Attachment 0001 - Statement of Work - 10 October 2023.pdf

UNCLASSIFIED

STATEMENT OF WORK

FOR

INTELLIGENCE SYSTEMS & ANALYTICS

INTELLIGENCE APPLICATIONS

WEATHER OPERATIONAL EFFECTS

Solicitation Number: W56KGY-24-R-0001 Indefinite Delivery Indefinite Quantity (IDIQ) Contract

10 October 2023

Project Manager Intelligence Systems & Analytics 6580 Surveillance Loop, Building 6006 Aberdeen Proving Ground, MD 21005 ii

Contents

1. Scope

1.1 Background

2. Applicable Documents

3. Requirements

3.0 WxOE Programmatic

3.0.1 WxOE Programmatic Kickoff

3.1 WxOE Technical Test

3.1.1 WxOE Technical Test Preparation

3.1.2 WxOE Test Readiness Review (TRR)

3.1.3 WxOE Technical Test Execution

3.1.4 WxOE – Post Technical Test Meetings and Support

3.1.5 Software Version Description (SVD)

3.1.6 Logistic Support for Technical Test

3.2 WxOE – Soldier Touch Point (STP)

3.2.1 Soldier Touch Point Preparation

3.2.2 Soldier Touch Point – Test Readiness Review (TRR) Support

3.2.3 Soldier Touch Point - Execution

3.2.4 Soldier Touch Point – Test Support

3.2.5 Post Soldier Touch Point Meeting and Support

3.2.6 Software Version Description (SVD)

3.2.7 Logistic Support for Soldier Touch Point

3.3 WxOE Program Protection

3.4 WxOE NIPRNet RMF Authorization

3.4.1 NIPR Cybersecurity Support

3.4.2 NIPR RMF Compliance

3.4.3 Cybersecurity Compliance

3.5 WxOE Secret RMF Authorization

3.5.1 Cybersecurity Support

3.5.2 Secret RMF Compliance

3.5.3 Cybersecurity Compliance

3.6 WxOE Functional Configuration Audit

iii

3.7 WxOE Solution Army Interoperability Certification (AIC)

3.8 WxOE Solution Training

3.9 Operational Assessment (OA)

3.9.1 Operational Test Readiness Review

3.9.2 Operational Assessment Execution

3.9.3 Operational Assessment Test Support

3.9.4 IA Support for Operational Assessment

3.10 WxOE Solution Software

3.10.1 WxOE Solution Delivery

3.10.2 DEVOPS

3.10.3 Program Protection Implementation

3.11 Annual Sustainment

3.11.1 Annual Maintenance Upgrades

3.11.2 IA Support for Annual Sustainment

3.11.3 Reach Back Support for Annual Sustainment

3.12 Initial Integration Support

3.12.1 Warranties

3.13 Configuration Management

3.13.1 Software Problem Report (SPR)

3.13.2 Monthly Security Patch/Release Delivery

3.13.3 Field-discovered SPRs

3.14 Engineering Change Proposals (ECP)

3.14.1 Contractor-proposed WxOE Modifications due to Enhancements, Obsolescence, and Major Software Releases

3.14.2 Government-proposed Enhancements and Modifications

3.15 Exercise Support

3.15.1 Warranty Patch/Release Delivery

3.16 Army Contractor Manpower Reporting (CMR) System

3.17 Cyber Security Support

3.18 Software Safety

4. Contract Deliverables iv

4.1 Licensing

4.2 Assurance Warranties

List of Tables Table 1. Program Documents

Table 2. Department of Defense Directives

Table 3. Department of Defense Instructions

Table 4. Army Regulations (AR)

Table 5. Other Documents

Table 6. Technical Test Asset List ...................................................................... Error! Bookmark not defined.

Table 7. Soldier Touch Point Asset List .............................................................. Error! Bookmark not defined.

Table 8. Operational Assessment Asset List ....................................................... Error! Bookmark not defined.

1. Scope The contractor shall provide a commercial item that is a software only solution to meet the Weather Operational Effects (WxOE) interoperability, security, training, usability, product management, and data ingest capabilities as required in this Statement of Work. The Contractor shall also provide support services, incidental services, and deliverables for the procurement of a commercial item solution to satisfy the WxOE requirements.

1.1 Background

Program Manager (PM) Intelligence Systems and Analytics (IS&A) is a Family of Systems that provides our Army with advanced analytics, support to targeting and situation understanding to commanders. It processes, exploits, and disseminates information and intelligence about the threat, weather, and terrain and provides tactical and operational ground stations that downlink data from national, joint partners and Army sensors. As technology evolves and new warfighting requirements emerge, the PM’s capability set need to be updated to meet the user needs.

The WxOE requirements address the need to modernize and enhance the capabilities of Army’s intelligence architecture. The contractor’s solution shall meet the capabilities called out in the Performance Requirement Documentation (PRD). The PRD may be tailored as applicable at the delivery order level. The Contractor’s WxOE software should provide a platform agnostic solution to support intel modernization efforts (e.g., CPCE, AC2SP, Edge Node).

The WxOE capability shall align with multiple overarching directives, to include the Army’s Common Operating Environment (COE). The WxOE shall support net-centric military operations by being interoperable with current Army, Unified Action Partners, Joint Service, Allied, Coalition, and Command and Control information and ISR systems. The WxOE application shall operate across the SCI, Secure Internet Protocol Router Network (SIPRNet), Secret Coalition Networks, and Unclassified security domains, and within and across all COE computing environments.

PM IS&A WxOE Application will provide real-time weather forecasts, advisories, and warnings; and provide weather impacts for threat and friendly warfighting capabilities supporting mission analysis, COA development, and decision-making.

2. Applicable Documents The following documents are applicable to this SOW.

Table 1. Program Documents Number Title Date

Base Performance Requirements Document (Base PRD) 16 October 2023

Table 2. Department of Defense Directives Number Title Date

DoD 5220.22-M National Industrial Security Program Operating Manual 28 February 2006 DoDD 8570.01 Information Assurance (IA) Training, Certification and Workforce

Management 15 August 2004

DoD 8570.01-M Information Assurance Workforce Improvement Program, Change

19 December 2005 w/ change 10 November

DoDD 8140.01 Cyberspace Workforce Management 11 August 2015

Number Title Date DoDI 4140.67 DoD Counterfeit Prevention Policy 26 April 2013 DoDI 4140.01 DoD Supply Chain Materiel Management Policy 14 December 2011 DoDI 8582.01 Security of Unclassified DoD Information on Non-DoD Information

Systems 6 June 2012

DoDI 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN)

5 November 2012

Table 3. Department of Defense Instructions Number Title Date

DoDI 3020.41 Operational Contract Support 20 December 2011 DoDI 8510.01 Risk Management Framework (RMF) for DoD Information

Technology 12 March 2014

Table 4. Army Regulations (AR) Number Title Date

AR 25-1 Army Information Technology 25 June 2013 AR 25-2 Information Assurance 4 April 2019 AR 70-1 Army Acquisition Policy 16 June 2017 AR 73-1 Test and Evaluation Policy 16 November 2016 AR 530-1 Operations Security 26 September 2014 AR 380-67 Personnel Security Program 24 January 2014 AR 381-12 Threat Awareness and Reporting Program (TARP) 01 June 2016 AR 70-77 Program Protection 08 June 2018 DA PAM 25-1-2 Information Technology Contingency Planning 06 June 2012

Table 5. Other Documents Number Title Date

NIST Special Publication 800- 53A Rev 4

Assessing Security and Privacy Controls in Federal Information Systems and Organizations

December 2014

Cybersecurity T&E Guidebook

Department of Defense Cybersecurity Test and Evaluation Guidebook

1 July 2015

DA Pam 73-1 Test and Evaluation in Support of Systems Acquisition 30 May 2003 DOT&E Memo Procedures for Operational Test and Evaluation of

Cybersecurity in Acquisition 1 August 2014

DAG 2017 Defense Acquisition Guidebook 21 August 2017 MIL-STD-810 Department of Defense Test Method Standard, Environmental

Engineering Considerations and Laboratory Tests 31 October 2008

NIST Interagency Report 7622

Notional Supply Chain Risk Management Practices for Federal Information Systems

October 2012

NIST Special Publication 800- 18 rev 1

Guide for Developing Security Plans for Federal Information Systems

February 2006

NIST Special Publication 800-

Supply Chain Risk Management Practices for Federal Information Systems and Organizations

April 2015

3. Requirements This SOW addresses all products, support, and activities that shall be required throughout the period of performance (PoP) for the IDIQ Contract. The Contractor shall provide all the necessary resources and knowledge to support the listed products, support, and activities.

The goal of this SOW and the applicable/referenced documents is to detail and implement commercial item solutions that will satisfy the Government’s requirements. The following requirements will be issued at the order level to establish the most viable commercial item solution(s) to meet the Government’s requirements.

3.0 WxOE Programmatic

The Contractor shall designate a program manager with responsibility to plan, manage, and direct the successful and final completion of the requirements of this SOW. The Contractor’s program manager shall be the single focal point of contact for all required programmatic requirements and work directly with the Government.

3.0.1 WxOE Programmatic Kickoff

The Contractor shall participate in a Government-run program kickoff event, no later than ten (10) business days after receipt of order. The Government will provide a product roadmap that conveys the expected path and schedule towards capability delivery. The Contractor shall plan for the kickoff meeting to last anywhere between two (2) to four (4) hours and will be conducted at Government Location at Aberdeen Proving Ground (APG), or remotely.

3.1 WxOE Technical Test

The Government will determine the scope of tested requirements for each Technical Test. The Contractor shall provide all necessary software licenses, materials, and incidental support required to execute a Weather Operational Effects Technical Test as detailed in the below paragraphs. This section shall include all analyst activities to include the WxOE Technical Test Preparation, WxOE Technical Test Support, the WxOE Technical Test Readiness Reviews (TRR), and information assurance activities of the WxOE Technical Test event.

3.1.1 WxOE Technical Test Preparation

The Contractor shall have a period of no longer than sixty (60) days before each Technical Test, during which the Contractor can modify and/or tailor its commercial software as necessary. The Government will determine the scope of the Technical Test to include expected results that will be measured, and meet decomposed requirements specific to the Technical Test. The vendor shall determine the factors that are expected to have an impact on results, to include thread and test step development to successfully meet requirements as mapped out in the PRD.

Based on the government-defined scope of the technical test, the Contractor shall develop technical test threads that is aligned to the PRD. The Contractor shall deliver the draft test threads to the Government no later than thirty (30) days prior to the start of technical tests. The Government will review the threads and may modify, delete, or add additional threads, as deemed necessary to fulfill the scope of the requirement. The Contractor shall provide a test limitation document and test plan that includes a daily schedule and test events defining the specific timeframes to be tested against the PRD. The Government will review the plan and have final discretion in determining the test scope and most efficient test sequence to meet the overall schedule.

The Contractor’s test plan will include processes and resources to use during test conditions.

Approximately seven (7) days prior to start of the event, the Contractor shall install the latest version of the software to be used during testing. No software changes to the system under test will be allowed once testing has begun, unless approved by the Government in a digitally signed email by the Government Task Lead or Intel Apps Chief Engineer. The Government will make available to the Contractor a representative test environment, such as an environment hosted on hardware at either APG or at an operational site. That environment will be made available in advance of the testing to the Contractor for system setup and configuration, integration, test, and training.

3.1.2 WxOE Test Readiness Review (TRR)

The Technical Readiness Review shall occur approximately seven (7) days prior to the Technical Test.

Approximately fourteen (14) days prior to the WxOE Technical Test Readiness Review, the Contractor shall participate in a Pre-Test meeting to discuss the test plan details, test limitations, and activities leading up to the WxOE Technical Test Readiness Review. At the Government’s discretion, the meeting will be held either in person or remotely.

3.1.3 WxOE Technical Test Execution

The purpose of the WxOE Technical Test is to test the Contractor’s commercial WxOE solution to the Government provided PRD. The WxOE Technical Test will be conducted in a Government-provided facility in vicinity of Aberdeen, MD or at a facility aligned to a military base. During the Technical Test, the software shall demonstrate its ability to meet the specified SOW and PRD requirements. Testing will be conducted by the WxOE Vendor in collaboration with PM IS&A. The Contractor will be provided the test location during the program kick off meeting or no less than sixty (60) days prior to allow proper planning. Each WxOE Technical Test is not expected to exceed fourteen (14) days overall, from set-up through teardown.

No software changes to the system under test will be allowed once testing has begun, unless approved by the Government, unless approved by the Government in a digitally signed email by the Government Task Lead or Intelligence Application (Intel Apps) Chief Engineer.

During testing, the Government may provide official Test Incident Reports (TIRs) to document anomalies and system failures identified by the Government. The Contractor may be provided TIRs during or at the conclusion of the event. The Government will make a determination on whether any TIRs result in a Priority 1-5 Software Problem Report (SPR), as defined in DA Pamphlet 73-1, Figure Q-31.

3.1.4 WxOE – Post Technical Test Meetings and Support

The Contractor shall participate in a Post-Performance Test meeting, within fourteen (14) days after the completion of the Technical Test, to allow the Government to provide the Contactor with the information collected from the WxOE Technical Test. During the Post Technical Test Meeting, the Government may present the findings of SPR or/and TIR results as defined in DA Pamphlet 73-1, Figure Q-31. The contractor shall have a time period of no longer than sixty (60) days before the next WxOE Technical Test or milestone event, during which the Contractor can modify and/or tailor its commercial solution as necessary. If the Contractor cannot resolve all priority one (1) and two (2) SPR/TIRs prior to the next milestone event (e.g., Technical Test, AIC, Soldier Touch Point, Operational Testing), the Contractor must submit a “road map” or “get-well plan” to the Government no less than sixty (60) days prior to the start of the next event. The “road map” or “get-well plan” should include detailed timeline on how the Contractor plans to successfully resolve, validate, and track existing SPR/TIRs based on negotiated timeline with the Government. The work shall be deemed complete when the Vendor resolves all priority one (1) and two (2) SPR/TIRs.

All meetings will occur in the Aberdeen, MD area, remotely, or at the contractor’s location, at the Government’s direction. If remote, the Contractor shall provide a virtual platform where the Government representatives can access.

3.1.5 Software Version Description (SVD)

The Contractor shall be responsible for delivering an initial version of the SVD document IAW CDRL A001. The Contractor shall deliver an SVD with each software deliverable to include monthly security patch/release deliveries, known limitations, and Development Operations (DEVOPS) updates, IAW CDRL A001.

3.1.6 Logistic Support for Technical Test

The Contractor shall be responsible for the installation and maintenance of software solutions leading up to and during the WxOE Technical Test.

3.2 WxOE – Soldier Touch Point (STP)

The Contractor shall provide all necessary software licenses, materials, and incidental support required to execute a Government-run Test as detailed in the below paragraphs. This section shall include all activities to include the STP.

3.2.1 Soldier Touch Point Preparation

The Contractor shall have a period of no longer than sixty (60) days before a Soldier Touch Point, during which time the Contractor can modify and/or tailor its solution as necessary. The goal is for the Government to provide usability feedback (e.g., SUS, TAM, STP Report) to the Contractor and for the Contractor’s solution to successfully meet the Government’s requirements identified within the PRD. The Government shall provide a representative environment at a Government facility/location, using Government-provided hardware, to be used for system setup, configuration, integration, test, and training.

3.2.2 Soldier Touch Point – Test Readiness Review (TRR) Support The STP TRR shall occur approximately seven (7) days prior to the STP. Approximately fourteen (14) days prior to the WxOE STP Test Readiness Review, the Contractor shall participate in a Pre-Test meeting to discuss the test plan details, test limitations, and activities leading up to the WxOE STP Test Readiness Review. At the Government’s discretion, the meeting will be held either in person or remotely.

3.2.3 Soldier Touch Point - Execution

The purpose of each STP is to test the proposed WxOE Intel App software to the requirements and solicit user feedback. The STP event is to effectively capture user feedback and meet System Usability Scale (SUS)/Technology Acceptance Model (TAM) requirements indicated in the WxOE PRD.

The STP may be conducted at Government locations or at a facility aligned to a military base. Testing will be conducted by PM IS&A. The STP will be used as an immersive testing and feedback mechanisms through which Soldiers can provide valuable insights on how certain tools or equipment will be used practically in the field. During the STP the Government may generate findings regarding the system usability and provide those findings to the Contractor.

Each STP is not expected to exceed three (3) weeks overall, from set-up through teardown. This does not include the preparation time discussed in SOW para. 3.2.1.

The Government will provide email notification to the Contractor twenty-one (21) days prior to the start of each Soldier Touch Point. With this notification, the Government will provide each Contractor a schedule that will include training dates, a test plan, and schedule of test events defining the specific timeframes that each Contractor’s System will be tested. The Government will have final discretion in determining the most efficient test sequence to meet the overall schedule.

No software changes to the system under test will be allowed once testing has begun. During testing, the Government may provide official TIRs to document anomalies and system failures identified by the Government. Contractor may be provided TIRs during or at the conclusion of the event. The Government will decide on whether any TIRs result in a Priority 1-5 SPR, as defined in DA Pamphlet 73-1, Figure Q-31.

The Contractor shall provide User Training Material prior to the event. Training shall be conducted in a classroom environment. The recipients of the training will have no prior experience with the Contractor’s system. The combination of all training shall not exceed twenty-four (24) hours over three (3) days per user group. User groups are not expected to exceed ten (10) people per group. The Contractor shall be responsible for providing its own training resources, such as laptops, software, and instructor(s) for its training activity. The Government will assign a user group to the Contractor’s system. Section 3.8 provides more details on training.

3.2.4 Soldier Touch Point – Test Support

The Contractor shall provide on-site test support for a period not expected to exceed three (3) weeks with no more than three (3) and no less than one (1) Contractor on-site representatives for the Soldier Touch Point.

The Contractor on-site representative(s) shall include:

• Operator Support: The Contractor on-site support shall provide support for system operation / issues and troubleshooting throughout the STP.

• System Configuration: The Contractor on-site support shall provide support for initial set up for the systems.

3.2.5 Post Soldier Touch Point Meeting and Support

The Contractor shall participate in a Post-STP Test Meeting (Usability Working Group), within fifteen (15) business days after the completion of STP, to allow the Government to provide the contactor with the information collected from the STP. The government and contractor shall communicate all qualitative Soldier feedback collected at STPs through a Usability Tracker (as proposed and maintained by the contractor). The contractor shall track the progress and status of all Soldier feedback. All feedback items shall be made available to the government through access to the contractor’s Usability Tracker system.

No later than thirty-five (35) days following an STP, Technical Reports containing the usability metrics collected will be released. The contractor shall have a negotiated period based on the expected schedule discussed at program kickoff, during which the Contractor can modify and/or tailor its commercial solution as necessary to meet the SUS and TAM requirements indicated in the PRD.

During the Post STP Meeting, the Government may present the findings of SPR or/and TIR results as defined in DA Pamphlet 73-1, Figure Q-31. The contractor shall have a time period of no longer than sixty (60) days before the next Technical Test or milestone event, during which the Contractor can modify and/or tailor its commercial solution as necessary. If the Contractor cannot resolve all priority one (1) and two (2) SPR/TIRs prior to the next milestone event (e.g., Technical Test, AIC, STP, Operational Testing), the Contractor must submit a “road map” or “get-well plan” to the Government no less than sixty (60) days prior to the start of the next event. The “road map” or “get-well plan” should include detailed timeline on how the Contractor plans to successfully resolve, validate, and track existing SPR/TIRs based on negotiated timeline with the Government.

The work shall be deemed complete when the Vendor resolves all priority one (1) and two (2) SPR/TIRs. All meetings will occur at Aberdeen, MD area, remotely, or at the contractor’s location, if directed. Contractor shall have maximum flexibility to assign the appropriate person or persons to participate. The meetings will last no longer than four (4) hours.

3.2.6 Software Version Description (SVD)

The Contractor shall be responsible for delivering an initial version of the SVD document after receipt of order IAW CDRL A001, and at the time of each of the RMF self-assessment artifacts IAW paragraphs 3.4.1.1, and

3.5.1.1. The Contractor shall deliver an SVD with each software deliverable to include monthly security patch/release deliveries and known limitations IAW CDRL A001.

(See CDRL DI-IPSC-81442A, A001)

3.2.7 Logistic Support for Soldier Touch Point

The Contractor shall be responsible for the maintenance and sustainment of software solutions participating in the WxOE STP. This requirement is limited to those assets the Contractor has delivered in support of the WxOE STP. The Contractor shall fix or replace any inoperable software it delivered to participate in the Intel Application WxOE STP.

3.3 WxOE Program Protection

The tasks listed below shall be performed by the Contractor as described and will flow down to any sub-contractors engaged by the Contractor:

a. The Contractor shall assist and support the USG in performing a Critical Functionality Analysis (CFA) and Critical Program Information (CPI) Assessment on the system in order to identify Critical Components and CPI. The USG shall provide the contractor with written guidance reference implementation of countermeasures to protect CPI. Additionally, the contractor shall implement USG specified Supply Chain Risk Management Countermeasures to safeguard USG identified Critical Components. The contractor shall provide periodic Program Protection Implementation Plan (PPIP) updates IAW DI-MGMT-80004A, Management Plan, Contract Deliverable (CDRL), A183. The contractor shall provide a PPIP to the USG within 30 days of receiving countermeasures and provide periodic PPIP status reports to program manager via CDRLs. The contractor shall support USG execution of Program Protection Surveys.

b. The Contractor shall provide technical support for the USG PPP process performed IAW DoDI 5000.02 Operation of the Adaptive Acquisition Framework, DoDI 5000.83 Technology and Program Protection to Maintain Technological Advantage, DoDI 5200.39 Critical Program Information (CPI) Identification and Protection Within Research, Development, Test, and Evaluation (RDT&E), DoDI 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN), DoD Technology and Program Protection Guidebook, and Key Practices and Implementation Guide for the DoD Comprehensive National Cyber Security Initiative 11 Supply Chain Risk Management.

c. The Contractor shall demonstrate he has visibility into the supply chain for Critical Components, understands how supply chain risk can be introduced through those Critical Components, and has implemented or plans to implement countermeasures to mitigate such risks. This requirement shall flow down to all subcontractors.

d. The Contractor shall develop, document and update software assurance countermeasures table listed below after USG identifies Critical Program Information and Critical Components. Note: P is for planned and A is for actual.

i. Common Vulnerabilities and Exposures (CVE) information is used to identify, track, and coordinate mitigation activities of the publicly known vulnerabilities in commercial off the shelf (COTS). Programs should use tools during incremental software testing of their commercial and open source packages to scan operational components and the tool can provide an indication of risk.

ii. Common Weakness Enumeration (CWE) catalog captures more than 700 types of weaknesses in code, design, architecture, and implementation.

iii. Common Attack Pattern Enumeration and Classification (CAPEC) is used for the analysis of common patterns of attacks against systems, whether for understanding how attacks are committed, scoping of relevant threats, templates for malicious testing, or as a foil for thinking about the susceptibility of system’s architecture, design, and technical implementation to specific attacks. CAPEC is a powerful mechanism to capture and communicate the attacker’s perspective, organize the analysis of a system with respect to attacks, and prioritize weaknesses (CWEs) based on the anticipated attack patterns.

iv. Development Process – assurance activities conducted during the development process to mitigate and minimize attacks (For example, threat assessment and modeling, attack surface analysis, architecture and design reviews, application of static and dynamic code assessment tools and services, penetration testing, and red teaming) that the developed system is likely to face when deployed into operation.

v. Operational System – attack countermeasures and other assurance activities applied within the operational environment (For Example, failover, fault isolation, encryption, application firewalls, least privilege, and secure exception handling) to mitigate attacks against the delivered system and software interfaces, which may include COTS, Government off-the-shelf (GOTS), open source, and other off-the-shelf software.

vi. Development Environment – assurance activities and controls (For example, access controls, configuration management, and release testing) applied to tools and activities (For example, compilers, linkers, integrated development environments, run-time libraries, and test harnesses) used to develop and sustain software to mitigate attacks.

Table X: Application of Software Assurance Countermeasures (sample)

Development Process

Software (CPI & Critical Component)

Static Analysis p/a (%)

Design Inspect

Code Inspect p/a (%)

CVE

p/a

CAPEC

p/a (%)

CWE

p/a

Pen Test

Test Coverage p/a (%)

CPI SW

Level I Critical Component SW

Level II Critical

Operational System Failover

Multiple Supplier

Redundancy

Fault

Isolation

Least

Privilege

System Element Isolation

Input checking/ validation

SW load key

CPI SW

Level I Critical

Level II Critical

Development Environment

SW Products

Source

Release testing

Generated code inspection p/a (%)

OEM or Authori zed dealer

List the COTS products used in the software development environment

Compiler

Runtime Libraries

Automated Test System

Configuration Management System

Database

Development Environment Access

3.4 WxOE NIPRNet RMF Authorization

The WxOE Solution Software includes all activities leading up to and including the procurement of the separately priced software solutions, completion of fielding and the transition to sustainment, to include training support, licensing, configuration management, and NIPR RMF activities.

3.4.1 NIPR Cybersecurity Support

The Contractor shall support and participate in NIPRNet authorization process and cybersecurity testing. The Contractor shall provide support for the NIPR RMF self-assessment.

3.4.1.1 NIPR RMF Self-Assessment Support

The Contractor shall provide self-assessment support to include but not limited to providing system artifacts and documentation, completing, and providing Assured Compliance Assessment Solution (ACAS) vulnerability scans, complying with security controls IAW Categorization and Control Selection Systems (CNSSI 1253), and assisting in developing Plan of Actions & Milestones (POA&M) to meet RMF security control requirements. The Government will provide or make available to the Contractor the required security tools needed for RMF compliance activities. Application scanning tools required to meet secure application development best practices to include static application security testing (SAST), dynamic application security testing (DAST), database scanning, and software composition analysis (SCA) will be on the Contractor to procure in addition to vulnerability scanning technologies such as Nessus. If needed, the Government can make available Security Center/ACAS to manage vulnerability results for the Contractor.

The Contractor shall deliver the following system artifact documentation via SIPRNet no later than fifteen (15) business days after receipt of order IAW CDRL B002 MGMT-82001 DOD RMF Package Deliverables:

• SVD, CDRL A001

• Software User Manual, CDRL A002

• Administrator Manuals/Guides

• System Security Plan, CDRL B002 o System Architecture Description o Components o Configurations o Accreditation/Authorization Boundaries o Compliant Network Diagrams o External Interfaces and Data Flow o Internal Data Flow o Contingency Plan (to include backup/restore/recovery procedures) o Hardware/Software/Firmware Lists (NETCOM HW/SW Template) o Ports, Protocols, and Services (PPS) o Configuration Management Plan o Account Management Plan / Policy o Continuous Monitoring Plan o Information Assurance Vulnerability Management (IAVM) Plan o RMF Implementation Plan

• Cybersecurity Test Plan, CDRL B002 o Required Vulnerability Scans (ACAS) o Security Technical Implementation Guides (STIGs) o Security Readiness Guides (SRGs) o Secure Content Automation Protocol (SCAP) benchmarks

• POA&M, CDRL B002

• Operations Security (OPSEC) Plan, CDRL B001

• Configuration Management Implementation Plan

• Maintenance Implementation Plan

• Audit and Accountability Implementation Plan

• System and Information Integrity Implementation Plan

• Identification and Authentication Implementation Plan

• Access Control Implementation Plan

• System and Services Acquisition Implementation Plan

• System and Communications Protection

• Media Protection Implementation Plan

• Incident Response Plan

• System Training Plans & Guides

• FSE Guides

• Testing and Evaluation Plan (security assessment, regression, flaw remediation)

• Secure configuration, installation, operation, and maintenance procedures

• Anti-counterfeit Implementation Procedures

• Supply Chain Protection Implementation Plan

• Controlled Unclassified Information Implementation Plan

(See CDRL, B002, DI-MGMT-82001, & A001, DI-IPSC-81442A) The Contractor shall comply with all applicable technical, procedural, and system documentation associated with Federal, Department of Defense (DoD), and Army Cybersecurity policy and requirements, including but not limited to the following.

a. Provide system information at the component level including security concepts and procedures and all system component user and maintenance manuals to the security engineering team after receipt of order, IAW CDRL B002. This system information shall become the baseline system configuration.

b. Provide system administration, access, and engineering support to the System Engineering team and installation management personnel from self-assessment activities through final system acceptance.

c. Provide system information and security assistance to the Security Control Assessor (SCA) team to support the Authorizing Official’s (AO) authorization decision process.

d. Provide a copy of complete system documentation including component manuals, configuration guides, administration guides, user guides, and any system unique documentation IAW CDRL B002. Information System documentation shall describe secure configuration, installation, and operation of the system, component, or service. The Information system document shall also describe the application of information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

e. The Contractor shall provide vulnerability scans and deliver ACAS results to the Government, comply with security controls, and apply Defense Information Systems Agency (DISA) STIGs.

Also, the Contractor shall assist the Government in developing the POA&M to meet RMF requirements.

f. The Contractor shall comply with implementing DoD and ARCYBER mandated requirements to include those of Public Key Infrastructure (PKI) or Multi-Factor Authentication (MFA) requirements, Data-At-Rest Encryption requirements, and Army Enterprise Security Services (AESS) requirements.

3.4.2 NIPR RMF Compliance

The Contractor shall perform cybersecurity assessment and authorization activities IAW DoDI 8510.01 RMF for DoD Information Technology and CNSSI 1253 Security Categorization and Control Selection for National Security Systems. During the early stage of NIPR RMF process, the Contractor’s system will be assessed for categorization for Confidentiality, Integrity, and Availability (CIA) impact levels and applicable security controls will be identified. The Contractor shall enable their solution to meet the requirements from the security controls by applying the required DISA STIGs which are applicable to the system. All applicable security controls identified in the CNSSI 1253 publication and STIGs shall be assessed to ensure security controls and STIGS are examined, and tested, ensuring authorization decision requirements are addressed.

The Contractor shall provide cybersecurity control artifacts that are compliant with the CNSSI 1253 publication.

No tools are authorized for generation of artifacts except those posted to the Army OIA&C site or Knowledge Service (KS) site. Artifacts provided must meet the requirements of Army and DoD guidance IAW CDRL B002.

3.4.3 Cybersecurity Compliance

The WxOE Solution shall meet all applicable security control requirements so that an Authorization to Operate (ATO) can be obtained. Once an authorization decision has been obtained, the Contractor shall continue to sustain the security posture of the system baseline to maintain the compliance of the ATO requirement. The Contractor shall maintain an IAVM patching process at least on a monthly basis to support Command Cyber Readiness Inspection (CCRI) compliance. The Contractor shall follow all aspects of their Continuous Monitoring Plan to include threat modeling, supply chain risk management practices, annual program protection updates, or any significant changes/upgrades to the WxOE architecture. Any significant changes/upgrades to the WxOE architecture will follow the Engineering Change Proposal process in Section 3.14.

3.5 WxOE Secret RMF Authorization

The WxOE Solution Software includes all activities leading up to and including the procurement of the separately priced software solutions, completion of fielding and the transition to sustainment to include training support, licensing, configuration management, Secret RMF activities.

3.5.1 Cybersecurity Support

The Contractor shall support and participate in Secret authorization process and cybersecurity testing. The Contractor shall provide support for the RMF self-assessment.

3.5.1.1 Secret RMF Self-Assessment Support

The Contractor shall provide self-assessment support to include but not limited to providing system artifact documentation, completing, and providing ACAS vulnerability scans, complying with security controls IAW CNSSI 1253, and assisting in developing POA&M to meet RMF security control requirements. The Government will provide or make available to the Contractor the required security tools needed for Secret RMF activities.

The Contractor shall deliver the following system artifact documentation no later than 15 business days after receipt of order IAW CDRL B002 (DI-MGMT-82001) DOD RMF Package Deliverables:

• SVD, CDRL A001

• Software User Manual, CDRL A002

• Administrator Manuals / Guides

• System Security Plan, CDRL B002 o System Architecture Description o Components o Configurations o Accreditation/Authorization Boundaries o Compliant Network Diagrams o External Interfaces and Data Flow o Internal Data Flow o Contingency Plan (to include backup/restore/recovery procedures) o Hardware Lists (NETCOM HW/SW Template) o Ports, Protocols, and Services (PPS) o Configuration Management Plan o Configuration Management Policy o Account Management Plan o Continuous Monitoring Plan o Information Assurance Vulnerability Management (IAVM) Plan o RMF Implementation Plan

• Cybersecurity Test Plan, CDRL B002 o Required Vulnerability Scans (ACAS) o STIGs o Security Readiness Guides (SRGs) o Secure Content Automation Protocol (SCAP) benchmarks

• POA&M, CDRL B002

• Operations Security (OPSEC) Plan, CDRL B001

• Configuration Management Implementation Plan

• Maintenance Implementation Plan

• Audit and Accountability Implementation Plan

• System and Information Integrity Implementation Plan

• Identification and Authentication Implementation Plan

• Access Control Implementation Plan

• System and Services Acquisition Implementation Plan

• System and Communications Protection

• Media Protection Implementation Plan

• Incident Response Plan

• System Training Plans & Guides

• FSE Guides

• Testing and Evaluation Plan (security assessment, regression, flaw remediation)

• Secure configuration, installation, operation, and maintenance procedures

• Anti-counterfeit Implementation Procedures

• Supply Chain Protection Implementation Plan

• Controlled Unclassified Information Implementation Plan

(See CDRL DI-MGMT-82001, B002, A001, DI-IPSC-81442A) The Contractor shall comply with all applicable technical, procedural, and system documentation associated with Federal, Department of Defense (DoD), and Army Cybersecurity policy and requirements, including but not limited to the following.

a. Provide system information at the component level including security concepts and procedures and all system component user and maintenance manuals to the security engineering team after receipt of order, IAW CDRL B002. This system information shall become the baseline system configuration.

b. Provide system administration, access, and engineering support to the System Engineering team and installation management personnel from self-assessment activities through final system acceptance.

c. Provide system information and security assistance to the Security Control Assessor (SCA) team to support the Authorizing Official’s (AO) authorization decision process.

d. Provide a copy of complete system documentation including component manuals, configuration guides, administration guides, user guides, and any system unique documentation after receipt of order, IAW CDRL B002. Information System documentation shall describe secure configuration, installation, and operation of the system, component, or service, the application of information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

e. The Contractor shall provide vulnerability scans and deliver ACAS results to the Government, comply with security controls, and apply DISA STIGs monthly or as required. Also, the Contractor shall assist the Government in developing the POA&M to meet RMF requirements.

f. The Contractor shall comply with implementing DoD and ARCYBER mandated requirements to include those of Public Key Infrastructure (PKI) or Multi-Factor Authentication (MFA) requirements, Data-At-Rest Encryption requirements, and Army Enterprise Security Services (AESS) requirements.

3.5.2 Secret RMF Compliance

The Contractor shall perform cybersecurity accreditation IAW DoDI 8510.01 RMF for DoD Information Technology and CNSSI 1253 Security Categorization and Control Selection for National Security Systems.

During the early stage of RMF process, the Contractor’s system will be assessed for categorization for CIA impact levels and applicable security controls will be identified. The Contractor shall enable their solution to meet the requirements from the security controls by applying the required DISA STIGs which are applicable to the system. All applicable security controls identified in the CNSSI 1253 publication and STIGs shall be assessed to ensure security controls and STIGS are examined, and tested, ensuring authorization decision requirements are addressed.

The Contractor shall provide cybersecurity control artifacts that are compliant with the CNSSI 1253 publication.

No tools are authorized for generation of artifacts except those posted to the Army OIA&C site or KS site.

Artifacts provided must meet the requirements of Army and DoD guidance IAW B002.

3.5.3 Cybersecurity Compliance

The WxOE Solution shall meet all applicable security control requirements so that an ATO can be obtained.

Once an authorization decision has been obtained, the Contractor shall continue to sustain the security posture of the system baseline to maintain the compliance of the ATO requirement. The Contractor shall maintain IAVM patching process at least on a monthly basis to support CCRI compliance. The Contractor shall follow all aspects of their Continuous Monitoring Plan to include threat modeling, supply chain risk management practices, annual program protection updates, or any significant changes/upgrades to the WxOE architecture.

Any significant changes/upgrades to the WxOE architecture will follow the Engineering Change Proposal process outlined in Section 3.14.

3.6 WxOE Functional Configuration Audit

The Contractor shall provide no less than one and no more than four (4) SMEs to support the Government Functional Configuration Audit, after receiving an order, for a duration not expected to exceed three (3) days.

This audit shall include, at a minimum, verification that the system complies with the applicable PRD requirements, incorporated within Section J of the contract. The FCA will occur in the Aberdeen, MD area, other designated Government location, or at the Contractor’s location, at the discretion of the Government. The FCA may involve testing and demonstrations of the Contractor’s software to verify compliance with requirements.

3.7 WxOE Solution Army Interoperability Certification (AIC)

The Contractor shall achieve an AIC. The Contractor shall provide system software (on a temporary basis), one (1) system operator, and one (1) cybersecurity person, who can be the same person, on-site for a duration not to exceed twelve (12) weeks for the AIC test event at the Central Technical Support Facility (CTSF) located at Fort Cavazos, TX. Activities for this event may include, but not limited to, system set-up, test operator training, AIC test plan review and coordination, general engineering services, IA scans, the Network Vulnerability Assessment, the cyber threat activity, and vulnerability and penetration assessments.

3.8 WxOE Solution Training

The Contractor shall provide full access to current WxOE software via remote connections or in-person access at Contactor facilities to enable the Program Management Office's Training Development Team to create New Equipment Training (NET) material. The software must include activated licenses for any outsourced COTS software. In addition, the Contractor must provide software access as needed throughout the delivery order.

After receipt of the order, the Contractor shall provide WxOE training materials (IAW DI-ILSS-80872) and WxOE user and administrator manuals (IAW DI-IPSC-81443A and DI-MISC-80711A). New or updated training materials, manuals, and a SVD shall be provided whenever software changes impact the user or administrator training.

It is suggested that the vendor be familiar with the tenants of Training & Doctrine Command (TRADOC) 350‐70 writing standards. The user and administrator manuals may be in the vendor format; however, the training material must be written IAW the PM IS&A Training Development Standards and Conventions.

The Contractor shall deliver an Instructor and Key Personnel Training (IKPT) course to support the Program Management Office's NET material development. The IKPT shall not exceed one (1) week per occurrence and must support up to twenty (20) personnel. The schedule for the IKPT course(s) shall be mutually agreed upon by Government and Contractor no later than forty-five (45) days after award. The classroom will be located at the Contractor's facility or Government location; determination will be at the discretion of the Government. The Contractor is expected to provide up to four (4) complete IKPT training occurrences for the Government's fielding, training, and support personnel during this delivery order. The Contractor will tailor each occurrence to provide a comprehensive training event that supports operators, trainers, and support personnel.

In addition, the Contractor shall provide Over the Shoulder training courses not to exceed one (1) week per occurrence and must support up to twenty (20) personnel, as needed and at the direction of the Government to support test events and other gaining unit’s training requirements, not to exceed six (6) courses per year for the length of the delivery order.

The Contractor shall provide access to no less than one (1) operator Subject Matter Expert (SME) during regular business hours, throughout the duration of the delivery order. Access is required to support the Program Management Office's training material development and trainer readiness.

The Contractor shall participate in monthly Integrated Product Team (IPT) meetings hosted by Program Management Office to review the program's progress, identify and resolve issues, and make sound and timely recommendations to facilitate decision-making.

3.9 Operational Assessment (OA)

The Contractor shall provide all necessary software licenses, materials, and support required to execute a Government-run Operational Assessment as detailed in the below paragraphs. The Contractor shall provide support to the OA which includes all activities from pre-Operational Test Readiness Review (OTRR) through the conclusion of the OA, to include associated training support and continued RMF accreditation activities.

3.9.1 Operational Test Readiness Review

The Contractor shall participate in a Pre-OA meeting, approximately fifteen (15) business days prior to the OTRR to discuss and review readiness to begin the OA. The meeting will occur in the Aberdeen MD area, remotely, or at contractor’s location, if directed. The meeting is not expected to last more than two hours.

The Contractor shall provide at least one (1) but not more than three (3) SMEs for one day to support the Government during the Operational Test Readiness Review (OTRR) for the Operational Assessment. The OTRR will be held no later than five (5) days prior to the OA and may occur at APG, or remotely.

3.9.2 Operational Assessment Execution

The purpose of the OA is to test the proposed Intel Apps software against some or all requirements in the PRD and related measures of performance, and, to assess the Contractor’s WxOE software’s effectiveness, suitability, and survivability. The OA may also solicit User feedback on system usability, contribution to mission accomplishment, and may assess cybersecurity. The OA will be conducted at a location designated by the Government. Testing will be conducted by the Army Test and Evaluation Command (ATEC) and may be supported by Forces Command (FORSCOM), INSCOM, and TRADOC. The OA is not expected to exceed six

(6) weeks from set-up through teardown. The Contracting Officer will provide the Contractor a schedule that will include training dates, a test plan, and schedule of test events identifying the timeframes that the Contractor’s System will be tested. The Government will have final discretion in determining the most efficient test sequence to meet the overall schedule. The Contractor shall deliver the number of test licenses with all applicable licenses listed in Table 8 for the OA, after receipt of order IAW CDRL A001.