PWS 13 RFAAP Technology and Cyber Security_12_2025_Draft.docx

RADFORD ARMY AMMUNITION PLANT

PERFORMANCE WORK STATEMENT (PWS)

PWS 13: Contractor Operational Technology (OT), Integrated Information Technology (IT) and Process Control Systems Cybersecurity November 2025

1. GENERAL INFORMATION

1.1. This PWS covers the Contractor’s requirements to provide adequate security on all covered contractor operational technology (OT) systems, integrated Information Technology (IT) systems and process control systems utilized in the manufacturing process and processes that support the OT environment using government, contractor, and industry best practices. This includes the execution of a comprehensive cybersecurity program, timely reporting of cybersecurity incidents to the government, and cooperation with government-led cyber defense initiatives for defense industrial base sites

2. BACKGROUND

2.1. RFAAP produces a variety of propellants and energetics. Most notably, RFAAP produces nitrocellulose, nitroglycerin, solvent propellant, and solventless propellant. Each of the production lines are housed within multiple buildings with various communications and controls through the processes. In addition to energetic and propellant production, RFAAP produces and supplies the production process utilities such as electricity, steam, water, and compressed air. RFAAP’s production and utilities processes are supported by the OT Network which includes, but is not limited to: programmable logic controllers (PLCs), supervisory control and data acquisition (SCADA) systems, and industrial control systems (ICS).

2.2. In 2020, RFAAP began a four-year Cyber Air-Gap modernization project to separate the OT process control network from the business network. This was accomplished by physically separating the two networks throughout RFAAP via an “air-gap” in compliance with NIST 800-82r2 guidelines. As part of this project, physical security controls were installed and implemented to protect the integrity of the air-gap. The Operating Contractor also established a Cyber Security Service Provider (CSSP) onsite, funded via PWS13, to oversee and manage the air-gapped network.

3. SCOPE

3.1. The scope of this PWS maintains a comprehensive Cybersecurity program that adheres to Government and Industry Standards and best business practices for all current and future process, buildings, and systems within RFAAP that are contained within the OT and Production Control Network covered under this contract. This includes, but is not limited to, the execution of a robust cybersecurity program by the contractor, timely reporting of cybersecurity incidents to the government, implementing identified controls and practices for cybersecurity, and cooperation with government led cyber defense initiatives for this Defense Industrial Base (DIB) site. The OT network includes production process, power and steam generation facilities, water treatment facilities and potentially security systems throughout the plant.

3.1.1. The operating contractor will maintain a separation between their business network and the production Industrial Control Network (ICN). The operating contractor’s business network will comply with DFARs 252.204.7012, DFARS 252.204-7021, and NIST 800-171 when used in support of the Installation’s government mission. This PWS does not support the operating cost (administration, equipment, software, cybersecurity monitoring, etc.) of the operating contractor’s business (corporate) network. The operating contractor will comply with the requirements of this PWS in the operation of the ICN or in the event the operating contractor requires access to the Government NIPRNet or SIPRNet.

3.2. This PWS does not include support for the following USG systems or other tenant networks that reside on RFAAP; including, but not limited to, RFAAP Army Staff business network or any of the tenants such as Grucci or ALTESS.

4. APPLICABLE DOCUMENTS OR CITATIONS

4.1. The Contractor shall abide by all applicable regulations, publications, and manuals, as well as local policies and procedures. The Contractor shall use current commercial practices whenever possible. A significant number of Army regulations that govern the conduct of the required work are listed below. Unless otherwise noted, the publications can be accessed at www.apd.army.mil, https://www.esd.whs.mil/, or https://cyber.mil/. Upon request, the Government will provide publications not available. The Contractor shall inform the contracting officer or designate of any changes to a publication or documents that impact the cost of the contract.

4.2. Unless otherwise specified in the solicitation, contract, or contract modifications, all requirements contained in the directly cited document and all reference and subsequently referenced documents, including documents that are replaced by recension, are contractually applicable to the extent specified.

4.2.1. DFARS 252.204-7008, Compliance with Safeguarding Covered Defense Information Controls, OCT 2016

4.2.2. DFARS 252.204-7009 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information, OCT 2016

4.2.3. Clinger-Cohen Act of 1996 also known as the “Information Technology Management Reform Act of 1996”

4.2.4. Privacy Act of 1974 (5 U.S.C. § 552a)

4.2.5. National Institute of Standards and Technology (NIST) 800-53 Rev 5, Security and Privacy Controls for Federal Information Systems and Organization

4.2.6. NIST 800-171 rev3, Protecting Controlled Unclassified Information in Nonfederal systems and Organization

4.2.7. NIST 800-82 Rev 3, Guide to Industrial Control Systems (ICS) Security

5. DEFINITIONS

5.1. Adequate Security: Protective measures that are commensurate with the consequences and probability of loss, misuse or unauthorized access to or modification of the information, process or equipment.

5.2. Covered Contractor OT/IT system: OT or IT system (Hardware and/or Software) which is utilized in the execution or support of manufacturing and process control on behalf of the government at this site or technical information associated with said mission.

5.3. Process Control Network: Network, or network infrastructure on which covered OT/IT systems used in the execution or support of manufacturing logically and physically reside.

5.4. Technical Information: Technical data or computer software as those defined in DFARS 252.227-7013 “Rights in technical data – Noncommercial Items” regardless of whether the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

5.5. Cyber Incident: Actions taken with computer or process control networks that result in the compromise of or actual or potentially adverse effect on an OT/IT system and/or information/technical information therein.

5.6. Compromise: Disclosure of information to unauthorized persons, or a violation of the security policy of a system or network, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information/technical information to unauthorized media may have occurred.

5.7. Sanitization: Sanitization refers to a process that renders access to target data on the media infeasible for a given level of effort.

5.8. Interfacing Requirements: The contractor will interface with the Government and other Contractors within the scope of this PWS. The Contractor will maintain cooperative and business-like relations with all personnel.

5.9. Cyber Awareness Training: All Contractor personnel holding an Army Common Access Card (CAC) with access to classified or unclassified Government information systems and networks shall successfully complete required Cybersecurity awareness training as specified in AR 25-2, DODD 8140.01, DoD 8570.01-M, and as directed by the Government requiring activity prior to access being granted. Training is available at https://cs.signal.army.mil.

5.9.1. All required Cybersecurity awareness training shall be taken upon work performance start date and annually thereafter, for the duration of this contract.

5.9.2. The Contractor shall maintain certificates of successful completion, for both initial awareness training and annual refresher training. As the Army Training and Certification Tracking System (ATCTS) is being decommissioned, Contractors who hold an Army CAC should register with the newly developed Army Validation System (AVS) to track user System Authorization Access Requests (SAARS), and IT User Agreements. Contractors will need to track user training manually or in their own system of record. The Army is working towards developing a system of record for all Army accounts; however, at the time of this writing that system is still in development. Certificates of successful completion of Cyber training, Acceptable Use Policies (AUP), applicable baseline and computing environment certifications, and continuing professional education credits, as required by DoD 8570.01-M, shall be uploaded to AVS and provided to the Government upon request for continuous compliance monitoring and reporting.

5.10. Non-Government-Owned Computing Systems or Devices: The Contractor shall comply with AR 25-1 and AR 25-2. The Contractor shall not install or connect non-Government-owned computing systems or devices to Government networks without coordinating and obtaining proper authorization from the appropriate Information System Security Manager (ISSM), ensuring that all software has a Government approval. The non-Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned removable media; e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives, removable or external hard drives, Personal Digital Assistants (PDA), PC Cards/Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD)/digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, or any devices that can store data.

5.10.1. In-Progress Reviews: The Contractor shall plan and conduct monthly IPRs in collaboration with the contracting officer or designate. The purpose of the IPR is to present, discuss, and analyze trends in system performance, to conduct forecasting with respect to system upgrades, deployments, projects and other potential or planned workload. The Contractor shall prepare, distribute, and use an agenda for the meeting to ensure that all participants are prepared to address pertinent issues and serve as a mechanism for ensuring that all issues are addressed. Agenda shall be distributed at least 2 business days prior to the meeting. The Government reserves the right to have any Government Subject Matter Expert (SME) attend the meeting to address any agenda item. Contractor will provide meeting minutes within 1 business day of the meeting to the contracting officer or designate and other participants. (CDRL A13-001)

5.11. Data and Software Rights: The Government has unlimited rights to all documents/material produced under this contract to include the source codes of any software which shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights. The Government's rights in non-commercial technical data and software deliverables shall be governed by DFARS 252.227-7013 and DFARS 252.227-7014, respectively. The Government's rights in commercial technical data deliverables will be governed by DFARS 252.227-7015.

5.12. Government Property: All data (e-mail, contact information, calendar contents, etc.) is and shall remain the property of the government. The Contractor shall ensure that the government retains access and download capability of all data for research, investigation, transfer, or migration to other systems.

5.13. Document Markings: The Contractor shall not provide the government deliverables marked as “proprietary” for any deliverable associated with this PWS. All software code, data, and information generated in support of this PWS is the property of the US government, without exception.

5.14. Reporting Requirements: The Contractor shall provide reports on the OT/IT requirements identified within the PWS and listed in the Deliverables Schedule. All information created or obtained because of this PWS shall be used and protected by the government in accordance with the conditions laid out in DFARS 252.204-7012, Para H and K.

5.15. Submission of Deliverables: All deliverables shall be sent to the Procuring Contracting Officer (PCO) and any other designees listed within identified timelines.

5.16. Contractor Responsibilities to Comply with Laws and Regulations: Contract functions shall be performed in accordance with the current versions of applicable regulations, directives, and headquarters guidance as of the date of this PWS. Primary governing regulations are in Paragraph 4. All services and supplies provided under this requirement must comply with the Clinger-Cohen Act, Section 508 of the Rehabilitation Act of 1973, as amended (29 USC 794d) and must meet the applicable accessibility standards at 36 CFR Part 1194.

5.17. Safeguarding Covered Defense Information and Cyber Incident Reporting: Contractor shall comply with DFARS 252-204-7012 for networks/ systems that process and or store government Controlled Unclassified Information (CUI) used in support of the mission at the installation. Refer to CUI Registry at http://www.archives.gov/cui/registry/category-list.html, for additional information on what information is CUI.

6. TECHNICAL REQUIREMENTS

6.1. Operational Technology/Information Technology Cybersecurity Program. The Operating Contractor (OC) shall establish or maintain a cross functional team dedicated to executing a comprehensive cybersecurity program for OT/IT used in the process control environment. This team should include but not be limited to, members of the OT/IT Cybersecurity team and engineering controls team with the capability to execute a comprehensive cybersecurity program for OT systems. See section 2.1.5 for more information. The OC shall establish and maintain a list of policies and procedures laid out within this PWS and in accordance with the NIST guidance. They shall present their OT cybersecurity plan to the government for review and acceptance. See section 2.1.6 for more information.

6.1.1. The OC shall establish a CSSP for OT/IT or commercial equivalent with capabilities that include, but are not limited to: Network Management, Security Incident Handling, Incident Management, Threat Analysis, near real time operations, Cybersecurity Compliance, Vulnerability Management, and Technology Services Delivery.

6.1.2. OT/Process controls Air-gap. OT shall be air-gapped on a stand-alone network that is physically separate from any other business or government networks, all unnecessary ports should be closed, and any outward facing software should operate without connections.

6.1.3. Security Categorization (Security Impact): The Government has identified that all contractor OT/ IT systems or OT/ IT systems operated on the behalf of the Government level of Confidentiality, Integrity, and Availability (CIA) will be Moderate, Moderate, Moderate. (CNSSI 1253, Section 3.1 definition of Moderate: If the loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals and exceeds mission expectations.) The Contractor shall use the identified controls to build a Cybersecurity program, policies, and procedures. NIST SP 800-82.

6.2. Security Program: Contractor shall utilize Government and Industry standards and business best practices, such as, but not limited to, defense-in-depth, NIST Publications or ISO to establish a cybersecurity program for OT/IT capabilities that include, but are not limited to: Network Management, Security Incident Handling, Incident Management, Threat Analysis, near real time operations, Cybersecurity Compliance, Vulnerability Management, and Technology Services Delivery. The program shall continue to evolve as the Government and Industry standards and best practices are revised to address emerging threats.

6.3. Cybersecurity Team: The contractor shall build/maintain a cross-functional cybersecurity team. The team shall execute and maintain the security program. Members can share their varied domain knowledge and experience to evaluate and mitigate risk in the ICS. Team make-up should consist of, but not limited to, IT Staff, control engineer, control system operator, security subject matter experts, and risk management staff. Security knowledge and skills should include, but not limited to, network architecture and design, security processes and practices and secure infrastructure design and operation. The team shall include vendors and/or system integrators on an as-needed basis.

6.4. Site Security Plan: The site security plan (SSP) is a formal document that provides an overview of the security requirements for the system and describes the security controls in place or planned for meeting those requirements. The security plan should include at a minimum, but not limited to, the implementation status, responsible entities, resources, and estimated completion dates. The plan also contains, as supporting appendixes or as references, other key security-related documents such as, but not limited to, a risk assessment, privacy impact assessment, system interconnection agreements, contingency plan, security configurations, configuration management plan, and incident response plan. (CDRL A13-002)

6.4.1. The Contractor shall develop and submit a security plan for Government approval within the first 30 calendar days from award of this contract and thereafter annually. The initial plan and all revisions shall be signed by the Plant Director or designated official to validate that the plan has been thoroughly reviewed by qualified SMEs, and accurately reflects the current security landscape of the identified system.

6.4.2. The Contractor shall review and evaluate the effectiveness of the plan at least annually and update accordingly then resubmit to the government for review and approval. In the event of an incident/breach, the contractor shall review, evaluate, and update the plan as part of their incident response plan.

6.4.3. The Contractor shall make the plan and associated security related policies and/or documentation available upon request to the DoD, US Army and any/all assigned inspectors or assessors. The Contractor shall engage in a proactive, collaborative effort by attending meetings, engage productively in discussions, and provide additional information and/or assistance to inspectors and/or assessors as required to complete a full and comprehensive assessment.

6.5. Security Control Selection:

6.5.1. Select Security Control Baseline: Selecting the initial control set, or baseline, is the process of aggregating the control corresponding to the security categorization of the system (refer to para. 2.1.3).

6.5.2. Select and apply security control overlays: Security control overlays specifications and supporting guidance complement the security control baselines values. Overlays may add security controls, subtract security controls, or provide additional guidance regarding security controls, which will result in a set of security controls applicable to that system that is a combination of the baseline and overlay. Overlays are intended to reduce the need for ad hoc tailoring of baselines by organizations through the selection of a set of controls and control enhancements that more closely correspond to common circumstances, situations, and/or conditions. The use of overlays however does not in any way preclude organizations from performing further tailoring (i.e., overlays can also be subject to tailoring) to reflect organization-specific needs, assumptions, or constraints. NIST SP 800- 82 Appendix G, includes an ICS-specific overlay of applicable NIST SP 800-53 controls that provide tailored baselines.

6.5.3. Tailor the set of security controls: Controls, regardless of source (baseline or overlays), may be tailored unless required to meet legislative, regulatory, or policy requirements. A control may be tailored out if there is no risk for which the control is designed to mitigate. The Contractor may find it necessary to tailor (modify), a control set in response to increased risk from threat or vulnerability changes or variations in risk tolerance. After tailoring, the resulting set of security controls is referred to as the tailored control set. Tailoring decisions must align with operational considerations and the environment of the system. The Contractor should coordinate this tailoring with mission owners and Government representatives. Contractor should only add or remove security controls as a function of specified, risk-based determinations. The Contractor must document the tailoring decisions, including the specific rationale – such as mapping to risk tolerance – for those decisions, in the security plan for the system. The Contractor must account for every selected control. If the Contractor does not implement a selected control from an overlay or baseline, then the Contractor must document the rationale for not implementing the controls in the security plan and a Plan of Action and Milestones (POA&M). Controls may not be tailored out due to inability to satisfy a control (e.g., resource constraints). These controls are still applicable and need to be documented for risk management decisions.

6.5.4. Supplement (compensating) the tailored set of security controls: Supplement the tailored baseline security control set, if necessary, with additional controls or control enhancements that consider local conditions including operation environment, organization-specific security requirements, specific threat information, cost-benefit analyses, or special circumstances. Organizations must base this supplementation on risk assessments consistent with NIST SP 800-30 “Guide for Conducting Risk Assessments.” Supplementing security controls may address residual risks not adequately mitigated by the tailored control set. Supplemental (compensating) controls are not exceptions or waivers to the baseline controls; rather, they are alternative safeguards and countermeasures employed within the ICS that accomplish the intent of the original security controls that could not be effectively employed. Contractor’s decisions on the use of compensating controls are documented in the security plan for the ICS.

6.6. Cyber Defensive Operations:

6.6.1. The Contractor shall aid and facilitate Cyber Defensive Operations (CDO) and assessments conducted by the government or a government assigned representative organization, on OT and IT operated by the OC on behalf of the government, as required. Assistance shall be given for situational, emergency, and recurring projects. Recurring inspections and assessments typically occur in conjunction with the Mission Assurance Assessment (MAA) program every 3 years. Contractor assistance includes, but not limited to:

6.6.1.1. Providing access to all OT and IT systems and devices within the mission footprint, including contractor information systems, used to conduct or support operations and/or process technical information on behalf of the government, as required.

6.6.1.2. Providing SME and operator input with all assessments, CDO, and audits of OT cybersecurity, as required.

6.7. Configuration Management:

6.7.1. Systems shall be baselined; any hardware or software modifications will be documented.

6.7.2. Any software that is no longer needed or lacks proper documentation/accreditation shall be removed from the system.

6.7.3. Unauthorized users shall not install or modify any hardware or software.

6.8. OT / IT System Component Inventory:

6.8.1. Contractor shall develop and maintain an inventory of all OT/IT devices in the process control network within 90 days of the start of the contract and establish a program to ensure the inventory is updated. New processes, equipment, and supported OT should be inventoried and mapped within 14 days of installation of equipment. Mappings and inventory changes shall be provided to the government at the end of each calendar quarter. (CDRL A13-003)

6.8.1.1. The inventory database should be electronic Microsoft® Excel compatible and record where applicable, but not limited to:

· Item Name and Description

· Model

· Manufacturer

· Firmware/OS version

· Type of network connection

· Any system interconnections

· System Notes

· Contract Number

· CAGE Code

· Manufacturer Product Number

· Serial Number

· Quantity

· Location

· Sub Location

· Type of Government Property

· Classification of Government Property

· Date of last physical inventory

· System type (what the item is ultimately part of, i.e., UMCS, SCADA)

· Connectivity (Does the device have connectivity to other devices and if so, is it hardwired wireless, both or none)

· Network type used (Serial, Ethernet, Both, None)

· Protocols in use (BACnet native or over IP, Modbus, FTP, SEL or none)

· Upstream device (serial number of the upstream network device)

· IP Address(es)

· MAC Address(es)

· Host Name

· IP Subnet/Mask

· Additional Ethernet interface(s), if any (Out of Band Management or monitoring)

· Additional serial interface(s), if any. (e.g., RS232 serial interface for remote administration)

6.8.1.2. Network Diagram and Maps:

6.8.1.2.1. Contractor shall review and update, as required, the Purdue model diagrams that map the process control network to the Programmable Logic Controller (PLC) in each building and an overall network diagram. The network diagram should show the physical and logical location of every device on the process control network as well as the physical separation between the process control network and the business networks used in mission processes.

6.8.1.2.2. The CSP should have a defined process for updating the network map as new equipment is added to the process control network or old equipment is removed. This process should be tied to the inventory process. Updates shall be submitted in conjunction with inventory updates, as required in section 2.1.8.3 of this PWS. First submittal after contract award is 90 calendar days (CDRL A13-004)

6.9. Security Technical Implementation Guides & Security Requirement Guides: The Contractor will ensure that all Government assets/systems that falls under the support of this contract are always properly configured IAW the Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) and are subject to random audit and inspection by Government cybersecurity teams/offices. Manual and automated checks will be used to verify compliancy. Contractor will provide, upon request, documentation for verification of STIG compliance. The contractor will review all applicable STIGs and SRGs; determine and correct non-compliant findings. Results of the STIGs and SRGs will be provided to the ACO and the site ISSM, at a minimum quarterly or upon request. Non-compliant findings which cannot be resolved due to timing, technology, or mission failure will be reported to the site ISSM in order to determine threat mitigation policy and procedures, as well as development of a POAM. POAMs will be submitted monthly by the 6th of the month. (CDRL A13-005)

6.10. Process and Procedures Documentation: The Contractor shall document all processes and procedures used to perform work identified within the PWS. This requirement is in addition to documentation needed for Risk Management Framework (RMF) requirements. Documentation must be always readily available to the Government. The Contractor shall develop and operate a document management system utilizing standard naming conventions for document retrieval. The Contractor shall review all documentation bi-annually, update as necessary, all documentation will contain a change log for tracking changes. Upon completion of the review, the contractor shall provide the Government a summary report of all updates.

6.11. OT Process Control Separation (Airgap Network): The contractor shall implement network configuration changes throughout this contract period. Configuration changes shall support the Government’s vision that OT/IT networks will be air-gapped on a stand-alone (process control) network; physically separate from any business or government networks. Future cybersecurity and network modernization projects will require the contractor to maintain network separations and design standards.

6.11.1. All unnecessary ports should be closed, and any outward facing software should operate without connections. Any devices that must connect to the OT/IT environment shall adhere to the appropriate NIST controls referenced in section 1.4.

6.11.2. Information Assurance Vulnerability Assessments / Common Vulnerabilities and Exposures Programs: Upon receiving notification for the implementation of a hardware/software/firmware IAVA/CVE, the Contractor will schedule the IAVA/CVE with the Government and install prior to the suspense. The Contractor shall provide IAVA/CVE compliance status to the HQ, JMC G6 Cybersecurity Team. One hundred percent (100%) accuracy and compliance is required. When IAVA/CVE compliancy cannot be met by the mitigation date, the Contractor will submit a POAM to the site ISSM and the HQ, JMC G6 Cybersecurity Team by the IAVA/CVE mitigation date.

6.12. Security Patches / Updates: The Contractor shall implement new security requirements, patches, and updates. Requirements shall be implemented IAW the time frame and guidelines dictated by the Government. When compliancy cannot be met by the mitigation date, the Contractor will submit a POAM to the site ISSM and the ACO by the mitigation date. The contractor shall provide a monthly Patch Management Report to the government for any IAVA/CVE patches and/or vendor updates that failed on initial and subsequent tries. The summary will include the IAVA/CVE patch and/or vendor update, a description of what failed and resolution to the problem, and mitigation date of compliance for any IAVA/CVEs not applied by the IAVA/CVE date that shows all patches that were deployed on the OT/IT networks no later than the 5th of the following month. (CDRL A13-006)

6.12.1. Software not utilizing the latest security patches/updates because of tested/documented mission interference shall be documented and a POAM created to track the finding and potential resolution.

6.12.2. All devices should be updated to the latest versions of applicable software/firmware whenever possible.

6.13. Access Control:

6.13.1. Contractor shall disable/deactivate remote access for the OT/IT process control systems.

6.13.2. Contractor shall deactivate any Wi-Fi devices not being used in the mission processes and remove them from use where applicable.

6.13.3. Contractor shall deactivate accounts that are no longer required. Special local accounts that are needed for management should be disabled when not in-use and the security plan should document the process that is to be followed.

6.13.4. Review of Audit Logs: The Contractor shall review all audit logs for; irregularities, attempts of unauthorized access and to determine system functionality, reliability, and performance. The Contractor shall maintain a library with 1 years’ worth of audit logs as per RMF requirements. The Contractor shall notify the Government immediately of any security or other issues that would adversely affect Government systems or the mission. The Contractor shall take appropriate steps to mitigate downtimes and damage to Government system.

6.14. Incident Reporting:

6.14.1. An incident is any suspicious activity leading the Contractor to believe unauthorized access was attempted, has occurred, or will occur. The Contractor shall notify the government of any compromise, or cyber incident which occurs within the OT/IT network environment within 24 hours of discovery, this report should include at a minimum, the required elements at https://dibnet.dod.mil. They shall notify in writing, at a minimum, site commander and IT specialist on staff. Within 72 hours they shall follow reporting guidelines established in DFAR 252-204-7012, cyber incident Reporting Requirement (Para C) for compromised CUI or technical information. No classified information shall be submitted with this CDRL. (CDRL A13-007) The report provided shall include a brief statement containing the location affected, system, a description of the incident, action taken, point of contact (POC), and any related information.

6.15. Media Preservation and Protection:

6.15.1. When the Contractor discovers a cyber incident has occurred, the Contractor shall preserve copies or images of all known affected OT/IT systems, and relevant logs, or packet captures for at least 90 days from date of submission of the cyber incident report to the government. The Contractor shall adhere to AR 25-2, Chapter 4, Section 4-19, page 27, “Incident and Intrusion Reporting” when identifying and reporting on incidents. Examples of the types of incidents that shall be reported:

· Known, suspected, or attempted intrusions into Army AISs to include alerts by Network Intrusion Detection (NID) systems installed to detect “hackers”

· Unauthorized access to data, files, or menus by users

· Indications of unauthorized users attempting access, unexplained modifications of files or un-requested “writes” to media

· Unexplained output received at a terminal or abnormal system response

· Inconsistent or incomplete security marking on output

· Malicious Software

6.16. Forensic Access: The Contractor shall provide the Army, or government assigned organizations with access to equipment or information as necessary to conduct forensic analysis within the process control network.

6.17. Damage Assessment: If the government elects to conduct a damage assessment, the Contracting Officer will request and be provided all damage information the Contractor has gathered on an incident.

6.18. Risk Management Framework: The contractor shall assist the Government in preparing packages/ risk assessments for the accreditation, re-accreditation, and self-assess processes of RMF. To include but not limited to providing artifacts, documentation, and eMASS input. Guidance; AR 25-2 Army Cybersecurity (Chapter 4), NIST Special Publication 800-53, Revision 4 (Including updates as of 01-22-2015); Security and Privacy Controls for Federal Information Systems and Organizations (http://csrc.nist.gov/publications/PubsSPs.html); Department of Defense Instructions (DoDI) 8510.01, March 12, 2014, Risk Management Framework (RMF) for DoD Information Technology (IT) (https://www.esd.whs.mil/DD/); or future DOD regulation that supersedes these regulations

6.19. System Disposal and Destruction: The contractor shall develop and implement a system disposal and destruction strategy within six months of contract award and review annually. Strategy will include, but not limited to, the organizations use of equipment, techniques, and procedures for sanitizing information systems digital media including the tracking, documenting, and the verification of media sanitization and destruction actions. Will periodically test sanitization equipment/procedures to ensure correct performance. Will destroy information system digital media before its disposal or release for reuse outside the organization to prevent unauthorized individuals from gaining access to and using the information contained on the media. (CDRL A13-008)

6.20. Key Performance Indicators and Tracking:

6.20.1. Key Performance Indicators (KPIs) are measurable indicators used to evaluate the effectiveness of an organization’s cybersecurity posture and risk management strategies. The following KPIs will apply to this PWS:

6.20.1.1. Compliance KPIs

6.20.1.1.1. Measure compliance with NIST 800-53, 800-171, and 800-82 standards.

6.20.1.1.2. 800-53 Security and Privacy Controls - Compliance is measured by implementing controls based on a system's impact level (low, moderate, or high) and then assessing their effectiveness.

6.20.1.1.3. System security plan (SSP): Create and maintain a detailed SSP that documents which controls have been selected, how they are implemented, and their operational status.

6.20.1.1.4. Access control (AC-4): Measure compliance by reviewing network topology maps and system access logs to verify that information flow is restricted according to defined policies. For instance, monitor traffic to confirm that systems processing sensitive data cannot communicate with unauthorized public networks.

6.20.1.1.5. Audit and accountability (AU-6): Measure effectiveness by reviewing audit records, vulnerability scans, and system monitoring data to identify unusual activity. Example: Use a SIEM (Security Information and Event Management) system to correlate log data and flag repeated failed login attempts from a new IP address.

6.20.1.1.6. Security assessment and authorization (CA-5): Conduct a risk assessment to evaluate the security posture against NIST 800-53 controls, document the findings, and obtain authorization to operate the system. This involves systematically identifying threats, choosing relevant controls, and documenting the effectiveness of those controls.

6.20.1.1.7. 800-171 Protecting Controlled Unclassified Information (CUI) - DoD assessment scoring: For the DoD Assessment Methodology, compliance is measured on a SPRS 110-point scale reflecting the number of security requirements.

6.20.1.1.8. Access control (AC): Measure compliance by implementing and auditing technical and administrative measures, such as:

6.20.1.1.9. Using multi-factor authentication (MFA) to restrict remote access to CUI

6.20.1.1.10. Conducting regular user access reviews to enforce the principle of least privilege

6.20.1.1.11. Logging access events and protecting audit systems from unauthorized access

6.20.1.1.12. System security plan and POA&M: Document compliance through a SSP that details how controls are met. For any controls not yet fully implemented, create a POA&M to track remediation efforts.

6.20.1.1.13. 800-82 Operational Technology (OT) Security - Compliance is measured by tailoring and applying controls from NIST 800-53 to the OT environment.

6.20.1.1.14. Risk and readiness assessments: Conduct assessments specifically tailored for OT environments that evaluate technical and procedural safeguards against the 800-82 guidelines. This involves vulnerability analysis, gap analysis, and risk scoring to identify deviations and potential threats.

6.20.1.1.15. Network segmentation: Measure compliance by verifying that the OT network is logically and physically separated from the IT network. Check for strictly controlled communication pathways between zones to prevent threats from moving laterally from one system to another.

6.20.1.1.16. Vulnerability and configuration management: Assess compliance by deploying monitoring devices within the OT environment. An example is using a dedicated OT security tool to detect anomalies, track configuration changes, and identify unapproved software that could impact safety or reliability.

6.20.1.1.17. Incident response (IR): Measure compliance with IR requirements by developing and testing a response plan that specifically addresses OT-related incidents. For example, the plan should account for potential impacts on physical processes or critical infrastructure.

6.20.1.2. Incident Detection and Response KPIs

6.20.1.2.1. Measure the speed and effectiveness of handling cybersecurity incidents:

6.20.1.2.2. Mean Time to Detect (MTTD): Average time to identify a threat. MTTD is the average time it takes for a security team to become aware of a potential security incident or anomaly after it occurs. A low MTTD indicates strong monitoring capabilities and a quick response from the security operations center (SOC). A high MTTD means threats could go unnoticed for longer periods, increasing the risk of data loss or system compromise.

6.20.1.2.3. Calculation method:

6.20.1.2.4. This metric can often be pulled from a Security Information and Event Management (SIEM) system.

6.20.1.2.5. Mean time to resolve / remediate (MTTR). This metric measures the average time from when a security incident is detected to when it is fully resolved and the system is back to a secure state. A short MTTR demonstrates an effective incident response process, limiting the "blast radius" of an attack and reducing potential damage. An increasing MTTR could indicate a need for more resources or improved incident response plans.

6.20.1.2.6. Calculation method:

6.20.1.2.7. This calculation relies on data from incident response tracking tools, often including SIEMs.

6.20.1.3. Threat Prevention and Awareness KPIs

6.20.1.3.1. Patch compliance rate

6.20.1.3.1.1. This metric measures the percentage of systems or devices that have received the latest security patches and updates, often tracked within a defined timeframe. Ensuring a high patch compliance rate is a fundamental part of risk management, as unpatched systems are a prime target for attackers. A high rate shows good operational discipline, while a low rate reveals critical gaps in security maintenance.

6.20.1.3.1.2. Calculation method: X100%

6.20.1.3.1.3. Intrusion attempts blocked: Number of unauthorized access attempts prevented.

6.20.1.3.1.4. Security awareness training completion rate: Percentage of personnel completing training.

6.20.1.3.1.5. Number of unidentified devices: Counts devices on the network not properly cataloged

6.20.1.4. Operational Efficiency and Performance

6.20.1.4.1. Service Level Agreement (SLA) compliance: Percentage of times contractual targets are met; e.g., with CSSP (ARCYBER).

6.20.1.4.2. Supplier Performance Risk System (SPRS) score: The score assesses how well an organization has implemented the 110 cybersecurity controls outlined in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171.

6.20.1.5. Personnel Certification: All personnel working within a CSSP SOC must hold a role-specific certification from a list approved by the DoD to meet compliance standards set forth in DoDI 8140 (which has replaced DoDI 8570). The specific baseline certification depends on the individual's job role and level within the SOC. Some common roles and their corresponding certification options include:

6.20.1.5.1. CSSP Analyst - Personnel in this role are responsible for network traffic analysis, signature development, and threat identification.

6.20.1.5.2. CSSP Incident Responder - These individuals handle cyber incidents from detection to resolution.

6.20.1.5.3. CSSP Infrastructure Support - This role focuses on maintaining the infrastructure supporting SOC operations.

6.20.1.6. Organizational Accreditation

6.20.1.6.1. A DoD Cyber CSSP subordinate Security Operations Center (SOC) requires formal organizational accreditation to operate. A designated DoD authority, must issue an Authority to Operate (ATO). Accreditation status is monitored, and requires re-assessment approximately every three years.

6.20.1.7. In addition to any KPIs specified in this PWS, the Contractor shall identify a minimum of three (3) KPIs that measure performance, effectiveness, timeliness, and/or efficiency of Cyber Security efforts at RFAAP. These additional KPIs shall be included in PWS 13 KPI report. (CDRL A13-009) The initial submission shall be submitted to the Government for approval 60 calendar days after transitioning as the Operating Contractor and monthly thereafter.

6.20.1.8. The Contractor shall define the calculation method for each KPI and any sub-KPIs in the first submission of the PWS 13 KPI report ACA for Government approval.

6.20.1.9. The PWS 13 KPI Report shall provide targets for improvement for each KPI, with justification as to why the target was determined. Targets may be based on industry standards or baseline data acquired in the first quarter of performance tracking. Targets may be adjusted on an annual basis or sooner, if necessary, with Government approval.

6.20.1.10. When KPIs are trending negative or consistently below target (for at least three consecutive months), the Contractor shall provide a plan or strategy adjustment to work back towards the target. The plan and/or strategy shall include details on actions to be performed, timeline for improvement and personnel responsible to achieve the target.

image1.png image2.png image3.png