W56KGY24R0002 Attachment 0001 - Statement of Work_6 November 2023.pdf

UNCLASSIFIED

STATEMENT OF WORK (SOW)

FOR

INTELLIGENCE SYSTEMS & ANALYTICS (IS&A)

INTELLIGENCE APPLICATIONS (INTEL APPS)

INFORMATION COLLECTION MANAGEMENT

Solicitation Number: W56KGY-24-0002

Base Statement of Work Indefinite Delivery Indefinite Quantity (IDIQ) Contract

06 November 2023

Project Manager Intelligence Systems & Analytics

6580 Surveillance Loop, Building 6006 Aberdeen Proving Ground, MD 21005 ii

Contents

1. Scope

1.1 Background

2. Applicable Documents

3. Requirements

3.0 ICM Programmatic

ICM Programmatic Kickoff

3.1 ICM Technical Test

ICM Technical Test Preparation

ICM Test Readiness Review (TRR)

ICM Technical Test Execution

ICM Post Technical Test Meeting and Support

Software Version Description (SVD)

Logistic Support for Technical Test

The Contractor shall be responsible for the installation and maintenance of software solutions leading up to and during the ICM Technical Test

3.2 ICM – Soldier Touch Point (STP)

Soldier Touch Point Preparation

Soldier Touch Point – Test Readiness Review (TRR) Support

Soldier Touch Point - Execution

Soldier Touch Point – Test Support

Soldier Touch Point – Post STP Meetings and Support

Software Version Description (SVD)

Logistic Support for Soldier Touch Point

3.3 ICM Program Protection

3.4 ICM NIPRNet RMF Authorization

NIPR Cybersecurity Support

NIPR RMF Compliance

Cybersecurity Compliance

3.5 ICM Secret RMF Authorization

Cybersecurity Support

Secret RMF Compliance

3.6 ICM Top Secret RMF Authorization

iii

Cybersecurity Support

TOP SECRET RMF Compliance

TOP SECRET Cybersecurity Compliance

Cybersecurity Compliance

3.7 ICM Functional Configuration Audit

3.8 ICM Solution Army Interoperability Certification (AIC)

3.9 ICM Solution Training

3.10 Operational Assessment (OA)

Operational Test Readiness Review

Operational Assessment Execution

Operational Assessment Test Support

IA Support for Initial Operational Test

3.11 ICM Solution Software

ICM Solution Delivery

DEVOPS

Program Protection Implementation

3.12 Annual Sustainment

Annual Maintenance Upgrades

IA Support for Annual Sustainment

Reach Back Support for Annual Sustainment

3.13 Initial Integration Support

Warranties

3.14 Configuration Management

Software Problem Report (SPR)

Monthly Security Patch/Release Delivery

Field-discovered SPRs

3.15 Engineering Change Proposals (ECP)

Contractor-proposed ICM Modifications due to Enhancements, Obsolescence, and Major Software Releases

Government-proposed Enhancements and Modifications

3.16 Exercise Support

Warranty Patch/Release Delivery iv

3.17 Army Contractor Manpower Reporting (CMR) System

3.18 Cyber Security Support

3.19 Software Safety

4. Contract Deliverables

4.1 Licensing

Licensing

4.2 Assurance Warranties

4.3 Non-Technical Data Deliverables

List of Tables Table 1. Program Documents

Table 2. Department of Defense Directives

Table 3. Department of Defense Instructions

Table 4. Army Regulations (AR)

Table 5. Other Documents

1. Scope The contractor shall provide a commercial item that is a software only solution to meet the Information Collection Management (also known as ICM) capability that enables the user to plan requirements, identify collection resources, and assess collection in an automated fashion. This application streamlines both the information requirements and recommended collection asset validation processes resulting in tools and products that support an organization’s Collection Management Plan. This digital collection management framework enables rapid Priority Intelligence Requirement (PIR) and Essential Elements of Information (EEI) entry with associated indicators and specific information requirements. This application enables vectored and dynamically updated collection asset management and tasking, enhancing battlespace awareness and situational understanding of a threat’s current operational capabilities and potential threat force application/course of action (COA).

1.1 Background

Program Manager (PM) Intelligence Systems and Analytics (IS&A) is a Family of Systems that provides our Army with advanced analytics, support to targeting and situation understanding to commanders. It processes, exploits, and disseminates information and intelligence about the threat, weather, and terrain and provides tactical and operational ground stations that downlink data from national, joint partners and Army sensors. As technology evolves and new warfighting requirements emerge, the PM’s capability set need to be updated to meet the user needs.

The ICM requirements address the need to modernize and enhance the capabilities of Army’s intelligence at the tactical echelons. The contractor’s solution shall meet the capabilities called out in the Performance Requirement Documentation (PRD). The PRD may be tailored as applicable at the delivery order level. The Contractor’s ICM software should provide a platform agnostic solution to support intel modernization efforts (e.g., CPCE, AC2SP, Edge Node).

The ICM capability shall align with multiple overarching directives, to include the Army’s Common Operating Environment (COE). The ICM shall support net-centric military operations by being interoperable with current Army, Unified Action Partners, Joint Service, Allied, Coalition, and Command and Control information and ISR systems. ICM shall operate across the Sensitive Compartmented Information (SCI), Collateral, U.S. Collateral, Unified Action Partner, Mission Partner Environment, and Unclassified security domains, and within and across all COE computing environments.

The PM IS&A ICM Intel Application will consist of digital components that must be compatible and able to synchronize with select (like data field) components of aligned other applications (i.e. Intel Support to Targeting Application and the All-Source II Application).

2. Applicable Documents The following documents are applicable to this SOW.

Table 1. Program Documents Number Title Date

Performance Requirements Document (PRD) November 2021

Table 2. Department of Defense Directives Number Title Date

DoD 5220.22-M National Industrial Security Program Operating Manual 28 February 2006 DoDD 8570.01 Information Assurance (IA) Training, Certification and Workforce

Management 15 August 2004

Number Title Date DoD 8570.01-M Information Assurance Workforce Improvement Program, Change

19 December 2005

DoDD 8140.01 Cyberspace Workforce Management 11 August 2015 DoDI 4140.67 DoD Counterfeit Prevention Policy 26 April 2013 DoDI 4140.01 DoD Supply Chain Materiel Management Policy 14 December 2011 DoDI 8582.01 Security of Unclassified DoD Information on Non-DoD Information

Systems 6 June 2012

DoDI 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN)

5 November 2012

Table 3. Department of Defense Instructions Number Title Date

DoDI 3020.41 Operational Contract Support 20 December 2011 DoDI 8510.01 Risk Management Framework (RMF) for DoD Information

Technology (IT) 12 March 2014

Table 4. Army Regulations (AR) Number Title Date

AR 25-1 Army Information Technology 25 June 2013 AR 25-2 Information Assurance 4 April 2019 AR 70-1 Army Acquisition Policy 16 June 2017 AR 73-1 Test and Evaluation Policy 16 November 2016 AR 530-1 Operations Security 26 September 2014 AR 380-67 Personnel Security Program 24 January 2014 AR 381-12 Threat Awareness and Reporting Program (TARP) 01 June 2016 AR 70-77 Program Protection 08 June 2018 DA PAM 25-1-2 Information Technology Contingency Planning 06 June 2012

Table 5. Other Documents (Information Collection Related) Number Title Date

ATP 2.01.3 Intelligence Preparation of the Battlefield 1 March 2009 ATP 2-01 Collection Management August 2021 ADP 2-0 Intelligence 31 July 2019 ADP 3-0 Operations 31 July 2019 ADP 5-0 The Operations Process 31 July 2019 ADP 6-0 Mission Command: Command and Control of Army Forces 31 July 2019 ATP 2-33.4 Intelligence Analysis 10 January

ATP 3-55.3 Multi-Service Tactics, Techniques, and

Procedures for Intelligence, Surveillance, and Reconnaissance Optimization.

3 September

ATP 3-55.4 Techniques for Information Collection During Operations Among Populations.

5 April 2016

FM 2-0 Intelligence 6 July 2018

ADRP 1-03 ART 2.2.2 Perform Situation Development October 2015 ATP 3-12.3 Electronic Warfare Techniques July 2019 CJCSI-3370.01C Target Development Standards 2019 CJCSI-3162.02 Methodology for Combat Assessment Mar 2019

3. Requirements This SOW addresses all products, support, and activities that shall be required throughout the period of performance (PoP) for the IDIQ Contract. The Contractor shall provide all the necessary resources and knowledge to support the listed products, support, and activities.

The goal of this SOW and the applicable/referenced documents is to detail and implement commercial item solutions that will satisfy the Government’s requirements. The following requirements will be issued at the order level to establish the most viable commercial item solution(s) to meet the Government’s requirements.

3.0 ICM Programmatic

The Contractor shall designate a program manager with responsibility to plan, manage, and direct the successful and final completion of the requirements of this SOW. The Contractor’s program manager shall be the single focal point of contact for all required programmatic requirements and work directly with the Government.

ICM Programmatic Kickoff The Contractor shall participate in a Government-run program kickoff event, no later than ten (10) business days after receipt of order. The Government will provide a product roadmap that conveys the expected path and schedule towards capability delivery. The Contractor shall plan for the kickoff meeting to last anywhere between two (2) to four (4) hours and will be conducted at Government Location at Aberdeen Proving Ground (APG), or remotely.

3.1 ICM Technical Test

The Government will determine the scope of tested requirements for each Technical Test. The Contractor shall provide all necessary software licenses, materials, and incidental support required to execute an ICM Technical Test as detailed in the below paragraphs. This section shall include all analyst activities to include the ICM Technical Test Preparation, ICM Technical Test Support, the ICM Technical Test Readiness Reviews (TRR), and information assurance activities of the ICM Technical Test event.

ICM Technical Test Preparation The Contractor shall have a period of no longer than sixty (60) days before each Technical Test, during which the Contractor can modify and/or tailor its commercial software as necessary. The Government will determine the scope of the Technical Test to include expected results that will be measured, and meet decomposed requirements specific to the Technical Test. The vendor shall determine the factors that are expected to have an impact on results, to include thread and test step development to successfully meet requirements as mapped out in the PRD.

Based on the government-defined scope of the technical test, the Contractor shall develop technical test threads that is aligned to the PRD. The Contractor shall deliver the draft test threads to the Government no later than thirty (30) days prior to the start of technical tests. The Government will review the threads and may modify, delete, or add additional threads, as deemed necessary to fulfill the scope of the requirement. The Contractor shall provide a test limitation document and test plan that includes a daily schedule and test events defining the specific timeframes to be tested against the PRD. The Government will review the plan and have final discretion in determining the test scope and most efficient test sequence to meet the overall schedule. The Contractor’s test plan will include processes and resources to use during test conditions.

Approximately seven (7) days prior to start of the event, the Contractor shall install the latest version of the software to be used during testing. No software changes to the system under test will be allowed once testing has begun, unless approved by the Government in a digitally signed email by the Government Task Lead or Intel Apps Chief Engineer. The Government will make available to the Contractor a representative test environment, such as an environment hosted on hardware at either APG or at an operational site. That environment will be made available in advance of the testing to the Contractor for system setup and configuration, integration, test, and training.

ICM Test Readiness Review (TRR) The Technical Readiness Review shall occur approximately seven (7) days prior to the Technical Test.

Approximately fourteen (14) days prior to the ICM Technical Test Readiness Review, the Contractor shall participate in a Pre-Test meeting to discuss the test plan details, test limitations, and activities leading up to the ICM Technical Test Readiness Review. At the Government’s discretion, the meeting will be held either in person or remotely.

ICM Technical Test Execution The purpose of each ICM Technical Test is to test the Contractor’s commercial ICM solution to the system requirements. The ICM Technical Test will be conducted in a Government-provided facility in vicinity of Aberdeen, MD or at a facility aligned to a military base. During the Technical Test, the software shall demonstrate its ability to meet the specified SOW and PRD requirements. Testing will be conducted by the ICM Vendor in collaboration with PM IS&A. The Contractor will be provided the test location during the program kick off meeting or no less than sixty (60) days prior to allow proper planning. Each ICM Technical Test is not expected to exceed fourteen (14) days overall, from set-up through teardown.

No software changes to the system under test will be allowed once testing has begun, unless approved by the Government, unless approved by the Government in a digitally signed email by the Government Task Lead or Intelligence Application (Intel Apps) Chief Engineer.

During testing, the Government may provide official Test Incident Reports (TIRs) to document anomalies and system failures identified by the Government. The Contractor may be provided TIRs during or at the conclusion of the event. The Government will make a determination on whether any TIRs result in a Priority 1-5 Software Problem Report (SPR), as defined in DA Pamphlet 73-1, Figure Q-31.

ICM Post Technical Test Meeting and Support The Contractor shall participate in a Post-Performance Test meeting, within fourteen (14) days after the completion of the Technical Test, to allow the Government to provide the Contactor with the information collected from the ICM Technical Test. During the Post Technical Test Meeting, the Government may present the findings of SPR or/and TIR results as defined in DA Pamphlet 73-1, Figure Q-31. The contractor shall have a time period of no longer than sixty (60) days before the next ICM Technical Test or milestone event, during which the Contractor can modify and/or tailor its commercial solution as necessary. If the Contractor cannot resolve all priority one (1) and two (2) SPR/TIRs prior to the next milestone event (e.g., Technical Test, AIC, Soldier Touch Point, Operational Testing), the Contractor must submit a “road map” or “get-well plan” to the Government no less than sixty (60) days prior to the start of the next event. The “road map” or “get-well plan” should include detailed timeline on how the Contractor plans to successfully resolve, validate, and track existing SPR/TIRs based on negotiated timeline with the Government. The work shall be deemed complete when the Vendor resolves all priority one (1) and two (2) SPR/TIRs. All meetings will occur in the Aberdeen, MD area, remotely, or at the contractor’s location, at the Government’s direction.

Software Version Description (SVD) The Contractor shall be responsible for delivering an initial version of the SVD document IAW CDRL A001. The Contractor shall deliver an SVD with each software deliverable to include monthly security patch/release deliveries, known limitations, and Development Operations (DEVOPS) updates, IAW CDRL A001.

Logistic Support for Technical Test

The Contractor shall be responsible for the installation and maintenance of software solutions leading up to and during the ICM Technical Test.

3.2 ICM – Soldier Touch Point (STP)

The Contractor shall provide all necessary software licenses, materials, and incidental support required to execute a Government-run STP as detailed in the below paragraphs. This section shall include all activities to include the actual STP.

Soldier Touch Point Preparation The Contractor shall have a period of no longer than sixty (60) days before a STP, during which time the Contractor can modify and/or tailor its solution as necessary. The goal is for the Government to provide usability feedback (e.g., SUS, TAM, STP Report) to the Contractor and for the Contractor’s solution to successfully meet the Government’s requirements identified within the PRD. The Government shall provide a representative environment at a Government facility/location, using Government-provided hardware, to be used for system setup, configuration, integration, test, and training.

Soldier Touch Point – Test Readiness Review (TRR) Support The STP TRR shall occur approximately seven (7) days prior to the STP. Approximately fourteen (14) days prior to the ICM STP Test Readiness Review, the Contractor shall participate in a Pre-Test meeting to discuss the test plan details, test limitations, and activities leading up to the ICM STP Test Readiness Review. At the Government’s discretion, the meeting will be held either in person or remotely.

Soldier Touch Point - Execution The purpose of each STP is to test the proposed ICM Intel App software to the requirements and solicit user feedback. The STP event is to effectively capture user feedback and meet System Usability Scale (SUS)/Technology Acceptance Model (TAM) requirements indicated in the ICM PRD.

The STP may be conducted at Government locations or at a facility aligned to a military base. Testing will be conducted by PM IS&A. The STP will be used as an immersive testing and feedback mechanisms through which Soldiers can provide valuable insights on how certain tools or equipment will be used practically in the field. During the STP the Government may generate findings regarding the system usability and provide those findings to the Contractor.

Each STP is not expected to exceed three (3) weeks overall, from set-up through teardown. This does not include the preparation time discussed in SOW para. 3.2.1.

The Government will provide email notification to the Contractor twenty-one (21) days prior to the start of each STP. With this notification, the Government will provide each Contractor a schedule that will include training dates, a test plan, and schedule of test events defining the specific timeframes that each Contractor’s System will be tested. The Government will have final discretion in determining the most efficient test sequence to meet the overall schedule.

No software changes to the system under test will be allowed once testing has begun. During testing, the Government may provide official TIRs to document anomalies and system failures identified by the Government. Contractor may be provided TIRs during or at the conclusion of the event. The Government will decide on whether any TIRs result in a Priority 1-5 SPR, as defined in DA Pamphlet 73-1, Figure Q-31.

The Contractor shall provide User Training Material prior to the event. Training shall be conducted in a classroom environment. The recipients of the training will have no prior experience with the Contractor’s system. The combination of all training shall not exceed twenty-four (24) hours over three (3) days per user group. User groups are not expected to exceed ten (10) people per group. The Contractor shall be responsible for providing its own training resources, such as laptops, software, and instructor(s) for its training activity. The Government will assign a user group to the Contractor’s system. Section 3.8 provides more details on training.

Soldier Touch Point – Test Support The Contractor shall provide onsite test support for a period not expected to exceed three (3) weeks with no more than three (3) and no less than one (1) Contractor onsite representatives for the STP. The Contractor onsite representative(s) shall include:

• Operator Support: The Contractor onsite support shall provide support for system operation / issues and troubleshooting throughout the STP.

• System Configuration: The Contractor onsite support shall provide support for initial set up for the systems.

Soldier Touch Point – Post STP Meetings and Support The Contractor shall participate in a Post-STP Test Meeting (Usability Working Group), within fifteen (15) business days after the completion of STP, to allow the Government to provide the contactor with the information collected from the STP. The government and contractor shall communicate all qualitative Soldier feedback collected at STPs through a Usability Tracker (as proposed and maintained by the contractor). The contractor shall track the progress and status of all Soldier feedback. All feedback items shall be made available to the government through access to the contractor’s Usability Tracker system.

No later than thirty-five (35) days following an STP, Technical Reports containing the usability metrics collected will be released. The contractor shall have a negotiated period based on the expected schedule discussed at program kickoff, during which the Contractor can modify and/or tailor its commercial solution as necessary to meet the SUS and TAM requirements indicated in the PRD.

During the Post STP Meeting, the Government may present the findings of SPR or/and TIR results as defined in DA Pamphlet 73-1, Figure Q-31. The contractor shall have a time period of no longer than seventy-five (75) days before the next ICM Technical Test or milestone event, during which the Contractor can modify and/or tailor its commercial solution as necessary. If the Contractor cannot resolve all priority one (1) and two (2) SPR/TIRs prior to the next milestone event (e.g., Technical Test, AIC, STP, Operational Testing), the Contractor must submit a “road map” or “get-well plan” to the Government no less than sixty (60) days prior to the start of the next event. The “road map” or “get-well plan” should include detailed timeline on how the Contractor plans to successfully resolve, validate, and track existing SPR/TIRs based on negotiated timeline with the Government. The work shall be deemed complete when the Vendor resolves all priority one (1) and two (2) SPR/TIRs. All meetings will occur at Aberdeen, MD area, remotely, or at the contractor’s location, if directed. Contractor shall have maximum flexibility to assign the appropriate person or persons to participate.

The meetings will last no longer than four (4) hours.

Software Version Description (SVD) The Contractor shall be responsible for delivering an initial version of the SVD document after receipt of order IAW CDRL A001, and at the time of each of the RMF self-assessment artifacts IAW paragraphs 3.4.1.1 and

3.5.1.1. The Contractor shall deliver an SVD with each software deliverable to include monthly security patch/release deliveries and known limitations IAW CDRL A001.

(See CDRL DI-IPSC-81442A, A001)

Logistic Support for Soldier Touch Point The Contractor shall be responsible for the maintenance and sustainment of software solutions participating in the ICM STP. This requirement is limited to those assets the Contractor has delivered in support of the ICM STP. The Contractor shall fix or replace any inoperable software it delivered to participate in the Intel Application ICM STP.

3.3 ICM Program Protection

The tasks listed below shall be performed by the Contractor as described and will flow down to any sub-contractors engaged by the Contractor:

a. The Contractor shall assist and support the USG in performing a Critical Functionality Analysis (CFA) and Critical Program Information (CPI) Assessment on the system in order to identify Critical Components and CPI. The USG shall provide the contractor with written guidance reference implementation of countermeasures to protect CPI. Additionally, the contractor shall implement USG specified Supply Chain Risk Management Countermeasures to safeguard USG identified Critical Components. The contractor shall provide periodic Program Protection Implementation Plan (PPIP) updates IAW DI-MGMT-80004A, Management Plan, Contract Deliverable (CDRL), A183. The contractor shall provide a PPIP to the USG within 30 days of receiving countermeasures and provide periodic PPIP status reports to program manager via CDRLs. The contractor shall support USG execution of Program Protection Surveys.

b. The Contractor shall provide technical support for the USG PPP process performed IAW DoDI 5000.02 Operation of the Adaptive Acquisition Framework, DoDI 5000.83 Technology and Program Protection to Maintain Technological Advantage, DoDI 5200.39 Critical Program Information (CPI) Identification and Protection Within Research, Development, Test, and Evaluation (RDT&E), DoDI 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN), DoD Technology and Program Protection Guidebook, and Key Practices and Implementation Guide for the DoD Comprehensive National Cyber Security Initiative 11 Supply Chain Risk Management.

c. The Contractor shall demonstrate he has visibility into the supply chain for Critical Components, understands how supply chain risk can be introduced through those Critical Components, and has implemented or plans to implement countermeasures to mitigate such risks. This requirement shall flow down to all subcontractors.

d. The Contractor shall develop, document and update software assurance countermeasures table listed below after USG identifies Critical Program Information and Critical Components. Note: P is for planned and A is for actual.

i. Common Vulnerabilities and Exposures (CVE) information is used to identify, track, and coordinate mitigation activities of the publicly known vulnerabilities in commercial off the shelf (COTS). Programs should use tools during incremental software testing of their commercial and open source packages to scan operational components and the tool can provide an indication of risk.

ii. Common Weakness Enumeration (CWE) catalog captures more than 700 types of weaknesses in code, design, architecture, and implementation.

iii. Common Attack Pattern Enumeration and Classification (CAPEC) is used for the analysis of common patterns of attacks against systems, whether for understanding how attacks are committed, scoping of relevant threats, templates for malicious testing, or as a foil for thinking about the susceptibility of system’s architecture, design, and technical implementation to specific attacks. CAPEC is a powerful mechanism to capture and communicate the attacker’s perspective, organize the analysis of a system with respect to attacks, and prioritize weaknesses (CWEs) based on the anticipated attack patterns.

iv. Development Process – assurance activities conducted during the development process to mitigate and minimize attacks (For example, threat assessment and modeling, attack surface analysis, architecture and design reviews, application of static and dynamic code assessment tools and services, penetration testing, and red teaming) that the developed system is likely to face when deployed into operation.

v. Operational System – attack countermeasures and other assurance activities applied within the operational environment (For Example, failover, fault isolation, encryption, application firewalls, least privilege, and secure exception handling) to mitigate attacks against the delivered system and software interfaces, which may include COTS, Government off-the-shelf (GOTS), open source, and other off-the-shelf software.

vi. Development Environment – assurance activities and controls (For example, access controls, configuration management, and release testing) applied to tools and activities (For example, compilers, linkers, integrated development environments, run-time libraries, and test harnesses) used to develop and sustain software to mitigate attacks.

Table X: Application of Software Assurance Countermeasures (sample)

Development Process

Software (CPI & Critical Component)

Static Analysis p/a (%)

Design Inspect

Code Inspect p/a (%)

CVE

p/a

CAPEC

p/a (%)

CWE

p/a

Pen Test

Test Coverage p/a (%)

CPI SW

Level I Critical Component SW

Level II Critical

Operational System Failover

Multiple Supplier

Redundancy

Fault

Isolation

Least

Privilege

System Element Isolation

Input checking/ validation

SW load key

CPI SW

Level I Critical

Level II Critical

Development Environment

SW Products

Source

Release testing

Generated code inspection p/a (%)

OEM or Authori zed dealer

List the COTS products used in the software development environment

Compiler

Runtime Libraries

Automated Test System

Configuration Management System

Database

Development Environment Access

3.4 ICM NIPRNet RMF Authorization

The ICM Solution Software includes all activities leading up to and including the procurement of the separately priced software solutions, completion of fielding and the transition to sustainment, to include training support, licensing, configuration management, and NIPR RMF activities.

NIPR Cybersecurity Support The Contractor shall support and participate in NIPRNet authorization process and cybersecurity testing. The Contractor shall provide support for the NIPR RMF self-assessment.

3.4.1.1 NIPR RMF Self-Assessment Support

The Contractor shall provide self-assessment support to include but not limited to providing system artifacts and documentation, completing, and providing Assured Compliance Assessment Solution (ACAS) vulnerability scans, complying with security controls IAW Categorization and Control Selection Systems (CNSSI 1253), and assisting in developing Plan of Actions & Milestones (POA&M) to meet RMF security control requirements. The Government will provide or make available to the Contractor the required security tools needed for RMF compliance activities. Application scanning tools required to meet secure application development best practices to include static application security testing (SAST), dynamic application security testing (DAST), database scanning, and software composition analysis (SCA) will be on the Contractor to procure in addition to vulnerability scanning technologies such as Nessus. If needed, the Government can make available Security Center/ACAS to manage vulnerability results for the Contractor.

The Contractor shall deliver the following system artifact documentation via SIPRNet no later than fifteen (15) business days after receipt of order IAW CDRL B002 MGMT-82001 DOD RMF Package Deliverables:

• SVD, CDRL A001

• Software User Manual, CDRL A002

• Administrator Manuals/Guides

• System Security Plan, CDRL B002 o System Architecture Description o Components o Configurations o Accreditation/Authorization Boundaries o Compliant Network Diagrams o External Interfaces and Data Flow o Internal Data Flow o Contingency Plan (to include backup/restore/recovery procedures) o Hardware/Software/Firmware Lists (NETCOM HW/SW Template) o Ports, Protocols, and Services (PPS) o Configuration Management Plan o Account Management Plan / Policy o Continuous Monitoring Plan o Information Assurance Vulnerability Management (IAVM) Plan o RMF Implementation Plan

• Cybersecurity Test Plan, CDRL B002 o Required Vulnerability Scans (ACAS) o Security Technical Implementation Guides (STIGs) o Security Readiness Guides (SRGs) o Secure Content Automation Protocol (SCAP) benchmarks

• POA&M, CDRL B002

• Operations Security (OPSEC) Plan, CDRL B001

• Configuration Management Implementation Plan

• Maintenance Implementation Plan

• Audit and Accountability Implementation Plan

• System and Information Integrity Implementation Plan

• Identification and Authentication Implementation Plan

• Access Control Implementation Plan

• System and Services Acquisition Implementation Plan

• System and Communications Protection

• Media Protection Implementation Plan

• Incident Response Plan

• System Training Plans & Guides

• FSE Guides

• Testing and Evaluation Plan (security assessment, regression, flaw remediation)

• Secure configuration, installation, operation, and maintenance procedures

• Anti-counterfeit Implementation Procedures

• Supply Chain Protection Implementation Plan

• Controlled Unclassified Information Implementation Plan

(See CDRL, B002, DI-MGMT-82001, & A001, DI-IPSC-81442A) The Contractor shall comply with all applicable technical, procedural, and system documentation associated with Federal, Department of Defense (DoD), and Army Cybersecurity policy and requirements, including but not limited to the following.

a. Provide system information at the component level including security concepts and procedures and all system component user and maintenance manuals to the security engineering team after receipt of order, IAW CDRL B002. This system information shall become the baseline system configuration.

b. Provide system administration, access, and engineering support to the System Engineering team and installation management personnel from self-assessment activities through final system acceptance.

c. Provide system information and security assistance to the Security Control Assessor (SCA) team to support the Authorizing Official’s (AO) authorization decision process.

d. Provide a copy of complete system documentation including component manuals, configuration guides, administration guides, user guides, and any system unique documentation IAW CDRL B002. Information System documentation shall describe secure configuration, installation, and operation of the system, component, or service. The Information system document shall also describe the application of information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

e. The Contractor shall provide vulnerability scans and deliver ACAS results to the Government, comply with security controls, and apply Defense Information Systems Agency (DISA) STIGs.

Also, the Contractor shall assist the Government in developing the POA&M to meet RMF requirements.

f. The Contractor shall comply with implementing DoD and ARCYBER mandated requirements to include those of Public Key Infrastructure (PKI) or Multi-Factor Authentication (MFA) requirements, Data-At-Rest Encryption requirements, and Army Enterprise Security Services (AESS) requirements.

NIPR RMF Compliance The Contractor shall perform cybersecurity assessment and authorization activities IAW DoDI 8510.01 RMF for DoD Information Technology and CNSSI 1253 Security Categorization and Control Selection for National Security Systems. During the early stage of NIPR RMF process, the Contractor’s system will be assessed for categorization for Confidentiality, Integrity, and Availability (CIA) impact levels and applicable security controls will be identified. The Contractor shall enable their solution to meet the requirements from the security controls by applying the required DISA STIGs which are applicable to the system. All applicable security controls identified in the CNSSI 1253 publication and STIGs shall be assessed to ensure security controls and STIGS are examined, and tested, ensuring authorization decision requirements are addressed.

The Contractor shall provide cybersecurity control artifacts that are compliant with the CNSSI 1253 publication.

No tools are authorized for generation of artifacts except those posted to the Army OIA&C site or Knowledge Service (KS) site. Artifacts provided must meet the requirements of Army and DoD guidance IAW CDRL B002.

Cybersecurity Compliance The ICM Solution shall meet all applicable security control requirements so that an Authorization to Operate (ATO) can be obtained. Once an authorization decision has been obtained, the Contractor shall continue to sustain the security posture of the system baseline to maintain the compliance of the ATO requirement. The Contractor shall maintain an IAVM patching process at least on a monthly basis to support Command Cyber Readiness Inspection (CCRI) compliance. The Contractor shall follow all aspects of their Continuous Monitoring Plan to include threat modeling, supply chain risk management practices, annual program protection updates, or any significant changes/upgrades to the ICM architecture. Any significant changes/upgrades to the ICM architecture will follow the Engineering Change Proposal process in Section 3.14.

3.5 ICM Secret RMF Authorization

The ICM Solution Software includes all activities leading up to and including the procurement of the separately priced software solutions, completion of fielding and the transition to sustainment to include training support, licensing, configuration management, Secret RMF activities.

Cybersecurity Support The Contractor shall support and participate in Secret authorization process and cybersecurity testing. The Contractor shall provide support for the RMF self-assessment.

3.5.1.1 Secret RMF Self-Assessment Support

The Contractor shall provide self-assessment support to include but not limited to providing system artifact documentation, completing, and providing ACAS vulnerability scans, complying with security controls IAW CNSSI 1253, and assisting in developing POA&M to meet RMF security control requirements. The Government will provide or make available to the Contractor the required security tools needed for Secret RMF activities.

The Contractor shall deliver the following system artifact documentation no later than 15 business days after receipt of order IAW CDRL B002 (DI-MGMT-82001) DOD RMF Package Deliverables:

• SVD, CDRL A001

• Software User Manual, CDRL A002

• Administrator Manuals / Guides

• System Security Plan, CDRL B002 o System Architecture Description o Components o Configurations o Accreditation/Authorization Boundaries o Compliant Network Diagrams o External Interfaces and Data Flow o Internal Data Flow o Contingency Plan (to include backup/restore/recovery procedures) o Hardware Lists (NETCOM HW/SW Template) o Ports, Protocols, and Services (PPS) o Configuration Management Plan o Configuration Management Policy o Account Management Plan o Continuous Monitoring Plan o Information Assurance Vulnerability Management (IAVM) Plan o RMF Implementation Plan

• Cybersecurity Test Plan, CDRL B002 o Required Vulnerability Scans (ACAS) o STIGs o Security Readiness Guides (SRGs) o Secure Content Automation Protocol (SCAP) benchmarks

• POA&M, CDRL B002

• Operations Security (OPSEC) Plan, CDRL B001

• Configuration Management Implementation Plan

• Maintenance Implementation Plan

• Audit and Accountability Implementation Plan

• System and Information Integrity Implementation Plan

• Identification and Authentication Implementation Plan

• Access Control Implementation Plan

• System and Services Acquisition Implementation Plan

• System and Communications Protection

• Media Protection Implementation Plan

• Incident Response Plan

• System Training Plans & Guides

• FSE Guides

• Testing and Evaluation Plan (security assessment, regression, flaw remediation)

• Secure configuration, installation, operation, and maintenance procedures

• Anti-counterfeit Implementation Procedures

• Supply Chain Protection Implementation Plan

• Controlled Unclassified Information Implementation Plan

(See CDRL DI-MGMT-82001, B002, A001, DI-IPSC-81442A) The Contractor shall comply with all applicable technical, procedural, and system documentation associated with Federal, Department of Defense (DoD), and Army Cybersecurity policy and requirements, including but not limited to the following.

g. Provide system information at the component level including security concepts and procedures and all system component user and maintenance manuals to the security engineering team after receipt of order, IAW CDRL B002. This system information shall become the baseline system configuration.

h. Provide system administration, access, and engineering support to the System Engineering team and installation management personnel from self-assessment activities through final system acceptance.

i. Provide system information and security assistance to the Security Control Assessor (SCA) team to support the Authorizing Official’s (AO) authorization decision process.

j. Provide a copy of complete system documentation including component manuals, configuration guides, administration guides, user guides, and any system unique documentation after receipt of order, IAW CDRL B002. Information System documentation shall describe secure configuration, installation, and operation of the system, component, or service, the application of information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

e. The Contractor shall provide vulnerability scans and deliver ACAS results to the Government, comply with security controls, and apply DISA STIGs monthly or as required. Also, the Contractor shall assist the Government in developing the POA&M to meet RMF requirements.

f. The Contractor shall comply with implementing DoD and ARCYBER mandated requirements to include those of Public Key Infrastructure (PKI) or Multi-Factor Authentication (MFA) requirements, Data-At-Rest Encryption requirements, and Army Enterprise Security Services (AESS) requirements.

Secret RMF Compliance The Contractor shall perform cybersecurity accreditation IAW DoDI 8510.01 RMF for DoD Information Technology and CNSSI 1253 Security Categorization and Control Selection for National Security Systems.

During the early stage of RMF process, the Contractor’s system will be assessed for categorization for CIA impact levels and applicable security controls will be identified. The Contractor shall enable their solution to meet the requirements from the security controls by applying the required DISA STIGs which are applicable to the system. All applicable security controls identified in the CNSSI 1253 publication and STIGs shall be assessed to ensure security controls and STIGS are examined, and tested, ensuring authorization decision requirements are addressed.

The Contractor shall provide cybersecurity control artifacts that are compliant with the CNSSI 1253 publication.

No tools are authorized for generation of artifacts except those posted to the Army OIA&C site or KS site.

Artifacts provided must meet the requirements of Army and DoD guidance IAW B002.

3.6 ICM Top Secret RMF Authorization

The ICM Solution Software includes all activities leading up to and including the procurement of the separately priced software solutions, completion of fielding and the transition to sustainment to include training support, licensing, configuration management, and RMF activities.

Cybersecurity Support The Contractor shall support and participate in Top Secret authorization process and cybersecurity testing. The Contractor shall provide support for the RMF self-assessment.

3.6.1.1 RMF Self-Assessment Support

The Contractor shall provide self-assessment support to include but not limited to providing system artifact documentation, completing, and providing ACAS vulnerability scans, complying with security controls IAW CNSSI 1253, and assisting in developing POA&M to meet RMF security control requirements. The Government will provide or make available to the Contractor the required security tools needed for RMF activities.

The Contractor shall deliver the following system artifact documentation via JWICS no later than 15 business days after receipt of order IAW CDRL B002 (DI-MGMT-82001) DOD RMF Package Deliverables:

• SVD, CDRL A001

• Software User Manual, CDRL A002

• Security Plan, CDRL B002 o System Architecture Description o Components o Configurations o Accreditation/Authorization Boundaries o Compliant Network Diagrams o External Interfaces and Data Flow o Internal Data Flow o Contingency Plan (to include backup/restore/recovery procedures) o Incident Response Plan o Hardware Lists (NETCOM HW/SW Template) o Software/Firmware Lists o Ports, Protocols, and Services (PPS) o Configuration Management Plan o Information Assurance Vulnerability Management (IAVM) Plan o RMF Implementation Plan

• Cybersecurity Test Plan, CDRL B002 o Required Vulnerability Scans (ACAS) o STIGs o Security Readiness Guides (SRGs) o Secure Content Automation Protocol (SCAP) benchmarks

• POA&M, CDRL B002

• Software User Manuals, CDRL A002

• Administrator Manuals/Guides

• Operations Security (OPSEC) Plan, CDRL B001

• Configuration Management Implementation Plan

• Maintenance Implementation Plan

• Audit and Accountability Implementation Plan

• System and Information Integrity Implementation Plan

• Identification and Authentication Implementation Plan

• Access Control Implementation Plan

• System and Services Acquisition Implementation Plan

• System and Communications Protection

• Media Protection Implementation Plan

• Incident Response Plan

• System Training Plans & Guides

• FSE Guides

• Testing and Evaluation Plan (security assessment, regression, flaw remediation)

• Secure configuration, installation, operation, and maintenance procedures

• Anti-counterfeit Implementation Procedures

• Supply Chain Protection Implementation Plan

• Controlled Unclassified Information Implementation Plan

(See CDRL DI-MGMT-82001, B002, A001, DI-IPSC-81442A) The Contractor shall comply with all applicable technical, procedural, and system documentation associated with Federal, Department of Defense (DoD), and Army Cybersecurity policy and requirements, including but not limited to the following.

a. Provide system information at the component level including security concepts and procedures and all system component user and maintenance manuals to the security engineering team after receipt of order, IAW CDRL B002. This system information shall become the baseline system configuration.

b. Provide system administration, access, and engineering support to the System Engineering team and installation management personnel from self-assessment activities through final system acceptance.

c. Provide system information and security assistance to the Security Control Assessor (SCA) team to support the Authorizing Official’s (AO) authorization decision process.

d. Provide a copy of complete system documentation including component manuals, configuration guides, administration guides, user guides, and any system unique documentation after receipt of order, IAW CDRL B002. Information System documentation shall describe secure configuration, installation, and operation of the system, component, or service and the application of information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

The Contractor shall provide vulnerability scans and deliver ACAS results to the Government, comply with security controls, and apply DISA STIGs. Also, the Contractor shall assist the Government in developing the POA&M to meet RMF requirements.

TOP SECRET RMF Compliance The Contractor shall perform cybersecurity accreditation IAW DoDI 8510.01 RMF for DoD Information Technology (IT) and CNSSI 1253 Security Categorization and Control Selection for National Security Systems.

During the early stage of RMF process, the Contractor’s system will be assessed for categorization for CIA impact levels and applicable security controls will be identified. The Contractor shall enable their solution to meet the requirements from the security controls by applying the required DISA STIGs which are applicable to the system. All applicable security controls identified in the CNSSI 1253 publication and STIGs shall be assessed to ensure security controls and STIGS are examined, and tested, ensuring authorization decision requirements are addressed.

The Contractor shall provide cybersecurity control artifacts that are compliant with the CNSSI 1253 publication.

No tools are authorized for generation of artifacts except those posted to the Army OIA&C site or KS site.

Artifacts provided must meet the requirements of Army and DoD guidance IAW B002.

TOP SECRET Cybersecurity Compliance The ICM Solution shall meet all applicable security control requirements so that an ATO can be obtained. Once an authorization decision has been obtained, the Contractor shall continue to sustain the security posture of the system baseline to maintain the compliance of the ATO requirement. The Contractor shall maintain IAVM patching process at least monthly to support CCRI compliance.

Cybersecurity Compliance The ICM Solution shall meet all applicable security control requirements so that an ATO can be obtained. Once an authorization decision has been obtained, the Contractor shall continue to sustain the security posture of the system baseline to maintain the compliance of the ATO requirement. The Contractor shall maintain IAVM patching process at least on a monthly basis to support CCRI compliance. The Contractor shall follow all aspects of their Continuous Monitoring Plan to include threat modeling, supply chain risk management practices, annual program protection updates, or any significant changes/upgrades to the ICM architecture.

Any significant changes/upgrades to the ICM architecture will follow the Engineering Change Proposal process outlined in Section 3.14.

3.7 ICM Functional Configuration Audit

The Contractor shall provide no less than one and no more than four (4) SMEs to support the Government Functional Configuration Audit, after receiving an order, for a duration not expected to exceed three (3) days.

This audit shall include, at a minimum, verification that the system complies with the applicable PRD requirements, incorporated within Section J of the contract. The FCA will occur in the Aberdeen, MD area, other designated Government location, or at the Contractor’s location, at the discretion of the Government.