Strategic Planning Operational Test and Evaluations and Architecture Evaluation SOW.pdf

PROCUREMENT SENSITIVE

UNCLASSIFIED//FOR OFFICIAL USE ONLY

DEPARTMENT OF HOMELAND SECURITY

Cybersecurity Division (CSD)

Statement of Work

Strategic Planning, Operational Test & Evaluation, and Architecture Evaluation

1 Cybersecurity Division CISA’s cybersecurity mission is to defend and secure cyberspace by leading national efforts to drive and enable effective national cyber defense, resilience of NCFs, and a robust technology ecosystem. CISA’s Cybersecurity Division (CSD) is responsible for executing this mission by fortifying the nation’s cyber defenses against immediate threats and vulnerabilities, building the nation’s long-term capacity to withstand and operate through cyber incidents, and through achieving a defensible cyberspace ecosystem by ensuring that changes in the ecosystem shift the advantage to network defenders. CSD is the lead federal entity responsible for the protection of Federal Civilian Executive Branch (FCEB) systems and networks. CSD also provides critical capabilities and insights to SLTT and Critical Infrastructure (CI) owners and operators to help identify and reduce operational and strategic cyber risk.

To achieve this mission, CSD is organized into several Subdivisions:

• Office of the Technical Director, which advances, coordinates, and aligns technical capability efforts across CSD to enable, enhance, and advance CSD mission effectiveness.

• Threat Hunting, which identifies, analyzes, detects, and responds to significant cyber threats to the United States;

• Vulnerability Management, which enables stakeholders to understand and manage vulnerabilities in the Nation's critical infrastructure;

• Joint Cyber Defense Collaborative, which leads, enables, and coordinates CSD operational planning, partnerships, integration, and production efforts;

• Capacity Building, which provides best-in-class cybersecurity services and guidance to enhance CSD customers' cybersecurity posture.

• Mission Engineering, engineers, acquires, integrates, and delivers timely, operationally meaningful, and resilient cyber mission capabilities

1.1 Mission Engineering (ME)

Mission Engineering’s (ME) mission is to acquire, engineer, and provide life cycle support for the capabilities required to execute CSD's federal enterprise cybersecurity mission. To meet that mission, ME designs, develops, tests, deploys, integrates, sustains, and maintains the mission systems, administrative services, and shared infrastructure in support of CSD’s cybersecurity mission. ME is also responsible for executing the Level 1 cybersecurity program, the Cyber Analytic and Data System (CADS) Program. Through the CADS Program, ME performs internal CSD cyber mission engineering and is the service provider for mission systems infrastructure, data ingestion, data management, analytics, and information sharing capabilities.

Figure 1 provides a high-level depiction of the ME organizational structure.

1.2 Threat Hunting (TH)

TH within CSD is responsible for identifying, analyzing, detecting, and responding to significant cyber threats to the United States to ensure they are unable to achieve their objectives.

TH is CISA’s front line in identifying and tracking threats; detecting malicious activity in federal civilian executive branch, critical infrastructure, and partner networks; proactively hunting for malicious cyber activity; and responding to cyber incidents. TH leads the Federal response by serving as its primary operational arm in the execution of the asset response mission delegated to DHS in Presidential Policy Directive 41 (PPD-41).

In addition to the CISA Director’s Guiding Principles of (1) Leadership and Collaboration, (2) Risk-Prioritization, (3) Results-Oriented, (4) Respect for National Values, and (5) Unified Mission and Agency, TH’s work is further influenced by these additional principles:

• Knowledge Sharing: TH’s mission can only be achieved when we share our knowledge on a broad scale. We place great emphasis on communication, pushing ourselves to publicly share whenever possible to enable computer network defenders around the world.

• Accountability: TH is committed to the mission and to our responsibility to the American people. We believe that accountability, integrity, and transparency go hand-in-hand, thereby allowing all to recognize our performance.

Mission Engineering Subdivision

Associate Director

Investment & Contract

Management Branch Business Operations

Branch

Technical Management BranchData Science Branch

Deputy Associate Director Program Manager

Acquisition Management Branch

Customer Management Branch

System Operations Branch

Information Security Branch

DevOps Branch

Figure 1- Mission Engineering Organization

• Technical Excellence: To combat threats against our homeland, technical competence is not enough. The TH standard is technical excellence. We surpass the status quo by engaging in employee development, smart acquisitions, and aggressive technological capability expansion.

2 Office of Strategy, Policy, and Plans/Strategic Technology (OSPP/ST)

CISA OSPP/ST is responsible for contributing to the strategic direction of CISA by identifying specific technologies that will contribute to or impact the CISA missions. The Office of Strategy, Policy, and Plans/Strategic Technology is responsible for:

• Lead the CISA Research and Development (R&D) Program:

o Coordinate the development and prioritization of CISA R&D requirements, overseeing the selection of research and technology transition projects to ensure they have the potential to add value.

o Support CISA Mission Division R&D Technology transition:

• Tools and procedures

• Modeling and analysis

• Establishing technology governance recommendations for R&D and Emerging Technology and Technology Standards

• Service as a Technical SME resource to CISA o Deliver Expert Briefings o Perform Horizon Scanning

• Formulating strategy for emerging technology utilization:

o Ensuring inclusion of appropriate technology in strategic plans, PPBE and other budget and program management systems.

• Support the development of CISA Research and Development technology roadmap:

o Identifying technology trends that will impact CISA programmatic capabilities, especially in the areas of cybersecurity, infrastructure security, high assurance communications, standards, interoperability and information sharing.

• Identifying emerging technologies to support the agency’s pathway from strategic technology concept to tangible mission outcomes o Assessing the value of new technology insertion into existing products and services o Providing expert, authoritative guidance on all technical aspects of cyber and communications, particularly regarding their evolution and integration in a converging technology environment.

• Oversee Strategic Coordination for CISA equities across technology standards and protocols efforts and maintains a current working knowledge of IT best practices, international standards efforts and innovative solutions within Government and industry.

3 Emergency Communications Division (ECD)

CISA ECD was established within the DHS to deliver 6 United States Code, Title XVIII, and Executive Order 13618 functions to enhance the Nation’s emergency communications capabilities. ECD is organized to achieve resilient and secure critical infrastructure, by maximizing a stakeholder-driven approach to enhance interoperable emergency communications capabilities, ensure telecommunications functions, and provide technical guidance, training, and other assistance, as appropriate, to support the rapid establishment of consistent, secure, and effective interoperable emergency communications. The ECD mission is to advance emergency communications in partnership with Public Safety and the National Security/Emergency Preparedness communities to bring about interoperable, secure, and resilient emergency communications capabilities including:

• National Planning via leading the nation’s emergency communications planning, policy, and assessment efforts, updates to the National Emergency Communications Plan (NECP) and supporting implementation, ensuring emergency communications capabilities and gaps are quantified and assessed to drive policy, programmatic, and funding decisions.

o National Emergency Communications Plan (NECP) o SAFECOM Nationwide Survey (SNS) o Statewide Communications Interoperability Plans (SCIPs) o Nationwide Communications Baseline Assessment (NCBA) o Biennial Progress Report (BPR)

Coordination on National Policy and Doctrine

• Grants Policy via developing annual guidance for grant recipients investing in emergency communications projects, providing subject matter expertise on emergency communications issues to ensure grants are administered consistently throughout the federal government, and managing the CISA demonstration project:

o SAFECOM Guidance on Emergency Communications Grants o Federal Partners Engagement o Grant Program Development and Administration

• NG911/ Alerts and Warnings o Cyber Resilient 911 (CR911) Initiative

Promotes and coordinates activities of State, Local, Tribal, Territorial and Federal 911 Officials nationwide to achieve highest level of cyber resilient next generation 911 capabilities across the nation o National Meeting of State Alerting Officials Promotes and coordinates activities of State Alerting Officials nationwide to achieve highest level of resilient, interoperable and secure alerting capabilities across the nation

• Priority Telecommunications Services which area a suite of services that enable priority communications when networks are degraded or congested including:

o Government Emergency Telecommunications Services (GETS) o Wireless Priority Services (WPS) o Telecommunications Service Priority (TSP) o Next Generation Network Priority Services (NGN-PS)

• Interoperable Communications Technical Assistance via serving all states, tribes and territories and provides direct support to State, Local, Territorial, and Tribal emergency responders and government officials through the development and delivery of training, tools, and onsite assistance to advance public safety interoperable communications capabilities:

o Tools o Onsite assistance o Training

• National Governance:

o SAFECOM improves emergency response providers’ inter-jurisdictional and inter-disciplinary emergency communications interoperability o National Council of Statewide Interoperability Coordinators (NCSWIC) promotes and coordinates activities designed to ensure the highest level of public safety communications across the nation.

CISA leads the Nation’s operable and interoperable public safety and NS/EP communications efforts to keep America safe, secure, and resilient. Through close collaboration with its federal, state, local, tribal, and territorial stakeholders, CISA builds emergency communications capacity, ensuring interoperability across jurisdictions and at all levels of government. By conducting extensive, nationwide outreach, CISA supports and promotes the ability of emergency response providers and relevant government officials to communicate in the event of natural disasters, acts of terrorism, and other hazards.

4 Scope The scope includes the cross-agency integration, integrated mission facilitation; research and development; research and development coordination and development; operational test (OT) support; and program analysis and planning, required by the Government to support CISA with new and/or enhanced systems for national cyber security.

The scope also includes providing research and technology review, analysis, and assessment;

systems analysis; engineering expertise; and requirements derivation, analysis, and assessment required by the Government to support CISA in identifying, evaluating, developing, and encouraging the adoption of current, emerging, and developed interoperable cybersecurity products and services by CISA stakeholders and inclusion in the Government’s research and research and development (R&D) planning, prioritization, and tracking activities.

Provide CISA with insight and knowledge that enable its strategic planning, systems engineering, and architecture development efforts for new national cyber security systems.

Services shall provide research, development, recommendations, and white papers as appropriate to support decisions related to strategic planning and systems engineering for new national cyber security systems. The Contractor shall, provide CISA with the expert-level research, engineering, and technology requirements expertise to enable CISA’s optimal research and R&D planning, prioritization, and tracking in coordination with CISA’s stakeholders.

The Contractor shall act entirely under the guidance and at the behest of the Government and will make technical recommendations to specific CISA Program Offices, who make final decisions. In performing the activities under this contract, the Contractor shall have a continuing obligation to inform CISA Program Offices of known problems and issues, and disclose known risks associated with performance or other activities to be conducted under this contract. This contract shall include independent peer reviews and quality assurance processes to execution and products of this task. Deliverables and recommendations will be provided for Government review and approval and will be provided only for the environments and specified conditions for which they were intended or tested.

5 Tasks

5.1 Task 1: Management

The Contractor shall provide the required task management activities.

5.1.1 Kick off Meeting

The Contractor shall host a kickoff meeting after contract award. The Contractor shall develop a proposed kickoff meeting agenda and provide to CISA within two business days after award.

The Contractor shall deliver an electronic copy of their kickoff briefing to the Contracting Officer’s Representative (COR) at least two business days before the scheduled kickoff meeting.

The Contractor shall record the minutes and action items from the kickoff meeting and deliver to CISA within five business days post kickoff meeting. The kickoff meeting shall demonstrate to CISA how the Contractor plans to address the associated contract requirements. The kickoff meeting shall be comprised of topics specific to the requirements including key schedule drivers for delivery of all Statement of Work (SOW) tasks; risks that impede or may affect delivery of any SOW tasks; and introduction of key personnel. The Contractor shall hold a kickoff meeting within ten (10) business days of award.

5.1.2 Monthly Status Report

The Contractor shall participate in a monthly Program Management Review (PMR) meeting for this contract. In addition to the monthly PMR meeting, the Contractor shall prepare and deliver a Monthly Status Report (MSR) by the 20th of the month. The MSR typically contains, but is not limited to, the following information:

• the staffing roster;

• the previous month’s progress;

• deviance from previous month’s planned progress (either positive or negative);

• the current month’s planned progress;

• issues and recommendations;

• schedule performance (schedule variance);

• program risks, risk mitigation plans, and risk mitigation actions taken; and

• Financial Status Report (FSR, template provided by DHS at contract award).

The Contractor shall develop and deliver an Integrated Master Schedule of contract activities to be tracked throughout the contract. The schedule shall contain all major activities, estimated durations, and dependencies that must occur to complete contract requirements. Delivery of the initial schedule will be provided with the Contractor’s proposal and updated monthly and as events occur that change the major schedule activities.

5.1.3 Staffing

The Contractor shall submit a staffing plan that details the names and positions of the proposed personnel for CISA to assess CISA personnel security suitability and clearance requests. The Contractor’s proposed staffing plan shall be delivered at the kick-off meeting and updated when staff assignments change.

5.2 Task 2: Operational Test and Evaluation (OT&E)

The Contractor shall employ a multi-disciplinary team (i.e., statisticians, systems engineers, computer scientists, human factors engineers, mathematicians, network security analysts) to accomplish the following articles for OT&E. These activities may include some or all the following tasks:

• Acquire and study (in depth where necessary) the users’ Consolidated Operational Requirements Document (CORD). Acquire lessons learned and knowledge of existing “as-is” capabilities to meet these user needs.

• Examine the system under test. Evaluate capabilities and methodologies to support measurements and meet data collection requirements. Make recommendations supporting more efficient or effective test execution.

• Analyze and assess system requirements (functional and operational) continually as they evolve and mature. Make recommendations where inconsistencies in operational and functional requirements do not complement or map appropriately.

• Participate in Test and Evaluation (T&E) Working-level Integrated Product Teams (WIPTs) and test and program planning meetings, as required.

• Support development and review of test plans and procedures no later than 30 days prior to the test occurring. Support planning and coordination of test activities; observation and support of formal and informal vendor-conducted testing to ensure performance, interface, interoperability, and information security requirements are met, including feedback on test results to CISA, as requested; and review of vendor-developed test reports with recommendations to CISA as requested.

• Assist the Program’s Test and Evaluation Manager (TEM), T&E WIPT, Department of Homeland Security (DHS) Director Operational Test and Evaluation (DOT&E) assigned Test Area Manager (TAM), the DOT&E approved Independent Test Agent (ITA) to develop appropriate test metrics and measures for OT&E test events.

• Assist the TEM, T&E WIPT, DHS DOT&E TAM, ITA, in developing program test strategies and test plans for integrated operational testing, including the following:

– Formulating test scenarios

– Identifying data required for evaluation

– Developing a detailed data collection strategy

– Developing a data analysis strategy for test data

– Defining measures for test evaluation process

– Monitoring scenarios and data collection progress

– Collecting user feedback

• Create, review or provide input to test documentation as required, including briefs, test plans, test schedule, test reports, etc.

• The Contractor shall conduct independent verification and validation (IV&V) of component and system functionality as required and needed by the Government.

• When required by the Government, the Contractor shall perform the functions of the Test Lead for the DOT&E approved ITA. These tasks may include, but are not limited to, assisting in development of the OT&E components of the Test and Evaluation Strategy Brief or Test Concept Brief through coordination with the ITA; assisting the ITA in defining the OT&E Measures of Effectiveness/Measures of Performance in accordance with the CORD COIs; overseeing the technical testing team; submitting the data analysis and collection plan to Independent Test Authority (ITA); and providing an overall assessment of the test and presenting results to the ITA.

5.3 Task 3: Integrated Mission Facilitation

The Contractor shall help the Government ensure its cyber security efforts are integrated with other cyber security efforts ongoing throughout the federal Government enterprise. The Contractor shall support development and execution of engineering strategies and practices addressing the complexities associated with integration of independently funded and managed programs. Facilitation shall include but not be limited to:

• Support evaluation of objectives, scope and approach of interagency cyber security efforts to identify overlaps and gaps between major efforts

• Identify proactive defense and pursuit gaps and providing strategies for establishing mission partner relationships with new communities (e.g., law enforcement) that could enhance cyber security

• Identify strategies to integrate systems/processes and support establishing organizational partnerships that will enhance the protection and resiliency of critical infrastructure networks

• Develop strategic reports documenting strategies for future program concepts, trades, and technology decision analyses

5.4 Task 4: Research and Development (R&D) Coordination

The Contractor shall support CISA’s goals of identifying, evaluating and encouraging adoption of current and emerging interoperable cybersecurity products and services by CISA stakeholders.

Perform systems analysis, technology assessment, research review and assessment, and requirements derivation. Document and deliver these for inclusion in the Government’s research planning, prioritization, and tracking activities. Support includes but is not limited to:

• Perform technology studies and analyses to assess identified technologies’ suitability and potential to support CISA needs.

• Support the development, communication and assessment of a capability roadmaps (i.e.

assessments of existing capabilities, gaps in those capabilities, future capabilities, and phasing required to fill those gaps)

• Identify, frame and support the resolution of critical issues that are preventing a consistent CISA cyber security vision. This may include participating in or leading support toing working groups, conducting analysis or developing models and simulations and conducting research.

• As required, participate in academic, industry and Government research-based, workshops, seminars, technical exchange visits/meetings and technology capability meetings to maintain/establish working partnerships, present technical needs and priorities, and maintain up-to-date technical understanding.

• Support the development of study plans that describe the recommended approach to be used to conduct a specific type of analysis; and

• Assist in developing, implementing, and analyzing of metrics and data collection activities and tools used to assess compliance, threat, impact, vulnerability, risk, and cyber consequences as well as the relevance and mission value of developed cybersecurity systems and/or services (i.e., the manner in which way cyber capabilities should be measured to assess the value added to the federal cyber mission) in support of research areas that will contribute to operational utilities for existing CISA programs.

5.5 Task 5: Specifications and Standards Development (Optional Task) The Contractor shall support CISA in development, evaluation and/or prototyping of existing and emerging specifications and standards. This task is considered optional, and the Government will exercise the CLIN if/when it becomes necessary. Specific support requirements, labor categories, and deliverables will be identified in advance of the execution of this optional task. These specifications and standards shall be developed to advance key cybersecurity capabilities and areas that include but are not limited to interoperability, automation and information sharing.

• Support transition and/or industry adoption of specifications and standards developed in alignment with key existing and future CSD initiatives such as the Integrated Adaptive Cyber Defense (IACD);

• Support development of use cases and reference implementations in accordance with existing and future architectures;

• When appropriate, identify and recommend standards that are adopted by industry and operate across platforms for use within internal developments;

• Support coordination with industry standards developing organizations to consider the technical merit of the standard, determine alignment with CSD’s mission and operational constraints, relay prospects for future adoption, and support CISA’s ability to influence and/or extend the standard moving forward;

• Support continued evolution of specifications based on lessons learned from experimentation, implementation, prototyping and based on community feedback as well as existing research and innovation; and

• Facilitate adoption of industry-supported specifications and evolution of standards.

• The Contractor shall support development of international standards for performance and interoperability requirements. The Contractor shall support standards development organizations, including acting as sub-committee coordinators, providing meeting

• The Contractor shall support development of international standards for performance and interoperability requirements.

• Record minutes, collection/ distribution of papers and materials, maintaining membership lists and serving as a primary support for the federal staff managing these working group activities.

• The Contractor shall provide standards expertise to support other Contractor development activities via technical interchange meetings, teleconferences, and/or reviews.

• The Contractor shall support prototype development and validation efforts being conducted at CISA test facilities, vendor sites, and designated field locations.

• The Contractor shall provide support to delegation lead, committee and working group chair support, including preparation of standards material, editing/integrating contributor submissions, collecting and resolving reviewer comments, and coordinating with other standards bodies and air navigation service providers.

5.6 Task 6: Industry Partnerships and Community Engagements (Optional Task) The Contractor shall support CISA in industry and community engagements to advance cybersecurity initiatives and support transition and/or adoption of developed specifications and future capabilities. This task is considered optional, and the Government will exercise the CLIN when it becomes necessary. Specific support requirements, labor categories, and deliverables will be identified in advance of the execution of this optional task. Support includes but is not limited to:

• Facilitate the community-driven definition of common interfaces and interoperability specifications;

• Support communities of interest to spur rapid progress on adoption of developed specifications and capabilities;

• Identify industry solutions to technical gaps that achieve tool interoperability and secure data exchanges through open community and industry engagements; and

• Support development of reference implementations for existing and emerging common interfaces to provide rapid feedback to industry.

5.7 Task 7: Information Sharing Framework (ISF) (Optional Task) The ISF document was developed by John Hopkins University Applied Physics Laboratory (JHU/APL) and CISA working with a team of public safety professionals and statewide interoperability coordinators comprising the Information Sharing Framework Task Force (ISFTF) which is, in turn, comprised of representatives from the National Council of Statewide Interoperability Coordinators (NCSWIC) and SAFECOM. The final version 1.7, “Approach for

Developing an Interoperable Information Sharing Framework,” was published on the CISA SAFECOM website in August 2021. Real time situational awareness for public safety relies on making data interoperable and enabling information sharing across platforms is a requirement that spans beyond technical and traditional organizational boundaries. The ISF document introduces the concept of “three layers” [the data, integration and presentation layers] and how one can “map” their data to this framework as a necessary step in building the IT connections to share data. The overarching goal of the ISF is to inform and guide transition of operational capabilities to a common data exchange approach for an interoperable ecosystem. The Contractor shall support CISA in any updates or revisions to the ISF document based on ongoing engagements with industry as the ISFTF seeks to produce a Request for Proposal (RFP) by end of CY2024 or early CY2025 to deploy the ISF as a cloud-based software platform to ensure transformation of Emergency Communications Interoperability in an Internet Protocol (IP) Network Environment. The ISF will harmonize the effective implementation of priority services, by providing recommendations to implement an interoperability framework as well as technical and operational standards to enable secure information flow between disparate components of National Security and Emergency Preparedness (NS/EP) and public safety communications systems in an IP-connected environment. The Contractor will not deliver the actual ISF software platform capability but will provide ISF document updates, technical and strategic advisement, stakeholder engagement and training, and documents to facilitate CISA engagement with the private sector to develop this capability.

The anticipated follow-on efforts in moving from the ISF documentation phase towards a capability development and implementation phase can be broadly characterized by the following three sub-tasks:

1. Subtask 10.1 Information Sharing Framework Document - Updates/Revisions – The Contractor shall support coordination with the ISFTF, SAFECOM and NCSWIC organizations to update the ISF document, as needed, as new relevant technologies evolve in the NS/EP and public safety ecosystem and from lessons learned via engagements with industry as the ISF moves to a service platform and provide implementation guidance to public safety entities. As directed by CISA, the Contractor shall present with CISA ECD personnel to various public safety bodies such as SAFECOM, NCSWIC, NPSTC, IACP, IAFC, NENA, NEMA, APCO, NIST/PSCR and others as needed. Briefings may occur (in person or virtually) at events such as IWCE, IACP Technology Conference, or the APCO Public Safety Broadband Summit to ensure widespread understanding and adoption of the ISF in the public safety community. Also aligned under this task are ongoing efforts to elicit feedback on requirements needed to clarify and enhance the current ISF approach. Such input will involve providing updates/revisions to the ISF document as needed. The overarching goal of this task is to broaden understanding of the ISF in the public safety community and elicit feedback that will strengthen the ISF approach and ensure adoption and implementation. Deliverables include, but are not limited to:

- Presentations and Briefs

- Attendance and participation at relevant meetings/conferences/workshops

- Revision(s) to the draft final report

2. Subtask 10.2 Workshops/Tabletops/Pilot Demonstration – To ensure validity of operationalizing the ISF approach as a service platform, the Contractor shall coordinate, under the direction of CISA, with the public safety community to conduct workshops, attend conferences, and/or exercises and/or pilot experiments in real-world environments. Number of interactions with public safety community are estimated to be no more than six times per year with four of these being done virtually. The intent is to provide further guidance and technical support to public safety end-users on how to implement the ISF in a practical “real world” environment or leverage the ISF as a service platform if deployed on broadband and cloud provider networks. Workshops may involve how to take ISF concepts and architect a plan for appropriate solutions that will result in more interoperable systems for public safety organizations for various large-scale and multi-jurisdictional use cases. These efforts will range from small workshops to a modest tabletop exercise conducted in a virtual manner and/or on-site demonstration depending upon need and availability of resources. The goal of this effort is to conduct real world implementation activities to ensure the usefulness of the ISF. In addition, this task will allow for development of training courses in conjunction with the CISA ECD Technical Assistance to help stakeholders customize the ISF to their use cases. This sub-task may also involve training NS/EP and public safety organizations in how to apply software tools which may integrate or customize the ISF service platform.

Deliverables include, but are not limited to:

- Tabletop exercise and/or workshop documents (facilitation documents, briefs, outcomes and recommendations report)

- Presentations and Briefs

- Attendance and Facilitation for Workshops/Demonstrations

3. Subtask 10.3 Technical Implementation Guidance for Industry – The Contractor shall work with CISA to develop functional performance and operational requirements for industry that will align with and support the ISF approach. This guidance will inform private sector third parties on how to design solutions that conform to the ISF data interoperability framework. This guidance would will also outline the best strategy to engage the private sector which could range from engaging with existing Wireless Priority Services (WPS) and the Government Emergency Telecommunications Services (GETS) service providers to develop and operate integration layer functions for improved data interoperability in those telecom carrier environments, R&D engagement with cloud computing providers to develop integration layer functionality or synergies with other related initiatives such as NG911, Fusion Center Evolution, and next generation Emergency Operations Centers (EOCs) as they begin to leverage Artificial Intelligence (AI) and machine learning or a combination of these options. While the ISF V1.7 report was developed in conjunction with public safety and directed towards public safety, the private sector presently has no such guidance. The goal of this effort is to provide guidance to private sector hardware/software and IT services companies on approaches for their products to meet the public sector need for interoperability so they can design solutions that support the ISF approach and address the five functions of the integration layer – For example how does a provider or developer address data needs related to 1) discovery, 2) identity management, 3) data exchange, 4) analytics, 5) transport and how best can these capabilities be delivered to NS/EP and public safety stakeholders working in different organizations and jurisdictions. This work may also include helping to prepare Request for Information (RFI) and Request for Proposal (RFP) technical documentation to support either a Technical Proof-of-Concept (POC) or Research and Development (R&D) project to award development, testing, and deployment of the ISF as a service platform. The Contractor shall afford DHS, the Office of the Inspector General, other government organizations, and Contractors working in support of the Government access to the Contractor’s facilities, installations, operations, documentation, databases, networks, systems, and personnel used in the performance of this contract. The Contractor will also support CISA in scoring and evaluating proposals from industry and technical support to CISA to ensure any Technical POC or R&D project with industry will provide the following outcomes:

- Determination of technical feasibility to develop, test, and deploy the ISF Integration Layer functions as a service platform of Platform-as-a-service (PaaS).

- ISF service platform can be operationalized as part of ongoing CISA ECD secure, prioritized, and interoperable Data, Video and Information Services (DV&IS) on 4G/5G and coming 6G critical communications infrastructure.

- Ability for critical communications infrastructure providers to adopt and scale the ISF service platform with testable and verifiable Key Performance Parameters (KPPs) and metrics, and

- Verification via operational testing that the ISF service platform and associated software tools are intuitive and align with NS/EP and public safety operations and mission to improve situation awareness.

Deliverables may include, but are not limited to:

- Functional, performance, and operational requirements documents

- Technical portions of RFP

- Technical assistance in RFP reviews

- Development, testing, and deployment guidance documents

- Development, testing, and deployment review documents

- Presentations

- Technical White papers

In the event that the Contractor may not be able to perform all above sub-tasks, the priority of the sub-tasks will be as follows:

Highest Priority: Sub Task 10.3: Technical Implementation Guidance for Industry Medium Priority: Sub Task 10.2: Workshops/Tabletops/Pilot Demonstration Lowest Priority: Sub Task 10.1: Information Sharing Framework Document - Final Revision

In addition, some of the sub-tasks above may be re-prioritized as needed pending funding, scheduling, and changing priorities of ISF service platform development, testing, and deployment by industry.

6 Deliverables

SOW Task Reference Deliverable Description Due Date

5.1.1 Kick Off Meeting Agenda Agenda for the Kickoff meeting Two (2) Business Days After Award

5.1.1 Kick Off Briefing Briefing containing pertinent

schedule and risk data and key personnel introductions

2 Business days prior to Kick Off Meeting

5.1.1 Kick Off Meeting Meeting to discuss all required

action items.

10 Business Days after contract award.

5.1.1 Kick Off Briefing

Minutes/Actions

Minutes and Action Items from the Kickoff meeting

Five (5) Business Days Post Kick Off Meeting

5.1.2 Monthly Status Report Document containing detailed

performance, schedule, and price/invoicing information for the previous and current quarter along with forecasted performance, schedule, and price/invoicing information for the coming quarter. Report will also include:

• Staffing roster;

• issues and recommendations;

• program risks, risk mitigation plans, and risk mitigation actions taken

• Financial Status Report (FSR, template provided by CISA).

Twenty (20) Business Days Following the End of the Previous Calendar Month

5.1.2 Integrated Master Schedule Schedule of contract management and task management activities to be tracked throughout the contract to include reoccurring meetings, reporting milestones, and management activities

Initial: Delivered with Proposal

Updates: As required, no less than monthly

5.1.3 Staffing Plan A staffing plan that details the

names and positions of the proposed personnel

Initial: Delivered with Proposal

Update: Monthly with the MSR when staff assignments change

5.2 Test Plan Comments Input and review to components of

the Test and Evaluation Strategy Brief, Test Concept Brief, and other test documents as required

As required; no later than 30 days prior to a test event

5.2 Test Planning & Coordination A description of the methodology, metrics and analyses for testing of future capabilities.

As required

5.3 Strategic Reports Developing strategic reports for

future program concepts

As required

5.5 Develop draft specifications

and technical material

Develop draft specifications, use cases and other technical material

As required

5.4 Develop Small-Scale

Prototypes

Review current systems/processes to develop small scale prototypes to drive research requirements and user feedback in capability gap areas

As required

5.4 Draft Prioritized Requirements Requirements and supporting technical materials as input to the CISA R&D requirements process

As required

5.4 Technology gap categorization

report

Draft report categorizing technology gaps (i.e., existing but unknown technology, emerging technology, R&D required to fill gap).

As required

5.4 Technology capability report Develop technology/capability reports documenting investigated technologies that could fill identified gaps

As required

5.4 Technical materials Technical papers, data, documentation and presentation materials to support Government participation in industry, Government, and academic workshops, seminars, technical exchanges, and technology transfer

As required

5.10 Sub-Task 10.1

Briefs and Presentations Technical presentations to support CISA in ISFTF meetings

5.10 Sub-Tasks 10.1-3

Updates to ISF Document Revisions to ISF Document based on ISFTF meetings, tabletop exercises, and industry engagement

As required

5.10 Sub-Task 10.2

Tabletop exercise and/or workshop documents

Facilitation documents, briefs, outcomes and recommendations report

As required but not to exceed four updates

5.10 Sub-Task 10.3

Functional, Performance, and Operational Requirements Document

Functional, Performance, and Operational requirements for ISF Industry engagement, development and implementation

As required

5.10 Sub-Task 10.3

Technical White Papers White papers detailing technical approaches or descriptions for ISF Industry engagement, development and implementation

As required

5.10 Sub-Task 10.3

Standards Strategy and Recommendations Document

Document detailing which standards may need to be implemented by industry standards bodies for development and implementation of

ISF

7 Contract Performance

7.1 Period of Performance

The period of performance is five years consisting of a one-year base period with four one-year option periods.

7.2 Place of Performance

Work under this contract will primarily be performed at the Contractor’s facility. Work may also be performed at the following Government locations and through telework:

The primary place of performance will be the proposed contractor facility. Work may also be performed at multiple Government facilities in the Washington DC area including Ballston One at 4601 N. Fairfax Drive, Arlington Virginia; the development/test facility at 4301 Wilson Blvd, Arlington, Virginia. All work performed at the contractor site will be unclassified and conducted in unclassified space, and any work requiring access to DHS classified information/material will be performed at a Government or a Government-approved facility only per the attached DD254.

“Telework” is an alternative work arrangement which allows a Contractor employee to perform work at an alternate worksite (e.g., home, telework center, Contractor’s office). In accordance with 41 U.S.C. § 3306(f), employees of Federal Government Contractors are permitted to telework in the performance of contracts entered with executive agencies. The term “telecommuting” used in the Federal Acquisition Regulation (FAR) is synonymous with the term

“telework” as used herein. A Contractor employee can telework on a core or episodic basis. A core arrangement occurs on a routine and recurring basis, whereas an episodic arrangement occurs on an occasional and nonroutine basis, such as during inclement weather.

“Telework-ready Contractor employee” who has been approved to telework, has an established alternate worksite, is prepared to telework by having enough work to cover the scheduled telework period, and has the appropriate secure technology equipment to meet the needs of the telework arrangement and a high-speed Internet connection.

The Contractor will be authorized to telework, and the PM/COR and Contractor shall mutually agree upon telework schedules and alternate sites in writing. A Contractor employee’s telework schedule shall be approved by the Contractor’s PM and coordinated with the COR. Once approved, requests to change a scheduled telework day shall be submitted in advance, when possible, to the Contractor’s PM, who shall coordinate with the COR. The Contractor’s PM continues to be responsible for Contractor’s employees time and attendance and notifying the COR of any changes. The Contractor is responsible for ensuring that any of its employees that are authorized to telework (and identified as “telework-ready”) meet the technical requirements and agrees to comply with the security procedures applicable to DHS telework, as provided to the Contractor by the CO or COR. The Contractor is responsible for ensuring that any of its employees that are authorized to telework (and identified as “telecommute-ready”) and comply with the security requirements stated in HSAR 3004.470 and HSAM 3004.470, and work according to the guidance set forth in DHS4300A, Sensitive Systems Handbook, Rules of Behavior (Attachment G). At the Government’s discretion, the Contractor shall be required to be on site for in person meetings regardless of telework status for the duration of the meeting. The Government reserves the right to revoke the option to telecommute, at any time.

If Contractor personnel are denied access to Government facilities due to Government closures or access is not recommended due to safety concerns or any other circumstances, Contractor employees who are telework-ready shall begin to telecommute at their normal start time and are expected to work the entire day. If a Contractor employees has performance issues, does not follow the security procedures, or does not complete required training while in a telework status, the COR will contact the Contractor’s PM and the Contractor’s employee’s telework privileges may be revoked. All classified work shall be conducted in a Government’s facility unless otherwise authorized by the Government. Contractor personnel will be notified in advance when Temporary Duty (TDY) travel is required. The Contractor shall charge the same applicable fixed hourly rate as a for a Government site for those Contractor personnel when the telecommute at their designated telecommuting location.

7.3 Other Direct Costs (ODC’s)

Prior approval by the COR is required for any ODC. The Contractor will provide three (3) quotes and justification for the purchase with its approval request. All equipment must comply with the Buy American Act and Trade Agreements Act. All ODC’s shall be submitted through the Government’s ODC portal. Allowable and reasonable costs incurred by the contractor for other direct costs will be reimbursed. Section 12.2 provides a detailed list of all documents that must be included when invoicing for an ODC; failure to comply with these requirements will result in a rejected invoice.

7.4 Travel

Contractor personnel may be required to support the requirements of this contract. Long distance and local travel may be required in CONUS. The Contractor will be reimbursed for reasonable actual travel-related costs in accordance with FAR 31.205-46. All long-distance travel must be pre-approved by the COR. A written request shall be sent to the COR well in advance of any anticipated travel to allow sufficient time for notification and approval. The Government will not reimburse travel without prior approval from the COR. The Contractor shall not be reimbursed for the following daily local travel costs:

• Travel performed for personal convenience/errands, including commuting to and from work, and

• Travel costs incurred in the replacement of personnel when such replacement is accomplished for the Contractor’s or employee’s convenience.

• Travel requests (including local travel) shall be submitted using the following template:

Anticipated Expenses Program:

Type of Expense Description of Expense Base Cost

# of Days

Total Expenses

Airfare Ground Transportation/mileage

Parking/Tolls Baggage Check Fuel Per Diem Lodging Travel Fees

TOTAL: $0.00

• Local Travel: local travel is considered any travel between the Contractor’s facility and any location required for tasks in support of CISA that is less than 50-miles drive (one-way). Local travel does not need to be pre-approved by the COR. Acquiring rental cars per-diem, or staying overnight (i.e. hotels) are not considered local travel and will require pre-approval from the COR. All travel including local travel should be accounted for, along with a description of why the travel was necessary and must be provided in the monthly invoice.

7.5 Identification of Non-Disclosure Requirements

Some material will contain proprietary, sensitive, or classified data from various public or private sources. The Contractor must require all subcontractors to sign corporate and individual non-disclosure agreements (NDAs).

7.6 Enhanced Skills Training

Personnel are to maintain any required professional certifications, accreditations and proficiency relative to their areas of expertise. Training of Contractor personnel to fulfill these requirements shall be performed at contractor’s expense. The Contractor shall retain documentation of such records.

The Government will not pay for Contractor training required to perform work under this contract. For training that provides direct benefit to the work being performed by the contractor under a specific task, the contractor may request the Government approve attendance on a case-by-case basis. In the event of the Government does not approve the Contractor’s ODC request for tuition, per diem, and/or travel costs, but approves the training, the Contractor shall submit a request to bill the Government only for the labor hours to attend training. The COR will review all requests and approve or disapprove on a case-by-case basis.

7.7 Accessibility Requirements

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology (EIT), they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public. The DART Tool 2.1 must be used for each requirement to get the 508 language that will be used in the SOW for that requirement. Link to the DHS Accessibility Requirements Tool (DART) 2.1 Tool.

All EIT deliverables within this SOW must comply with the applicable technical and functional performance criteria of Section 508 unless exempt.

8 Security Requirements

8.1 General

The DHS Office of the Chief Security Officer (OCSO) has primary security cognizance of all SCI work performed during the performance of this contract and subsequent contract phase unless otherwise directed by the Government.

All contractor personnel assigned to those tasks specifically noted as requiring a Secret clearance must be U.S. Citizens and meet the requirements contained in DHS Directive 121-01-007, Personnel Suitability and Security Program.