Sources Sought HDTRA124R0046 - DTRIAC ITSS.pdf

Distribution Statement A: Approved for public release, distribution is unlimited.

NOTICE INFORMATION

Notice Type: Sources Sought

NAICS Code: 541513 Computer Facilities Management Services

Agency/Office: Defense Threat Reduction Agency (DTRA)

Title: DTRIAC Information Technology Support Services (DTRIAC ITSS)

Sources Sought Number: HDTRA124R0046

Description: This is a Sources Sought Notice; there is no solicitation available at this time. No response will be provided to requests for solicitation. THIS SOURCES

SOUGHT IS PUBLISHED FOR MARKET RESEARCH PURPOSES ONLY.

DTRA requires Information Technology (IT) Support Services for operation of the IT systems of the Defense Threat Reduction Information Analysis Center (DTRIAC).

DTRIAC manages the DTRA nuclear testing archives, as well as other DTRA, DoD, and U.S. Government collections. The DTRIAC mission is to provide timely electronic access to all nuclear weapons test data, legacy and current, to U.S. Government programs supporting U.S. Nuclear Deterrent missions. The DTRIAC IT Systems (ITS) program area includes the design, development, prototyping, implementation, information assurance (IA), management and operation of the DTRIAC IT systems as the Service Provider for DTRIAC on premise clouds and other inter-related IT systems.

The scope of this Contract includes but is not limited to the design, development, prototyping, implementation, information assurance, management and operation of the DTRIAC IT systems.

See the attached Performance Work Statement (PWS) for additional details on the requirement.1

The scope includes providing the following support services:

1. SERVICE PROVIDER –

serve as Software/Platform/Infrastructure Service Provider for DTRIAC on premise IT systems;

2. CYBERSECURITY –

broad spectrum cybersecurity and information assurance support for DTRIAC IT systems;

3. SYSTEM ARCHITECTURE –

1 For acronym definitions, reference PWS 9. For definitions of DTRIAC IT systems, reference PWS 1.3.

network and system architecture and design services for existing, evolving, or new DTRIAC IT systems;

4. CROSS DOMAIN TRANSFERS –

broad spectrum cross-domain file/data transfer support as a service;

5. SOFTWARE –

software development, implementation, and configuration support, including programming and scripting as needed to meet other requirements of the PWS;

6. DATA MANAGEMENT –

provide data architecture, configuration, and engineering support to host and organize diverse and inhomogeneous datasets as needed to meet other requirements of this PWS;

7. TESTING AND EVALUATION –

prototype, test, evaluate, and implement DTRIAC IT systems;

8. INTEGRATION –

provide development capabilities and project management support to implement DTRIAC requirements for application and capability integration;

9. TRAINING –

provide training and documentation to the DTRIAC Government Program Manager (PM), the Contracting Officer’s Representative (COR) for this contract, the Capability Provider(s) for DTRIAC IT systems, and the End Users for DTRIAC IT systems;

10. PROCUREMENT –

procure hardware and software in support of DTRIAC IT systems as Contractor Acquired Property (CAP)

The initial Period of Performance is anticipated to be from 29 September 2024 through 29 September 2025 with three (3) 12-month option periods (concurrent or consecutive) ending no later than 29 September 2026. An optional 3-month transition period will be included at the end of the contract.

As part of your capability submittal, please provide your company’s experience with and approach to the following areas.1

1. PWS 3.1 Contract Management:

a. overall management of this contract;

b. recruiting for the typically high-competition labor categories required for this contract; and

c. management and integration of geographically separated onsite teams at

DTRIAC and DTRC (reference PWS 6.14), including travel requirements.

2. PWS 3.2 Operations:

a. serving as cloud service provider (software, platform, and infrastructure) for

DoD on premise clouds (reference PWS 8);

b. operating heterogenous, integrated IT hardware and software include from digitization and printing peripherals, internal and external networking, end user workstations, compute servers, network servers, storage servers, and repositories; and

c. end user support, training, and documentation.

3. PWS 3.3 Information Assurance, Cybersecurity, and Configuration Management:

a. DTRA IT systems and processes (reference PWS 6.2 and 6.13);

b. meeting DTRA and DoD information assurance (IA) and cybersecurity requirements for the DTRIAC IT systems; and

c. configuration management (CM) of the DTRIAC IT systems.

4. PWS 3.4 Software:

a. software development and management including DevSecOps (reference

PWS 6.3).

5. PWS 3.5 Cross-Domain:

a. DoD file transfer capabilities including between networks and between classification levels.

6. PWS 3.6 RDnets:

a. DoD on premise clouds;

b. HPCMP, DREN, and SDREN;

c. inter-network connectivity between DoD networks (DREN-NIPR and

SDREN-SIPR); and

d. handling and protection of classified data, including UCNI, FRD, RD, and

CNWDI, on DoD IT systems (reference PWS 6.4 and 6.13);

e. network servers;

f. virtualization;

g. containerization;

h. local user authentication; and

i. multi-factor role-based access control.

7. PWS 3.7 RD-NT Portals:

a. hosting of data, software, and compute resources for secure remote access;

b. remote user authentication; and

c. protection of classified data, including UCNI, FRD, RD, and CNWDI, during storage, processing, and transport on DoD networks.

8. PWS 3.8 DTRIAC DATA Lake:

a. Data as a Service; and

b. Dell Isilon storage systems.

9. PWS 3.9 Procurement:

a. documentation and internal processes for Contractor Acquired Property (CAP) purchases under a DoD contract.

Sources having the capability/concept to meet these requirements are invited to respond to this notice. Responses should be limited to a fifteen (15) page white paper in 12 point Times New Roman font, not including cover page, cover letter and table of contents. Any proprietary information should be clearly identified as such. Submitted data and information will not be returned. Any information submitted in response to this Sources Sought Notice is strictly voluntary. This notice is for information planning purposes and the Government will not pay or otherwise reimburse respondents for information submitted.

Electronic responses are required no later than 10 May 2024 at 16:00 ET and shall be submitted to Ms. Cheryl Beaty, Contract Specialist, at cheryl.d.beaty.civ@mail.mil> cheryl.d.beaty.civ@mail.mil, as well as Ms. Mary Kay Chase, Contracting Officer, at mary.k.chase2.civ@mail.mil. All emails should include in the subject line the Sources Sought Number and the submitting organization’s name. All documentation submitted in response to this sources sought shall become the property of the Government.

Unless otherwise stated herein, no additional information is available. Requests for same will be disregarded. There is no commitment by the Government to issue a solicitation, to make award or awards, or to be responsible for any monies expended by any interested parties in support of any effort in response to this Sources Sought Notice. Information provided herein is subject to change and in no way binds the Government to solicit or award a task order.

Contracting Office Address:

DTRA AL-ACS

8725 John J. Kingman Road Fort Belvoir, Virginia 22060-6201

Primary Point of Contact:

Cheryl Beaty cheryl.d.beaty.civ@mail.mil

Secondary Point of Contact:

Mary Kay Chase mary.k.chase2.civ@mail.mil mailto:cheryl.d.beaty.civ@mail.mil mailto:cheryl.d.beaty.civ@mail.mil mailto:mary.k.chase2.civ@mail.mil

PERFORMANCE WORK STATEMENT

DTRIAC Information Technology Support Services (ITSS)

Draft PWS for Sources Sought HDTRA124R0046

04 May 2024

1. INTRODUCTION

DTRA Organizations and Missions

DTRIAC Program

DTRIAC IT Systems

1.3.1. Additional Definitions

Cloud Computing paradigms

2. SCOPE

3. TASKS

Contract Management

3.1.1. Contract Transition In

Operations

Information Assurance, Cybersecurity, and Configuration Management

Software

3.4.1. Software

Cross-Domain

RDnets

3.6.1. DTRIAC Tenants

3.6.2. RDnets Implementation and Operation

RD-NT Portals

DTRIAC Data Lake

Procurement

Transition

3.10.1. Contract Transition Out

3.10.2. DTRA Out-Processing

Distribution Statement A: Approved for public release, distribution is unlimited.

4. PERFORMANCE REQUIREMENTS

5. DELIVERABLES

6. GENERAL PERFORMANCE REQUIREMENTS

Contractor use of DTRIAC resources in support of other contracts

DoD IT Systems

Software Development

Control of DTRIAC Records

6.4.1. Classification

6.4.2. Atomic Energy Act and related Caveats

6.4.3. Other Caveats

6.4.4. Export Control

6.4.5. DoD Distribution Statements

6.4.6. Interagency and Inter-Component Agreements

Contractor Site Leads

Security Clearances

Visit Authorization Letters (VALs)

Government Furnished Property

6.8.1. Government Furnished Property

6.8.2. Contractor Acquired Property

Training, Permits, and Licenses

6.9.1. Contractor Responsibility

6.9.2. Government Provided Training

Physical Security

6.10.1. Safeguarding Government Facilities, Equipment and Materials

6.10.2. Key Control

6.10.2.1. Control

6.10.2.2. Lock Combinations

Support Hours

Vehicles

Applicable Directives

Place of Performance

6.14.1. Other Work Locations

6.14.2. Travel

7. QUALITY

8. CLOUD COMPUTING TERMS

9. ACRONYMS

1. INTRODUCTION

DTRA ORGANIZATIONS AND MISSIONS

DTRIAC. The Defense Threat Reduction Information Analysis Center (DTRIAC) manages the DTRA nuclear testing archives, as well as other DTRA, DoD, and U.S. Government collections.

The DTRIAC mission is to provide timely electronic access to all nuclear weapons test data, legacy and current, to U.S. Government programs supporting U.S. Nuclear Deterrent missions.

For purposes of this task order, “DTRIAC” refers to the Program, and “the CENTER” refers to the DTRIAC main facility, located at DTRA Albuquerque, Kirtland AFB, New Mexico.

DTRIAC also operates a small auxiliary located at DTRA Headquarters (DTRC) at Fort Belvoir, Virginia.

DTRA. The Defense Threat Reduction Agency (DTRA) enables DoD and the U.S. Government to prepare for and combat weapons of mass destruction (WMD) and improvised threats and to ensure nuclear deterrence.

DTRA/RD. The DTRA Research & Development Directorate (DTRA/RD) provides science, technology and capability development investments that maintain the U.S. military's technological superiority in countering weapons of mass destruction & asymmetric threats, mitigate the risks of technical surprise and respond to the warfighter's urgent technical requirements.

DTRA/RD-NT. The DTRA Nuclear Technologies Department (DTRA/RD-NT) mission is to research, develop, and demonstrate technologies that support the nuclear deterrent by quantifying nuclear weapons effects, ensuring system survivability, and supporting attribution through nuclear forensics and prevent attacks against the US and its allies by verifying nuclear treaty compliance and locating and identifying nuclear threats.

DTRA/RD-NTI. The DTRA Nuclear Technologies Integration Division (DTRA/RD-NTI) mission is to deliver integrated applications, data analysis, and AI-enhanced capabilities in a cloud-ready, cross-cutting platform to support the full spectrum of nuclear operations, wargaming, and assessments. DTRIAC is a program under DTRA/RD-NTI.

DTRA/IT. The DTRA Information Management & Technology Directorate (DTRA/IT) mission is to project the Agency’s knowledge and capabilities for information sharing and situational awareness in a rapid and secure manner with DoD and Interagency Partners to counter and deter WMD and improvised threat networks.

DTRIAC PROGRAM

DTRIAC manages a vast collection of unclassified and classified knowledge bases. It promotes the use of existing Scientific and Technical Information (STI) relating to nuclear weapons development and testing, to meet Department of Defense (DoD) research, development, test, evaluation, training, mission rehearsal, logistics, maintenance, and operational requirements.

DTRIAC acquires digests, analyzes, evaluates, synthesizes, stores, publishes, and disseminates nuclear deterrent related STI.

Records in the DTRIAC collection are controlled by a number of laws, regulations, directives, instructions, manuals, and other issuances of the US Government and federal agencies (see paragraph 4.8 Control of DTRIAC Records). DTRIAC has requirements to respond to Freedom of Information Act (FOIA) requests that may pertain to items the collection, and to support Systematic Declassification Review of items in the collection for Automatic Declassification in accordance with (IAW) Executive Order 13526 (as amended, sections 3.3 and 3.4).

The program is organized into four (4) program areas:

• Core Operations (OPS) includes the traditional maintenance and cataloguing of the collection, support to end users, digitization of the collection, and operation of STARS and the Data Lake (as “End User” in the cloud paradigms discussed below);

• The Nuclear Information Analysis Center (IAC) includes specialized tasks that leverage the DTRIAC collection and capabilities for focused mission support and provisioning of subject matter experts (SMEs) to support DTRIAC internal and external tasks and analyses; and

• The Advanced Search and Discovery (ASD) Program is a Research and Development (R&D) initiative to develop and implement methodologies for the extraction, cleaning, organization, and discoverability of information from all media types in the DTRIAC collection and transition ASD methodologies for routine execution under the OPS and IAC tasks and provide analyses leveraging ASD capabilities. The ASD Program is under the RD- NTI AIML Portfolio.

• Information Technology Systems (ITS) includes the design, development, prototyping, implementation, information assurance (IA), management and operation of the DTRIAC IT systems as the Service Provider in the cloud paradigms discussed below.

This contract will focus primarily on DTRIAC ITS.

DTRIAC IT SYSTEMS

The developing DTRIAC ITS program area consists of several inter-related IT systems:

• The RDnets (RDnet-U, RDnet-S) is an on-premise cloud infrastructure support DTRA/RD

RDT&E activities. The RDnets will be physically located in the DTRA/IT Data Center in building 20676 at Kirtland AFB with connectivity to, and some hardware located at DTRC.

The RDnets will have primary network connectivity through the Defense Research and Engineering Networks (DREN and SDREN). The RDnet-S classified cloud will be accredited to support storage, processing, and transport of Nuclear Information (UCNI, FRD, RD, CNWDI).

• The DTRIAC Data Lake is the primary repository of the DTRIAC digital collection, hosted on RDnet-S, and utilizing Dell EMC Isilon (Powerscale) data storage systems. DTRIAC Data Lake Instances1 will be populated and maintained on RDnet-U and other DTRA and DoD

1 “Instances” of the DTRIAC Data Lake are flexible copies of subsets of the Data Lake, hosted on other DTRA or DoD networks or IT systems, and kept synchronized to the primary Data Lake under DTRIAC CDS.

networks and IT systems under DTRIAC CDS. The DTRIAC Data Lake will be managed under the Data as a Service (DaaS) cloud paradigm.2 The Data Lake will have the capacity and structure to flexibly host RD datasets beyond the DTRIAC collection. Other storage systems, managed by other RD programs, may also be stood up on the RDnets.

• The RD-NT Portals (RD-NT-U, RD-NT-S) will provide single-sign-on access to RD-NT capabilities for external end users, performers, and partners. RD-NT Portals servers will be hosted on RDnets.

• DTRIAC Cross Domain Support (CDS) is a service resourced by under DTRIAC as part of ITS outside this contract to provide data transfers to/from DTRIAC IT systems, in accordance with all DTRA cybersecurity requirements and processes

• The DTRIAC Tenant is a platform on the DTRA Integration, Test & Engineering Center (DITEC) that support OPS, IAC, ITS, and ASD. DITEC is an infrastructure provided by DTRA IT as Infrastructure-as-a-Service (IaaS).

• DTRIAC Configuration Management (CM) is the process for configuration control for OPS, IAC, ASD, and ITS data and software.

The DTRIAC IT infrastructure includes but is not limited to, the routers, circuits, firewalls, interconnecting cabling, network security equipment, network monitoring equipment, and end user IT equipment.

1.3.1. Additional Definitions

• The DTRIAC Collection consists of all materials held by DTRIAC, whether accessed or not accessed, whether physical or digital, in all media. The Collection includes Scientific and Technical Information (STI) and non-STI. Excluded are DTRIAC programmatic and working records, non-DTRIAC programmatic records held by DTRIAC, and records stored or archived at DTRIAC on behalf of other DTRA or Government offices.

• The DTRIAC Digital Collection consists of all materials in the DTRIAC collection that have been converted to standard formats readable by common contemporary IT systems. The DTRIAC Digital Collection will be stored primarily in the DTRIAC Data Lake and Instances, as well as on transfer media as needed. OPS, IAC, ITS, and ASD working files will be moved to the DTRIAC Data Lake according to Standard Operating Procedures (SOPs) developed for each program area.

CLOUD COMPUTING PARADIGMS

Under this contract, DTRIAC IT systems will be managed by analogy to standard Cloud Computing paradigms.3 Cloud paradigms are becoming the standard in DoD, and have the advantage of being formalized by US Government, DoD, DISA, and DTRA issuances.4

The RDnets, DTRIAC Data Lake, and RD-NT Portals will be operated as Platform as a Service (PaaS) with the contractor in the role of Service Provider.

2 See for instance the Wikipedia entry for Data as a Service (DaaS), https://en.wikipedia.org/wiki/Data_as_a_service 3 “Cloud” only by analogy, as the DTRIAC IT systems are not true Cloud services.

4 See paragraphs 6.13 Applicable Directives and 8 Cloud Computing Terms.

https://en.wikipedia.org/wiki/Data_as_a_service

Details of the assignments of roles and responsibilities for each DTRIAC IT system are given in the Task paragraphs below.

2. SCOPE

The contractor shall perform mission Information Technology (IT), Cybersecurity, and Information Assurance (IA) support for the DTRIAC program and DTRIAC IT systems including:

• oversee the performance of all requirements defined in this TO:

• serve as Service Provider for DTRIAC IT systems (see paragraph 8 Cloud Computing Terms);

• provide the DTRIAC Configuration Management (CM) process, including the DTRIAC

Software Repository;

• support DTRIAC in presenting DTRIAC requirements to the DTRA/IT the Requirements

Review Board (RRB), Engineering Review Board (ERB) and Change Control Board (CCB) regarding IT systems managed by DTRA/IT;

• sustain operation of DTRIAC IT systems;

• provide broad spectrum Cybersecurity and IA support for DTRIAC IT system owners or systems connected to DTRA managed networks;

• provide network and system architecture and design services for new or evolving DTRIAC IT systems;

• provide cross-domain support to the overall DTRIAC program;

• provide software development, implementation, and configuration support, including programming and scripting as needed to meet other requirements of this PWS;

• provide data architecture, configuration, and engineering support to host and organize diverse and inhomogenous datasets as needed to meet other requirements of this PWS;

• prototype, test, evaluate, and implement DTRIAC IT systems;

• provide development capabilities and project management support to implement DTRIAC requirements for application and capability integration;

• provide training and documentation to the DTRIAC Government Program Manager (PM), the

Contracting Officer’s Representative (COR) for this contract, the Capability Provider(s) for DTRIAC IT systems, and the End Users for DTRIAC IT systems.

3. TASKS

CONTRACT MANAGEMENT

The contractor shall:

• work with the COR to adapt priorities, timelines, and contract staffing to meet DTRIAC mission requirements;

• provide the necessary resources to effectively oversee the performance of all requirements defined in this contract;

• assign a contract Lead/Manager who will be accountable for the overall performance outcomes identified within this contract;

• develop and deliver monthly performance, and cost reports (CDRL A001 Monthly Performance and Cost Report);

• prepare and maintain timeline and resource requirements for DTRIAC IT systems supported under this contract and deliver the timelines and resource requirements as part of the monthly status report (CDRL A002 Monthly Status Report);

• meet weekly with the COR, pending COR schedule and availability, to report on all work performed under the contract (all active CLINs), and to report on risks and issues identified or encountered during the reporting period (CDRL A003: Weekly Status Meeting);

• Present Interim Program Reviews (IPRs) to the COR covering all work performed under this contract (CDRL A004: Program and Gate Reviews);

• present significant plans and results through Gate Reviews for approval by the COR, with attendance by stakeholders as selected by the COR (CDRL A004: Program and Gate Reviews).

3.1.1. Contract Transition In

The contractor shall plan for and execute a transition-in strategy to provide for the on-boarding of appropriately qualified personnel, with the required DoD security clearances and eligibilities, needed to support a smooth and seamless transition from the incumbent support team to “full performance” within 60 calendar days of contract award. Transition-in includes all staffing activities, as well as the necessary knowledge transfer and capture to ensure “work-in-progress” is smoothly transitioned, and mission support is not interrupted. Transition-in shall include validation of DoD Cybersecurity Workforce Certification requirements IAW DoD Directive 8140.01, Cybersecurity Workforce Management.

OPERATIONS

The contractor shall provide operational support for DTRIAC IT systems including:

• provide the full range of support services required to manage the day-to-day operations and systems administration, ensuring reliable, secure, and efficient availability of the current and evolving DTRIAC IT systems;

• support DTRIAC IT systems on multiple computer networks at various levels of security classification, in support of the DTRA/IT Systems Administration Group;

• plan, manage, back up, troubleshoot, fix/repair, install OEM and security patches and upgrades;

• monitor the systems to ensure continuous, secure, and efficient access;

• provide selected database administration, not including content management;

• maintain real-time situational awareness of the systems and supported environments;

• lead restorative actions to ensure all networks remain up and operational;

• continuously monitor DTRIAC IT systems’ infrastructure equipment and components to support appropriate technical refresh plans;

• ensure continuous and complete role-based access to all DTRIAC IT systems, components, and associated storage systems and devices for the COR and other DTRA Government and contractor personnel as designated in writing by the COR;

• ensure protection of all DTRIAC information on the IT systems according to paragraph 6.4 Control of DTRIAC Records below;

• provide the Capability Provider(s) and End Users IT remediation and support to allow DTRIAC to effectively leverage the full capabilities of the available IT services and capabilities in direct support of the DTRIAC and RD-NT missions.

INFORMATION ASSURANCE, CYBERSECURITY, AND CONFIGURATION

MANAGEMENT

The contractor shall provide broad-based Information Assurance (IA) and Cybersecurity support for DTRIAC IT systems including but not limited to:

• develop and manage the DTRIAC Configuration Management (CM) process as an internal

RRB/ERB/CCB process for the DTRIAC IT systems which are managed by the contractor as Service Provider;

• perform IA to maintain Risk Management Framework (RMF) tasks, documentation and system accreditation required to achieve and maintain system Authority to Operate (ATO);

• develop Service Level Agreements (SLAs) defining component roles and responsibilities, and system availability and resource requirements, and route for signature by the COR and responsible POCs for all components accepting responsibilities under the SLA;

• coordinate closely with the Government (DTRA/RD and DTRA/IT), other Government partners (e.g, HPCMP), and the Capability Provider(s) on system SLAs, ATOs and IA;

• ensure protection of all DTRIAC information on the IT systems according to paragraph 6.4 Control of DTRIAC Records below;

• respond within suspense to DTRA/IT taskers regarding DTRIAC IT systems and maintain a record, easily accessible by the COR, of all taskers and responses;

• ensure security upgrades, patches, configurations, and logging are introduced and implemented with appropriate priority commensurate with the level of exposure to potential cybersecurity threats.

SOFTWARE

3.4.1. Software

The contractor shall provide software support as needed to meet the requirements of other tasks of this PWS including:

• identify required software;

• procure software as needed in accordance with paragraph 3.9 Procurement below;

• develop software, including but not limited to database and OS scripts, for purposes including but not limited to automation of recurring tasks or tasks which are unfeasible, unacceptably expensive, or prone to error if performed manually, or tasks for which scripts can provide valuable documentation of the process employed in performing the task;

• verify software is validated for deployment on targeted IT systems according to DTRA requirements and processes;

• install and configure software, and maintain configuration control;

• ensure all software development, implementation, and configuration is performed in accordance with the requirements of paragraph 6.3 Software Development below.

CROSS-DOMAIN

For this task, “portable media” includes but is not limited to CDs, DVDs, external FIPS-compatible hard drives, and other backup and archive media used by DTRIAC.

Transfers performed under this paragraph may be via portable media or via network systems5 approved for such transfers by DTRA/IT and as approved by the COR and DTRA/IT.

The contractor shall provide cross-domain support for data transfers to/from DTRIAC IT systems, in accordance with all DTRA cybersecurity requirements and processes, including:

• developing SharePoint workflows or other system for receiving requests for cross-domain support, obtaining COR per-request review and approval, and recording request status and any supporting artifacts;

• transferring data between DTRIAC IT systems, including between classification levels;

• transferring data to external (non-DTRA) parties;

• engage the DTRA/IT Cross-Domain team to ensure all data transfers under this task follow

DTRA best practices, requirements, and processes;

• when required, request and receive approvals from the DTRA/IT Authorizing Official (AO) prior to executing data transfers;

• when required, obtain required Classification and other reviews from DTRA/RD offices as needed prior to executing data transfers;

• include a summary of transfer activities during the reporting period in the monthly status report

(CDRL A002 Monthly Status Report).

• ensure protection of all DTRIAC information when resident on the IT systems and during transfer according to paragraph 6.4 Control of DTRIAC Records below.

5 Examples of available DoD file transfer systems are the DoD Intelligence Information System (DoDIIS) DOTS webtransfer portal (https://dots.dodiis.mil/webtransfer/ ) and the Department of Defense Secure Access File Exchange system (DOD-SAFE;

https://safe.apps.mil/ ).

https://dots.dodiis.mil/webtransfer/ https://safe.apps.mil/

RDNETS

The priority under this task is RDnet-S. RDnet-U architecture and configuration will follow RDnet-S to the extent possible. RDnet-U will be implemented in parallel with RDnet-S following the requirements for RDnet-S below.

Management of user accounts, content, and end user applications will be the primary responsibility of the DTRIAC Program and Capability Providers for the system and will be resourced outside of this contract.

The COR will arrange for support to the contractor from the DoD HPCMP DREN Program.

3.6.1. DTRIAC Tenants

The contractor shall, acting as Platform provider for the DTRIAC Tenants,:

• design, implement, obtain authorizations to operate, and operate virtual machines and containers on DITEC (-U and -C), for prototyping capabilities and solutions for the RDnets, and to support OPS, IAC, ASD, and ITS O&M and R&D activities;

• perform RDnets prototyping on the workstations;

• support the use of the workstations by DTRIAC and other users, as designated in writing by the COR, to manage the DTRIAC digital collection;

• support the use of the workstations by DTRIAC and other users, as designated in writing by the COR, to prototype and test data science methodologies and tools relevant to the DTRIAC digital collection.

3.6.2. RDnets Implementation and Operation

The contractor shall, with regard to the RDnets,:

• prepare and maintain a timeline and resource requirements for system development and operation;

• collect functional requirements from program stakeholders as selected by the COR;

• collect cybersecurity and IA requirements from DTRA/IT;

• propose system configuration changes including prototypes, implementation, testing, ATO, and operation of the system as needed to meet and maintain the functional, cybersecurity, and IA requirements and present to the COR for approval (CDRL A004 Program and Gate Reviews);

• support installation and configuration of install and configure the systems;

• refine the configuration, and implement, test, and operate the system according to the approved plan;

• in accordance with paragraphs 3.2 Operations and 3.3 Information Assurance above, serve as

Service Provider for the system under PaaS paradigm, responsible for all system components except user account and content management;

• in accordance with paragraph 3.5 Cross-Domain above perform cross-domain data transfers and synchronization;

• propose and implement user authentication for the system;

• plan, execute, and complete function testing against the functional requirements;

• support and collaborate with the Capability Provider(s) and other DTRA/RD-NT programs in the installation, hosting, and use of data and capabilities on the system;

• support and collaborate with DTRA and HPCMP in obtaining and maintaining required authorizations to connect RDnet-S to SDREN and RDnet-U to DREN;

• provide training and informational materials as required to support to system users and

Capability Providers (CDRL A005 Informational and Training Materials).

RD-NT PORTALS

The priority under this task is RD-NT-S. RD-NT-U architecture and configuration will follow RD-NT-S to the extent possible. RD-NT Portals implementation will depend on re-evaluation of mission priorities during execution of this contract.

Management of user accounts, content, and end user applications will be the primary responsibility of the DTRIAC Program and Capability Providers for the system and will be resourced outside of this contract.

The contractor shall, with regard to the RD-NT Portals,:

• prepare and maintain a timeline and resource requirements for system development and operation;

• collect functional requirements from program stakeholders as selected by the COR;

• collect cybersecurity and IA requirements from DTRA/IT;

• propose system configuration changes including prototypes, implementation, testing, ATO, and operation of the system as needed to meet and maintain the functional, cybersecurity, and IA requirements and present to the COR for approval (CDRL A004 Program and Gate Reviews);

• in accordance with paragraphs 3.2 Operations and 3.3 Information Assurance above, serve as Service Provider for the system under PaaS paradigm, responsible for all system components except user account and content management;

• in accordance with paragraph 3.5 Cross-Domain above perform cross-domain data transfers and synchronization;

• propose and implement configuration changes as needed for user authentication of the system through DoD Common Access Card (CAC) (RD-NT-U), DoD Secret Internet Protocol Router Network (SIPR) tokens (RD-NT-C), or RSA token;

• plan, execute, and complete function testing against the functional requirements;

• support and collaborate with the Capability Provider(s) and other DTRA/RD-NT programs in the integration and hosting of other portals, data, capabilities, and collaboration sites under the system;

• provide training and informational materials as required to support to system users and Capability Providers (CDRL A005 Informational and Training Materials).

DTRIAC DATA LAKE

The primary DTRIAC Data Lake will be implemented on a Dell EMC Isilon Network Attached Storage (NAS) system. The COR will arrange for support to the contractor from the commercial vendor for the Isilon system.

The priority under this task is the primary DTRIAC Data Lake on RDnet-S. Implementation of the unclassified DTRIAC Data Lake and other Instances1 will depend on re-evaluation of mission priorities during execution of this contract.

Management of user accounts, content, and end user applications will be the primary responsibility of the DTRIAC Program and Capability Providers for the system and will be resourced outside of this contract.

The contractor shall, with regard to the DTRIAC Data Lake,:

• prepare and maintain a timeline and resource requirements for system development and operation;

• collect initial functional requirements from program stakeholders as selected by the COR;

• collect cybersecurity and IA requirements from DTRA/IT;

• propose system configuration changes including prototypes, implementation, testing, ATO, and operation of the system as needed to meet and maintain the functional, cybersecurity, and IA requirements and present to the COR for approval (CDRL A004 Program and Gate Reviews);

• support installation and configuration of the system by DTRA and the hardware vendor(s);

• refine the configuration, and implement, test, and operate the system according to the approved plan;

• in accordance with paragraphs 3.2 Operations and 3.3 Information Assurance above, serve as

Service Provider for the system under PaaS paradigm, responsible for all system components except user account and content management;

• in accordance with paragraph 3.5 Cross-Domain above perform cross-domain data transfers and synchronization;

• plan, execute, and complete function testing against the functional requirements;

• support and collaborate with the Capability Provider(s) and other DTRA/RD-NT programs in the installation, hosting, and use of data and capabilities on the system;

• support and collaborate with the Capability Provider(s) in configuring and optimizing the system to meet mission requirements for OPS, IAC, ASD, and other RD-NT and RD programs;

• configure, implement, and maintain synchronization of an unclassified DTRIAC Data Lake

Instance1 on the RDnet-U;

• configure, implement, and maintain synchronization other Instances1 of the Data Lake as designated by the COR;

• provide training and informational materials as required to support to system users and

Capability Providers (CDRL A005 Informational and Training Materials).

PROCUREMENT

With the approval of the COR, the Contractor shall procure Contractor Acquired Property (CAP) to support specialized mission operations and critical needs.

Procurements:

• will be incidental as required to accomplish the tasks specifically defined in this contract;

• may include, but are not limited to: hardware; software licensing; maintenance and support; or training;

• must follow DTRA processes and requirements to obtain Chief Information Officer (CIO)

Approval for each purchase.

Generally, procurements under this task will be approved by the COR with Contracting Officer (KO) and CIO concurrence and documented with a digitially signed email.

See also paragraph 6.8 Government Furnished Property below.

TRANSITION

3.10.1. Contract Transition Out

The contractor shall plan for and support the smooth and seamless transition-out at the end of the performance period. The contractor shall develop and deliver a transition-out plan defining their knowledge transfer plan with specific emphasis on transiting work-in-progress. The contractor shall coordinate with the incoming workforce (government or contactor) as necessary to enable a seamless transition with minimum interruption of mission support.

The contractor shall, in coordination with the COR and the incoming performer, brief the incoming performer personnel on the operation and management of the DTRIAC IT systems, to include but not limited to, the following:

• system architectures and configurations;

• data structures;

• data locations;

• cybersecurity protocols;

• passwords;

• software;

• software licenses and warranties;

• software vendors and points-of-contact.

3.10.2. DTRA Out-Processing

The contractor shall, in coordination with the COR, out-process all contractor personnel supporting this contract with exceptions for personnel supporting or transitioning to other active contracts. Out-processing will meet DTRA out-processing requirements.

4. PERFORMANCE REQUIREMENTS

Performance requirements are defined in the Quality Assurance Surveillance Plan (QASP) associated with this PWS.

5. DELIVERABLES

In support of the requirements in this PWS, the contractor shall develop and deliver a variety of reports, analyses, recommendations, and plans. The specific requirement for content, format, and delivery timing for each deliverable is defined in the Contract Data Requirements Lists (CDRL;

DD Form 1423). The following table summarizes the deliverables associated with this PWS.

Table 1-- Summary of Contract Line Item Deliverables (CDRLs)

PWS ¶ CDRL

3.1 CDRL A001 Monthly Performance and Cost Report

3.1 CDRL A002 Monthly Status Report

3.1 CDRL A003 Weekly Status Meeting

3.1, 3.5-3.8 CDRL A004 Program and Gate Reviews

3.6-3.8 CDRL A005 Informational and Training Materials

6.8.1 CDRL A006 Master Government Property List

6. GENERAL PERFORMANCE REQUIREMENTS

CONTRACTOR USE OF DTRIAC RESOURCES IN SUPPORT OF OTHER

CONTRACTS

The contractor shall obtain written concurrence from the COR prior to:

• using DTRIAC resources or spaces;

• performing work in DTRIAC spaces;

• adding records to, modifying records in, or removing records from the DTRIAC collection;

• bringing items or materials into, or removing items from, DTRIAC spaces; or

• utilizing DTRIAC IT systems;

in support of any other contract or activity for which the contractor is the performer, subcontractor, consultant, or otherwise receiving compensation, or in which the contractor is participating.

DOD IT SYSTEMS

The contractor shall perform all work under this contract on DoD IT systems selected by the COR, unless an exception is granted in writing by the COR.

The contractor shall not move or copy DTRIAC data, including data produced under this contract, to any IT system not selected by the COR, unless required to do so by other paragraphs of this PWS, or written concurrence is provided by the COR.

The contractor shall utilize the DTRIAC CDS process to move or copy DTRIAC data into, out of, or between DTRIAC IT Systems.

The contractor shall not move any software or libraries into or between any DTRIAC or DoD IT System, except through the DTRIAC CM process.

SOFTWARE DEVELOPMENT

The contractor shall employ, to the extent appropriate to the work being performed, DevSecOps methodology as directed in the Capabilities Planning Guidance (see paragraph 6.13 Applicable Directives).

The contractor shall ensure configurations and installations under this contract are designed to meet the Information Assurance (IA) requirements set forth in DoDI 8500.2 (see paragraph 6.13 Applicable Directives).

The contractor shall ensure all IA implementations under this contract recieve certification in accordance with DoDI 8510.01 (see paragraph 6.13 Applicable Directives).

The contractor shall ensure review and acceptance by the DTRA Senior Information Security Officer (SISO) of documented source code analysis findings prior to installation of any software deliverable on a DTRA operational network, integration with any operational system, or to support a Certificate of Networthiness issued by DTRA.

The contractor shall ensure all source code developed under the contract is delivered to the Government through software repository(-ies) designated by the COR. The contractor shall ensure all source code developed under the contract is delivered to the Government through the DTRIAC CM process, including through regular check-ins of all software during development to a software repository as designated by the COR.

CONTROL OF DTRIAC RECORDS

Marking, handling, access and dissemination of records in the DTRIAC collection are controlled by a number of laws, regulations, directives, instructions, manuals, and other issuances of the US Government, DoD, DOE, DTRA, and other federal agencies. Many of these are listed in paragraph 4.9 Applicable Directives.

DTRIAC follows additional guidelines set by the DTRA Research and Development (RD) Classification Review Office. Record, editing, and marking performed by DTRIAC is preliminary and subject to review by the RD Classification Office and the DTRA Public Affairs Office.

Specific controls are described in the following paragraphs.

6.4.1. Classification

For reference, see DoD Manual 5200.01 Volume 3 DoD Information Security Program:

Protection of Classified Information, and references therein.

• U – Unclassified

• C – Confidential

• S – Secret

• TS – Top-Secret

• United Kingdom (UK) Atomic

6.4.2. Atomic Energy Act and related Caveats

For reference, see DoD Instruction 5210.02 Access to and Dissemination of Restricted Data and Formerly Restricted Data, and references therein.

• UCNI – Unclassified Controlled Nuclear Information

• FRD – Formerly Restricted Data

• RD – Restricted Data

• CNWDI – Critical Nuclear Weapons Design Information

• DOE Sigma Information

6.4.3. Other Caveats

• FOUO – For Official Use Only

• OUO – Official Use Only

• NATO – North Atlantic Treaty Organization information

• CUI – Controlled Unclassified Information

6.4.4. Export Control

• ITAR – The International Traffic in Arms Regulations (22 CFR 120-130)

6.4.5. DoD Distribution Statements

Applies formally only to DoD Scientific and Technical Information (STI) records.

For reference, see DoD Instruction 5230.24 Distribution Statements on Technical Documents, and references therein.

DoD STI records without formal markings, or with obsolete markings, have typically been handled as Distribution F, though that policy is under review.

Handling of STI records for which DTRA is the Controlling Distribution Office (CDO), including dissemination and changing of Distribution Statements, is specified in DTRA Instruction 3200.12 Scientific and Technical Information Program.

DoD Distribution Statement categories are:

• Distribution A

Approved for public release: distribution unlimited.

• Distribution B

Distribution authorized to U.S. Government agencies. Other requests for a Distribution B records shall be referred to the controlling DoD office or higher DoD authority.

• Distribution C Distribution authorized to U.S. Government agencies and their contractors. Other requests for a Distribution C records shall be referred to the controlling DoD office or higher DoD authority.

• Distribution D Distribution authorized to DoD and DoD contractors. Other requests for a Distribution D records shall be referred to the controlling DoD office or higher DoD authority.

• Distribution E Distribution authorized to DoD component only. Other requests for a Distribution E records shall be referred to the controlling DoD office or higher DoD authority.

• Distribution F Further dissemination only as directed by the controlling DoD office or higher DoD authority.

• Other legacy and obsolete markings.

6.4.6. Interagency and Inter-Component Agreements

Dissemination of many subsets and sub-collections held by DTRIAC are controlled by Interagency or Inter-Component agreements, either formal (e.g., through memoranda), or less-formally through long-standing agreements between DTRIAC and the Controlling Distribution Office (CDO) for the sub-collection. One such subset are records with significant DOE equities, which do not have DoD Distribution markings.

CONTRACTOR SITE LEADS

The contractor must designate a Site Lead for the CENTER, who shall distribute workload to the contractor employees and must be responsible for the contractor’s performance of the work; and a local Site Lead for the DTRC location who shall distribute workload to the contractor employees and must be responsible for the contractor’s performance of the work at the DTRC.

The Site Leads will be the contractor’s interface with the COR. The name of the contractor Site Leads for each location, and an alternate(s), who must act for the contractor when the Site Lead is absent, shall be designated in writing to the COR. The CENTER Site Lead shall be located at the CENTER, building 20676, Kirtland AFB, NM. The DTRC Site Lead shall be located at the

DTRC, Fort Belvoir, VA, and shall attend regular weekly meetings, and provide reports, as requested. Work assignments for DTRC and communications with the contractors in DTRC will be accomplished by phone, Video Teleconference (VTC), or e-mail. The Site Leads or their designated alternatives must work with the COR to resolve problems that may occur at both ABQ and DTRC.

The contractor Site Leads or alternates (in the absence of the Leads) must have full authority to act for the contractor on all contract requirements relating to daily operation of the contract.

SECURITY CLEARANCES.

The contractor shall possess and maintain a SECRET facility clearance granted by the Defense Security Service (DSS). Contractor personnel performing work on this contract shall be U.S.

citizens and shall have been granted a minimum of a SECRET security clearance. A minimum of two (2) personnel with TOP SECRET Clearances will be required for the Kirtland AFB, NM location.

Contractors require access to FRD/RD/CNWDI material and information to perform official duties require a final U.S. government security clearance and briefings. This information is classified and is controlled under the Atomic Energy Act of 1954. Overall security oversight for RD and FRD is under the cognizance and control of the Department of Energy. Contractor personnel given access to RD and FRD shall be knowledgeable of requirements in 10CFR1045, "Nuclear Classification and Declassification," and DoD Directive 5210.2, "Access to and Dissemination of Restricted Data," and shall be trained in accordance with 10CFR1045.35(a)".

The contractor shall comply with all terms of the Security Agreement (DD Form 254), including the National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22-M, and any revisions to that manual. Contractor shall comply with all other DoD requirements for the handling, storage and transportation of classified documents.

A Visitor Request must be provided for each contractor employee working on this contract who will require access to any DTRA site. The Contractor shall provide all forms and information and apply for the Contractor employees.

The contractor shall comply with DTRA’s security policy in the handling or transporting of sensitive or classified items. In addition, the contractor shall ensure appropriate measures are followed in order to secure DTRA storage facilities during and outside of normal operational hours. The contractor shall maintain physical security of all Government owned supplies, material, or equipment in his custody.

VISIT AUTHORIZATION LETTERS (VALS)

The contractor’s employees performing work at DTRA shall require unescorted entry into work areas wherein special entry controls have been established for the protection of classified information. Before any contractor employee performs work at DTRA, the contractor shall verify and submit written proof of security clearance information (Visit Authorization Letter (VAL)) to the DTRA Security Office. The VALs for collateral security clearance shall be typewritten, contain the information specified in paragraph 6-103 of the NISPOM, and be submitted to the DTRA Security Support Branch (Visitor Control). The term of the VAL shall be for the term of the contract.

GOVERNMENT FURNISHED PROPERTY

6.8.1. Government Furnished Property

The Government may provide Government Furnished Property, Equipment or Material (GFP/GFE/GFM) to support execution of the TO.

No GFP/GFE/GFM will be provided at contract award.

DTRA may provide Government equipment to the contractor for use offsite, such as laptops for telework.

The contractor shall:

• comply with the contract clauses for accountability of Government Property in the possession of contractors;

• report any changes to the assigned GFP/GFE/GFM on a monthly basis via the Master

Government Property List (CDRL A006 Master Government Property List).

6.8.2. Contractor Acquired Property

If the contractor is required to purchase any Contractor Acquired Property (CAP), all purchases of hardware and software shall be in accordance with the procedures of Federal Acquisition Regulations (FAR) Part 45 and Defense Federal Acquisition Regulations (DFAR) and shall be approved to purchase, by the Contracting Officer’s Representative (COR), and shall be considered Government Property. As such, all care, maintenance, and consideration apply, and the same as it would for GFE hardware or software (see paragraph 6.8.1 Government Furnished above). The contractor shall be liable for Government Property in their possession pursuant to FAR 52.245-1, as applicable.

TRAINING, PERMITS, AND LICENSES

6.9.1. Contractor Responsibility.

The contractor shall ensure that all personnel are properly trained to perform the assigned tasks.

The contractor personnel operating Government vehicles shall have a valid driver’s license and…