WOLFDOOR SOW.pdf

UNCLASSIFIED

(U) United States Cyber Command

(USCYBERCOM)

(U) WOLFDOOR CDS Support

Version 1.0

25 March 2021

Statement of Work

WOLFDOOR, 25 March 2021

(U) WOLFDOOR CDS Support

1. (U) Introduction and Background

2. (U) Objectives

3. (U) Scope

4. (U) Applicable Documents

5. (U) Requirements

a. (U) Task 1 – Operational Services Support

b. (U) Task 2 – Security Boundary Services

c. (U) Task 3 – Data Transport Network .............................................................................................. 5-6

d. (U) Manpower Estimate ................................................................................................................... 7-10

e. (U) Surge Capability

f. (U) Management Documentation

6. (U) Security

a. (U) Facility Clearance

b. (U) Personnel and Security Clearance Requirements

7. (U) Key Personnel

8. (U) Place of Performance

9. (U) Period of Performance

10. (U) Reports and Deliverables

a. (U) Monthly Status Report (CDRL Item A001)

b. (U) Project Management Plan (CDRL Item A002)

c. (U) Quarterly Review Report (CDRL Item A003)

d. (U) Trip Agendas and Reports (CDRL Item A004)

e. (U) Other Studies and Reports (CDRL Item A005)

11. (U) Government Furnished Property/Information

12. (U) Travel

13. (U) Other Direct Costs

14. (U) Government Rights

15. (U) APPENDIX I – Labor Categories ......................................................................................... 15-17

Statement of Work

WOLFDOOR, 25 March 2021

(U) STATEMENT OF WORK (SOW)

WOLFDOOR CDS Support

Version 1.0

25 Mar 2021

1. (U) Introduction and Background

(U) USCYBERCOM J9 Acquisition and Technology Directorate is tasked to coordinate, integrate, and prioritize cyberspace capability development efforts to rapidly deliver joint operational products through integrated project delivery, enabling full-spectrum cyberspace operations. The J9 plans and synchronizes joint capability development for the cyberspace domain, rapidly delivers mission-ready operational products and services required for generating, facilitating, or monitoring effects, and operates and maintains USCYBERCOM’s technical baseline to enable the Command to execute its missions.

(U) The WOLFDOOR Cross Domain Program Office was established in 2018, with the deployment and fielding of the WOLFDOOR Cross Domain Solution (CDS), a cyber-operations-focused Guard Farm, capable of moving data securely between U.S. Cyber Command (USCYBERCOM), Intelligence Community (IC), Department of Defense (DoD), and commercial networks. This boundary solution provides robust boundary security and mediation of data and information sources.

USCYBERCOM currently maintains an operation Cross Domain Solution, located at USCYBERCOM-HQ, Fort Meade, MD with a secondary Cross Domain Solution, to be deployed in FY22 at San Antonio, TX.

(U) To meet exponentially growing cyber mission needs, the Command requires expanded infrastructure to meet these mission requirements. The Contractor, in coordination with the Government, shall be responsible for maintaining, replicating, and expanding this infrastructure in support of mission systems. The Contractor shall interact with multiple components of the Joint Cyber Warfighting Architecture (JCWA), to enable the sharing of information and enable mission planning and analysis. Driven by increasing mission needs, dramatic increases in data flow requests require adequate filter development, security, engineering, and testing resources to ensure transport fidelity. New standards and requirements mandate quick adaptation to technically complex compliance standards. Each disparate geographic location requires its own redundant technical staff, and the infrastructural support necessary to maintain operations.

2. (U) Objectives

(U) The goal of the WOLFDOOR CDS Support effort is provide support services to maintain a scalable cross domain solution for USCYBERCOM that is based on industry best practices and the architecture and implementation requirements as specified within the National Security Agency (NSA)/U.S. Cyber Command (USCYBERCOM) Raise the Bar (RTB) Strategy’s Baseline, and to implement those best practices securely and adeptly. The objective is to obtain technical and management support to improve the inherent security of USCYBERCOM’s CDS through actionable engineering practices and in concert with host agency best practices. The goal of this effort is to

Statement of Work

WOLFDOOR, 25 March 2021

UNCLASSIFIED

obtain critical staff redundancy, scalability for multiple geographic locations, support for auxiliary and support functions, increased security support, and the ability to address unanticipated requirements, to include but not limited to: engineering, design, integration, sustainment and documentation.

3. (U) Scope

(U) USCYBERCOM needs support for technical assistance on the design, deployment, and implementation of the Network Security components (e.g., firewalls, switches, VPNs) boundary, and Cross Domain System (CDS) solutions. In-depth knowledge of the architecture, components and devices, and the software used in current programs, as well as those currently under design, will be required to support a viable solution that satisfies the requirements of the WOLFDOOR program.

USCYBERCOM requires engineering and information technology (IT) services to support the WOLFDOOR program’s efforts. These services include, but aren’t limited to: Network Security and CDS design, testing, implementation, sustainment, lab management support, and process engineering.

4. (U) Applicable Documents

(U) Federal Acquisition Regulation (FAR)

(U) Department of Defense Directive (DODD) 5000.01, The Defense Acquisition System

(U) DODD 8570.01, Information Assurance Training, Certification, and Work Force Management

(U) DOD Instruction (DODI) 5000.2, Operation of the Adaptive Acquisition Framework”

(U) DODI 5200.02, DOD Personnel Security Program (PSP)

(U) DODI 8500.1, Cybersecurity

(U) DODI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT)

(U) DODI 8540.01, Cross Domain (CD) Policy

(U) DODI 8580.1, Information Assurance (IA) In The Defense Acquisition System

(U) DoD Test and Evaluation Management Guide, December 2012

(U) USCYBERCOM Instruction 5200-08, Cybersecurity, 12 December 2018

5. (U) Requirements

(U) The Contractor shall provide support for capabilities described below:

a. (U) Task 1 – Operational Services Support

(U) The Contractor shall provide Tier 1, 2 and 3 support for the WOLFDOOR CDS during USCYBERCOM business hours. Business hours support is defined as 0600 to 1800, Monday through Friday, excluding federal holidays. The Contractor shall remotely log into the systems to validate the current operational state and to restore to normal service the guard and associated systems. The Contractor shall provide Tier 3 on-call support. The

Statement of Work

WOLFDOOR, 25 March 2021

UNCLASSIFIED

Contractor shall travel to the operational location when on-site support is necessary. During USCYBERCOM exercises and operations, the Contractor may be required to provide 24/7 support during this time.

(U) The Contractor shall work with USCYBERCOM’s customers to gather and analyze requirements for new data flows through WOLFDOOR. The Contractor shall recommend priorities based on the complexity of the data flow and USCYBERCOM’s overall mission priorities. The Contractor shall use the customer requirements to develop new flows to put through WOLFDOOR or to modify existing flows through WOLFDOOR.

(U) The Contractor shall test all new data flows and modified data flows for correctness and completeness prior to making them operational. The Contractor shall follow all relevant USCYBERCOM or other required government agency Assessment and Authorization (A&A) processes to make all new data flows operational. The Contractor shall follow USCYBERCOM Change Management (CM) processes and relevant A&A processes when making changes to existing data flows. The customer will complete any required documentation for new or modified data flows. The Contractor shall troubleshoot existing data flows as required and modify as needed to resume normal operation. The Contractor shall create and/or maintain all documentation required for A&A certification.

b. (U) Task 2 – Security Boundary Services

(U) The Contractor shall recommend, document, and assist the Government in implementing systematic engineering processes for satisfying new requirements for CDS. The Contractor processes will follow guidelines established by the National Cross Domain Strategy and Management Office. These processes will be added to the USCYBERCOM’s best practices to create a logical and cohesive work flow.

(U) The Contractor shall assist with replicating and maintaining the WOLFDOOR boundary and expand its capabilities to meet emerging mission requirements. The Contractor shall be required to travel to local, continental United States (CONUS) Government sites, as needed, to perform site surveys, and deploy and implement solutions.

The Contractor shall be required to attend program and review meetings. The Contractor shall recommend technical input for the Government’s consideration during the design, implementation, and sustainment of products and solutions. The Contractor shall closely integrate with the CDS Team and coordinate and facilitate CDS needed interconnections.

c. (U) Task 3 – Data Transport Network

(U) The Contractor shall support data flow services to enable the sharing of data between users, across platforms, classifications, and missions. The Contractor shall provide the development, implementation, and sustainment of Command-wide data transport and delivery services for USCYBERCOM and its programs, service elements, and IC partners. Centralized data flow management shall enable increased speed of data flow activations to support mission faster, increased speed and ease cybersecurity approvals and support data flow standards to be utilized across the Command. The Data Transport Network shall provide scalable enterprise data ingest and data forwarding to the correct recipients, whether they are automated systems or individual users. It shall also be built

Statement of Work

WOLFDOOR, 25 March 2021

UNCLASSIFIED

as a secure and accredited solution. Once the Data Transport Network has gained accreditation and is providing services for systems within USCYBERCOM, it shall transition to an operational state. The network shall continue to be developed and enhanced, as well as monitor, maintain and update the production system. The Data Transport Network shall address the following requirements:

Requirement Description/Output

Meet User and Server Use Cases

The data flow service provides data flow transport functionality for 1) user-to-user transport, 2) user-to-server transport, and 3) server-toserver transport. These solutions shall use a variety of technologies but must ensure data is distributed between users and servers to enable successful, data-driven missions.

Provide Command- Wide Data flow Service

A command-wide data flow service provides accredited endpoints to receive and deliver data flow to the appropriate locations and destinations to ensure mission success. This serves as the main highway for data to travel to every significant data flow endpoint with which the Command interacts (i.e. IC partners, services, commercial entities). This service shall be available on every network upon which the Command has mission.

Integrate with Core

Command Services

The Data Transport Network creates pre-authorized paths and integration methods for core services within the Command (i.e. Big Data Platform, WOLFDOOR) to eliminate redundant data flow paths and decrease time to mission for new data flows.

Improve Speed of Data flow Mission

Enablement

The Data Transport Network produces standards that enable data transport to flow at mission speed. The solutions should provide coordination which ensures efforts are not being duplicated across multiple teams. The Data Transport Network must also support real-time/streaming data flows, ad hoc requests, and large data moves.

Create Authoritative

Data flow Standards

The Data Transport Network creates an authoritative data flow nomenclature that is used across the Command on all data flows. This creates standardized methodologies that can be followed by all Command entities to ensure mission delivery, standard compliance, greater visibility and record tracking.

Audit Log Collection

The Data Transport Network provides audit log (i.e. syslog) collection services on each required network. These collectors receive audit logs from any USCYBERCOM system and forward those logs to the appropriate locations to ensure security compliance and enable monitoring.

Statement of Work

WOLFDOOR, 25 March 2021

UNCLASSIFIED

End-to-End Data flow

Monitoring

When the Data Transport Network becomes the central hub for data flowing between users and servers in USCYBERCOM, monitoring these transactions become crucial. By instrumenting and appropriately logging the data provenance of every file and stream of data, the Data Transport Network shall provide greater visibility into the data-driven missions by aggregating and displaying this provenance data so that insight into the metrics, lineage, and auditability will be readily available. This data shall be shared with mission owners to provide accurate insights into the command’s data usage and operational status.

d. (U) Manpower Estimate

(U) The Government anticipates the following manpower levels are required to satisfy this effort. Alternate labor categories and level of effort may be proposed by the Contractor based on the Contractor’s expertise and the Government’s mission requirements. During performance of this effort, the Government reserves the right to realign the labor mix as necessary to address emerging requirements.

Base Period:

Labor Category FTE (1.0 =

1,880 hours) Location

WOLFDOOR CDS

Project Manager 1.0 Fort Meade, MD CDS Specialist I 3.0 Fort Meade, MD CDS Specialist II 1.0 Fort Meade, MD CDS Specialist III 1.0 Fort Meade, MD Software Engineer 2.0 Fort Meade, MD Software Developer 1.0 Fort Meade, MD Security Engineer 1.0 Fort Meade, MD Information Systems Security Officer 0.0 Fort Meade, MD Logistician 0.0 Fort Meade, MD Lab Engineer 0.0 Fort Meade, MD Systems Engineer I 0.0 Fort Meade, MD Systems Engineer II 0.0 Fort Meade, MD Technical Writer 0.0 Fort Meade, MD

Data Transport Network Technical Lead 1.0 Fort Meade, MD Cloud DevOps Engineer 1.5 Fort Meade, MD Cloud Developer 1.5 Fort Meade, MD Cloud Data Flow Engineer 0.0 Fort Meade, MD

Statement of Work

WOLFDOOR, 25 March 2021

UNCLASSIFIED

System Administrator 0.0 Fort Meade, MD

TOTAL 14.0

Option Period I:

Labor Category FTE (1.0 =

1,880 hours) Location

WOLFDOOR CDS

Project Manager 1.0 Fort Meade, MD CDS Specialist I 3.0 Fort Meade, MD CDS Specialist II 2.0 Fort Meade, MD CDS Specialist III 1.0 Fort Meade, MD Software Engineer 2.0 Fort Meade, MD Software Developer 1.0 Fort Meade, MD Security Engineer 2.0 Fort Meade, MD Information Systems Security Officer 1.0 Fort Meade, MD Logistician 1.0 Fort Meade, MD Lab Engineer 1.0 Fort Meade, MD

Systems Engineer I 2.0 Fort Meade, MD

Systems Engineer II 2.0 Fort Meade, MD

Technical Writer 1.0 Fort Meade, MD

Data Transport Network

Technical Lead 1.0 Fort Meade, MD

Cloud DevOps Engineer 1.5 Fort Meade, MD

Cloud Developer 1.5 Fort Meade, MD

Cloud Data Flow Engineer 0.0 Fort Meade, MD

TOTAL 24.0

Option Period II:

1,880 hours) Location

Statement of Work

WOLFDOOR, 25 March 2021

UNCLASSIFIED

WOLFDOOR CDS

Project Manager 1.0 Fort Meade, MD CDS Specialist I 3.0 Fort Meade, MD CDS Specialist II 2.0 Fort Meade, MD CDS Specialist III 1.0 Fort Meade, MD Software Engineer 3.0 Fort Meade, MD Software Developer 1.0 Fort Meade, MD Security Engineer 3.0 Fort Meade, MD Information Systems Security Officer 1.0 Fort Meade, MD Logistician 1.0 Fort Meade, MD Lab Engineer 2.0 Fort Meade, MD Systems Engineer I 3.0 Fort Meade, MD Systems Engineer II 3.0 Fort Meade, MD Technical Writer 1.0 Fort Meade, MD

Data Transport Network Technical Lead 1.0 Fort Meade, MD Cloud DevOps Engineer 1.5 Fort Meade, MD Cloud Developer 1.5 Fort Meade, MD Cloud Data Flow Engineer 0.0 Fort Meade, MD

TOTAL 29.0

Option Period III:

1,880 hours) Location

WOLFDOOR CDS

Project Manager 1.0 Fort Meade, MD

CDS Specialist I 3.0 Fort Meade, MD

CDS Specialist II 2.0 Fort Meade, MD

CDS Specialist III 1.0 Fort Meade, MD

Software Engineer 4.0 Fort Meade, MD Software Developer 1.0 Fort Meade, MD Security Engineer 4.0 Fort Meade, MD Information Systems Security Officer 1.0 Fort Meade, MD Logistician 1.0 Fort Meade, MD

Statement of Work

WOLFDOOR, 25 March 2021

UNCLASSIFIED

Lab Engineer 2.0 Fort Meade, MD Systems Engineer I 3.0 Fort Meade, MD Systems Engineer II 3.0 Fort Meade, MD Technical Writer 1.0 Fort Meade, MD

Data Transport Network Technical Lead 1.0 Fort Meade, MD Cloud DevOps Engineer 1.5 Fort Meade, MD Cloud Developer 4.0 Fort Meade, MD Cloud Data Flow Engineer 1.0 Fort Meade, MD System Administrator 2.0 Fort Meade, MD

TOTAL 36.5

Option Period IV:

1,880 hours) Location

WOLFDOOR CDS

Project Manager 1.5 Fort Meade, MD CDS Specialist I 3.0 Fort Meade, MD CDS Specialist II 2.0 Fort Meade, MD CDS Specialist III 1.0 Fort Meade, MD Software Engineer 4.0 Fort Meade, MD Software Developer 1.0 Fort Meade, MD Security Engineer 4.0 Fort Meade, MD Information Systems Security Officer 2.0 Fort Meade, MD Logistician 2.0 Fort Meade, MD Lab Engineer 2.0 Fort Meade, MD Systems Engineer I 3.0 Fort Meade, MD Systems Engineer II 4.0 Fort Meade, MD Technical Writer 1.0 Fort Meade, MD

Data Transport Network Technical Lead 1.0 Fort Meade, MD Cloud DevOps Engineer 2.0 Fort Meade, MD Cloud Developer 5.0 Fort Meade, MD Cloud Data Flow Engineer 2.0 Fort Meade, MD System Administrator 2.5 Fort Meade, MD

TOTAL 43.0

Statement of Work

WOLFDOOR, 25 March 2021

UNCLASSIFIED

e. (U) Surge Capability

(U) Surge Effort. A surge capability requirement is included to have a contract vehicle in place should emerging circumstances require a quick and temporary increase in effort to meet new requirements within the scope of the existing Statement of Work. The Contractor shall be prepared to evaluate requirements and submit a price proposal for any new requirement for consideration by USCYBERCOM. Surge proposals will be evaluated by the Contracting Officer for fair and reasonable pricing and should be developed based upon the same pricing structure as the original contract proposal. Surge efforts will be incorporated by formal contract modification. Requests for pricing do not constitute any commitment by USCYBERCOM to contract for additional work; contractor will not be reimbursed costs for preparing price proposals for consideration. Surge efforts will not exceed 75% of the annual contract value. Surge efforts executed outside of USCYBERCOM Funding shall not be considered in calculating the total surge value associated with the contract.

f. (U) Management Documentation

(U) The Contractor shall be required to generate Monthly Status reports and Quarterly meetings which shall be used by USCYBERCOM to track progress. Meetings and trips shall be documented.

6. (U) Security (U//FOUO) The contractor shall fully comply with all security requirements established for this contract by the Contract Security Classification Specifications (DD254). The contractor shall submit, update, and maintain a current Contractor Position Roster Log (CPRL). The CPRL is to be managed according to published guidelines from the Office of Security Services Policy Issuance 10-10, Industrial Security Program, dated March 1996.

a. (U) Facility Clearance (U//FOUO) The work to be performed under this contract/order is up to the Top Secret level and will require Sensitive Compartmented Information (SCI) access eligibility for some personnel. Therefore, the company must have a Top Secret Facility Clearance from the Defense Security Service Facility Clearance Branch.

b. (U) Personnel and Security Clearance Requirements (U//FOUO) The contractor shall provide, if necessary, TS/SCI-cleared personnel, with full scope polygraph (unless a conditional certification of acceptance (CCA) is granted), who are qualified and fully trained.

(U//FOUO) All Contractor personnel assigned to work on classified activities shall be cleared, if necessary, at the Top Secret/Sensitive Compartmented Information (TS/SCI) level clearance in accordance with "Personnel Security Requirements for Contractor Access to NSA/CSS Sensitive Compartmented I (Attachment to DD 254)", dated January 2005. Individuals possessing a current Counter intelligence (CI) polygraph will be considered for a contract

Statement of Work

WOLFDOOR, 25 March 2021

UNCLASSIFIED

position that requires a full-scope polygraph if they possess a Conditional Certification of Access (CCA) pending the successful completion and adjudication of a full-scope polygraph.

In certain circumstances and only with COR approval, uncleared personnel may be permitted to perform specific unclassified tasks (e.g. technical writing) without a final security clearance, provided that individual's security clearance has been initiated by submission of security forms and paperwork through proper channels.

(U//FOUO) Uncleared contractor personnel may be authorized to perform unclassified tasks.

However, non-U.S. citizens, to include immigrant aliens, are not authorized access to any portions of this contract or to commence performance of any work under this contract without express written approval from the Contracting Officer. In accordance with the conditions as prescribed by 352.204-9014, NOTIFICATION OF NON-U.S. CITIZEN PARTICIPATION, the contractor shall provide all the requested information for processing of each non-U.S.

citizen seeking access to or being proposed to perform work on this contract.

(U//FOUO) The contractor shall comply with OPSEC plans and policies provided by the government. All subcontracts for which any subcontractor employees will be required to have access to classified information shall also be subject to the same security requirements as set forth above.

7. (U) Key Personnel

(U) The Cross Domain Solution Specialist Skill Level 3 is considered a key personnel position.

The contractor shall fill this position within 15-business days of contract award, and shall provide a letter of intent for the Key Personnel to remain on the contract for at least six months from the contract award. All other positions shall be filled within 90-days after award of the contract. Replacement personnel shall be replaced within 14-days for the key person if they leave the contract and within 30-days for all other positions under the contract. The contractor shall notify the COR of any changes in the key personnel assigned to these positions and provide a resume for the proposed personnel replacement. Qualifications must remain current throughout the period of performance; any deviation from this policy requires authorization from the contracting officer.

8. (U) Place of Performance

(U) The primary place of performance for this effort shall be the USCYBERCOM facilities in the Fort Meade, MD area. Travel in and around the primary place of performance may be required throughout the period of performance. Additional travel within CONUS may be required to support the requirements of this SOW. Approved Contractor facilities with the appropriate facilities clearance and connectivity may be designated as a place of performance.

The Contracting Officer (CO) may designate other sites as required for performance of this effort. As directed by the Contracting Officer, the Contractor shall continue performance in emergency or mission essential conditions. Additionally, the Contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR. Per KO direction, Telework may be authorized to perform unclassified work. When performing unclassified work, the contractor shall telework in accordance with the contractor’s

Statement of Work

WOLFDOOR, 25 March 2021

UNCLASSIFIED

corporate telework policy. Telework shall not create any additional cost to the Government beyond the normal costs of execution of contractual scope of unclassified work.

9. (U) Period of Performance

(U) This contract effort shall consist of a base period, plus 4 option periods. The base period of performance will be 12 months from contract award and each option period will be 12 months from option award.

10. (U) Reports and Deliverables

(U) The Contractor shall deliver all Contract Data Requirements List (CDRL) for the Government to track the Contractor’s deliverables. All CDRLs shall be delivered to the COR in electronic form. CDRLs cover sheet shall indicate the date and tracking / version number of the CDRL document for cross-referencing purposes.

a. (U) Monthly Status Report (CDRL Item A001)

(U) An unclassified itemized financial status report which shall include actual hours by employee, details of ODC expenses, expected funds depletion date, a chart of budgeted cost for work performed (BCWP), actual cost for work performed (ACWP) and variance at completion (VAC) is to be delivered to the COR. Tables, lists and charts shall also be delivered in editable Microsoft Excel format. Monthly Status Reports are due no later than ten

(10) working days after the end of the month.

(U) A work breakdown structure will be provided which shall be in MS Project format, updated for each existing and new significant action item, showing new and completed items that show management metrics. Management metrics that shall include at a minimum: start date, planned and actual hours expended by member of the staff (so that all hours charged against the effort are accounted for), percent completed and finish date.

b. (U) Project Management Plan (CDRL Item A002)

(U) The Contractor shall generate a project management plan (PMP) that shall be delivered no later than three (3) weeks After Receipt of Order (ARO). The plan shall be approved by the COR. The project management plan shall be a tailored document that includes a Work Breakdown Schedule (WBS), a schedule, financial plan, processes for management and addresses when the plan needs to be updated.

c. (U) Quarterly Review Report (CDRL Item A003)

(U) The Contractor shall deliver a quarterly review report to the COR in electronic form. This document will include the activities and progress of efforts in meeting USCYBERCOM goals.

The unclassified document shall indicate the date and tracking / version number of the posted document for cross-referencing purposes. Quarterly Review Reports are due fifteen (15) working days after the end of each quarter, based on calendar year.

Statement of Work

WOLFDOOR, 25 March 2021

UNCLASSIFIED

d. (U) Trip Agendas and Reports (CDRL Item A004)

(U) The Contractor shall deliver trip agendas and reports for each trip outside their place of performance. The trip agenda shall be delivered before the trip commences. The trip report shall be delivered within five (5) business days after returning from the trip.

e. (U) Other Studies and Reports (CDRL Item A005)

(U) On an as required basis, the Contractor shall be tasked to deliver system studies or reports to improve the operation of the WOLFDOOR Cross Domain. Format and Topic of reports shall be determined by operational need and other requirements to be furnished by the Government.

11. (U) Government Furnished Property/Information

(U) No Government Furnished property shall be included in this effort.

12. (U) Travel

(U) Local travel at destinations is authorized. Travel to other locations, including OCONUS, requires prior approval by the Contracting Officer’s Representative (COR).

(U) All travel performed on this contract shall be subject to prior Government COR approval.

All travel shall be performed on a reimbursable basis, and reimbursed in accordance with the Joint Travel Regulations. The contractor shall be responsible for making arrangements for all airfare, car rental, and lodging required during approved trips. The contractor shall be responsible for tracking travel expenditures and reporting usage rates in the monthly status reports.

13. (U) Other Direct Costs

(U) Other Direct Costs, to include incidental material costs, are authorized, with approval by COR and shall be itemized and reported per Contract Data Requirements List (CDRL) item described above.

14. (U) Government Rights

(U) All reference process development, material, documents, training support material, and all other information obtained, produced, or developed by the contractor, inclusive of subcontractors, in support of this effort shall become the property of the United States Government and shall be delivered to the Government. The Government shall have unlimited and unrestricted right to use, modify, reproduce, release, perform, display, or disclose all technical or software data that is developed, updated, modified, or converted under this effort.

The contractor shall not distribute or use the information and data without the express and specific written approval of the COR. See DFARS 252.227-7013(a) and 252.227-7014(a).

Statement of Work

WOLFDOOR, 25 March 2021

15. (U) APPENDIX I – Labor Categories

Critical Job Functions Job Description

Project Manager Ten (10) years of demonstrated experience in managing programs and contracts of similar scope, type, and complexity within the Federal Government is required. Five (5) years of the experience must be within the Department of Defense or Intelligence Community.

Cross Domain Solution Specialist I

Bachelor’s degree in Computer Science, Information Assurance, Information Security System Engineering, or related discipline from an accredited college or university is required.

Must have 5 years of experience with Cross Domain Solutions. DoD 8570 compliance with IASAE Level 1 is required

Cross Domain Solution Specialist II

Ten (10) years of experience on contracts of similar scope, type, and complexity within the Federal Government is required.

A Master’s degree in Computer Science, Information Assurance, Information Security System Engineering, or related discipline from an accredited college or university is required.

Must have 6 years of experience with Cross Domain Solutions.

DoD 8570 compliance with IASAE Level 1 is required.

Cross Domain Solution Specialist

III

(KEY)

Twenty-five (25) years of experience on contracts of similar scope, type, and complexity within the Federal Government is required.

A Master’s degree in Computer Science, Information Assurance, Information Security System Engineering, or related discipline.

Must have 10 years of experience with Cross Domain Solutions. DoD 8570 compliance with IASAE Level 3 is required. CISSP-ISSEP or CISSP-ISSAP Certification is required.

Software Engineer Ten (10) years of experience as a Software Engineer in programs and contracts of similar scope, type, and complexity is required.

A Bachelor’s degree in Computer Science, Information Assurance, Information Security System Engineering or related discipline is required.

Software Developer Ten (10) years of experience as a Software Developer in programs and contracts of similar scope, type, and complexity is required.

Bachelor’s degree in Computer Science or related discipline from an accredited college or university is required.

Security Engineer Candidate must possess ten (10) years of experience with Information Systems Security on programs of similar size, scope, and complexity A Bachelor’s degree in Computer Science, Information Assurance, Information Security System Engineering or related discipline is required.

Statement of Work

WOLFDOOR, 25 March 2021

UNCLASSIFIED

Information Systems Security Officer

Five (5) years ISSE experience on programs and contracts of similar scope, type, and complexity within the Federal Government is required.

Bachelor’s degree in Computer Science, Information Assurance, Information Security System Engineering, or related discipline from an accredited college or university is required.

DoD 8570 compliance with IASAE Level 1 is required

DoD 8570 compliance with IASAE Level 3 is required. Both Information Systems Security Engineering Professional (ISSEP) and CISSP Certifications are required.

Logistician Two (2) years of experience as a Logistician on programs of similar size, scope, and complexity. It is highly desired that the candidate possess a Security+ certification or comparable Information Assurance Training (IAT) Level II certification.

Lab Engineer Five (5) years of experience as a Lab Engineer on programs of similar size, scope, and complexity. Candidate must possess a Security+ certification or comparable Information Assurance Training (IAT) Level II certification per DoD 8140 requirements

Systems Engineer I Four (4) years of experience in Systems Engineering practices on programs of similar size, scope, and complexity. Candidate must possess a Security+ certification or comparable Information Assurance Training (IAT) Level II certification per DoD 8140 requirements.

Systems Engineer II Ten (10) years of experience in Systems Engineering practices on programs of similar size, scope, and complexity. Candidate must possess a Security+ certification or comparable Information Assurance Training (IAT) Level II certification per DoD 8140 requirements.

Technical Writer Five (5) years generating technical documentation relating to IC/DoD electronic equipment and systems.

Technical Lead Ten (10) years of experience with Cyber Security on programs of similar size, scope, and complexity.

Three (3) years of experience providing technical leadership on programs of similar size, scope, and complexity.

A Master’s degree in Computer Science, Information Assurance, Information Security System Engineering, Business or related discipline.

DoD 8570 compliance with IASAE Level 2 is required.

AWS Certified Solutions Architect – Associate certification (or greater)

Statement of Work

WOLFDOOR, 25 March 2021

UNCLASSIFIED

Cloud DevOps Engineer

Eight (8) years of experience in Linux and syslog on programs of similar size, scope, and complexity.

DoD 8570 compliance with IASAE Level 1 is required.

Experience working in DoD/IC classified cloud Environments Experience solving dataflow challenges for unclassified and classified DoD/IC systems

Cloud Developer Eight (8) years of experience in software development/engineering, including requirements analysis, software development, installation, integration, evaluation, enhancement, maintenance, testing, and problem diagnosis/resolution, on programs of similar size, scope, and complexity.

Experience developing software to be deployed in AWS, developing analytics

Cloud Data Flow Engineer

Eight (8) years of experience in dataflow technologies or system engineering on programs of similar size, scope, and complexity.

Three (3) years of experience with designing, developing, testing, and integrating dataflow and data flow systems.

Three (2) years of experience with corporate dataflow tools (e.g. NiFi, JDTS) Experience integrating with cross domain solutions DoD 8570 compliance with IASAE Level 1 is required.

System Administrator

Two (2) years Linux system administrator experience, on programs of similar size, scope, and complexity.

Two (2) years of troubleshooting network issues