A01_-_Performance_Work_Statement_(PWS)_18-R-0025).pdf

PERFORMANCE WORK STATEMENT (PWS)

DEVELOPMENT, OPERATION, SUPPORT AND MAINTENANCE

OF ROLL-ON-ROLL-OFF (RORO) PROCESSING, EXPLOITATION AND DISSEMINATION (PED)

SYSTEM IN SUPPORT OF NETWORKING AND COMMUNICATIONS IN CONTESTED AND

AUSTERE ENVIRONMENTS

09 APRIL 2018

C.1 BACKGROUND

The Sensors and Electron Devices Directorate (SEDD) Intelligence Surveillance and Reconnaissance (ISR) Technology branch at the Army Research Laboratory (ARL) requires end-to-end research and development (R&D) services for the continued development, operation, support, and maintenance of a Roll-On-Roll-Off (RORO) Processing, Exploitation and Dissemination (PED) tactical edge processing system designed for use in contested and austere environments. In its current implementation, RORO consists of three (3) physical servers running VMware’s vSphere virtualized environment connected by a network switch and managed using a system control laptop. RORO’s original design is flexible, versatile, and modular. The current RORO system does, however, have some shortcomings that need to be addressed with additional development. These shortcomings include limitations in virtual machine file management; slower than expected speeds for data storage and retrieval for particular file types; deficiencies in network topology; and incomplete deployment of security controls and enhancements. Once solutions for these deficiencies are identified, developed, and implemented, the system will need to be evaluated in both laboratory and field exercise environments to assess the efficacy of the improvements.

C.2 OBJECTIVE

The objective of this effort is to further develop, support, maintain, and operate the RORO system and thereby advance the state-of-the-art in deployable PED systems at the tactical edge in networking and communications in contested and austere environments.

C.3 PROGRAM REQUIREMENTS

The Contractor shall provide the research and development services necessary to develop solutions to the current system deficiencies and support and maintain the RORO system as an operational PED testbed. Operational support is required both in the lab environment as well as in the field at various events and exercises designed to test and evaluate the RORO system as well as supported ARL Programs. Operating the RORO system in these environments will enable the program to effectively assess the system. The system is required to be maintained in terms of both hardware and software updates and upgrades, including vendor firmware updates and software and operating system patches. System security (Cybersecurity) support is also required.

C.3.1 Project Plan

The Contractor shall establish a project plan for the effort. The Contractor shall ensure the project plan includes all major milestones and project tasks, as well as any deliverables and critical path elements. The Contractor shall also ensure the project plan and any subsequent updates are formatted in Microsoft Project. The Contractor shall provide the project plan to the Contracting Officer’s Representative (COR) no later than ten (10) days after contract award.

The COR will review and approve the initial project plan within one (1) week of receipt.

C.3.2 RORO System Development (CLIN 0001 – Firm Fixed Price-Level of Effort (FFP-LOE))

C.3.2.1 The Contractor shall develop additional capabilities and enhancements to advance the state-of-the-art in tactical edge information processing systems. In particular, the RORO system development will focus on expanded capabilities in virtual machine file management, improved algorithms for data storage and retrieval, improved network topology for faster networking and data throughput, and security enhancements that protect the integrity of the system while maintaining a high level of performance.

C.3.2.2 For virtual machine file management, the Contractor shall evaluate the system for storage and retrieval of virtual machines using both localized storage on individual hypervisor host machines and VMware vSAN storage technology distributed across hosts in the RORO environment.

C.3.2.3 RORO currently relies primarily on standard Windows OS capabilities to manage data storage and retrieval to individual virtual machines, typically using TCP networking protocols. The Contractor shall evaluate additional operating systems and protocols that may improve data storage and retrieval, particularly for large files.

C.3.2.4 The Contractor shall modify and evaluate the network topology in order to provide faster and better access to virtual machine files as well as data files and streams.

C.3.2.5 Finally, the Contractor shall specify, configure, implement and evaluate advanced security hardware and protocols to support network and data sharing with coalition partners in a safe and secure manner. The implementation of DoD RMF cybersecurity controls and proving the effectiveness of system performance is also required.

C.3.2.6 The Contractor shall document the results of C.3.2 within the monthly report (reference section C.3.8).

C.3.3 Operations, Support, and Maintenance (CLIN 0002 – Firm Fixed Price (FFP))

The Contractor shall provide operational support for the RORO system both in the field and in the laboratory environment in order to evaluate the effectiveness of the planned developments to the RORO system. Operational support requirements instantiation, operation, and support of ARL Research Program software and applications within the RORO system.

C.3.3.1 General Research Program Requirements

The Contractor shall modify the baseline RORO configuration to create new virtual machines as required by the COR to meet requirements of specified research programs on an as-needed basis. The Contractor shall document and backup each new virtual machine and restore the baseline lab to the original configuration upon completion of an event or exercise.

C.3.3.2 Field Environment Requirements

C.3.3.2.1 The Contractor shall support Technology Demonstration Events and exercises across the United States and in coalition partner countries. These activities can be as simple as conducting field testing for a particular sensor in a specific environment or as complex as participating in a coalition exercise with multiple sensor packages and multiple system interfaces with coalition partners. The Contractor shall provide onsite operation and support of the RORO system, including but not limited to pre-event preparations, onsite event support, and post-event support activities.

C.3.3.2.2 Pre-event support provided by the Contractor may include integration of the supported technology demonstration or exercise system on the RORO platform, including virtual machine creation, software installation, configuration, testing, documentation, and system pack-up for transport to the event location. RORO system routing and switching configurations may also be tailored to individual research programs on an as-needed basis, with services provided either pre-event or onsite depending on event requirements.

C.3.3.2.3 The Contractor shall provide onsite event support including system administration support for the RORO system at the event. This generally includes onsite networking configuration and support, RORO system administration, end user support, on-demand re-configuration and deployment of virtual machines to support event requirements, and similar functions.

C.3.3.2.4 The Contractor shall provide post-event support including archiving of virtual machines and system configurations, data copying and distribution, RORO pack-up for transport back to ARL, re-configuring RORO for ARL analyst use at ARL, and configuration of RORO for exploitation of acquired data.

C.3.3.2.5 The Contractor shall be required to travel to and from even locations in the US and abroad to provide onsite support.

C.3.3.3 Laboratory Environment Requirements

C.3.3.3.1 The Contractor shall support the RORO platform in the laboratory environment at ARL offices in Adelphi, MD. Typical examples of supported activities include configuration of RORO to support an ARL Program for laboratory testing in a PED environment and configuration of RORO as an analyst PED to exploit data collected at an event or exercise (whether collected on RORO or provided by third party). In support of these activities, the Contractor shall provide onsite operation and support of the RORO system, including but not limited to system configuration, system administration, networking, data management, and related support activities.

C.3.3.3.2 The Contractor shall provide laboratory testing support including integration of the supported ARL Program system on the RORO platform, including virtual machine creation, software installation, configuration, testing, and documentation. The Contractor shall also support tailoring RORO system routing and switching configurations for individual research programs on an as-needed basis.

C.3.3.3.3 The Contractor shall provide system administration and networking support including onsite networking configuration and support, RORO system administration, end user support, on-demand re-configuration and deployment of virtual machines to support event requirements, and similar functions. The Contractor shall also provide backups of system and network configurations as well as the ARL Program virtual machines as required by individual programs.

C.3.3.3.4 The Contractor shall provide data management support including deploying data sets in the RORO environment and configuring access for virtual machines. Smaller data sets shall be backed up where storage capacity is available.

C.3.3.3.5 The Contractor shall document the results of C.3.3 within the monthly report (reference section C.3.8).

C.3.4 Maintenance Requirements

The RORO system comprises of both hardware and software, both of which need to be supported and maintained.

In addition, the documentation package for RORO needs to be maintained and updated to reflect changes and enhancements to the system. Backups are also a required function of system maintenance support, including the baseline infrastructure as well as the ARL Program virtual machine library.

C.3.4.1 The Contractor shall provide ongoing maintenance activities on all configurations and virtual environments, including identification and implementation of updates and patches for operating systems and applications, to ensure the configurations and virtual environments remain fully functional. The Contractor shall provide similar maintenance and update support for hosted systems (virtual machines) at the discretion of the COR. The Contractor shall create or update, as applicable, a System Update Plan for each hardware and OS infrastructure to include all recommended updates, patches and upgrades for the operating systems and applications to remain fully functional.

The Contractor shall check for any updates, patches, and upgrades on an ongoing basis for all virtualization environments and update (and provide to the COR) the Systems Update Plan accordingly. The COR will review the Systems Update Plans within five (5) business days of receipt. Upon COR approval of each Systems Update Plan, the Contractor shall implement each Systems Update Plan to ensure all configurations and virtual environments remain fully functional. The Contractor shall document all maintenance efforts within a System Update Log and deliver a finalized System Update Plan and Log to the COR no later than twelve (12) months after contract award.

C.3.4.2 The Contractor shall deliver updated systems maintained in C.3.3.1 to the COR no later than twelve (12) months after contract award.

C.3.4.3 The Contractor shall create or maintain, as applicable, the documentation for the configured network system (physical network configuration, operating systems, virtualization environment, system capabilities, etc.). At a minimum, system documentation includes: Network Diagram, System Description Document, and Network Configuration documentation.

C.3.4.4 The Contractor shall document the efforts of C.3.4 within the monthly report (reference section C.3.8).

C.3.5 Configuration Testing Requirements

C.3.5.1 The Contractor shall develop a test plan for the hardware, software, and network configurations of the RORO system. The Contractor shall ensure the test plan validates network connectivity, data throughput, and functionality of each configuration individually and as a whole. The Contractor shall then conduct network testing in accordance with the test plan and document the results within a RORO Configuration Test Results Document.

The Contractor shall provide the test plan and the RORO Configuration Test Results Document to the COR no later than twelve (12) months after contract award.

C.3.5.2 The Contractor shall also document the results of C.3.5 within the monthly report (reference section C.3.8).

C.3.6 Backup and Recovery Requirements

C.3.6.1 The Contractor shall conduct separate backup and recovery processes for the following systems: base machine infrastructure, network configuration, and research program-specific virtual machines. The Contractor shall backup server and host system configurations consisting of the base operating systems and virtualization environment as images to enable recovery from system crashes due to localized hardware failures and all similar causes. The Contractor shall enable rapid recovery by also saving the network hardware configuration files along with the testbed images.

C.3.6.2 The Contractor shall create backups for virtual machines on an as-required basis for supported research programs. The backups shall be stored either on the RORO system or exported to external media depending on supported research program requirements.

C.3.6.3 The Contractor shall create or update, as applicable, a Backup Services Plan detailing the recommended backup services, maintenance of system images, and system configuration files and provide this to the COR as the maintenance is required. The COR will review and approve within five (5) business days of receipt. Upon approval, the Contractor shall implement the Backup Services Plan. The Contractor shall also document efforts of routine backup services within a Backup Services Log. The Contractor shall deliver the Backup Services Plan and Backup Services Log to the COR no later than twelve (12) months after contract award.

C.3.6.4 The Contractor shall deliver updated systems backups maintained in C.3.6.3 to the COR no later than twelve

(12) months after contract award.

C.3.6.5 The Contractor shall create or update, as applicable, a separate Backup Test Plan and Results Document reporting all tests performed on backup up and recovery efforts and the subsequent results. The COR will review and approve within five (5) business days of receipt. Upon approval, the Contractor shall implement the Backup Test Plan. The Contractor shall deliver the Backup Test Plan and Results Document no later than twelve (12) months after contract award for COR review. The COR will review and approve within five (5) business days of receipt.

C.3.6.6 The Contractor shall also document the results of C.3.6 within the monthly report (reference section C.3.8).

C.3.7 Cybersecurity and Risk Management Framework (RMF) Requirements

The Contractor shall specify, configure, implement and evaluate a network perimeter security appliance in order to provide a more robust perimeter defense architecture to ensure that communications and data sharing with external networks is well-controlled and limits the exposure of internal systems to adverse events originating from outside the RORO network.

C.3.7.1 The Contractor shall provide all required cybersecurity and RMF services to meet security requirements for securing the RORO system and specific configurations associated with research programs as specified by the COR.

The Contractor shall provide security configuration information and implementation as required by the COR for specific research programs to test and prepare for deployment, or to research the impact of RMF configuration requirements on the functionality of their systems. The Contractor shall create an RMF Documentation Package for the RORO system and infrastructure and deliver the RMF Documentation Package to the COR no later than twelve

(12) months after contract award.

C.3.7.2 The Contractor shall document the efforts of C.3.7 within the monthly report (reference section C.3.8).

C.3.8 Monthly Status Reports

The Contractor shall deliver the monthly status reports via secure communications to the COR on the tenth (10th) day of each month after contract award. The Contractor shall provide monthly status reports summarizing current program accomplishments measured against the tasks outlined previously, identification and summary of any unresolved problems, incurred costs, meetings attended, planned activities for the next month, issues, and recommendations. The Contractor shall ensure the monthly report includes a spending plan for the period of performance; actual expenditures to date; actual expenditures for the month just ended; and monthly and cumulative variation of actual expenditures from the planned expenditures. The Contractor shall include in the spending plan all costs to include labor, overhead expenses, description (to include cost and results obtained) of each trip taken in the previous month, and fees. The Contractor shall also include all updates and changes to the project plan (reference C.3.1) in the monthly status reports. The Contractor shall include detailed copies of all invoices submitted to date for payment from both the Prime Contractor as well as all Subcontractors. The Contractor shall ensure each invoice details the labor categories, labor rates, labor hours, and all Other Direct Costs (ODCs). The Contractor shall also answer the following questions within the monthly reports:

Is the job progressing on schedule?

What is the percent of completion?

What is the dollar value completed?

What is the total number of contract employees currently on contract?

What is the total number of new employees placed on contract this month?

Was Contractor Manpower Reporting (CMR) performed during the monthly reporting period? If so, what information was entered?

What are names of the Contractor personnel, who are/were deployed during the period covered by this monthly report?

C.3.9 Final Report

The Contractor shall deliver a final report summarizing all efforts performed under this contract to include the hardware configuration, software configuration, network design and configuration, testing and results, backup, recovery, as well as any supporting documentation for all of the components of the system. The Contractor shall deliver the final report to the COR no later than two (2) weeks prior to the end of the contract’s period of performance (POP). The COR will review and approve the final report within one (1) week of receipt. Upon approval, the Contractor shall deliver a revised final report to include any required revisions and comments per the COR. The Contractor shall ensure the revised final report is delivered prior to the end of the contract’s POP.

C.3.10 Contract Deliverables

The Contractor shall ensure all data deliverables are provided in accordance with the DD Form 1423 attached in Section J of the contract.

Milestone/Deliverable PWS Reference Due Date

Project Plan C.3.1 No later than ten (10) days after contract award (ACA)

System Update Plan and Log C.3.4.1 No later than (12) twelve Months ACA Updated Systems C.3.4.2 No later than (12) twelve Months ACA Network Diagram, System Description Document, Network Documentation

C.3.4.3 No later than five (5) Months ACA

RORO Configuration Test Plan and Results Document

C.3.5.1 No later than (12) twelve Months ACA

Backup Services Plan and Log C.3.6.3 No later than (12) twelve Months ACA Updated System Backups C.3.6.4 No later than (12) twelve Months ACA Backup Test Plan and Results Document

C.3.6.5 No later than (12) twelve Months ACA

RMF Documentation Package C.3.7 No later than (12) twelve Months ACA Monthly Status Report C.3.8 No later than the 10th day of each month

ACA

Final Report C.3.9 No later than two (2) weeks prior to the end of contract POP

C.3.11 Travel (CLIN 0003 – Firm Fixed Price (FFP))

To the maximum possible extent, the Contractor shall provide electronic media over existing secure high bandwidth or other secure communications links rather than by contractor travel. Travel between the Contractor’s facility and the ARL and various CONUS locations are required. The Contractor shall ensure that all travel is performed in accordance with the Joint Travel Regulations (JTR). The Contractor shall request approval for travel from the COR in writing four (4) weeks prior to scheduling the travel arrangements. The COR will provide approval in writing within two (2) weeks after receipt of the travel request.

C.3.12 Anti-Terrorism Operational Security (AT-OPSEC) Requirements

AT Level I training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I awareness training within XX calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within XX calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: http://jko.jten.mil

Access and general protection/security policy and procedures. This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area. Contractor and all associated sub-contractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204- 9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

For contractors requiring Common Access Card (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

AT Awareness Training for Contractor Personnel Traveling Overseas. This standard language required US based contractor employees and associated sub-contractor employees to make available and to receive government provided area of responsibility (AOR) specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact.

Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems. All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the IS and then annually thereafter.

For contracts that require a formal OPSEC program. The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander. In addition, the contractor shall have an identified certified Level II OPSEC coordinator per AR 530-1.

For contracts that require OPSEC Training. Per AR 530-1 Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

For information assurance (IA)/information technology (IT) training. All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six months of appointment to IA/IT functions.

For information assurance (IA)/information technology (IT) certification. Per DoD 8570.01-M , DFARS

252.239.7001 and AR 25-2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

For Contract Requiring Performance or Delivery in a Foreign Country, DFARS Clause 252.225-7043, Antiterrorism/Force Protection for Defense Contractors Outside the US. The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non-contingency support. The key AT requirement is for non-local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor’s compliance with combatant commander and subordinate task force commander policies and directives.

For contracts that require handling or access to classified information. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with— (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); (2) any revisions to DOD 5220.22-M, notice of which has been furnished to the contractor.

Threat Awareness Reporting Program. For all contractors with security clearances. Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2-4b.

C.3.13 Distribution Statements

C.3.12.1 Determination of Contract Submission Documents:

Distribution Statement A. Approved for public release; distribution is unlimited.

C.3.12.2 Determination of Information generated from the performance of the contract:

Distribution Statement A. Approved for public release; distribution is unlimited.