Page 1 of 35

Performance Work Statement (PWS)

Mission Command Software Support (MCSS)

SSESR-2066-MCSS 12/06/2016

Version 1.0

Page 2 of 35

1 Scope ................................................................................................................................................ 4

1.1 Background ................................................................................................................................... 4

1.2 Applicability ................................................................................................................................... 5

1.3 Order Type .................................................................................................................................... 7

1.4 Period of Performance ................................................................................................................ 7

1.5 Place of Performance.................................................................................................................. 7

1.5.1 Onsite (Government Facility) .................................................................................................. 7

1.5.2 Offsite (Contractor Facility) ..................................................................................................... 7

2 Applicable Documents and Websites .......................................................................................... 7

2.1 Governing Documents ................................................................................................................ 7

2.2 Reference Documents ................................................................................................................ 8

3 Requirements .................................................................................................................................. 8

3.1 General .......................................................................................................................................... 8

3.1.1 Materials, Equipment and Facilities ....................................................................................... 8

3.1.2 Security ...................................................................................................................................... 9

3.1.3 Inspection and Acceptance / FOB ......................................................................................... 9

3.1.4 Phase In and Phase Out ......................................................................................................... 9

3.1.5 Task Order Management ...................................................................................................... 10

3.1.6 Travel ....................................................................................................................................... 10

3.1.7 Personnel Qualifications........................................................................................................ 10

3.1.8 Work Hours ............................................................................................................................. 11

3.1.9 Contractor Manpower Reporting (CMR) ............................................................................. 11

3.1.10 Contractor Mandatory Training .......................................................................................... 11

3.1.11 Formal Reviews .................................................................................................................... 12

3.2 Performance ............................................................................................................................... 12

Page 3 of 35

3.2.1 Program Management ........................................................................................................... 12

3.2.2 Research, Experimentation, and Analysis .......................................................................... 13

3.2.3 Software Development .......................................................................................................... 16

3.2.4 Post Deployment Software Support (PDSS) and Post Production Software Support (PPSS) ............................................................................................................................................... 23

3.2.5 Test and Evaluation ............................................................................................................... 25

3.2.6 Cybersecurity .......................................................................................................................... 29

3.2.7 Lab Support ............................................................................................................................. 30

4 Deliverables ................................................................................................................................... 31

5 Data Rights .................................................................................................................................... 34

6 Software Assurance ..................................................................................................................... 34

List of PWS Appendices

• APPENDIX A Level of Effort (LOE) • APPENDIX B Quality Assurance Surveillance Plan (QASP) • APPENDIX C System Description • APPENDIX D Contract Data Requirements Lists (CDRLs) • APPENDIX E Travel Summary • APPENDIX F Data Rights • APPENDIX G Operational Security (OPSEC) • APPENDIX H Outside Contiguous United States (OCONUS) Travel Requirements • APPENDIX I Contractor Non-Disclosure • APPENDIX J Personal Financial Interest • APPENDIX K Government Furnished Equipment • APPENDIX L Not used • APPENDIX M Categorization of Software Anomalies • APPENDIX N Not used • APPENDIX O Acronyms • APPENDIX P Staffing of Critical Personnel • APPENDIX Q SEC Transition Checklist

Page 4 of 35

Performance Work Statement (PWS) SSESR-2066-MCSS

1 Scope This Performance Work Statement (PWS) describes the requirements for consolidated technical, engineering, and management services to be provided the U.S. Army Communications-Electronics Command (CECOM), Software Engineering Center (SEC), Command, Control, and Communications Tactical Directorate (C3T). The Contractor shall provide software engineering support services to the SEC mission supporting Program Executive Office (PEO) C3T, specifically Program Managers (PM) Mission Command; Product Manager (PdM) Tactical Mission Command (TMC); PdM Strategic Mission Command (SMC); PdM Joint Battle Command Platform (JBC-P); Assistant Secretary of the Army for Acquisition, Logistics, and Technology ASA (ALT); Joint Staff (J6); and PM Warfighter Information Network Tactical (WIN-T).

The scope of this task order encompasses systems engineering support for the SEC C3T portfolio of systems. This portfolio of systems includes all hardware and software applications directly and indirectly supported by SEC C3T. This portfolio is expected to have the same basic requirements as the previous period of performance to align with both Army and Mission Command modernization strategies and new versions of the Common Operating Environment (COE). The portfolio names can change and systems’ capabilities may be shifted from one system to another by the Program Manager.

1.1 Background The SEC C3T Directorate’s mission is to serve as the software technical lead in the evaluation, insertion, and integration of emerging software technology focused on the Command, Control, Communications, Computers, Intelligence, Sensors and Reconnaissance (C4ISR) domain with an emphasis on Command and Control (C2); the current and future Army Battle Command System (ABCS); and enabling strategic and tactical systems. In addition, C3T is responsible for supporting the PM Mission Command and PEO C3T’s mission to ensure that software has been correctly developed, documented, and is supportable during post deployment. Software suitability and supportability are paramount responsibilities of SEC C3T. There is no requirement for software purchasing under this task order.

Each fiscal year, SEC and its customers agree on high-level tasks and resource levels to achieve mission goals. In addition to universal tasks for SEC C3T's portfolio of systems, this PWS is structured to encompass specific tasks outlined in the fiscal year functional support agreements. These specific tasks are representative of the knowledge, skills, and abilities needed as universal requirements. This PWS captures the support required for the entire period of performance.

Page 5 of 35

During the development phase of an ABCS, SEC C3T provides the required software engineering management support and technical expertise. SEC C3T provides software engineering support in the design, development, and implementation of software, which includes ensuring that all user and software requirements are satisfied, defects are corrected, and mission objectives are fulfilled. SEC C3T develops and establishes concepts and methodologies for technical and operational execution of software engineering.

SEC C3T supports customers to ensure their mission objectives are met. For the purpose of this task order, the primary customer is Project Manager (PM) Mission Command (MC). PM MC includes the areas of maneuver, fires, sustainment, airspace management, and air defense. Mission Command Capabilities and Services (MCCS) provides various command and control capabilities and services to support the engineering and standardized implementation of common enterprise services across Tactical Units for the purposes of creating greater interoperability and supportability. Under PM MC, SEC C3T provides support to the following Product Managers (PdMs): PdM Tactical Mission Command (TMC), PdM Strategic Mission Command (SMC), and PdM Joint Battle Command Platform (JBC-P). PdM Tactical Mission Command (TMC) provides future capabilities for the common operation picture, real-time situational awareness, and the enabling infrastructure for Mission Command systems. PdM Strategic Mission Command (SMC) supports software solutions to the Army, Joint, and coalition partner communities. PdM SMC products include Global Command and Control System Army (GCCS-A), Multilateral Interoperability Programme (MIP), Command Post Computing Environment (CP CE), Command Web, Widget development, Command Post of the Future (CPOF), Battle Command Common Services (BCCS) Infrastructure, and Common Software. PdM Joint Battle Command Platform (JBC-P) provides mission command and situational capabilities. Products include computer hardware, software, and communications and network management infrastructure to form an integrated system. PdM JBC-P products include Mounted Android Computing Environment (MACE), Field Service Station (FSS), and Blue Force Tracking (BFT) Global Network (BGN) Network Operations Center (NOC).

PM MC's focus is the Command Post Computing Environment (CP CE), which is a common, scalable, integrated Mission Command architecture and infrastructure (e.g., hardware, services, applications) aligned with the Common Operating Environment (COE) that will improve interoperability, reduce costs, and reduce development and deployment timelines. The CP CE, one of several computing environments under the Army’s COE, is comprised of a partnership between multiple Program Managers with the goal of simplifying hardware and software infrastructures for Command Posts from Battalion to Corps and Army levels. CP CE will consolidate and simplify into a single computing environment the separate capabilities commanders use for missions related to fires, logistics, intelligence, and airspace management.

1.2 Applicability This task order is within the scope of the basic Systems and Software Engineering Support Next Generation (SSES NEXGEN) BASIC PWS as indicated below:

Page 6 of 35

MCSS Task Order PWS Paragraph SSES NEXGEN Paragraph(s)/Subparagraph(s)

1.5 Place of Performance 3.6 Facilities

3.1.1 Materials, Equipment and Facilities 3.1.1 Materials, Equipment and Facilities

3.1.2 Security 3.1.2 Security

3.1.4 Phase In and Phase Out 3.2.1.9. Phase In and Phase Out, 3.2.1.9.1 Phase In, and 3.2.1.9.2 Phase Out

3.1.5 Task Order Management 3.5 Contract Program Management

3.1.6 Travel 3.5.4 Travel

3.1.7 Personnel Qualifications 3.5.1 Contractor Personnel

3.1.8 Work Hours 3.5.1.6 Hours Worked

3.1.9 Contractor Manpower Reporting (CMR) 3.9 Contractor Manpower Reporting (CMR)

3.1.10 Contractor Mandatory Training 3.10 Contractor Mandatory Training

3.1.11 Formal Reviews 3.7 Formal Reviews

3.2.1 Program Management 3.5 Contract Program Management

3.2.2 Research, Experimentation, and Analysis

3.3.1 System and Software Acquisition Support, 3.3.7 Software Architecture and Technology (A&T) Support, and 3.3.8 Software Technology Demonstration and Transition

3.2.3 Software Development 3.3.7 Software Architecture and Technology (A&T) Support and 3.3.8 Software Technology Demonstration and Transition

3.2.4 Post Deployment Software Support (PDSS) and Post Production Software Support (PPSS)

3.3.2 Support to SEC Software support Environments and Facilities and Post Production Software Support (PPSS) and Post Deployment Software Support (PDSS)

3.2.5 Test and Evaluation 3.3.3 Field Support and 3.3.6 System Integration and Exercise Support

3.2.6 Cybersecurity 3.3.10 Cyber Security, Information Assurance and Software Assurance Support

3.2.7 Lab Support 3.3.6 System Integration and Exercise Support and 3.3.11 Information Technology Infrastructure Support

Page 7 of 35

1.3 Order Type This task order is a Cost Plus Fixed Fee (CPFF) Term for all line items other than travel and materials. Travel and materials are on a Cost reimbursement basis in accordance with FAR 16.302.

1.4 Period of Performance The period of performance shall be a twelve (12) month base period with two twelve (12) month option periods.

1.5 Place of Performance

1.5.1 Onsite (Government Facility) At least 80% of contract performance shall be at the primary Place of Performance for this task order. Appendix A (Level of Effort) outlines which labor categories shall be at Aberdeen Proving Ground (APG), MD; Ft. Hood, TX; and Ft. Bliss, TX in accordance with NEXGEN BASIC PWS paragraph 3.6 (Facilities).

1.5.2 Offsite (Contractor Facility) Up to 20% of contract performance shall be in a contractor facility in accordance with NEXGEN BASIC PWS paragraph 3.6 (Facilities) and Appendix A (Level of Effort). Offsite contractor and subcontractor personnel must be located in the Contiguous United States (CONUS).

2 Applicable Documents and Websites The following documents and websites are referenced for the performance of this task order. The Government reserves the right to update applicable documents.

2.1 Governing Documents Document Location Publication Date

Army Regulation 25-1, Army Information Technology

https://ia.signal.army.mil/docs/r25_1.pdf 25 June 2013

Army Regulation 25-2, Information Assurance

https://ia.signal.army.mil/docs/AR25-2.pdf 24 Oct 2007

Army Training and Doctrine Command (TRADOC) Regulation 350-70, Army Learning Policy and Systems

http://www.tradoc.army.mil/tpubs/regs/TR350-70.pdf

6 December 2011

Army Regulation 700-142, Type Classification, Materiel Release, Fielding, and Transfer

http://www.apd.army.mil/Search/ePubsSearch/ePubsSearchForm.aspx?x=AR

2 June 2015

Chairman of the Joint Chiefs of Staff Instruction (CJSCI)

https://dap.dau.mil/policy/Documents/2015/CJCSI_3170_01I.pdf

23 January 2015

Page 8 of 35

3170.01I, Joint Capabilities Integration and Development System

Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs)

http://iase.disa.mil/stigs/Pages/index.aspx N/A

DoD Instruction 8500.01 Cybersecurity

http://www.dtic.mil/whs/directives/corres/pdf/850001_2014.pdf

14 Mar 2014

DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT)

http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf

24 May 2016

2.2 Reference Documents

Document Location Publication Date

Department of Defense Architecture Framework (DoDAF)

http://dodcio.defense.gov/Library/DoDArchitectureFramework.aspx

N/A

MIL-STD-2525, Joint Military Symbology

http://quicksearch.dla.mil/qsDocDetails.aspx?ident_number=114934

10 June 2014

MIL-STD-40051-2C, Preparation of Digital Technical Information for Page-Based Technical Manuals (TMs)

http://quicksearch.dla.mil/qsDocDetails.aspx?ident_number=216338

15 December 2015

3 Requirements

3.1 General

3.1.1 Materials, Equipment and Facilities All requirements and sub-requirements of paragraph 3.1.1 (Materials, Equipment, and Facilities) of the SSES NEXGEN BASIC PWS apply to this task order. A list of government furnished materials, equipment, and facilities for this task order is provided in Appendix K (Government Furnished Equipment).

Page 9 of 35

3.1.2 Security All requirements and sub-requirements of paragraph 3.1.2 (Security) of SSES NEXGEN BASIC PWS apply to this task order. The highest level of facility clearance required for the contractor to perform on this task order is SECRET. The highest level of classified material the contractor will be required to safeguard at its own facility is UNCLASSIFIED. The following security requirements apply to this task order and are further described in the DD Form 254, Contract Security Classification Specification (See Appendix G):

• This contract will require access to Communications Security (COMSEC) information. • This contract will require access to Non-Sensitive Compartmented Information (SCI)

Intelligence Information. • This contract will require access to NATO Information. • This contract will require access to Foreign Government Information. • This contract will require access to For Official Use Only Information (FOUO.) • In performing this contract, the contractor will have access to classified information only

at another contractor's facility or a government activity. • In performing this contract, the contractor will have access to U.S. Classified information

outside the U.S., Puerto Rico, U.S. Possessions and trust territories. • In performing this contract, the contractor will have operational security (OPSEC)

requirements. • In performing this contract, the contractor will have sensitive IT duties.

3.1.3 Inspection and Acceptance / Free On Board (FOB) Delivery, inspection, and acceptance shall be at APG, MD.

Ship to address is:

CECOM Life Cycle Management Command SEC, C3T Directorate 6010 Frankford St. Aberdeen Proving Ground, MD 21005 ATTN: Project Lead

All deliverables shall be delivered to the Government in accordance with (IAW) this PWS paragraph 3.2 (Performance) and Appendix D (CDRLs).

3.1.4 Phase In and Phase Out All requirements of paragraph 3.2.1.9 (Phase In and Phase Out) of the SSES NEXGEN BASIC PWS apply to this task order, with the following changes: Transition periods are scheduled for the 60 days immediately after task order start date (phase in) and for the 60 days prior to contract end date (phase out) to allow for orderly contract transition. The Contractor shall provide a staffing plan for the critical personnel in accordance with the timelines specified in Appendix P (Staffing of Critical Personnel). The Contractor shall

Page 10 of 35

prepare and deliver a Phase In Plan IAW CDRL F002 (DI-MISC-80508B) and Phase Out Plan IAW CDRL F003 (DI-MISC-80508B). Deliverables F002 Technical Report-Study/Services subtitled Phase In Plan F003 Technical Report-Study/Services subtitled Phase Out Plan

3.1.5 Task Order Management All requirements and sub-requirements of paragraph of 3.5 (Contract Program Management) of the SSES NEXGEN BASIC PWS apply to this task order. Additionally, the Contractor shall provide Monthly Status Reports IAW CDRL E003 (DI-MGMT-80368A), Weekly Status Reports IAW CDRL E004 (DI-MGMT-80368A), and Monthly Performance and Cost Reports IAW CDRL B002 (DI-FNCL-80912). Deliverables B002 Performance and Cost Report E003 Status Report subtitled Monthly Status Report E004 Status Report subtitled Weekly Status Report

3.1.6 Travel All requirements of paragraph 3.5.4 (Travel) of the SSES NEXGEN BASIC PWS apply to this task order.

A summary of anticipated travel is provided in Appendix E (Travel Summary). OCONUS travel requirements are provided in Appendix H (OCONUS Travel Requirements).

3.1.7 Personnel Qualifications The Contractor shall employ only personnel who meet the minimum qualifications provided under Appendix A, are fully qualified, and are competent to perform the tasks specified in this PWS. The Contractor shall ensure that all personnel are utilized in a manner that maximizes productivity and efficiency. To ensure that contractor personnel meet or exceed the proposed category descriptions, qualifications, minimum technical skills, and experience specified in Appendix A of this PWS, the Contracting Officer’s Representative (COR) may verify contractor personnel resumes.

The critical personnel specified in Appendix A of this PWS are considered to be essential to work performance. At least thirty (30) days prior to diverting any of the specified individuals to other programs or contracts (or as soon as possible if an individual must be replaced, for example, as a result of leaving the employment of the Contractor), the Contractor shall notify the Contracting Officer and submit a Status Report subtitled Critical Personnel Change IAW CDRL E001 (DI-MGMT-80269). This comprehensive justification for the diversion or replacement of critical personnel (including proposed substitutions for critical positions) will permit the Government to evaluate the impact on performance the requested diversion or replacement will have under this contract. Critical positions shall be filled within thirty (30) calendars days of any vacancy. Non-critical positions shall be filled within forty-five (45) calendar days of any vacancy.

Page 11 of 35

The Contractor and its employees, as appropriate, shall be required to sign Non-Disclosure Agreements in Appendix I and Contractor Employee Personal Financial Interest/Protection of Sensitive Information Agreement in Appendix J (Personal Financial Interest).

3.1.8 Work Hours All requirements of paragraph 3.5.1.6 (Hours Worked) of the SSES NEXGEN BASIC PWS apply to this task order.

The Contractor is authorized to work an Alternate Work Schedule (AWS), with approval by the Contracting Officer or designee, provided that there is no impact to cost or performance. AWS is defined as both flexible work schedules and compressed work schedules. Flexible work schedule is defined as, in the case of a full-time employee, an eighty (80) hour biweekly basic work requirement that allows an employee to determine his or her own schedule within the limits set by SEC, and in the case of a part-time employee, a biweekly basic work requirement of less than eighty (80) hours that allows an employee to determine his or her own schedule within the limits set by SEC. Compressed work schedule is defined as, in the case of a full-time employee, an eighty (80) hour biweekly basic work requirement that is scheduled by an agency for less than ten (10) workdays, and in the case of a part-time employee, a biweekly basic work requirement of less than eighty (80) hours that is scheduled by an agency for less than ten (10) workdays and that may require the employee to work more than eight (8) hours in a day.

Should situations arise in which the advance notice as set forth in paragraph 3.5.1.6 (Hours Worked) of the SSES NEXGEN BASIC PWS cannot be met, Government support of Contractor extended hours or overtime shall be handled on a case-by-case basis.

3.1.9 Contractor Manpower Reporting (CMR) All requirements of paragraph 3.9 (Contractor Manpower Reporting) of the SSES NEXGEN BASIC PWS apply to this task order.

3.1.10 Contractor Mandatory Training The training of Contractor personnel shall be accomplished by the Contractor at the Contractor’s expense, except when the Procurement Contracting Officer (PCO) gives prior approval for training to meet requirements specific to a particular task under this task order. Training at Government expense shall not be authorized solely for the purpose of keeping Contractor personnel abreast of the state-of-the-art technology pertaining to this task order.

The Contractor shall complete all government mandated training requirements, as determined by CECOM SEC for Contractor employees, which occur during the period of performance for this task order. Contractors shall track mandatory training compliance using their own resources. The use of the Total Employee Development (TED) system is not required.

The Contractor shall track training and certification status on the Monthly Status Report IAW CDRL E003 (DI-MGMT-80368A). Deliverables

Page 12 of 35

E003 Status Report subtitled Monthly Status Report

3.1.11 Formal Reviews All requirements and sub-requirements of paragraph 3.7 (Formal Reviews) of the SSES NEXGEN BASIC PWS apply to this task order, with the following changes: A post-award orientation shall be held at the government's facility at APG, Maryland within fifteen (15) working days after award of contract. The Contractor shall prepare and deliver Record of Meeting Minutes IAW CDRL A001 (DI-ADMN-81505). Deliverables A001 Report, Record of Meeting Minutes

3.2 Performance The following section specifies the Performance Objectives and Performance Elements for the contract.

3.2.1 Program Management

3.2.1.1 The Contractor shall build, deliver, and maintain a Work Breakdown Structure (WBS) and Integrated Master Schedule (IMS) for the SEC C3T portfolio of systems.

The IMS aligns with SEC C3T customers' development, logistics, and fielding schedules. IMS components include software releases, documentation deliveries, and test events. Deliverables E005 Contract Work Breakdown Structure (WBS) E008 Integrated Program Management Report (IPMR) subtitled Integrated Master Schedule

3.2.1.2 The Contractor shall develop, maintain, and deliver cost and manpower reports for all efforts included in this task order.

The Government reserves the right to call for informal management and/or cost status reviews, as needed, to be held either telephonically or at the government facility. These formal and informal reviews do not relieve the Contractor from its ongoing responsibility to promptly inform the Government of problematic issues that affect or may affect performance, cost, or schedule. Deliverables B001 Funds and Manpower Expenditure Report

Page 13 of 35

B002 Performance and Cost Report E001 Status Report subtitled Critical Personnel Change E006 Contract Funds Status Report 3.2.1.3 The Contractor shall provide technical support to working groups, reviews, meetings, and conferences for SEC C3T.

Technical support to include identification, preparation, and planning of objectives, documents, and test cases for participation in technical audits, design reviews, milestone reviews, Integrated Product Teams (IPTs), configuration control boards, working groups/meetings, and conferences. Deliverables A001 Report, Record of Meeting Minutes E004 Status Report subtitled Weekly Status Report F009 Trip Report

3.2.2 Research, Experimentation, and Analysis

3.2.2.1 The Contractor shall gather, analyze, and manage customer software requirements for the SEC C3T portfolio of systems.

To include requirements management, requirements traceability and bidirectional requirements traceability. Deliverables C001 Software Requirements Specification (SRS) C003 System/Subsystem Specification (SSS) F004 Technical Report-Study/Services subtitled Requirements Traceability Matrix 3.2.2.2 The Contractor shall develop system models for the SEC C3T portfolio of systems.

Development to include use of case models, class diagrams, and sequence diagrams. Deliverables C005 Software Design Description (SDD) 3.2.2.3 The Contractor shall assess and design system and system of systems architectures for the SEC C3T portfolio of systems.

Deliverables C004 System/Subsystem Design Description (SSDD) C011 Interface Control Document (ICD) 3.2.2.4 The Contractor shall research, analyze, and recommend cost-effective improvements to address capability gaps and performance improvements for current and future systems.

Page 14 of 35

Emerging technologies for solutions include mobile and cloud computing, Variable Message Format (VMF) messaging, smart clients, handhelds, databases, web services, cybersecurity, single sign-on authentication, and Commercial Off-the-Shelf (COTS)/Government Off-the-Shelf (GOTS) hardware and software. Deliverables F006 Technical Report-Study/Services subtitled Technical Analysis 3.2.2.5 The Contractor shall design data management, backwards compatibility, and translation solutions for interoperability between Army, Joint Military Services, and Coalition Military systems.

Deliverables C005 Software Design Description (SDD) F006 Technical Report-Study/Services subtitled Technical Analysis 3.2.2.6 The Contractor shall develop and demonstrate new capabilities/systems and prototypes for enhancements to SEC C3T portfolio of systems.

Performance Standards a a) STD: Response time to resolve identified defects AQL: 100% of critical defects (those that would result in an unfavorable recommendation or block formal tests, certification, or fielding) are resolved within timelines mutually determined by the Government and the Contractor b) STD: Response time to resolve identified vulnerabilities AQL: 100% of critical vulnerabilities (those that would result in an unfavorable recommendation or block formal tests, certification, or fielding) are resolved within timelines mutually determined by the Government and the Contractor Deliverables D001 Computer Software Product End Items 3.2.2.7 The Contractor shall evaluate, recommend, document, and implement new software development methodologies and tools for risk management and process improvement.

Deliverables F006 Technical Report-Study/Services subtitled Technical Analysis 3.2.2.8 The Contractor shall provide engineering support for systems engineering activities for Multilateral Interoperability Programme (MIP).

Engineering support to include analysis, evaluation, design, and implementation of data exchange database models compliant with MIP implementation specifications, the MIP

Page 15 of 35

Technical Interface Design Plan, and enhancements and new MIP data exchange and interoperability requirements. Deliverables C005 Software Design Description (SDD) E004 Status Report subtitled Weekly Status Report F006 Technical Report-Study/Services subtitled Technical Analysis F009 Trip Report 3.2.2.9 The Contractor shall provide engineering support planning, research, and systems engineering for Coalition Warrior Interoperability eXploration, eXperimentation, eXamination, eXercise (CWIX) and Bold Quest.

Engineering support to include gathering and analysis of requirements, development of translation, security, and chat software solutions, and setup and maintenance of Combined Federated Battle Laboratories Network (CFBLNet) connection. Deliverables C005 Software Design Description (SDD) E004 Status Report subtitled Weekly Status Report F006 Technical Report-Study/Services subtitled Technical Analysis F009 Trip Report 3.2.2.9.1 The Contractor shall evaluate and document common standards and specifications for security services, data exchange, data mediation, web services, and service management and control.

Research will involve collaboration with mission partners to identify and demonstrate options for secure data exchange and information sharing. Deliverables C005 Software Design Description (SDD) F006 Technical Report-Study/Services subtitled Technical Analysis 3.2.2.9.2 The Contractor shall participate in planning conferences and exchanges for identification of objectives, test case development, and technical documentation.

Deliverables E004 Status Report subtitled Weekly Status Report F009 Trip Report 3.2.2.9.3 The Contractor shall develop prototypes for Public Key Infrastructure (PKI), data mediation solutions between Army and mission partners, Identity and Access Management (IdAM), and service management and control.

Performance Standards a) STD: Response time to resolve identified defects AQL: 100% of critical defects (those that would result in an unfavorable recommendation or block formal tests, certification, or fielding) are resolved within timelines mutually determined by the Government and the Contractor

Page 16 of 35

b) STD: Response time to resolve identified vulnerabilities AQL: 100% of critical vulnerabilities (those that would result in an unfavorable recommendation or block formal tests, certification, or fielding) are resolved within timelines mutually determined by the Government and the Contractor Deliverables D001 Computer Software Product End Items

3.2.3 Software Development

3.2.3.1 The Contractor shall develop, update, and maintain code and build scripts for the SEC C3T portfolio of systems.

To include new enhancements, debugging software defects, baseline upgrades, performance improvements, technical incident reports from test events, and refactoring. Performance Standards a) STD: Response time to resolve identified defects AQL: 100% of critical defects (those that would result in an unfavorable recommendation or block formal tests, certification, or fielding) are resolved within timelines mutually determined by the Government and the Contractor b) STD: Response time to resolve identified vulnerabilities AQL: 100% of critical vulnerabilities (those that would result in an unfavorable recommendation or block formal tests, certification, or fielding) are resolved within timelines mutually determined by the Government and the Contractor Deliverables C007 Software Test Report D001 Computer Software Product End Items 3.2.3.1.1 The Contractor shall provide engineering support new development and maintenance for Command Web including the SMC Widgets (e.g., Engineering Widget, Maneuver Widget, Project Widget, and 3D Common Map Widget).

Engineering support includes: • Upgrade the Maneuver Widget and SMC Widgets for modern web standards and

technologies • Develop situational awareness playback capability for the Maneuver Widget • Develop additional map engines, map tools, and core data services for the 3D Common

Map and Extensible Mapping Platform (EMP) • Consolidate Joint Command and Control Content Manager (JC2 CM) and the Maneuver

Widget • Update SMC widgets for current and future COE architectures • Updates include single sign-on, authentication, authorization, visualization, geospatial,

data management, and enhanced messaging integration for COE architectural changes • Provide upgrades to SMC Widgets for EnRoute Mission Command Capability (EMC2)

Page 17 of 35

Deliverables: D001 Computer Software Product End Items 3.2.3.1.2 The Contractor shall provide engineering support for new development and maintenance for virtualized GCCS-A components and Joint Command and Control (JC2).

Engineering support includes: • Integrate and upgrade new versions of Global Command & Control System – Joint

(GCCS-J) components • Upgrades include operating system upgrades, Java version upgrades, and Common

Operational Picture (COP) Sync Tool (CST) • Develop COP and content management capabilities for Keyhole Markup Language

(KML), graphic overlays, situational awareness, and alerts • Develop, design, and integrate Ozone Widget Framework (OWF), Joint Command and

Control Common User Interface (JC2CUI), and Ozone Platform (OZP) packages for strategic and tactical deployments

• Design, develop, and integrate data translation services and capabilities for Army and Joint services interoperability

3.2.3.1.3 The Contractor shall develop software compatible with Command Post, Mounted, and Tactical Computing Environment (CP/M/TCE) Technical Guidance and Mission Command Modernization architecture.

Engineering Support includes: • Develop and integrate security solutions, open source changes, and Software

Development Kits (SDKs) for Android and Linux operating systems, to include Android mobile applications, security guards, credential authentication and authorization, utilities, system configurators, additional SDK development, Android Open Source Project (AOSP) modifications, Linux kernel modifications, Android SELinux policy implementation, GeoLinux kernel technical support, and hybrid operating systems

• Develop software solutions for data modeling, persistence, access, and synchronization to include development of Tactical Cloud Reference Implementation (TCRI), Mission Command Data Services (MCDS), and Semantically Extensible Attribute Model (SEAM)

• Develop common network communications stacks and libraries for operation in the upper and lower tactical internets, to include integration of the Command and Control Interface (C2I) UltraLite and support of components and interfaces

• Develop cross-platform user interface frameworks for handheld, mounted, and command post environments, to include Tactical Applications (TacApps) and smart client user interfaces

• Develop frameworks, components, and application programming interfaces (APIs) for geospatial and mapping platforms, to include Geographical Information Systems (GISs), display and manipulation of military symbology, API wrappers, map implementation layers, software development kits (SDKs), and third-party developer support

• Develop backwards compatibility solutions for interoperability with previous capability sets and operating environments to include data interoperability and transformations for

Page 18 of 35

Data Dissemination Service (DDS), Command and Control Interface (C2I), United States Message Text Formats (USMTFs) and Variable Message Formats (VMFs).

3.2.3.1.4 The Contractor shall provide engineering support for new development and maintenance for Mounted Android Computing Environment (MACE).

To include debugging software defects, security updates, and changes needed for fielding. 3.2.3.1.5 The Contractor shall provide engineering support for new development and maintenance for the Tactical Services Security System (TS3).

To include Single Sign On support for GCCS-A Widget, T-PKI directive, SIPR Token authentication, failover OCSP, access management, and Information Assurance specifications. 3.2.3.1.6 The Contractor shall provide engineering support for new development and maintenance for The Tactical Server Infrastructure (TSI), Battle Command Common Services (BCCS), and Warfighter Information Network-Tactical WIN-T Rapid Provisioning System (RPS).

To include identifying, assessing, integrating, testing, and deploying Microsoft Enterprise Solutions (e.g., Active Directory, SQL Server, System Center Configuration Manager (SCCM), System Center Operations Manager (SCOM), Email, Sharepoint, Database, Software Patching, etc…) in support of the United States Army – Chief Information Officer/G/S-6 Strategic and Tactical requirements and development of software to hardware allocation sheets. 3.2.3.1.6.1 The Contractor shall develop and maintain current and future baseline server infrastructure scripts for automated software installation and configuration capabilities.

3.2.3.1.6.2 The Contractor shall evaluate and integrate COTS/GOTS hardware and software for the server infrastructure.

3.2.3.1.6.3 The Contractor shall evaluate, design, develop, test, and deploy Information Assurance (IA) automation solutions for hardware and software systems in the tactical enclave.

Solutions shall address online and offline patch management, host monitoring, Host Intrusion Prevention Systems (HIPS), policy enhancement, offline patch management, compliance checking, compliance reporting, vulnerability audits, and remediation. 3.2.3.1.6.4 The Contractor shall develop and integrate initialization and monitoring tools for networks, operating systems, and SEC C3T portfolio of systems.

Page 19 of 35

3.2.3.1.7 The Contractor shall provide engineering support for development and maintenance for Joint and Coalition Military Exercises & Experiments.

Engineering support includes development of cyber security services, data exchange, data mediation, web services, and service management and control for both Joint and Coalition exercises and experiments. Service software includes automated Identity and Access Management (IdAM), automated data format mediation, service management and control capability, National Information Exchange Model (NIEM), and Department of Defense (DoD) Public Key Infrastructure (PKI). Joint Coalition Events include Tactical Infrastructure Enterprise Services (TIES), CWIX, and Joint Capability Technology Demonstration (JCTD). 3.2.3.1.8 The Contractor shall provide engineering support for new development and maintenance for Data Dissemination Service (DDS), Near Real-Time Server (NRTS), and Publish and Subscribe Service (PASS).

Data Dissemination Services to include the Army’s near real-time reporting of ABCS Data interoperability requirements (e.g., units, artillery, air tracks). Engineering support to DDS will include PKI Integration, Windows Server 2012, Patch 2 (P2) and Patch 4 (P4) fielding support, debugging software defects, Technical Incident Reports (TIR), IAVAs, Technical Bulletins, and Tactics, Techniques, Procedures (TTPs). Engineering support to NRTS and PASS will include test support in an Army Software Block 2 (SWB2) environment. 3.2.3.1.9 The Contractor shall design, develop, and integrate Army, Joint Services, and coalition forces’ messaging adapters, modules, and services for Data Dissemination Service (DDS), Command and Control Interface (C2I), and future COE components.

Engineering Support includes design, development, and integration of interoperability solutions compliant with Mission Command and JC2 governance specifications for Multilateral Interoperability Programme (MIP). 3.2.3.1.10 The Contractor shall provide engineering support for new development and maintenance for Significant Activities Manager (SAM) and Field Artillery Scatterable Mines Manager (FASCAM).

Engineering support to SAM and FASCAM includes Capability Sets (CS) 11/12 support testing, consolidation/simplification of product, creating and updating documentation, testing in preparation for sustainment, and re-deployment into C2I. 3.2.3.1.11 The Contractor shall provide engineering support for new development and maintenance for Active Directory Custom Attribute tool (ADCat).

Page 20 of 35

Engineering support to ADCat includes user enhancements and repairs and test support contingent upon Army Common Access Card (CAC) mandate. 3.2.3.1.12 The Contractor shall enhance and upgrade the SEC Tactical Renderer to MIL-STD-2525D for Mounted Android Computing Environment (MACE), Command Post (CP) Computing Environment (CE) Common Map Widget, and Command Post of the Future (CPOF).

Performance Standards a) STD: MIL-STD-2525D AQL: 100% compliant with standard; any defects, conflicts, or errors are corrected Deliverables C007 Software Test Report 3.2.3.1.13 The Contractor shall provide engineering support for new development and maintenance of Multilateral Interoperability Programme (MIP) software.

Engineering support includes: • Development of a single MIP product baseline to support MIP 2.0, 3.0, 3.1, and future

MIP standards • Development and integration with MIP Information Model (MIM) 4.0 • Adoption of the Semantic Extensive Attribute Model (SEAM) • Integration with C2I UltraLite for data exchanges in COEv3 • Maintenance of previous MIP baselines

Deliverables C007 Software Test Report 3.2.3.2 The Contractor shall execute and write unit tests for the SEC C3T portfolio of systems.

Performance Standards a) STD: Code coverage of unit tests AQL: Unit tests are written to cover 80% of the source code b) STD: Percentage of unit tests that pass upon software release AQL: 100% of unit tests pass upon software release Deliverables C007 Software Test Report D001 Computer Software Product End Items

3.2.3.3 The Contractor shall use the Government-designated configuration management repository for source code, build scripts, technical documentation, and project artifacts.

Page 21 of 35

To include Defense Intelligence Information Enterprise (DI2E)-provided and local repositories for central or distributed source control.

3.2.3.4 The Contractor shall perform component testing, system testing, integration testing, and interoperability testing for the SEC C3T portfolio of systems.

To include development and maintenance of test plans and test reports. Deliverables C007 Software Test Report 3.2.3.5 The Contractor shall use Agile software development for iterative updates, quick feedback, and implementation of emerging technologies.

3.2.3.6 The Contractor shall maintain, develop, and update documentation and training packages for the SEC C3T portfolio of systems.

Documentation and training package material include: System Administration Manuals (SAMs), Software User Manuals (SUMs), Software Version Descriptions (SVDs), Quick Reference Guides, Training Support Package (TSPs), Training Program Structure Document (TPSD), Technical Bulletins (TBs), Tactics, Techniques, and Procedures (TTPs), Release Notes, System Software Hazard Analysis Report (SSHAR), and other documentation as required for Software Materiel Release (SMR). Performance Standards a) STD: TRADOC Regulation 350-70, Army Learning Policy and Systems AQL: 100% compliance b) STD: MIL-STD-40051-2C, Department of Defense Standard Practice Of Digital Technical Information For Paged-Based Technical Manuals (TMs) AQL: 100% compliance Deliverables C008 Software Version Description C009 Software User Manual (SUM) subtitled Software User Manual (SUM) C010 Software User Manual (SUM) subtitled System Administration Manual (SAM) F005 Tactics, Techniques, Procedures (TTP) F007 Technical Bulletin (TB) F008 Training Materials subtitled Training Support Package (TSP) G001 System Safety Hazard Analysis Report (SSHAR)

3.2.3.6.1 The Contractor shall participate in Government verification and validation events to receive and address feedback.

Deliverables F009 Trip Report

Page 22 of 35

3.2.3.6.2 The Contractor shall conduct Instructor and Key Personnel Training (IKPT) for the SEC C3T portfolio of systems for new software releases.

Instructor and Key Personnel Training includes system functionality, architecture design, and source code for Government personnel. Deliverables F009 Trip Report 3.2.3.7 The Contractor shall prepare and deliver release packages for submission to the Program Manager.

To include packaging and shipping of release package if necessary. Shipping costs for software releases are paid for by the Government. Performance Standards a) STD: Response time to resolve identified defects AQL: 100% of critical defects (those that would result in an unfavorable recommendation or block formal tests, certification, or fielding) are resolved within timelines mutually determined by the Government and Contractor b) STD: Response time to resolve identified vulnerabilities AQL: 100% of critical vulnerabilities (those that would result in an unfavorable recommendation or block formal tests, certification, or fielding) are resolved within timelines mutually determined by the Government and Contractor Deliverables D001 Computer Software Product End Items

3.2.3.8 The Contractor shall develop tools and simulation products for the SEC C3T portfolio of systems.

Deliverables C007 Software Test Report D001 Computer Software Product End Items 3.2.3.9 The Contractor shall prepare source code, documentation, and training for transitioning SEC C3T portfolio systems from development phase to PPSS and/or a third party.

To include requirements management, programmatic and technical support provided by subject matter experts, and third-party developer training. Appendix Q (SEC Transition Checklist) describes the requirements for acceptance of programs into SEC sustainment and is provided for informational use. The Government is ultimately responsible for fulfillment of the requirements, but the Contractor shall provide technical input and support.

Page 23 of 35

Deliverables C002 Software Transition Plan (STRP)

3.2.4 Post Deployment Software Support (PDSS) and Post Production Software Support (PPSS)

3.2.4.1 The Contractor shall provide programmatic and engineering support to SEC C3T for the transition of existing hardware and software to sustainment.

The Transition Plan details the efforts for orderly and efficient transition of C3T software support from the Contractor to the US Army CECOM SEC. The Transition Plan describes the activities and events necessary to transfer the software, associated documentation, software licenses, warranties, maintenance agreements, and software test and maintenance tools (development and testing environment) to SEC. Appendix Q (SEC Transition Checklist) describes the requirements for acceptance of programs into SEC sustainment and is provided for informational use. The Government is ultimately responsible for fulfillment of the requirements, but the Contractor shall provide technical input and support. Deliverables C002 Software Transition Plan (STRP) 3.2.4.2 The Contractor shall provide operations support for Field Service Station (FSS).

Operations support to include follow-on application development, test/fix/test activities, MT-2012 Blue Force Tracking (BFT)-1/BFT-2 transceiver support, KGV-72 encryption devices, Global Positioning System (GPS) message routers (GMR) and microrouters, aviation provisioning, encryption processes and key management, and Android application development. Performance Standards a) STD: Response time to resolve identified defects AQL: 100% of critical defects (those that would result in an unfavorable recommendation or block formal tests, certification, or fielding) are resolved within timelines mutually determined by the Government and Contractor b) STD: Response time to resolve identified vulnerabilities AQL: 100% of critical vulnerabilities (those that would result in an unfavorable recommendation or block formal tests, certification, or fielding) are resolved within timelines mutually determined by the Government and Contractor Deliverables D001 Computer Software Product End Items E004 Status Report subtitled Weekly Status Report 3.2.4.3 The Contractor shall provide operations support for APG Blue Force Tracker (BFT) Global Network (BGN) Network Operations Center (NOC).

Page 24 of 35

Performance Standards a) STD: Response time to resolve identified defects AQL: 100% of critical defects (those that would result in an unfavorable recommendation or block formal tests, certification, or fielding) are resolved within timelines mutually determined by the Government and Contractor b) STD: Response time to resolve identified vulnerabilities AQL: 100% of critical vulnerabilities (those that would result in an unfavorable recommendation or block formal tests, certification, or fielding) are resolved within timelines mutually determined by the Government and Contractor Deliverables D001 Computer Software Product End Items E004 Status Report subtitled Weekly Status Report 3.2.4.3.1 The Contractor shall provide requirements management, design, development, test, support, and maintenance for NOC Monitoring and Diagnostic System (Network Essential Cross-Domain Unified Software (NEXUS)).

Performance Standards Deliverables D001 Computer Software Product End Items E004 Status Report subtitled Weekly Status Report

3.2.4.3.2 The Contractor shall maintain configuration management for NEXUS requirements, build processes, software versions, test artifacts, and documentation.

Performance Standards Deliverables D001 Computer Software Product End Items E004 Status Report subtitled Weekly Status Report 3.2.4.3.3 The Contractor shall design, develop, and integrate monitoring and troubleshooting software for ViaSat 2nd Generation Blue Force Tracking Satellite Network Control Center (SNCC) equipment and associated networks.

Performance Standards Deliverables D001 Computer Software Product End Items E004 Status Report subtitled Weekly Status Report

3.2.4.3.4 The Contractor shall provide tracking, analysis, and resolution for issues reported by BGN NOC Personnel.

Page 25 of 35

Performance Standards Deliverables D001 Computer Software Product End Items E004 Status Report subtitled Weekly Status Report

3.2.4.4 The Contractor shall provide software maintenance support for the SEC C3T portfolio of systems.

Software maintenance support includes fixing software defects, enhancements, standards updates, Technical Bulletins, end-user technical support, troubleshooting and issue resolution, test support, training, and product documentation updates. Performance Standards a) STD: Response time to resolve identified defects AQL: 100% of critical defects (those that would result in an unfavorable recommendation or block formal tests, certification, or fielding) are resolved within timelines mutually determined by the Government and Contractor b) STD: Response time to resolve identified vulnerabilities AQL: 100% of critical vulnerabilities (those that would result in an unfavorable recommendation or block formal tests, certification, or fielding) are resolved within timelines mutually determined by the Government and Contractor Deliverables C007 Software Test Report

3.2.5 Test and Evaluation

3.2.5.1 The Contractor shall support to Network Integration Evaluations (NIEs) and Advanced Warfighter Assessments (AWAs) for the SEC C3T portfolio of systems.

Technical Support includes onsite field support activities such as installation, configuration, and troubleshooting of both software and systems for demonstrations, informal tests, and formal tests. Deliverables F009 Trip Report

3.2.5.2 The Contractor shall provide technical support for Army Interoperability Certification (AIC) for the SEC C3T portfolio of systems.

Technical support to include installation, configuration, and troubleshooting (as needed) for AIC test floors, Central Technical Support Facility (CTSF) Software Integration Labs (SILs), and AIC

Page 26 of 35

prerequisites, which include Integration and Interoperability Evaluation (I2E) and System of Systems (SoS) Risk Reduction events. Deliverables E004 Status Report subtitled Weekly Status Report

3.2.5.3 The Contractor shall provide technical support for operational tests for the SEC C3T portfolio of systems.

Technical support to include installation, configuration, troubleshooting, demonstration, and training for the software under test. Test events include coordination and planning of Operational Test (OT) activities and all prerequisites, including Developmental Test (DT) and System of Systems (SoS) Risk Reduction events. Deliverables E004 Status Report subtitled Weekly Status Report F009 Trip Report

3.2.5.4 The Contractor shall plan and conduct Government Acceptance Tests (GATs) and Software Acceptance Tests (SATs) for the SEC C3T portfolio of systems.

To include creating test plans, preparing and holding test readiness reviews, and executing test cases. Performance Standards Deliverables C006 Software Test Plan C007 Software Test Report

3.2.5.5 The Contractor shall perform installation, configuration, and troubleshooting as needed in other integration facilities, to include the Mission Command Tactical Integration Facility (MC TIF) and PEO C3T Tactical Systems Integration Facility (TSIF).

Deliverables E004 Status Report subtitled Weekly Status Report

3.2.5.6 The Contractor shall conduct and plan Risk Reduction Events for the SEC C3T portfolio of systems.

Page 27 of 35

Deliverables C007 Software Test Report E004 Status Report subtitled Weekly Status Report

3.2.5.7 The Contractor shall support exercises and test events for Multilateral Interoperability Programme (MIP).

Deliverables C007 Software Test Report F009 Trip Report

3.2.5.8 The Contractor shall plan and conduct feedback sessions, usability studies, and user juries for the SEC C3T portfolio of systems.

Deliverables F006 Technical Report-Study/Services subtitled Technical Analysis

3.2.5.9 The Contractor shall provide support for Network Integration Evaluation (NIE) and related events to Assistant Secretary of the Army for Acquisition, Logistics, and Technology (ASA (ALT)) and System of Systems Engineering and Integration (SoSE&I).

Deliverables E004 Status Report subtitled Weekly Status Report 3.2.5.9.1 The Contractor shall assist SoSE&I in the development, validation, and modification of test architectures for Network Integration Evaluation (NIE) and related events.

Activities to include Horse Blanket development, high-level NIE architecture diagrams, Joint & Coalition architecture prototypes, Lab Based Risk Reduction (LBRR) slice architecture identification, and Transport Design Reviews. Deliverables E004 Status Report subtitled Weekly Status Report

3.2.5.9.2 The Contractor shall maintain, identify, plan, develop, validate, and execute test threads for Network Integration Evaluation (NIE), Lab Based Risk Reduction (LBRR), Validation Exercise (VALEX), Limited User Test (LUT), Systems Under Evaluation (SUE), Systems Under Test (SUT), and related events.

Page 28 of 35

Additional responsibilities to include training the NIE community and providing configuration management of the threads, periodic updates, and supplemental documents. Supplemental documents includes documents such as training documents, test plans, thread validation checklists, thread validation Master Scenario Event List (MSEL) steps, validation status reports, leadership briefings, Information Papers, and Architecture Reference Diagrams Deliverables E004 Status Report subtitled Weekly Status Report F006 Technical Report-Study/Services subtitled Technical Analysis

3.2.5.9.3 The Contractor shall execute test threads to reduce risks and verify functionality for Network Integration Evaluation (NIE) and related events.

Deliverables E004 Status Report subtitled Weekly Status Report

3.2.5.9.4 The Contractor shall provide subject matter expertise (SME) for instrumentation strategy, Capability Set (CS) architecture, design of the CS test environment, and various planning activities.

Deliverables E004 Status Report subtitled Weekly Status Report

3.2.5.9.5 The Contractor shall maintain, lead, build, and integrate the upper Tactical Internet for Network Integration Evaluation (NIE) and related events.

Upper Tactical Internet includes the Battle Command Common Services and all associated Program of Records Virtual Machine servers to be integrated at Division and Brigade echelons. Deliverables E004 Status Report subtitled Weekly Status Report

3.2.5.10 The Contractor shall provide technical support for ad-hoc and emerging test events for the SEC C3T portfolio of systems.

To include planning, setting up, installing, configuring, troubleshooting, and execution testing for training exercises and follow-on events, Joint User Interoperability Communications Exercise (JUICE), Command Post Exercises (CPXs), and Coalition/Joint exercises. Deliverables E004 Status Report subtitled Weekly Status Report F009 Trip Report

Page 29 of 35

3.2.5.11 The Contractor shall collect and analyze user and operational feedback from events and provide recommendations for the SEC C3T portfolio of systems.

Deliverables F006 Technical Report-Study/Services subtitled Technical Analysis 3.2.5.12 The Contractor shall provide on-call support to and resolve technical inquiries from CONUS and OCONUS exercises and events.

Performance Standards a) STD: Critical issues (those that will result in mission failure) are resolved within twelve (12) hours of notification. Non-critical issues (Defined as all other issues) are resolved within five (5) business days. AQL: Critical issues are resolved IAW the standard 100% of the time if a workaround exists. Non-critical issues are resolved IAW with standard 75% of the time if a workaround exists. Deliverables E004 Status Report subtitled Weekly Status Report

3.2.6 Cybersecurity

3.2.6.1 The Contractor shall deliver, develop, integrate, and test Information Assurance Vulnerability Alerts (IAVAs) updates for the SEC C3T portfolio of systems.

IAVA updates to include quarterly gold disks, monthly collection files, and System Center Configuration Manager (SCCM) updates. Deliverables D001 Computer Software Product End Items E007 Vulnerability Scan Compliance (VSC) Report

3.2.6.2 The Contractor shall provide technical support to the customer Information Assurance Security Officer (IASO) in developing and maintaining the Plan of Action and Milestones (POA&M).

Deliverables E007 Vulnerability Scan Compliance (VSC) Report

3.2.6.3 The Contractor shall provide technical support to the IASO for all Authority to Operate (ATO), Interim Authority to Test (IATT), Certificate of Networthiness (CoN), and Assess Only requirements for the RMF and Enterprise Mission Assurance Support Service (eMASS) processes.

Page 30 of 35

Technical support includes development of all security documentation required for RMF and eMASS and will require a SECRET Internet Protocol Router (SIPR) account and an eMASS account. Deliverables E004 Status Report subtitled Weekly Status Report

3.2.6.4 The Contractor shall develop, maintain, and deploy policies and templates for Host Based Security System (HBSS).

Policies and templates to include virtualized and physical Information Assurance (IA) compliant Operating Systems (Server and Client) using the Army Gold Master (AGM) baseline. Deliverables C007 Software Test Report E004 Status Report subtitled Weekly Status Report

3.2.6.5 The Contractor shall test, identify, download, analyze, and implement Security Technical Implementation Guides (STIGs) for the SEC C3T portfolio of systems.

Performance Standards a) STD: DISA STIGs AQL: 100% compliance as technically feasible, noncompliance is documented in the POA&M b) STD: Percentage of software functionality after STIG implementation AQL: 100% software functionality after STIG implementation Deliverables C007 Software Test Report E004 Status Report subtitled Weekly Status Report E007 Vulnerability Scan Compliance (VSC) Report

3.2.6.6 The Contractor shall participate in vulnerability assessment exercises and resolve any identified findings.

3.2.7 Lab Support

3.2.7.1 The Contractor shall establish, maintain, configure, support, and administer functional and accredited infrastructure for SEC test and development networks.

Development and test lab support to include network topology diagrams, configuration management repositories, issue tracking, storage infrastructure, backup and disaster recovery,

Page 31 of 35

build servers, technical support, license management, software installation and patching for IAVA compliance, virus scans, maintenance activities and upgrades, and creation of workstations. Performance Standards a) STD: Availability of networks and infrastructure resources AQL: 98% system uptime during the prime shift as defined in NEXGEN BASIC PWS paragraph 3.5.1.6 (Hours Worked) Deliverables E004 Status Report subtitled Weekly Status Report E007 Vulnerability Scan Compliance (VSC) Report

3.2.7.2 The Contractor shall establish, maintain, configure, support, and administer secure, certified, and up-to-date networks and systems for external test and integration labs.

Support to include PM Mission Command, PEO C3T, and ASA (ALT) test and integration labs. Deliverables E004 Status Report subtitled Weekly Status Report

4 Deliverables All requirements of paragraph 4.0 (Deliverables) of the SSES NEXGEN BASIC PWS apply to this task order.

Number Name Frequency Quantity

A001 Report, Record of Meeting Minutes As Required

DI-ADMN-81505

B001 Funds and Manpower Expenditure Report Monthly

DI-FNCL-80331A

B002 Performance and Cost Report Monthly

DI-FNCL-80912

C001 Software Requirements Specification (SRS) As Required

DI-IPSC-18443A

C002 Software Transition Plan (STRP) As Required

DI-IPSC-81429

Page 32 of 35

C003 System/Subsystem Specification (SSS) As Required

DI-IPSC-81431A

C004 System/Subsystem Design Description (SSDD)

As Required

DI-IPSC-81432A

C005 Software Design Description (SDD) As Required

DI-IPSC-81435

C006 Software Test Plan As Required

DI-IPSC-81438

C007 Software Test Report As Required

DI-IPSC-81440A

C008 Software Version Description As Required

DI-IPSC-81442A

C009 Software User Manual (SUM) subtitled Software User Manual (SUM)

As Required

DI-IPSC-81443

C010 Software User Manual (SUM) subtitled System Administration Manual (SAM)

As Required

DI-IPSC-81443

C011 Interface Control Document (ICD) As Required

DI-IPSC-81463A

D001 Computer Software Product End Items As Required

DI-MCCR-80700

E001 Status Report subtitled Critical Personnel Change

As Required

DI-MGMT-80269

Page 33 of 35

E002 Status Report subtitled Status of GFE Report

Monthly

DI-MGMT-80269

E003 Status Report subtitled Monthly Status Report

Monthly

DI-MGMT-80368A

E004 Status Report subtitled Weekly Status Report

Weekly

DI-MGMT-80368

E005 Contract Work Breakdown Structure (WBS) Monthly

DI-MGMT-81334D

E006 Contract Funds Status Report Monthly

DI-MGMT-81468

E007 Vulnerability Scan Compliance (VSC) Report As Required

DI-MGMT-81842

E008 Integrated Program Management Report (IPMR) subtitled Integrated Master Schedule

Monthly

DI-MGMT-81861

F001 Technical Report-Study/Services subtitled Data Accession List

As Required

DI-MISC-80508B

F002 Technical Report-Study/Services subtitled Phase In Plan

As Required

DI-MISC-80508B

F003 Technical Report-Study/Services subtitled Phase Out Plan

As Required

DI-MISC-80508B

Page 34 of 35

F004 Technical Report-Study/Services subtitled Requirements Traceability Matrix

As Required

DI-MISC-80508B

F005 Tactics, Techniques, Procedures (TTP) As Required

DI-MISC-80508B

F006 Technical Report-Study/Services subtitled Technical Analysis

As Required

DI-MISC-80508

F007 Technical Bulletin (TB) As Required

DI-MISC-80508B

F008 Training Materials subtitled Training Support Package (TSP)

As Required

DI-ILSS-80872

F009 Trip Report As Required

DI-MISC-81943

G001 System Safety Hazard Analysis Report (SSHAR)

As Required

DI-SAFT-80101B

5 Data Rights The Government's rights in non-commercial technical data and software deliverables shall be governed by DFARS 252.227-7013 and DFARS 252.227-7014, respectively. Additional provisions related to technical data and software rights are provided in Appendix F (Data Rights). Deliverables F001 Technical Report-Study/Services subtitled Data Accession List

6 Software Assurance Applicable standards may include Software Engineering Center (SEC) Manual(s), American National Standards Institute (ANSI) standards, and National Institute of Standards and Technology (NIST) standards, including Federal Information Processing Standards (FIPS)

Page 35 of 35

publications. Software Development Standards Life Cycle Guidelines contain a list of software development standards for SEC tasks. All work under this Task Order shall comply with the latest version of all applicable standards, as necessary.

Resources: » Federal Information Processing Standard (FIPS) Publication 200, Minimum Security Requirements for Federal Information and Information Systems. » National Institute of Standard and Technology (NIST) Special Publication 800–53, Recommended Security Controls for Federal Information Systems. » Department of Defense Instruction (DODI) 8500.2, Information Assurance (IA) Implementation. » Office of Management and Budget (OMB) Memorandum M–07–18, Ensuring New Acquisitions Include Common Security Configurations, 1 June 2007.