Update Plan and Log to the COR no later than (2) weeks prior to the end of contract POP.

C.3.2.3.2 The Contractor shall create and maintain, as applicable, the documentation for the configured network system (physical network configuration, operating systems, virtualization environment, system capabilities, etc.). At a minimum, system documentation includes: Network Diagram, System Description Document, and Network Configuration documentation.

C.3.2.4 Backup and Recovery Requirements

C.3.2.4.1 The Contractor shall conduct separate backup and recovery processes for the following systems: base machine infrastructure, network configuration, and research program-specific virtual machines. The Contractor shall backup server and host system configurations consisting of the base operating systems and virtualization environment as configuration files and virtual machine images to external media to enable recovery from system crashes due to localized hardware failures and all similar causes. The Contractor shall enable rapid recovery by also saving the network hardware configuration files along with the testbed images.

C.3.2.4.2 The Contractor shall create backups for virtual machines on an as-required basis for supported research programs. The backups shall be stored either on the RORO system or exported to external media depending on supported research program requirements.

C.3.2.4.3 The Contractor shall create and maintain, as applicable, a Backup Services Plan detailing the recommended backup services, maintenance of system images, and system configuration files and provide this to the COR as the maintenance is required. The COR will review and approve within five (5) business days of receipt.

Upon approval, the Contractor shall implement the Backup Services Plan. The Contractor shall also document efforts of routine backup services within a Backup Services Log. The Contractor shall deliver the final Backup Services Plan and Backup Services Log to the COR no later than no later than (2) weeks prior to the end of contract PoPC.3.2.4.4 The Contractor shall create and maintain, as applicable, a separate Backup Test Plan and Results Document reporting all tests performed on backup up and recovery efforts and the subsequent results. The COR will review and approve within five (5) business days of receipt. Upon approval, the Contractor shall implement the Backup Test Plan. The Contractor shall deliver the final Backup Test Plan and Results Document no later than (2) weeks prior to the end of the contract PoP.

C.3.2.5 Cybersecurity and Risk Management Framework (RMF) Requirements

C.3.2.5.1 The Contractor shall maintain a network perimeter security appliance in order to provide a more robust perimeter defense architecture to ensure that communications and data sharing with external networks is well-controlled and limits the exposure of internal systems to adverse events originating from outside the RORO network.

C.3.2.5.2 The Contractor shall provide all required cybersecurity and RMF services to meet security requirements for securing the RORO system and specific configurations associated with research programs as specified by the COR. The Contractor shall provide security configuration information and implementation as required by the COR for specific research programs to test and prepare for deployment, or to research the impact of RMF configuration requirements on the functionality of their systems. The Contractor shall create and maintain, as applicable, an RMF Documentation Package for the RORO system and infrastructure and deliver the RMF Documentation Package to the COR (2) weeks prior to the end of the contract PoP.

C.3.2.6 Other Technology Events

C.3.2.6.1 The Contractor shall attend and support Technology Events and exercises across the United States and in coalition partner countries as required by the COR. The Contractor shall provide onsite operation and support of the RORO system, including but not limited to, pre-event preparations, onsite event support, and post-event support activities.

C.3.2.6.2 The Contractor shall be required to travel to and from locations in the US and abroad to provide onsite support. The Contractor shall ensure that all travel is performed in accordance with the Joint Travel Regulations (JTR). The Contractor shall request approval for travel from the COR in writing four (4) weeks prior to scheduling the travel arrangements. The COR will provide approval in writing within two (2) weeks after receipt of the travel request.

C.3.2.6.3 The Contractor shall document the results of C.3.2 within the monthly report (reference section C.4.2).

C.3.2.7 Period of Performance

C.3.2.7.1 The Period of Performance (PoP) shall be for one (1) base year of 12-months and two (2), 12-month option years. The four (4) major events shall each have a two (2) month PoP.

C.3.3 OPTIONS

C.3.3.1 RORO Development, Operation, Maintenance, Other Technology Events (Time & Materials (T&M) Type of Contract)

C.3.3.1.1 RORO Development, Operation, Maintenance, Other Technology Events, Option 1, The Contractor shall execute the requirements identified in Section 3.2 for the period of one (1) year.

C.3.3.1.2 RORO Development, Operation, Maintenance, Other Technology Events, Option 2, The Contractor shall execute the requirements identified in Section 3.2 for the period of one (1) year.

C.3.3.2 Major Event Support (Firm Fixed-Price (FFP) Type of Contract)

C.3.3.2.1 Major Event Support 2022, The Contractor shall execute the requirements identified in Section 3.1.

C.3.3.2.2 Major Event Support 2023, The Contractor shall execute the requirements identified in Section 3.1.

C.3.3.2.3 Major Event Support 2024, The Contractor shall execute the requirements identified in Section 3.1.

C.3.3.2.4 Major Event Support 2024, The Contractor shall execute the requirements identified in Section 3.1.

C.4 DELIVERABLES

The Contractor shall ensure all data deliverables are provided in accordance with the DD Form 1423 attached in Section J of the contract.

Milestone/Deliverable PWS Reference Due Date Project Plan C.4.1 No later than ten (10) days after contract award (ACA) System Update Plan and Log C.3.2.3.2 No later than (2) weeks prior to the end of contract POP Network Diagram, System Description Document, Network Documentation

C.3.2.3.3 No later than five (5) Months ACA

RORO Configuration Test Plan and Results Document

C.3.2.2.7 No later than (12) twelve Months ACA

Backup Services Plan and Log C.3.2.4.3 No later than (12) twelve Months ACA Backup Test Plan and Results Document

C.3.2.4.4 No later than (12) twelve Months ACA

RMF Documentation Package C.3.2.5.2 No later than (12) twelve Months ACA Monthly Status Report C.4.2 No later than the 10th day of each month

ACA

Final Report C.4.3 No later than two (2) weeks prior to the end of contract POP

C.4.1 Project Plan The Contractor shall establish a project plan for the effort. The Contractor shall ensure the project plan includes all major milestones and project tasks, as well as any deliverables and critical path elements. The Contractor shall also ensure the project plan and any subsequent updates are formatted in Microsoft Project. The Contractor shall provide the initial project plan to the Contracting Officer’s Representative (COR) no later than ten (10) days after contract award. The COR will review and approve the initial project plan within one (1) week of receipt. Subsequent updates to the project plan shall be provided on a monthly basis due at the tenth (10th) of each month.

C.4.2 Monthly Status Reports The Contractor shall deliver the monthly status reports via secure communications to the COR on the tenth (10th) day of each month after contract award. The Contractor shall provide monthly status reports summarizing current program accomplishments measured against the tasks outlined previously, identification and summary of any unresolved problems, incurred costs, meetings attended, planned activities for the next month, issues, and recommendations. The Contractor shall ensure the monthly report includes a spending plan for the period of performance; actual expenditures to date; actual expenditures for the month just ended; and monthly and cumulative variation of actual expenditures from the planned expenditures. The Contractor shall include in the spending plan all costs to include labor, overhead expenses, description (to include cost and results obtained) of each trip taken in the previous month, and fees. The Contractor shall also include all updates and changes to the project plan (reference C.4.1) in the monthly status reports. The Contractor shall include detailed copies of all invoices submitted to date for payment. The Contractor shall ensure each invoice details the labor categories, labor rates, labor hours, and all Other Direct Costs (ODCs). The Contractor shall also answer the following questions within the monthly reports:

Is the job progressing on schedule?

What is the percent of completion?

What is the dollar value completed?

What is the total number of contract employees currently on contract?

What is the total number of new employees placed on contract this month?

Was Contractor Manpower Reporting (CMR) performed during the monthly reporting period? If so, what information was entered?

What are names of the Contractor personnel, who are/were deployed during the period covered by this monthly report?

C.4.3 Final Report The Contractor shall deliver a final report summarizing all efforts performed under this contract to include the hardware configuration, software configuration, network design and configuration, testing and results, backup, recovery, as well as any supporting documentation for all of the components of the system. The Contractor shall deliver the final report to the COR no later than two (2) weeks prior to the end of the contract’s period of performance (POP). The COR will review and approve the final report within one (1) week of receipt. Upon approval, the Contractor shall deliver a revised final report to include any required revisions and comments per the COR. The Contractor shall ensure the revised final report is delivered prior to the end of the contract’s POP.

C.5 SECURITY REQUIREMENTS

The Contractor must be able to work at the SECRET level. Therefore, the Contractor must have access to existing secure facilities, storage, and communication capabilities for contract award. A DD254 will be incorporated into the contract when access to sensitive or classified data is required.

C.6 ANTI-TERRORISM OPERATIONAL SECURITY (AT-OPSEC) REQUIREMENTS

AT Level I training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: http://jko.jten.mil

Access and general protection/security policy and procedures. This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area. Contractor and all associated sub-contractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204- 9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

For contractors requiring Common Access Card (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

AT Awareness Training for Contractor Personnel Traveling Overseas. This standard language required US based contractor employees and associated sub-contractor employees to make available and to receive government provided area of responsibility (AOR) specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact.

Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems. All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the IS and then annually thereafter.

For contracts that require a formal OPSEC program. The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander. In addition, the contractor shall have an identified certified Level II OPSEC coordinator per AR 530-1.

For contracts that require OPSEC Training. Per AR 530-1 Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

For information assurance (IA)/information technology (IT) training. All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six months of appointment to IA/IT functions.

For information assurance (IA)/information technology (IT) certification. Per DoD 8570.01-M , DFARS

252.239.7001 and AR 25-2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

For Contract Requiring Performance or Delivery in a Foreign Country, DFARS Clause 252.225-7043, Antiterrorism/Force Protection for Defense Contractors Outside the US. The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non-contingency support. The key AT requirement is for non-local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor’s compliance with combatant commander and subordinate task force commander policies and directives.

For contracts that require handling or access to classified information. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with— (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); (2) any revisions to DOD 5220.22-M, notice of which has been furnished to the contractor.

Threat Awareness Reporting Program. For all contractors with security clearances. Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2-4b.

C.7 QUARTERLY STATUS MEETINGS

The Contractor shall participate in status meetings, to be held at least quarterly, with the COR and Contracting Officer (KO), to be scheduled by the KO. The meetings will discuss the progress of the contract, performance of the Contractor, and any problems that have arisen or are expected to arise.

C.8 DISTRIBUTION STATEMENT

C.8.1 Determination of Contract Submission Documents:

Distribution Statement A. Approved for public release; distribution is unlimited.

C.8.2 Determination of Information generated from the performance of the contract:

Distribution Statement A. Approved for public release; distribution is unlimited.

Contracting Officer:

4/5/2022

X Ariel M. Amey

Contracting Officer (KO) Signed by: AMEY.ARIEL.M.1469952971

Legal Advisor:

3 /2 8 /2 0 2 2

X B ra d R a m o s

Le g a l A d v i s o r S ig n e d b y : R A M O S . B R A D F O R D .C R A IG . 1 2 4 3 3 1 2 8 3 0