COMPUTATIONAL DIVERSITY FOR CYBER SECURITY

NAICS CODE: 541715 FEDERAL AGENCY NAME: Department of the Air Force, Air Force Materiel Command, AFRL - Rome Research Site, AFRL/Information Directorate, 26 Electronic Parkway, Rome, NY, 13441-4514 BAA ANNOUNCEMENT TYPE: Initial announcement BROAD AGENCY ANNOUNCEMENT (BAA) TITLE: Computational Diversity for Cyber Security BAA NUMBER: FA8750-19-S-7003 PART I - OVERVIEW INFORMATION This announcement is for an Open, 2 Step BAA which is open and effective until 30 Sep 2023. Only white papers will be accepted as initial submissions; formal proposals will be accepted by invitation only. While white papers will be considered if received prior to 12:00 p.m. Eastern Standard Time (EST) on 30 Sep 2023, the following submission dates are suggested to best align with projected funding: FY19 by 31 JAN 2019 FY20 by 30 SEP 2019 FY21 by 30 SEP 2020 FY22 by 30 SEP 2021 FY23 by 30 AUG 2022 Offerors should monitor the Federal Business Opportunities website at Http://www.fbo.gov in the event this announcement is amended. An Industry Day on this topic was held at 0900 on 12 Dec 2018 at the Griffiss Institute, 725 Daedalian Drive, Rome, NY 13441. Individual 15 minute meetings were accommodated on a first come first serve basis and were available from 10:30-11:45 AM EST and then again from 12:30-3:30 PM EST. RSVP was done via email to the TPOC listed in Section VII to receive scheduling instructions. CONCISE SUMMARY OF TECHNOLOGY REQUIREMENT: Seeking innovative research to develop a secure microcontroller for cryptography in an Application Specific Integrated Circuit (ASIC) form factor. The secure microcontroller should utilize computationally diverse software or hardware to deliver an ASIC that exceeds current state of the art in terms of speed, power consumption and security, while also addressing the weaknesses associated with storage of cryptographic keys in Flash memory. Additionally, seeking innovative research to establish the necessary primitives and logic functions to support computationally diverse computing. BAA ESTIMATED FUNDING: Total funding for this BAA is approximately $24.9M. Individual awards will not normally exceed 36 months with dollar amounts normally ranging from $500K to $3.9M. There is also the potential to make awards up to any dollar value as long as the value does not exceed the available BAA ceiling amount. ANTICIPATED INDIVIDUAL AWARDS: Multiple Awards are anticipated. TYPE OF INSTRUMENTS THAT MAY BE AWARDED: Procurement contract, grant, cooperative agreement or other transactions AGENCY CONTACT INFORMATION: All white paper submissions and any questions of a technical nature shall be directed to the cognizant Technical Point of Contact (TPOC) as specified below (unless otherwise specified in the technical area): BAA MANAGER: Donald Telesca AFRL/RITB 525 Brooks Rd Rome, NY 13441-4505 Telephone: (315)330-3606 Email: donald.telesca@us.af.mil Questions of a contractual/business nature shall be directed to the cognizant contracting officer, as specified below (email requests are preferred): Amber Buckley Telephone (315) 330-3605 Email: Amber.Buckley@us.af.mil Emails must reference the solicitation (BAA) number and title of the acquisition. Pre-Proposal Communication between Prospective Offerors and Government Representatives: Dialogue between prospective offerors and Government representatives is encouraged. Technical and contracting questions can be resolved in writing or through open discussions. Discussions with any of the points of contact shall not constitute a commitment by the Government to subsequently fund or award any proposed effort. Only Contracting Officers are legally authorized to commit the Government. Offerors are cautioned that evaluation ratings may be lowered and/or proposal rejected if proposal preparation (Proposal format, content, etc.) and/or submittal instructions are not followed. SEE ATTACHMENT 1 for the full BAA Announcement. AMENDMENT 1 to BAA FA8750-19-S-7003 The purpose of this modification is to republish the original announcement, incorporating any previous amendments, pursuant to FAR 35.016(c). This republishing also includes the following changes: Part I, Overview Information: Updates FBO reference to Beta SAM website; Updates the Type of Instruments that May be Awarded; Part II, Full Text Announcement: Section III.2.b.2, updates the DCSA website; Section IV.3.a, updates the DCSA website; Section IV.3.c, updates the mailing instructions; Section IV.4.e, updated the link to reference the Beta SAM website; Section VI.1, updates the RI Specific Proposal Preparation Instructions date and Beta SAM link; Section VI.4, adds paragraphs d and e; Section VI.7, adds paragraph d; Section VII: updated the OMBUDSMAN. No other changes have been made. ________________________________________ NAICS CODE: 541715 FEDERAL AGENCY NAME: Department of the Air Force, Air Force Materiel Command, AFRL - Rome Research Site, AFRL/Information Directorate, 26 Electronic Parkway, Rome, NY, 13441-4514 BAA ANNOUNCEMENT TYPE: Initial announcement BROAD AGENCY ANNOUNCEMENT (BAA) TITLE: Computational Diversity for Cyber Security BAA NUMBER: FA8750-19-S-7003 PART I - OVERVIEW INFORMATION This announcement is for an Open, 2 Step BAA which is open and effective until 30 Sep 2023. Only white papers will be accepted as initial submissions; formal proposals will be accepted by invitation only. While white papers will be considered if received prior to 12:00 p.m. Eastern Standard Time (EST) on 30 Sep 2023, the following submission dates are suggested to best align with projected funding: FY19 by 31 JAN 2019 FY20 by 30 SEP 2019 FY21 by 30 SEP 2020 FY22 by 30 SEP 2021 FY23 by 30 AUG 2022 Offerors should monitor the Contract Opportuities on the Beta SAM website at https://beta.SAM.gov in the event this announcement is amended. An Industry Day on this topic was held at 0900 on 12 Dec 2018 at the Griffiss Institute, 725 Daedalian Drive, Rome, NY 13441. Individual 15 minute meetings were accommodated on a first come first serve basis and were available from 10:30-11:45 AM EST and then again from 12:30-3:30 PM EST. RSVP was done via email to the TPOC listed in Section VII to receive scheduling instructions. CONCISE SUMMARY OF TECHNOLOGY REQUIREMENT: Seeking innovative research to develop a secure microcontroller for cryptography in an Application Specific Integrated Circuit (ASIC) form factor. The secure microcontroller should utilize computationally diverse software or hardware to deliver an ASIC that exceeds current state of the art in terms of speed, power consumption and security, while also addressing the weaknesses associated with storage of cryptographic keys in Flash memory. Additionally, seeking innovative research to establish the necessary primitives and logic functions to support computationally diverse computing. BAA ESTIMATED FUNDING: Total funding for this BAA is approximately $24.9M. Individual awards will not normally exceed 36 months with dollar amounts normally ranging from $500K to $3.9M. There is also the potential to make awards up to any dollar value as long as the value does not exceed the available BAA ceiling amount. ANTICIPATED INDIVIDUAL AWARDS: Multiple Awards are anticipated. TYPE OF INSTRUMENTS THAT MAY BE AWARDED: Procurement contracts, grants, cooperative agreements or other transactions (OT) depending upon the nature of the work proposed. In the event that an Other Transaction for Prototype agreement is awarded as a result of this competitive BAA, and the prototype project is successfully completed, there is the potential for a prototype project to transition to award of a follow-on production contract or transaction. The Other Transaction for Prototype agreement itself will also contain a similar notice of a potential follow-on production contract or agreement. AGENCY CONTACT INFORMATION: All white paper submissions and any questions of a technical nature shall be directed to the cognizant Technical Point of Contact (TPOC) as specified below (unless otherwise specified in the technical area): BAA MANAGER: Donald Telesca AFRL/RITB 525 Brooks Rd Rome, NY 13441-4505 Telephone: (315)330-3606 Email: donald.telesca@us.af.mil Questions of a contractual/business nature shall be directed to the cognizant contracting officer, as specified below (email requests are preferred): Amber Buckley Telephone (315) 330-3605 Email: Amber.Buckley@us.af.mil Emails must reference the solicitation (BAA) number and title of the acquisition. Pre-Proposal Communication between Prospective Offerors and Government Representatives: Dialogue between prospective offerors and Government representatives is encouraged. Technical and contracting questions can be resolved in writing or through open discussions. Discussions with any of the points of contact shall not constitute a commitment by the Government to subsequently fund or award any proposed effort. Only Contracting Officers are legally authorized to commit the Government. Offerors are cautioned that evaluation ratings may be lowered and/or proposal rejected if proposal preparation (Proposal format, content, etc.) and/or submittal instructions are not followed. PART II - FULL TEXT ANNOUNCEMENT BROAD AGENCY ANNOUNCEMENT (BAA) TITLE: Computational Diversity for Cyber Security BAA NUMBER: BAA FA8750-19-S-7003 CATALOG OF FEDERAL DOMESTIC ASSISTANCE (CFDA) Number: 12.800 I. TECHNOLOGY REQUIREMENTS: Modern computer microarchitectures build on well-established foundations that have encouraged a pattern of computational homogeneity that many cyberattacks depend on. The concept of computational diversity applied to Internet of Things (IoT) security, authentication of connected vehicles, as well as hardware and software assurance, presents an uninvestigated approach to securing cyber space with the potential to dramatically improve information assurance. Examples of computational diversity include, but are not limited to, systems that mix binary, ternary and/or other radix. (see B. Cambou, D. Telesca; - Ternary Computing to Strengthen Cybersecurity, Development of Ternary State based Public Key Exchange, 2018 IEEE SAI computing conference, Jul 2018; or B. Cambou, P. Flikkema, J. Palmer, D. Telesca, and C. Philabaum, - Can Ternary Computing Improve Information Assurance? Cryptography, MDPI, Feb 2018.). The Air Force Research Laboratory is soliciting white papers under this Broad Agency Announcement (BAA) for research, development, integration, test, evaluation and delivery of technologies/techniques that exhibit computational diversity. There are two technical objectives of this BAA. The first is to develop a secure microcontroller in an Application Specific Integrated Circuity (ASIC) form factor that can be embedded in large platforms including space assets or unmanned aerial systems (UAS), as well as more resource-constrained IoT devices and sensors, without modification. Current technologies for storage of cryptographic keys do not protect keys when assets are in the wrong hands. In addition, these technologies require high power consumption that prohibits extending information assurance to small form factor IoT devices. The proposed secure microcontroller should utilize innovative computationally diverse software and/or hardware to deliver an ASIC that exceeds current state of the art in terms of speed, power consumption and security, while also addressing the weaknesses associated with storage in Flash and/or other memory. Proposers are encouraged to identify baseline examples quantifying the resources needed to overcome current state of the art methods (i.e. time, processing resources, etc.) that will be used for future comparative advantage to demonstrate the proposed solution has made a quantifiable increase to cyber security and mission assurance. The second objective is to investigate the primitives, logic functions and software tool chains that would be necessary to allow code to be compiled on a computationally diverse hardware computing architecture, more advanced than an ASIC. This can include but is not limited to laptop, desktop, or server computing architectures. The proposed solution can include models and/or hardware concept demos. The results of this work could be used to determine if such an advanced computing architecture is possible, and inform what further steps or resources would be needed for further development. IMPORTANT NOTES REGARDING: FUNDAMENTAL RESEARCH. It is DoD policy that the publication of products of fundamental research will remain unrestricted to the maximum extent possible. National Security Decision Directive (NSDD) 189 defines fundamental research as follows: - Fundamental research means basic and applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific community, as distinguished from proprietary research and from industrial development, design, production, and product utilization, the results of which ordinarily are restricted for proprietary or national security reasons. As of the date of publication of this BAA, the Government cannot identify whether work proposed under this BAA may be considered fundamental research and may award both fundamental and non-fundamental research. Proposers should indicate in their proposal whether they believe the scope of the research included in their proposal is fundamental or not. While proposers should clearly explain the intended results of their research, the Government shall have sole discretion to select award instrument type and to negotiate all instrument terms and conditions with selectees. Appropriate clauses will be included in resultant awards for non-fundamental research to prescribe publication requirements and other restrictions, as appropriate. For certain research projects, it may be possible that although the research being performed by the awardee is restricted research, a sub-awardee may be conducting fundamental research. In those cases, it is the awardee's responsibility to explain in their proposal why its sub-awardee's effort is fundamental research. CLOUD COMPUTING. In accordance with DFARS Clause 252.239-7010, if the development proposed requires storage of Government, or Government-related data on the cloud, offerors need to ensure that the cloud service provider proposed has been granted Provisional Authorization by the Defense Information Systems Agency (DISA) at the level appropriate to the requirement. II. AWARD INFORMATION: 1. FUNDING: Total funding for this BAA is approximately $24.9 M. The anticipated funding to be obligated under this BAA is broken out by fiscal year as follows: FY19 - $ 3.9 M FY20 - $ 4.3 M FY21 - $ 4.4 M FY22 - $ 5.6 M FY23 - $ 6.7 M Individual awards will not normally exceed 36 months with dollar values normally ranging from $500K to $3.9M. There is also the potential to make awards up to any dollar value as long as the value does not exceed the available BAA ceiling amount. The Government reserves the right to select all, part, or none of the proposals received, subject to the availability of funds. All potential Offerors should be aware that due to unanticipated budget fluctuations, funding in any or all areas may change with little or no notice. 2. FORM. Awards of efforts as a result of this announcement will be in the form of contracts, grants, cooperative agreements or other transactions depending upon the nature of the work proposed. 3. BAA TYPE: This is a two-step open broad agency announcement. This announcement constitutes the only solicitation. As STEP ONE - The Government is only soliciting white papers at this time. DO NOT SUBMIT A FORMAL PROPOSAL. Those white papers found to be consistent with the intent of this BAA may be invited to submit a technical and cost proposal. See Section VI of this announcement for further details regarding the proposal. III. ELIGIBILITY INFORMATION: 1. ELIGIBILITY: All qualified offerors who meet the requirements of this BAA may apply. 2. FOREIGN PARTICIPATION/ACCESS: This BAA is closed to foreign participation. This includes both foreign ownership and foreign nationals as employees or subcontractors. Exceptions. Fundamental Research. If the work to be performed is unclassified, fundamental research, this must be clearly identified in the white paper and/or proposal. See Part II, Section I for more details regarding Fundamental Research. Offerors should still identify any performance by foreign nationals at any level (prime contractor or subcontractor) in their proposals. Please specify the nationals country of origin, the type of visa or work permit under which they are performing and an explanation of their anticipated level of involvement. You may be asked to provide additional information during negotiations in order to verify the foreign citizen's eligibility to participate on any contract or assistance agreement issued as a result of this announcement. Foreign Ownership, Control or Influence (FOCI) companies who have mitigation plans/paperwork in place. Proof of approved mitigation documentation must be provided to the contracting office focal point, Amber Buckley, Contracting Officer, telephone (315) 330-3605, or e-mail Amber.Buckley@us.af.mil prior to submitting a white paper and/or a proposal. For information on FOCI mitigation, contact the contact the Defense Counterintelligence and Security Agency (DCSA). Additional details can be found at: https://www.dcsa.mil/mc/ctp/foci/ Foreign Nationals as Employees or Subcontractors. Applicable to any effort not considered Fundamental Research. Offerors are responsible for ensuring that all employees and/or subcontractors who will work on a resulting contract are eligible to do so. Any employee who is not a U.S. citizen or a permanent resident will be restricted from working on any resultant contract unless prior approval of the Department of State or the Department of Commerce is obtained via a technical assistance agreement or an export license. Violations of these regulations can result in criminal or civil penalties. Information Regarding Non-US Citizens Assigned to this Project Contractor employees requiring access to USAF bases, AFRL facilities, and/or access to U.S. Government Information Technology (IT) networks in connection with the work on contracts, assistance instruments or other transactions awarded under this BAA must be U.S. citizens. For the purpose of base and network access, possession of a permanent resident card ("Green Card") does not equate to U.S. citizenship. This requirement does not apply to foreign nationals approved by the U.S. Department of Defense or U.S. State Department under international personnel exchange agreements with foreign governments. It also does not apply to dual citizens who possess US citizenship, to include Naturalized citizens. Any waivers to this requirement must be granted in writing by the Contracting Officer prior to providing access. Specific format for waiver request will be provided upon request to the Contracting Officer. The above requirements are in addition to any other contract requirements related to obtaining a Common Access Card (CAC). For the purposes of Paragraph 1, if an IT network/system does not require AFRL to endorse a contractor's application to said network/system in order to gain access, the organization operating the IT network/system is responsible for controlling access to its system. If an IT network/system requires a U.S. Government sponsor to endorse the application in order for access to the IT network/system, AFRL will only endorse the following types of applications, consistent with the requirements above: Contractor employees who are U.S. citizens performing work under contracts, assistance instruments or other transactions awarded under this BAA. Contractor employees who are non-U.S. citizens and who have been granted a waiver. Any additional access restrictions established by the IT network/system owner apply. 3. FEDERALLY FUNDED RESEARCH AND DEVELOPMENT CENTERS AND GOVERNMENT ENTITIES: Federally Funded Research and Development Centers (FFRDCs) and Government entities (e.g., Government/National laboratories, military educational institutions, etc.) are subject to applicable direct competition limitations and cannot propose to this BAA in any capacity unless they meet the following conditions: FFRDCs: FFRDCs must clearly demonstrate that the proposed work is not otherwise available from the private sector; and FFRDCs must provide a letter on official letterhead from their sponsoring organization citing the specific authority establishing their eligibility to propose to Government solicitations and compete with industry, and their compliance with the associated FFRDC sponsor agreement's terms and conditions. This information is required for FFRDCs proposing to be prime contractors or sub-awardees. Government Entities: Government entities must clearly demonstrate that the work is not otherwise available from the private sector and provide written documentation citing the specific statutory authority and contractual authority, if relevant, establishing their ability to propose to Government solicitations. While 10 U.S.C. 2539b may be the appropriate statutory starting point for some entities, specific supporting regulatory guidance, together with evidence of agency approval, will still be required to fully establish eligibility. FFRDC and Government entity eligibility will be determined on a case-by-case basis; however, the burden to prove eligibility for all team members rests solely with the proposer. Government agencies interested in performing work related to this announcement should contact the Technical Point of Contact (TPOC). If resulting discussions reveal a mutual interest, cooperation may be pursued via other vehicles. IV. APPLICATION AND SUBMISSION INFORMATION: All responses to this announcement must be addressed to the Technical Point of Contact (TPOC) listed in SECTION VII. DO NOT send white papers to the Contracting Officer. 1. SUBMISSION DATES AND TIMES: It is recommended that white papers be received by 12:00 PM Eastern Standard Time (EST) on the following dates to maximize the possibility of award: FY19 by 31 JAN 2019 FY20 by 30 SEP 2019 FY21 by 30 SEP 2020 FY22 by 30 SEP 2021 FY23 by 30 AUG 2022 White papers will be accepted until 12:00 PM EST on 30 September 2023, but it is less likely that funding will be available in each respective fiscal year after the dates cited. This BAA will close on 30 September 2023. All offerors submitting white papers will receive notification of their evaluation results within 45 days of submission. Offerors should email the TPOC and the Contracting Officer listed in Section VII, for status of their white paper(s) after 45 days, if no such correspondence has been received. 2. CONTENT AND FORMAT: Offerors are required to submit 1 electronic copy or 5 hard copies of a 3 to 5 page white paper summarizing their proposed approach/solution. The purpose of the white paper is to preclude unwarranted effort on the part of an offeror whose proposed work is not of interest to the Government. The white paper will be formatted as follows: Section A: Title, Period of Performance, Estimated Cost, Name/Address of Company, Technical and Contracting Points of Contact (phone and email)(this section is NOT included in the page count); Section B: Task Objective; and Section C: Technical Summary and Proposed Deliverables. All white papers shall be double spaced with a font no smaller than 12 point. In addition, respondents are requested to provide their Commercial and Government Entity (CAGE) Code, their unique entity identifier and electronic funds transfer (EFT) indicator (if applicable), an e-mail address and reference BAA FA8750-19-S-7003 with their submission. Multiple white papers within the purview of this announcement may be submitted by each offeror. If the offeror wishes to restrict its white papers, they must be marked with the restrictive language stated in FAR 15.609(a) and (b). 3. HANDLING AND MAILING INSTRUCTIONS: a. CLASSIFICATION GUIDANCE. All Proposers should review the NATIONAL INDUSTRIAL SECURITY PROGRAM OPERATING MANUAL, (NISPOM), dated February 28, 2006 and incorporating Change 2, dated May 18, 2016, as it provides baseline standards for the protection of classified information and prescribes the requirements concerning Contractor Developed Information under paragraph 4-105. Defense Counterintelligence and Security Agency (DCSA) Site for the NISPOM is: http://www.dcsa.mil/. In the event of a possible or actual compromise of classified information in the submission of your white paper or proposal, immediately but no later than 24 hours, bring this to the attention of your cognizant security authority and AFRL Rome Research Site Information Protection Office (IPO): Information Protection Office (contact only if a security compromise has occurred) Monday-Friday (0730-1630): Call 315-330-4048 or Email: vincent.guza@us.af.mil Evenings and Weekends: Call 315-330-2961 b. CLASSIFIED SUBMISSIONS. AFRL/RITB will accept classified responses to this BAA when the classification is mandated by classification guidance provided by an Original Classification Authority of the U.S. Government, or when the offeror believes the work, if successful, would merit classification. Security classification guidance in the form of a DD Form 254 (DoD Contract Security Classification Specification) will not be provided at this time since AFRL is soliciting ideas only. Offerors that intend to include classified information or data in their white paper submission or who are unsure about the appropriate classification of their white papers should contact the technical point of contact listed in Section VII for guidance and direction in advance of preparation. c. MAILING INSTRUCTIONS. Email Unclassified electronic submission to the TPOC identified in Section VII. Encrypt or password-protect all proprietary information prior to sending. Offerors are responsible to confirm receipt with the TPOC. AFRL is not responsible for undelivered documents. If electronic submission is used, only one copy of the documentation is required. In addition to the electronic submission, please also mail a response. Any mailed responses, unclassified/classified, to this announcement must be sent U.S. Postal Service, registered mail or similar service and addressed to Donald Telesca, AFRL/RITB, 525 Brooks Road, Rome NY 13441-4505, and reference BAA FA8750-19-S-7003. When mailing follow the directions regarding the number of copies required. Questions can be directed to the TPOC listed in Section VII. 4. OTHER SUBMISSION REQUIREMENTS/CONSIDERATIONS: a. COST SHARING OR MATCHING: Cost sharing is not a requirement. Cost sharing may be proposed and will be considered on a case-by-case basis. b. SYSTEM FOR AWARD MANAGEMENT (SAM). Offerors must be registered in the SAM database to receive a contract award, and remain registered during performance and through final payment of any contract or agreement. Processing time for registration in SAM, which normally takes forty-eight hours, should be taken into consideration when registering. Offerors who are not already registered should consider applying for registration before submitting a proposal. The provision at FAR 52.204-7, System for Award Management (Oct 2016) applies. c. EXECUTIVE COMPENSATION AND FIRST-TIER SUBCONTRACT/ SUBRECIPIENT AWARDS: Any contract award resulting from this announcement may contain the clause at FAR 52.204-10 - Reporting Executive Compensation and First-Tier Subcontract Awards (Oct 2016). Any grant or agreement award resulting from this announcement may contain the award term set forth in 2 CFR, Appendix A to Part 25 which can be viewed at: http://www.ecfr.gov/cgi-bin/text-idx?SID=8fb6c83606df57968c3e7e145e7d683c&mc=true&node=ap2.1.25_1360.a&rgn=div9 d. ALLOWABLE CHARGES: The cost of preparing white papers/proposals in response to this announcement is not considered an allowable direct charge to any resulting contract or any other contract, but may be an allowable expense to the normal bid and proposal indirect cost specified in FAR 31.205-18. Incurring pre-award costs for ASSISTANCE INSTRUMENTS ONLY are regulated by 2 CFR part 200.458, Pre-Award Costs. e. GOVERNMENT APPROVED ACCOUNTING SYSTEM: An offeror must have a Government approved accounting system prior to award of a cost-reimbursement contract per limitations set forth in FAR 16.301-3(a) to ensure the system is adequate for determining costs applicable to the contract. The acceptability of an accounting system is determined based upon an audit performed by the Defense Contract Audit Agency (DCAA). IMPORTANT: If you do not have a DCAA approved accounting system access the following link for instructions: https://beta.sam.gov/opp/e628c811fafe041accdddf55fb8539bf/view?keywords=AFRL-BAA-Guide&sort=-relevance&index=&is_active=true&page=1 f. HUMAN USE: All research involving human subjects, to include the use of human biological specimens and human data, selected for funding must comply with Federal regulations for human subject protection. Further, research involving human subjects that is conducted or supported by the DoD must comply with 32 CFR 219, - Protection of Human Subjects found at: http://www.access.gpo.gov/nara/cfr/waisidx_07/32cfr219_07.html, and DoD Instruction 3216.02, - Protection of Human Subjects and Adherence to Ethical Standards in DoD-Supported Research found at: http://www.dtic.mil/whs/directives/corres/pdf/321602p.pdf. Institutions awarded funding for research involving human subjects must provide documentation of a current Assurance of Compliance with Federal regulations for human subject protection, for example a Department of Health and Human Services, Office of Human Research Protection Federal Wide Assurance found at: http://www.hhs.gov/ohrp. All institutions engaged in human subject research, to include subcontractors, must have a valid assurance. In addition, personnel involved in human subject research must document the completion of appropriate training for the protection of human subjects. For all research that will involve human subjects in the first year or phase of the project, the institution must submit evidence of a plan for review by an institutional review board (IRB) as part of the proposal. The IRB conducting the review must be the IRB identified on the institution's Assurance of Compliance. The protocol, separate from the proposal, must include a detailed description of the research plan, study population, risks and benefits of study participation, recruitment and consent process, data collection, and data analysis. The designated IRB should be consulted for guidance on writing the protocol. The informed consent document must comply with 32 CFR 219.116. A valid Assurance of Compliance and evidence of appropriate training by all investigators should accompany the protocol for review by the IRB. In addition to a local IRB approval, an AFRL-level human subject regulatory review and approval is required for all research conducted or supported by the DoD. The Air Force office responsible for managing the award can provide guidance and information about the AFRL-level review process. Confirmation of a current Assurance of Compliance and appropriate human subjects protection training is required before AFRL-level approval can be issued. The time required to complete the IRB review/approval process will vary depending on the complexity of the research and/or the level of risk to study participants; ample time should be allotted to complete the approval process. The IRB approval process can last between 1 to 3 months, followed by a DoD review that could last 3 to 6 months. No funding may be used toward human subject research until all approvals are granted. Therefore, in their cost proposals offerors should separate hu...