(U) TREx Draft SOW for RFI.docx

PR # 82-5002-24

RFP N00173-XX-R-XXXX

Attachment # Date: XX/XX/XXXX

Naval Research Laboratory 4555 Overlook Avenue SW Washington DC, 20375-5329 Code 8250

Transmit/Receive Enterprise (TREx) Service Statement of Work (SOW) DRAFT

10 June 2024

RFP N00173-18-R-MJO1

Attachment #6 Date: 11/07/2020

B2a SOW Sample_1117

STATEMENT OF WORK

TREx

Table of Contents

Section 1 Background.

The Naval Research Laboratory Spacecraft Engineering Division, Mission Operations Branch (Code 8250) develops and operates innovative, resilient, and secure multi-mission satellite operations solutions, and provides Command and control (C2) of satellites Integrated via CONUS/OCONUS antenna network including the Blossom Point Tracking Facility (BPTF).

NRL Code 8250 developed the Transmit/Receive Enterprise (TREx) Service to broker connections to commercial antenna network providers, and to broker access to NRL R&D antenna network to selected Department of Defense (DoD) missions.

Section 2 Objective/ Scope.

The objective of the work is to continue to develop and operate the TREx service, such that transmit/receive capabilities (both government owned and commercially offered), are accessible to end users similar to other commercial cloud services for compute, networking, and storage.

The scope of the work includes building and operating a Development/Security/Operations (DevSecOps) process to continuously deliver new TREx service features and capabilities based on user needs and operational feedback. The scope includes continuous operation of the TREx service, including service monitoring and usage tracking, while maintaining the Authority to Operate (ATO). The work scope includes establishing contractual relationships with commercial antenna network providers to broker access, both technically and financially, to their commercial offerings and/or custom offerings as required from mission users. Finally, the work scope includes the onboarding of new users and missions to the TREx service.

Section 3 Applicable Documents.

· DEPARTMENT OF DEFENSE CLOUD COMPUTING SECURITY REQUIREMENTS GUIDE Version 1, Release 4 14 January 2022

Section 4 Requirements.

4.1 DevSecOps

· Information Technology (IT) Infrastructure

· The contractor shall provide and utilize information technology (IT) infrastructure including compute/network/storage and IT platform services for the creation, transmission, and storage of Controlled Unclassified Information (CUI).

· DevSecOps Process

· The contractor shall provide and utilize a DevSecOps process for TREx deliveries, and shall provide access to NRL government individuals and other designated individuals such as cybersecurity personnel.

· Issue Tracking

· The contractor shall provide and utilize issue tracking for all internal development change/feature requests from users and/or NRL government personnel, and for operational support issues (i.e. support tickets), and shall provide access to NRL individuals and other designated individuals such as cybersecurity personnel.

4.2 NRL Software Development

· Antenna Scheduling

· The contractor shall maintain an interface specification and service functionality to broker the scheduling of shared antenna resources.

· Equipment Control & Status

· The contractor shall maintain an interface specification and service functionality to broker real-time equipment control from users to external networks, and to broker real-time equipment/network status from external networks to users.

· User Data Routing

· The contractor shall maintain an interface specification and service functionality to route (encrypted) uplink and downlink user/mission data between the users and the external networks.

· Ground Specialty Equipment

· The contractor shall maintain ground specialty equipment as required for antenna control, radio frequency and digital signal processing, and wide-area-network data transport equipment.

· The contractor shall conduct prototyping and experimentation of new/novel radio frequency technologies and associated digital processing and network transport devices and services.

4.3 User/Mission Onboarding

· The contractor shall develop and maintain a user/mission onboarding guide/documentation to include mission use cases, technical connectivity, and user/mission configurations.

· The contractor shall conduct and/or broker the licensing of radio frequency uplinks and downlinks for users/missions.

4.4 Service Monitoring and Operations:

· The contractor shall design and develop tests to exercise all TREx externally exposed interfaces and all network provider external interfaces, and shall conduct these for continuous regression testing/service monitoring independent of TREx users.

· The contractor shall monitor and maintain the TREx operational state, and respond to operational issues in accordance with service level agreements (SLAs) established with users/missions.

4.5 Measured Service

· The contractor shall measure service usage by user/mission and by external network to generate performance metrics from operational data and cost attribution of external network resources and data transport by user/mission.

4.6 TREx ATO

· The contractor shall abide by terms of the TREx ATO including development practices, configuration management, access policies, cybersecurity reporting, change requests to the Authorizing Official (AO), and the Plan Of Actions & Milestones (POAM).

4.7 Commercial Antenna/Network Providers

· The contractor shall conduct technical onboarding of commercial antenna networks to include connectivity, software interfacing, and cybersecurity assessments.

· The contractor shall negotiate terms with commercial antenna providers and establish subcontracts, as required, to conduct operations for TREx users.

· The contractor shall implement custom user requirements (e.g. dedicated antenna equipment) or other custom radio frequency capabilities via commercial antenna providers.

Section 5 Use of Existing Corporate Plans, Policies, and Procedures

NRL Code 8250 has existing plans and commitments for the TREx service.

5.1 NRL Code 8250 Development Model:

NRL Code 8250 owns and manages several other software products/services and adheres to the following development model:

· Maximize the use of commercially available IT infrastructure, platform, and Free and Open Source Software (FOSS)/third party products when they do not require customization and can meet DoD cybersecurity standards.

· Minimize the use/dependence on licensed third-party software tools/services, or any third-party software that required customization.

· Maintain NRL ownership of the development and configuration control of all custom software, which is focused on the custom code development of core mission system functions.

· Source code access/contributions may be provided by numerous NRL government and contractor personnel, and source code access restrictions may be required by the NRL government management team.

5.2 TREx ATO

NRL maintains the TREx service Authority to Operate (ATO) with the Space Authorizing Official (AO), United States Space Force (USSF) Space Operations Command (SpOC) S6. The contractor is expected to continue the ATO technical and cybersecurity obligations as well as maintain a technical baseline and cybersecurity artifacts to renew the ATO.

5.3 TREx Users

NRL Code 8250 maintains the TREx service with several active users and commitments to additional users. Continuity of operations is required to the active users.

5.4 Antenna Network Providers

NRL Code 8250 maintains the TREx service with active connections to Amazon Web Services Ground Station (AWS-GS), and selected NRL Code 8250 antennas. Continuity of operations from these providers are required for active users.

Section 6 Data Rights Assertions:

NRL Code 8250 requires full Government ownership (ie NRL copyright) on all custom code developed for the TREx service as well as Infrastructure-as-Code, TREx Design Artifacts, and all TREx usage/Cost Data.

Section 7 Data Deliverables

The Contract Data Requirements List (CDRL) is as follows:

· CDRL A001

· Title: TREx Feature/Onboarding Issue Tracker Summary

· Description: This deliverable shall be a document-formatted output of an automated issue-tracking system. The report shall show all planned/accepted/completed issues that describe work at the TREx feature level and TREx user/provider onboarding milestones.

· Frequency: Monthly.

· Due Dates: By the 15th of the month, to cover the previous calendar month.

· CDRL A002

· Title: TREx Code Repository

· Description: This delivery shall consist of all TREx code, infrastructure as code, third-party product repositories, and TREx documentation such that the TREx Production environment could be reconstituted given a loss of the primary production pipeline. The delivery may be an email notification with instructions to download data from TREx configuration managment from a secure access point.

· Frequency: Monthly.

· Due Dates: By the 15th of the month, to cover the version in production at the end of the previous calendar month.

· CDRL A003

· Title: TREx Development Issue Tracking Report

· Description: This deliverable shall be a document-formatted output of the issue tracking system used by the internal development team. The document shall show all completed development items over the time period.

· Frequency: Monthly.

· Due Dates: By the 15th of the month, to cover the issues completed over the previous calendar month. The issues reported may be aligned with the latest development release of the previous calendar month.

· CDRL A004

· Title: TREx Support Issue Tracking Report

· Description: This deliverable shall be a document-formatted output of the issue tracking system used by the operations/support team. The document shall show all completed and open support items over the time period.

· Frequency: Monthly.

· Due Dates: By the 15th of the month, to cover the issues completed over the previous calendar month. The issues reported may be aligned with the latest production release of the previous calendar month.

· CDRL A005

· Title: TREx Financial Tracking Report

· Description: This report shall separate cost tracking per task, and include funding available, costs incurred for labor, and other direct costs. The report shall include projections for future costs and fund-run-out dates, based on current level of effort. The report shall include a spreadsheet in addition to a summary report.

· Frequency: Monthly.

· Due Dates: By the end of the month to cover the previous month.

· CDRL A006

· Title: TREx Usage Tracking Report

· Description: This report shall track usage of the TREx service and attribute costs per TREx user. This includes usage metrics and costs for infrastructure-as-a-service, networking, and provider network costs.

· Frequency: Monthly.

· Due Dates: By the end of the month to cover the previous month.

Section 8 Security

All contractor personnel who require access to Top Secret Sensitive Compartmented Information (SCI) and/or Special Access Program (SAP) Information access must be US citizens, possess a final DoD granted TOP SECRET security clearance, based on a favorably adjudicated DoD Tier 5 investigation; be ICD 704 eligible, and be indoctrinated for the applicable SCI compartments at the time of bid proposal.

Contractor personnel requiring access to Secret or unclassified material must be a US citizen; have at least a favorably adjudicated DoD Tier 3 investigation and a final SECRET clearance at the time of bid proposal.

Contractor personnel performing any function designated as a component of the Cyber Security Work Force (CSWF), and/or having privileged user access to NRL information systems will require background investigations as specified in SECNAV M-5510.30. System Administrators with privileged access may work in the computing, network and/or enclave environments. System Administrators with privileged access shall meet the training and certification requirements for IAT level I at the computing environment (CE), IAT level II at the network environment (NE), and IAT level III for the enclave environment as specified in SECNAV M-5239.2. A submitted DoD Tier 5 Investigation is required for all System Administrators with privileged access serving in these positions. A completed NACLC investigation and a submitted Tier 5 Investigation are required for all contractor personnel performing CSWF duties. Personnel performing CSWF, IA, or IT duties must be identified as such on all badge and visit request submissions.

Contractors issued a DoD interim secret security clearance may ONLY work on unclassified tasks in accordance with this contract SOW. No classified access will be authorized. Unclassified CSWF, IA, IT or any positon that requires privilege access are NOT authorized with a DoD issued interim secret clearance.

The contractor requires access to TS/SCI and/or TS/SAP systems in order to design, develop, and implement communications applications. This will require access to NATO information and COMSEC controls to participate in demonstration, installations, and software development as required.

All subcontractors identified in the Statement of Work shall supplement their current security practices by requiring any personnel involved in executing the contract to complete. Government-sponsored and administered Operations Security (OPSEC) training, OPSE-1301 and any OPSEC guidance that may pertain to the project.

B2 SOW Template_1117 image1.png