(U) ATTACHMENT 1 - TECHNICAL REQUIREMENTS.pdf

UNCLASSIFIED

CSO CALL 5 – PROJECT MARINE DUCK

ATTACHMENT 1 - TECHNICAL REQUIREMENTS

I. GENERAL TECHNICAL REQUIREMENTS: The following general technical requirements must be met during the performance of this program:

1. For all potential Phases, the following requirements apply for the deliverable/prototype:

a. The deliverable/prototype must be an innovative DOD or DISA accredited hybrid cloud, cloud native network, or “environment” to host modern software development, with focus on C++ and collaboration tools. For Phase 1, cloud environments with lower accreditations such as a DISA Provisional Authorization or NIST self-attestation with proper documentation, may be provided. However, the contractor/performer must also provide specific detailed information on how the vendor intends to achieve necessary accreditation for IL5 by the end of Phase 1.

b. The developed environment shall, to the maximum extent practical, be compliant with the latest version of the DoD DevSecOps enterprise reference design as located at:

https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20D evSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf

2. For all potential Phases, the following requirements apply to the contractor/performer’s performance in the contract/agreement:

a. The final environment shall meet DoD cloud computing security requirements to support (e.g., store and process) ITAR designated information.

b. The contractor/performer shall support any collaboration and configuration changes necessary to support data transfer between security domains to include the instantiation of Data Transfer as a Service (DTaaS).

c. The contractor/performer shall procure and provide all licenses, hardware, software, and cloud licensing and platform engineering manpower to build, secure, deploy, sustain, update, and scale the environment.

d. The contractor/performer shall employ U.S citizens ONLY. Information Technology and cybersecurity professionals must possess an active DOD SECRET clearance, at minimum, and must be in compliance with DoDM

8140.03 and the associated Education and Certification matrices.

e. To the maximum extent possible, the contractor/performer shall utilize DoD enterprise contracts, such as Joint Warfare Cloud Computing https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf

CSO Call 5 – “Project Marine Duck”

Attachment 1 –Technical Requirements 13 January 2025

(JWCC) to acquire and maintain cloud resources, as applicable. The contractor is responsible for all compute and storage costs.

f. The Contractor/performer shall implement remote session technologies

(ex. VDI & RDP) allowing AFLCMC partners to have access to the environment via AFNET or approved connections. The contractor shall ensure the session includes data loss prevention controls

g. The contractor/performer shall ensure AFLCMC has the ability to, via a data transfer agent, remove data and data products from the environment.

Examples of data to be transferred may include code or documentation developed in the environment for deployment to other locations.

h. The contractor/performer shall provide continuous support for the developed environment, including, but not limited to performing maintenance, conducting updates, and expanding the environment.

Specifically, the continuous support shall be comprehensive and include, but is not limited to, on-call tiered help desk support, best-practice patching, license management, continuous cybersecurity compliance, continuous reevaluation of processes improvements that maximize automation to the greatest extent possible, and consultation/advising on future environment projects. Priority coverage should be during United States standard business hours and can include an on-call team or response plan for critical after-hours support.

3. The following requirement applies to the prototype/deliverable for Phase II (and potential subsequent Phase) performance:

a. The developed environment must be able to accommodate edge devices

(Ex: a gaming tower) for local compute and store and/or testing. AFLCMC has particular interest in vendors who can provide pre-configured and STIGGED hardware to AFLCMC and external contractors/performers.

The contractor/performer shall detail its ability to do so in the scalability plan deliverable for Phase I.

4. The following requirements apply to the contractor/performer for Phase II (and potential subsequent Phase) performance:

a. The contractor/performance shall maintain an IT inventory management process in support of edge devices.

b. The contractor/performer shall maintain live dashboards to report resource utilization and environment performance. Dashboards shall be numerous and customized to the needs of individual user types and roles.

5. The following are not requirements applicable to this specific Call, but are technical objectives for any potential subsequent Phase following Phase II:

a. When the environment is fully scaled, AFLCMC desires a contractor/performer-provided help desk from 0700-2100 ET for the environment that provides support for access requests, group management, onboarding, general IT issues/questions, new capability and feature requests, account issues, and application issues.

b. For ongoing performance following Phase II, AFLCMC desires a contractor/performer provided and maintained knowledge base that provides relevant instructions, information, and training resources to support users (i.e. onboarding, tool catalog, tool support resources, technical support and how-to guides).

c. For ongoing performance following Phase II, AFLCMC desires contractor/performer continuous support to identify, propose, coordinate, and implement continuous environment improvements.

II. USER-SPECIFIC REQUIREMENTS:

1. The following requirement applies to the deliverable/prototype for Phase I:

a. The environment shall be capable of hosting up to 10 concurrent

AFLCMC users, at minimum.

2. The following requirements apply to the deliverable/prototype for Phase II:

a. The environment shall be capable of hosting up to 50 users, to include both AFLCMC and third-party contractor users, at minimum.

b. The environment shall be capable of hosting up to 40 concurrent users (to include both AFLCMC and third-party contractor users), at minimum.

3. The following requirements apply to the deliverable/prototype for all Phases:

a. The environment shall be capable of having at least the following user types:

i. “General users” with limited permissions to perform work

ii. “Power users” who have application-level permissions

iii. “Super users” who have network level permissions and kernel-level permissions for on-prem hardware

iv. “Monitoring users” with minimal permissions restricted to limited read accesses

b. If not fully available in Phase 1, the vendor shall include plans to achieve necessary user roles in their scalability plan.

c. The environment shall support role-based permissions (e.g., Program Manager (PM developer, and project lead). Specifically, users of the environment, including Government and third-party contract developers, shall be allocated licenses only for the tools required by their role within the environment.

4. The following requirements apply to the contractor/performer for all Phases:

a. The contractor/performer shall be able to identify and segment user groups and projects by type of data distribution and dissemination controls (i.e.

ITAR, PII data, etc).

b. The contractor/performer shall be able to identify and segment user groups and projects by company and organization.

c. The contractor/performer shall create and implement a user account creation and onboarding process for the environment which maximizes automation to the greatest extent practical.

d. The contractor/performer shall create and implement a user validation process, which will check if the user is a US citizen and has USG and/or contractor confirmation/approval for account creation. If the user is to be an administrator or cybersecurity professional, the contractor/performer shall validate the user’s security clearance. This validation process shall also validate, via USG and/or contractor confirmation, approval for account creation within 5 business days.

III. TOOLING AND LICENSING SPECIFIC REQUIREMENTS:

1. The following tooling and licensing general requirements apply to the deliverable/prototype for all Phases:

a. The developed environment shall be capable of hosting and providing to users industry standard DevOps tools including, but not limited to: (1) source code management; (2) Continuous Integration/ Continuous Deployment (CI/CD) pipelines; (3) configuration management; (4) containerization and orchestration; (5) monitoring and logging and (6) security and compliance. Examples of acceptable industry standard DevOps tools include Gitlab, Nessus, Purefile, and Sonarqube.

b. The developed environment shall be capable of hosting and providing to users industry standard engineering and data analytics tools including, but not limited to: (1) model-based systems engineering; (2) computer-aided design; (3) product lifecycle management; (4) simulation tools; (5) data analysis and visualization and (6) collaboration and communication.

Examples of acceptable industry standard engineering and data analytics tools include Cameo Systems Modeler, Teamwork Cloud, and Matlab.

c. The environment shall be capable of hosting and providing to users industry standard real time collaboration including, but not limited to various productivity applications and multimedia communication (e.g., video, voice, and content sharing for dial in and teleconferencing).

Examples of similar products include Microsoft Office, Atlassian Suite, Mattermost, Skype, Teams, Teams, Zoom Gov, and Cisco CMS.

d. The environment shall be capable of hosting an isolated email server or service, accessible to only those in the environment.

2. The following tooling and licensing requirement applies to the contractor/performer performance for Phase I:

a. The contractor/performer shall utilize trial licenses or Joint Enterprise License Agreements (JELAs) to demonstrate the contractor/performer’s ability to host applications to the maximum extent practical.

3. The following tooling and licensing requirement applies to the deliverable/prototype performance for Phase II and any potential subsequent Phase following Phase II:

a. The developed environment shall be capable of either first- or third-party management of licenses, networking, and cloud resources, as applicable.

4. The following tooling and licensing requirement applies to contractor/performer performance for Phase II and any potential subsequent Phase following Phase II:

a. The contractor/performer shall maintain near real time dashboards specifically for license utilization.

IV. CYBERSECURITY SPECIFIC REQUIREMENTS:

1. The following cybersecurity requirements apply to the deliverable/prototype for all Phases:

a. The environment shall embrace, to the maximum extent practical, the latest USAF Zero Trust architecture practices and policy (ZTA). A recent copy can be found here:

https://www.safcn.af.mil/Portals/64/Documents/Strategy/DAF%20Zero%2 0Trust%20Strategy%20v1.0%20(002).pdf

b. The environment shall be, to the maximum extent practical, logically isolated from the internet.

c. The environment shall employ and be compliant with latest National Institute of Standards and Technology (NIST) (https://www.nist.gov/) and Federal Information Processing Standards (FIPS) (https://csrc.nist.gov/pubs/fips/140-3/final) requirements for network security and encryption, at IL5 to accommodate Controlled Unclassified Information (CUI) and International Traffic in Arms Regulations (ITAR) data.

d. The environment shall be capable of having segmented project spaces which can securely protect intellectual property, ITAR information, and obfuscate vendor relationships with one another, when directed by the

USG.

e. The environment shall be capable of securely hosting personally identifiable Information (PII) to complete user verification and validation, digital certificates, etc.

f. The environment shall have an ability safely and rapidly ingest commercial off the shelf (COTS), government off the shelf (GOTS), and open-source software (OSS) and associated dependencies.

g. The environment shall implement two-factor authentication (2FA), at minimum. The contractor/performer shall detail the Multi-Factor Authentication (MFA)/2FA plan in the scalability plan deliverable at the end of Phase I.

h. The environment shall have keystroke-level traceability via log and event management (LEM). The contractor/performer shall explain their LEM strategy in the scalability plan deliverable at the end of Phase I.

2. The following cybersecurity requirements apply to the contractor/performer’s performance for all Phases:

a. The contractor shall maintain a continuously compliant NIST compliant Authority to Operate (ATO) or self-attestation package including implementation Cybersecurity Maturity Model Certification Level II controls, at minimum, subject to request and review by the Government at any time.

3. The following cybersecurity requirements apply to the contractor/performer’s performance for Phase II and any potential Phases following Phase II:

a. The contractor/performer shall allow AFLCMC or an AFLCMC-designated third party contractor to perform regular and re-occurring penetrative assessments on the developed environment. The contractor/performer shall patch, or by AFLCMC approval-only, mitigate all security relevant findings within 30 days of USG notification.

b. The contractor/performer shall implement a security incident response plan. The contractor/performer shall detail its incident response plan in the scalability plan deliverable at the end of Phase I. This plan should include timelines and methodologies to address data breaches, common examples or cyber incidents, and data loss tractability response.