Attachment_0002_Eagle_Shield_BPA_PWS.pdf

DEFENSIVE CYBER OPERATIONS

EAGLE SHIELD BLANKET PURCHASE AGREEMENT (BPA)

PERFORMANCE WORK STATEMENT

30 JANUARY 2019

Contents

1. Background

1.1 Authorized BPA Users

1.2 Scope

1.3 Length of Agreements

1.4 General Information

1.4.1 Organizational Conflict of Interest (OCI)

1.4.2 Contracting Officer’s Representative (COR)

1.4.3 Quality Management System

1.4.4 Security Requirements

1.4.5 Data Rights

2. Services and Work Product Overview

2.1 Program Management

2.2 Technical Management

3. Applicable Publications

3.1 Regulations, Publications, Manuals, and Local Policies and Procedures

3.2 Cybersecurity Policy Requirement

4. Definitions and Acronyms

4.1 Definitions

4.1.1 Contractor

4.1.2 Contracting Officer (KO)

4.1.3 Contracting Officer’s Representative (COR)

4.1.4 Sub-Contractor

4.1.5 System

4.1.6 Family of Systems (FoS)

4.1.7 System of Systems

4.1.8 Interoperability

4.1.9 Combining

4.2 Acronyms

1. Background The U.S. Army's cyber mission is to provide the capabilities required for various teams to maneuver in cyberspace and perform cyberspace operations in direct response to the ever changing and evolving threat. The Army's cyber mission requires the integration of worldwide suites of complementary systems capabilities for designated global, regional, and local Cyber Protection Teams (CPTs). To provide the required capabilities tailored to the specific threat and mission urgent need, the Army must enable flexible, scalable, elastic, and responsive changes driven by the evolving threat landscape, technological innovations, and availability of cyberspace solutions and tools.

The Defensive Cyber Operations (DCO) program currently instantiates Acquisition Category (ACAT) III or below Programs of Record (POR):

Cyber Analytics Deployable DCO System (DDS) Garrison DCO Platform (GDP) Tactical DCO Infrastructure (TDI) (managed by PEO C3T; not by PEO EIS and PM

DCO

DCO Tool Suite DCO Mission Planning

DCO Program future Acquisition Category (ACAT) III or below Programs of Record (POR) include:

Forensic/Malware Insider Threat Advanced Sensors Threat Discovery/Counter-Infiltration Threat Emulation.

Mission

Near-Term: Continue delivery of initial operating DCO capabilities to CPTs, potentially Regional Cyber Centers, and select corps and below units across all three components (COMPOs): Active, Reserve and National Guard. Careful exploration and prototyping of technologies is required during this period to support the mid-term development and employment of DCO solutions.

Mid-Term: Provide full operational capabilities to the force. Solutions stemming from the approved DCO Information System Initial Capabilities Document (IS-ICD) and follow-on Requirements Definition Packages (RDPs) will start to be fielded during this period as POR. Technology advances will increase the flexibility and support rapid fluidity of operations. The Army must strive to influence Science and Technology (S&T) efforts to meet long-term requirements

Long-Term: Employ advanced technologies resulting from academia and DoD S&T efforts to increase the ability of cyberspace defenders in the future, and expand and develop DCO capabilities as responsive, dynamic, and tailorable. Advanced technologies will offer giant leaps in solutions, requiring less size, weight, and power, generating effects that ensure use of friendly cyberspace.

1.1 Authorized BPA Users

The BPA is open for ordering in support of PEO EIS, PM DCO, U.S. Cyber Command (USCYBERCOM), ARCYBER, Headquarters, Department of the Army (HQDA), Chief Information Officer/G6 (CIO G6), Program Executive Office Command, Control and Communications-Tactical (PEO C3T), and Program Executive Office Intelligence, Electronic Warfare & Sensors (PEO IEW&S).

1.2 Scope

The Contractor shall provide industry-leading, cyber-related, non-traditional program and technical management support services and work products to DCO programs, the DoD cyber community and customers under individual call orders. Specific call order scope will be identified at the call order level. Required support at the call order level could include, but is not limited to, the following:

Program Management Technical Management Acquisitions Agile Development Administration/Operations Cyber Analytics Business and Financial Management Cybersecurity Graphics Cybersecurity Risk Management Human Resource Support Integration Logistics Security/Development/Operations

(SEC/DEV/OPS)

Program Management Systems Engineering Project Management System Maintenance and Sustainment Training System Security Engineering Testing

The work covered under this agreement does not include “personal services.” A “personal services” contract is characterized by “the employer-employee relationship it creates between the Government and the contractor’s personnel.” This occurs when contractor personnel are being treated in a manner akin to that of a Government employee.

1.3 Length of Agreements

Blanket Purchase Agreements will be for five years. At five years, the BPA will be reviewed to determine if it will be renewed. However, each BPA will be reviewed at least annually, and, if necessary, updated at that time.

1.4 General Information

1.4.1 Organizational Conflict of Interest (OCI)

Personnel performing work under this agreement may receive, have access to, or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services, which may create a current or subsequent Organizational Conflict of Interests (OCI). The Contractor shall notify the KO immediately that such access or participation may result in any actual or potential OCI and promptly submit a plan to the KO to avoid or mitigate any such OCI. The KO has sole discretion to decide whether the Contractor’s mitigation plan is acceptable. If the

Contractor cannot satisfactorily avoid or mitigate any OCIs, the KO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which the OCI may affect.

In order to prevent a future OCI resulting from potential bias, unfair competitive advantage, or impaired objectivity, the Contractor (to include subcontractors) shall be subject to the following restrictions.

The Contractor shall be excluded from competition for or award of any agreement/call order to which, in the course of performance of this PWS, the Contractor has received advance procurement information before such information has been made generally available to other persons or firms.

The Contractor shall be excluded from competition for, or award of any agreement/call order for which the Contractor provide the development of specifications or statements of work. Additionally, the Contractor shall be excluded from future procurements to which they have drafted evaluation criteria.

The Contractor shall be excluded from any procurement where the Government determines there is an unmitigated Organizational Conflict of Interest.

1.4.2 Contracting Officer’s Representative (COR)

A COR will be identified by the designation letter issued by the KO at both the BPA and call order levels. All call orders will have an identified COR and designation letter that specifies their specific authorities and responsibilities. A copy of the letter will be sent to the contractor and the contractor will acknowledge each COR’s designation letter.

Under no circumstances does a COR have the authority to authorize substantive changes to any terms and conditions of the resulting order with respect to cost/price, and delivery dates.

All call orders under this BPA shall include a Quality Assurance Surveillance Plan (QASP) outlining the Government’s surveillance methodology and assessment of the contractor’s performance in terms of an acceptable level of quality.

1.4.3 Quality Management System

Contractors performing under this BPA shall ensure that they have an approved Quality Management System that is certified to ISO 9001:2015 standards. The Contractor shall develop a Quality Control Plan (QCP) within 30 day of Notice to Proceed (NTP) of a call order under this BPA.

1.4.4 Security Requirements

Contractor personnel performing work under this BPA shall have a SECRET or TOP SECRET security clearance, as determined at the call order level. The required level of security clearance shall be active at time of the call order proposal submission, and the level of security required shall be maintained for the life of the call order. The security requirements are IAW the attached DD Form 254, DoD BPA Security Classification Specification incorporated in this BPA. In addition, the Contractor shall meet the following requirements:

a. All Contractor personnel shall require access to Confidential and Secret classified information. Further, as required at each call order, select Contractor personnel shall require Top Secret and Sensitive Compartmented Information (SCI) classified information. Additionally, all Contractor personnel shall require access to North Atlantic Treaty Organization (NATO) and Foreign DCO information at classification levels equivalent to their respective required clearance levels. The Contractor personnel shall also require access to Non-classified Internet Protocol Router Network (NIPRNET), SECRET Internet Protocol Router Network (SIPRNET), and, as required by the specific call order, Joint Worldwide Intelligence Communications System (JWICS) and shall adhere to applicable Security/Program/Classification Guides.

b. All Contractor personnel shall require access to Controlled Unclassified Information (CUI), which will, at a minimum, include For Official Use Only (FOUO) information.

c. As required at the call order level, Contractor personnel shall also require access to COMSEC information. The Contractor shall be able to provide storage capability for safeguarding of Controlled Cryptographic Items (CCI) to include Secure Terminal Equipment (STE), Secure Terminal Unit (STU) III, KIV-7, and KIV-19 if, and as required by a specific call order.

d. In performing call orders under this BPA, the Contractor shall receive and generate CUI and classified material, shall access classified information outside the U.S., Puerto Rico, U.S. possessions and trust territories, shall be authorized the use of the Defense Technical Information Center (DTIC) or secondary distribution center, and shall adhere to Operations Security (OPSEC) requirements IAW the DD Form 254.

e. All public release of information requires COR concurrence; however, all information FOUO or higher shall be cleared in accordance with Section 12 of the DD Form 254.

1.4.4.1 Other Security Requirements

Per the Antiterrorism/Operations Security Review Cover Sheet, the Contractor shall adhere to the following security requirements:

a. Anti-Terrorism (AT) Level I Training. This applies to Contractor employees with an area of performance within an Army-controlled installation, facility, or area. All Contractor employees, to include Sub-Contractor employees, requiring access to Army installations, facilities, or controlled access areas shall complete AT Level I awareness training within 30 calendar days after call order start date The Contractor shall submit certificates of completion for each affected Contractor employee and Sub-Contractor employee to the BPA COR, or to the KO, if a BPA COR is not assigned, within 14 calendar days after completion of training by all employees and Sub-Contractor personnel. AT Level I awareness training is available at https://atlevel1.dtic.mil/at.

b. Access and General Protection/Security Policy and Procedures. This standard language is for Contractor employees with an area of performance within an Army-controlled installation, facility, or area. The Contractor and all associated Sub-Contractors employees shall comply with applicable installation, facility, and area commander installation and facility access and local security policies and procedures (provided by the DCO representative). The Contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of Emergency Services, or Security Office. The Contractor workforce must comply with all personal identity verification requirements as directed by DoD, HQDA, and/or local policy. In addition to the changes otherwise authorized by the changes clause of this BPA, should the Force Protection Condition (FPCON) at any individual facility or installation change, the DCO may require changes in Contractor security matters or processes.

c. DoD Network Access. All Contractor employees and associated Sub-Contractor employees must be registered in the ATCTS at commencement of the order and successfully complete the DoD Cyber Awareness Challenge Training before issuance of network access and annually thereafter.

d. For Cybersecurity/IT Certification. Per DoD 8570.01-M, DFARS 252.239.7001, and AR 25-2, the Contractor Cybersecurity Engineer(s), System/Software Engineer(s) and Administrator(s) requiring Privileged Access in support of IT functions shall be appropriately certified upon BPA award. The Contractor’s Cybersecurity Engineer(s) and/or System/Software Engineer(s) and/or Administrator(s) responsible for administering any updates to fielded systems require certification. All other supporting activities, including any work on our standalone classified systems, should be considered developmental or test systems and are not required to comply with the subject regulations included in this paragraph.

e. Combat Trafficking in Persons. Mandatory General Awareness. All Contractor employees and associated Sub-Contractor employees must complete this training within 30 calendar days of call order award and within 30 calendar days of new employees commencing performance, with the results reported to the call order COR not later than 45 calendar days after call order award.

f. For all Contractors with security clearances. Per AR 381‐12, Threat Awareness and Reporting Program (TARP), Contractor employees must receive annual TARP training by a CI agent or other trainer as specified in AR 381-12, paras 2‐ 4b. The applicability of AR 381‐12 to local foreign national employees and contractors employed in overseas areas will be governed by Status of Forces Agreements and applicable treaties between the United States and host countries.

g. The Contractor and all associated Sub‐Contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity Authority to Operate). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the BPA and/or call order COR. This training shall be completed within 30 calendar days of call order award and within 30 calendar days of new employees commencing performance, with the results reported to the call order COR not later than 45 calendar days after call order award.

h. The Contractor shall not divulge any information about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed, as required at the call order level.

i. The Contractor shall afford the DCO access to the Contractor’s facilities, installations, operations, documentation, databases, and personnel used in performance of the BPA. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of data or to the function of IT systems operated on behalf of Defense Information Systems Agency (DISA) or DoD, and to preserve evidence of computer crime.

j. Contractor employees will be required to comply with all security regulations and requirements. Initial and periodic security training and briefings will be provided by DCO security personnel. Failure to comply with security requirements can cause for removal from the BPA and the Contractor will not be able to provide services or deliver work products on this BPA.

1.4.4.2 Contractors Requiring a Common Access Card (CAC)

CACs will be issued at the call order level. Before CAC issuance, the Contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation IAW Army Directive 2014‐05.

The Contractor employee will be issued a CAC only if duties involve one of the following: (1) both physical access to a DoD facility and access, via logon, to DoD networks on‐site or remotely; (2) remote access, via logon, to a DoD network using DoD‐approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non‐DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of six months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the Federal Bureau of Investigation (FBI) fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

1.4.4.3 Facility Security Clearance

The Contractor facility shall have a TOP SECRET facility clearance with SECRET safeguarding capability at a minimum of two cubic feet. The work to be performed under this BPA is up to the Top Secret level and will require SCI access eligibility for some personnel. Therefore, the company must have a final TOP SECRET Facility Clearance from the Defense Security Service (DSS) Facility Clearance Branch at time of BPA award.

1.4.4.4 DoD Policy and Cybersecurity

DoD policy states that Cybersecurity requirements shall be identified and included in the design, acquisition, installation, operation, upgrade, or replacement of all DoD information systems. This includes systems and processes developed within the Defense Acquisition System, systems and processes developed at private expense, outsourced business processes supported by private sector information systems, and outsourced information technologies. Information technology services provided under this BPA must comply with statutory and regulatory Cybersecurity policy. Any new laws or policies applicable to Cybersecurity subsequent to issuance of this BPA will be incorporated into the basic BPA unilaterally without equitable adjustment to the basic BPA. (See Cybersecurity Policy Requirements in section 3.2 below)

1.4.5 Data Rights

The DCO has unlimited rights to all documents/material produced under this BPA. All documents and materials, to include the source code of any software, produced under this BPA shall be DCO owned and are the property of the DCO with all rights and privileges of ownership/copyright belonging exclusively to the DCO. These documents and materials may not be used or sold by the Contractor without written permission from the KO. All materials supplied to the DCO shall be the sole property of the DCO and may not be used for any other purpose. This right does not abrogate any other DCO rights.

1.4.6 Government Furnished Equipment (GFE), Government Furnished Information (GFI), Government Data, Access to Data GFE, GFI, Government Data and Access to Data shall be specified at the call order level.

1.4.7 Contractor Manpower Reporting

The Contractor shall report ALL Contractor labor hours, including subcontractor labor hours required for performance of services provided under this contract via a secure data collection site. The Government requires the Contractor to completely fill in all required data fields using the following web address: http://www.ecmra.mil/ and then click on "Department of the Army CMRA" or the icon of the DoD organization that is receiving or benefitting from the contracted services. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While the Contractor may report inputs any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk by clicking on “Send an email” which is located under the Help Resources ribbon on the right side of the login page of the applicable Service/Component’s CMR website"

2. Services and Work Product Overview The objective of this BPA is to provide strategic level program and technical management support to the cyber community in implementing laws, regulations, and polices to facilitate evolving Army cyber practices with the intention of meeting critical milestones, delivering of capabilities, and continuously improving performance. This BPA objective includes providing a high level of expertise, and in some instances niche capabilities and skills, in order to procure industry-leading technologies or meet urgent cyber capability needs. Examples of niche capabilities and skills required for the Army’s cyber mission includes experience with artificial intelligence, cyber cloaking, networking tapping, micro cloud, behavioral analytics, machine learning, deep learning, big data scientists, cyber cloud development, adapting and configuring new technology, multifaceted script language, cyber analytics, identifying and implementing digital platforms across organizations. A comprehensive, but not limited, sampling of work to be performed under this BPA at the call order level is shown below:

2.1 Program Management

a) Acquisitions - support in creating acquisition requirements packages for supplies and services. The supplies and services could be acquired using the Federal Acquisition Regulations procurement process or by other transaction agreements.

b) Administration/Operations - execution of day-to-day requirements, such as management of schedules, calendars, databases, documents, distribution of information, data input, reporting, and document control. This could also involve complex evaluations of existing procedures, processes, technique, models, and/or systems related to management problems.

c) Business and Financial Management – planning, programming, and budget execution support, to include budget analysis, budget planning, cost benefit analysis, business case analysis, and economic analysis as it relates to data-driven innovation.

d) Graphics - visual communications support to inspire and inform audiences through both physical and virtual art forms.

e) Human Resource Support - assist in establishing personnel and workforce development, procedures, processes, and standard operating procedures.

This could include planning of command events, ensuring that annual employee training is scheduled and completed, assistance with succession planning, creating and sustaining a mentor program, etc.

f) Logistics - management of the flow of resources between the point of origin and the point of consumption to meet requirements, to include lifecycle and asset management.

g) Program Management - application of knowledge, skills, tools, and techniques to program activities to meet requirements. This could include assisting in the management of several projects with the intention of meeting critical milestones, delivering of capabilities, and continuously improving performance.

h) Project Management - assist in planning, developing, testing, and documenting projects, to include applying business process improvement practices, modernizing projects, and reengineering old methodologies/principles.

i) Training - provide the principles and techniques of instructional design methodology to develop and deliver training materials and programs as well as provide customized education and training in varied venues and locations.

2.2 Technical Management

a) Agile Development - provide subject matter expertise to support agile development using methodologies based on iterative development, requirements and solutions. The requirements and solutions evolve through collaboration between self-organizing cross-functional teams and customers/end users. Agile Development could include supporting adaptive planning, evolutionary development, early delivery, and continual improvement to rapidly and flexibly respond to change.

b) Cyber Analytics - provide subject matter expertise in computer security, computer and network administration, and auditing support using Cyber Analytics. This could include reviewing data patterns and applied algorithms and statistical analyses to ensure detected anomalies are meaningful.

c) Cybersecurity - assist in the management and administration of the DCO Mission Network (DCO-MN), network performance and maintaining network security. This could include managing and administering the total DCO infrastructure, platforms, systems, applications/tools, performance, and maintenance over system security.

d) Cybersecurity Risk Management - support the management of information and risks related to the use, processing, storage, and transmission of information or data and the systems and processes used for those purposes.

e) Integration - provide engineering subject matter expertise to the integration and combining of components (i.e., systems, subsystems, applications, or parts thereof) of capabilities to create Family of Systems, Systems of Systems, and Interoperability between systems.

f) Security/Development/Operations (SEC/DEV/OPS) - provide subject matter expertise to support Sec/Dev/Ops. This could include supporting security activities that occur before development or operations, as well as throughout the entire life cycle. Security requirements shall have automated tests created and added to the automation suites so they can run continuously to ensure that security is inclusive throughout the cycle.

g) Systems Engineering - provide engineering support that focuses on how to design and manage complex systems over their lifecycles. This include design, implementation, and maintenance of complex databases, access methods, access time, device allocation, validation checks, organization, protection and security, documentation and statistical methods.

h) Systems Maintenance and Sustainment - provide consulting services to ensure systems receive corrective, adaptive, perfective, and preventive maintenance.

i) System Security Engineering - assist in the integration research and technology protection into the development of products, systems and standards/specifications, providing life-cycle protection for the DCO-MN and other systems and products. This could include “design-in” necessary countermeasures and “engineer-out” vulnerabilities.

j) Testing - provide technical expertise to assist in the testing of systems and applications.

3. Applicable Publications

3.1 Regulations, Publications, Manuals, and Local Policies and Procedures.

The Contractor shall abide by all applicable regulations, publications, manuals, and local policies and procedures including.

a) Department of Defense Directive (DoDD) 5000.01, The Defense Acquisition System

b) DoD Instruction (DoDI) 5000.2, Operation of The Defense Acquisition System

c) Federal Acquisition Regulation (FAR)

d) AR 700-142, Materiel Release, Fielding, and Transfer

e) DA Pamphlet 700-142, Instructions for Materiel Release, Fielding, and Transfer

f) DoDD 8500.1E, Information Assurance (IA)

g) DoDI 8500.2, Information Assurance Implementation

h) AR 25-2, Information Assurance

i) DoD 5200.40 Information Assurance Certification and Accreditation Process

Guidance

j) DoD Directive 8570.01, Information Assurance Training, Certification, and Work

Force Management

k) Army Best Business Practices (BBPs)

l) DoDI 8510.01, Department of Defense Certification and Accreditation Process

Guidance

m) DoDI 8580.1, IA in the Defense Acquisition System

n) DoDI 5200.2-R, Personnel Security Program

o) Other IA security guidance from the Army’s Certification Authority, the PEO EIS, and PM DCO.

3.2 Cybersecurity Policy Requirement

The Contractor shall comply with the following main DoD Cybersecurity policies. A complete list can be found at https://www.csiac.org/resources/the-dod-cybersecurity-policy-chart/

a) Title 40/Clinger-Cohen Act

b) DoD Instruction 8500.01 Cybersecurity – 14 Mar 2014

c) DoD Directive 8570.1 “Information Assurance Training, Certification, and

Workforce Management” – 23 April 2007

d) DoD Instruction 8580.1 “Information Assurance in the Defense Acquisition

System”

e) DoD Instruction 8510.01 Risk Management Framework (RMF) for DoD

Information Technology (IT) – 12 Mar 2014

f) CJCS Instruction 6510.01E “Information Assurance (IA) and Computer Network

Defense (CND)”

g) CJCS Instruction 6212.01 “Interoperability and Supportability of IT and National

Security Systems”

4. Definitions and Acronyms

4.1 Definitions

4.1.1 Contractor. A supplier or vendor awarded a BPA to provide specific supplies or service to the DCO. The term used in this BPA refers to the prime.

4.1.2 Contracting Officer (KO). A person with authority to enter into, administer, and or terminate BPAs, and make related determinations and findings on behalf of the DCO.

Note: The only individual who can legally bind the DCO.

4.1.3 Contracting Officer’s Representative (COR). An employee of the U.S. DCO appointed by the KO to administer the BPA. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the BPA, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the BPA.

4.1.4 Sub-Contractor. One that enters into a BPA with a prime Contractor. The DCO does not have purview of BPA with the Sub-Contractor.

4.1.5 System. Hardware, Software and Tools collectively forming a complex/intricate whole to provide a function.

4.1.6 Family of Systems (FoS). A grouping of systems having some common characteristic(s). In general, a FoS is not considered to be a system per se because it does not necessarily create capability beyond the additive sum of the individual capabilities of its member systems. A FoS lacks the synergy of a System of Systems (SoS). The FoS does not acquire qualitatively new properties as a result of the grouping. In fact, the member systems may not be connected into a whole.

4.1.7 System of Systems. A set or arrangement of systems that results from independent systems integrated into a larger system that delivers unique capabilities;

i.e. the whole is greater than the sum of the parts.

4.1.8 Interoperability. Information exchanges between a range of products, or similar products from several different vendors, or even between past and future revisions of the same product and/or the ability to share data and services between different components via open standards.

4.1.9 Combining. A process of amalgamation of multiple components into a FoS which together provide a full expression of the intent and do not acquire new properties as a result of the grouping.

4.2 Acronyms

Acronym Definition

ACAT Acquisition Category AFCYBER Air Force Cyber AR Army Regulation ARCYBER Army Cyber AT Anti-Terrorism ATCTS US Army Training and Certification Tracking System ATO Authority To Operate BBP Best Business Practices BPA Blanket Purchase Agreement CAC Common Access Card CCI Controlled Cryptographic Items CMF Cyber Mission Forces COMPO Component COMSEC Communication Security COR Contract Officer Representative CPT Cyber Protection Team CUI Controlled Unclassified Information

DCO Defense Cyber Operations DDS Deployable DCO System DFAR Defense Federal Acquisition Regulation DISA Defense Information Systems Agency DoD Department of Defense DoDAF Department of Defense Architecture Framework DoDD Department of Defense Directive DoDI Department of Defense Instructions DSS Defense Security Service DTIC Defense Technical Information Center EEO Equal Employment Opportunity eMASS Enterprise Mission Assurance Support Service FAR Federal Acquisition Regulation FBI Federal Bureau of Investigation FFC Fleet Cyber Command FOUO For Official Use Only FPCON Force Protection Condition FoS Family of Systems GDP Garrison DCO Platform GFE Government Furnished Equipment

HQDA Headquarters, Department of the Army IA Information Assurance IDP Individual Development Plan IS Information System IS-ICD Information System Initial Capabilities Document JWICS Joint Worldwide Intelligence Communications System KO Contracting Officer MN Mission Network NACI National Agency Check with Inquiries NATO North Atlantic Treaty Organization NDA Non-Disclosure Agreement NIPSOM National Industrial Security Program Operating Manual NSA National Security Agency NTP Notice to Proceed OCI Organizational Conflict of Interest OCONUS Outside the Continental United States OPSEC Operations Security OSHA Occupational Safety and Health Administration OTA Other Transaction Authority PEO EIS Program Executive Office Enterprise Information Systems POR Program of Record PV Project Viewpoint PWS Performance Work Statement QA Quality Assurance QASP Quality Assurance Surveillance Plan QCP Quality Control Plan RDP Requirements Definition Package RMF Risk Management Framework SCI Sensitive Compartmented Information SEC/DEV/OPS Security/Development/Operations SIPRNET Secret Internet Protocol Router Network SME Subject Matter Expert SOP Standard Operating Procedure SOW Statement of Work SoS System of Systems S&T Science and Technology STIG Security Technical Implementation Guides SvcV Services Viewpoint TARP Threat Awareness and Reporting Program TTP Tactics, Techniques and Procedures USCYBERCOM U.S. Cyber Command