TO 0001-Order-SOW-CDRLs.pdf

Section B - Supplies or Services and Prices

AMOUNT

Infrastructure and Maintenance

FFP

The contractor shall provide Infrastructure and Maintenance support services on a monthly basis IAW Basic Contract, CLIN 0003, # SOW-2020-011, Section 3.6.1, and TO 0001 SOW # 2020-011-01.

Year 1

FOB: Destination

PSC CD: 7010

NET AMT

Materials for Replacement Parts Cost The contractor shall provide materials as required IAW Basic Contract CLIN 0013, SOW # 2020-011, Section 3.1.11 and TO 0001 SOW # 2020-011-01.

Year 1

MAX COST

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE

0001 9 Months

0002 1 Lot

OPTION Infrastructure and Maintenance

The contractor shall provide Infrastructure and Maintenance support services on a monthly basis IAW Basic Contract CLIN 0003, SOW-2020-011, Section 3.6.1 and

TO 0001 SOW # 2020-011-01.

Year 2

OPTION Materials for Replacement Parts

Year 2

0003 12 Months

0004 1 Lot

The contractor shall provide Infrastructure and Maintenance support services on a

Year 3

Year 3

0005 12 Months

0006 1 Lot

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

OPTION

Infrastructure and Maintenance

12 Months

The contractor shall provide Infrastructure and Maintenance support services on a monthly basis IAW Basic Contract CLIN 0003 # SOW-2020-011, Section 3.6.1 and TO 0001 SOW # 2020-011-01.

Year 4

PCS CD: 7010

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

OPTION

Materials for Replacement Parts

1 Lot

The contractor shall provide materials as required IAW Basic Contract, CLIN 0013, SOW # 2020-011, Section 3.1.11 and TO 0001 SOW # 2020-011-01.

Year 4

The contractor shall provide Infrastructure and Maintenance support services on a

Year 5

PCS CD: 7010

Year 5

0009 12 Months

0010 1 Lot

Section C – Descriptions and Specifications

C1 Order of Precedence

STATEMENT OF WORK

The SOW, under Attachment 1, is incorporated into Section C1 for purposes of FAR Clause 52.215-8, “Order of Precedence”.

Section E – Inspection and Acceptance

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government 0002 Destination Government Destination Government 0003 Destination Government Destination Government 0004 Destination Government Destination Government 0005 Destination Government Destination Government 0006 Destination Government Destination Government 0007 Destination Government Destination Government 0008 Destination Government Destination Government 0009 Destination Government Destination Government 0010 Destination Government Destination Government

• Inspection and Acceptance shall consist of maintaining a 95% availability of the PCTE infrastructure calculated on a monthly basis.

• The 95% availability shall be measured against each RCS individually. The availability time is 24 hours a day, 7 days a week.

• Unavailability of RCS fielded facilities, networks connectivity, or awaiting Government provided replacement parts is deleted from the platform availability time. (Reference SOW Para 3.2.1)

Section F - Deliveries or Performance

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAC/CAGE

0001 POP 1-SEP-2021 TO

31-MAY-2022

N/A N/A

FOB:

Destination

0002 POP 1-SEP-2021 TO

31-MAY-2022

0003 POP 1-JUN 2022 TO

31-MAY-2023

0004 POP 1-JUN 2022 TO

31-MAY-2023

0005 POP 1-JUN 2023 TO

31-MAY-2024

0006 POP 1-JUN 2023 TO

31-MAY-2024

0007 POP 1-JUN 2024 TO

31-MAY-2025

0008 POP 1-JUN 2024 TO

31-MAY-2025

0009 POP 1-JUN 2025 TO

31-MAY-2026

0010 POP 1-JUN 2025 TO

31-MAY-2026

Section G – Contract Administration Data

CLAUSES INCORPORATED BY FULL TEXT

252.232-7006 WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (DEC 2018)

(a) Definitions. As used in this clause—

“Department of Defense Activity Address Code (DoDAAC)” is a six position code that uniquely identifies a unit, activity, or organization.

“Document type” means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

“Local processing office (LPO)” is the office responsible for payment certification when payment certification is done external to the entitlement system.

“Payment request” and “receiving report” are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) Electronic invoicing. The WAWF system provides the method to electronically process vendor payment requests and receiving reports, as authorized by Defense Federal Acquisition Regulation Supplement (DFARS) 252.232- 7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) WAWF access. To access WAWF, the Contractor shall—

(1) Have a designated electronic business point of contact in the System for

Award Management at https://www.beta.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) WAWF training. The Contractor should follow the training instructions of the WAWF

Web-Based Training Course and use the Practice Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the “Web Based Training” link on the WAWF home page at https://wawf.eb.mil/.

(e) WAWF methods of document submission. Document submissions may be via web entry, Electronic Data Interchange, or File Transfer Protocol.

(f) WAWF payment instructions. The Contractor shall use the following information when submitting payment requests and receiving reports in WAWF for this contract or task or delivery order:

(1) Document type. The Contractor shall submit payment requests using the following document type(s):

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items—

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

Combo Type invoice for FFP orders

(Contracting Officer: Insert applicable invoice and receiving report document type(s) for fixed price line items that require shipment of a deliverable.)

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

See (A) above

(Contracting Officer: Insert either “Invoice 2in1” or the applicable invoice and receiving report document type(s) for fixed price line items for services.)

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial item financing, submit a commercial item financing request.

(2) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

[Note: The Contractor may use a WAWF “combo” document type to create some combinations of invoice and receiving report in one step.]

(3) Document routing. The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in WAWF when creating payment requests and receiving reports in the system.

Routing Data Table*

Field Name in WAWF Data to be entered in WAWF Pay Official DoDAAC To be completed at Contract Award Issue By DoDAAC W900KK Admin DoDAAC** To be completed at Contract Award Inspect By DoDAAC W906ZL Ship To Code To be identified with each TO Ship From Code Mark For Code To be identified with each TO/DO Service Approver (DoDAAC) Service Acceptor (DoDAAC) Accept at Other DoDAAC LPO DoDAAC DCAA Auditor DoDAAC N/A Other DoDAAC(s)

(*Contracting Officer: Insert applicable DoDAAC information. If multiple ship to/acceptance locations apply, insert “See Schedule” or “Not applicable.”)

(**Contracting Officer: If the contract provides for progress payments or performance-based payments, insert the DoDAAC for the contract administration office assigned the functions under FAR 42.302(a)(13).)

(4) Payment request. The Contractor shall ensure a payment request includes documentation appropriate to the type of payment request in accordance with the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) Receiving report. The Contractor shall ensure a receiving report meets the requirements of DFARS Appendix F.

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity’s WAWF point of contact.

- Ronald Crowder, ronald.j.crowder.civ@mail.mil, ph 407-208-3032, Group Administrator (GAM)

- Thomas Bunch, thomas.j.bunch.civ@mail.mil, ph 407-384-3792, GAM

Officer: Insert applicable information or “Not applicable.”)

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

(End of clause)

G2 - Contract Administration Data

Payment Instructions:

https://www.acq.osd.mil/dpap/dars/pgi/pgi_htm/current/PGI204_71.htm#payment_instructions, G3 AWARD/EXERCISE OF OPTION

The Government may unilaterally exercise any or all CLINs designated as an option in Section B of this task order.

These option CLINs will be exercised at the Government’s discretion to extend the period of performance of the task order up to twelve (12) months, but may be for less time. Such options may be exercised by issuing a contract modification not later than the last day of the current period of performance. The Government shall comply with FAR 52.217-9, “Option to Extend the Term of the Contract” notice requirements.

Option CLINs

Description of CLIN Exercise Period

CLIN 0003 Infrastructure and Maintenance 1 Jun 2022 – 31 May 2023 CLIN 0004 Materials 1 Jun 2022 – 31 May 2023 CLIN 0005 Infrastructure and Maintenance 1 Jun 2023 – 31 May 2024 CLIN 0006 Materials 1 Jun 2023 – 31 May 2024 CLIN 0007 Infrastructure and Maintenance 1 Jun 2024 – 31 May 2025 mailto:ronald.j.crowder.civ@mail.mil mailto:thomas.j.bunch.civ@mail.mil http://www.acq.osd.mil/dpap/dars/pgi/pgi_htm/current/PGI204_71.htm#payment_instructions http://www.acq.osd.mil/dpap/dars/pgi/pgi_htm/current/PGI204_71.htm#payment_instructions http://www.acq.osd.mil/dpap/dars/pgi/pgi_htm/current/PGI204_71.htm#payment_instructions

CLIN 0008 Materials 1 Jun 2024 – 31 May 2025 CLIN 0009 Infrastructure and Maintenance 1 Jun 2025 - 31 May 2026 CLIN 0010 Materials 1 Jun 2025 – 31 May 2026

W900KK-20-F-CT01

Section J - List of Documents, Exhibits and Other Attachments

EXHIBITS AND ATTACHMENTS

Section J - List of Documents, Exhibits and Other Attachments Type Name Description

Attachments Attachment 1 Statement of Work, #2020-011-01

Attachment 2 DD254, DoD Contract Security Classification Specification (See Basic Contract, Attach 14)

Attachment 3 Government Furnished Property Listing (See Basic Contract Attach 9)

Attachment 4 Government Equipment (PCTE HW-SW) Property Listing (See Basic Contract Attach 10)

Exhibits CDRL A101 Contractors Progress, Status and Management Report DI-MGMT-80227 CDRL A102 Report, Record of Meeting Minutes DI-ADMN-81505 CDRL B101 Maintenance Plan DI-MISC-80711A CDRL B102 Trouble Ticketing/Problem Reporting Plan DI-MISC-80711A CDRL C102 Property Management System Plan DI-MISC-80711A CDRL C101 PCTE Consolidated GFE Report DI-MGMT-80269 CDRL C104 Logistics Product Data DI-SESS-81758 CDRL C103 Priced Bill of Materials DI-MGMT-81994 CDRL C105 Commercial Off-The-Shelf (COTS) Manuals and

Associated Supplemental Data

DI-TMSS-80527C

SOW-2020-011-01

STATEMENT OF WORK

for the

Cyber Training, Readiness, Integration, Delivery and Enterprise Technology (Cyber TRIDENT)

Task Order One (1) - Persistent Cyber Training Environment (PCTE) Infrastructure and Maintenance

U.S. Army Program Executive Office for Simulation, Training, and Instrumentation (PEO STRI)

12211 Science Drive Orlando, FL 32826-3276

Revision Number Date Log of Changes Made and Description of

Reason Changes Approved By

Table of Contents

1. SCOPE

1.1 Introduction

1.2 Goals and Objectives

2. APPLICABLE DOCUMENTS

3. REQUIREMENTS

3.1 Program Management

3.1.1 Monthly Report

3.1.2 Associate Contractor Agreements (ACAs)

3.1.3 Schedule

3.1.4 Risk Management

3.1.5 Program Management Reviews (PMRs)

3.1.6 Facilities

3.1.6.1 Contractor’s Developmental/Test Facilities

3.1.6.2 Sensitive Compartmented Information Facility (SCIF)

3.1.7 Material Acquisition - Computer Hardware, Enterprise Software Solutions

(CHESS) Program

3.2 Operations

3.2.1 PCTE Maintenance and Support

3.2.2 Infrastructure Tier 3 Technical Support

3.3 Cybersecurity

3.3.1 Risk Management Framework (RMF)

3.3.1.1 Cyber Reports and Tasks Schedules

3.3.1.2 Cyber Technical and Meeting Support

3.3.2 Army Training and Certification Tracking System (ATCTS) Training

3.3.3 OPSEC Clauses/COMSEC/Declassification

3.3.3.1 Requirements for OPSEC Training:

3.3.3.2 Anti-Terrorist Training (AT Level 1)

3.3.3.3 Active Shooter Training

3.3.3.4 Access to Government Information Systems

3.3.3.5 Professional Training and Certification

3.3.3.6 Personal Identifiable Information (PII)

3.3.3.7 Security and Access Controls

3.3.3.7.1 General Security

3.3.3.7.2 Security Clearances

3.3.3.7.3 Access and General Protection/Security Policy and Procedures

3.3.3.7.4 Handling or Access to Classified Information

3.3.3.7.5 Disclosure of Information

3.3.3.7.6 Effective Use of Controls

3.3.3.7.7 System Security Plan (SSP)

3.4 Logistics

3.4.1 Maintenance Support

3.4.2 Property Accountability and Management

3.4.2.1 Inventory Support

3.4.3 Supply Management

3.4.4 Licensing and Warranty Management

3.4.5 Supportability

3.4.6 Software Asset Management

3.4.7 Obsolescence Management/Diminishing Manufacturing Sources and

Material Shortages (DMSMS)

3.4.8 Item Unique Identification (IUID)

4. ADDITIONAL CONTRACTOR REQUIREMENTS

4.1 The Enterprise-Wide Contractor Manpower Reporting Application

(eCMRA)

Statement of Work

SOW-2020-011-01

Cyber Training, Readiness, Integration, Delivery and Enterprise Technology (Cyber TRIDENT)

Task Order One (1) - Persistent Cyber Training Environment (PCTE) Infrastructure and Maintenance

1. SCOPE

This Statement of Work (SOW) defines the scope of the Project Manager Cyber Test and Training (PM CT2) Product Manager Cyber Resiliency and Training (PdM CRT) Cyber Training, Readiness, Integration, Delivery and Enterprise Technology (Cyber TRIDENT) Task Order One (1). The Cyber TRIDENT Indefinite Delivery/Indefinite Quantity (IDIQ) is utilized by Department of Defense (DoD) organizations and other non-DoD agencies that have related cyber training needs. The Cyber TRIDENT IDIQ provides the management, integration, maintenance, and evolution for the PCTE platform, and provides total system/subsystem acquisition life cycle support for the PCTE system baseline.

This Task Order One (1) SOW defines the detailed requirements that PdM CRT requires to have performed under the Cyber TRIDENT IDIQ contract in support of PCTE Infrastructure and Maintenance for the PCTE platform. PM CT2 defines the Infrastructure and Maintenance of the PCTE platform under Cyber TRIDENT Task Order One (1) to include:

• Cybersecurity Maintenance and Compliance

• Information Technology (IT) Support

• Facilities

• Development Regional Compute and Storage (RCS), Production RCS Support

• Tier 3 Infrastructure Technical Support

• Sensitive Compartmented Information Facility (SCIF) Operations

• License Procurement and Management

• Logistics

• Property Management

1.1 Introduction

Task Order One (1) will provide the necessary contractor support for Infrastructure and Maintenance of the PCTE platform. This covers the various hardware and software platforms, networks, and security operations across the fielded sites of PCTE.

1.2 Goals and Objectives

The objective of Cyber TRIDENT Task Order One (1) is to provide Infrastructure and Maintenance for the evolving PCTE Platform. Cyber TRIDENT Task Order One (1) will specifically support the PCTE solution evolving infrastructure and the required maintenance of the infrastructure along with the security operations to comply with all Army and DoD regulations and policies.

2. APPLICABLE DOCUMENTS

The applicable documents listed in the Base SOW are applicable to Task Order 1. Reference Section 2 of the Base SOW for full list.

3. REQUIREMENTS

The contractor shall provide Infrastructure and Maintenance support of the PCTE capabilities.

The contractor shall deliver platform capabilities for integration, to include performing testing prior to fielding the platform. This will require such activities that include IAVA management, IT Support, Facilities, Development RCS, Production RCS, Help Desk, JDIF/SCIF Operations, License Procurement and Management, Logistics, Property Management, Risk Management Framework (RMF)across the PCTE RCS fleet. The contractor shall provide engineering, materials, equipment, testing, technical and operations support for the PCTE as described in this Task Order (TO) One (1) SOW. The work scope of TO 1 shall be managed and tracked within the visibility and construct of the TO 2 established agile ceremonies.

3.1 Program Management

The contractor shall provide the overall management and administrative effort necessary to ensure that the requirements of this TO are accomplished. The contractor shall track TO progress and deliverables, utilizing data driven metrics to inform the Government of the TO status. The contractor shall participate, contribute, and execute as an attendee in the TO hosted agile ceremonies, design reviews, product demonstrations, Integrated Product Team (IPT) meetings, partnering, transition meetings, conferences, installations, post installation assessments, and life cycle planning of current and future systems/software releases.

3.1.1 Monthly Report

The contractor shall submit a Contractor’s Progress and Status Report that provides information to include but not limited to schedules, accomplishments, metrics, risks, issues, problems, and deficiencies related to this TO’s activities. The monthly report shall include, but not be limited to, status on the below requirements. The contractor shall propose additional metrics to better inform the Government on TO status.

• Property Management – the contractor shall identify all new contractor acquired property (CAP) in support of the infrastructure and maintenance and changes to government property inventory (attachment 9) and government furnished property inventory (attachment 10) occurring during month of performance.

• Software Licensing Management – the contractor shall report the purchases, updates and expiration of all software licenses occurring during month of performance.

• Help Desk Metrics – the contractor shall provide metrics on Tier 3 technical support provided during month of support IAW Trouble Ticketing/Problem Reporting Plan

(CDRL B102)

• Infrastructure Availability and Uptime Metrics - the contractor shall provide the availability of the PCTE infrastructure (all RCS nodes) IAW Section 3.2.1 calculated on a monthly basis.

CDRL Number CDRL Name CDRL A101 Contractor’s Progress and Status Report, DI-MGMT- 81928

3.1.2 Associate Contractor Agreements (ACAs)

The contractor shall implement ACAs with other PCTE and third-party contractors as required for exchanging data, accessing and using third party software and equipment, receiving technical support, working interface and integration issues, and DoD cyber user event planning and execution. The contractor shall ensure that ACAs are maintained to achieve development of the platform and maintain PCTE interoperability and event planning and execution, as applicable.

ACAs shall provide for and permit the complete and unbiased exchange of technical information and data relating to PCTE integration, development and deployment. Agreements shall be structured so that all Cyber TRIDENT and PCTE contractors are obligated to protect proprietary data and classified information from all unauthorized use or disclosure. ACAs shall be submitted to the Contracting Officer for review prior to execution.

3.1.3 Schedule

The contractor shall document the planned events and milestones, accomplishments, and activities based on supporting other active TO/DOs. The schedule shall include a detailed account of all tasks necessary to support schedule, goals, and objectives of other active TOs/DOs. The contractor shall demonstrate that schedule activities are synchronized across all other active TOs/DOs, and available for Government review.

3.1.4 Risk Management

The contractor shall promptly notify the Government of contract performance risks, issues, problems, and deficiencies. In accordance with the contractor’s risk management plan, implement risk detection and identification, assignment of risk categories, risk mitigation planning, mitigation plan implementation, corrective action, tracking of compliance, reporting of status and planning for risk abatement. The contractor shall promptly provide and execute corrective actions plans, in consultation with the Government. The contractor shall include in each Contractor’s Progress and Status Report the status of all outstanding contract performance risks, issues, problems, and deficiencies, as well as corrective actions with respect thereto.

3.1.5 Program Management Reviews (PMRs)

The contractor shall host Program TO Review quarterly (per year) to inform the Government of TO risks and issues. The contractor shall conduct Technical Interchange Meetings (TIMs) and In Progress Reviews (IPRs) as directed by the Government. The reviews shall provide a forum for IPT members to clarify the following areas of this TO to include but not limited to:

• Cybersecurity Management and Compliance

• IT Support

• Facilities

• Development RCS, Production RCS

• Logistics

The meetings shall be conducted at the contractor’s facility. PMR shall cover TO program risks and issues that can affect the entire Cyber TRIDENT portfolio, including parallel TOs/DOs-specific issues and risks as appropriate. The contractor shall post agendas and meeting minutes to established web portals or SharePoint sites.

CDRL Number CDRL Name CDRL A102 Report, Record of Meeting/Minutes, DI-ADMN-81505

3.1.6 Facilities

3.1.6.1 Contractor’s Developmental/Test Facilities

The contractor shall operate and maintain a facility that supports all PCTE (TOs/DOs), to include TO 0002 and DO 0003 operations at the Unclassified, Secret, and Top-Secret classification levels with the ability to incorporate PCTE end users to include Government, Industry, and coalition partners. The PCTE program has implemented an Agile software development methodology requiring active and daily on-site Government presence to conduct the various Agile ceremonies including daily standup meetings, weekly Architectural meetings, monthly sprint planning meetings, and release planning workshops. As a result of this active and daily Government presence and to facilitate Government testing and collaboration, the facility shall be located no more than ten (10) miles from PEO STRI at 12211 Science Dr, Orlando, FL 32826.

This facility will include the Government provided PCTE RCS infrastructure to be used as a test bed for system configuration and software development to enable support of the PCTE Production and Development RCS. The facility equipment provided by the Government must be dedicated to PCTE activities and tasks.

The contractor shall provide the necessary physical space, power, cooling, and network connectivity needed to house the Government Furnished Equipment (GFE) hardware, software, and networking components (see Attachment 7). The RCS equipment includes a PCTE development RCS and the facility shall be able to support the build out of RCS configurations.

The contractor shall provide physical space, power and Heating, Ventilation, Air Conditioning (HVAC) in accordance with specifications (see Attachment 7, (e)). The contractor shall provide connectivity to the equipment with appropriate bandwidth to support PCTE’s RCS fleet across multiple classification levels.

The contractor shall establish and enforce security procedures in accordance with (IAW) security classification of products and services and the Contracts Security Classification Specifications, DD Form 254 and addendum sheets for TO 1 according to the National Industrial Security Program Operating Manual (NISPOM) requirements.

The contractor shall provide and manage an integration factory which includes but is not limited to a collaborative meeting space, development environment (i.e., Remote, Compute, and Storage), and tools at an unclassified level. The collaborative meeting space at an unclassified level shall include but not be limited to the following features:

• A core meeting space that supports as least one hundred (100) participants for conducting Agile Ceremonies, traditional Government Ceremonies, and any other ceremonies/meetings required by the contractor’s Agile system engineering process.

• At least five (5) break-out rooms that accommodate at least twenty (20) participants per room.

• Video and audio teleconferencing tools for remote participants in each space / room.

• Video projection system in each space / room.

• Internet and power access for attendees in each space / room.

• Audio system and microphones for projecting participants voice in each meeting space / room.

• Whiteboards and office supplies in each space/room to support Agile Ceremonies, traditional Government Ceremonies, and any other ceremonies/meetings required by the contractor’s Agile system engineering process.

3.1.6.2 Sensitive Compartmented Information Facility (SCIF)

The contractor shall utilize the Government provided SCIF until the contractor provided SCIF is completed and accredited. Upon completion of the contactor provided accredited SCIF, the contractor shall operate and maintain the SCIF at the contractor facility as required to maintain accreditation. See Base Contract SOW, Section 3.1.9.2 for details on SCIF configuration requirements.

3.1.7 Material Acquisition - Computer Hardware, Enterprise Software Solutions (CHESS) Program The contractor shall procure hardware, software, and licensing to support the TO 1 activities to include infrastructure and maintenance related procurements. The contractor shall comply with the Army’s CHESS program when making procurements. Under Program Executive Office Enterprise Information Systems (PEO EIS), CHESS is the mandatory source for commercial Information Technology (IT) purchases. CHESS contracts provide IT products and services that comply with U. S. Army Network Enterprise Technology Command (NETCOM), Army and DoD policy and standards. Purchasers of commercial hardware and software must satisfy IT requirements by utilizing CHESS contracts and DoD Enterprise Software Initiative agreements first, regardless of dollar value. Any purchase made outside of CHESS contracts requires a waiver. A complete list of CHESS contracts and the on-line waiver process can be found at:

https://protectus.mimecast.com/s/yDPLCR6K3OIrGJ7iqywOR?domain=chess.army.mil https://protectus.mimecast.com/s/yDPLCR6K3OIrGJ7iqywOR?domain=chess.army.mil

3.2 Operations

The contractor shall manage PCTE platform operations to ensure a system availability for a high quality, persistent user experience. The work tasks described in this TO are intended to address the core functionalities of capability operations. The contractor shall perform all of the required tasks necessary to ensure the continued functions to support the capability. PCTE will be located at a number of sites enabling cyber range transport capabilities and existing emulated network environments (maneuver areas). The current PCTE sites include:

1. Fort Gordon, GA

2. Ft. Meade, MD

3. Suffolk, VA

4. Joint Base San Antonio, TX

5. Oahu, HI

6. Orlando, FL

3.2.1 PCTE Maintenance and Support

The contractor shall manage the maintenance for PCTE infrastructure (all RCS nodes). This includes but is not limited to the following:

• Shall provide a 95% availability of the PCTE infrastructure calculated on a monthly basis. The 95% availability shall be measured against each RCS individually. The availability time is 24 hours a day, 7 days a week. Unavailability of RCS fielded facilities, networks connectivity, or awaiting Government provided replacement parts is deleted from the platform availability time.

• Coordinate with Government site representatives to facilitate PCTE release deployment schedule and maintenance tasks to not impact PCTE operations

• Assist, maintain, and update Memorandums of Agreement (MOAs) and Inter-Agency Service Agreements (ISAs)

• Perform on-going test and performance validation of the PCTE RCS at designated sites

• Activate and perform ongoing maintenance and monitoring of RCS nodes in accordance with Program Management Office Technical Operations Management (TOM) guidelines to maintain availability of the system

• Regularly apply software patches and updates for any COTS/GOTS products utilized on the PCTE RCS platform

The contractor shall provide on-site maintenance for the PCTE platform for all equipment listed in Attachment 9 and 10 of the Base contract. The contractor shall maintain RCS nodes in a variety of security enclaves. This includes but is not limited to unclassified, secret, and TS/SCI.

The contractor shall develop, maintain, and plan technical patches of the platform for the RCS software, hardware, and network configuration.

CDRL B101 Maintenance Plan, DI-MISC-80711A

3.2.2 Infrastructure Tier 3 Technical Support

PCTE has a multi-tier support structure that is enabled through the Tier 0-3 levels. Tier 0 is the unit providing initial support. Tier 1 is Government provided through the Joint Cyber Training Enterprise (JCTE). Tier 2 is PCTE PM supported. Tier 3 is the Cyber TRIDENT contractor for PCTE Infrastructure related trouble tickets and the PCTE CIC vendors are responsible to cyber training platform software related trouble tickets.

The contractor shall design and implement a Tier 3 Technical Support capability to provide support for escalated PCTE platform and infrastructure related trouble tickets as coordinated from Tier 2. The contractor shall provide technical and subject matter expertise that matches the current baseline and future updated capabilities of PCTE to diagnose and resolve problems identified by Tier 2 and documented in trouble tickets. Tier 3 Technical Support includes resolution of infrastructure problems such as connectivity, diagnostics, interface problems, and performance-related problems. The contractor shall have 24 hours from the point of Tier 3 notification of a trouble ticket to resolve the action. The Tier 3 Technical Support function provides Tier 2 point of access to request help in identification and resolution of enterprise application infrastructure-related problems. The Tier 3 Technical Support function shall maintain support communications through a phone line, dedicated email address, channels on the PCTE platform’s onboard chat capability, and leverage the existing enterprise-wide Trouble Ticketing/Problem Reporting System (TTPRS) accessible from the PCTE platform. The Tier 3 Technical Support shall be staffed in order to provide customer support 24 hours a day, seven (7) days a week.

CDRL Number CDRL Name CDRL B102 Trouble Ticketing/Problem Reporting Plan, DI-MISC-80711A

3.3 Cybersecurity

The contractor shall adhere to the PCTE approved type accreditation. The contractor shall monitor the accreditation compliance of cybersecurity at a number of classification levels and environments to include Closed, Restricted Networks (CRNs), Open Secret Internet Protocol (IP) Router (SIPRNET), Open Non-Classified IP Router (NIPRNET), and Top Secret/Sensitive Compartmented Information (SCI).

The Contractor shall monitor accreditation compliance of the Army Best business Practices Federal Information System Management Act (FISMA) security requirements, Appendix II of OMB A-130, to include the configuration of systems to Security Technical Implementation Guides (STIGs) compliance, patch management, Information Assurance Vulnerability Management (IAVM), AR 380-5, National Security Telecommunications and Information Systems Security Policy (NSTISSP), No. 11 with revisions, “ National Policy Governing the Acquisition of Information Assurance (IA) and IA-enabled Information Technology Product,” DoDI 8500.01, and must be compliant with all NETCOM Tactics Techniques Plans (TTPs) which can be found at Risk Management Framework (RMF) Knowledge website cyclical support to remediate or mitigate know critical issues, and other Information Assurance functions.

1. The contractor shall also ensure that the software, components, and services maintained within PCTE are in accordance with DISA STIG compliance. The contractor shall monitor the DISA STIGs implementation for the IT technology developed and configuration manage the TO 2 completed STIG checklists to enforce compliance.

2. The contractor shall ensure compliance of the Cybersecurity/RMF process to guide management and design actions, document RMF decisions and certification efforts, specify and track RMF requirements, identify possible Cybersecurity solutions, synchronize RMF with CM activities, and maintain operational systems security.

3. The contractor shall conduct assessments of the PCTE supporting infrastructure for security vulnerabilities and weaknesses. The contractor shall report and ensure compliance with protective measures in accordance with the PCTE accreditation to address identified vulnerabilities and weaknesses to the Government.

4. The contractor shall continually evaluate the security of the system, both physical and logical, identifying exposures and providing protective options for reducing security risk.

5. The contractor shall ensure protective measures are maintained to provide Information Security. When Classified or Controlled information is introduced into the PCTE, the contractor shall adhere to the provisions within AR 380-5 regarding the classification, transmission, transportation, and safeguarding of this information. Cryptography shall be Federal Information Processing Standards (FIPS) 140-2 compliant. There shall be a mechanism established to ensure encrypted data can be recovered in the event the primary encryption system fails.

6. The contractor shall maintain protective mechanisms into the system and applications to provide identification and authentication, access control, accountability, availability, confidentiality, privacy, data integrity, and non-repudiation.

7. The contractor shall use Government approved assessment tools to perform cyber security testing to document, verify, and validate each applicable operating system security configuration.

8. The contractor shall provide input into the documentation of the unincorporated security controls defined in the applicable STIG and unincorporated IAVA’s in the Plan of Action and Milestones (POA&M) document to ensure future compliance with the ATO is maintained.

3.3.1 Risk Management Framework (RMF)

The Contractor shall maintain the current PCTE RMF accreditation and perform reaccreditation tasks at the time of recertification. The Contractor shall adhere and ensure compliance with the RMF documentation and participate in the necessary milestones to include, but not limited to, the System Registration Review (SRR), System Security Plan (SSP), System Contingency Plan

(SCP), System Configuration Management Plan (SCMP), systems Plan of Action and Milestones (POA&M), Information Assurance Vulnerability Alert (IAVA) Reports, STIG Deviation Reports, STIG Checklists, Accreditation and Data Flow Boundaries, Software and Hardware Lists for each system configuration.

The Contractor shall ensure the system remains in a configuration compliant with the current type accreditation Authority to Operate (ATO) certification to the RMF Confidentiality, Integrity, and Availability (CIA) and Certification Level (CL) of all levels at moderate. The contractor shall report any ATO waivers or deviations to the PM through the Configuration Management process.

The Contractor shall support Assessment and Authorization associated activities to use a third-party validator to scan the system for IA vulnerabilities. The Contractor shall provide Cybersecurity Subject Matter Expertise (SME) to support the annual review of each accredited system/sub-system’s IA controls according to Federal Information Security Management Act (FISMA) guidance in conjunction with the Information Systems Security Officer (ISSO) and the Information System Security Manager (ISSM) and /or PEO STRI IA designee. The Contractor shall conduct quarterly IA scans on Government Furnished Equipment (GFE) and provide to the Government as part of the annual review.

The Contractor shall follow production specification and evaluation requirements of the National Institute of Standards and Technology (NIST), Special Publications (SP) 800.53 Security and Privacy Controls for Federal Information Systems and Organizations, Committee on National Security Systems Instruction (CNSSI) 4009, CNSS, Glossary, Common Criteria, and National Information Assurance Partnership (NIAP) Approved Product List (APL). All incorporated IA products, and IA-enabled IT products that require use of the product’s IA capabilities, acquired under the contract, shall comply with the National Telecommunications and Information Systems Security Policy (NTSISSP) No. 11 “National Policy Governing Acquisition Assurance (IA) and IA-enabled Technology Product.”

3.3.1.1 Cyber Reports and Tasks Schedules

The Contractor shall complete the following requirements and report:

• Quarterly Reports o IAVA Reports o Vulnerability Scan Reports

ACAS/Nessus Scans SCAP Scan Reports on all COTS Software and Hardware STIG Checklists STIG Deviation Reports Software Security Reports for any developmental software Updated Configuration Drawings Updated Software and Hardware Reports

POA&M

• FISMA Annual Review Report o ACAS/Nessus Scans o SCAP Scan Reports on all COTS Software and Hardware o STIG Checklists o STIG Deviation Reports o Software Security Reports for any developmental software o Updated Configuration Drawings o Updated Software and Hardware Reports o POA&M

3.3.1.2 Cyber Technical and Meeting Support

The cybersecurity team should be integrated in the agile ceremonies and shall attend and support various meetings to include, but not limited to:

• Integrated Product Team (IPT) Meetings

• Program Management Reviews (PMR’s)

• System Testing and/or Integration Events

• Technical Interchange Meetings (TIM)

• Training Events

• Cyber Meetings

• Configuration Management Board Meetings

3.3.2 Army Training and Certification Tracking System (ATCTS) Training The Contractor shall require that lead and support personnel performing Cybersecurity job functions possess the Information Assurance Management (IAM) or Information Assurance Technical (IAT) certification relevant to their role within the execution of this contract and IAW DoDD 8140.01, DoD 8570.01-M, AR 25-2 (4-3 Information Assurance Training), and Army BBP 05-PR-M-002. IA engineers, analysts, and technicians shall complete the required “IA Awareness Training.” Method of training for “IA Awareness training” is https://cs.signal.army.mil/default.asp “DoD Cyber Awareness Mandatory IA Training,” The Contractor’s IA Team shall complete the required “Information Assurance Fundamentals Training.”

1. This shall include the methods, skills, use, and mechanisms to maintain the level of security of the IS.

2. The training shall be geared toward the audience and their roles and responsibilities with respect to the system’s operation and maintenance (i.e., system administrator, network administrator, hardware maintenance, etc.).

https://cs.signal.army.mil/default.asp

3. The contractor shall utilize DOD 8570.01-M as a guide in the development of the IA Training content.

3.3.3 OPSEC Clauses/COMSEC/Declassification

The contractor shall ensure this TO is in compliance with the base contract existing OPSEC Standing Operating Procedure/plan within ninety (60) calendar days of TO award making any necessary updates, to be reviewed and approved by the responsible Government OPSEC officer.

The plan’s updates shall include a process to identify critical information, where it is located, who is responsible for it, how to protect it, and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the Government. In addition, the contractor shall have an identified certified Level II OPSEC coordinator per AR 530-1.

3.3.3.1 Requirements for OPSEC Training:

Per AR 530-1, Operations Security, new contractor employees must complete Level I OPSEC training within thirty (30) calendar days of their reporting for duty. The contractor shall ensure all applicable employees have completed OPSEC initial training, annual refresher training, and shall certify their work force has completed the training through the submission of completion certificates(s) to the COR, or the Contracting Officer when a COR is not assigned, within thirty

(30) days of arrival on the installation. OSPEC training can be accomplished at the Defense Security Services website at: https://securityawareness.usalearning.gov/opsec/

3.3.3.2 Anti-Terrorist Training (AT Level 1)

All contractor employees, to include subcontractor employees, requiring access to DoD installations, facilities and controlled access areas shall complete AT Level I awareness training within thirty (30) calendar days after TO start date or effective date of incorporation of this requirement into the TO, whichever is applicable. The Contractor shall submit certificates of completion for each affected Contractor employee and subcontractor employee, to the COR or to the Contracting Officer within 30 calendar days after completion of training by all contractor employees and subcontractor personnel. AT Level I awareness training is available at the following website: https://atlevel1.dtic.mil/at or other Service specific websites.

The contractor shall ensure all US based Contractor employees and associated subcontractor employees to make available and to receive Government provided area of responsibility (AOR) specific AT awareness training as directed by applicable DoD, Service policy and regulations.

Specific AOR training content is directed by the Combatant Commander with the unit Anti- Terrorism Officer (ATO) being the local point of contact.

3.3.3.3 Active Shooter Training

All contractor employees, to include subcontractor employees, requiring access to DoD installations, facilities and controlled access areas shall complete active shooter training as directed by applicable DoD, Service policy and regulations within thirty (30) calendar days after TO start date or effective date of incorporation of this requirement into the TO, whichever is https://protect-us.mimecast.com/s/10sqC4xvMQuBVRwfNKr6z?domain=securityawareness.usalearning.gov https://protect-us.mimecast.com/s/KTyvC5ywNQFZJwrT4smug?domain=atlevel1.dtic.mil applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR/ACOR or to the Contracting Officer within thirty (30) calendar days after completion of training by all contractor employees and subcontractor personnel.

3.3.3.4 Access to Government Information Systems

All contractor employees with access to a Government Information System must be registered in the applicable Service training and certification system at commencement of TO performance and must successfully complete DoD Information Assurance Awareness training prior to being granted access to information systems (IS) and then annually thereafter.

3.3.3.5 Professional Training and Certification

The contractor shall be responsible to ensure that employees, to include subcontractor employees, at all times maintain the required professional training and certifications required for their job description(s) and role(s).

Per DoD 8570.01-M, DoDD 8140.01, Defense Federal Acquisition Regulation Supplement (DFARS) 252.239.7001 and applicable Service regulations, the contractor employees supporting Cybersecurity/IT functions shall be appropriately certified upon TO award. The baseline certifications as stipulated in DoD 8570.01-M for specific positions shall be completed upon TO award.

3.3.3.6 Personal Identifiable Information (PII)

All contractor employees, to include subcontractor employees, requiring access to DoD installations, facilities and controlled access areas shall complete training in the handling and protection of PII as directed by applicable DoD, Service policy and regulations within thirty (30) calendar days after TO start date or effective date of incorporation of this requirement into the TO, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR/ACOR or to the Contracting Officer within thirty (30) calendar days after completion of training by all contractor employees and subcontractor personnel. PII training is available at https://securityawareness.usalearning.gov/piiv2.

3.3.3.7 Security and Access Controls

3.3.3.7.1 General Security

The contractor shall ensure that personnel at all times comply with applicable Government security policies and procedures. In addition, to ensure expedited reporting, the contractor shall ensure that required security reporting is implemented in a manner that does not require contractor employees to notify contractor management chains of a reportable security situation prior to them reporting it to the appropriate Government channels.

https://protect-us.mimecast.com/s/qeQ6C68xOXurNZ4fjjCh-?domain=securityawareness.usalearning.gov

3.3.3.7.2 Security Clearances

The contractor shall issue security clearances only to those contractors who will have access to classified information up to the TS/SCI level for PCTE. Some positions/duties may not require a clearance, but all positions/duties will require investigation for duties and access to U.S.

Government systems and technical information. The Contractor shall ensure that employees performing under this contract have the appropriate clearance not to exceed the requirements supported.

3.3.3.7.3 Access and General Protection/Security Policy and Procedures Contractor and all associated subcontractor employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation authorities. Contractor workforce shall comply with all personal identity verification requirements as directed by applicable DoD, Service and local policy. In addition to the changes otherwise authorized by the changes clause of this TO, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

The Common Access Card (CAC) shall be the principal identity credential for supporting access to DoD installations, facilities, buildings, controlled spaces, and access to U.S. Government information systems. A National Agency Check with Inquiries (NACI) or equivalent national security clearance [e.g. National Agency Check with Local Agency Checks including Credit Check (NACLC)] will be required for permanent issuance of the credential. The Government may issue the credential upon favorable return of the Federal Bureau of Investigations (FBI) fingerprint check, pending final favorable completion of the NACI or equivalent. There shall be no additional NACI or equivalent submission for an individual holding a valid national security clearance.

The contractor shall account for all forms of U.S Government-provided identification credentials issued to contractor employees in connection with the performance of this TO. The contractor shall return such identification credentials to the issuing agency at the earliest of any of the circumstances listed below, unless otherwise determined by the U.S. Government. The Contracting Officer may delay final payment under an individual TO/DO if the Contractor fails to comply with these requirements. The contractor and all associated subcontractors shall return all identification credentials when:

a. No longer needed for TO performance.

b. Completion of contractor employee’s employment.

c. TO completion or termination.

For all contractors and associated subcontractor employees who do not require a CAC, they must comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB), applicable

Service, installation, facility and area Commander installation/facility access and local security policies and procedures (provided by Government representative), or, at OCONUS locations, in accordance with status of forces agreements (SOFA) and other theater regulations.

3.3.3.7.4 Handling or Access to Classified Information

The contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified "Confidential," "Secret," or "Top Secret". The contractor shall comply with (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DOD 5220.22-M), (2) any revisions to DOD 5220.22-M, and (3) Contract Security Classification Specification (DD Form 254).

3.3.3.7.5 Disclosure of Information

The contractor shall comply with the protection standards and guidance described in DoD Manual 5200.1 to prevent foreign intelligence collection and/or the unauthorized disclosure of information.

3.3.3.7.6 Effective Use of Controls

The contractor shall screen all electronic deliverables or electronically provided information for malicious code using DoD approved anti-virus software prior to delivery to the Government.