A01 - Attachment 0001 - Statement of Work_DCGS-A CD2_17JUL2019.pdf

UNCLASSIFIED // FOR OFFICIAL USE ONLY

STATEMENT OF WORK (SOW)

FOR

Distributed Common Ground System – Army (DCGS-A) Capability Drop (CD) 2 – Data Fabric and Analytics

Solicitation Number: W56KGY-19-R-0007

Base Contract Version 1.0

17 July 2019

Project Manager (PM) DCGS-A 6580 Surveillance Loop, Building 6006 Aberdeen Proving Ground, MD 21005

Solicitation # W56KGY-19-R-0007 SOW 17 July 2019

Table of Contents

1.0 Scope

1.1 Background

2.0 Applicable Documents

3.0 Requirements

3.1 Intel Analyst Test Support

3.1.1 Intel Analyst Test Preparation

3.1.2 Intel Analyst Test Readiness Review Support

3.1.3 Intel Analyst Test

3.1.4 Intel Analyst Test Support

3.1.5 Program Management and Meeting Support

3.1.6 Software Version Description (SVD)

3.1.7 Logistic Support for Intel Analyst Test

3.2 CD 2 Technical Testing

3.2.1 Technical Test Preparation

3.2.2 Technical Test Readiness Review Support

3.2.3 Technical Test

3.2.4 Technical Test Support

3.2.5 Program Management and Meeting Support

3.2.6 SVD

3.2.7 Program Protection

3.2.8 Logistic Support for Technical Test

3.3 CD 2 NIPRNet RMF Authorization

3.3.1 Cybersecurity Support

3.3.2 RMF Compliance

3.3.3 Cybersecurity Compliance

3.4 CD 2 Secret RMF Authorization

3.4.1 Cybersecurity Support

3.4.2 RMF Compliance

3.4.3 Cybersecurity Compliance

3.5 CD 2 Top Secret RMF Authorization

3.5.1 Cybersecurity Support

3.5.2 RMF Compliance

3.5.3 Information Assurance Compliance

3.6 CD 2 Functional Configuration Audit

3.7 CD 2 Solution Army Interoperability Certification (AIC)

3.8 CD 2 Solution Joint Interoperability Test Certification (JITC)

3.9 CD 2 Solution Training

3.10 Operational Assessment

3.11 CD 2 Solution Software

3.11.1 CD 2 Solution Delivery

3.11.2 DEVOPS

3.11.3 Program Protection Implementation

3.12 Annual Sustainment

3.12.1 Annual Maintenance Upgrades

3.12.2 IA Support for Annual Sustainment

3.12.3 Reach Back Support for Annual Sustainment

3.13 Field Service Engineer (FSE) – Contiguous United States (CONUS)

3.13.1 CONUS FSE Locations

3.13.2 CONUS FSE Efforts

3.13.3 CONUS FSE DEVOPS Support

3.14 FSE - Germany

3.14.1 Germany FSE Locations

3.14.2 Germany FSE Efforts

3.14.3 Germany FSE DEVOPS Support

3.15 FSE – Pacific Command (PACOM)

3.15.1 PACOM FSE Locations

3.15.2 PACOM FSE Efforts

3.15.3 PACOM FSE DEVOPS Support

3.16 Fixed Site Fielding Support - CONUS

3.16.1 CONUS Fixed Site Fielding Support Preparation

3.16.2 CONUS Fixed Site Fielding Support Execution

3.17 Fixed Site Fielding Support – Germany

3.17.1 Germany Fixed Site Fielding Support Preparation

3.17.2 Germany Fixed Site Fielding Support Execution

3.18 Fixed Site Fielding Support – PACOM

3.18.1 PACOM Fixed Site Fielding Support Preparation

3.18.2 PACOM Fixed Site Fielding Support Execution

3.19 Fixed Site Initial Configuration - CONUS

3.19.1 CONUS Fixed Site Data Harvest

3.19.2 CONUS Fixed Site Data Source Adapters

3.19.3 CONUS Fixed Site Fielding Support Execution

3.19.4 CONUS Edge Node Fielding Support Execution

3.20 Fixed Site Initial Configuration - Germany

3.20.1 Germany Fixed Site Data Harvest

3.20.2 Fixed Site Data Source Adapters

3.20.3 Fixed Site Fielding Support Execution

3.20.4 Germany Edge Node Fielding Support Execution

3.21 Fixed Site Initial Configuration - PACOM

3.21.1 PACOM Fixed Site Data Harvest

3.21.2 PACOM Fixed Site Data Source Adapters

3.21.3 PACOM Fixed Site Fielding Support Execution

3.21.4 PACOM Edge Node Fielding Support Execution

3.22 Addition of a New Data Source (Low Complexity)

3.22.1 Addition of a New Data Source (Low Complexity)

3.22.2 New Data Source Testing

3.23 Addition of a New Data Source (High Complexity)

3.23.1 Addition of a New Data Source (High Complexity)

3.23.2 New Data Source Testing

3.24 Data Export

3.24.1 Site Data Export

3.25 Licensing

3.25.1 Warranties

3.26 Configuration Management

3.26.1 Software Problem Report (SPR)

3.26.2 Monthly Security Patch/Release Delivery

3.26.3 Field-discovered SPRs

3.27 Engineering Change Proposals (ECP)

3.27.1 Contractor-proposed CD 2 Modifications due to Enhancements, Obsolescence, and Major Software Releases

3.27.2 Government-proposed Enhancements and Modifications

3.28 Exercise Support

3.29 Assurance Warranties

3.29.1 Warranty Patch/Release Delivery

3.30 Army Contractor Manpower Reporting (CMR) System

4.0 Contract Deliverables

1.0 Scope

The contractor shall provide a commercial item that is a software only solution to meet the DCGS-A CD 2 interoperability, security, training, usability, and data management capabilities. The Contractor shall also provide support services, incidental services, and deliverables for the procurement of a commercial item solution (system) to satisfy DCGS- A CD 2 requirements.

1.1 Background

DCGS-A is a Family of Systems that provides our Army with advanced analytics, support to targeting and situation understanding to commanders. It processes, exploits and disseminates information and intelligence about the threat, weather, and terrain and provides tactical and operational ground stations that downlink data from national, joint partners and Army sensors. As technology evolves and new warfighting requirements emerge, the DCGS-A capability set needs to be updated to meet the user needs.

The DCGS-A CD 2 requirements address the need to enhance the Data Fabric and Analytics capabilities of DCGS-A at the Army’s Intelligence and Security Command (INSCOM) Fixed Sites and tactical echelons. The contractor’s solution shall meet the capabilities called out in the Performance Requirement Documentation (PRD). The Contractor’s CD 2 software is intended to be hosted in the Cloud and/or on Government owned equipment (e.g. Intelligence Processing Center Version 1 (IPCv1) or Tactical Server Infrastructure (TSI)).

The CD 2 capability shall align with multiple overarching directives, to include the Army’s Common Operating Environment (COE); the Intelligence Community Information Technology Enterprise; Joint Information Environment and Defense Intelligence Information Enterprise. The DCGS-A CD 2 shall support net-centric military operations by being interoperable with current Army, Unified Action Partners, Joint Service, Allied, Coalition, and Command and Control information and ISR systems. DCGS-A CD 2 shall operate across the Top Secret Joint Worldwide Intelligence Communications System (JWICS) Network and the Secure Internet Protocol Router Network (SIPRNet), Secret Coalition, and Unclassified security domains, and within and across all COE computing environments.

DCGS-A will continue to contribute to visualization and situational awareness, maximizing combat power and enhancing the ability to operate in an unpredictable and changing environment throughout the operational spectrum.

2.0 Applicable Documents

The following documents are applicable to this SOW.

Table 2-1: DCGS-A Program Documents

Number: Title: Date:

Performance Requirements Document (PRD) for DCGS-A Capability Drop 2

30 April 2019

Capability Drop 2 User Stories 30 April 2019

Table 2-2: Department of Defense Directives

DoD 5220.22-M National Industrial Security Program Operating Manual 28 February 2006

DoDD 8570.01 Information Assurance (IA) Training, Certification and Workforce Management

15 August 2004

DoD 8570.01-M Information Assurance Workforce Improvement Program, Change

19 December 2005 w/ change 10 November

DoDD 8140.01 Cyberspace Workforce Management 11 August 2015

DoDI 4140.67 DoD Counterfeit Prevention Policy 26 April 2013

DoDI 4140.01 DoD Supply Chain Materiel Management Policy 14 December 2011

DoDI 8582.01 Security of Unclassified DoD Information on Non-DoD Information Systems

6 June 2012

DoDI 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN)

5 November 2012

Table 2-3 Department of Defense Instructions

DoDI 3020.41 Operational Contract Support 20 December 2011

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT)

12 March 2014

Table 2-4 Army Regulations (AR)

AR 25-1 Army Information Technology 25 June 2013

AR 25-2 Information Assurance 4 April 2019

AR 70-1 Army Acquisition Policy 16 June 2017

AR 73-1 Test and Evaluation Policy 16 November 2016

AR 530-1 Operations Security 26 September 2014

AR 380-67 Personnel Security Program 24 January 2014

AR 381-12 Threat Awareness and Reporting Program (TARP) 01 June 2016

AR 70-77 Program Protection 08 June 2018

DA PAM 25-1-2 Information Technology Contingency Planning 06 June 2012

Tables 2-5 Other Documents

NIST Special Publication 800- 53A Rev 4

Assessing Security and Privacy Controls in Federal Information Systems and Organizations

December 2014

Cybersecurity T&E Guidebook

Department of Defense Cybersecurity Test and Evaluation Guidebook

1 July 2015

DA Pam 73-1 Test and Evaluation in Support of Systems Acquisition 30 May 2003

DOT&E Memo Procedures for Operational Test and Evaluation of Cybersecurity in Acquisition

1 August 2014

DAG 2017 Defense Acquisition Guidebook 21 August 2017

MIL-STD-810 Department of Defense Test Method Standard, Environmental Engineering Considerations and Laboratory Tests

31 October 2008

NIST Interagency Report 7622

Notional Supply Chain Risk Management Practices for Federal Information Systems

October 2012

NIST Special Publication 800- 18 rev 1

Guide for Developing Security Plans for Federal Information Systems

February 2006

NIST Special Publication 800-

Supply Chain Risk Management Practices for Federal Information Systems and Organizations

April 2015

ADP 1-02 Terms and Military Symbols August 2018

ATP 2-01.3 Intelligence Preparation of the Battlefield March 2019

ATP 2.33.4 Intelligence Analysis August 2014

- DoD Dictionary of Military and Associated Terms June 2019

FM 100-2-1 The Soviet Army - Operations and Tactics Most Recent Version

FM 100-2-2 The Soviet Army - Specialized Warfare and Rear Area Support Most Recent Version

FM 100-2-3 The Soviet Army - Troops, Organizations, and Equipment Most Recent Version

JP 2-01.3 Joint Intelligence Preparation of the Operational Environment May 2014

MIL-STD-2525

[B, C, &D]

Common Warfighting / Joint Military Symbology Most Recent Version

3.0 Requirements

This SOW addresses all products, support, and activities that shall be required throughout the period of performance (PoP) for the contract. The Contractor shall provide all the necessary resources and knowledge to support the listed products, support, and activities.

The goal of this SOW and the applicable/referenced documents is to detail and implement commercial item solutions that will satisfy the Government’s requirements. The following requirements will be issued at the order level to establish the most viable commercial item solution(s) to meet the Government’s requirements.

3.1 Intel Analyst Test Support

The Contractor shall provide all necessary software licenses, materials, and incidental support required to execute a CD 2 Intel Analyst Test as detailed in the below paragraphs.

This section shall include all activities to include the Intel Analyst Test Preparation, Intel Analyst Test Support, the Intel Analyst Test Readiness Reviews (TRR), information assurance activities, and the actual performance of the Intel Analyst Test.

3.1.1 Intel Analyst Test Preparation

The contractor shall have a period of time of no longer than eight (8) weeks before each Intel Analyst Test, during which the Contractor can modify and/or tailor its commercial solution as necessary. The goal is for the Contractor’s solution to successfully meet the Government’s requirements identified within the PRD incorporated in Section J of this contract. The Government will make available to the Contractor a representative test environment, such as Aberdeen Proving Ground (APG) or at an operational site, such as the 513th MI BDE at Ft Gordon, GA, during that time. That environment will be made available in advance of the testing to the Contractor for system setup and configuration, integration, test, and training.

3.1.2 Intel Analyst Test Readiness Review Support

The Contractor shall provide no more than four (4) and no less than one (1) subject matter expert (SME) for one (1) day to support the Government during the TRR for each Intel Analyst Test. The TRR may occur at APG, or remotely, approximately five (5) business days prior to the start of each Intel Analyst Test.

3.1.3 Intel Analyst Test

The purpose of each Intel Analyst Test is to test the Contractor’s commercial CD 2 solution to the system requirements and solicit user feedback on system usability. The Government may provide decomposed requirements, measures of performance, and technical performance measures to support the testing and evaluation. The Intel Analyst Test will be conducted in the Aberdeen MD area, other Government location, or at a facility aligned to a military base, such as the 513th MI BDE, Ft Gordon, GA. Testing will be conducted by PM DCGS-A, or other Government Authority. During an Intel Analyst Test, the software shall demonstrate its ability to meet the specified SOW and PRD requirements. During the Intel Analyst Test, the Government will receive user input on system design and workflows for the Contractor to utilize to tailor and/or modify its solutions to better meet the needs of the user community. The Intel Analyst Test may also include cybersecurity testing of the Contractor’s software.

The Intel Analyst Testing will include operational users using and/or evaluating the Contractor’s software. These users represent the end-users that will use the software once fielded/deployed. The users will be responsible for executing operational workflows/exercises written to demonstrate system requirements. If these users use the software, the Contractor shall be responsible for the training portion of the event and resolving any system or operator issues during the exercise. The Government may provide feedback to the Contractor. The Intel Analyst Test procedures will be provided to the Contractor in the Government’s test plan.

Each Intel Analyst Test is not expected to exceed three (3) weeks overall, from set-up through teardown.

The Government will provide email notification to the Contractor about 15 business days prior to the start of each Intel Analyst Test. With this notification, the Government will provide each Contractor a schedule that will include training dates, a test plan, and schedule of test events defining the specific timeframes that each Contractor’s System will be tested. The Government will have final discretion in determining the most efficient test sequence to meet the overall schedule. If multiple base contractor awardees are issued the same Intel Analyst Test, then the Government will make reasonable efforts to conduct tests in as similar conditions as possible for each Contractor. The Government’s test plan will include processes and resources the Government plans to use during test conditions.

A. The Contractor shall deliver the number of temporary software licenses, listed in Table 3.1.3 for the Intel Analyst Test. Each of these temporary software licenses shall support up to 30 clients, simultaneously. The Contractor shall license the software for testing during the entire PoP of the order. The Government may use the Contractor’s software for Government-run training development activities, Beta-Testing in the field, and laboratory testing during or after the Intel Analyst Test. The Contractor will be responsible for working at the Government site to install and configure its CD 2 software on Government-provided infrastructure (e.g. Cloud, TSI, IPCv1). The Contractor’s CD 2 software may share computing resources with other software applications and services.

The Contractor shall build/integrate new data adapters to enable its CD 2 solution to connect to live or simulated sources of data. The Contractor’s CD 2 software solution shall be used for Intel Analyst Tests. The Contractor shall also deliver all necessary configuration files and training material after receipt of order, in accordance with (IAW) contract data requirements list (CDRL) A001, A002 & C001. The Contractor shall be responsible for providing any additional copies of software required to conduct training during the Intel Analyst Tests (e.g., system for the trainer); any such systems shall be in addition to the assets listed in Table 3.1.3. The Operator Systems shall be used by Operators during training and test execution. The Contractor shall provide 30 Contractor-owned workstations to support all activities during the Intel Analyst Test.

(See CDRL DI-ILSS-80872, F001)

Software Licenses per Intel

Analyst Test

Total Qty: 6 Test Licenses

Table 3.1.3: Intel Analyst Tests Asset List

B. No software changes to the system under test will be allowed once testing has begun, unless approved by the Government.

C. During testing, the Government may provide official Test Incident Reports (TIR) to document anomalies and system failures identified by the Government. The Contractor may be provided TIRs during or at the conclusion of the event. The Government will make a determination on whether any TIRs result in a Priority 1-3 Software Problem Report (SPR), as defined in DA Pamphlet 73-1, Figure Q-31. The final delivered software shall contain no Priority 1-2 SPRs.

D. The Contractor shall provide User Training Material prior to the event. Training shall be conducted in a classroom environment and the Contractor shall assume recipients of the training have no prior experience with the Contractor’s system. Training during the Intel Analyst Test should be divided into blocks and the Contractor is encouraged to utilize a “train-exercise-train” methodology. However, the combination of all training shall not exceed 24 hours over three (3) days per user group. User groups are not expected to exceed 20 people per group. The Contractor shall be responsible for its training environment.

E. The Government will assign a user group to the Contractor’s system. It is possible that the Government may rotate user groups among systems from all base contract holders and may provide the Contractor, to a reasonable extent, with equal access and feedback from user groups.

3.1.4 Intel Analyst Test Support

The Contractor shall provide on-site training and test support for a period not expected to exceed three (3) weeks with no more than eight (8) and no less than one (1) Contractor on-site representatives for the Intel Analyst Test. The Contractor on-site representative(s) shall include:

A. Training Support: The Contractor on-site support shall provide system training for up to 20 operators at a time, not to exceed a total training time of 24 hours over three (3) days. Training should be tailored to knowledge managers, maintainers, and operator/analysts.

B. Operator Support: The Contractor on-site support shall provide support for system operation / issues and troubleshooting throughout the Intel Analyst Test.

C. System Configuration: The Contractor on-site support shall provide support for initial set up for the systems.

3.1.5 Program Management and Meeting Support

The Contractor shall designate a program manager with responsibility to plan, manage, and direct the successful and final completion of the requirements of this SOW. The Contractor’s program manager shall be the single focal point of contact for all required programmatic requirements and work directly with the Government

3.1.5.1 Program Kickoff

The Contractor shall participate in a Government-run program kickoff event, no later than 10 business days after receipt of order. The Contractor shall plan for the kickoff meeting to last anywhere between two (2) to four (4) hours, and will be conducted at Government Location at APG, or remotely.

3.1.5.2 Intel Analyst Test Meetings

The Contractor shall participate in a Pre-Test meeting either in-person or remotely, approximately 10 business days prior to the Intel Analyst Test TRR, to discuss the test plan details and activities leading up to the Intel Analyst Test TRR and Intel Analyst Test.

The meeting is not expected to last more than two (2) hours. The Contractor shall participate in the TRR meeting either in person, or remotely, approximately five (5) business days prior to the start of testing to discuss readiness to begin testing. The TRR is not expected to last more than two (2) hours.

The Contractor shall participate in a Post-Performance Test meeting, on or before five (5) business days after the completion of the Intel Analyst Test, to allow the Government to provide the Contactor with the information collected from the Intel Analyst Test.

All meetings will occur in the Aberdeen, MD area, remotely, or at the contractor’s location, at the Government’s directed. The Contractor shall have maximum flexibility to assign the appropriate person or persons to participate. The meeting should last no longer than two

(2) hours.

3.1.6 Software Version Description (SVD)

The Contractor shall be responsible for delivering an initial version of the SVD document IAW CDRL A001. The Contractor shall deliver an SVD with each software deliverable to include monthly security patch/release deliveries and Development Operations (DEVOPS) updates, IAW CDRL A001.

3.1.7 Logistic Support for Intel Analyst Test

The Contractor shall be responsible for the maintenance and sustainment of software solutions participating in the Intel Analyst Test. This requirement is limited to those assets the Contractor has delivered in support of the Intel Analyst Test. The Contractor shall fix or replace any inoperable software it delivered to participate in the Intel Analyst Test.

3.2 CD 2 Technical Testing

The Contractor shall provide all necessary software licenses, materials, and incidental support required to execute a Government-run Technical Test as detailed in the below paragraphs. This section shall include all activities to include the actual Technical Test, the Technical Test’s Test Readiness Review (TRR), and Information Assurance activities.

3.2.1 Technical Test Preparation

The Contractor shall have a period of time of no longer than eight (8) weeks before a Technical Test, during which time the Contractor can modify and/or tailor its solution as necessary. The goal is for the Contractor’s solution to successfully meet the Government’s requirements identified within the PRD incorporated in Section J of this contract. The Government will make available to the Contractor a representative environment at a Government facility, such as APG, or at another Government facility, such as the 513th MI BDE, Ft Gordon, GA. That environment will be made available to the Contractor for system setup and configuration, integration, test, and training.

3.2.2 Technical Test Readiness Review Support

The Contractor shall provide no more than four (4) and no less than one (1) SME for one

(1) day to support the Government during the TRR for each Technical Test. The TRR may occur at APG, or remotely, approximately five (5) business days prior to the start of each Technical Test. The TRR is expected to last between one (1) to three (3) hours.

3.2.3 Technical Test

The purpose of each Technical Test is to test the proposed DCGS-A CD 2 software to the requirements and solicit feedback on system performance from Government technical experts. The Government may provide decomposed requirements, measures of performance, and technical performance measures to support the testing and evaluation.

The Technical Test may be conducted in the Aberdeen, MD area, other Government locations or at a facility aligned to a military base, such as the 513th MI BDE, Ft Gordon, GA without limit, as may be needed. Testing will be conducted by PM DCGS-A, or other Government Authority. During a Technical Test the Contractor shall demonstrate its technical solution against the requirements defined in the SOW and PRD, incorporated in Section J of the contract. During the Technical Test the Government may generate findings regarding the system performance and provide those findings to the Contractor.

The Technical Test may be comprised of up to two (2) efforts. Effort 1 may be a technical performance checkout. During the Technical Test effort testing, the Contractor will execute a series of performance tasks based on the PRD requirements. The performance tasks will be identified in the test plan that will be provided by the Government. Each task tested may be assessed as “met, not met, or partially met”. Effort 1 may last from two (2) days to three (3) weeks, depending on how the test will be structured. Effort 2 may include cybersecurity testing of the Contractor’s software.

Each Technical Test is not expected to exceed three (3) weeks overall, from set-up through teardown.

The Government will provide email notification to the Contractor about 15 business days prior to the start of each Technical Test. With this notification, the Government will provide each Contractor a schedule that will include training dates, a test plan, and schedule of test events defining the specific timeframes that each Contractor’s System will be tested.

The Government will have final discretion in determining the most efficient test sequence to meet the overall schedule. If multiple base contractor awardees are issued the same Technical Test, then the Government will make reasonable efforts to conduct tests in as similar conditions as possible for each Contractor. The test plan will include processes and resources the Government plans to use during test conditions.

A. The Contractor shall deliver the number of temporary software licenses, listed in Table

3.2.3 for each Technical Test. Each of these temporary software licenses shall support up to 30 clients, simultaneously. The Contractor shall license the software for testing during the entire order period. The Government may use the Contractor’s software for Government-run training development activities, Beta-Testing in the field, and laboratory testing during or after the Technical Test. The Contractor shall be responsible for working at the Government site to install and configure its CD 2 software on Government-provided infrastructure (e.g. Cloud, TSI, IPCv1). The Contractor’s CD 2 software may share computing resources with other software applications and services. The Contractor shall build/integrate new data adapters to enable its CD 2 solution to connect to live or simulated sources of data. The software provided as the offeror’s solution shall be used in the Technical Tests. The Contractor shall also deliver all necessary configuration files and training material after receipt of order, IAW CDRL A001, A002 & C001. The Contractor shall be responsible for providing any additional copies of software required to conduct training during Technical Tests (e.g., system for the trainer); any such systems shall be in addition to the assets listed in Table 3.2.3. The Operator Systems shall be used by Operators during training and test execution. The Contractor shall provide 30 contractor-owned workstations to support all activities during the Technical Test.

(See CDRL DI-ILSS-80872, F001)

Software Test Licenses per Technical Test

Total Qty: 6 Test Licenses

Table 3.2.3: Technical Tests Asset List

B. No software changes to the system under test will be allowed once testing has begun, unless approved by the Government in writing.

C. During testing, the Government may provide official TIRs to document anomalies and system failures identified by the Government. Contractor may be provided TIRs during or at the conclusion of the event. The Government will make a determination on whether any TIRs result in a Priority 1-3 SPR, as defined in DA Pamphlet 73-1, Figure Q-31. The final delivered software shall contain no Priority 1-2 SPRs.

D. The Contractor shall provide User Training Material prior to the event. Training shall be conducted in a classroom environment and the Contractor shall assume recipients of the training have no prior experience with the Contractor’s system. Training during the Technical Test should be divided into blocks and the Contractor is encouraged to utilize a “train-exercise-train” methodology. However, the combination of all training shall not exceed 24 hours over three (3) days per user group. User groups are not expected to exceed 20 people per group. The Contractor shall be responsible for its own training environment. The Government will assign a user group to the Contractor’s system. It is possible that the Government may rotate user groups among systems from all base contract holders and may provide the Contractor, to a reasonable extent, with equal access and feedback from user groups.

3.2.4 Technical Test Support

The Contractor shall provide on-site training and test support for a period not expected to exceed three (3) weeks with no more than eight (8) and no less than one (1) Contractor on-site representatives for the Technical Test. The Contractor on-site representative(s) shall include:

A. Operator Support: The Contractor on-site support shall provide support for system operation / issues and troubleshooting throughout the Analytics and Tools Performance Test.

B. System Configuration: The Contractor on-site support shall provide support for initial set up for the systems.

3.2.5 Program Management and Meeting Support

The Contractor shall designate a program manager with responsibility to plan, manage, and direct the successful and final completion of the requirements of this SOW. The

Contractor’s program manager shall be the single focal point of contact for all required programmatic requirements and work directly with the Government.

3.2.5.1 Program Kickoff

The Contractor shall participate in a Government-run program kickoff event, no later than 10 business days after receipt of order The Contractor shall plan for the kickoff meeting to last anywhere between two (2) to four (4) hours, and will be conducted at Government Location at APG, or remotely.

3.2.5.2 Technical Test Meetings

The Contractor shall participate in a Pre-Technical Test meeting, either in person or remotely, about, 10 business days prior to the Technical Test TRR , to discuss the test plan details and activities leading up to the Technical Test TRR and Test. The meeting is not expected to last more than two (2) hours. The Contractor shall participate in the TRR either in person, or remotely, about five (5) business days prior to the start of testing, to discuss readiness to begin testing. The TRR is not expected to last more than two (2) hours.

The Contractor shall participate in a Post-Technical Test meeting, on or before, five (5) business days after the completion of Technical Test, to allow the Government to provide the contactor with the information collected from the Technical Test.

All meetings will occur at Aberdeen, MD area, remotely, or at the contractor’s location, if directed. Contractor shall have maximum flexibility to assign the appropriate person or persons to participate. The meetings should last no longer than two (2) hours.

3.2.6 SVD

The Contractor shall be responsible for delivering an initial version of the SVD document after receipt of order IAW CDRL A001, and at the time of each of the RMF self-assessment artifacts IAW paragraphs 3.3.1.1, 3.4.1.1, and 3.5.1.1. The Contractor shall deliver an SVD with each software deliverable to include monthly security patch/release deliveries, IAW CDRL A001.

(See CDRL DI-IPSC-81442A, A001)

3.2.7 Program Protection

The Contractor shall perform the below tasks as described and shall flow down to any subcontractors engaged by the Contractor:

A. During the program kickoff meeting, SOW Section 3.2.5.1, the Contractor shall assist and support the Government in performing a Critical Functional Analysis and Critical Program Information (CPI) Assessment on the vendor solution in order to identify Critical Components and CPI.

B. During the Functional Configuration Audit, SOW Section 3.6, the Contractor shall assist the Government to develop, document and update required software assurance activities per Table 8 provided in the Defense Acquisition Guidebook, Chapter 9, Program Protection Plan, Section 9-3.2.5. Note: P is for planned and A is for actual.

C. During the Functional Configuration Audit, SOW Section 3.6, the Contractor shall provide the Government with visibility into the supply chain for Critical Components, and the contractor shall describe how supply chain risk can be introduced through those Critical Components, and describe how the contractor has implemented or plans to implement countermeasures to mitigate such risks. The Government will either approve, modify, or add additional countermeasures.

D. The Contractor shall provide a Program Protection Implementation Plan to the

Government with initial delivery of CD 2 as part of SOW Section 3.11 CD 2 Solution Software, and provide reports to the Government IAW CDRL DI-ADMN-81306, E001.

3.2.8 Logistic Support for Technical Test

The Contractor shall be responsible for the maintenance and sustainment of software solutions being presented during the Technical Test. This requirement is limited to those assets the vendor has delivered in support of the Technical Test. The Contractor shall fix any inoperable software it delivered to participate in the Technical Test.

3.3 CD 2 NIPRNet RMF Authorization

The CD 2 Solution Software includes all activities leading up to and including the procurement of the separately priced software solutions, completion of fielding and the transition to sustainment, to include training support, licensing, configuration management, and RMF activities.

3.3.1 Cybersecurity Support

The Contractor shall support and participate in NIPRNet authorization process and cybersecurity testing. The Contractor shall provide support for the RMF self-assessment.

3.3.1.1 RMF Self-Assessment Support

The Contractor shall provide self-assessment support to include but not limited to providing system artifacts and documentation, completing and providing Assured Compliance Assessment Solution (ACAS) vulnerability scans, complying with security controls IAW CNSSI 1253, and assisting in developing Plan of Actions & Milestones (POA&M) to meet RMF security control requirements. The Government will provide or make available to the Contractor the required security tools needed for RMF compliance activities.

The Contractor shall deliver the following system artifact documentation via SIPRNet no later than 15 business days after receipt of order IAW CDRL B002 MGMT-82001 DOD RMF Package Deliverables:

• SVD, CDRL A001

• Software User Manual, CDRL A002

• Security Plan, CDRL B002:

o System Architecture Description, o Components, o Configurations, o Accreditation/Authorization Boundaries, o Compliant Network Diagrams, o External Interfaces and Data Flow, o Internal Data Flow, o Contingency Plan (to include backup/restore/recovery procedures), o Incident Response Plan, o Hardware Lists (NETCOM HW/SW Template), o Software/Firmware Lists, o Ports, Protocols, and Services (PPS), o Configuration Management Plan, o Information Assurance Vulnerability Management (IAVM) Plan o RMF Implementation Plan

• Cybersecurity Test Plan, CDRL B002:

o Required Vulnerability Scans (ACAS), o Security Technical Implementation Guides (STIGs), o Security Readiness Guides (SRGs), o Secure Content Automation Protocol (SCAP) benchmarks,

• POA&M, CDRL B002

• Software User Manuals, CDRL A002

• Administrator Manuals/Guides

• Operations Security (OPSEC) Plan, CDRL B001

• Configuration Management Implementation Plan

• Maintenance Implementation Plan

• Audit and Accountability Implementation Plan

• System and Information Integrity Implementation Plan

• Identification and Authentication Implementation Plan

• Access Control Implementation Plan

• System and Services Acquisition Implementation Plan

• System and Communications Protection

• Media Protection Implementation Plan

• Incident Response Plan

• System Training Plans & Guides

• FSE Guides

• Testing and Evaluation Plan (security assessment, regression, flaw remediation)

• Secure configuration, installation, operation and maintenance procedures

• Anti-counterfeit Implementation Procedures

• Supply Chain Protection Implementation Plan

• Controlled Unclassified Information Implementation Plan

(See CDRL, B002, DI-MGMT-82001, & A001, DI-IPSC-81442A)

The Contractor shall comply with all applicable technical, procedural, and system documentation associated with Federal, Department of Defense (DoD), and Army Cybersecurity policy and requirements, including but not limited to:

A. Provide system information at the component level including security concepts and procedures and all system component user and maintenance manuals to the security engineering team after receipt of order, IAW CDRL B002. This system information shall become the baseline system configuration.

B. Provide system administration, access, and engineering support to the System Engineering team and installation management personnel from self-assessment activities through final system acceptance.

C. Provide system information and security assistance to the Security Control Assessor (SCA) team to support the Authorizing Official’s (AO) authorization decision process.

Provide a copy of complete system documentation including component manuals, configuration guides, administration guides, user guides, and any system unique documentation after receipt of order, IAW CDRL B002 Information System documentation shall describe secure configuration, installation, and operation of the system, component, or service; the application of information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

The Contractor shall provide vulnerability scans and deliver ACAS results to the Government, comply with security controls, and apply Defense Information Systems Agency (DISA) STIGs. Also, the Contractor shall assist the Government in developing the POA&M to meet RMF requirements.

3.3.2 RMF Compliance

The Contractor shall perform cybersecurity assessment and authorization activities IAW DoDI 8510.01 RMF) for DoD Information Technology (IT) and CNSSI 1253 Security Categorization and Control Selection for National Security Systems. During the early stage of RMF process, the Contractor’s system will be assessed for categorization for Confidentiality, Integrity, and Availability (CIA) impact levels and applicable security controls will be identified. The Contractor shall enable their solution to meet the requirements from the security controls by applying the required DISA STIGs which are applicable to the system. All applicable security controls identified in the CNSSI 1253 publication and STIGs shall be assessed to ensure security controls and STIGS are examined, and tested, ensuring authorization decision requirements are addressed.

The Contractor shall provide cybersecurity control artifacts that are compliant with the CNSSI 1253 publication. No tools are authorized for generation of artifacts except those posted to the Army OIA&C site or Knowledge Service (KS) site. Artifacts provided must meet the requirements of Army and DoD guidance IAW CDRL B002.

3.3.3 Cybersecurity Compliance

The DCGS-A CD 2 Solution shall meet all applicable security control requirements so that an Authorization to Operate (ATO) can be obtained. Once an authorization decision has been obtained, the Contractor shall continue to sustain the security posture of the system baseline to maintain the compliance of the ATO requirement. The Contractor shall maintain an IAVM patching process at least on a monthly basis to support Command Cyber Readiness Inspection (CCRI) compliance.

3.4 CD 2 Secret RMF Authorization

transition to sustainment to include training support, licensing, configuration management, and RMF activities.

3.4.1 Cybersecurity Support

The Contractor shall support and participate in Secret authorization process and cybersecurity testing. The Contractor shall provide support for the RMF self-assessment.

3.4.1.1 RMF Self-Assessment Support

The Contractor shall provide self-assessment support to include but not limited to providing system artifact documentation, completing and providing ACAS vulnerability scans, complying with security controls IAW CNSSI 1253, and assisting in developing POA&M to meet RMF security control requirements. The Government will provide or make available to the Contractor the required security tools needed for RMF activities.

The Contractor shall deliver the following system artifact documentation no later than 15 business days after receipt of order IAW CDRL B002 (DI-MGMT-82001) DOD RMF Package Deliverables:

• SVD, CDRL A001

• Software User Manual, CDRL A002

• Security Plan, CDRL B002:

o System Architecture Description, o Components, o Configurations, o Accreditation/Authorization Boundaries, o Compliant Network Diagrams, o External Interfaces and Data Flow, o Internal Data Flow, o Contingency Plan (to include backup/restore/recovery procedures), o Incident Response Plan, o Hardware Lists (NETCOM HW/SW Template), o Software/Firmware Lists, o Ports, Protocols, and Services (PPS), o Configuration Management Plan, o Information Assurance Vulnerability Management (IAVM) Plan o RMF Implementation Plan

• Cybersecurity Test Plan, CDRL B002:

o Required Vulnerability Scans (ACAS), o STIGs, o Security Readiness Guides (SRGs), o Secure Content Automation Protocol (SCAP) benchmarks,

• POA&M, CDRL B002

• Software User Manuals, CDRL A002

• Administrator Manuals/Guides

• Operations Security (OPSEC) Plan, CDRL B001

• Configuration Management Implementation Plan

• Maintenance Implementation Plan

• Audit and Accountability Implementation Plan

• System and Information Integrity Implementation Plan

• Identification and Authentication Implementation Plan

• Access Control Implementation Plan

• System and Services Acquisition Implementation Plan

• System and Communications Protection

• Media Protection Implementation Plan

• Incident Response Plan

• System Training Plans & Guides

• FSE Guides

• Testing and Evaluation Plan (security assessment, regression, flaw remediation)

• Secure configuration, installation, operation and maintenance procedures

• Anti-counterfeit Implementation Procedures

• Supply Chain Protection Implementation Plan

• Controlled Unclassified Information Implementation Plan

(See CDRL DI-MGMT-82001, B002, A001, DI-IPSC-81442A)

The Contractor shall comply with all applicable technical, procedural, and system documentation associated with Federal, Department of Defense (DoD), and Army Cybersecurity policy and requirements, including but not limited to:

A. Provide system information at the component level including security concepts and procedures and all system component user and maintenance manuals to the security engineering team after receipt of order, IAW CDRL B002. This system information shall become the baseline system configuration.

B. Provide system administration, access, and engineering support to the System

Engineering team and installation management personnel from self-assessment activities through final system acceptance.

C. Provide system information and security assistance to the Security Control Assessor (SCA) team to support the Authorizing Official’s (AO) authorization decision process.

D. Provide a copy of complete system documentation including component manuals, configuration guides, administration guides, user guides, and any system unique documentation after receipt of order, IAW CDRL B002. Information System documentation shall describe secure configuration, installation, and operation of the system, component, or service; the application of information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

The Contractor shall provide vulnerability scans and deliver ACAS results to the Government, comply with security controls, and apply DISA STIGs. Also, the Contractor shall assist the Government in developing the POA&M to meet RMF requirements.

3.4.2 RMF Compliance

The Contractor shall perform cybersecurity accreditation IAW DoDI 8510.01 RMF for DoD Information Technology (IT) and CNSSI 1253 Security Categorization and Control Selection for National Security Systems. During the early stage of RMF process, the Contractor’s system will be assessed for categorization for CIA impact levels and applicable security controls will be identified. The Contractor shall enable their solution to meet the requirements from the security controls by applying the required DISA STIGs which are applicable to the system. All applicable security controls identified in the CNSSI 1253 publication and STIGs shall be assessed to ensure security controls and STIGS are examined, and tested, ensuring authorization decision requirements are addressed.

The Contractor shall provide cybersecurity control artifacts that are compliant with the CNSSI 1253 publication. No tools are authorized for generation of artifacts except those posted to the Army OIA&C site or KS site. Artifacts provided must meet the requirements of Army and DoD guidance IAW B002.

3.4.3 Cybersecurity Compliance

The DCGS-A CD 2 Solution shall meet all applicable security control requirements so that an ATO can be obtained. Once an authorization decision has been obtained, the Contractor shall continue to sustain the security posture of the system baseline to maintain the compliance of the ATO requirement. The Contractor shall maintain IAVM patching process at least on a monthly basis to support CCRI compliance.

3.5 CD 2 Top Secret RMF Authorization

transition to sustainment, to include training support, licensing, configuration management, and Top Secret RMF activities.

3.5.1 Cybersecurity Support

The Contractor shall support and participate in Top Secret accreditation assessment and cybersecurity testing. The Contractor shall provide support for the RMF self-assessment.

3.5.1.1 RMF Self-Assessment Support

The Contractor shall provide self-assessment support to include but not limited to providing system artifact documentation, completing and providing ACAS security scans, complying with security controls IAW, and assisting in the development of a POA&M to meet RMF security control requirements. The Government will provide or make available to the Contractor the required security tools needed for RMF activities.

The Contractor shall deliver the following system artifact documentation no later than 15 business days after receipt of order IAW CDRL B002 (DI-MGMT-82001) RMF Assessment & Authorization Products, and CYBERSAFE Objective Quality Evidence

Assessment & Authorization Product and Cybersecurity Test Plan. Information Assurance (IA) Documentation: Risk Management Framework Documentation:

• Software List (Name, Model, and Version)

• SVD, CDRL A001

• Software Installation/Configuration Plans

• Software Test Plans

• Software Test Report

• Software User Manuals A002

• Administrator Manuals/Guides

• Illustrated System Architecture Diagram (with accreditation boundary)

• Detailed System Architecture Diagram (with accreditation boundary)

• Data Flow Diagram

• Data Types

• Ports, Protocols, and Services List

• Operations Security (OPSEC) Plan, CDRL B001

• Security configuration guides

• Process & Procedures for backup/restore/recovery

• Nessus/STIG Scans and Checklist

• Patch update

• System Change Requests

• System Change Implementation/Rollback Plans

• Audit file/log retrieval/archiving

• Password management

• Access Control Implementation

• Configuration Management Plan/Process

• System Training Plans & Guides

• Maintenance

• System/Services Supply Chain Acquisition process

• FSE Guides

• Regression Test Plans

• TEMPEST Letter

• SCIF Letter

(See CDRL DI-IPSC-81442A, A001 & DI-MGMT-82001, B002)

The Contractor shall comply with all applicable technical, procedural, and system documentation associated with Federal, Department of Defense (DoD), and Army Cybersecurity policy and requirements, including but not limited to:

A. Provide system information at the component level including security concepts and procedures and all system component user and maintenance manuals to the security engineering team after receipt of order, IAW CDRL B002. This system information shall become the baseline system configuration.

B. Provide system administration, access, and engineering support to the certification engineering team and installation management personnel from certification activities through final system acceptance.

C. Provide system information and security assistance to the certification authority and certification agents during certification recommendation and accreditation decisions.

D. Provide a copy of complete system documentation including component manuals, configuration guides, administration guides, user guides, and any system unique documentation after receipt of order, IAW CDRL B002.

The Contractor shall provide support to conduct ACAS scans and deliver results to the Government, comply with security controls, and apply DISA STIG. Also, the Contractor will assist the Government in developing the POA&M to meet RMF requirements.

3.5.2 RMF Compliance

The Contractor shall perform cybersecurity accreditation IAW DoDI 8510.01 RMF for DoD Information Technology (IT). During the early stage of RMF process, the Contractor’s system will be assessed for security categorization for CIA impact levels and a proper set of security controls will be identified. The Contractor shall enable their solution in meeting the requirements from the applicable security controls by applying the required DISA STIGs which are applicable to the system. All applicable security controls identified in the SP 800-53 publication and STIGs shall be assessed to ensure security controls and STIGS are examined, interviewed and tested, ensuring ATO requirements are addressed.

The Contractor shall provide cybersecurity control artifacts that are compliant with the DoD SP 800-53 publication. No tools are authorized for generation of artifacts except those posted to the Army OIA&C site or KS site. Artifacts provided must meet the requirements of Army and DoD guidance IAW B002.

3.5.3 Information Assurance Compliance

The Contractor’s CD 2 solution shall meet all applicable security control requirements so that an ATO can be obtained.