EWPMTTaskOrder1PWSDraftv6.pdf

UNCLASSIFIED//PROCUREMENT SENSITIVE

Performance Work Statement (PWS) for

Task Order 1 of the

Electronic Warfare Planning and

Management Tool

(EWPMT)

Version 6.0

25 July 2012 i

Table of Contents

1 Scope

1.1 Background

1.2 Program Objectives for Capability Drop 1

1.2.1 Stand-Alone Operation [OPTION]

2 Applicable Documents

2.1 Department of Defense – Specifications, Standards and Handbooks

2.2 Other Government Documents, Drawings and Publications

2.3 Non Government Documents – Commercial Standards

3 Program Requirements

3.1 Schedule Objectives

3.2 Program Management

3.2.1 Program Management

3.2.2 Cost Reporting

3.2.2.1 Contract Work Breakdown Structure (CWBS)

3.2.2.2 Contract Performance Report (CPR)

3.2.2.3 Schedule Risk Assessment (SRA)

3.2.2.4 Resource/Spend Plan

3.2.2.5 Contract Funds Status Report (CPSR)

3.2.3 Design Review and Integrated Product Team (IPT) Meetings

3.2.3.1 Working Group IPTs

3.2.3.2 Design Reviews

3.2.4 Data Deliverables

3.2.5 Quality Assurance

3.2.6 Public Private Partnership

3.3 System Engineering

3.3.1 System Engineering

3.3.2 System Design

3.3.3 Interface Control

3.3.4 Risk Management

3.4 Software Engineering

3.4.1 Software Development

3.4.2 Software Development Environment (SDE)

ii

3.4.2.1 SDE Resource Requirements

3.4.2.2 SDE Operation and Initial Government Acceptance

3.5 Security

3.5.1 Security Requirements

3.5.2 Program Technology Protection

3.5.3 Anti-Tamper (AT)

3.5.4 Information Assurance (IA)

3.5.5 Information Assurance Vulnerability Alert (IAVA) Compliance

3.5.6 Information Security (INFOSEC)

3.5.7 Communications Security (COMSEC)

3.5.8 Operations Security (OPSEC)

3.5.9 Anti-Terrorism (AT)

3.5.10 Foreign Disclosure/Export

3.5.11 Personnel Security

3.5.12 Assessment of Program Security Effectiveness

3.6 Test and Evaluation

3.6.1 Software Testing

3.6.1.1 Test Readiness Review (TRR)

3.6.1.2 Test Completion Review (TCR)

3.6.1.3 Capability Drop Deliveries

3.6.2 Integration and Test (I&T)

3.6.3 Operational Test

3.7 Configuration Management

3.7.1 Class Changes

3.7.2 Contractor Configuration Control Board (CCCB)

3.7.3 Product or System Improvement

3.8 Integrated Logistics Support

3.8.1 Reliability, Availability and Maintainability Program

3.8.2 Technical Manuals

3.8.2.1 Technical Manual Development

3.8.2.2 Technical Manual Validation

3.8.2.3 Technical Manual Verification

3.8.3 Software Maintenance Program

3.8.4 Training and Training Materials

iii

3.8.5 Supply Support

3.8.5.1 Field Support Representatives (FSRs)

3.8.6 Manpower and Personnel Integration (MANPRINT)

3.8.7 Initial Product Support Plan (PSP) for Performance Based Logistics (PBL) 32

3.8.8 PBL Metrics Guidance

3.9 Purchased Equipment

3.10 Development and Test Capability

3.11 Safety Assessment Report (SAR)

3.12 Government Furnished Equipment/Information (GFE/GFI)

4 CDRL List

1 SCOPE

The scope of this effort is to define and design the capability drop 1 of the EWPMT. The

Contractor shall provide a range of services and effort necessary to design, build, integrate, test and deliver capability drop 1. These services shall include engineering design, procurement incidental to performing the stated PWS efforts, integration, production and installation of

Hardware, Software, and Systems. The period of performance for this effort is the date of contact award through fourteen (14) months after award of contract.

1.1 Background

The Electronic Warfare Planning and Management Tool (EWPMT) is part of the Integrated

Electronic Warfare System (IEWS) Family of Systems (FoS). The IEWS FoS includes Multi-function Electronic Warfare (MFEW), Defensive-Electronic Attack (D-EA), and EWPMT.

Facing an electromagnetic environment that is congested and contested among adversaries and non-aligned parties and the proliferation of EW technologies worldwide, the Army intends to develop a framework to integrate current and future EW capabilities into a networked, modular system capable of providing a unified EW capability across the force. The EWPMT is software that gives Electronic Warfare Officers (EWO) mission planning capability to plan, coordinate, manage, and deconflict unit EW activities. It will provide battle management for distributed, networked EW capability, aligned with fires and synchronize air/ground electromagnetic spectrum operations across the G2/3/6 areas of responsibility.

1.2 Program Objectives for Capability Drop 1

The objective of this effort is to deliver capability drop (CD) 1 of the EWPMT. This capability drop will be fielded by 2014 and provides the current force with essential EW mission planning and management tools. The following Figure 1 depicts completed functions planned for this capability drop. Partial implementation of functionalities in later CDs can be implemented in this CD if engineering analysis identified need to implement functionalities over multiple CDs.

Figure 1: EWPMT Capability Drop Functions

The EWPMT design shall leverage common infrastructure and interoperability services available on the Command Post Computing Environment (CP CE).

The Offeror shall use Modular Open Systems Approach (MOSA) to:

(1) Facilitate development of a modular architecture and allow for affordable intraoperability.

(2) Ensure that the system design is sufficiently flexible and robust to accommodate changing technology and requirements.

(3) Facilitate integration with other systems and use of commercial products from multiple sources both in the initial design and in future enhancements.

(4) Enable technology insertion as currently available 3 rd

Party commercial products mature and new commercial products become available in the future.

(5) Allow for affordable support.

(6) Allow continued access to technologies and products supported by many suppliers (a broad industrial base which does not restrict available sources to the detriment of competition)

For systems that tend to evolve and improve with time, the EWPMT MOSA architecture shall utilize a Service Oriented Architecture (SOA) exposing capabilities as Web Services in accordance with (IAW) Common Operating Environment (COE).

1.2.1 Stand-Alone Operation [OPTION]

In the event that EWPMT is unable to test, integrate and deploy with the CPCE provisioned computing environment, the purchase of dedicated EWPMT hardware is required. This hardware shall include computer servers, storage area networks (SAN), laptops, network equipment and all associated accessories that match CPCEv2 specification for corresponding items. The purchase of operating systems and supporting software and their licenses may also be required. For all software that appears on the CPCEv2 common software list, the software shall match the version specified by CPCEv2.

2 APPLICABLE DOCUMENTS

In the event of conflict between the PWS and any of the reference documents, the PWS shall take precedence.

The Contractor shall use the following documents as guidelines to the extent specified herein.

2.1 Department of Defense – Specifications, Standards and Handbooks

The following specifications, standards, and handbooks form a part of this PWS to the extent specified herein and are provided for reference and guidance. Unless otherwise specified, the latest issues of these documents are provided in the Department of Defense Index of

Specifications and Standards (DoDISS) and supplement thereto:

Document Number Document Title

MIL-HDBK-61A(SE) Configuration Management Guidance

MIL-HDBK-454 General Guidelines for Electronic Equipment

MIL-HDBK-502 Acquisition Logistics

MIL-STD-129P Military Marking for Shipping and Storage

MIL-STD-130N Identification Marking of U.S. Military Property

MIL-STD-881C Work Breakdown Structures for Defense Materiel Items

MIL-STD-882E System Safety

MIL-STD-2525C Common Warfighting Symbology

MIL-STD-31000 Technical Data Packages

MIL-STD-40051-1A

Preparation of Digital Technical Information for Interactive Electronic

Technical Manuals (IETMs)

2.2 Other Government Documents, Drawings and Publications

The following Government documents, drawings, and publications form a part of this PWS to the extent specified herein.

AR-25-2

Information Management: Management of Subsystems Information

Assurance

AR 385-40 Safety and Health Accidents and Injuries

AR 715-9 Contractors Accompanying the Force

DODI 6055.11

Protection of DoD Personnel from Exposure to Radio Frequency

Radiation and Military Exempt Lasers

DODI 8500.2 Information Assurance Implementation

MIST SP 800-53, Rev. 3 Recommended Security Controls for Federal Information Systems and

Organizations

TBD IEWS Security Classification Guide

TBD Performance Based Specification - Government (PBS-G)

DoD Information Assurance Certification and Accreditation Procedures

(DIACAP)

2.3 Non Government Documents – Commercial Standards

ANSI/TIA/EIA-568-A Commercial Telecommunications Cabling Standard

ASME Y14.100 Engineering Drawing Practices

ASME Y14.24 Types and Applications of Engineering Drawings

ASME Y14.34M Associated Lists

ISO 10007

Quality Management Systems - Guidelines for Configuration

Management

3 PROGRAM REQUIREMENTS

The tasks outlined in this PWS include program management, system engineering, design engineering, software engineering, configuration management, technical data package, quality assurance, material procurement, systems integration & test, demonstration support, and logistics support for the EWPMT system.

The Contractor shall provide the range of services necessary for the development, build, integration, test and delivery of the EWPMT.

The Contractor shall:

Provide an Integrated Master Schedule and Work Breakdown Structure consistent with the PWS tasks called out.

Conduct the following reviews; Systems Requirement Review (SRR), Systems

Functional Review (SFR), Preliminary Design Review (PDR), Critical Design Review

(CDR) and Test Readiness Review (TRR). The Contractor can combine the SRR with

SFR.

Generate Systems Engineering MASTER Plan (SEMP).

Perform all required testing.

Provide configuration management functions for EWPMT.

Provide technical documentation, user manuals, and training materials.

Develop embedded training with IEWTPT simulation.

Develop embedded training with IEWTPT interfaces.

Provide security accreditation documentation and provide a security design for the

EWPMT system to operate at required Mission Assurance Category (MAC) II classified

Security levels.

Generate or produce Software Requirements Specifications, Interface Control Documents

(ICD) and a Drawing package.

Transfer the EWPMT software Baseline and documentation to Government configuration management control.

Provide a Technical Data Package (TDP) consistent with requirements cited in MIL-

STD-31000 for both hardware and software, as well as supporting technical documentation, e.g. test plans, procedures, software code, logic diagrams… etc, in accordance with CDRLs/DIDs herein.

Provide a secure, access-controlled Integrated Data Environment (IDE) for use by the

Government and the Contractor, which shall serve as a repository for program management information and data deliverables.

3.1 Schedule Objectives

The Government‘s Integrated Master Plan (IMP) identifies the EWPMT program‘s key objectives against which the offeror/Contractor shall build their Integrated Master Schedule for the program. The Contractor‘s IMS shall take into account both the explicit milestones and implicit milestones inherent to the offeror/Contractor approach in executing the EWPMT program.

3.2 Program Management

3.2.1 Program Management

The Contractor shall establish and maintain a data management system for control, tracking, and accountability of all program data and documentation set forth in the Contract Data

Requirements List (CDRL).

The Contractor shall have a Program Management team structure necessary to support execution of the EWPMT effort.

The Contractor shall track and manage the status of tasks and schedule of events for all tasks within this PWS utilizing an Integrated Master Schedule (IMS).

The Contractor shall interface with the Government through an Integrated Product Team (IPT) structure. The Government‘s IPT structure includes Management/Integration, System

Engineering & Logistics, Supportability/Acquisition, Test & Evaluation, Cost and Security

Requirements IPTs. These IPTs shall include Government, Federally Funded Research and

Development Centers (FFRDC), and Government System Engineering and Technical Assistance

(SETA) participation.

The Contractor shall prepare and submit a monthly status report (A001) addressing the topical areas which follow. The Contractor shall brief program progress and report statuses of all activities associated with the EWPMT effort and provide technical overview presentations at monthly Program Management Reviews (PMRs). The Contractor shall identify areas of program risk and concern, tasks completed, action item status, schedule progress, funding status, Integrated Logistics Support (ILS) status and notification of design changes. These meetings shall be held on mutually agreeable dates at an agreed upon location.

The Contractor shall participate in interface, analysis, and planning meetings with Government agencies and other contractors on an as required basis. The Government will provide details, and identify objectives for these meetings not less than 5 working days prior to the meeting date.

3.2.2 Cost Reporting

3.2.2.1 Contract Work Breakdown Structure (CWBS)

The Contractor shall develop and maintain a CWBS that follows MIL-HDBK-881 for the

EWPMT development (A003). The CWBS shall be an extension of the project summary Work

Breakdown Structure (WBS). It shall reflect the requirements of this PWS, and provide the basis for management and for cost reporting at and below the cost account level. The Contractor shall use the CWBS as the baseline for contract planning, the Contract Performance Report (CPR), the

Integrated Master Schedule (IMS), and the Contractor Cost Data Report (CCDR).

3.2.2.2 Contract Performance Report (CPR)

The Government requires CPR for reporting the EWPMT baseline cost reimbursement task orders. The CPR shall use the WBS that will be implemented at Task Order award and as changed by future modifications.

The Contractor shall provide the CPR in Formats 1, 2, and 5. The Contractor shall provide an attachment to format 1 to include current software size (SLOC). The CPR thresholds for explanation of applicable variances, which are subject to Government review and may be modified, are as follows:

(1) Format #1 – Work Breakdown Structure: Format to provide separate breakout of overhead.

(2) Format #2 – Organizational Categories: Contractor Format.

(3) Format #5 - Explanations and Problem Analyses.

3.2.2.3 Schedule Risk Assessment (SRA)

The Schedule Risk Assessment shall follow the Integrated Master Schedule (IMS) format.

3.2.2.4 Resource/Spend Plan

The Contractor shall prepare and submit a report that portrays resource and manpower actuals and projections for the contract period (A040). The report shall address, and update with each submission, all portions of the contract.

WBS

Level

Cost & Schedule

Current Month

Cost & Schedule

Cum to Date

At Complete

1 +/- 10% +/- 10% +/- 3%

2 +/- 15% +/- 15% +/- 5%

3 +/- 20% +/- 20% +/-10%

3.2.2.5 Contract Funds Status Report (CFSR)

The Contractor shall prepare and submit a Contract Funds Status Report (CFSR) for any Cost

Reimbursable Task Order (A002). The Contractor shall use DD Form 1586 to prepare the

CFSR.

3.2.3 Design Review and Integrated Product Team (IPT) Meetings

3.2.3.1 Working Group IPTs

The Contractor shall conduct Working Group IPT Meetings with the designated Government representatives as required. These meetings shall be held on mutually agreeable dates and locations.

3.2.3.2 Design Reviews

Design Reviews shall be conducted as specified below. The Contractor shall provide presentation and source material for all meetings and reviews. (A005)

The Contractor shall conduct the following reviews:

EWPMT Systems Requirements Review (SRR)

EWPMT Systems Functional Review (SFR). SFR can be conducted in conjunction with the SRR

EWPMT Preliminary Design Review (PDR)

EWPMT Critical Design Review (CDR)

A Preliminary Design Review shall be conducted for the EWPMT capability drop 1. The purpose of the PDR is to demonstrate that the preliminary design meets all system requirements with acceptable risk and within the cost and schedule constraints and establishes the basis for proceeding with detailed design. It will show that the correct design options have been selected, interfaces have been identified, and verification methods have been described. The

Requirements Definition Documents (RDDs) (A006), System/Subsystem Specification (SSS)

(A007), Software Requirements Specification (SRS) (A008), Interface Control Document (ICD)

(A009), and Software Architecture Design Document (SADD) (A010) shall be delivered no later than (NLT) 30 days prior to the review.

A Critical Design Review shall be conducted for Capability Drop 1 of the EWPMT. The purpose of the CDR is to demonstrate the maturity of the design and to ensure that the "build-to" baseline contains detailed specifications that can meet functional and performance requirements.

The Software Design Document (SDD) (A011), Interface Design Description (IDD) (A012), Software Version Description Document (SVDD) (A013) and Database Design Document

(DBDD) (A014) shall be delivered NLT 30 days prior to the review.

3.2.4 Data Deliverables

The Contractor shall develop, prepare and deliver contract data deliverables, called for in the

Contract Data Items List (CDRL) associated with the PWS paragraphs herein as identified in

Paragraph 4 of this PWS. The Contractor is responsible for all lower tier data generated by team members/subcontractors and/or vendors.

The Contractor shall ensure that data is delivered on schedule and in a quality manner, and that the information/data provided is clear in its content, cohesive within the data item as well as the overall contract (PWS) effort.

NOTE: Where Government review and comment is required, that review will be based on information presented. If the information required (by the CDRL) is deemed to be deficient in any way, it will be rejected without Government editing.

Prepare and deliver each data item in accordance with its corresponding contract CDRL, DD

Form 1423-1 and preparation instructions therein (Block 16).

Each data item shall be identified and tracked in the IMS.

Ensure all data deliverables are traceable to specific tasks defined in the PWS.

All data shall be in Contractor format unless otherwise specified and mutually agreed to

Develop and maintain a Data Access List (DAL) of all relevant Contractor/subcontractor generated data posted to the Integrated Data Environment including proprietary documents (appropriately marked).

Provide the Government complete access to all internal data generated in the performance of this contract, regardless of delivery requirement to the Government.

3.2.5 Quality Assurance

The Contractor shall conduct Quality Assurance in accordance with industry best practices for quality assurance.

The Contractor shall deliver a Quality Assurance Plan (A039). The plan shall identify the organizational structure, quality interfaces and the quality activities conducted during all product development, integration, test and delivery.

3.2.6 Public Private Partnership

The Contractor shall partner with government components within US Army Communications-

Electronics Research, Development, and Engineering Center (CERDEC) to leverage

Government of the Shelf (GOTS)/GPR modules and components in use in other programs (e.g.

at a minimum the Contractor shall leverage the Communications Effects Simulator (CES), the

Spectrum Planning Advisor (SPA), and the Spectrum Knowledge Repository (SKR) – all modules of the Electromagnetic Battle Manager, EMBM). The Contractor‘s design architecture, development plan, and schedule shall leverage these S/W modules to reduce cost, schedule, and performance risk to the program. Furthermore, the Contractor shall collaborate with government partners and synchronize development and software release and sustainment schedules.

The Contractor shall work with US Army CERDEC laboratories or CECOM SEC to verify and validate interfaces with unclassified and classified spectrum data sources (eg SXXI, ARAT, SKR, JDSR), for use within their product. The Contractor shall work with US Army CERDEC to verify that analyctical models (e.g. propagation, interference, deconfliction) performed within their product provide precision and results corresponding to other tools in use by DOD spectrum managers e.g. Spectrum XXI Online, CJSMPT, etc. CERDEC Point of Contact (POC) is Bob

Shields (443)395-8665 and the CECOM SEC POC is Wayne Field (443) 861-3480.

3.3 System Engineering

3.3.1 System Engineering

The Contractor shall develop and deliver a System Engineering Master Plan (SEMP). (A015)

The Contractor shall develop a SEMP for the development of the full operational capability

(FOC) of the 22 EWPMT functions for the various Capability Drops outlined in Figure 1. The plan shall lay out the software development plan for each capability drops and identify any functionality requiring multiple capability drops to achieve full functionality. The Contractor shall track and maintain the status of each of the 22 functions partial or full implementation. The

Contractor shall brief the plan as part of each appropriate capability drop PDR and the final plan at the appropriate capability drop CDR.

The Contractor shall capture the EWPMT System Engineering Documentation in a database tool and the Government shall have access to that database.

3.3.2 System Design

The Contractor shall perform system engineering and analysis leading to an EWPMT system design and development strategy which satisfies the allocated requirements stated in Table X of the EWPMT Performance Based Specification – Government (PBS-G).

3.3.3 Interface Control

The Contractor shall develop EWPMT interfaces and document technical requirements in the

ICD. The ICD documents all external data exchanges implemented in EWPMT and it includes information on the systems involved in the interface, the data exchanged, the ports and protocols used to exchange the data, the security (encryption, authentication) utilized by the interface and include diagrams graphically depicting the interface. (A016)

3.3.4 Risk Management

The Contractor shall develop, document, and then implement a process for Risk Management.

This process shall include methods and procedures for identifying risks, assessing risks, developing mitigation plans and contingency plans for risks. The Contractor shall present Risks and mitigation efforts at Program Reviews.

The Contractor‘s Risk Management Plan and approach shall be included as part of the SEMP.

3.4 Software Engineering

The Contractor shall ensure that the EWPMT retain interoperability and backward compatibility with all interoperable systems in the CS 15-16/COE v.2 and future COE versions architectures.

The Contractor‘s system engineering and software designs shall reflect industry MOSA open standards, utilize the operating system provided in the Army Golden Master program, and align with CP CE architecture and technology governances.

The Contractor shall document all software releases in the Software Version Description

Document, and shall update the Software Users Manual accordingly.

The Contractor shall plan software builds in support of trouble report fixes, PM Mission

Command Quarterly release cycles or CP CE release cycles, software blocking transition and required participation in system-of-system integration events.

The Contractor shall develop new versions of EWPMT software such that the new versions will be able to replace a previously fielded version and shall not lose any interoperability with other existing systems, system services, components in the field.

The Contractor shall conduct detailed design analysis of software defects, security patches, software change proposals or enhancements for all tasks to determine the required software fixes

/ upgrades necessary to the EWPMT software design. Prior to implementing the fixes/upgrades required, the Contractor shall discuss design work with the Government in working group meetings to support the Government decision making process.

3.4.1 Software Development

The Contractor shall develop software to implement the software functionality of the allocated requirements of the PBS-G.

The Contractor shall develop the required SOA software services IAW the DCGS-A Service

Interface Specification, V1.0. Appendix A shall be the minimum set for implementation.

The Contractor shall document all system requirements allocated to Computer Software

Configuration Items (CSCI) in a Software Requirements Specifications.

The Contractor shall document final software product baseline for all CSCI for EWPMT in a

Software Product Specification. (A017)

All new software and modifications to existing software (including COTS, GOTS, and firmware) shall be developed utilizing IEEE/EIA 12207 as a guide and shall be documented in the Software

Version Description Document (SVDD).

The Contractor shall perform configuration management on all software.

The Contractor shall provide Software Installation scripts and procedures. (A018)

The Contractor shall provide to the Government recommended Software applications or tools for approval to implement. The Contractor shall recommend selection criteria and shall perform selection based on the criteria that has been agreed-to by the Government.

The Contractor shall design, procure, and make operational in the Contractor‘s plant, a SDE that shall be sufficient to develop and test the EWPMT, as well as meet life cycle software support requirements. The SDE shall comply with the Joint Technical Architecture (JTA) – Army. The

SDE shall inclue all hardware, , support software, software tools, test support tools, test support tool documentation, associated data files, and all appropriate licenses. The SDE shall provide the Government the capability to modify the EWPMT source code, documentation and data; and to build, test, install, and operate all EWPMT support software, and associated utilities.

3.4.2 Software Development Environment (SDE)

The Contractor shall design, procure, and make operational in the Contractor‘s plant, a SDE that shall be sufficient to develop and test the EWPMT, as well as meet life cycle software support requirements. The SDE shall comply with the Joint Technical Architecture (JTA) – Army. The

SDE shall inclue all hardware, support software, software tools, test support tools, test support tool documentation, associated data files, and all appropriate licenses. The SDE shall provide the Government the capability to modify the EWPMT source code, documentation and data; and to build, test, install, and operate all EWPMT support software, and associated utilities.

3.4.2.1 SDE Resource Requirements

The Contractor shall provide 50% spare capacity for the following computing resources of the proposed environment:

(1) Processor utilization

(2) Random Access Memory (RAM)

(3) Hard disk secondary storage space

(4) Input/Output (I/O) bandwidth for peripheral and communications interfaces

(5) Physical I/O connections for peripheral and communications interfaces.

The SDE shall have the capability to run the EWPMT software in the same manner as the

EWPMT would run in an operational environment.

3.4.2.2 SDE Operation and Initial Government Acceptance

The SDE shall be operated and maintained by the Contractor during the development of the

EWPMT and associated support software.

The Contractor shall develop and deliver a complete set of SDE design documentation, to a level that will allow the Government to recreate the SDE without additional design details. (A041)

The Complete SDE, including all associated documentation, support software, tools, spare parts, and licenses, shall be inventoried upon formal acceptance of the EWPMT software.

The Contractor shall demonstrate that the executable mission area software can be regenerated from the source code and maintained from the support software and other resources identified in the SDE design documentation, and that the support software and other resources of the SDE can perform their intended function.

3.5 Security

The Contractor shall adhere to security guidelines as found in the DD254 form for this effort and as contained in the Army Tactical Automatic Information Systems (AIS) Security Classification

Guide (SCG), April 2008, and the Operations Security (OPSEC) Plan for PM EW, October 2008.

The Contractor shall extend all relevant security guidelines to their sub-contractors. The

Contractor shall develop, conduct and implement an annual security training and awareness program using the above documents for guidance for all contractor personnel with a need to know. The training program will address security objectives and responsibilities for these personnel. The Contractor shall provide an annual EWPMT Program Security Training Report with initial report delivered 60 DAC (A043). This report will identify the content of the security training and all personnel in attendance. Subsequent Security Training Reports will be submitted annually.

3.5.1 Security Requirements

The Contractor shall establish and maintain a SECRET facility clearance with SECRET safeguarding capability. The Contractor facility shall have a valid accreditation from the DoD

Security Service (DSS) for the PWS Period of Performance. The Contractor will require access to Secret Collateral, Controlled Unclassified/For Official Use Only (CUI/FOUO) information, COMSEC information, NATO Secret information/terminals, access to the SIPRNET at a

Government Facility and will be authorized to use the Defense Technical Information Center

(DTIC). The Contractor will require access to classified information/material up to SECRET at

U. S. Government facilities in Afghanistan. The Contractor is not authorized a COMSEC

Account nor the use of the Defense Courier Service (DCS) for this effort.

The Army Tactical AIS SCG will be the governing document with which the Contractor must comply with regards to information classification-until revised, replaced or superseded. The

Government will provide a copy of the applicable classification guidance to the contractor. The

Contractor will receive and derivatively generate classified material in performing this contract.

In performing this contract, the Contractor will receive and generate derivatively classified material and fabricate/modify/store classified hardware and software. When related hardware/system is loaded with classified software it becomes a classified item at the classification level of the software. Without a classified software load, associated hardware/system is an unclassified controlled (FOUO) item. The Contractor shall design, build, integrate, manufacture, test and document the System so that it is certifiable and accreditable by the proper Government authorities to operate. The Contractor shall assist the Government in conducting any necessary certification and accreditation tests.

Classified Automation Information Systems (AIS) will be required at the Contractor‘s facility.

Classified systems and personnel security must be IAW the NISPOM. Contractor personnel performing IT sensitive duties are subject to investigative and assignment requirements IAW AR

25-2, AR 380-67 and affiliated regulations. Performance of this contract will be and other

CONUS/OCONUS sites as designated by the Government Technical Lead (GTL).

3.5.2 Program Technology Protection

Protecting Critical Program Information (CPI) is a cornerstone of our program's success. CPI is components, engineering, design, or manufacturing processes, technologies, system capabilities and vulnerabilities; and other information that gives the system its unique capability on the battlefield or provides the ability for other countries to reproduce the essential capabilities or mission. CPI consists of those items that if compromised, would degrade combat effectiveness, shorten the expected combat-effective life of the system, or significantly alter program direction.

This includes classified military information or controlled unclassified information (CUI/FOUO) about such programs, technologies, or systems.

The Contractor shall assist and support the USG in performing a CPI assessment on the system during System Development & Demonstration (SDD) and/or any other follow on actions, Pre-planned Product Improvement (P3I) or system upgrades as necessary. The Contractor shall participate in Government lead IPT that facilitate CPI assessments. The CPI assessment is a structured approach to identify the "technical know-how" in the areas of Concept, Material, Design, Manufacturing, and Integration that enables the hardware and / or software elements to meet the threshold of CPI as defined in Critical Program Information Protection within the

Department of Defense, DoDI 5200.39,. If CPI is identified, the USG shall prepare a Program

Protection Plan (PPP). The USG shall provide the contractor with written guidance reference implementation of countermeasures to protect CPI. The Contractor shall provide a

Countermeasures Implementation Plan to the USG within 30 days of receiving countermeasures via Contract Deliverable (A044). Included in this plan shall be a Limited Access Roster (LAR) identifying which contractor personnel have either a need-to-know of the CPI, a need to have access to the CPI, or both need-to-know and access. The Contractor shall provide subsequent updates to the Countermeasures Implementation Plan on a quarterly basis. These status reports shall cite any additions and/or deletions to the LAR as approved by the Contractor‘s Senior

Management. If there are no program protection affects, then the quarterly report shall indicate

―Nothing to Report (NRT) for this period.‖

The Government will provide the Contractor and all EWPMT End Users system/technology protection guidance via the EWPMT System Security Procedures (SSP).

3.5.3 Anti-Tamper (AT)

AT Techniques are system security engineering solutions designed to protect CPI and/or critical technologies inherit within a weapon or defense item; in order to deter exploitation if the system-if lost, stolen in battle or loaned/sold to foreign allies. Should a Government requirement arise for EWPMT AT solutions, then appropriate contractual modifications would be initiated detailing the Contractor‘s performance requirements .

3.5.4 Information Assurance (IA)

The system shall include effective countermeasures to mitigate risks associated with system threats and vulnerabilities. IA requirements and security certification and accreditation should be properly addressed throughout the entire program life cycle. The system shall comply with current DoD and Army Directives, Instruction, Policies, Standards, Architectures, and Services on IA and security. The Contractor shall generate the appropriate security accreditation documents as required. (A019). These regulations include:

DoDI 8510.01, DoD Information Assurance Certification & Accreditation Process

(DIACAP), 28 November 2007

Army Regulation (AR) 25-1 4 December 2008

Army Knowledge Management and Information Technology Clinger Cohen Act of 1996

Subtitle III, Title 40 U.S. Code Committee on National Security Systems (CNSS) 4009 dated 20 Mar 2007

National Information Assurance (IA) Glossary DoD Directive (DoDD) 8570.1 dated 15

Aug 2004

Information Assurance Training, Certification and Workforce Management DoD Manual

(DoDM) 8570.01M dated 20 Apr 2010

Information Assurance Workforce Improvement Program DoD Instruction (DoDI)

5000.2 dated 8 Dec 2008

Operation of the Defense Acquisition System DoDI 8580.1 dated July 9 2004

Information Assurance in the Defense Acquisition Systems Federal Information Security

Management Act (FISMA) dated 24 Oct 2002

NSTISSP No. 11, National Policy Governing the Acquisition of Information Assurance

(IA) and IA-Enabled Information Technology Products, June 2003

The Contractor shall comply and cooperate with Government provided IA compliance requirements for all EWPMT Software Applications, IS and IT components. The Contractor shall also insist the Government in the execution of DoDI 8510.01, the DoD IA Certification and

Accreditation Process (DIACAP) as follows:

Implementation of Security Technical Implementation Guidelines (STIGS) and Security

Recommendation Guides (SRG).

All contractor employees and associated sub-contractor employees must complete the

DoD IA awareness training before issuance of network access and annually thereafter.

All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six months of employment.

Per DoD 8570.01-M , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the IS and then annually thereafter.

3.5.5 Information Assurance Vulnerability Alert (IAVA) Compliance

The Contractor shall track all applicable IAVAs and determine impacts of patches to the system and report to the Government when patches or mitigation mechanism can be applied to the system. Subsequent to Government review and approval, the Contractor shall implement the necessary repairs that have no adverse effects on the system‘s operations. From time of IAVA notification the Contractor shall have 90 days to complete the repair.

The Contractor shall be responsible for the security design of the EWPMT System to a Mission

Assurance Category (MAC) II Classified.

3.5.6 Information Security (INFOSEC)

The Contractor personnel shall properly mark, store and handle all material they acquire, generate or create IAW AR 380-5, in conjunction with the The Army Tactical AIS SCG. The

Contractor should obtain guidance from the Government‘s Program Security Staff regarding appropriate marking, storage and destruction of classified and For Official Use Only materials.

In addition to guidance in associated DD-254, Appendix D, unused FOUO will be shredded. A

Controlled Unclassified document containing FOUO information shall be appropriately marked

―UNCLASSIFIED//FOR OFFICIAL USE ONLY.‖

EWPMT Technical Documents shall be marked U//FOUO at a minimum, or SECRET as appropriate with the content of the information within. Program Technical and/or acquisition documents below and the like, shall bear the appropriate Distribution Statement and Export

Controlled Warning markings.

Training Manuals/documentation

Technical Manuals/documentation

Engineering Drawings

SW/HW Configurations Items

Performance Specifications

System Architecture

Maintenance Manuals/documentation

Reports and document deliverables

Test plan/reports

User Guides/SOP

Logistical support documents

The Contractor shall acquire specific guidance from the government for the appropriate

Distribution Statements and Export Controlled Warning markings during document development and/or prior to document dissemination. Contractor shall comply with FAR 52.204-2, Security

Requirements. This clause involves access to information classified ―Confidential,‖ or ―Secret,‖

(as applicable) and requires contractors to comply with— (1) The Security Agreement (DD Form

441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M);

any revisions to DOD 5220.22-M, notice of which has been furnished to the contractor.

3.5.7 Communications Security (COMSEC)

The Contractor is authorized access to COMSEC information and equipment for this effort.

COMSEC information shall be processed IAW DoD 5220.22-M, NSA/CSS Policy Manual 3-16, and AR 380-40. Recipients of COMSEC information under this contract may not release information to subcontractors without permission of the User Agency. See DD-254, Appendix A for further guidance. Transmission of materials to/from the Government shall be accomplished via approved methods for transmission of For Official Use Only (FOUO) or SECRET material as appropriate. The Contractor is not authorized a COMSEC account nor the handling of COMSEC

Keying material for this effort.

3.5.8 Operations Security (OPSEC)

Additional OPSEC requirements to the National Industrial Security Program Operating Manual

(NISPOM) are in effect and will be provided by the Government. The Contractor shall not publically release information about the program without prior approval by the Government.

Requests for program information shall be referred to the Government Program/Project Manager.

The fact that certain details of information are shown to be unclassified does not authorize automatic public release.

The Contractor shall develop and deliver an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible

Government OPSEC officer, per AR 530-1, Operations Security (A045). This SOP/Plan will include the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. The Government will provide guidance to the

Contractor in the development of this OPSEC SOP. In addition, the Contractor shall identify an individual who will be an OPSEC Coordinator. The Contractor will ensure this individual becomes OPSEC Level II certified per AR 530-1.

Per AR 530-1, Operations Security, new Contractor employees must complete Level I OPSEC training within 30 calendar days of their reporting for duty. All Contractor employees must complete annual OPSEC awareness training to be provided and recorded by the Contractor

OPSEC Coordinator.

3.5.9 Anti-Terrorism (AT)

a. AT Level I Training. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete

AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The Contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar daysafter completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: https://atlevel1.dtic.mil/at.

b. Access and General Protection/Security Policy and Procedures. Contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures

(provided by the local/unit AT Officer (ATO)). The Contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force

Protection Condition (FPCON) at any individual facility or installation change, the

Government may require changes in contractor security matters or processes.

c. AT Awareness Training for Contractor Personnel Traveling Overseas. Contractor and all associated sub-contractors employees shall be available to receive government provided area of responsibility (AOR) specific AT awareness training as directed by AR 525-13.

Specific AOR training content is directed by the combatant commander with the unit

ATO being the local point of contact.

d. The Contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the local/unit ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract award.

These key AT requirements are for non-local national Contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor‘s compliance with combatant commander and subordinate task force commander policies and directives.

3.5.10 Foreign Disclosure/Export

The Contractor shall avoid creating false impressions of the U.S. PdM Raven Fire‘s position on disclosing Classified Military Information (CMI) or Controlled Unclassified Information (CUI).

The Government shall provide foreign disclosure guidance to the Contractor. The Contractor shall not agree to provide access to and/or exchange of Government information/items, equipment or briefings to any foreign individual or entity without obtaining the proper approval from the Government first.

Transportation/Shipment: All fielded EWPMT Systems, sub-systems, ancillary equipment, test equipment, storage devices, media or any other associated program material- once stored and/or embedded with classified data, shall retain the classification at the highest level of the data that ever resided within the item. Purging or degaussing of equipment for the purpose of unclassified transport or shipments will not be acceptable; as these declassification methods are not guaranteed to clear all remnants of classified data in all cases, nor can the proper execution of these measures be relied upon. Therefore, the Contractor shall ensure that all shipments, transportation, handling, packaging, wrapping or storage of EWPMT classified assets are executed IAW AR 380-5 consistent with the highest classified level of data that had existed.

3.5.11 Personnel Security

The Contractor shall maintain sufficiently cleared personnel to perform the tasks required by this

PWS IAW the DD Form 254, and the Contract. All Contractor personnel shall possess a clearance and need-to-know commensurate with the requirements of their positions IAW AR

380-67.

3.5.12 Assessment of Program Security Effectiveness

IAW DoDD 5200.39 the Government, assisted by the Protection Team, will assess the overall security posture, PPP effectiveness, and the PPP countermeasures prescribed therein, as part of the normal program review process. Security surveys shall be used to aid the Government in performing these assessments. When the Contractor is to be granted access to sensitive information, CUI (FOUO), and the export of controlled or unclassified technical data, the

Contractor shall provide authorization for access to Contractor facilities by the responsible

Government industrial security office (Defense Security Service or the Service cognizant security authority) as well as the acquisition, security, counterintelligence and intelligence activities supporting the program. This authorization is necessary to permit surveys, inspections, training, advice or assistance visits, or inquiries, which are necessary to ensure protection of the sensitive information and implementation of security requirements and PPP activities at prime, subcontractor, and/or vendor facilities. When possible, applicable threat information will be shared with the Contractor‘s Facility Security Officer (FSO) to ensure their understanding of the threat.

3.6 Test and Evaluation

3.6.1 Software Testing

The Contractor shall develop a set of system level test cases in accordance with Contractor test planning to test system threads and requirements. The Software Functional Qualification Test

(SFQT) shall include a qualitative assessment of the operational software build as well as an assessment of the system performance under stress. The SFQT shall demonstrate the operational software‘s overall usability and fitness for Government acceptance as a fieldable version.

The Contractor shall support Operational Tests as well as exercise and integration events at locations designated by the Government. Prior to releasing software versions for Government operational testing, the Contractor shall audit deliverables (software artifacts) for requirements compliance and completeness. The Contractor shall participate in Joint Certification (Joint

Interoperability Test Command) and the Army Interoperability Certification events at a

Government designated facilities and locations. The Contractor shall ensure project data are archived, backed up and delivered to the Government in specified storage media format at software release milestones. After completion of testing, the Contractor shall deliver media containing executable and source code (A020), a Software Test Report and an updated Software

User‘s Manual (SUM). The Contractor shall provide source code upon Government request.

3.6.1.1 Test Readiness Review (TRR)

The Government will request that Test Readiness Reviews (TRR) be conducted prior to the start of significant test events called for in the Contractor‘s IMS, and which shall be supported by the

Contractor. The purpose of the TRR is ensure that both the Contractor and the Government have adequately addressed the ‗test requirements/objectives‘ and are ready to begin testing.

Approval criteria of the TRR shall consist of the following:

The final approved Software Test Materials are completed.

The complete set of Government-approved test cases is completed; redline changes are permitted.

All new requirements are traceable from the Functional Requirement to the Requirements

Definition Documents (RDD) through the System/Subsystem Specification (SSS) and code units to uniquely identified test cases.

All engineering changes are approved. All Requests for Deviation (RFD) and Requests for Waiver (RFW) have been approved by the Government.

All tasks identified as…