Attachment_0001_-_PWS_-_ACES_-_17JUN2016.pdf

PERFORMANCE WORK STATEMENT

UNITED STATES ARMY CHIEF INFORMATION OFFICER (CIO)/G6

CYBERSECURITY ENTERPRISE SUPPORT

17 June 2016

1.0 BACKGROUND

As the lead for the Army’s Information Assurance Program, the CIO/G6 Cyber Directorate’s mission is to integrate efforts across the Army Staff (ARSTAF) to provide policy, oversight, and guidance in promoting and maintaining cyber security for the Army. The Army’s networks and infrastructure play a pivotal role in allowing the Army to complete its mission on and off the battlefield. It is essential that the Army protect its mission-critical infrastructure from adversaries that are constantly trying to exploit vulnerabilities in the network architecture to cause denial of services or exploit data to gain an advantage. Network outages or data tampering within these networks and systems could result in confusion, delayed decision making and the loss of resources (equipment and human life). The Army’s ability to implement secure solutions to protect its networks, provide warfighters and Army leaders with the right information at the right time and at the right place. As a result, the network is protected. By ensuring availability, authentication, integrity, non-repudiation, and confidentiality, the CIO/G6 Cyber Directorate supports the Army’s goal to dramatically improving the network defense posture.

2.0 OBJECTIVE

Cyber security and Information Assurance remain high priorities within the Department of Defense (DoD). The Army CIO/G6’s mission is critical to the Army as it supports DoD’s efforts in advancing our national cyber security capabilities. Integral to these efforts are Cyber Security capabilities provided to warfighters accessing Army networks, as they contribute to providing mission partners and warfighters with the right information—at the right time at the right place— from a trusted information enterprise. The Army CIO/G6 Cyber Security Directorate is required to provide a wide range of information technology security capabilities to lead the Army which include technical oversight, guidance, planning, operational support and policy development for the Cyber Security and Cryptographic solutions being fielded Army-wide.

3.0 SPECIFIC TASKS

The contractor shall perform the following recurring technical tasks described below with the Government’s oversight and approval. The individual tasks shall be performed throughout the period of performance. The Government Requiring Activity Technical Point of Contact (COR) will task the contractor when requirements arise for the tasks listed below. The COR will prioritize tasks and communicate to the contractor the start and required completion date for each task and associated deliverables, and deliverable specific format and content requirements. The COR will communicate to the contractor the particulars of the systems and technologies used by the contractor. The contractor shall perform all tasks listed below utilizing best practices, the most current information and technology available, and without incurring undue risks that may jeopardize the objective of this effort. The contractor may be required to provide “surge” support that could require additional staffing for unforeseen mission critical requirements that arise during the entire contract period of performance. The contractor shall adhere to the policies and procedures in the Applicable Publications and References listed in paragraph 7.0 in performing all tasks. In performing all tasks, the contractor shall be required to interface and coordinate with representatives from the Defense Information Systems Agency (DISA), the United States Cyber Command (USCYBERCOMMAND), the U.S. Army Cyber Command (ARCYBERCOMMAND), the U.S. Army Network Enterprise Technology Command (NETCOM) and the military Services.

3.1. Task 1: Program Management (PM) Services: Contractor shall provide program management to ensure efficient and effective accomplishment of all work detailed in this PWS.

Contractor shall prepare a Management Plan describing the technical approach, organizational resources and management controls to be employed to meet the cost, performance and schedule requirements throughout contract execution. Contractor shall summarize significant events and findings, activities, cost or funding concerns, performance that exceeds contract requirements, performance that fails to meet contract requirements and corrective actions in Monthly Status Reports (please see paragraph 4.2). Only one monthly status report is needed to fulfill this requirement. Contractor shall accomplish Contractor Manpower Reporting annually until the end of the contract. Contractor shall perform all supervisory tasks concerning the contractor’s employees.

PM Services: The contractor shall manage, oversee, and supervise the activities of all contracted personnel serving on this contract to include task management, time card and leave approval. The PM shall ensure support for the creation, review and editing of staff packages, reports and taskers (i.e. SACO/JACO), and other written documents IAW AR 25-50 (Preparing and Managing Correspondence), DA Memo 25-52 (Staff Action Process and Correspondence Policies) and/or other applicable Army publications and policies. The Contractor is to take direction only from the KO or COR and only when such direction is routed through the contractor's designated manager or supervisor. In no case will contractor's employees take direction directly from Government employees other than from the KO or COR.

3.1.2 Quality Assurance (QA) Services: Contractor shall provide Quality Assurance services to ensure that all deliverables and products are of the highest quality and meet the standards established by the contract Quality Assurance Surveillance Plan (QASP).

3.1.3 Meetings and Briefings: Contractor shall conduct meetings and coordination efforts at times commensurate with the complexity and status of the effort required to support the work and meet the identified requirements. Contractor shall support monthly teleconferences and quarterly Technical Interchange Meetings with the task order COR, as required, to discuss contents of program management reports, providing materials and agendas, as required via Presentation Material. The contractor shall participate in Technical Interchange Meetings (TIMs) upon request of the KO and/or COR to discuss and evaluate contractor efforts and accomplishments in direct relation to specific tasks. During these meetings, the contractor shall present necessary data to enable a joint review of assigned tasks, schedules, and resource expenditures. The contractor must be able to conduct meetings at the secret level when required. The contractor shall present and participate in technical discussions and shall inform the COR and the KO of any problems with contract execution and any proposed solutions. Contractor shall schedule and conduct contract-wide Program Management Review (PMR) meetings as coordinated with the COR, monthly from the time of contract award.

The contractor shall create the following deliverables in support of this task:

Post-Award Brief and Minutes

Monthly Status Report Beginning 30 days after award and monthly thereafter

Final Technical Report At the end of each performance period

3.2. Task 2: Executive and Administrative Support: The contractor shall support the Army CIO/G-6 Director for Cyber Security, the Deputy Director for Cyber Security and two (2) Cyber Security Divisions by providing highly skilled executive and administrative support services for in-depth information workflow management, staff action expertise, administrative support, records management, professional graphics production, Property Book Officer (PBO) support, Information Management Officer (IMO) support, Information System Security Officer (ISSO) support and process continuity.

Coordinate executive-level meetings and video teleconferences (VTCs) including maintaining attendance lists, developing seating arrangements, reserving facilities, and distributing read-ahead materials.

Perform protocol duties including organizing or assisting with the organization and conduct of ceremonies including award ceremonies, promotions, and retirements.

Manage the Director’s schedule/calendar.

Manage the Deputy Director’s schedule/calendar.

Manage incoming telephone calls.

Manage the Information Assurance Division Chief’s schedule/calendar.

Manage the Identity & Access Management Division Chief’s schedule/calendar.

Ensure proper reception and escorting of visitors, ensuring the proper security procedures are followed.

Maintain current personnel rosters, organizational charts, etc.

Design and produce professional graphics to meet the Directorates needs that would include:

presentations, campaigns, official publications, etc.

Provide administrative/technical support to the Cyber Security Directorate Property Book

Officer (PBO).

Provide administrative/technical support to the Cyber Security Directorate Information

Management Officer (IMO).

Provide administrative/technical support to the Cyber Security Directorate Information

System Security Officer (ISSO).

Track suspense/process staff actions/assist with monitoring workflow, to include:

o Review and edit staff packages, military and civilian appraisals, awards and decorations, and other written documents IAW AR 25-50 (Preparing and Managing Correspondence), DA Memo 25-52 (Staff Action Process and Correspondence Policies) and/or other applicable Army publications and policies;

o Serve as the point of contact for incoming/outgoing correspondence and distribution;

o Update the status of actions in the appropriate workflow management tracking system, based on inputs from AOs;

o Provide feedback on observed process problems and suggest improvements to the

Staffing Process POC;

o Maintain pertinent data (electronic or hard copies) necessary for the effective function of the office, following applicable Records Management guidance. The material will include both classified and unclassified information;

o Prepare routine correspondence for the Director and Deputy Director with minimum guidance; and, o Manage the assignment of incoming tasks, anticipate and assign suspense dates based on external demands and availability of key personnel, track and report on progress and completion of tasks daily (reporting issues to the Director and Staff Action Control Office POC, as appropriate), and forward completed documents to appropriate internal and external agencies with a copy to the Action Officer.

3.3. Task 3: Public Key Infrastructure (PKI) Advancement: The Army CIO/G-6, Cyber Security Directorate, Identity Management Division, is tasked to align PKI initiatives in support of Federal, DoD and Army mandates. This requires understanding current PKI technology capabilities already implemented across both the Army and DoD, analyzing trends in technology advancement, and ensuring policy directives reflect technology advancements in a manner that sustains information security for the warfighter.

3.3.1 Emerging PKI Technologies Analysis: At the direction of the COR, the contractor shall analyze the Army’s Public Key Infrastructure while concurrently tracking emerging authentication technologies (i.e. technologies that have not been fielded). The emerging technology analyses will allow Army CIO/G6 to stay at the forefront of the warfighter’s authentication needs and provide the basis for the contractor’s policy recommendations.

The contractor shall create the following deliverables in support of this task:

PKI Emerging Technologies Reports

Paper will describe emerging technologies pertaining to PKI. (30 pages approximately each)

PKI Emerging Technology Product Evaluations

Paper will detail the testing and evaluation of emerging technologies in PKI. This will encompass 2-5 product evaluations annually.

(30 pages approximately each)

PKI Analyses of Alternatives

This study will allow Army CIO/G6 to differentiate between PKI solutions and how they pertain to their changing needs. (15 pages)

Technology White Papers

This study will provide a snapshot of technological developments that could impact PKI initiatives. (10 pages approximately)

3.3.2 PKI Transformation: To enable Army CIO/G6 to improve the Cyber Security defense posture of Army systems and networks, the contractor, by direction of the COR, shall conduct studies and analyses and develop recommendations concerning technologies and developments across three layers —an assessment layer, a technology layer, and a guidance layer.

With respect to the technical recommendations, the contractor shall develop technical recommendations with the objective of allowing the CIO/G6 to meet and/or exceed Army-wide goals in the transformation of the Army networks across the enterprise.

The contractor shall be required to maintain an existing electronic library of Identity Management Division program documents by adding pertinent documents, removing documents that are no longer relevant and amending/updating current library documents. The documents to be added will either be documents the contractor is responsible for preparing (which are already captured and listed as deliverables elsewhere in this PWS) or will be documents that already exist and were created by other parties. The COR will indicate to the contractor the deliverables required to be added or updated, on a weekly basis. With respect to document updates, the magnitude of the update could range from a few paragraphs to a complete overhaul/rewrite of the document. The contractor shall be required to make approximately one to two document updates per month on a recurring basis, as directed by the COR, throughout the entire period of performance. It is estimated that all work required under subtask 3.3.2 will require approximately 1880 – 1900 contractor man-hours per year to accomplish.

The contractor shall create the following deliverables in support of this task:

Updates to documents in the Army CIO/G6 Electronic Library of all program documents

This is an Army CIO/G6 repository for its IDAM Division program documents.

Approximately 2-3 document updates per month throughout the TO period of performance.

PKI Architecture Analyses

This is a review of the Army’s present-state PKI infrastructure. (10 pages approximately)

Technology Implementation Analyses

This study will review how newly implemented technologies are improving or impacting the Army and DoD PKI. (15 pages approximately)

PKI Evaluation Papers This study will evaluate the PKI and Public Key Enablement (PKE) to ensure they meet the Army’s evolving needs. (15 pages approximately)

PKI Configuration Analyses

This analysis will provide recommendations on how to improve PKI/PKE configurations within the Army. (15 pages approximately)

Impact/Risk Assessment Reports

This study will assess how PKI technologies are deployed within the tactical environment. (20 pages approximately)

PKI Guidance Recommendations Report

This report will detail recommended changes based on the testing and evaluation of emerging technologies, and on the research and analysis completed across PKI. (10 pages

3.3.3 Policy Analysis: At the direction of the COR, the contractor shall analyze the Army’s Cyber Security posture as it relates to the DoD PKI/PKE infrastructure and program. The contractor shall provide policy analyses, recommendations and summaries for strengthening Army CIO/G6’s DoD PKI capabilities as needed by the warfighter.

Army Policy Memorandum Recommendations

These studies will track DoD and Army policies as they pertain to PKI. (10 pages approximately)

Army Technology Policy Position Papers

These studies will analyze how the Army’s new technology solutions integrate with PKI. (10 pages approximately)

Policy Working Group Briefings

These papers will summarize policy working groups. (10 pages approximately)

3.3.4 Registration Authority (RA) Advancement: At the direction of the COR, the contractor shall research current-state technologies and develop analyses, recommendations and solutions for implementation, bridging existing capabilities with future capabilities allowing Army CIO/G6 to transform Army PKI software/hardware-based certificate technologies. This task will include analyses and evaluation of Registration Authority Operations to identify issues with Certificate Practice Statement (CPS) compliance and Army certificate management practices that include Army smart card audit responsibilities, identity verification of the requester/subscriber, certificate issuance (hard and soft), key recovery, certificate revocation, and suspensions that the new technologies should address.

Registration Practice Statement (RPS)/Certificate Practice Statement (CPS) Review Report

This will provide an annual analysis of how the RPS is being utilized by Registration Authorities (RAs). (20 pages approximately)

RA Process Improvements Recommendations Report

This study will analyze current RA operations and make recommendations on how to streamline processes to improve IA across the Army. (15 pages approximately)

Issuance Performance Metrics Analysis

This report presents statistical analyses of NIPR and SIPR tokens issued. (1 page)

Next Generation (NexGen) RA Report

This study will present futuristic solutions for automating RA technology. (30 pages

3.4. Task 4: Identity and Access Management (IdAM) Analysis and Engineering: The Army CIO/G6 Cyber Security Directorate, Identity Management Division, is supporting the implementation of an Identity and Access Management (IdAM) and Enterprise Identity Directory Service (EIDS) to support the Army mission across the enterprise. The CIO/G6 Identity Management Division serves as the liaison between external identity stakeholders (e.g. Department of Defense Chief Information Officer (DoD CIO), the Defense Information Systems Agency (DISA), and the Defense Manpower Data Center (DMDC)) and internal identity stakeholders. At the direction of the COR, the contractor shall research and document current state technologies and processes existing in the Army IdAM portfolio. This research will be used to develop a transitional operational view and reference architectures to ensure the Army’s IdAM programs are in line with the DoD ICAM Transition Plan and any future DoD GIG Enterprise-wide requirements.

3.4.1 Digital Identity Analysis: The target state for Army CIO/G6 identity management is for digital identity creation and modification to occur only in authoritative system(s), and for authoritative identity attributes to be shared in an automated fashion with other systems across the Army GNE. At the direction of the COR, the contractor shall analyze current state redundancies in the collection and maintenance of identity data to streamline data collection and sharing for Army CIO/G6 to achieve this target state. The contractor shall develop business process reports, change management processes, requirements vetting process analyses, account life cycle management analyses, use cases, and new identity data on-boarding oversight procedures for CIO/G6 to further attain the goal of the target state and its operational requirements.

Current State Identity Data Report

This report will analyze redundancies in the collection and maintenance of identity data. (10 pages approximately)

Army Identity Attribute Specification (IAS) Business Processes Report

This study will examine all new identity attributes needed to support the cyber functions of the Army IdAM System. (30 pages approximately)

Attribute Change Control Process Development Report

This report details the requirements necessary to develop an attribute change control process within the Army. (45 pages approximately)

Requirements Vetting Process Analysis

This report will analyze the attributes needed by Army organizations and assess their feasibility.

(15 pages approximately)

Account Life Cycle Management Analysis Report

This study will analyze the user account lifecycle to streamline and automate. (15 pages approximately)

End User Identity Use Case

This use case will map the identity lifecycle process for users across the Army. (50-100 pages approximately)

3.4.2 Authorization and Access Analysis: At the direction of the COR, the contractor shall ensure the Army is in a position to address any DoD Enterprise Authorization and Access control model that is established from an architectural perspective. The contractor shall accomplish this by providing CIO/G6 Cyber, Identity Management Division leadership with analyses of changes in the Authorization and Access knowledge space, analyses of reference architectures, and drafting information papers, Army implementation plans and methodologies, and best practices reports. The contractor shall research industry trends in Policy Decision Point (PDP) and Policy Enforcement Point (PEP) Technologies and provide recommendations on how they can be incorporated into the Army’s IdAM portfolio. The contractor shall develop an Analysis of Alternatives (AoA’s) of Federated Capabilities for CIO/G6 to further validate the requirements of an Authorization and Access Framework (AAF) in meeting the Army’s target security end-state.

Reference Architectures Report

This study will document the IdAM architectures and how they interface with DISA. (50-100 pages approximately)

Attribute Based Access Controls (ABAC) and Role Based Access Controls (RBAC) Information Papers

This study will analyze the effectiveness of ABAC and RBAC and how best to utilize these technologies within the Army. (50-100 pages approximately)

ABAC and RBAC Army Implementation Plans

These plans will document how best to implement these technologies. (30 pages approximately)

ABAC Operational View and Reference Architectures Analysis

This study will provide the baseline for analyzing optimal ABAC operational architectures. (50 pages approximately)

RBAC Operational View and Reference Architectures Analysis

This study will provide the baseline for analyzing optimal RBAC operational architectures. (50 pages approximately)

ABAC and RBAC Implementation Methodologies Report

This report will examine potential risks associated with ABAC and RBAC implementation and provide recommended methodologies for mitigating these risks. (50 pages approximately)

ABAC and RBAC Best Business Practices Report

This report will analyze efficiencies by effectively implementing ABAC and RBAC technologies. (50 pages approximately)

Analysis of Alternatives for Federated Services Findings and Recommendation Report

This analysis will examine which information services can be federated and integrated with Army information services without posing information security threats. (30 pages

3.4.3 Enterprise Architecture Analysis: The Enterprise Services Security Framework (ESSF) is the unifying construct for aligning security-related efforts to enable enterprise services security within DoD. To ensure the Army CIO/G6 Cyber Security Directorate is supporting the enabling of this capability, at the direction of the COR, the contractor shall provide identity engineering subject matter expertise (SME) support to internal Army identity stakeholders and serve as the identity engineering SME’s to external identity stakeholders. The contractor shall assist Army identity stakeholders with requirements generation as well as the development of reference and operational architectures to support the creation of an Enterprise Identity Directory Service (EIDS). The Government is responsible for creation of the EIDS and the contractor's role shall be to assist the Government in developing this system. The contractor's activities in assisting stakeholders with requirements identification/generation will contribute to (result in) the creation of all the deliverables listed below; there will not be a separate stand-alone "requirements identification" deliverable. EIDS will complement current and future DoD Enterprise Directory Service (EDS) offerings and allow the Army to provision accounts into its application forests and domain structures. The contractor shall perform EIDS/IdAM-related analyses, prepare progress updates, draft Army EIDS recommendations, and diagram the Army's IdAM environment.

The contractor shall create the following deliverables in support of this task:

Identity Management Infrastructure Improvements Report

This report presents analysis on how to improve the identity management systems within the Army. (20 pages approximately)

Operation and Reference Architectures Report

This report will provide an update on progress of IdAM in the tactical space. (10 pages approximately)

Army EIDS Concept of Operations (CONOPS) Update Report

This report will provide updates and recommendations for Army EIDS CONOPS improvements. (30 pages approximately)

Army IdAM Roadmap Update Report

This report will diagram the Army’s IdAM environment and how it interfaces with DISA.

(Diagram)

Army EIDS Identity Provisioning Capability Report

This report will provide a monthly snapshot of accounts provisioned by EIDS. (5 pages approximately)

Army EIDS Authentication and Authorization Framework Analysis

This study will analyze the EIDS framework and makes necessary recommendations to ensure EIDS meets the Army’s needs, mission and goals. (50 pages approximately)

Army EIDS Identity Federation Capability Analysis

This study will analyze how federating services streamlines the existing DISA EIDS capability. (50

3.5. Task 5: Communications Security (COMSEC) Analysis: The contractor shall conduct Cyber/COMSEC analysis to ensure key management and cryptographic modernization solutions and services are supportable and conform to the enterprise standards-based architecture. This analysis will ensure that key management enterprise architecture is aligned with cryptographic modernization initiatives and achieve configuration management consistent with network and security performance requirements. The contractor shall develop policy, standards, and strategy recommendations that ensure Army networks and systems are secure and emerging integrated capabilities meet prescribed regulatory guidelines

3.5.1 COMSEC Governance and Policy Analysis: The contractor shall conduct Cyber/COMSEC analysis to ensure key management and cryptographic modernization solutions and services are supportable and conform to the enterprise standards-based architecture. This analysis will ensure that key management enterprise architecture is aligned with cryptographic modernization initiatives and achieve configuration management consistent with network and security performance requirements. The contractor shall develop policy, standards, and strategy recommendations that ensure Army networks and systems are secure and emerging integrated capabilities meet prescribed regulatory guidelines.

The contractor is required to have knowledge of Army policies, public laws, regulations, procedures, and methods associated with COMSEC. Ability to interface and participate with Department of Army (DA), Department of Defense (DOD), National Security Agency (NSA) and other Services in IPT, configuration management, portfolio management, planning and strategy meetings, budget reviews, and coordination meetings.

The contractor shall create the following deliverables in support of this task:

Document Review/ Comment Matrix Analysis

This study will examine overlaps and gaps in existing governance and policy documents. (50

Best Business Practices (BBP) Report

This study will examine how to build efficiencies into Army business practices. (30 pages approximately)

Policy Guidance/Updates Recommendation Report

This study will provide policy recommendations for COMSEC. As required

Portfolio Management, Line of Efforts (LOE) Roadmap

This study will provide direction guidance and implementation timeline to support the Army’s key initiatives for effectiveness and efficiency strengthen network operations (e.g., Mid-Term, Long-Term)

Next Generation Cryptographic Policy Report

This report will provide new direction and guidance on how to implement new Cryptographic capability (20 pages approximately)

AR 25-2 - COMSEC

Policy Guidance/Updates

This report will examine how new Cyber policies and technological advancements impact this policy. (20 pages approximately)

AR Polices Guidance/Updates Recommendations

This report will examine how new Cyber policies and technological advancements impact this policy. (20 pages approximately)

DA PAMs Policy Guidance/Updates Recommendations Report

This report will examine how new Cyber policies and technological advancements impact this policy. (20 pages approximately)

3.5.2 Key Management Integration: At the direction of the COR, the contractor shall document, review and analyze the enterprise key management architecture to ensure management capabilities and services are supportable and conform to the Army CIO/G6’s enterprise key management architecture. The contractor shall conduct Best Business Practices (BBP) analyses that assess and provide guidance on how to advance current technologies without loss of existing service and capabilities to the warfighter, as well as draft recommendations, prepare a transition plan, and diagram Army Key Management Infrastructure.

The contractor shall create the following deliverables in support of this task:

Electronic Key Management Systems (EKMS) to Key Management Infrastructure (KMI) Transition Plan

This is a report that analyzes the optimal method for transitioning the Army from EKMS to KMI. (20 pages approximately)

Life Cycle Management and interoperability of new and legacy accounts

This report will track, evaluate and report the opening/closing of COMSEC accounts (Quarterly)

Key Management Baseline Standards Report for Common Operating Environment (COE)

This report will examine the existing baseline construct for COE. (30 pages approximately)

Key & Certificate Management Plan (KCMP) BBP Report

This report will identify streamlined, cost-efficient methods for effectively managing key and certificate issuances. (30 pages approximately)

Report for Army Network Campaign Plan

3.5.3 COMSEC Modernization Compliance: At the direction of the COR, the contractor shall assess cryptographic standards and procedures in accordance with Army priorities and cryptographic capabilities (devices, waveforms, algorithms, etc.) and produce studies on methods the Army CIO/G6 can employ to enhance the security, interoperability and appropriate protection of National Security Systems and National Information as mandated by the COMSEC Modernization Initiative. The assessments will include diagramming cryptographic evolution, requirements validation, and conducting COMSEC-related analyses and studies.

The contractor shall assist the CIO/G-6 with assessing the Army’s inventory, processing unit/organization equipment request, monitoring equipment programs, coordinating with vendors and government agencies, preparing, publishing annual guidance, policy and direction for the Army’s Cryptographic Modernization Strategic, Planning guidance and Roadmap.

The contractor shall provide recommendation to Army COMSEC leadership (CIO/G-6 Cyber Security) and assist in recommending alternative solutions to Cryptographic and Key Management issues based on in-depth comparative analysis and implementation timelines.

The Contractor shall assist in the completion and documentation of Technology Assessments to identify existing and emerging technologies to include Mobility and NSA Commercial Solution for Classified Implementation Plans for consideration in the evolution of program and forecast cost-effective opportunities to improve the mission-effectiveness of program segments.

Cryptographic Modernization Strategy

This study will assess how the Army can improve its strategy for acquiring and developing modernized cryptographic capabilities. (50-100 pages approximately)

Develop , distribute and maintain Cryptographic Evolution Charts

This will diagram cryptographic evolution and how technological advancements impact legacy Army systems. Diagram)

Information Systems Security Program Application (ISSPA) Cryptographic Requirements Validation Report

This report will validate the Army’s cryptographic requirements against DoD requirements. (5 pages approximately)

Commercial Solutions Integration timeline Roadmap

This study will analyze how commercial solutions can best integrate into Army systems and assess progress towards Army’s strategic goals. (15 pages approximately)

New Capabilities/ Technology Report

This study will analyze new and emerging technologies and how they can integrate into the Army’s COMSEC program while remaining compliant with existing requirements. (50 pages approximately)

COMSEC

Replacement obsolescence and Divestiture Strategy

This study will examine how best to leverage legacy COMSEC solutions while adequately disposing of obsolete capabilities. (40 pages

3.5.4 COMSEC Strategic Planning: At the direction of the COR, the contractor shall focus its strategic planning efforts on providing the Army CIO/G6 with information essential to developing an agile acquisition process that preserves its CYBER capabilities and is consistent with the capability set management process, Army Network Campaign Plan, Army Force Generation Model and Chairman Joint Chief of Staff Guidance. The contractor shall conduct as-is mapping of current capabilities, develop technology implementation plans and strategies, draft risk mitigation and procedural recommendations and guidance, draft progress tracking studies and provide strategy recommendations for the Army COMSEC community on the replacement of obsolete and divest legacy cryptographic devices.

3.5.5 COMSEC Acquisition, Logistics and Modern Technology: At the direction of the

COR, the contractor shall prepare detailed cost analysis in support of cryptographic modernization, divestiture and roadmap for sun-setting of legacy systems and circuits. Prepare funding reports and track obligation, commitment disbursement rates requirements throughout the Program Office Memorandum (POM) cycle. Provide justifications and status to congressional staffers and the CIO/G-6. Develop and prepare impact statements, information papers, decision papers and briefings for Senior Army Leadership.

3.5.6 The contractor shall prepare budget briefings to senior level OSD, G-8, Joint and service staff personnel. Coordinate with the Army’s stakeholder on implementing new standards and procedures in accordance with Army priorities, and direction for the network. Provide and produce studies on methods the Army CIO/G6 can employ to enhance the security, interoperability and appropriate protection of National Security Systems and National Information as mandated by the COMSEC Modernization Initiative.

Key Management Roadmap Analysis

This study will provide an as-is mapping of key management capabilities. (30 pages approximately)

Cryptographic Roadmap This study will provide an as-is mapping of cryptographic capabilities. (30 pages approximately)

Cryptographic Modernization annual Planning memo

This report will examine cryptography advancements and propose a plan for implementing them across the Army. (10 pages approximately)

Cryptographic Modernization Guidance Report

This report will provide key guidance on risk mitigation for modernizing Army cryptography capabilities. (40 pages approximately)

COMSEC obsolescence and divestiture Report

This report will provide key guidance CYBERW the Chairman Joint Chiefs Instruction/Notice (CJCSI) 6510 to transition off of legacy cryptography capabilities. (15 pages approximately)

Document review on BOIPs, technical publications

This report will track the Army’s progress in modernizing its cryptographic capabilities with the Programs of Record (POR). (40 pages approximately)

Next Generation cryptographic capabilities)

This report will track the Army’s progress in modernizing its cryptographic capabilities. (40 pages approximately)

Cryptographic Modernization Assessment Report (Command Plan roll-up)

This report will track the Army’s progress in modernizing its cryptographic capabilities with Camp/Post/Stations. (40 pages approximately)

Monitor and track the execution of the COMSEC/Modernization budget

This report will examine requirements for projecting cryptography capabilities to strengthen and implement a robust network. (15 pages approximately)

Prepare and document input for Army Budget Estimate Submission

(BES),

This study will assist with examining and reporting data for modernization to deliver enhance capability to the tactical edge (15

3.6. Task 6: Network Operations Analysis: The contractor shall analyze Do, National Security Agency, Joint and Army IA and NetOps goals and initiatives to ensure Army CIO/G6 remains fully coordinated for all initiatives across the Army for both the generating and operating force. These analyses will provide the foundation for the contractor to develop NetOps policy recommendations, impact statements and strategic plans, which will enable the Government to carry out effective policy implementation. The contractor shall make recommendations to synchronize Army network operations efforts and provide a road map for disparate initiatives so there is consistency, standardization, and efficiency across Army NetOps as policy changes occur. The contractor shall prepare and present briefing reports at IA/NetOps briefings approximately every 2 months. The contractor is not responsible for arranging for a briefing space, arranging for audience attendance or handling room logistics for any of the briefing events. All travel associated with this task is included in the PWS Travel paragraph 9.

The contractor shall create the following deliverables in support of this task:

IA/ NetOps Briefing Reports

This briefing will provide up-to-date information for key leaders on IA and NetOps advancements. (3-15 page Briefings)

Impact Statements These statements will provide leadership with concise information on the status of NetOps. (1 page)

NetOps Strategy Report

This study will outline a strategy for improving Army NetOps and measure the Army’s progress in meeting strategic goals and objectives. (30 pages approximately)

Policy Recommendations Report

This report will provide policy recommendations based on changes in NetOps.

(15 pages approximately)

3.7. Task 7: Network 2025: The contractor shall support the Army CIO/G-6 in coordination of Network 2025 initiatives across the Army for both the generating and operating force in the areas of Identity, Credential and Access Management, Cyber Security, Secure Mobile Computing, Cloud Computing, Network Operations, Continuous Monitoring, Risk Management, Network Modernization and other capabilities identified to achieve improved Cyber Security. The contractor shall support the Government in the development of resource requirements and policies for same. In addition, the contractor shall assist the Government in the development of strategic plans and objectives to effectively implement DoD, NSA, Joint and Army Cyber Security goals and initiatives in the out-years.

3.7.1 Support activities include the following:

Participation in DoD/DISA/DMDC/NSA/Joint Staff and Joint Information Environment working groups supporting Army interests.

Planning, coordinating and facilitating Cross-Army Integrated Project Teams for both

Identity and Access Management, Network Modernization and Network Operations.

Maintaining a shared area on the Network for document sharing and collaboration, Support to Lines of Effort: Strengthening Network Operations. Provide recommendations to issues, track and maintain status updates to network modernization initiatives involving network operations supporting the operational and generating force.

Support to the Network Operations and Security Domain leads within the CIO/G-6.

Support the development and coordination of Army Regulation 25-2.

Support activities defined in the Risk Management Framework (RMF) for DoD

Information Technology DoDI 8510.01; formerly known as DIACAP. The contractor shall provide support to the Cyber Security Directorate to address the cyber security requirements for DoD information technologies which shall be managed through the RMF consistent with the principals established in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37.

Information Assurance MilSuite Site. The contractor shall support the Army Cyber Security Directorate Strategic Communications Branch responsible for adopting and employing an array of communication approaches, ranging from policy advocacy, community collaboration, interpersonal communication, outreach and awareness training to the use of innovative communication techniques and media in order to shape behaviors within the Army and contribute to positive cultural change that is essential to accomplishing the Cyber Security mission.

A website was established on the Army's NIPRNet as a "One Stop Shop" for Mission Assurance Information in the Army. The contractor shall assist the Government in providing continued updates from Mission Assurance Subject Matter Experts (SMEs) and management of the site. The contractor shall be responsible for quality assurance of the site using the content provided by the Government designated SMEs. As the DoD and Army toolsets expand or are enhanced the contractor shall keep the Government informed and as directed update the Army IA site to take advantage of new or different functionality available. The contractor shall provide the government a monthly MilSuite Website Update Report.

The contractor shall assist the Army Cyber Security Directorate in developing strategies for the prevention of cyber-attacks against DoD's networks and numerous, varied, and complex information sharing challenges within the DoD Information Network (DODIN), the DoD has established a strategic vision to deliver a Joint Information Environment (JIE) that will enable the DoD and its mission partners to securely access information and services they require when they need it, from where they need it, and on the DoD approved device of their choice. The envisioned strategic end-state of this strategy is to enhance mission effectiveness, increase security, and to improve information technology efficiencies through the consolidation of costly network resources and infrastructure throughout the DoD.

The contractor shall assist the Army Cyber Security Directorate with relevant DOTMLPF findings to ensure that "gaps" in Mission Assurance capabilities are fully documented for review and possible resolution by affected stakeholders. This objective shall include addressing clarification of roles and responsibilities Cyber Security governance documentation, or reaffirming existing MOUs/MOAs, or formalizing processes that are currently executed on a less than formal basis. As requested, the contractor shall provide a SME in one or more of the following IA disciplines: Army Cryptographic Modernization, Army Public Key Infrastructure (PKI) Credentialing, Key

Management Infrastructure (KMI), cyber security and information assurance, Computer Network Defense- Service Provider (CND-SP), securing the network in a joint environment, secure network tools and operations, Federal Information Security Management Act (FISMA), and the RMF.

The contractor shall provide the Government, as requested, with a follow-up report to any meetings the contractor attends in support of the Government.

The contractor shall provide a Trip Report to the Government for any TDY travel taken in support of this contract.

3.7.2 The contractor shall support the Army CIO/G-6 in coordination with DoD CIO, DISA, and Services to support the JIE that will be comprised of shared IT infrastructure, enterprise services, and single security architecture to achieve full spectrum superiority, improve mission effectiveness, increase security and realize IT efficiencies. The contractor shall assist the JIE community of interest with developing enforceable standards, specifications, reference architecture and common tactics, techniques, and procedures (TTPs).

3.7.3 Support activities include the following:

Participation in the development of JIE strategic plans and objectives as well as Army

Network Modernization efforts which effectively support the goal of leveraging shared IT infrastructure that will operate the same regardless of service provider and/or use common tactics, techniques, and procedures developed at the enterprise level. In addition, ensure these efforts enhance/support Computer Network Defense (CND) operational efforts.

Participation in JIE working groups and support Army interests in areas such as information sharing, enterprise services, tools standardization, Network Modernization and security and architectures across the full range of military operations.

Planning, coordination, and facilitation of Integrated Project Teams (IPTs) that consist of multiple Army Organizations and DoD mission partners for all cyber security JIE activities and ensure these efforts are synchronized with Army’s Cyber Security and Network Modernization efforts.

Collection, research and analysis of information to provide requirements, architectures, policies, and procedures that enable information sharing across DoD Components for shared situational awareness of all business, warfighting, and intelligence data.

Participation and support of the JIE workings groups to research and develop criterion for Common enterprise services, applications and tools, and single security architecture for all Services with global availability that's extendable to the tactical edge.

3.8. Task 8: Identity, Credentialing, and Access Management (ICAM): The CIO/G6 requires Identity, Credentialing, and Access Management (ICAM) subject matter expertise to support the incorporation of ICAM services into Army network operations. The Army’s ICAM efforts must align with efforts detailed in the DoD Identity and Access Way Ahead, ICAM Transition Plan and the Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance document.

3.8.1: ICAM is imperative to security, as it makes resources available to the Soldier whenever and however is necessary to complete the mission, while preventing adversaries from gaining access to mission critical data. ICAM also enables significant cost efficiencies. The Army’s predominantly tactical nature presents unique challenges, as the IT infrastructure itself is subject to constant fluctuation and varying levels of assurance. A holistic solution is required to fulfill the requirements of both the Strategic and Operating Forces.

3.8.2: To achieve this holistic solution, the Army will continue to implement an enterprise service based access management capability based on an integrated Identity and Access Management (IdAM) framework. This framework will provide seamless network access for identification, authentication, authorization, and accountability for personnel (military, civilian, contractor, etc.) accessing logical and physical resources. This capability will also allow Army to eliminate the standalone access control mechanisms for applications, systems, and networks that are often insecure, inefficient, and redundant.

3.8.3: The Army will further enhance IdAM capabilities to provide security services to support the adoption of Big Data and Cloud technologies. Through the establishment of an Enterprise IdAM framework and leveraging DoD common Identity services, Army will dramatically increase the security posture, increase IT efficiencies, and improve IT effectiveness.

Furthermore, the addition of these capabilities will result in the following benefits to the Army.

Alignment with DoD IdAM strategy for access control and elimination of duplicative efforts with other DoD Components.

Assurance of identity information by enforcing the single-provider model and decreasing the proliferation of data stores.

Ability to define and enforce identity and access control policies independently of cloud application and cloud infrastructure providers.

Context-based and content-aware policy management for the cloud allowing Army to shift resources to the cloud without loss of control.

3.8.4: Authentication: Determining the most appropriate authentication methodology for Army users and ensuring that DoD Enterprise offerings meet the needs of Army user populations.

These methodologies must include analysis on authentication schemes for user populations that include CAC and Non-CAC Eligible populations.

The contractor shall support the Army CIO/G6 Cyber Security Directorate in ensuring that advances in DoD Public Key Infrastructure (PKI) such as the incorporation of SHA-256 and the planned use and deployment of PKI in tactical echelons are technically sound and meet the needs of Army user populations.

3.8.5: Authorization: Orchestrating the institutionalization of access controls via a robust, resilient, and secure framework. The contractor shall support the CIO/G-6 Cyber Security Directorate in collaborating with Army service providers such as DISA and DMDC on Enterprise authorization services and will develop analyses and information papers detailing how Army stakeholders (such as PEO-C3T, PEO-EIS and NETCOM) will utilize those services and how those services will be deployed. This analysis will include support of JIE efforts for DoD wide Access Management capabilities.

The contractor shall support the CIO/G-6 Cyber Security Directorate in providing authorization subject matter expertise to assist PEO-EIS and NETCOM with determining appropriate authorization methods and techniques for logical access to Army resources that are being transitioned from Army Knowledge Online (AKO) Single Sign On capabilities (SSO) to either DoD Core Data Centers (CDC) Joint Information Environments (JIE), DoD cloud services, or locally managed Army Installation Processing Nodes (IPNs).

3.8.6: Provisioning and Directory Services: Preparing the Army infrastructure to consume the Enterprise provisioning service through coordination across the stakeholders and providing engineering guidance…