(U) FA8600-23-S-C056-0008 - CSO Call 8 - Attachment 1 SOO.pdf
PDF 67 KB Posted
- Attached to
- CSO Call 8 - "Project Smiley"
- Solicitation number
- FA8600-23-S-C056-0008
- Issued by
-
Department of the Air Force
About this file
This Statement of Objectives (SOO) for Project Smiley details a cybersecurity assessment contract for the Air Force Life Cycle Management Center (AFLCMC). The primary objective is for a contractor to conduct comprehensive cyber vulnerability assessments on industry vendor networks, focusing on nation-state level adversarial penetration testing. Specific requirements include performing assessments on development networks, Controlled Unclassified Information (CUI) networks, and Joint Special Access Program Implementation Guide (JSIG) compliant networks within 30-day engagement periods.
Key technical requirements involve evaluating network security from nation-state actor perspectives, with goals of gaining subversive network access, establishing persistence, performing lateral movement and privilege escalation, and attempting data exfiltration. The contractor must deliver detailed reports with actionable recommendations for improving network security, technology, and culture postures. The contractor will coordinate directly with vendors, establish Non-Disclosure Agreements, and be capable of conducting at least four assessments in parallel. Anticipated deliverables include contract kick-off presentation materials and comprehensive assessment findings reports with mitigation strategies for each identified vulnerability.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
UNCLASSIFIED
Statement of Objectives
PROJECT SMILEY
Version 1.0
5 June 2025
1 OBJECTIVE
This Statement of Objectives (SOO) describes the technical requirements to be performed by the Contractor in support of Project Smiley. AFLCMC has a requirement for a vendor to conduct cyber assessments of industry in support of mission effectiveness.
2 BACKGROUND
The Contractor shall leverage its strong experience conducting cyber vulnerability assessments to meet the objectives in this SOW.
3 TECHNICAL REQUIREMENTS
3.1 The Contractor shall conduct nation state level adversarial penetration testing of
AFLCMC-identified development networks, not exceeding 30-days per engagement at various 3rd party industry vendor facilities.
3.2 The Contractor shall assess industry vendor Controlled Unclassified Information (CUT) networks. The Contractor shall provide feedback on discovered vulnerabilities with regards to the latest revision of National Institute of Standards and Technology (NIST) Special Publication 800-171.
3.3 The Contractor shall assess Joint Special Access Program Implementation Guide (JSIG) compliant networks.
3.4 The Contractor shall perform cyber assessments on industry vendor networks with a specific focus on evaluating the networks' security from nation-state actors with the goal to gain subversive network access, establish persistence, perform lateral movement and privilege escalation, and attempt data exfiltration from within the identified vendor network.
3.5 The Contractor shall deliver a report detailing actionable recommendations and remediation activities to improve the evaluated vendors' network security, technology, and culture postures.
3.6 The Contractor shall coordinate directly with industry vendors to schedule and perform cyber assessments, to include establishing a Non-Disclosure Agreement (NDA) between the Contractor and the vendor whose network is being assessed. The Contractor shall be able to perform at least four assessments in parallel.
4 PLACE OF PERFORMANCE
Primary places of performance shall be at Contractor facilities or designated industry vendor network sites.
5 REQUIRED EQUIPMENT/INFORMATION
The Contractor will be provided access to each industry vendor's development environment instance(s).
6 PROGRAM MANAGEMENT
The Contractor shall ensure the contract is executed within contract specifications, actively participate in virtual and in-person meetings, manage deliverables, and support technical and security activities. The Program Manager shall be the primary interface to the Government.
7 PROGRAM SECURITY
The Contractor must meet the requirements for Security detailed in the Call.
8 ANTICIPATED DELIVERABLES
The anticipated deliverables for this contract are contract kick-off presentation materials and reports of findings compiled at the completion of each industry vendor's cyber assessment. The report shall provide mitigation strategies andlor guidance on vulnerability remediation for each confirmed finding during the cyber assessment.
File details come from the government source that posted it. Updated .