PWS.pdf

Performance Work Statement (PWS) Flexible and Scalable High Fidelity Network Testbed

06 June 2024

1. Background

The Combat Capabilities Development Command (DEVCOM) Army Research Laboratory (ARL) has a long and highly regarded history of conducting innovative internal and collaborative cybersecurity research ranging from studying and protecting specific endpoints through safeguarding national assets. Much of this work is now focused on providing overmatch in a contested tactical environment, researching the problem from the level of an individual soldier to an entire warfighting theater. ARL must maintain a robust program in this domain because commercial systems do not experience stresses of the magnitude encountered in the battlefield.

To be effective in this endeavor, ARL must employ innovative, scalable, and sophisticated tools to reliably and repeatably investigate problems and devise and test solutions. ARL also needs to foster close collaboration with academia and other Department of Defense (DoD) elements, to incorporate cutting edge research and ideas, and to share results and tools developed during the conduct of the research program.

2. Objective

The purpose of this Indefinite Delivery/ Indefinite Quantity (IDIQ) contract is to increase the cyber security knowledge and capability for Army strategic and tactical cyber domains through innovative research and experimentation; to assess the validity of basic research, develop and evaluate new methods and tools, and test prototype implementations in environments that will lead to improved operational capabilities.

Research Development Test and Evaluation (RDT&E) results must be replicated, validated, and further developed in a robust manner to have the greatest impact for the soldier. The vehicle for this work and the primary tool provided by this contract is a testbed, and it is the main mechanism for conducting the replication, validation, and development needed to incorporate results into future Army capabilities. The testbed shall be able to:

1) Realistically and repeatably model network and endpoint devices, services, and workloads using both ns-3 (network simulator – 3; free software, licensed under the GNU GPLv2 license) and EMANE (Extendable Mobile Ad-hoc Network Emulator; open source, licensed under multiple Creative Commons licenses) simulation/emulation environments.

2) Incorporate and execute imported ns-3 and EMANE models without modification.

3) Create, modify, execute, store, and reuse scenarios incorporating devices, services, workloads, models, and external sources and sinks.

4) Support operation in real, compressed (sped up), and stretched (slowed down) time.

5) Incorporate and interact with physical hardware-in-the-loop devices.

6) Ingest and output data- and control-plane signals from/to other environments.

7) Collect and log human interaction with an executing scenario.

8) Collect and log data supplied and generated during the execution of a scenario.

The Contractor shall:

1) Conduct and validate 6.1 basic research performed by ARL and collaborators;

2) Implement and execute innovative approaches derived from the state of the art to further 6.2 applied research for cyber experimentation in a manner which seeks to improve accuracy, impact, realism, repeatability, and predictability, and;

3) Engage in early 6.3 prototyping to foster migrating experimentation results to transferable technology packages for potential use in other RDT&E efforts within DoD seeking to understand, manage, and exploit cyber phenomena.

This support shall include both the maintenance and development of the testbed capability, and the application of associated subject matter expertise to assist and facilitate researchers effective use of the testbed.

The following types of tasks, independently or in combination, are required to support the objective above:

The Contractor shall develop and conduct new and innovative approaches and processes to investigate and evaluate fundamental (6.1 basic research) ideas and ready promising results for experimental validation.

The Contractor shall perform experimental validation (6.2 applied research) of models and theories developed by the basic research through comprehensive innovative experiments, which sufficiently represent the complexity of the Army’s cyber domain, its dynamics, and cyber security posture.

The Contractor shall incorporate selected results and testbed capabilities into early prototype environments (6.3 advanced technology development) to further assess the relevance and potential operational enhancement that can be provided.

The Contractor shall develop processes and approaches designed to improve the accuracy, impact, realism, repeatability, predictability, and relevance of the work performed. At any time, new experiments and/or corresponding testbed upgrades may be incorporated into this effort.

For all the above the Contractor shall work with ARL and collaborators to perform identified work in simulated, realistic, and operationally relevant environments, and return experimental results to researchers, classification permitting.

3. Requirements

There are three (3) general requirements for this effort. Since this effort is providing support for research, it is not possible to describe any action under this effort in full detail until the researcher conceives the outline, context, and goals of any specific experiment. Only then can detailed planning and execution occur. Nonetheless, the framework for support consists of the following three (3) elements:

3.1. Experimentation and Validation:

For each experiment (whether a 6.1, 6.2, or 6.3 effort) a researcher wishes to conduct using the testbed to support a project, the Contractor shall, in coordination with the researcher, define, execute, and document a plan for the experimentation. This plan shall describe the motivation, experimental approach, network topologies and relevant attacks; traffic and user models employed, and parameter explorations, as well as anticipated experimental outcomes.

The researcher must provide sufficient context regarding research thrusts and experimentation objectives to enable the Contractor to: 1) Analyze the requirement and devise an appropriate plan and schedule to meet the requirement; and, 2) Validate experimental results obtained as part of this effort. Once defined, the Contractor shall execute the plan (with possible active involvement of the researcher) and collect data for analysis (either as part of the Contractor effort for the experiment, or to provide to the researcher), and assist the researcher with documenting experimental results. Both strategic and tactical network experimentation shall be supported. To the maximum extent practical, experimentation plans, scenarios, results, reports, and supporting data shall be publicly releasable or releasable to an appropriately cleared community having a need to know.

3.2. Testbed Improvements:

The Contractor shall add and improve testbed features as needed to perform the experiments.

For each experimentation plan defined, the Contractor shall establish a testbed configuration and scenario that will accomplish the goals outlined in the plan and shall make the testbed, configuration, and scenario accessible to the research team members. The configuration and scenario shall be used to execute the plan and shall become a permanent part of the testbed feature/tool/scenario library.

The Contractor shall expand and improve the fidelity of the synthetic network, device, user, and protocol/traffic models, as well as the network topologies, network traffic types and attack scenarios and shall add additional testbed features and capabilities as required by the experimentation plans. Testbed design shall be generalizable and enable addition of new protocols, new waveforms, new networking technologies, new attacks, new user models, and new types of experiments that combine the research areas.

Any plan shall include creation of both unclassified and classified testbeds where a classified testbed may contain more operationally relevant capabilities. The Contractor shall provide technical assistance to maintain replicated testbed capabilities housed at ARL and collaborator facilities. The Contractor shall document testbed improvements on a quarterly basis and provide capability updates at meetings.

3.3. Management and Reporting:

The Contractor shall attend quarterly meetings with the Government, and scheduled collaborator calls. When directed by the Government, the Contractor shall travel to conferences, workshops, seminars and customer sites to engage in intense collaboration, present results, and conduct training. The estimated number of trips per year is included in the Place of Performance table below. The Contractor shall provide monthly technical status and financial reports as well as an annual status report at the end of each fiscal year, and meet the deliverables and milestones. The reports are summarized in the deliverables table below.

Change order recommendations from the Contractor shall include the associated plan including the expected results and benefits, the effort needed and implementation cost, and expected ongoing effort and costs. The Contracting Officer must approve every change order prior to execution.

The Contractor shall provide the appropriate personnel, supervision, materials, non-personal services, and technical assistance needed to perform the specific tasks necessary to support research as specified and ordered. The Contractor shall support testbed instances as needed in both unclassified and classified environments as described in the Security Clearance section below.

Contractor support for efforts active at the time of transition from the prior contract to this contract shall proceed without introducing delay into those efforts. Significant efforts funded under the prior contract in fiscal year 2024 include the DEVCOM ARL SAASCA (Science and Analysis for Autonomous Systems and Counter-Autonomy) research program, the DEVCOM DAC (DEVCOM Analysis Center) ACCOLADE (Augmented Cyber Cognition with Operational Learning Automation of Deployable Expertise) research program, and the DEVCOM SC (Soldier Center) CyberBOSS/OneSAF (Cyberspace Battlefield Operating System Simulation / One Semi-Automated Forces) research program.

4. Deliverables

The deliverables will be defined at a Task Order (TO) level. Below is a sample of what deliverables may be needed.

CDRL Deliverable Date 001 Experimentation Plan for each experiment.

30 days after receiving experiment parameters and objectives.

002 Technical status and financial report End of every month 003 Annual FY research results report. End of October 004 Training presentation material. One week prior to start of training event

(with 30 days lead-time to prepare) 005 Conference or workshop presentation material.

One week prior to submission deadline (with 30 days lead-time to prepare)

5. Ordering Period and Contract Ceiling

The ordering period will be five (5) years, with an option to extend for five (5) additional years.

The ceiling will be $48,500,500.00 and this contract will be incrementally funded within the constraints of available funding.

6. Place of Performance

The principal contract performance for this effort is at the Contractor’s facility, with additional performance at Government facilities, primarily Aberdeen Proving Ground, MD and Adelphi, MD. The Contractor may be required to perform work at other facilities at various times. Travel will be required, estimated as follows:

Event Frequency /year

Participants /trip

Duration /trip

Location

Annual review 1 trip 8 staff 2 days APG

Testbed assistance 4 trips 1 staff 2 days Various

Event participation (e.g.

training, conference, or workshop)

3 trips 2 staff 3 days Various

7. Security Clearance

This effort requires the ability to handle, process, and store information classified up to SECRET at Contractor facilities and handle and process information classified up to TOP SECRET, SECURE COMPARTMENTED INFORMATION, and SPECIAL ACCESS PROGRAM at Government facilities.

A DD Form 254 is included for this contract as set forth in Section J. Should there be additional security requirements for specific Task Orders, such requirements will be specified in the Task Order.

8. Government Furnished Information (GFI)

GFI will be provided in Task Order level and will be determined by the need of each order.

9. Government Furnished Property (GFP)

GFP will be provided in Task Order level and will be determined by the need of each order.

10. Operational Security (OPSEC) Requirements

(1) For contract that require a formal OPSEC program. Contractors and all associated sub-contractors who must meet OPSEC requirements as stated on the DD Form 254 shall develop an OPSEC Standing Operating Procedure/Plan (SOP) within 90 calendar days of contract award and provide it to the COR to be reviewed and approved by the responsible Government OPSEC officer, usarmy.adelphi.arl.mbx.arleoc@mail.mil per AR 530-1, Operations Security. This SOP will include the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it.

In addition, the contractor shall identify an individual who shall be an OPSEC Coordinator. The contractor will ensure this individual becomes OPSEC Level II certified per AR 530-1.

(2) For contract that require OSPEC Training. Per AR530-1 Operations security, the contractor employees must complete Level 1 OPSEC Awareness training. New employees must be trained within 30 days of their reporting for duty and annually thereafter.

(3) For information Assurance (IA)/ Information Technology (IT) Training. All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working in IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M, and AR 25-2 within 6 months of appointment to IA/IT functions.

(4) For information Assurance (IA)/ Information Technology (IT) Certification. Per DoD 8570.01-M, DFARS 252.239-7001, and AR 25-2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award.

(5) For contracts that require handling or access to Classified Information. Contract shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” “Top Secret” and requires contractors to comply with, (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); (2) any revisions to DoD 5220.22-M, notice of which has been furnished to the contractor. If secure telecommunication requirement apply, include clause 252.239-7016 and follow guidance at 239.74.

(6) Controlled Unclassified Information (CUI). Include DFARS clause 252.204-7012, which requires the contractor to comply with NIST 800-171. Also, include DFARS provision 252.204- 2019 into solicitations. Acquisition officials should follow procedures outlined in DFARS

204.73 and verify vendors have an adequate NIST SP 800-171 summary assessment score within the Supplier Performance Risk System (within PIEE). If the score doesn't show a medium-or high-level assessment with a score of 110 or better (as described in the "NIST SP 800-171 DoD Assessment Methodology"), include clause 252.204.7020 and obtain the vendor's "system security plan" and "plan of action" for NIST SP 800-171 verification and assurance by Army Security officials.

(7) Threat Awareness Reporting Program. For all contractors with security clearances. Per AR 381-12, para 2-4b; Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a CI agent or other qualified trainer as specified in 2-4b.

Contracting Officer:

6/6/2024

X Salma Williamson

Contracting Officer (KO) Signed by: WILLIAMSON.SALMA.KHAIREDIN.1514583095

Legal Advisor:

6/6/2024

X Brad Ramos

Legal Advisor Signed by: RAMOS.BRADFORD.CRAIG.1243312830