RCIS_Type_I_PWS.pdf

FOR OFFICIAL USE ONLY

ROUTE CLEARANCE & INTERROGATION SYSTEMS (RCIS) TYPE I

Performance Work Statement (PWS)

Document Date: 21 Jul 2016 Version 0.1 (Draft)

Route Clearance & Interrogation Systems (RCIS) Type I Performance Work Statement

C.1 RCIS Type I

C.1.1 Introduction This Performance Work Statement (PWS) encompasses the Engineering and Manufacturing Development (EMD) (C.1.2-C.20), Low Rate Initial Production (LRIP) Option (C.21), Full Rate Production (FRP) Options (C.22), Total Package Fielding Options (C.23), Technical Data Package (TDP) Option (C.24), the System Technical Support (STS) Options (C.25) and Interim Contractor Support Options (C.26), of the Route Clearance & Interrogation System (RCIS) Type I program.

C.1.1.1 Definitions

C.1.1.1.1 High Mobility Engineer Excavator (HMEE): a 15-ton construction tractor capable of high speed with a front loader and backhoe bucket on a boom arm, able to self-deploy with military convoys.

C.1.1.1.2 Delta HMEE (D-HMEE): a HMEE modified with electronic control of automotive and interrogation functions to enable unmanned operation; also includes additional interrogation attachments (air spade, rake and spork, and clamshell bucket).

C.1.1.1.3 Buffalo Mine Protected Clearance Vehicle (MPCV): a 24 ton wheeled armored vehicle in the Mine-Resistant Ambush-Protected (MRAP) Family of Vehicles (FoV) used for route clearance missions.

C.1.1.1.4 RCIS HMEE (R-HMEE): a D-HMEE integrated with Semi-autonomous Control (SAC) system components capable of manned and unmanned operation.

C.1.1.1.5 SAC System: a robotics applique kit consisting of a Mobile Base Unit (MBU) integrated on the D-HMEE and Operator Control Unit (OCU) integrated on the MPCV enabling unmanned control of the R-HMEE by an operator in the MPCV. The operator can remove the OCU from the MPCV and control the R-HMEE while dismounted.

C.1.1.1.6 Control Vehicle: a Buffalo MPCV integrated with SAC system components enabling an operator to control the R-HMEE in the unmanned mode.

C.1.1.1.7 RCIS Type I: a system consisting of an R-HMEE and Control Vehicle used during route clearance missions.

C.1.1.2 Applicable Documents

C.1.1.2.1 Reference Performance Work Statement Applicable Documents (Attachment 0011).

C.1.1.3 System Overview

C.1.1.3.1 The RCIS Type I shall enable a Soldier to excavate, interrogate, and classify (i.e. identify) deep buried explosive hazards, Improvised Explosive Devices (IEDs), and caches in a wide range of road surfaces and soil conditions, as well as clear routes by moving explosive hazards, debris and rubble, and filling potholes. The RCIS Type I shall operate in two different modes: a manned mode operable by a Soldier in the R-HMEE and an unmanned mode operatable by a Soldier in a separate control vehicle, or in a dismounted position.

C.1.1.3.2 The RCIS Type I shall employ two R-HMEE vehicle configurations: an unarmored configuration and, an armored configuration with its Crew Protective Kit (CPK). The RCIS Type I shall provide various attachments including a front loader, backhoe bucket, clamshell bucket, rake and spork, air spade, classification camera, light and measurement devices to enable a Soldier to perform interrogation tasks.

C.1.1.3.3 The RCIS Type I shall include a SAC system that provides the capability to control the R-HMEE and attachments in the unmanned mode. The SAC system shall also be capable of providing control of classification capabilities in the manned mode.

C.1.2 Engineering Manufacturing and Design (EMD)

C.1.2.1 For EMD, the Contractor shall design, develop, and deliver RCIS Type I’s and all associated deliverables IAW the Performance Specification for RCIS Type I (Attachment 0001), hereafter referred to as the “RCIS P-Spec”, and sections C.2 through C.20 of the PWS. For information regarding RCIS Type I missions refer to the Operational Mode Summary / Mission Profile (OMS/MP) (Attachment 0005).

C.1.2.1.1 The Contractor shall integrate SAC system components onto six D-HMEE vehicles in accordance with the D-HMEE Physical Interface Control Document (ICD) (Attachment 0002) and D-HMEE Robotic Interface ICD (Attachment 0003).

C.1.2.1.2 The Contractor shall integrate SAC system components onto six control vehicles, specifically the Buffalo MPCV, IAW the RCIS Control Vehicle ICD (MPCV) (Attachment 0004).

C.1.2.4 The Government will provide Government Furnished Property (GFP) to support EMD (Attachment 0008 GFP List) including six D-HMEEs and six Buffalo MPCVs.

C.2 PROGRAM STRUCTURE AND MANAGEMENT

C.2.1 The Contractor shall define and ensure its key roles (including Project Management (PM) and Integrated Product Team (IPT) leads) are staffed with personnel of commensurate education, training, work experience, and technical training to perform the tasks required of the position. The Contractor shall present its organizational key roles at the Start of Work Meeting (SOWM) and discuss its plan for communicating and transitioning personnel changes. When the Contractor intends to change the personnel working in key roles, the Contractor shall provide ten business days notice via email to the Contracting Officer Representative (COR).

C.2.2 Integrated Product Teams (IPTs) For purposes of this contract, any joint deliberative or task-focused body, regardless of its formal or informal title, (e.g., "Working Group," "Integrated Design Team", etc.) will be considered an Integrated Product (or Process) Team, or "IPT". The Contractor shall establish IPTs to serve as a tool to manage performance under this PWS and as a key method of communication for this contract.

C.2.3 Integrated Master Schedule (IMS)

The Contractor shall develop and maintain the project’s Integrated Master Schedule (IMS) detailing program activities using the Government provided RCIS Program Plan (Attachment 0015) as a guide. The IMS shall be delivered IAW Contract Data Requirements List (CDRL) A001 Integrated Master Schedule (IMS).

C.2.4 Work Breakdown Structure (WBS) The Contractor shall use the RCIS Type I Work Breakdown Structure (WBS) ((Attachment 0006)) for preparation of the Contract Work Breakdown Structure (CWBS).

The WBS shall be developed using the latest version of MIL-STD-881, Work Breakdown Structures for Defense Materiel Items, as guidance and continue the WBS numbering scheme to decompose the WBS to level 5, or lower as appropriate and subject to PCO approval. The Contractor shall deliver its WBS IAW Contract Work Breakdown Structure

(CWBS), CDRL A002

C.2.5 Contract Funds Status Report The Contractor shall prepare, update and submit the Contract Funds Status Report

(CFSR) IAW CDRL A003 CFSR.

C.2.6 Internet-Based Collaboration

C.2.6.1 The Contractor shall notify the COR via email upon submission of new or updated documents being posted to the RCIS Integrated Data Environment (IDE) (C.8.2). The notification email shall include a web address or link to the location of the posted content.

C.2.6.2 The Contractor shall use Versatile Information Systems Integrated On-Line Nationwide (VISION), VISION Digital Library System (VDLS) to access data from Government testing. Details on specific tools, requirements for access, and approach for use will be discussed at the Start of Work Meeting (SOWM). (reference C.16.6.1

VISION).

C.2.6.3 The Government will sponsor Contractor personnel access to Army Knowledge Online (AKO), Product Manager (PdM) Applique and Large Unmanned Ground Systems (ALUGS) Portal, Defense Collaboration Services (DCS), and VDLS. The Government can only sponsor accounts for U.S. Citizens. The Contractor shall provide all names, contact information, and level of access (upload or download) to the COR. The list of Contractor personnel requiring VDLS access shall be provided to the Government no later than 50 calendar days prior to the Test Readiness Review (TRR).

C.2.6.4 To access the Government information systems cited in this contract, the Contractor shall have or obtain a DoD approved Public Key Infrastructure credential for all personnel who require access. Credentials include External Certification Authority (ECA) Certificates and Department of Defense (DoD) Common Access Cards (CAC).

The Contractor shall designate an Information Assurance (IA) Officer to work with PdM ALUGS and the Government Information Systems Security Manager (ISSM) to implement usage of the ECA and CAC program in compliance with DoD Directive

8190.3 Smart Card Technology, and DoD Instruction 8520.2, Public Key Infrastructure (PKI) and Public Key (PK) Enabling. Details on the ECA program and authorized ECA vendors can be found at: http://iase.disa.mil/pki/eca/.

http://iase.disa.mil/pki/eca/

C.3 MEETINGS/AUDITS/ASSESSMENTS/REVIEWS

C.3.1 Participation/Administration The Contractor shall host, unless otherwise specified in the paragraphs below, all meetings, audits, assessments, and reviews. When agreed upon by the Government, the Contractor shall schedule face-to-face meetings for multiple topics to minimize personnel resources and travel expenses. The Contractor's hosting duties and responsibilities shall include sending invitations and providing the necessary facilities, media resources, security, minutes, and hard copy materials related to the preparation and execution of the meetings, audits, assessments, and reviews. The Contractor shall provide teleconference and Defense Collaboration Services (DCS) access to the Government for all meetings, audits, assessments, and reviews.

C.3.1.1 Agenda and Read-Ahead Packages The Contractor shall submit an agenda and read-ahead package, IAW CDRL A071 Conference Agenda, prior to all meetings, audits, assessments, and reviews in Section C.3.

C.3.1.2 Minutes The Contractor shall record and submit minutes IAW Meeting Minutes, CDRL A070 for all meetings, audits, assessments, and reviews in Section C.3 and as otherwise called out in this contract. The Contractor shall identify its recorder at the beginning of each event.

C.3.1.3 Program Information Information developed on this contract shall be made available by the Contractor to the Government for discussion during all meetings including program reviews and meetings, technical reviews and audits, and IPT meetings IAW C.3.

C.3.2 Start of Work Meeting (SOWM) The Contractor shall conduct a SOWM at the Contractor’s facility 20 business days after contract award. This meeting will introduce and align the Government and Contractor teams. The SOWM will consist of a Contractual Obligations review, a System Requirements Review (SRR), an IMS Review, and a Logistics Guidance Review. For planning purposes, the participants should anticipate this SOWM to be a consecutive two-day event.

C.3.3 Program Management Reviews (PMR) The Contractor shall conduct quarterly PMRs, beginning with the first quarter after contract award. The PMRs shall include Contractor senior-level program management personnel. The Contractor shall present cost, schedule, performance, and risk status at each PMR and be prepared for detailed discussion with the Government. The Contractor shall present issues in terms of performance goals, exit criteria, schedule progress, risks and mitigation, and cost impact. For planning purposes, the participants should anticipate these meetings to be a one-day event.

C.3.4 Technical Reviews and Audits

C.3.4.1 The Contractor shall conduct program technical reviews and audits in accordance with the IMS, CDRL A001. The Technical Review Criteria (Attachment 0009) provides high-level entrance and exit criteria for each technical review and audits.

For the System Requirements Review (SRR) detailed in C.3.4.4, the Contractor shall finalize entrance and exit criteria jointly with the COR at least 10 business days prior to the SOWM. For all other technical reviews and audits, the Contractor shall finalize entrance and exit criteria jointly with the Government at least 20 business days prior to the associated technical review or audit. The Contractor shall remedy all unsatisfactory entrance criteria prior to entry into each technical review and audit.

C.3.4.2 The Contractor shall describe in its System Engineering Management Plan (SEMP) (C.4.1 SEMP) the internal processes that it will use to prepare for and conduct the technical reviews and audits. The Contractor shall document the proceedings of all technical reviews and audits in Meeting Minutes IAW CDRL A070. The Contractor shall document all action items that result from the technical reviews and audits in the Meeting Minutes.

C.3.4.3 The Procurement Contracting Officer (PCO) has the sole authority to certify the successful completion of the technical reviews and audits and provide written authorization to the Contractor to proceed based on successful completion of the entrance and exit criteria and closure of action items.

C.3.4.4 System Requirements Review (SRR) The Contractor shall conduct the SRR in conjunction with the SOWM (Section C.3.2).

The SRR shall be conducted IAW the Defense Acquisition Guidebook (DAG) dated 15 May 2013, Section 4.2.10 System Requirements Review. The SRR shall be a line-by-line review of the RCIS P-Spec (Attachment 0001).

C.3.4.5 Preliminary Design Review (PDR) The Contractor shall conduct a PDR at the Contractor’s site no later than 3 months after contract award. The PDR shall be conducted IAW the DAG dated 15 May 2013, Section

4.2.12 Preliminary Design Review. The Contractor shall establish the SAC system allocated baseline as defined in DAG Section 4.2.12. The Contractor shall demonstrate that the SAC system satisfies the requirements of the RCIS P-Spec within the currently allocated budget and schedule. For planning purposes, participants should anticipate this meeting to be a consecutive two-day event.

C.3.4.6 Critical Design Review (CDR) The Contractor shall conduct a CDR at the Contractor’s site no later than 9 months after contract award. The CDR shall be conducted IAW the DAG dated 15 May 2013, Section

4.2.13 Critical Design Review. The Contractor shall establish the initial product baseline and demonstrate that the SAC system satisfies the requirements of the RCIS P-Spec within the currently allocated budget and schedule. For planning purposes, participants should anticipate this meeting to be a consecutive two-day event.

C.3.4.7 Test Readiness Reviews (TRR)

C.3.4.7.1 Contractor Conducted Pre-Test Readiness Review (pre-TRR) The Contractor shall conduct a Pre-TRR to present to the Government the readiness of the RCIS Type Is to enter into Government system level testing. The Pre-TRR shall be held at the Contractor integration site, at least five business days prior to the Government TRR (C.3.4.7.2). The Pre-TRR shall address the content detailed in the Technical Review Criteria (Attachment 0009) and the RCIS Pre-TRR Checklist

(Attachment 0010). For planning purposes, participants should anticipate this meeting to be a consecutive two-day event.

C.3.4.7.2 Government Conducted Test Readiness Reviews (TRR) The Contractor shall attend the Government TRR to be conducted at Aberdeen Proving Ground (APG). The Government TRR is anticipated to be held no more than five business days prior to system delivery at Government test sites IAW Attachment 0018 RCIS Type I Test Summary. The Government TRR will assess both the Contractor's and the Government's test readiness. The Contractor shall provide all of the information prepared for the Pre-TRR. For planning purposes, participants should anticipate this meeting to be a one-day event.

C.3.4.7.3 Operational Test Readiness Review The Contractor shall attend the Government Operational Test Readiness Review (OTRR), conducted at or in the vicinity of Operational Test and Evaluation site and be prepared to brief and display all of the information the Contractor prepared for the Pre- TRR and TRR. The Government OTRR is anticipated to be a one day event and held no less than seven days prior to entering Limited User Test (LUT) and will assess readiness to enter LUT.

C.3.4.8 System Verification Review (SVR) and Functional Configuration Audit (FCA) The Contractor shall conduct a SVR/FCA at the Contractor site after completion of all EMD testing. The SVR/FCA shall be conducted IAW the DAG dated 15 May 2013, Section 4.2.14 System Verification Review/ Functional Configuration Audit. For planning purposes, participants should anticipate this meeting to be a consecutive two-day event.

C.3.4.9 Production Readiness Review (PRR) The Contractor shall conduct a PRR at the Contractor site after completion of SVR/FCA IAW the Contractor’s IMS (CDRL A001 Integrated Master Schedule). The PRR shall be conducted IAW the DAG dated 15 May 2013, Section 4.2.15 Production Readiness Review. For planning purposes, participants should anticipate this meeting to be a one-day event.

C.3.5 Integrated Product Team (IPT)/Meetings

C.3.5.1 Program Management Integrated Product Team (PM IPT) Meetings The Contractor shall conduct monthly PM IPT meetings at the Program Officer level and below. If mutually agreed to by the parties, the Contractor may conduct additional PM IPT meetings. The PM IPT meetings shall commence the month following the SOWM.

PM IPT meetings shall include Contractor program management and working level IPT personnel. The Contractor shall be prepared for detailed discussion on cost, schedule, performance, and risk status. The Contractor shall present technical issues in terms of performance goals, exit criteria, schedule progress, risks and mitigation, and cost impact.

C.3.5.2 Systems Engineering IPT Meetings The Contractor shall conduct weekly System Engineering (SE) IPT meetings to discuss the technical planning and execution of SAC system analysis, design, development, and integration activities.

C.3.5.3 Logistics Guidance Conference

The Contractor shall conduct a Logistics Guidance Conference to address Logistics Management data and products. The conference shall be in conjunction with the SOWM.

C.3.5.4 Software IPT Meetings The Contractor shall conduct weekly Software IPT meetings to discuss the design and development of the SAC system software.

C.3.5.5 Human Systems Integration (HSI) IPT Meetings The Contractor shall conduct monthly HSI IPT meetings (IAW C.12). IPT meetings will be held jointly with the System Safety and Environmental Working Group (IAW C.11.6) with Government participation and oversight, providing HSI integration system status, HSI event findings, issues database updates, recommendations and design data. The Contractor shall be prepared for detailed discussion of these topics. The meetings shall include Contractor HSI personnel and working level IPT personnel. The Contractor shall address HSI domains of safety, health hazards, human factors engineering, soldier survivability, manpower, personnel and training. The Contractor shall address HSI database issues in terms of risk assessment, mitigation, cost, and identification of organization and personnel responsible for a resource schedule to resolve issues (Ref Section C.12.3 HSI Issue Database).

C.3.5.6 Corrosion Prevention Advisory Team (CPAT) Meetings The Contractor shall conduct CPAT meetings, complete assigned action items, and inform the CPAT of corrosion issues and their impact on the corrosion prevention and control of the SAC system. CPAT meetings will be held as part of System Engineering IPT meetings.

C.3.5.7 Test and Evaluation Working-level Integrated Product Team (T&E WIPT) The Contractor shall provide an engineering representative to the Government-led T&E WIPT to plan and support Government and Contractor test activities. The primary purpose of the RCIS Type I T&E WIPT is to optimize the use of T&E expertise, instrumentation, facilities, Modeling and Simulation (M&S), and the collected resources of the represented agencies and organizations to integrate the collective T&E efforts.

The T&E WIPT will collectively plan, budget, resource, execute, and continuously evaluate the RCIS Type I T&E program as a principal risk management agent for the Product Manager. The primary product of the T&E WIPT is the program test strategy, which is captured in the RCIS Type I Test and Evaluation Master Plan (TEMP), Attachment 0017. The T&E WIPT shall meet every two weeks after contract award and be the instrument that will tailor the T&E tools and strategy to maximize effectiveness and efficiency of the test procedures, while determining which specific tests are required to support the RCIS Type I assessment for approval and systems safety certification.

C.3.5.8 Program Protection Meetings The Contractor shall conduct Program Protection meetings, complete assigned action items as assigned in the Program Protection Meetings, and inform the Government of issues and their impact on the SAC system. The Contractor shall ensure any updated assumptions, rationale, and results related to criticality analysis, vulnerability assessments and risk evaluations, as well as supply chain risk information and mitigation are made available for Government review at the program protection meetings. The meetings will be held as part of System Engineering IPT meetings.

C.4 SYSTEMS ENGINEERING

C.4.1 Systems Engineering Management Plan (SEMP) The Contractor shall prepare and execute a SEMP detailing the systems engineering process for developing the SAC system. The SEMP shall also include the approach for Open Systems Architecture (C.4.6), and plans for Configuration Management (C.7.2) and Risk Management (C.9.1). The Contractor shall prepare and deliver the SEMP in accordance with CDRL A004 Systems Engineering Management Plan (SEMP).

C.4.2 System/Subsystem/Component Specification (SSS) The Contractor shall develop and deliver system, subsystem, and component specifications (IAW CDRL A005 System/Subsystem/Component Specification) for the SAC system. The System, Subsystem and Component Specifications shall be derived from and trace to the RCIS P-Spec (Attachment 0001). The System, Subsystem and Component Specifications shall represent performance requirements of the RCIS Type I at the end of the EMD phase.

C.4.3 Requirements Compliance Matrix (RCM) The Contractor shall develop, deliver and update a Requirements Compliance Matrix (RCM) (IAW CDRL A006 Requirements Compliance Matrix (RCM)) that assesses compliance towards achieving all RCIS Performance Specification (Attachment 0001) requirements. The RCM shall trace to the RCIS Performance Specification (Attachment 0001) and include information supporting each requirement’s assessment. The RCM shall include P-Spec ID, P-Spec Requirement, Compliance Assessment (Meets Requirement, Partially Meets Requirement, Does Not Meet Requirement), and Compliance Rationale to include supporting data that describes the analysis that has been done to support the assessment. The RCM shall include all related data including analysis, simulation, drawings, schematics, functional diagrams, and test results and describe how the data supports the assessed compliance.

C.4.4 System/Subsystem Design Description (SSDD) The Contractor shall develop and deliver a System/Subsystem Design Description (SSDD) (IAW CDRL A007 System/Subsystem Design Description (SSDD)) for the SAC system. The SSDD shall break down the system into Hardware/Software Configuration Items and how those components interface with each other to meet the system level requirements as defined in the SSS IAW C.4.2.

C.4.5 Interface Control Documents (ICDs) The Contractor shall prepare, deliver and update Interface Control Documents (ICDs) (IAW CDRL A008 Interface Control Documents (ICDs)) that identify the interface requirements between: Hardware Configuration Items (HWCI) (HWCI to HWCI);

Computer Software Configuration Items (CSCI) and hardware configuration items (CSCI to HWCI); and HWCI and CSCI to systems external to the SAC system.

C.4.6 Open Systems Architecture The Contractor shall define and follow an open systems architecture for using modular designs with open standards and published interfaces while limiting the use of proprietary solutions. The Contractor shall document its open systems approach in its SEMP (C.4.1). The Contractor shall demonstrate compliance with its open systems architecture during formal technical reviews and audits per Section C.3.4.

C.4.7 Unmanned Ground Vehicle (UGV) Interoperability Profile (IOP) The Contractor shall utilize the Unmanned Ground Vehicle (UGV) Interoperability Profile (IOP) (Attachment 0014) in the design and build of the SAC system for RCIS Type I. If the use of the UGV IOP, in whole or in part, does not support the Contractor's implementation, the Contractor shall provide a non-proprietary interface description with electrical, signal, mechanical, connector, and digital message protocol information in Contractor format (IAW CDRL A009 IOP Contractor Standards) to describe the implementation for Government approval prior to adopting the solution in the SAC system. CDRL A009 shall also identify the associated requirements in the RCIS P-Spec and how these requirements are impacted. The Contractor shall present its IOP approach and supporting information at formal technical reviews and audits per Section C.3.4.

C.4.8 Application for Equipment Frequency Allocation (DD 1494) The Contractor shall deliver a completed Department of Defense (DD) Form 1494, Application for Equipment Frequency Allocation (IAW CDRL A011 Frequency Allocation Data). The Contractor shall also provide technical information including drawings that identifies antenna placement on the R-HMEE and control vehicle (Ref Section C.4.9) in CDRL A011. The Contractor shall conduct the necessary coordination with the Government to complete the DD 1494 data entries prior to submittal.

C.4.9 Co-site Mitigation and Antenna Optimization The Contractor shall determine the placement of all antennas on the R-HMEE vehicle and control vehicle to ensure optimal performance and to avoid interference with the operation of all other R-HMEE and control vehicle systems. The Contractor shall provide technical information including drawings that identify antenna placement (IAW CDRL A011 Frequency Allocation Data) to support Government co-site analysis. Final antenna placement is subject to Government approval.

C.4.10 Proposed Vehicle Modifications The Contractor shall minimize vehicle modifications necessary to integrate the SAC system and its components onto the six D-HMEE vehicles and six MPCVs. For vehicle modifications the Contractor considers necessary, the Contractor shall submit proposed vehicle modifications IAW CDRL A012 Proposed Vehicle Modifications that includes mechanical drawings, electrical schematics, and any other information. Proposed vehicle modifications will be dispositioned (approved or rejected) by the PCO in writing.

The Contractor shall not implement any vehicle modifications without prior PCO written approval.

C.4.11 Reserved

C.4.12 Military (MIL) Grade Connector Waivers In the design and fabrication of the SAC system and its components, the Contractor shall use all MIL Grade connectors that meet the appropriate military specification. For connectors that do not meet military specifications, the Contractor shall submit a waiver request IAW Military (MIL) Grade Connector Waiver Request, CDRL A013 and MIL Grade Connector Waiver Form (Attachment 0012). Waivers will be dispositioned (approved or rejected) by the PCO in writing.

C.4.13 Corrosion Prevention and Control

In the design and fabrication of the SAC system and its components as well as the proposed vehicle modifications IAW C.4.10, the Contractor shall use compatible materials, inherently corrosion resistant, or treated to provide protection against the various forms of corrosion and deterioration to which they are susceptible.

C.5 SOFTWARE ENGINEERING

C.5.1 Software Development Plan (SDP) The Contractor shall provide a Software Development Plan IAW CDRL A014 Software Development Plan (SDP). The SDP shall remain consistent with the SEMP (C.21.4.1) and shall describe the Contractor’s software lifecycle process, including software measurement, information assurance/security, software safety, Intellectual Property Rights (IPR), and reliability and maintainability attributes throughout the entire lifecycle.

The Contractor shall establish style guides and practices as part of its development process documented in its SDP that address aspects of code quality and secure coding practices. These practices shall ensure that common software errors that can cause vulnerabilities or instabilities are avoided and more secure alternatives and design patterns are employed. Utilization of industry best practices and material such as those found at http://cwe.mitre.org/top25/index.html are encouraged but not required. The Contractor shall include the Software Quality Assurance Plan (C.5.13) and approach for Software Configuration Management (C.5.14) in their SDP. The Contractor may use Institute of Electrical and Electronics Engineers (IEEE)/Electronic Industries Association (EIA) 12207.0, IEEE/EIA 12207.1, and IEEE/EIA 12207.2 as guidance.

C.5.2 Software Requirements Specification (SRS) The Contractor shall provide Software Requirements Specifications for SAC system developed software IAW CDRL A015 Software Requirements Specification (SRS). The Contractor shall deliver a separate SRS for each CSCI identified in the SSDD (C.4.4).

Each SRS shall specify all software requirements for that CSCI and the methods to verify compliance for each requirement. Each SRS shall include a matrix that shows requirements traceability between the SRS and the System Specification (C.4.2). All software requirements in each SRS shall include a matrix that shows traceability between the SRS and the Software Test Descriptions (STD) (C.5.8). Each SRS shall specify all interface requirements, both internal and external, for the CSCI.

C.5.3 Interface Design Description (IDD) The Contractor shall provide Interface Design Descriptions for SAC system developed software IAW Interface Design Description (IDD), CDRL A017. The Contractor shall deliver a separate IDD for each CSCI identified in the SSDD (C.4.4). Each IDD shall describe the interface characteristics selected to meet the requirements of a specific CSCI in accordance with its SRS (C.5.2).

C.5.4 Software Design Description (SDD) The Contractor shall provide Software Design Descriptions for SAC system developed software IAW Software Design Description (SDD), CDRL A108. The Contractor shall deliver a separate SDD for each CSCI identified in the SSDD (C.4.4). Each SDD shall describe the software implementation of a specific CSCI in accordance with its SRS (C.5.2). Each SDD shall describe design decisions, architectural design, and the detailed design needed to implement the CSCI.

C.5.5 Contractor Support for Government Stress Testing http://cwe.mitre.org/top25/index.html

Prior to TRR, the Contractor shall provide online software engineering technical support (in the form of telephone and email communication) during Government Software Stress Testing of the SAC system software source code and executables. The Contractor shall review the results of the Software Stress Testing and corrective actions during the Software IPT meeting(s) (Section C.3.5.4). The Contractor shall implement corrective actions and resolve to closure all software defects identified and report the implementation and closure status during Software IPT meetings.

C.5.6 Contractor Support for Government IOP Conformance Testing Prior to TRR, the Contractor shall provide onsite software engineering technical support for final IOP conformance testing. The COR will provide the results from the Conformance Validation Tool and the Contractor after reviewing the results, shall provide corrective action to resolve all conformance issues. The conformance test will be repeated until all conformance issues have been resolved.

C.5.7 Software Test Plan (STP) The Contractor shall provide a Software Test Plan for SAC system developed software IAW CDRL A019 Software Test Plan (STP). The STP shall describe the plans for qualification testing of the CSCIs and SAC system software. The STP shall describe the software test environment to be used for testing, identify the tests to be performed, and provide schedules for test activities. The Contractor shall notify the COR via email 10 business days prior to the start of each test and the Government reserves the right to witness each test.

C.5.8 Software Test Description (STD) The Contractor shall provide Software Test Descriptions for SAC system developed software IAW Software Test Description (STD), CDRL A020. The Contractor shall deliver a separate STD for each CSCI identified in the SSDD (C.4.4) and for the SAC system. Each STD shall describe the test preparations, test cases, and test procedures to perform qualification testing of the CSCI and the SAC system.

C.5.9 Software Test Report (STR) The Contractor shall provide Software Test Reports for SAC system developed software IAW CDRL A021 Software Test Report (STR). The Contractor shall deliver a separate STR for each CSCI identified in the SSDD (C.4.4) and for the SAC system. Each STR shall document the test objectives, methods, types, criteria, environment, dates, data, results, conclusions, description and analysis of failures. The Contractor shall notify the COR NLT five business days via email prior to testing, specifying test activities and locations. The Government reserves the right to witness each test.

C.5.10 Software Version Description (SVD) The Contractor shall provide a Software Version Description for RCIS Type I SAC system developed software IAW CDRL A022 Software Version Description (SVD). The SVD shall be used to release, track, and control software versions.

C.5.11 Source Code and Executables The Contractor shall deliver a copy of all software images, parameter files, configuration files, source code, and other documentation required for creating, modifying, compiling, building, running, installing and maintaining all software and firmware utilized on the SAC system and developed or modified by the Contractor or any subcontractors under this contract. The Contractor shall deliver a copy of all software executables, hardware, tools, documentation, and items required to reimage SAC system computers to a fully operational state. The Contractor shall deliver a copy of all software executables, hardware, tools, documentation, and items applicable to any patches to SAC system computers that may be required including any Cybersecurity required updates (C.6).

When software or patches are updated by the Contractor, the Contractor shall deliver a new copy to the Government. (IAW Source Code and Executables, CDRL A023)

C.5.12 Software Licenses The Contractor shall deliver and maintain the applicable software licenses for ongoing Government use of the SAC system IAW CDRL A024, Software Licenses. The Contractor shall provide status of acquiring and delivering software licenses at IPTs and major reviews.

C.5.13 Software Quality Assurance Plan (SQAP) The Contractor shall develop, deliver and maintain a SQAP in accordance with IEEE STD 730-2014. The SQAP shall describe procedures, techniques and control methods to ensure that a product meets all RCIS Program requirements in addition to those specified in the SRS deliverables (C.5.2). The Contractor shall include its SQAP as part of the SDP, CDRL A014(C.5.1).

C.5.14 Software Configuration Management (CM) The Contractor shall establish and maintain a software CM system in accordance with its SDP to establish and maintain a software baseline. The Contractor shall implement a change control process for the approval or rejection by the COR of all change requests that are sent against any baseline. The Contractor shall maintain a software identification table for each piece of software and its corresponding hardware component. This list shall consist of the hardware serial number and its correlating software version number to ensure that correct software versions reside on the production hardware. The Contractor shall include its Software CM approach as part of the SDP, CDRL A014 (C.5.1).

C.6 CYBERSECURITY

C.6.1 Cybersecurity Strategy The Contractor shall develop and implement a Cybersecurity Strategy that addresses the Contractors Software Development, Software Assurance, Hardware Validation, Supply Chain Risk Management, Testing (Architecture and Configuration), Vulnerability Management, Patch Management, Release Management and Configuration Management efforts for the SAC system. This strategy will be used to validate the systems cybersecurity posture throughout contract period of performance.

C.6.1.2 Data Protection The Contractor shall establish administrative, technical, and physical safeguards to protect all Government data, to ensure the confidentiality, integrity, and availability of Government data in accordance with Department of Defense Instruction (DoDI) 8582.01 Security of Unclassified DoD Information on Non-DoD Information Systems. The Contractor shall encrypt all unclassified RCIS data (including Controlled Unclassified Information (CUI) and For Official Use Only (FOUO)) stored electronically using Federal Information Processing Standard (FIPS) 140-2 validated encryption, IAW DoDI 8582.01 and the PEO CSCSS Armoring Systems Security Classification Guide (Attachments 0041).

C.6.2 Policies

C.6.2.1 Cybersecurity Policies The Contractor shall comply with Cybersecurity requirements in accordance with DoDI

8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT), DoD

8500.01 Cybersecurity, NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Lifecycle Approach, NIST SP 800-53 Recommended Security Controls for Federal Information Systems and Organizations, Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01IA, Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6212.01E Interoperability and Supportability of Information Technology and National Security Systems, DoD 5220.22- M National Industrial Security Program Operating Manual (NISPOM), DoDI 8551.1 Ports, Protocols and Services Management (PPSM), Federal Information Security Management Act (FISMA), AR 380-5 Department of The Army Information Security Program, and AR 25-2, Information Assurance.

C.6.2.2 Reserved

C.6.3 Training In accordance with cybersecurity directives, the PM requires cybersecurity support for all tasks identified in section C.6 of the PWS. To achieve Cybersecurity accreditation, the Contractor cybersecurity support must comply with training requirements and certifications mandated by Department of Defense Directive (DoDD) 8570.01-M Information Assurance Workforce Improvement Program for Information Assurance Technical (IAT) Level III, identifying all personnel assigned with cybersecurity roles and functions and ensuring certification and background checks are completed. This information shall be made available to the Government upon request. Current DoD Approved 8570 Baseline Certifications can be found at http://iase.disa.mil/iawip/Pages/iabaseline.aspx.

C.6.3.1 Cybersecurity Annual Training Contractor personnel with access to Government Information Systems are required to have annual DoD Cyber Awareness Training (https://ia.signal.army.mil/DoDiaa/) and a favorable National Agency Check with Inquiries (NACI) per AR 25-2 to access the RCIS

IDE.

C.6.4 Use of Army Best Business Practices (BBPs), Defense Information Systems Agency (DISA) Security Readiness Guides (SRGs), and Security Technical Implementation Guides (STIGs) The Contractor shall use the Army BBPs (https://login.milsuite.mil/?goto=https%3A%2F%2Fwww.milsuite.mil%3A443%2Fwiki%2 FPortal%3AArmy_Information_Assurance) , DISA SRGs, and STIGs to define specific standards, measures, practices, or procedures necessary to meet Cybersecurity requirements in support of AR 25-2 Information Assurance. DISA STIGs are located at http://iase.disa.mil/stigs/Pages/index.aspx.

C.6.5. Cybersecurity Authorization Artifact Package

The Contractor shall provide a Cybersecurity Authorization Artifact Package as part of https://login.milsuite.mil/?goto=https%3A%2F%2Fwww.milsuite.mil%3A443%2Fwiki%2FPortal%3AArmy_Information_Assurance https://login.milsuite.mil/?goto=https%3A%2F%2Fwww.milsuite.mil%3A443%2Fwiki%2FPortal%3AArmy_Information_Assurance the Cybersecurity Authorization Package (CDRL A025). The Contractor shall provide the following security related documents as part of the Artifact Package:

a) Security Plan (SP): The Contractor shall develop a security plan in accordance with DoDI 8510.01 using the template from the Risk Management Framework (RMF) Knowledge service (https://rmfks.osd.mil/login.htm) and include any external documentation required to document compliance with security controls.

Name of document and section of document that demonstrated compliance with security controls shall be listed in the comments column.

b) Evidence of applied Army BBPs, SRGs, and STIGs as applicable based on architecture and software

c) Data Flow Diagram

d) Architecture (topology) Diagram

e) Hardware and Software List (included vendors and versions) (Attachment 0020)

f) Ports Protocols and Services (PPS) List and how each PPS impacts the function of the system

g) System backup and restoration procedures

h) Account management procedures

i) Roles based access permission description

j) Products undergoing cryptographic certification, status and evaluating organization

k) Products undergoing IA and IA enabled product certification, status and evaluating organization

l) Other artifacts as needed to meet risk management framework documentation requirements

C.6.6 Cybersecurity Updates The Contractor shall ensure that all Cybersecurity mitigation strategies have been applied to the SAC system prior to any Government data being loaded onto any assets or software for testing or delivery. Cybersecurity mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating systems, hardware and software delivered to the Government shall comply with all applicable Department of Defense Computer Emergency Response Team (DoD-CERT) Alerts, Bulletins, and Technical Advisory Notices (https://www.jtfgno.mil/default.aspx).

C.6.7 Information Assurance Vulnerability Management (IAVM) Program The Contractor shall establish an Information Assurance Vulnerability Management (IAVM) Program. The Contractor shall monitor Government, vendor, and industry releases by subscribing to vulnerability notification services and reviewing product specific data available to identify vulnerabilities in software and hardware used in the SAC systems. The Contractor shall subscribe to the Government email notifications from the IAVM notification system, currently hosted at https://iavm.csd.disa.mil/. The Contractor shall evaluate all IAVMs to determine whether they apply to the SAC system and test the applicable IAVMs on the SAC system prior to release to the Government.

The Contractor shall release the updated Software Executables (C.5.11) and the Engineering Change Proposals (C.7.4.2) to the Government by the end of the time frame posted on the notification system. If a patch to an applicable IAVA cannot be applied, the Contractor shall notify the COR.

C.6.8 Product National Institute of Standards and Technology (NIST), National Information Assurance Partnership (NIAP), and Federal Information Processing Standards (FIPS) Usage The Contractor shall ensure that all IA and IA enabled products are National Security Telecommunications and Information Systems Security Policy Number 11 (NSTISSP-11) compliant and are validated by accredited labs under National Security Agency (NSA), the National Information Assurance Partnership (NIAP) Common Criteria Evaluation and Validation Scheme or National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) Cryptographic Module Validation Program (CMVP) to include; FIPS Pub 197 Advanced Encryption Standard, FIPS Pub 140-2 Security Requirements for Cryptographic Modules, FIPS Pub 198-1 The Keyed-Hash Message Authentication Code (HMAC), and Internet Engineering Task Force (IETF) Request for Comments (RFC) 2560 X.509 Internet Public Key Infrastructure.

C.6.9 Cybersecurity and Software Scans

C.6.9.1 Software Assurance Scans The Contractor shall provide the Government access to the software source code repositories for all SAC system software (excluding closed source Commercial Off the Shelf (COTS)) for Software Code Scans. The Contractor shall allow the Government to conduct software assurance scans on the Contractor's software to determine if there are any vulnerabilities in the system software code. The Contractor shall resolve any vulnerabilities discovered in Category (CAT) I or CAT II critical functions as defined in the DISA Application Security and Development STIG as a result of the baseline software analysis and Government scans. Mitigation information, as delivered in accordance with CDRL A025 Cybersecurity Authorization Package, shall be discussed at IPT meetings. The Contractor shall ensure each source code repository can accept the Government's Hewlett Packard (HP) Fortify 360 Suite Static Code Analyzer scanning software tool.

C.6.9.2 Cybersecurity Testing Contractor Cybersecurity personnel shall attend Government Cybersecurity Cooperative Vulnerability and Penetration Assessment (CVPA) and Adversarial Assessment (AA) testing execution. The Contractor shall provide system security implementation information and answer any questions prior to and during assessments. CVPA and AA testing will be conducted during Developmental and Operational Test events. The Contractor shall provide 40 hours of onsite technical support for security control validation scans at Contractor and Government facilities.

C.7 CONFIGURATION MANAGEMENT (CM)

C.7.1 The Contractor shall plan and execute a CM program for all products including hardware, and software configurations comprising the SAC system in accordance with the requirements in Section C.7 and Society of Automotive Engineering (SAE) - Electronics Industries Association (EIA) SAE-EIA-649-1 dated November 2014 or most current version. The Contractor shall maintain this configuration management program throughout the period of performance of this contract.

C.7.2 Configuration Management and Planning The Contractor shall comply with Configuration Management Planning and Management (CMP) requirements in accordance with Principles CMP-1 through CMP-8 of SAE-EIA-

649-1. The Contractor shall develop a life cycle CM plan for all hardware and software items and manage the implementation of that plan. The Contractor shall provide the life cycle CM plan in the SEMP (C.4.1). (IAW CDRL A004 SEMP)

C.7.3 Configuration Identification The Contractor shall comply with configuration identification and interface requirements in accordance with Configuration Identification (CI) Principles CI-1 through CI-13 of SAE- EIA-649-1 and the following:

C.7.3.1 Baselines The Contractor shall develop the Allocated and Initial Product Baselines IAW 3.2, 3.2.2 through 3.2.2.3 of SAE-EIA 649-1 and shall follow the PDR, CDR, and CM guidance in Systems Engineering section of the DAG dated 15 May 2013. The Contractor shall deliver the Allocated and Initial Product Baselines in separate Baseline Description Documents. Configuration baselines status shall be discussed at IPT meetings as well as the technical reviews and audits defined in C.3.4 and C.3.5. (IAW CDRL A026 Baseline Description Document).

C.7.3.2 Product and Enterprise Identifiers The Contractor shall select Configuration Items (CIs) and product and enterprise identifiers for all SAC system products and Product Configuration Documentation (PCD) IAW 3.2 through 3.2.1.(2)g.8, and 3.2.4 through 3.2.4.2.(1)e.4 of SAE-EIA 649-1. The product identifier is the Part or Identifying Number (PIN) and is synonymous with part number. The enterprise identifier is the Commercial and Government Entity (CAGE) code. The Contractor shall insure unique item identification by utilizing a PIN with CAGE for all products. The Contractor shall convert all non-conforming product and enterprise identifiers to conforming product and enterprise identifiers in accordance with these requirements.

C.7.3.2.1 Modified Products The Contractor shall adhere to the product and enterprise identifier requirements in Sections C.7.3.2 through C.7.3.2.7.1 to identify new and modified products. When products are modified to the point they are no longer interchangeable with the existing product, the Contractor shall create new models and drawings or altered item models and drawings and assign a new PIN in accordance with these requirements (reference American Society of Mechanical Engineers (ASME) Y14.24). The Contractor shall also create new next higher assemblies and subsequent higher assemblies, and apply the appropriate identifiers, until interchangeability is re-established. Actual ‘modification’ type drawings and models (as defined by ASME Y14.24), shall be prepared only for changes in delivered equipment and shall not be used for production modifications. The Contractor shall maintain internal configuration records to crosswalk, link or otherwise retain history of the original PIN and CAGE code to the new PIN and CAGE code.

C.7.3.2.2 Government Developed SAC System Noncommercial Products The Contractor shall assign a Government PIN and CAGE to all noncommercial SAC system products developed with Government funds, and there shall be no Contractor-imposed restrictive markings on the PCD for these products. The Contractor shall request additional Government-issued CAGE Codes and PINs by e-mail from the COR.

The Government is the Original Design Activity for all SAC system products developed under this contract or any previous Government contract. The Government will provide the Contractor with a range of Government issued PINs and applicable CAGE code(s)

C.7.3.2.2.1 Modified Government…