Phase III Supply Effort.pdf

STATEMENT OF WORK

Intelligent Maritime Situational Awareness System Development

Small Business Innovation Research Phase III Supply Effort

Cydecor Inc.

CAGE Code: 3HBG4

JULY 11, 2025

NAVAL SEA SYSTEMS COMMAND HQ

N00024-25-R-6308

1. SCOPE

1.1. BACKGROUND

Program Executive Office Unmanned and Small Combatants (PEO USC), Expeditionary Missions Program Office (PMS 408), has a requirement for the development and delivery of the Intelligent Maritime Situational Awareness System (IMSAS) Development. IMSAS Development is an innovative solution leveraging Artificial Intelligence (AI) and Machine Learning (ML) for enhanced Anti-Submarine Warfare (ASW) situational awareness through autonomous anomaly detection in underwater acoustic data streams. This Statement of Work (SOW) builds upon the successful completion of the Small Business Innovation Research (SBIR) Phase I effort “Intelligent Anomaly-Based Maritime Situational Awareness System (IMSAS)” under SBIR Topic #N193-A02-0462 in support of multiple maritime missions.

This SOW also encompasses the related analysis, systems engineering and design, development, refactoring, configuration, testing, accreditation, operation, training, support, maintenance, documentation, planning, and management required to support this effort, as well as all materials, software, and support necessary to ensure the successful demonstration of the solution readiness to enter production.

The Contractor shall adhere to all requirements contained in the Navy-issued security classification guide (SCG), entitled, “Navy Unmanned Undersea Vehicle (UUV) Security Classification Guide” ID# 05-180, which defines the standards by which Navy UUV programs will:

• Protect sensitive information concerning system hardware/software in the system design,

• Protect sensitive information concerning operational procedures or intended areas and concepts of operation intended for Navy UUVs,

• Protect classified data used to generate a UUV mission package, and

• Protect classified data generated and recorded during the conduct of a UUV mission.

1.2. SYSTEM OVERVIEW

This SOW defines the effort required to develop, design, refactor, refine, validate, harden, and transition the IMSAS technology identified in Phase I into a data anomaly detection software solution and tool set capable of providing real-time, autonomous anomaly detection. This enhanced capability will enable improved detection, classification, and identification of data elements including, but not limited to: (i) underwater threats in deep-ocean transit; (ii) operational patrol areas; and (iii) strategic choke points. This SOW derives from and extends the work performed under the Phase I effort to develop the IMSAS.

2. APPLICABLE DOCUMENTS

The following specifications, standards, and handbooks form a part of this SOW to the extent cited herein. Unless otherwise specified, the issuances of Government documents are listed in the current issuance of the Department of Defense Index of Specifications and Standards (DoDISS) as of the date of this SOW. The issues of non-Government standards shall be those in effect at the time of contract award.

When, in the opinion of the Contractor, a deviation from the standards or requirements cited in this SOW is in order, the Contractor shall submit a written request for deviation to the PCO and provide an informational copy to the designated Contracting Officer’s Representative (COR). The Government will notify the Contractor in writing of approval or disapproval of the request for deviation within thirty (30) calendar days after receipt by the PCO.

Military specifications and standards can be viewed at https://quicksearch.dla.mil/.

Department of Defense (DoD) issuances can be viewed at https://www.esd.whs.mil/dd/.

Department of Navy (DoN) issuances, such as NAVSEA, OPNAV and SECNAV Instructions, Directives and Notes can be viewed at https://www.secnav.navy.mil/doni/default.aspx.

Code of Federal Regulations can be viewed at https://www.ecfr.gov/.

In the case of a conflict, the following order of precedence applies:

1. Laws and regulations of the United States,

2. Contract requirements cited in the contract,

3. Attachment J-1: Statement of Work (SOW)

4. Attachment J-2: Contract Data Requirements List, DD Form 1423-1, Exhibit A

5. Attachment J-3: Contract Security Classification Specification, DD Form 254

6. Attachment J-4: Small Business Innovation Research Data Rights Assertions List

2.1. GOVERNMENT DOCUMENTS, SPECIFICATIONS, STANDARDS, AND PUBLICATIONS

CNSSI No. 1253, Security Categorization and Control Selection for National Security Systems

CNSSI No. 1253 Appendix F Attachment 4, Intelligence Overlay

CNSSI No. 1253 Appendix F Attachment 5, Classified Information Overlay

CNSSP No. 15 Use of Public Standards for Secure Information Sharing

CNSSP No. 28 Cybersecurity of Unmanned National Security Systems

DoD 8570.01-M, Information Assurance Workforce Improvement Program

DoDD 8140.01, Cyberspace Workforce Management

DoD Cybersecurity Test and Evaluation Guidebook v2.0, Change 1

DoD Manufacturing Readiness Level (MRL) Deskbook v2018

DOD-5220.22-M - National Industrial Security Program Operating Manual Supplement, incorporating change

DODI 1322.26 - Development, Management, and Delivery of Distributed Learning

DoDI 5000.02T – Operation of the Defense Acquisition System

DoDI 5200.39 – Critical Program Information (CPI) Identification and Protection Within Research, Development, Test and Evaluation (RDT&E)

DoDI 5200.44 - Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN)

DoDI 8500.01 – Cybersecurity

DoDI 8510.01 - Risk Management Framework (RMF) for DoD Information Technology (IT), Change 1

DoDI 8523.01 – Communications Security

DoDI 8582.01 - Security of Unclassified DoD Information on Non-DoD Information Systems, Change 1

ICD-503 –Intelligence Community Information Technology Systems Security Risk Management

NAVSEA 5100.12-M - System Safety Engineering (SSE) Manual, January 2014

NAVSEA 9400.2-M NAVSEA PIT-Control System Cybersecurity Implementation Manual

SECNAVINST 5239.22, “Department of the Navy Cybersecurity Safety Program”

NAVSEAINST 5000.9 - Naval SYSCOM Systems Engineering Policy

NIST SP 800-171, Rev 1, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

NIST SP 800-53 Rev 4 - Security and Privacy Controls for Federal Information Systems and Organizations

OPNAVINST 5239.4, “Chief of Naval Operations Cybersecurity Safety Program”

SCG ID# 05-180, “Navy Unmanned Undersea Vehicle (UUV) Security Classification Guide”

SCG ID# 10-040, “U.S. Navy Afloat Control Systems Cybersecurity Classification Guide”

OPNAVINST 2221.5D – Release of Communications Security Material to U.S. Industrial Firms Under Contract to the Department of the Navy

CSTA-STD-011-CSRS – Navy Cybersecurity Safety (CYBERSAFE) Requirements Standard v1.5 (Draft)

OPNAVINST 1500.76D – Navy Training System Requirements, Acquisition, and Management

Unmanned Systems Safety Guide for DoD Acquisitions

Technical Manual Contract Requirement (TMCR) NO. SNIPP-210222-000 – Interactive Electronic Technical Manual (IETM), SUUV, Organizational-Level Maintenance

Technical Manual Contract Requirement (TMCR) NO. SNIPP-210223-000 – Interactive Electronic Technical Manual (IETM), SUUV, Intermediate-Level Maintenance

Technical Manual Contract Requirement (TMCR) NO. SNIPP-210224-000 – Interactive Electronic Technical Manual (IETM), SUUV, Depot-Level Maintenance

Technical Manual Contract Requirement (TMCR) NO. SNIPP-210225-000 – Interactive Electronic Technical Manual (IETM), Mission Support Equipment for SUUV; Organizational-Level Operation and Maintenance with Illustrated Parts Breakdown

Unmanned Maritime Autonomy Architecture (UMAA) Architecture Design Description Rev 1.1, 19 December

UMAA Compliance Specification Rev 1, 4 August 2020

UMAA Engineering Operations (EO) ICD Rev 5.2.1, 20 April 2022

UMAA Mission Management (MM) ICD Rev 5.2.1, 20 April 2022

UMAA Maneuver Operations (MO) ICD Rev 5.2.1, 20 April 2022

UMAA Situational Awareness (SA) ICD Rev 5.2.1, 20 April 2022

UMAA Sensor and Effector Management (SEM) ICD Rev 5.2.1,20 April 2022

UMAA Support Operations (SO) ICD Rev 5.2.1, 20 April 2022

UMAA Communications Operations - Experimental (CO-EXP) ICD Rev 5.2 20 April 2022

UMAA Experimental Services Operations (EXP) ICD Rev 5.2 20 April 2022

2.2. NON-GOVERNMENT PUBLICATIONS

Joint Software Systems Safety Engineering Handbook

ANSI/EIA-748-D - Earned Value Management Systems Intent Guide

ANSI/ISO/ASQ 9001:2015 - Quality Management Systems Requirements

SAE/EIA-649C - Configuration Management Standard

SAE TA-STD-0017 – Product Support Analysis

ASTM-F1166 – Standard Practice for Human Engineering Design for Marine Systems, Equipment, and Facilities

IEEE STD 12207:2017 - System and Software Engineering

SAE AS5553C - Fraudulent / Counterfeit Electronic Parts: Avoidance, Detection, Mitigation and Disposition

IEEE 15288.1-2014, Standard for Application of Systems Engineering on Defense Programs

IEEE 15288.2-2014, IEEE Standard for Technical Reviews and Audits on Defense Programs

GEIA-STD-007 Logistics Product Data

SAE STD-0016 Standards for Preparing a DMSMS Management Plan

S1000D – International Specification for Technical Publications Utilizing a Common Source Database

3. REQUIREMENTS

3.1. DELIVERABLES

The Contractor shall perform the following tasks:

3.1.1. IMSAS SOFTWARE SOLUTION AND TOOL SET TECHNOLOGY APPLICATION

REQUIREMENTS (ITEM 0001)

The Contractor shall conduct a thorough needs assessment with PMS 408 to define specific mission-focused application requirements for the IMSAS technology transition based on the following Requirements:

Requirement 1: Establish Experimental Data Testbed – The Contractor shall develop a testbed composed of datasets suitable for validating anomaly detection techniques that may include, but are not limited to:

a) Generating test datasets using statistical and physics-based modeling that includes anomaly injection.

b) Collaborating with PMS 408 and PEO USC data experts to identify and obtain real-world datasets relevant to operational UUV development and financial decision-making.

Requirement 2: Develop Taxonomy of Data Patterns – The Contractor shall create a comprehensive taxonomy of data patterns that are relevant to normal and anomalous behaviors across multiple data domains. The taxonomy shall include, but not be limited to, temporal, time-frequency, sequential, relational, categorical, and clustering-based pattern types.

Requirement 3: Formulate Analytical Models – The Contractor shall design and implement AI and ML models tailored to the pattern types identified in Taxonomy and Data Patterns. Technique examples may include, but are not limited to:

a) Recurrent neural networks (e.g., Long Short-Term Memory (LSTM) for modeling time-series or sequential data,

b) Deep learning models to predict future states based on current conditions, or

c) Rule-based or probabilistic models for categorical and relational data.

Requirement 4: Multi-Dimensional Anomaly Fusion – The Contractor shall investigate and develop methods to integrate anomaly signals from multiple models or data types into a unified assessment of system state. This purpose of this fusion shall be to enhance the accuracy and robustness of anomaly detection for complex decision-making environments.

Requirement 5: Proof-of-Concept Prototype – The Contractor shall design and implement a prototype anomaly detection system that demonstrates the integrated capabilities developed in Requirements 1–4 above. The purpose of the system shall be to support data ingestion, pattern recognition, anomaly detection, dashboard and data visualizations and alert generation, and will be validated by the Government against the datasets assembled in Requirement 1 above.

Reporting and Initial Operational Capability (IOC) Planning – The Contractor shall prepare all required reports and deliverables during the project, including technical progress and final reports. This task shall also involve formulating the approach to achieve IOC by focusing on system maturation, broader data integration, and deployment planning. The Contractor shall establish IOC milestones and functionality.

CDRLs:

A001 System/Software Development Plan (SDP) A002 Software Version Description (SVD) A003 Software Design Description (SDD) A004 Supplier’s Configuration Management Plan (CMP) A005 Configuration Status Accounting Report A006 Interface Control Document (ICD) A008 Contractor’s Data Management Plan (DMP) A009 Product Roadmap A010 Contractor’s Progress and Status Report

3.1.2. IMSAS SOFTWARE SOLUTION ANOMALY DETECTION METHODS REFINEMENT (ITEM

1001)

The Contractor shall develop updates to the model and approach for deep learning, transfer learning, and reasoning methods based on recent successful application of criteria in Requirement 3, as defined in Section 3.1.1. The Contractor shall refine the deep learning, transfer learning, and reasoning methods to meet Requirement 4, as defined in Section 3.1.1. The Contractor shall validate the performance of the refined anomaly detection methods using Government datasets, including simulated and real-world data.

CDRLs:

A001 System/Software Development Plan (SDP) A003 Software Design Description (SDD) A006 Interface Control Document (ICD) A007 Software Product Specification (SPS) A008 Contractor’s Data Management Plan (DMP) A009 Product Roadmap A010 Contractor’s Progress and Status Report A011 Funds and Man-Hours Expenditure Report

3.1.3. IMSAS SOFTWARE SOLUTION DATA ANOMALY DETECTION METHOD VALIDATION

(ITEMS 1001, 1002, 2001, 2002, 2004, 2005, 3001, 3002, 3004, 3005, 4001, 4002, 4005 (IF OPTION(S)

EXERCISED))

The Contractor shall test anomaly detection on existing datasets to validate the model and approach. The Contractor shall generate reports on testing results. The Contractor shall generate change recommendations and reports for Government approval. The Contractor shall establish a Change Control Board (CCB) process for the system baseline, system change recommendations, and approval. The Contractor shall refine as necessary the deep learning, transfer learning, and reasoning methods to meet the specific application requirements outlined in Requirements 3 and 4, as defined in Section 3.1.1.

CDRLs:

A001 System/Software Development Plan (SDP) A002 Software Version Description (SVD)A003 Software Design Description (SDD) A004 Supplier’s Configuration Management Plan (CMP) A005 Configuration Status Accounting Report A006 Interface Control Document (ICD) A007 Software Product Specification (SPS) A008 Contractor’s Data Management Plan (DMP) A009 Product Roadmap A010 Contractor’s Progress and Status Report A011 Funds and Man-Hours Expenditure Report

3.1.4. IOC FUNCTIONAL REQUIREMENTS (ITEM 0001)

The Contractor shall deliver a system that meets the following functional requirements (FR):

FR1. Pattern Detection and Classification

• FR1.1: The system shall detect and classify periodic patterns in data.

FR2. Data Preprocessing and Handling

• FR2.1: The system shall pre-process diverse data elements to account for dispersion, spreading, and absorption.

FR3. AI/ML Model Calibration

• FR3.1: The system shall employ LSTM and Deep Neural Networks or similar technology for data modeling and machine learning.

FR4. Multi-Dimensional Anomaly Fusion

• FR4.1: The system shall integrate outputs from multiple AI models to establish a composite norm.

FR5. Experimental Testbed

• FR5.1: The system shall include a testbed capable of processing both simulated and real-world datasets for model validation.

FR6. IOC Deployment

• FR6.1: The system shall support a prototype architecture for demonstration and testing of

Government-directed additions and modifications.

• FR6.2: The prototype shall include tools to visualize anomaly detection results.

CDRLs:

A001 System/Software Development Plan (SDP) A003 Software Design Description (SDD) A006 Interface Control Document (ICD) A008 Contractor’s Data Management Plan (DMP) A009 Product Roadmap A010 Contractor’s Progress and Status Report

3.1.5. IMSAS SOFTWARE SOLUTION DATA ANOMALY DETECTION METHOD VALIDATION

(ITEMS 2001, 2002, 2004, 2005, 3001, 3002, 3004, 3005, 4001, 4002, 4005 (IF OPTION(S)

EXERCISED))

The Contractor shall establish Full Operational Capability (FOC) including successful delivery of all Functional Requirements in Requirement 5, as defined in Section 3.1.1 and established by the Government. The Contractor shall refine anomaly detection on existing Navy sonar and operational data combined with public datasets to validate the model and approach. The Contractor shall generate reports on testing results and produce recommended refinements and adjustments for model performance improvements with real-world data. The Contractor shall generate change recommendations and progress reports on FOC for Government approval. The Contractor shall recommend changes to achieve FOC validation.

CDRLs:

A002 Software Version Description (SVD) A004 Supplier’s Configuration Management Plan (CMP) A005 Configuration Status Accounting Report A007 Software Product Specification (SPS) A011 Funds and Man-Hours Expenditure Report A012 Human Engineering Test Plan A013 Training System Operator Manual

3.1.5.1. FOC Functional Requirements

The Contractor shall deliver a system that meets the following functional requirements:

FR1. Pattern Detection and Classification

• FR1.1: The system shall detect and classify periodic patterns in data.

• FR1.2: The system shall detect synchronous patterns involving simultaneous changes across multiple datasets.

• FR1.3: The system shall identify temporal relationships between sequential data events.

• FR1.4: The system shall visualize relationships and patterns and identify data anomalies.

FR2. Data Preprocessing and Handling

• FR2.1: The system shall preprocess diverse data elements to account for dispersion, spreading, and absorption.

• FR2.2: The system shall normalize input data from diverse data types for consistency.

FR3. AI/ML Model Calibration

• FR3.1: The system shall employ LSTM and Deep Neural Networks or similar technology for data modeling and machine learning.

• FR3.2: The system shall support training and calibration of multiple anomaly detection models specialized for different pattern types.

FR4. Multi-Dimensional Anomaly Fusion

• FR4.1: The system shall integrate outputs from multiple AI models to establish a composite norm.

• FR4.2: The system shall compare real-time data against the composite model to detect emerging anomalies.

FR5. Experimental Testbed

• FR5.1: The system shall include a testbed capable of processing both simulated and real-world datasets for model validation.

• FR5.2: The system shall include a staging environment capable of deploying new software and data models for processing both simulated and real-world datasets for model validation, testing, system patching for Authority to Operate (ATO) continuous monitoring and pre-deployment validation prior to deployment to production environment.

FR6. Proof-of-Concept Deployment

• FR6.1: The system shall support a prototype architecture for demonstration and testing of

Government-directed additions and modifications.

• FR6.2: The prototype shall include tools to visualize anomaly detection results.

CDRLs:

A002 Software Version Description (SVD) A004 Supplier’s Configuration Management Plan (CMP) A005 Configuration Status Accounting Report A007 Software Product Specification (SPS) A011 Funds and Man-Hours Expenditure Report A012 Human Engineering Test Plan A013 Training System Operator Manual

3.1.6. IMSAS SOFTWARE SOLUTION TECHNOLOGY DEVELOPMENT, INTEGRATION, AND

SOFTWARE TOOL SETS (ITEMS 1002, 2002, 2004, 2005, 3002, 3004, 3005, 4002, 4005 (IF

OPTION(S) EXERCISED))

The Contractor shall implement data ingestion, processing, anomaly detection, data visualization and alert generation for software solutions. The Contractor shall conduct rigorous testing and evaluation of the software solutions for each program as defined in Section C, Descriptions and Specifications, including test, simulated, and real-world data. The Contractor shall ensure seamless integration of the software solutions with the reporting requirements stipulated by each program. The Contractor shall ensure accreditation and authority to operate (ATO) for the software tool set and solution into each environment.

The Contractor shall provide project progress, reporting, and updates on integration to program management. The Contractor shall coordinate deployment of the software tool set and solution into each program environment and integrate the IMSAS software solution and system software for each program.

CDRLs:

A002 Software Version Description (SVD) A004 Supplier’s Configuration Management Plan (CMP) A005 Configuration Status Accounting Report A007 Software Product Specification (SPS) A011 Funds and Man-Hours Expenditure Report A012 Human Engineering Test Plan A013 Training System Operator Manual

3.2. IMSAS SOFTWARE SOLUTION OPERATIONS AND MAINTENANCE

The Contractor shall perform Operations and Maintenance (O&M) to maintain and support the system's operational effectiveness.

3.2.1. SYSTEM SUPPORT AND MAINTENANCE (ITEMS 0003, 1003, 2003, 3003, 4003)

The Contractor shall provide annual software and system support, development, and maintenance to installed systems for each program defined in Section C.

3.2.1.1. Corrective Maintenance:

The Contractor shall perform corrective maintenance by identifying, troubleshooting, and resolving any software defects and system malfunctions. The Contractor shall investigate and diagnose reported software defects and system malfunctions. The Contractor shall develop and implement bug fixes and patches. The Contractor shall conduct root cause analysis of recurring issues. The Contractor shall provide timely status updates to the Government on issue resolution progress.

3.2.1.2. Preventive Maintenance:

The Contractor shall perform preventive maintenance activities such as software updates, security patching, and system backups. The Contractor shall perform regular system backups and disaster recovery procedures for the AI and ML systems components and data. The Contractor shall apply software updates, security patches, and application and tool/architecture system upgrades. The Contractor shall conduct routine system health checks and performance monitoring. The Contractor shall review system logs and identify potential issues.

3.2.1.3. Adaptive Maintenance:

The Contractor shall perform adaptive maintenance to meet evolving operational needs, technology advancements, and emerging threats. The Contractor shall assess and implement changes to the system based on evolving operational needs and technology advancements. The Contractor shall update system documentation and training materials to reflect changes. The Contractor shall conduct regression testing to ensure system stability after modifications.

3.2.2. HELPDESK SUPPORT AND USER SUPPORT

3.2.2.1. End-User Support

The Contractor shall supply support for end-users and define the process for submitting trouble tickets, tracking issue resolution, and providing user assistance.

3.2.2.2. User Training

The Contractor shall outline the training program for system operators and administrators, specify the content, format, and delivery method for training and include provisions for refresher training and updates.

The Contractor shall provide the following training materials:

• User manuals

• System administration guide,

• Troubleshooting guide, and

• End-user training materials.

The Contractor shall ensure the training material and documentation are kept up to date.

CDRLs:

A014 Contractor’s Risk Management Plan A015 Quality Assurance Program Plan A016 Manhour Estimate Technical Cost Proposals A017 Cost Summary Report A018 Trip/Travel Report A019 Software Resources Data Reporting A020 Research and Development Project Summary

3.2.2.3. Incident Management

The Contractor shall define the process for handling system incidents, including notification procedures, escalation paths, and post-incident analysis. The Contractor shall provide timely resolution for incidents with users or system outages. The Contractor shall track and report all incidents, and the time required to resolve them.

3.2.3. SYSTEM MONITORING AND MANAGEMENT (ITEMS 0003, 1003, 2003, 3003, 4003 (IF

OPTION(S) EXERCISED))

3.2.3.1. System Monitoring

The Contractor shall monitor the software solution and tool set to assess system health and performance.

3.2.3.2. Performance Reporting

• Latency: The Contractor shall track and report the time it takes for the system to process a request and return a prediction.

• Throughput: The Contractor shall track and report the number of requests the system can handle per unit of time.

• Uptime: The Contractor shall track and report the percentage of time the system is available and operational.

• Error Rate: The Contractor shall track and report the percentage of requests that result in errors.

• Resource Utilization (CPU, GPU, Memory): The Contractor shall monitor and report on the usage of computational resources.

• Scalability: The Contractor shall track and generate a report showing the ability of the architecture to handle increasing data volume and user traffic without significant performance degradation.

• Cost: The Contractor shall track and report the cost of running and maintaining the AI/ML infrastructure.

• Deployment Schedule: The Contractor shall propose, maintain, track and report on the schedule for new models, versions or updates and their deployment timeline.

3.2.3.3. Security Updates and Patching

The Contractor shall specify the detailed process, frequency for applying security updates and patches to the IMSAS software solution and tool set.

3.2.3.4. Vulnerability Management: The Contractor shall outline the detailed process for identifying and mitigating system vulnerabilities within the IMSAS software and infrastructure. The Contractor shall include detailed procedures for penetration testing, vulnerability scanning, and performing security assessments of the IMSAS software solution and tool set.

3.2.3.5. Access Control: The Contractor shall define the comprehensive access control policies and procedures for the IMSAS software solution and tool set. The Contractor shall ensure that the defined access control policies and procedures allow only authorized personnel have access to sensitive data and functionalities within the IMSAS software solution and tool set.

3.2.3.6. Configuration and Change Control

The Contractor shall describe the detailed process for managing system configurations for the IMSAS software solution and tool set including:

• Software and tool set version control,

• Detailed procedures for tracking, evaluating and implementing change requests, and

• Detailed procedures for configuration backups of the IMSAS software solution and tool set.

A014 Contractor’s Risk Management Plan A015 Quality Assurance Program Plan A016 Manhour Estimate Technical Cost Proposals A017 Cost Summary Report A018 Trip/Travel Report A019 Software Resources Data Reporting A020 Research and Development Project Summary

3.2.4. RISK MANAGEMENT FRAMEWORK (RMF) SYSTEM ACCREDITATION, IMPLEMENTATION

AND ASSESSMENT (ITEMS 0003, 1003, 2003, 3003, 4003 (IF OPTION(S) EXERCISED)

The Contractor shall perform the application accreditation steps necessary to achieve Authority to Operate (ATO) in accordance with the Navy's Risk Management Framework (RMF) as outlined in DoD Instruction 8510.01.

3.2.4.1. Step 1: Categorize Systems

The Contractor shall categorize the system based on the information analyzed, stored, and relayed by the system and an analysis of the impact of potential loss of confidentiality, integrity, and availability to organizational operations and assets, individuals, other organizations, and the Nation with respect to the loss of confidentiality, integrity, and availability of organizational systems. The Contractor shall define and document the security category of the AI/ML solution based on the potential impact of loss of confidentiality, integrity, or availability, in accordance with Navy and DoD guidelines. The Contractor shall assess the sensitivity of all data processed, stored, or transmitted by the AI/ML solution, including training data and model outputs. The Contractor shall consider the mission criticality of the AI/ML functionality in determining the security categorization. The Contractor shall ensure the security categorization aligns with the approved Impact Level (IL) of the Microsoft Azure Government Cloud environment where the solution will reside.

3.2.4.2. Step 2: Select Security Controls

The Contractor shall define an initial set of system security and privacy controls and tailor the controls as necessary to reduce risk to the system to an acceptable level based on a risk assessment. The Contractor shall select a baseline set of security controls for the AI/ML solution based on its security categorization, utilizing NIST SP 800-53 as a guide. The Contractor shall tailor the baseline security controls based on a comprehensive risk assessment specific to the AI/ML solution and relevant Navy and DoD policies. The Contractor shall implement specific security controls addressing the unique risks associated with AI/ML, including but not limited to:

• Data encryption (at rest and in transit).

• Access control mechanisms for training data and model artifacts.

• Data integrity measures throughout the AI/ML lifecycle.

• Measures to ensure the integrity and trustworthiness of AI/ML algorithms, including mitigation of adversarial attacks and model poisoning.

• Processes and controls to identify, mitigate, and monitor potential bias in AI/ML models and their outputs.

• Mechanisms to provide audit trails and, where feasible, explanations of AI/ML decisions.

• Secure development practices for any custom AI/ML code and libraries.

The Contractor shall document the inherited security controls from the Government Cloud Service Provider (CSP) platform based on its DoD IL authorizations. The Contractor shall identify and implement additional security controls specific to the AI/ML solution that are not inherited from the Government CSP environment. The Contractor shall leverage Government CSP Policy to enforce security control implementation where applicable.

3.2.4.3. Step 3: Implement Security Controls

The Contractor shall implement the required security controls based on the NIST SP 800-53 catalog or other relevant security standards. This includes technical, administrative, and operational controls.

Specifically, for IMSAS software solution and tool set, this may include access controls, auditing, encryption, identification and authentication, and system accreditation, Security Technical Implementation Guide (STIG) implementation, patching and communications protection. The Contractor shall implement the selected security controls within the AI/ML solution and the Government CSP environment. The Contractor shall establish secure data pipelines for data ingestion, processing, storage, and access for the AI/ML solution. The Contractor shall ensure a secure development environment for building and training AI/ML models. The Contractor shall implement Role-Based Access Control (RBAC) for accessing AI/ML models, APIs, and related data within the Azure Government and CSP environment. The Contractor shall establish robust logging and monitoring of all AI/ML system activities, including data access, model usage, and prediction outcomes, integrated with Government CSP monitoring services. The Contractor shall utilize relevant Government CSP and Cloud services and features to support the implementation of security controls.

3.2.4.4. Step 4: Assess Security Controls

The Contractor shall conduct regular security control assessments to verify their effectiveness and compliance using the Security Assessment Plan (SAP) and Security Assessment Report (SAR). Qualified Security Control Assessors (SCAs), often Navy Qualified Validators (NQVs) or third-party assessors, conduct the assessment. The SAR details the assessment methodology, findings, and any identified vulnerabilities or weaknesses. The Contractor shall assess the effectiveness of the implemented security controls to determine if they are functioning as intended and meeting the required security objectives. The Contractor shall conduct security-focused testing of the AI/ML models, including adversarial robustness testing. The Contractor shall conduct specific assessments to identify and quantify potential bias in the AI/ML model's predictions across different demographic groups. The Contractor shall evaluate the mechanisms for explainability and ensure they provide meaningful and accurate insights where implemented. The Contractor shall leverage any relevant third-party assessments and audits conducted on the Government CSP platform. The Contractor shall provide documentation of the assessment results (SAP & SAR), including any identified vulnerabilities and remediation plans.

3.2.4.5. Step 5: Authorize the System

The Contractor shall coordinate with the designated Authorizing Official (AO) for review of the security authorization package (including the SSP, SAR, and Plan of Action and Milestones (POA&M)). The AO will determine whether any residual risk is acceptable and make a risk-based decision on wither to authorize the system to operate. If the AO approves, an Authority to Operate (ATO) will be granted. The Contractor shall support the Government in obtaining a formal Authorization to Operate (ATO) from a designated Authorizing Official (AO) for the AI/ML solution within the Microsoft Azure Government environment. The Contractor shall develop and maintain a comprehensive System Security Plan (SSP) that explicitly addresses the unique risks associated with the AI/ML components, including data security, algorithm integrity, bias, and explainability. The Contractor shall provide all necessary documentation and evidence to support the authorization process, including security control implementation details and assessment results.

3.2.4.6. Step 6: Monitor Security Controls (Continuous Evaluation) The Contractor shall regularly track and assess the effectiveness of implemented security controls over time including regular vulnerability scanning, security audits, incident response activities, and updating the security documentation (SSP, SAR, POA&M) as needed. The impact of any changes to the system or its environment and selected controls will be assessed annually in the Annual Security Review (ASR).

Security status will be reported to the AO on an ongoing basis. The Contractor shall establish and maintain a continuous monitoring program for the AI/ML solution and its security controls within the

Microsoft Azure Government Cloud environment. The Contractor shall continuously monitor the performance and behavior of the AI/ML models for signs of degradation or drift, which could indicate security issues or the need for retraining. The Contractor shall continuously monitor the model's outputs for the emergence or exacerbation of bias over time. The Contractor shall implement mechanisms to detect and respond to potential adversarial attacks against the AI/ML models. The Contractor shall continuously monitor the input data distribution for changes that could affect model performance and security. The Contractor shall establish secure processes for retraining AI/ML models and deploying updates within the Microsoft Azure Government Cloud environment. The Contractor shall utilize Azure Monitor and Azure Security Center for continuous monitoring and alerting tailored to the specific risks of the AI/ML solution. The Contractor shall participate in regular security audits and vulnerability scanning of the AI/ML solution. The Contractor shall have established incident response procedures for addressing security incidents related to the AI/ML solution.

3.2.4.7. Dispose of the System

The Contractor, if directed by the Government, shall plan for system decommissioning when the system is no longer needed. The Contractor shall implement proper procedures for the secure decommissioning and disposal of the AI/ML solution and its data when it is no longer needed, in accordance with DoN and DoD guidelines and Azure Government policies. The Contractor shall ensure secure deletion of all training data, model artifacts, and any sensitive information associated with the AI/ML solution within the Microsoft Azure Government Cloud environment. The Contractor shall follow Azure Government's guidelines for data destruction and resource deallocation.

3.2.4.8. Additional Requirements

The Contractor shall establish and maintain clear data governance policies and procedures for all data used by the AI/ML solution within the Microsoft Azure Government Cloud environment, adhering to relevant compliance requirements. The Contractor shall adhere to principles of Responsible AI, including fairness, reliability, safety, privacy, security, and transparency, throughout the RMF lifecycle. The Contractor shall actively collaborate with Government security personnel and the AO throughout the RMF process. The Contractor shall maintain comprehensive and up-to-date documentation of the AI/ML solution, the implemented security controls, assessment results, and the authorization package.

CDRLs:

A014 Contractor’s Risk Management Plan A015 Quality Assurance Program Plan A016 Manhour Estimate Technical Cost Proposals A017 Cost Summary Report A018 Trip/Travel Report A019 Software Resources Data Reporting A020 Research and Development Project Summary

3.3. SECURITY REQUIREMENTS (ALL ITEMS)

All Contractor personnel accessing classified information or material associated with and/or performing work relative to the resultant Contract must be United States citizens and shall have and maintain a SECRET security clearance at time of Contract award through the duration of this Contract. Contractor personnel shall comply with all current badging and security procedures required to gain access to any Government site. The Contractor shall maintain a SECRET facility security clearance.

The Contractor shall maintain a level of safeguarding for classified information and/or material up to the SECRET level.

If Communications Security (COMSEC) information and/or material is required, including Government Furnished Equipment (GFE), the Contractor shall process COMSEC information and/or material in accordance with DoD 5220.22-M, Chapter 9, Section 4, and OPNAVINST 2221.5D, and any additional security guidelines.

The Contractor will require access to Controlled Unclassified Information (CUI) with developers and integrators.

The Contractor will require access to classified source data up to and including the level of SECRET.

Should the Contractor generate any classified material in support of this Contract, the Contractor shall maintain the classification per the source material or SCG.

The Contractor will require access to the Defense Technical Information Center (DTIC) or other secondary distribution centers.

The Government authorizes the Contractor to use the Defense Courier Service in support of this Contract.

The Contractor shall receive, store, or generate CUI in accordance with DoD M-5200.01 Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI). The Contractor shall safeguard CUI per DFARS 252.204-7012.

The Contractor shall develop, implement, and maintain an Operational Security (OPSEC) Plan to protect classified and sensitive unclassified activities, information, equipment, and/or material used or developed by the Contractor and any Subcontractor during the performance of this Contract. The Contractor shall be responsible for the Subcontractor implementation of the OPSEC requirements of this Contract. All Contractor and Subcontractor OPSEC programs shall be in full compliance with the latest version of the National Industrial Security Program Operating Manual (NISPOM) – currently DoD 5220.22-M dated 28 February 2006. The Contractor shall also follow the requirements in the Contract Security Classification Specification, DD 254 (Attachment J-4).

The Contractor shall implement and follow the OPSEC Plan under all CLINs.

All Contractor personnel and Subcontractors requiring routine access to both a Government facility and a DoD enabled network shall obtain a Government-issued Common Access Card (CAC). The Contractor shall work with the COR to submit the appropriate justification and coordinate the paperwork for obtaining a CAC. The approval of a CAC is at the discretion of the COR. If the COR determines that the Contractor is not approved to receive a CAC, the COR may authorize the procurement of a Defense Biometric Identification System pass to obtain access to the Government facility. All other Contractor and Subcontractor personnel requiring occasional access to a Government facility shall submit a visit request via Defense Information System for Security and check in through the facilities’ visitor control center.

The Contractor has five (5) days to return all Government issued identification badges to the COR upon Period of Performance (PoP) completion.

3.3.1. CLASSIFIED INFORMATION STORAGE AND HANDLING (ITEM 0005)

Given the stringent requirements for safeguarding classified information up to the SECRET level, including access to classified source data and adherence to DoD M-5200.01 Volume 4 and NISPOM, on-site storage of all classified information and material is required to ensure the highest level of security and compliance.

3.3.1.1. Classified Meeting Requirements

The Contractor shall be required to host meetings involving classified information and discussions at the SECRET level hosted and conducted on-site at the Contractor's cleared facility. The Contractor shall ensure that all classified material and classified discussions occur within a physically secured environment, protected by appropriate alarm systems, access controls, and sound attenuation measures as required by NISPOM (DoD 5220.22-M) and other applicable directives for handling classified information. The Contractor shall maintain rigorous control over attendee access, ensuring that only United States citizens holding and maintaining the requisite SECRET security clearance with a need-to-know are present. The Contractor shall ensure all classified material remains within the Contractor's secure safeguarding perimeter.

3.3.1.2. Classified Material Storage Requirements

The Contractor shall ensure all classified information is stored in approved security containers, within a secure space that meet specific construction and locking standards with GSA-approved containers and locks meeting Federal Specifications (e.g., FF-L-2740 for containers, FF-L-2937 for vaults). Access to these storage facilities shall be strictly controlled, limited to appropriately cleared personnel with a demonstrated need to know, and subject to continuous accountability measures, including secure key/combination control, robust alarm systems, and potentially intrusion detection systems, all to ensure that the integrity and confidentiality of national security information are maintained at all times.

3.4. SAFEGUARDING COVERED DEFENSE INFORMATION (ITEM 0005)

The Contractor shall develop SSP(s) for its covered Contractor information system(s) to implement the security requirements in DFARS 252.204-7012. The Contractor shall fully cooperate in Government review of the SSP(s) at the Contractor's facility.

If the Government determines that a SSP does not adequately implement the requirements of DFARS 252.204-7012, the Government will notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiency within thirty (30) calendar days of notification by the Government.

The Contracting Officer may provide for a correction period longer than thirty (30) calendar days and, in such a case, may require the Contractor to submit a POA&M for correction of each identified deficiency.

The Contractor shall immediately notify the Contracting Officer of any failure or anticipated failure to meet a milestone in the POA&M.

Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor’s facility. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected each identified deficiency in the SSP(s).

At its sole discretion, the Government may conduct subsequent reviews at the Contractor’s facility to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of Contract award) and may conduct such reviews at any time upon thirty

(30) calendar days’ notice to the Contractor until the end of the Contract.

The Contractor shall fully implement the CUI Security Requirements and associated Relevant Security Controls in NIST SP 800-171 (Rev. 1) or establish SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered Contractor information systems affecting this Contract.

Notwithstanding the allowance for such variation, the Contractor shall identify in any SSP and POA&M its plan to implement the following, at a minimum:

• Implement Control 3.5.3 (multi-factor authentication). Multi-factor authentication shall be required for all users, including privileged and unprivileged accounts, that log into a network.

Any system that is not standalone shall be required to utilize acceptable multi-factor authentication as determined by the Government. For legacy systems and systems that cannot support the requirement, a combination of physical and logical protection acceptable to the Government may be substituted,

• Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the Contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its Subcontractors, suppliers, or vendors based on need-to-know principles,

• Implement Control 3.1.12 (monitoring and control remote access sessions). Require monitoring and controlling of remote access sessions and include a mechanism to audit the sessions and methods.

• Audit user privileges on at least an annual basis,

• Implement Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of National Security Administration (NSA) or NIST approved algorithms (i.e., FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in an SSP and POA&M),

• Implement NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program),

• Implement Control 3.13.16 (protect the confidentiality of CUI at rest) or provide a POA&M for implementation which shall be evaluated by PMS 408 for risk acceptance, and

• Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a POA&M for implementation which can be evaluated by the Government Program Manager for risk to the program.

The Contractor shall, within fifteen (15) calendar days of discovering a cyber incident (inclusive of the 72-hour reporting period), deliver to the Government all data used in performance of the Contract that the Contractor determines were impacted by the incident and begin assessment of potential warfighter/program impact. Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at:

http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx.

In delivery of the incident data, to practical extent, the Contractor shall remove Contractor-owned information from Government-covered defense information.

If the Contractor subsequently identifies any such data not previously delivered to DC3, the Contractor shall immediately notify the Contracting Officer in writing and shall deliver incident data in accordance with the DC3 Instructions for Submitting Media within ten (10) calendar days of identification. In such a case, the Contractor may request a delivery date later than ten (10) calendar days after identification. The Contracting Officer will approve or disapprove the request after coordination with DC3.

The Contractor shall engage with the Naval Criminal Investigative Service (NCIS) industry outreach efforts and consider recommendations for hardening of covered Contractor information systems affecting DoN programs and technologies.

In the event of a cyber-incident, or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with NCIS, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor’s infrastructure systems; or the continuous provision of all Contractor, Subcontractor, or vendor logs that show network activity, including any additional logs the Contractor, Subcontractor, or vendor aggress to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor shall coordinate with NCIS to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS on the Contractor’s information system(s) or information technology asset(s). Specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of a NCIS network device shall be the subject of a separate agreement to be negotiated between NCIS and the Contractor.

Alternatively, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement to be negotiated between NCIS and the Contractor.

In all…