Attachment_0001-_Statement_of_Work_CD-1_16_Oct_17.pdf

UNCLASSIFIED//FOUO

STATEMENT OF WORK (SOW)

FOR

Program Executive Office - Intelligence Electronic Warfare & Sensors

Project Manager, Distributed Common Ground System - Army

DCGS-A Capability Drop 1 (CD-1) – Battalion Solution

DISCLAIMER: This is a draft and is provided for informational purposes only. This draft is not a request to submit proposals and is not an authorization to start work. The Government will not reimburse or pay costs for preparation of proposals or for any work that is performed as a result of this draft. In addition, the Government may determine not to proceed with a solicitation, or may make changes to any and all content in this draft before issuing a solicitation. If in the future the Government issues a solicitation, then Offerors shall rely solely only upon the terms of the issued solicitation when submitting an offer.

Table of Contents

1.0 Scope

1.1 Background

2.0 Applicable Documents

3.0 Requirements

3.1 User Trial

3.1.1 User Trial Preparation-(CLIN 0001)

3.1.2 User Trial Test Readiness Review Support (CLIN 0001)

3.1.3 User Trial Tests (CLIN 0001)

3.1.4 User Trial Test Support (CLIN 0001)

3.1.5 Army Interoperability Certification (AIC) (CLIN 0003)

3.1.6 Functional Configuration Audit (CLIN 0010)

3.1.7 Information Assurance Support for User Trial (CLIN 0002)

3.1.8 Program Management and Meeting Support (CLIN 0001)

3.1.9 Software Version Description (SVD) (NSP)

3.1.10 Program Protection (CLIN 0001)

3.1.11 Logistic Support for User Trial (CLIN 0001)

3.2 Operational Assessment

3.2.1 Operational Test Readiness Review (CLIN 0004)

3.2.2 Operational Assessment (CLIN 0004)

3.2.3 Operational Assessment Support (CLIN 0004)

3.2.4 IA Support for Operational Assessment (CLIN 0005)

3.2.5 Operational Assessment Meetings (CLIN 0004)

3.2.6 Logistic Support for Operational Assessment (CLIN 0004)

3.3 CD-1 Solution Procurement

3.3.1 CD-1 Solution Delivery (CLIN 0006)

3.3.2 CD-1 Solution Delivery (CLIN 0007)

3.3.3 Training Support for CD-1 Solution Delivery (CLIN 0009)

3.3.4 IA Support for CD-1 Solution Delivery (CLIN 0008)

3.3.5 Reach back Support for CD-1 Solution Delivery (CLIN 0008)

3.4 Annual Sustainment

3.4.1 IA Support for Annual Sustainment (CLIN 0008)

3.4.2 Reach back Support for Annual Sustainment (CLIN 0008)

3.5 Information Assurance (NSP applicable CLIN 0006, 0007, & 0008)

3.5.1 Risk Management Framework Compliance

3.5.2 Information Assurance Compliance

3.6 Licensing

3.6.1 Warranties

3.7 Configuration Management

3.7.1 Software Problem Report (SPR) (NSP)

3.7.2 Monthly Security Patch/Release Delivery CLIN 8

3.7.3 Field-discovered SPRs (CLIN 0008)

3.7.4 Contractor-proposed CD-1 Modifications due to Enhancements, Obsolescence, and Major Software Releases (NSP)

3.7.5 Government-proposed Enhancements and Modifications (NSP)

3.8 Hardware (NSP)

4.0 Government Furnished Information

4.1 Computer Software and Interfaces (NSP)

4.2 Contractor Furnished Property

4.3 Government/Military Facilities

4.4 Additional GFI

5.0 Travel (NSP)

6.0 Security (NSP)

7.0 Delivery Address

8.0 CDRL

9.0 Acronym List

1.0 Scope

The contractor shall provide a commercial item that is a combined hardware and software solution to meet the interoperability, security, training, usability, and data management capabilities at the Product Manager (PM) Distributed Common Ground System – Army (DCGS-A) Battalion (BN) while reducing the hardware footprint (size, weight, and power). The Contractor shall provide support, incidental services, and deliverables for the procurement of a commercial item to satisfy DCGS-A capability requirements at the Battalion.

The scope of this SOW includes the requirements for the entire period of performance of the Multiple Award IDIQ Contract, which will be issued as Delivery Orders (DO).

After award of the MA IDIQ, the Army may, but is not required to, issue delivery orders.

The test strategy for DCGS-A CD-1 may be comprised of a User Trial (UT) and Operational Assessment (OA). The UT and OA will be conducted IAW the detailed test plans provided by the Government to the Contractor prior to the test events taking place. The detailed test plans will be developed within the general scope of testing the proposed DCGS-A BN System to requirements defined in the Performance Requirements Document (PRD) for DCGS-A Capability Drop 1, Section J Attachment 0003. The Contractor shall provide support for all test activities IAW this

SOW.

1.1 Background

DCGS-A is a Family of Systems that provides our Army with advanced analytics, support to targeting and Situation Understanding to commanders. It processes, exploits and disseminates information and intelligence about the threat, weather, and terrain and provides tactical and operational ground stations that downlink data from national, joint partners and Army sensors. As technology evolves and new warfighting requirements emerge, the DCGS-A capability set needs to be updated to meet the user needs.

The DCGS-A Capability Drop-1 requirements address the need to enhance capabilities of DCGS- A at the Battalion Echelon. Intelligence processing to include All Source, Imagery Analysis, Weather, and Geospatial Intelligence will provide soldiers the capabilities needed at the Battalion, aligning with multiple overarching directives, to include the Common Operating Environment (COE); Command Post Computing Environment (CPCE), the Intelligence Community Information Technology Enterprise (IC ITE); Joint Information Environment (JIE) and Defense Intelligence Information Enterprise (DI2E). The DCGS-A Capability Drop-1 shall support net-centric military operations by being interoperable with current Army, Unified Action Partners, Joint Service, Allied, Coalition, and Command and Control (C2) information and ISR systems (Mission Command, Global Command and Control System, Universal Ground Control Station, etc.). DCGS-A Capability Drop-1 shall operate across the SIPRNet, Secret Coalition, and NIPRNet security domains, and within and across all Common Operating Environment (COE) computing environments.

DCGS-A will continue to contribute to visualization and situational awareness (SA), thereby enhancing tactical maneuver, maximizing combat power and enhancing the ability to operate in an unpredictable and changing environment throughout the operational spectrum.

2.0 Applicable Documents

The following documents are applicable to this SOW.

Table 2-1: DCGS-A Program Documents

Number: Title: Date:

Performance Requirements Document (PRD) for DCGS-A Capability Drop 1

Table 2-2: Department of Defense Directives

DoD 5220.22-M National Industrial Security Program Operating Manual 28 February 2006

DoDD 8570.01 Information Assurance (IA) Training, Certification and Workforce Management

15 August 2004

DoD 8570.01-M Information Assurance Workforce Improvement Program, Change

19 December 2005 w/ change 10 November

DoDD 8140.01 Cyberspace Workforce Management 11 August 2015

Table 2-3 Department of Defense Instructions

DoDI 3020.41 Operational Contract Support 20 December 2011

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT)

12 March 2014

Table 2-4 Army Regulations (AR)

Number: Title: Date:

AR 25-1 Army Information Technology 25 June 2013

AR 25-2 Information Assurance 24 October 2007

AR 70-1 Army Acquisition Policy 16 June 2017

AR 73-1 Test and Evaluation Policy 16 November 2016

AR 530-1 Operations Security 26 September 2014

AR 380-67 Personnel Security Program 24 January 2014

AR 381-12 Threat Awareness and Reporting Program (TARP) 01 June 2016

Tables 2-5 Other Documents

NIST Special Publication 800- 53A Rev 4

Assessing Security and Privacy Controls in Federal Information Systems and Organizations

December 2014

Cybersecurity T&E Guidebook

Department of Defense Cybersecurity Test and Evaluation Guidebook

1 July 2015

DA Pam 73-1 Test and Evaluation in Support of Systems Acquisition 30 May 2003

DOT&E Memo Procedures for Operational Test and Evaluation of Cybersecurity in Acquisition

1 August 2014

DAG 2017 Defense Acquisition Guidebook 21 August 2017

MIL-STD-810 Department of Defense Test Method Standard, Environmental Engineering Considerations and Laboratory Tests

31 October 2008

3.0 Requirements

This SOW addresses all products, support, and activities that shall be required throughout the period of performance for the contract. The Contractor shall provide all the necessary resources and knowledge to support the listed products, support, and activities.

The goal of this SOW is to establish commercial item solutions that will satisfy the Government’s requirements, as set forth in the PRD, Section J Attachment 0003, and in the other documents referenced in this SOW. It is contemplated that after award of the base contract, the Government may issue a series of delivery orders for the purpose of establishing viable commercial item solutions that will meet the Government’s requirements. The Government may issue orders to all base contract holders, or may conduct fair opportunity competitions to select one contractor awardee for a delivery order.

The series of delivery orders that the Government may issue include:

(a) User Trial Delivery Order (SOW Par. 3.1) –The purpose is to provide contractor up to six (6) weeks to tailor their commercial solution to the Government’s requirements, culminating in a User Trial that may extend for four (4) to five (5) weeks. Concurrently to or after the User Trial, the contractor shall support Army Interoperability Certification, which may take up to twelve

(12) weeks.

(b) Operational Assessment Delivery Order (SOW Par. 3.2) – The purpose of the Operational Assessment is to test the contractor’s DCGS-A CD-1 systems against the Government’s PRD, Section J Attachment 0003, solicit Soldier feedback on system usability, and assess cybersecurity. The Operational Assessment may take up to six (6) weeks.

(c) CD-1 Solution Procurement (SOW Par. 3.3) – The purpose of this delivery order is to procure commercial item systems that meet the Government’s PRD, Section J Attachment 0003. The Government may procure as many systems as it needs, without limitation, to satisfy the needs of the Department of Defense (DOD), including the Army and all other DOD activities.

(d) Other Delivery Orders – The Government may issue additional delivery orders for any work that is within the scope of the contract and this SOW.

The Government reserves the right to issue delivery orders, without limit, during the ordering period of the contract.

3.1 User Trial

If the Government issues an order, the Contractor shall provide all necessary support required to execute a User Trial, as detailed in the below paragraphs. This section shall include all activities to include the actual User Trial (UT), the UT Test Readiness Reviews (TRR), the Functional Configuration Audit (FCA), and initial Information Assurance activities.

3.1.1 User Trial Preparation-(CLIN 0001)

If the Government issues an order, there will be a period of time of no longer than six (6) weeks before each User Trial, during which the Contractor shall modify and/or tailor its solution as necessary. The goal is for the Contractor to tailor its solution to meet all Government PRD requirements, Section J Attachment 0003, and to include but not limited to Army Interoperability Certification (AIC), Cybersecurity, and Risk Management Framework (RMF). The Government will make available to the Contractor an operationally representative environment at Aberdeen Proving Ground during that time. That environment will be made available to the Contractor for system setup and configuration, integration, test, and training.

3.1.2 User Trial Test Readiness Review Support (CLIN 0001)

If the Government issues an order, the Contractor shall provide no more than three (3) and no less than one (1) subject matter experts (SME) for one (1) day to support the Government during the TRR for each UT. The TRR may occur at Aberdeen Proving Ground, or remotely, about, ten

(10) business days prior to each UT.

3.1.3 User Trial Tests (CLIN 0001)

If the Government issues an order, the purpose of each UT is to test the proposed DCGS-A Capability Drop-1 systems to the requirements and solicit Soldier feedback on system usability.

The Government may provide or update its requirements at the time it issues an order for a UT.

The UT will be conducted at Aberdeen Proving Ground (APG), MD and/or other Government locations, without limit, as may be needed. Testing will be conducted by PM DCGS-A, or other Government Authority. During a UT the Contractor shall demonstrate its technical solution against the requirements defined in the PRD, Section J Attachment 0003, and against such other requirements as the Government may have for the UT. During the UT the Government may receive Soldier input on system design and workflows for the Contractor to utilize to tailor and/or modify its solutions to better meet the needs of the Soldier community.

The UT may be comprised of up to three phases. Phase 1 may be a technical performance checkout. During UT Phase 1 testing, the Contractor will execute a series of performance tasks based on the PRD requirements, Section J Attachment 0003, as may be updated from time to time. The performance tasks will be detailed in the test plan that will be provided by the Government. Each task tested will be assessed as “pass / fail”. Phase 1 may not exceed two (2) days.

Phase 2 may have Soldiers on the system. Soldiers will be responsible for executing operational workflows / exercises written to demonstrate system requirements. During Phase 2 the Contractor will be responsible for the training portion of the event and resolving any system or operator issues during the exercise. The Government will solicit feedback from the Soldiers, through such mechanisms as Surveys, Interviews and Focus Groups. The Contractor may provide to the Government additional questions or topics as it relates to their solution that they would like discussed during the Focus Group. The Government may provide feedback to the Contractor, and may share the feedback with all other base contractors. The Contractor can propose to the Government alternative methods for capturing usability related information during the phase to support the modification/tailoring of the Contractor solution prior to the start of a follow-on UT.

The User Trial test procedures will be provided to the Contractor in the Government test plan.

Phase 3 may include cybersecurity testing. Cybersecurity testing may include the cyber threat activity and vulnerability and penetration assessment, in accordance with Procedures for Operational Assessment and Evaluation of Cybersecurity in Acquisition and the Department of Defense Cybersecurity Test and Evaluation Guidebook. Cybersecurity Testing may not exceed three (3) days.

Each UT is not expected to exceed four (4) weeks from set-up through teardown. The UTs may extend up to an additional week in length for ATEC to perform risk reduction tasks prior to the Operational Assessments. If this occurs, the Contractor shall leave behind its solution and a minimum of one (1) SME to operate the hardware/software.

The Contracting Officer will provide email notification to the Contractor about twenty (20) business days prior to the start of each UT. With this notification, Contracting Officer will provide each Contractor a schedule that will include training dates, a detailed test plan, and schedule of test events defining the specific timeframes that each Contractor’s System will be tested. The Government will have final discretion in determining the most efficient test sequence to meet the overall schedule. If multiple base contractor awardees are issued the same UT, then the Government will make reasonable efforts to conduct tests in as similar conditions as possible for each Contractor. The detailed test plan will include processes and resources the Government plans to use during test conditions.

A. The Contractor shall deliver the number of assets, with all applicable licenses, listed in Table 1 for UT. The Contractor shall ship the aforementioned assets to the location designated in the order. The assets (hardware) provided as the offeror’s solution shall be used in the UTs. If the Contractor wishes to change their hardware platform during the UT they can only do so with the prior approval, in writing, of the Government. Software shall be loaded by each Contractor prior to delivery to the Government. The Contractor shall also deliver all necessary configuration files and training material. The Contractor shall be responsible for providing any additional systems required to conduct training during both UTs (e.g., system for the trainer); any such systems shall be in addition to the assets listed in Table 1. The Operator Systems shall be used by Operators during training and Phase 2 execution.

Table 1: User Trials Asset List Systems per UT

Total Qty: 8 (with licenses) 6 – Operator Systems

2 – Spares

B. No software changes to the system under test will be allowed once testing has begun, unless approved by the Government in writing.

C. During testing, the Government is planning to provide official Test Incident Reports (TIRs) to document all anomalies and system failures identified by the Government. Contractor may be provided TIRs at the conclusion of the event. The Government will make a determination on whether any TIRs result in a Priority 1-3 Software Problem Report (SPR), as defined in DA Pamphlet 73-1, Figure Q-31. ATEC OA Entrance Criteria is no Priority 1-2 SPRs.

D. The Contractor shall provide Soldier Training Material prior to the event. Training shall be conducted in a classroom environment and the Contractor shall assume recipients of the training have no prior experience with the Contractor’s system. Training during the UT should be divided into blocks and the Contractor is encouraged to utilize a “train-exercise-train” methodology.

However, the combination of all training shall not exceed twenty-four (24) hours over three (3) days per Soldier group. Soldier groups will utilize the same Contractor-provided Operator Systems (see Table 1) for all activities during the UT.

E. The Government will assign a Soldier group to the Contractor’s system. It is anticipated that the Government may rotate Soldier groups among systems from all base contract holders and may provide the Contractor, to a reasonable extent, with equal access and feedback from Soldier groups.

3.1.4 User Trial Test Support (CLIN 0001)

If the Government issues an order, the Contractor shall provide on-site training and test support for a period not expected to exceed four (4) weeks with no more than four (4) and no less than one (1) Contractor on-site representatives for the UT. The Contractor on-site representative(s) shall include:

A. Training Support: The Contractor on-site support shall provide system training for up to six (6) operators at a time, not to exceed a total training time of twenty-four (24) hours over three

(3) days.

B. Operator Support: The Contractor on-site support shall provide support for system operation / issues and troubleshooting throughout the UT.

C. System Configuration: The Contractor on-site support shall provide support for initial set up for the systems.

3.1.5 Army Interoperability Certification (AIC) (CLIN 0003)

If the Government issues an order, the Contractor shall achieve an Army Interoperability Certification. The Contractor shall provide one (1) system operator and one (1) cybersecurity person, who can be the same person, on-site for a duration not to exceed twelve (12) weeks for the AIC test event at the Central Technical Support Facility (CTSF) located at Fort Hood, TX.

Activities for this event may include, but not limited to, system set-up, test operator training, AIC test plan review and coordination, general engineering services, IA scans, the Network Vulnerability Assessment (NVA), the cyber threat activity, and vulnerability and penetration assessments.

3.1.6 Functional Configuration Audit (CLIN 0010)

If the Government issues an order, the Contractor shall provide two (2) SMEs to support the Government Functional Configuration Audit, after receiving an order, for a duration not to exceed three (3) days. This audit shall include, at a minimum, verification that the system complies with all the DCGS‐A PRD requirements, Section J Attachment 0003.

3.1.7 Information Assurance Support for User Trial (CLIN 0002)

If the Government issues an order, the Contractor shall support and participate in accreditation assessment and cybersecurity testing. For the User Trial, the Contractor shall provide support for the Risk Management Framework (RMF) self-assessment and Army Interoperability Certification.

3.1.7.1 RMF Self-Assessment Support

The Contractor shall provide self-assessment support to include but not limited to providing system artifact documentation, completing and providing Assured Compliance Assessment Solution (ACAS) security scans, complying with security controls IAW, and assisting in the development of a Plan of Actions & Milestones (POA&M) to meet RMF security control requirements. The Government will provide or make available to the Contractor the required security tools needed for RMF activities.

The Contractor shall deliver the following system artifact documentation no later than (15) business days after receipt of order IAW CDRL A004 and A005 (DI-MGMT-82135, DI-MGMT- 82140) RMF Assessment & Authorization Products, and CYBERSAFE Objective Quality Evidence Assessment & Authorization Product and Cybersecurity Test Plan. Information Assurance (IA) Documentation: Risk Management Framework Documentation:

• Hardware List (Name, Model, and Version)

• Software List (Name, Model, and Version)

• Software Version Description (SVD), CDRL A001

• Software Installation/Configuration Plans

• Software Test Plans

• Software Test Report

• Software User Manuals

• Administrator Manuals/Guides

• Illustrated System Architecture Diagram (with accreditation boundary)

• Detailed System Architecture Diagram (with accreditation boundary)

• Data Flow Diagram

• Data Types

• Ports, Protocols, and Services List

• Operations Security (OPSEC) Plan

• Security configuration guides

• Process & Procedures for backup/restore/recovery

• Nessus/STIG Scans and Checklist

• Patch update

• System Change Requests

• System Change Implementation/Rollback Plans

• Audit file/log retrieval/archiving

• Password management

• Access Control Implementation

• Configuration Management Plan/Process

• System Training Plans & Guides

• Maintenance

• System/Services Supply Chain Acquisition process

• FSE Guides

• Regression Test Plans

(See CDRL DI-MGMT-82140, A004,DI-MGMT-82135, A005 & A001)

The Contractor shall comply with all applicable technical, procedural, and system documentation associated with Federal, Department of Defense (DoD), and Army Cybersecurity policy and requirements, including but not limited to:

A. Provide system information at the component level including security concepts and procedures and all system component user and maintenance manuals to the security engineering team after receipt of order, IAW CDRL A004 and A005. This system information shall become the baseline system configuration.

B. Provide system administration, access, and engineering support to the certification engineering team and installation management personnel from certification activities through final system acceptance.

C. Provide system information and security assistance to the certification authority and certification agents during certification recommendation and accreditation decisions.

D. Provide a copy of complete system documentation including component manuals, configuration guides, administration guides, user guides, and any system unique documentation after receipt of order, IAW CDRL A004 and A005.

The Contractor shall provide support to conduct ACAS scans and deliver results to the Government, comply with security controls, and apply Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs). Also, the Contractor will assist the Government in developing the POA&M to meet RMF requirements.

3.1.8 Program Management and Meeting Support (CLIN 0001)

If the Government issues an order, the Contractor shall designate a program manager with responsibility to plan, manage, and direct the successful and final completion of the requirements of this SOW. The Contractor’s program manager shall be the single focal point of contact for all required programmatic requirements and work directly with the Contracting Officer Representative (COR) and Contracting Officer (KO).

3.1.8.1 Program Kickoff

The Contractor shall participate in a Government-run program kickoff event, no later than, 10 business days after receipt of order The Contractor shall plan for the kickoff meeting to last anywhere between 2-4 hours, and will be conducted at Government Location at APG. Contractor shall possess and demonstrate an understanding of the PRD, Section J Attachment 0003, Government’s program schedule, and Statement of Work. Contractor shall present a general concept plan for how it intends to execute.

3.1.8.2 User Trial Meetings

The Contractor shall participate in a Pre-User Trial meeting, about, fifteen (15) business days prior to the UT TRR , to discuss the test plan details and activities leading up to the UT TRR and

UT.

The Contractor shall participate in a Post-User Trial meeting, on or before, five (5) business days after the completion of UT, to allow the Government to provide the contactor with the information collected from UT.

All meetings will occur at Aberdeen Proving Ground, remotely, or other location if directed.

Contractor shall have maximum flexibility to assign the appropriate person or persons to participate.

3.1.8.3 Overview Demonstration

The Contractor shall support a one (1) day system demonstration at APG at the Government’s request. The Contractor will be given at least five (5) business days notice and will be required to provide two (2) demonstration systems with two (2) SMEs to support.

3.1.9 Software Version Description (SVD) (A001-NSP)

If the Government issues an order, the Contractor shall be responsible for delivering an initial version of the software version description (SVD) after receipt of order IAW CDRL A001, at the time of RMF self-assessment artifacts IAW paragraph 3.1.7.1. The Contractor shall deliver a SVD with each software deliverable to include monthly security patch/release deliveries, IAW CDRL A001.

(See CDRL DI-IPSC-81442A, A001)

3.1.10 Program Protection (CLIN 0001)

If the Government issues an order, the Contractor shall perform the below tasks as described and will flow down to any sub-contractors engaged by the Contractor:

A. During the program kickoff meeting, SOW Section 3.1.8.1, the Contractor shall assist and support the Government in performing a Critical Functional Analysis (CFA) and Critical Program Information (CPI) Assessment on the vendor solution in order to identify Critical Components and CPI.

B. During the Functional Configuration Audit, SOW Section 3.1.6, the contractor shall assist the Government to develop, document and update required software assurance activities per Table 8 provided in the Defense Acquisition Guidebook, Chapter 9, Program Protection Plan, Section 9-3.2.5. Note: P is for planned and A is for actual.

C. During the Functional Configuration Audit, SOW Section 3.1.6, the contractor shall provide the Government with visibility into the supply chain for Critical Components, and the contractor shall describe how supply chain risk can be introduced through those Critical Components, and describe how the contractor has implemented or plans to implement countermeasures to mitigate such risks. The Government will either approve, modify, or add additional countermeasures.

D. The Contractor shall provide a Program Protection Implementation Plan (PPIP) to the Government with initial delivery of CD-1 battalion solutions as part of SOW Section 3.3 CD-1 Solution Procurement, and provide reports to the Government IAW CDRL DI-ADMN-81306, A007 Program Protection Implementation Plan.

3.1.11 Logistic Support for User Trial (CLIN 0001)

If the Government issues an order, the Contractor shall be responsible for the maintenance, sustainment and commercial warranty support of hardware/software solutions being presented during the User Trial. This requirement is limited to those assets the vendor has procured in support of the UT.

3.2 Operational Assessment

If the Government issues an order, the Contractor shall provide support to the Operational Assessment which includes all activities from pre-Operational Test Readiness Review (OTRR) through the conclusion of the OA, to include associated training support and continued RMF accreditation activities.

3.2.1 Operational Test Readiness Review (CLIN 0004)

If the Government issues an order, the Contractor shall provide no more than three (3) no less than one (1) subject matter experts (SME) for one (1) day to support the Government during the TRR for the Operational Assessment. The TRR may occur at Aberdeen Proving Ground, or remotely, about, twenty (20) business days prior to the Operational Assessment.

3.2.2 Operational Assessment (CLIN 0004)

If the Government issues an order, the purpose of the OA is to test the proposed DCGS-A CD-1 systems against some or all requirements in PRD, Section J Attachment 0003, assess the proposed DCGS-A CD-1 system’s effectiveness, suitability, and survivability, and to solicit Soldier feedback on system usability, and to assess cybersecurity. The OA will be conducted at a location designated by the Government. Testing will be conducted by the Army Test and Evaluation Command (ATEC). The OA is not expected to exceed six (6) weeks from set-up through teardown.

The Contracting Officer will provide email notification to the Contractor no less than 10 business days prior to the start of OA. With this notification, Contracting Officer will provide the Contractor a schedule that will include training dates and schedule of test events defining the specific timeframes that the Contractor’s System will be tested. The Government will have final discretion in determining the most efficient test sequence to meet the overall schedule. If the Government tests solutions from multiple contractors, then the Government will make reasonable efforts to conduct tests in as similar conditions as possible for each Contractor.

The Contractor shall deliver the number of assets with all applicable licenses listed in Table 2 for the OA, after receipt of order IAW CDRL A001. The Contractor shall ship the aforementioned assets to the location designated in the order. The assets (hardware) proposed in the solution shall be the same used in the most recent User Trial. If the Contractor wishes to change their hardware platform from that utilized in the most recent User Trial they can only do so with the written approval of the Government. Software shall be loaded by each Contractor prior to delivery to the Government. The Contractor shall also deliver all necessary configuration files and training material after receipt of order, IAW CDRL A001, A008 & A009. The Contractor shall be responsible for providing any additional systems required to conduct training during the OT (e.g., system for the trainer); any such systems shall be in addition to the assets listed in Table 2. The Operator Systems shall be used by Operators during training and OA execution.

Table 2: OA Asset List

Systems per OA

Total Qty: 17 (with Licenses) 15 – Operator Systems 2 – Spares

No software changes to the system under test will be allowed upon receipt by the Government.

During testing, official TIRs will be prepared to document all anomalies and system failures identified by the Government. The Government may provide the Contractor with some or all of the results following the conclusion of the event. The Government will make a determination on whether any TIRs result in a Priority 1-3 Software Problem Report (SPR), as defined in DA Pamphlet 73-1.

The Contractor shall provide Instructor / Soldier Training and Training Material prior to the OA test event. Training shall be provided in a classroom environment and the Contractor shall assume recipients of the training have no prior experience with the system. Training prior to the OA shall not exceed a total training time of twenty-four (24) hours over three (3) days.

At the start of Pilot Test, the Contractor will not be allowed access to the test site unless accompanied by a Government Test Official. However, the Contractor will be provided a separate location in case support is needed during the event.

3.2.3 Operational Assessment Support (CLIN 0004)

If the Government issues an order, the Contractor shall provide no more than three (3) and not less than one (1) Contractor on-site representatives to provide on-site training and test support for a period not to exceed six (6) weeks for the Operational Assessment. The Government is planning to execute the Operational Assessment in Fort Bragg, NC, but the location is subject to change. The Contractor on-site representative(s) shall include:

A. Training Support: The Contractor on-site support shall provide system training for up to fifteen (15) operators at a time.

B. Initial System Set up: The Contractor on-site support shall provide support for initial set up for up to fifteen (15) BN Systems.

C. Operator/System Support: The Contactor on-site support shall provide support for any system or operator issues during the event. During the “record” testing event, support shall remain in a separate building and not oversee or otherwise interfere with test conduct.

3.2.4 IA Support for Operational Assessment (CLIN 0005)

If the Government issues an order, the Contractor shall continue to support all RMF activities from the User Trial, per SOW Section 3.1.7.1, in addition to supporting the Security Control Assessor (SCA) validation test and follow-on adjudications.

The contractor shall support the SCA validation test, which is not to exceed one (1) week, at the Contractor’s facility. The Contractor shall also support any and all follow-on adjudications as a result of the SCA validation test.

3.2.5 Operational Assessment Meetings (CLIN 0004)

If the Government issues an order, the Contractor shall participate in a Pre-Operational Assessment meeting, about fifteen (15) business days prior to the OTRR to discuss and review readiness to begin the OA. The meeting will occur at Aberdeen Proving Ground, remotely, or other location if directed.

3.2.6 Logistic Support for Operational Assessment (CLIN 0004)

If the Government issues an order, the Contractor shall be responsible for the maintenance, sustainment and commercial warranty support of hardware/software solutions delivered for the Operational Assessment. This requirement is limited to those assets the vendor has procured in support of the OA.

The Contractor shall deliver two (2) fully operational systems with test licenses to the Government for the purpose of training development and analysis at the beginning of the Operational Assessment. These systems will remain in Government control until the end of the Operational Assessment.

3.3 CD-1 Solution Procurement

If the Government issues an order, the CD-1 Solution Procurement includes all activities leading up to and including the procurement of the separately priced software and hardware solutions, completion of fielding and the transition to sustainment of DCGS-A CD-1, to include training support, licensing, configuration management, and RMF activities.

3.3.1 CD-1 Solution Delivery (CLIN 0006)

If the Government issues an order, the Contractor shall deliver the number of individual software solutions with all applicable licenses, required in the delivery order to Field Office Fort Hood, Texas. The Government, when issuing the delivery order, will inform how many Battalions will need to be supported.

3.3.2 CD-1 Solution Delivery (CLIN 0007)

If the Government issues an order, the Contractor shall deliver the number of individual hardware solutions with all applicable licenses, required in the delivery order, to Field Office Fort Hood, Texas. The Government, when issuing the delivery order, will inform how many Battalions will need to be supported

3.3.3 Training Support for CD-1 Solution Delivery (CLIN 0009)

If the Government issues an order, the Contractor shall deliver a “train the trainer” course to support New Equipment Training (NET), not to exceed one (1) week, to support up to twenty (20) personnel at the Contractor’s facility or Government location, at the discretion of the Government.

The Contractor is not expected to provide training for the entire field support team but provide this training to key Government fielding and training personnel.

The Contractor shall provide DCGS-A CD-1 NET materials, to include but not limited to user manual and administrator manual after receipt of order, per SOW Section 3.2.6, IAW DI-IPSC- 81443A CDRL A008 and DI-MISC-80711A CDRL A009. The NET materials may be in the vendor format, but it is suggested that the vendor be familiar with the tenants of Training & Doctrine Command (TRADOC) 350‐70 standard.

The Contractor shall provide the “train the trainer” course, as needed, for additional training, not to exceed six (6) courses per year for the length of the delivery order.

3.3.4 IA Support for CD-1 Solution Delivery (NSP applicable to CLIN 0006 & 0007)

If the Government issues an order, the Contractor shall continue to support all RMF activities from the User Trial and Operational Assessment per SOW Section 3.1.7.1, in addition to supporting the continued RMF activities needed to achieve an Authority to Operate (ATO).

The Contractor shall update and maintain all system artifact documentation and provide information to update and maintain the POA&M IAW CDRL A004.

3.3.5 Reach back Support for CD-1 Solution Delivery (NSP applicable to CLIN 0006) If the Government issues an order, the Contractor shall provide on-call subject matter expertise to support a reach back capability for two hundred fifty (250) hours per year, for each year of Delivery Order. The Contractor shall respond to any inquiries within twenty-four (24) hours after first being reported.

The Reach back Support shall include, but is not limited to, one or more of the following: live phone support or voicemail, email, or online portal.

3.3.6 Program Protection Implementation (NSP applicable to CLIN 0006, 0007 & 0008) The Contractor shall implement Government specified Supply Chain Risk Management Countermeasures to safeguard Government identified CPI and Critical Components, per PRD Section 11.5, Section J Attachment 0003.

3.4 Annual Sustainment

If the Government issues an order, the Annual Sustainment consists of years two (2) through ten

(10) of the period of performance of this contract. These activities include, but is not limited to, licensing, configuration management, maintenance, and RMF activities.

3.4.1 IA Support for Annual Sustainment (CLIN 0008)

If the Government issues an order, the Contractor shall update and maintain all system artifact documentation and POA&M on a monthly basis. In the case of follow-on re-accreditation of the DCGS-A CD-1, the Contractor shall support the activities outlined in sections 3.1.5 and 3.1.7.

The Contractor shall release monthly security patches/releases to PM DCGS-A Configuration Management after receipt of order, IAW SOW Section 3.7 and CDRL A006

3.4.2 Reach back Support for Annual Sustainment (CLIN 0008)

If the Government issues an order, the Contractor shall provide on-call subject matter expertise to support a reach back capability, for two hundred fifty (250) hours per year, for each year of Annual Sustainment. The Contractor shall respond to any inquiries within twenty-four (24) hours after first being reported.

The Reach back Support may be, but not limited to one or more of the following: live phone support or voicemail, email, or online portal.

3.5 Information Assurance (NSP applicable CLIN 0006, 0007, & 0008)

3.5.1 Risk Management Framework Compliance

The Contractor perform cybersecurity accreditation in accordance with DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT). During the early stage of RMF process, the Contractor’s system will be assessed for security categorization for Confidentiality, Integrity, and Availability (CIA) impact levels and a proper set of security controls will be identified.

The Contractor shall enable their solution in meeting the requirements from the applicable security controls by applying the required DISA STIGs which are applicable to the system. All applicable security controls identified in the SP 800-53 publication and STIGs shall be assessed to ensure security controls and STIGS are examined, interviewed and tested, ensuring ATO requirements are addressed.

The Contractor shall provide cybersecurity control artifacts that are compliant with the DoD SP 800-53 publication. No tools are authorized for generation of artifacts except those posted to the Army OIA&C site or Knowledge Service (KS) site. Artifacts provided must meet the requirements of Army and DoD guidance.

The Contractor shall ensure all known findings from system certification activities are corrected or mitigated to meet ATO requirements. All IA or IA-enabled products such as firewalls, routers, switches, Intrusion Detection System/Intrusion Prevention System (IDS/IPS), Virtual Private Network (VPN), etc. must be at a minimum National Information Assurance Partnership (NIAP) certified. The product should also be on the DoD Unified Capabilities (UC) Approved Products List (APL) (https://informationassurance.us.army.mil, AAPL under IA Tools; use AKO account for access).

3.5.2 Information Assurance Compliance

The DCGS-A BN shall meet all applicable security control requirements so that an ATO can be obtained. Once an ATO has been obtained, the Contractor shall continue to sustain the security posture of the system baseline to maintain the compliance of the ATO requirement. The https://informationassurance.us.army.mil/

Contractor shall maintain IAVA patching process at least on a monthly basis to support Command Cyber Readiness Inspection (CCRI) compliance.

3.6 Licensing (NSP applicable CLINs 0001, 0002, 0003, 0004, 0005, 0006, 0007, & 0008)

The Government reserves the right to not award any delivery order under this contract unless the corresponding commercial software license agreements (for commercial software deliverables for that delivery order) are reviewed and approved by the Contracting Officer. The Government reserves the right to not accept any commercial software license terms that conflict with federal procurement law or do not satisfy user needs. Commercial Software License terms that are unacceptable to the Government include (but are not limited to) indemnification provisions (and other types of provisions that include unauthorized or unbudgeted funding obligations), attorney’s fees provision, state or foreign choice of law/jurisdiction provisions, binding arbitration provisions, and injunctive relief provisions.

Software licensing will comprise licensing for the entire solution, and any licenses contained within the solution. The software licensing should be scalable and flexible to fit annual requirements.

• The Contractor shall state the type of licensing it is providing, a clear definition of the licensing and the duration of that licensing.

• The Contractor shall provide instruction for activation processes, if activation will be required, to fit the restrictive nature of where the solution will be implemented.

3.6.1 Warranties

The Contractor shall warrant that the license grants the Government (and its service contractors or covered Government support contractors) the right to operate or use the solution, the software and software code has been properly licensed from the licensor, and warrant no third-party restrictions or encumbrances exist that would impact this contract.

The Contractor will indemnify the Government from any third-party fees or costs arising either directly or indirectly from third party royalties, infringement, source code ownership, object code, trade mark violations, open source or any other such potential violations for use of the software as outlined within the contract terms. If full indemnification is not possible the Contractor will provide a summary of what is not indemnified, copies of assignments, declarations and documentation needed for the Government to assess the level of risk and impacts.

If the Contractor becomes aware of an infraction or impact to this contract due to a third-party agreement, the Contractor will provide written notice to the Government within 30 days detailing the infraction and impact to the contract.

3.7 Configuration Management

The CDRL deliveries referenced within this SOW must be delivered to CM.

3.7.1 Software Problem Report (SPR) (NSP applicable to CLIN 0001, 0004, 0006, 0007 & 0008)

The Government and Contractor shall collect and analyze Software Problem Reports (SPR) during User Trial(s), Operational Assessment and Annual Sustainment. SPRs shall include those software defects found during external testing events, by organizations such as CTSF and Army Test and Evaluation Center (ATEC), user-submitted software defects, software defects encountered by field support personnel and requests for system enhancements. All SPRs shall be made available to the Government.

The Government and Contractor shall communicate and track all software problem reports (SPR) through a SPR Tracker (as proposed by the Contractor). The SPR Tracker shall include, at a minimum, information outlined in DA PAM 73-1 Figure Q-30. The Contractor shall update existing SPRs on a daily basis with information including, but not limited to, resolution assessments, SPR resolution status, and target deliveries.

3.7.2 Monthly Security Patch/Release Delivery (CLIN 0008)

If the Government issues an order, the Contractor shall deliver monthly security patches/releases, with all applicable installation procedures and updated documentation, to the PM DCGS-A CM team no later than the 15th of each month. The Contractor shall monitor and track firmware upgrade notices for the proposed hardware solution and deliver any updates as part of the monthly security patch/release delivery. After receipt of order, any changes to software/firmware will be IAW CDRL DI-MISC-81807, A006. The Government will conduct an Acceptance Test to verify the installation software/firmware operates without error, that the installation documents provide accurate and complete instructions to install the patch/release at the user level, and that the installation does not adversely impact the functionality of the CD-1 system. The Government will produce a subsequent test report detailing the results and identifying any SPRs found. If any Priority 1, Priority 2, or Priority 3 SPRs are found during the Acceptance Test, the Contractor shall have five (5) days from notification by the Government to adjudicate and re-submit the security patch/release to the Government with all updated installation procedures and applicable documentation. The Government may adjust the timelines for monthly delivery and Priority 1-3 SPR adjudication.

(See CDRL DI-MISC-81807, A006)

3.7.3 Field-discovered SPRs (CLIN 0008)

If the Government issues an order, this paragraph applies to CD-1 software already released to and in use by the end-user. The Government will analyze all user-submitted SPRs and classify by priority IAW DA PAM 73-1, and subsequently enter into the SPR Tracker. The Contractor shall monitor the SPR tracker and respond to any new or updated Priority 1 SPR submissions within twenty-four (24) hours, any new or updated Priority 2 SPR submissions within forty-eight (48) hours, and any new or updated Priority 3 SPR submissions within seventy-two (72) hours. The Contractor shall work with the COR or COR designee to ascertain that the root cause of the issue being addressed lies with DCGS-A CD-1, rather than from hardware, network, or some other factor outside the scope of DCGS-A CD-1. The Contractor and Government shall determine if submitted SPRs shall be addressed in an emergency software patch/release or part of the ensuing monthly delivery IAW with paragraph 3.8.2.

3.7.4 Contractor-proposed CD-1 Modifications due to Enhancements, Obsolescence, and Major Software Releases (NSP applicable to CLIN 0006, 0007 & 0008)

The Contractor shall present all modifications due to enhancements, obsolescence, and major software version release to the Government Engineering Review Board (GERB) no later than ninety (90) days prior to initial release of modification. The contractor shall also present to the GERB any discontinuation or removal of hardware or software components or features due to obsolescence, diminishing sources, or any other reason, no later than ninety (90) days prior. The requirement for the contractor to present to the GERB does not apply to any software patches or updates designed to correct software errors, or that address cybersecurity issues. The Contractor shall present all documentation and training impacts associated with the modification, and present their plan for maintaining required ATO.

3.7.5 Government-proposed Enhancements and Modifications (NSP applicable to CLIN 0006, 0007 & 0008)

The Government may present capability enhancements and modifications to be incorporated into future CD-1 software releases. The Government will notify the Contractor IAW FAR 52.243-1 of any such enhancements or modifications. The Contractor shall have thirty (30) days from notification to prepare an Engineering Change Proposal in Contractor format (See CDRL DI-

SESS-80639D, A002).

3.8 Hardware (NSP applicable to CLIN 0001, 0004 & 0007)

The Contractor must provide documentation and data to prove that their hardware solution complies with MIL-STD 810 IAW PRD, Section J Attachment 003.

The Contractor shall provide, and/or, ensure that hardware warranties are for five (5) years.

The Contractor shall…