SOW Gen Remote Monitoring.pdf

“Mission Ready Warfighters Deterring Conflict…TOGETHER!”

Statement of Work (SOW)

Remote Generator Monitoring

1. The 628th Civil Engineer Squadron (CES) requires a new Facility-Related Control System (FRCS) for generator monitoring. The current system is non-existent and needs to be a modern, secure, on-premise solution that meets all current Air Force cybersecurity standards. The primary objective of this project is to procure and install a new, on-premise generator monitoring system and replace the associated network hardware to ensure continuous, secure, and reliable operational oversight.

2. The contractor shall provide all necessary personnel, materials, and services to perform the work as detailed in the following tasks.

3. Scope of Work

a. Task 1: System Procurement and Compliance

(1) System Requirements: The contractor shall provide a complete and new on-premise generator monitoring system. The system shall not utilize any cloud-based services or cellular connections for data transmission.

(2) Cryptographic Standards: All system components that use cryptography must be NIST FIPS 140-2/3 validated.

b. Task 2: Network Hardware Installation

(1) Switch Replacement: If contractor needs to replace any network switches, they must be replaced with new, managed switches that are compliant with the DoD Approved Products List (APL). See Attachment 1 for list of current switches.

c. Task 3: System Installation

(1) Component Installation: The contractor shall install all new system components, including servers, monitors, and network hardware.

(2) Cabling: The contractor shall install all necessary low-voltage data cabling.

d. Task 4: System Documentation

(1) RMF Support: Upon completion of the installation, the contractor shall provide a comprehensive documentation package to support the Risk Management Framework (RMF) process. This shall include system diagrams, hardware/software lists, and all necessary information for security control assessment.

4. Deliverables

a. The following deliverables are required under this contract. All deliverables must be submitted to the Government Project Manager for review and approval.

ID Deliverable Description Recipient

D-1 A fully installed and functional on-premise generator monitoring system.

628th CES PM

D-2 Fully installed and configured managed network switches. 628th CES PM

D-3 A post-installation report detailing the work performed and confirming system functionality.

628th CES PM

D-4 All required Risk Management Framework (RMF) support documentation.

628th CES PM /

ISSO

5. The government will provide the contractor with necessary access to facilities, existing system documentation, and 120V AC power outlets required to perform the work. All access requests must be coordinated at least 10 business days in advance.

Appendixes

a. System connectivity requirements and justification

Attachments

1. Generator Equipment List

APPENDIX A: SYSTEM CONNECTIVITY REQUIREMENTS AND JUSTIFICATION

1. PLAIN LANGUAGE JUSTIFICATION FOR PROHIBITING WI-FI

a. Physical Security: Wi-Fi signals are radio waves that travel through walls and can be intercepted from outside the secure facility (e.g., from a parking lot or adjacent building). This creates an unacceptable physical security risk. Hardwired, cabled connections ensure that all system data is physically contained within the facility.

b. Reliability: Critical infrastructure control systems require the highest level of reliability. Wired connections are not susceptible to radio frequency (RF) interference from machinery, other electronic devices, or building materials (like concrete and steel). This ensures a stable, consistent connection that Wi-Fi cannot guarantee.

c. Access Control: A wired network allows for absolute control over system access.

A device must be physically plugged into a specific, managed port to communicate. Wi-Fi is a shared, broadcast medium, making it significantly more difficult to control and monitor every device that may attempt to connect.

2. IT LANGUAGE / TECHNICAL JUSTIFICATION

a. Compliance with DAFGM 2024-32-01 & UFGS 25 05 11: These directives mandate a defense-in-depth security posture for all Facility-Related Control Systems (FRCS). A physically bounded, wired network is the foundational layer for implementing mandatory NIST SP 800-53 controls, including AC-4 (Information Flow Enforcement), PE-3 (Physical Access Control), and SC-7 (Boundary Protection).

b. Attack Surface Reduction: Prohibiting Wi-Fi and other wireless broadcast capabilities is a primary method of reducing the system’s attack surface. Wireless access points are common vectors for reconnaissance, denial-of-service, and intrusion. Eliminating this vector is a non-negotiable security requirement.

c. Risk of Non-Compliant Cryptography: Many off-the-shelf Wi-Fi solutions do not use FIPS 140-2/3 validated cryptography for all management and control frames.

Furthermore, per UFGS 25 05 11, any wireless solution for a moderate-impact system must meet a minimum of FIPS 140-2 Level 2, a standard most commercial Wi-Fi products fail to meet.

d. Spectrum Management (DoDI 8420.01): Any device that intentionally broadcasts a radio signal on a DoD installation must be registered with and approved by the Base Spectrum Manager to ensure deconfliction with critical frequencies (e.g., flightline, emergency services). A fully wired system bypasses this entire regulatory and approval process.