(U) Attachment 3 Starfleet SOW.pdf

STARFLEET MAC IDIQ

BASE CONTRACT

FA8806‐XX‐D‐0XXX

Attachment 1

STATEMENT OF WORK (SOW)

UNITED STATES SPACE FORCE (USSF)

SPACE SYSTEMS COMMAND (SSC)

29 July 2022 Revision 1

Table of Contents:

List of Changes 03

1.0 General Information ‐ Background 04

2.0 Scope 04

3.0 Delivery Order (DO) Contract Data Requirements List (CDRLs) 05

4.0 Applicable Compliance and Reference Documents 06

5.0 Security 07

6.0 Data Rights and Management 08

7.0 Reserved 09

8.0 Reserved 09

9.0 Government Team 09

10.0 Associate Contractor Agreements(s) (ACA) 09

Tables

Table 1 – Starfleet MAC IDIQ CDRL List 05

Table 2 – Starfleet MAC IDIQ Compliance Documents 06

Table 3 – Starfleet MAC IDIQ Reference Documents 07

Table 4 – Starfleet MAC IDIQ Associate Contractors 10

Figures & Examples

Figure 1 – Space C2 Enterprise 04

List of Changes

Date Changes 29 Jul 2022 Rev. 1 – Cover – Added SSC Emblem, removed old emblems, removed/replaced SMC to SSC, and new date, removed CUI designation indicator box. All pages – removed header/footers and portion marking;

page 10 – updated Table 4 contract numbers.

1.0 General Information – Background

The Starfleet Multi‐Award Contract (MAC) Indefinite‐Delivery, Indefinite‐Quantity (IDIQ) contract vehicle is used to develop, demonstrate, test, evaluate, deliver, and integrate open architecture (OA) systems, software services, standards, sensors and supporting infrastructure enabling multi‐domain capabilities for the Space C2 Enterprise. The Starfleet IDIQ has a seven (7) year ordering period and the overall period‐of‐performance (PoP) for Delivery Orders (DOs) can extend up to two (2) years beyond the ordering period for a total of nine (9) years. DOs awarded under this contract are intended to perform operational and tactical command and control (C2) for the Space Enterprise.

2.0 Scope

The Starfleet MAC IDIQ will support the operational and tactical Space C2 Enterprise for development, security and continual operations.

2.1 Description of Supplies

Tactical system on‐boarding, connections, & operational C2 integration o Tactical system C2 on‐boarding and integration o Communication network and Information

Technology (IT) system deployment

Operational C2 software services & DevSecOps (Track Management, Reactive Course‐of‐Action

(COA) Generation, etc.); Tactical C2 Software

Services & DevSecOps o Tactical C2 processing, dissemination and fusion of spacecraft and payload data

Command and Control Enablers: i.e.

Infrastructure as a Service(IaaS); Platform as a

Service (PaaS); Data as a Service (DaaS) o Cyber framework development (hardening) and defensive cyber operations support o Capability deployment and software and system operations support

Software Development Support (Tools, Administrative & Development Network, & Software

Integration Labs (SILs)) o Development Security and Operations (DevSecOps) Continuous Integration/Continuous

Delivery (CI/CD) pipeline development and support

Space Enterprise Standards ‐ open industry technical standard adoption and development

Space C2 Enterprise System Integration, Test & Training – A software driven, everything as code approach to system of systems level continuous integration, test and training.

o Software Architecture and Engineering – Strategic level software architecture design, engineering guides and best practices.

o Quality Assurance and Automated Testing – Continual enhancement of code quality through advanced and automated testing.

o Agile Development Process – Development processes that streamline development, manage dependencies/risks, increase velocity and provide transparency across all development efforts.

o Release Engineering and DevSecOps CI/CD pipeline design, guides and best practices Enable automated deployment capability o Cybersecurity, Defensive Cyber Operations (DCO) and Multi‐Level Security

Support for continuous Authority to Operate (cATO) / continuous Risk Management

Framework (cRMF) approaches o Site Reliability Engineering (SRE) o Data Architecture and System Interface design, guides and best practices o Space C2 user engagement, operator training, procedure and CONOP development o Digital and Systems Engineering for architecture, capability specific, or utility o Modeling, Simulation, Training and Exercise (MSTX) design, development and support o User Interface / User Experience (UI/UX) design, guides and best practices o Space C2 Enterprise level cross‐system design, development and testing o Space C2 Enterprise level enabling capability design, development and testing

Continuous, iterative updates & improvements o Space C2 Modernization – i.e. algorithms, data dissemination/fusion, machine learning, artificial intelligence, and cyber hardening o Continuous iterative update/improvement (maintenance/sustainment/technical refresh) o Integrate Space C2 capabilities with the terrestrial, air and cyber domains

3.0 Delivery Order (DO) Contract Data Requirements List (CDRLs)

The Contractor shall deliver all data and documentation to this electronic repository in accordance with the established delivery schedule for each item.

Table 1 – Starfleet MAC IDIQ CDRL List and Associated SOW References

Data Item Number

Title SOW Paragraph

A001 Billet/Staffing Plan Base (3.1)

A002 Contract Funds Status Report (CFSR) Base (3.2)

A003 Program Protection Implementation Plan (PPIP) Base (3.3)

A004 Data Accession List (DAL) Base (3.4, 6.1, 6.2, 10.0)

3.1 Billet/Staffing Plan, CDRL, A001 ‐ the Contractor(s) shall include and maintain a Government‐ approved security billet plan as part of the base Starfleet MAC IDIQ Task Order. Special Access Program (SAP) access is required for this effort. Individual companies will be responsible for the personnel security aspects of its employees as part of the Program Billet/Staffing Plan.

3.2 Contract Financial Status Report, CDRL A002 ‐ The contractor shall provide monthly program financial status reports per DO basis.

3.3 Program Protection Implementation Plan, CDRL A003 ‐ the contractor shall develop a Program Protection Implementation Plan (PPIP) for each delivery order requirement. The PPIP shall align with the DD Form 254, Contract Security Specification, the Government‐provided Program Protection Plan (PPP), and applicable security compliance documentation (Section 4.1, Table 2).

3.4 Data Accession List, CDRL A004 ‐ the contractor shall provide a consolidated listing of non‐ deliverable, supporting technical and non‐technical data (i.e. presentation material, action items, meeting minutes, etc.). See 6.1, 6.2, and 10.0 for more information.

4.0 Applicable Compliance and Reference Documents

The contractor shall adhere to the compliance documents listed below. In the event a conflict exists between a compliance document, subject SOW, or associated Delivery Order SOW, the contractor shall notify the Government PM and PCO for resolution.

4.1 Compliance Documents – See Table 2 below.

Table 2: Starfleet MAC IDIQ Compliance Documents

Document # Title Version/Date

Compliance Documents

CNSSD 505 Supply Chain Risk Management (SCRM) Current Version

CNSSI 1253 Security Categorization and Control Selection for National Security Systems

Current Version

DoD 8570.01‐M Information Assurance Workforce Improvement Program (or replacement based on DoDD 8140.01, Cyberspace Workforce Management)

Current Version

DoD 5220.22‐M National Industrial Security Program (NISP) Operating Manual (NISPOM) Current Version

DoDD 8140.01 Cyberforce Work Management Current Version

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT) Current Version

DoDM 5205.07 DoD Special Access Program Security Manual:

Volume 1 ‐ General Practices; Volume 2 – Personnel Security;

Volume 3 – Physical Security; & Volume 4 ‐ Marking

Current Version

ICD‐503 Intelligence Community Information Technology Systems Security Risk Management

Current Version

ICD‐705 Sensitive Compartmented Information Facilities Current Version

JDCSISSS Joint DODIIS / Cryptologic SCI Information Systems Security Standard Current Version

JSIG Department of Defense (DoD) Joint Special Access Program (SAP) Implementation Guide (JSIG)

Current Version

NIST SP 800‐30 Guide for Conducting Risk Assessments Current Version

NIST SP 800‐37 Risk Management Framework for Information Systems and Organizations:

A System Life Cycle Approach for Security and Privacy

Current Version

NIST SP 800‐39 Managing Information Security Risk: Organization, Mission, and Information System View

Current Version

NIST SP 800‐53 Security & Privacy Controls for Federal Information Systems & Organizations

Current Version

NIST SP 800‐53A Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans

Current Version

NSIS‐C, Section 600.3

National Reconnaissance Office (NRO) System Integration Specification Current Version

N/A DoD Enterprise DevSecOps Reference Design Current Version

N/A DevSecOps Enterprise Container Hardening Guide Current Version

4.2 Reference Documents – See Table 3 below.

Table 3: Starfleet MAC IDIQ Reference Documents

Document # Title Version/Date

Reference Documents

N/A Air Force Future Operating Concept Current Version

N/A AFSPC Commander's Operational Intent for Space Enterprise Vision Current Version N/A AFSPC Commander's Strategic Intent Current Version N/A DoD Enterprise DevSecOps Initiative Moving to Micro‐Services (Draft) Current Version

N/A DoD Enterprise DevSecOps Initiative Pipeline Description (Draft) Current Version

N/A MIT/LL Space C2 Jumpstart Documentation Current Version N/A Risk Management Guide for DoD Acquisitions Current Version N/A SCOOP Design Reference Missions Current Version N/A Universal Command and Control Interface (UCI) Standard Current Version JP 3‐14 Space Operations Current Version JP5‐0 Joint Operational Planning Current Version OAC‐STD‐001 Unmanned Aerospace Systems Command and Control Standards Initiative

Standard Current Version

OMSC‐STD‐001 Open Mission System (OMS) Definition & Documentation Current Version

5.0 Security

The contractor shall implement, administer, and maintain a security program to ensure classified information is protected per the DD Form 254, Department of Defense Contract Security Classification Specification and DO‐specific, appropriate Security Classification Guide(s). The contractor(s) must have access to a Secure Compartmented Information Facility (SCIF), with Special Access Program‐Facility (SAP‐F) overlay that has been accredited for performing and safeguarding work up to TS/SCI and SAR/SAP at time of contract award. The contractor may be excluded from a DO award, if unable to comply with facility requirements at time of award. The Contractor shall work with the Government PSO direction to ensure security issues are properly addressed and Government approval is obtained when necessary.

5.1 Personnel Security Clearance Requirements ‐ key individuals who will support classified Starfleet Delivery Orders (DOs) must be eligible for, and comply with applicable program security requirements, enabling them to work with TS/SCI and SAP materials at the time of contract award.

5.2 Facility Accreditation – Starfleet IDIQ contractors are responsible for coordinating the accreditation and maintenance of their individual facilities. Starfleet IDIQ contractors are responsible for any combined facilities deemed necessary for developing joint deliverables.

5.3 Classified Computer Networks ‐ the contractor shall maintain a TS//SCI//SAR working space that will support a connection to the RockNet classified collaborative network. The network will be the virtual work‐space to remotely collaborate, share information, develop, integrate, and assemble products with the Contractor teams. The Government will provide the necessary cryptographic devices (TACLANEs) to the industry locations and systems to the Government network.

5.4 System Security Engineering ‐ The Contractor shall update, deliver, and comply with the Program Protection Implementation Plan (PPIP) and include workforce security training. The Contractor shall provide recommended changes to the Government when information is acquired that suggest the need for a Program Protection Plan (PPP) update. The Contractor shall flow PPIP requirements in all applicable subcontractor and supplier contracts and verify compliance.

5.4.1 The Contractor shall comply with Contractor Operations Security (OPSEC) once approved by the Government Program Office

5.4.2 The Contractor shall establish and maintain an insider threat program to gather, integrate, and report relevant and available information indicative of a potential or actual insider threat, consistent with E.O. 13587 and the National Insider Threat Policy. The Contractor will submit reports to the designated Office of Special Investigations (OSI) in a timely manner; with a copy to the Government Program Office (GPO).

5.4.3 Contractor shall support and participate in government audits conducted to ensure compliance and safeguards employed are adequate for the protection of program information.

5.4.4 The Contractor shall identify security, security engineering, and program protection issues to the Government at regularly scheduled PMRs.

5.4.5 The Contractor shall manage the nomination of personnel for program access using JADE, to include providing nominations for personnel to have write access to JADE. The Contractor shall nominate individuals who are anticipated to materially contribute to the program. The Contractor shall debrief personnel when access is no longer required. The Contractor shall ensure JADE submissions are adequate, accurate and complete per latest guidance from the Government. NOTE: The Contractor shall ensure Special Access Program access requests are limited to the minimal number of employees necessary for operational efficiency, consistent with contractual obligations and other requirements.

5.4.6 The Contractor shall be responsible for creating JADE profiles, updating Pre‐Screening Questionnaires (PSQs) annually, and ensure annual refresher training is completed and annotated.

6.0 Data Rights and Management

The Government shall have, at a minimum, Government Purpose Rights to documentation, hardware, software, and source code developed under this contract. Any service or service interface software developed wholly under this effort shall have, at a minimum Government Purpose Rights and be deliverable via the applicable CDRL.

6.1 Data Accession ‐ The Contractor shall develop, maintain and deliver a Data Accession List (DAL) (CDRL A004) identifying data generated using Government funds in support of the Starfleet delivery orders. The DAL shall include items specified in each DO for inclusion in the DAL and drawings, analysis, source code, algorithms, parts lists, and products that are not CDRLs.

6.2 If the Government requests deferred orders of Technical Data, or Computer Software item(s) from the DAL as permitted by DFARS 252.227‐7027, the Contractor shall only be compensated for converting the data or computer software into the prescribed form, for reproduction, and for delivery.

Such compensation shall be minimized and shall not include costs associated with verifying/validating items, no duplicated item, and determining data rights, proper markings, and any other due diligence.

6.3 The Contractor shall develop an electronic Integrated Data Environment (IDE) repository readily available and directly accessible by the Government (from contractor facility) within 30 days after ATP (anticipated to be DO1). The IDE shall be at the classified level, and shall be searchable by keyword and be sortable by date of last update. The Contractor shall provide access to unclassified IDE by the Government (from contractor facility) if one is used by the Contractor.

7.0 Reserved

8.0 Reserved

9.0 Government Team

The Government team includes Non‐Government Advisors (NGAs) as follows from Federally Funded Research and Development Corporations (FFRDCs), University‐Affiliated Research Centers (UARCs), and government contractors. The Contractor shall notify the PCO immediately if there are any concerns regarding the participation of NGA personnel during the performance of this contract.

FFRDCs: The Aerospace Corporation, MITRE Corporation, Carnegie Mellon University Software Engineering Institute (SEI), Massachusetts Institute of Technology‐Lincoln Laboratory (MIT‐LL), Lawrence Livermore National Laboratory (LLNL), and Sandia National Laboratory (SNL)

UARCs: Johns Hopkins University Applied Physics Laboratory (JHU/APL), University of Southern California Information Sciences Institute (USC/ISI)

Advisory and Assistance Services (A&AS) contractors and their subcontractors: SAIC, Quantech, Stellar Solutions, Tech 7, Booz Allen Hamilton, AT&T, ExoAnalytics, Mantech, and Tecolote Research.

10.0 Associate Contractor Agreement(s) (ACA)

The Contractor shall enter into Associate Contractor Agreements (ACA) for any portion of the contract requiring joint participation (see individual DOs for examples) in the accomplishment of the Government's requirement. The agreements shall include the basis for sharing information, data, technical knowledge, expertise, and/or resources essential to the Starfleet IDIQ that shall ensure the greatest degree of cooperation for program development to meet the terms of the contract.

ACAs shall include the following general information:

Identify the associate contractors and their relationships

Identify involved program and the relevant associate contractors Government contracts

Describe the associate contractor interfaces by general subject matter

Specify the information categories to be exchanged or support to be provided

Include the ACA expiration date

Identify potential conflicts between relevant Government contracts and the ACA; include agreements on employee proprietary data protection and restrictions

A copy of such agreement shall be provided to the PCO via the DAL (CDRL A004) NLT then 90 days after the award of Delivery Order 0001. The Government intends to award DO 0001 approximately 3rd Quarter FY 2021. The Contractor is not relieved of any contract requirements or entitled to any adjustments to the contract terms because of a failure to resolve a disagreement with an associate contractor. Liability for the improper disclosure of any proprietary data contained in or referenced by any agreement shall rest with the parties to the agreement and not the Government. All costs associated with the agreements are included in the negotiated cost of this contract. Agreements may be amended as required by the Government during the performance of this contract.