Mission Awareness for Mission Assurance (MAMA)

AMENDMENT 7 to BAA RIK-2014-0014 The purpose of this modification is to republish the original announcement, incorporating any previous amendments, pursuant to FAR 35.016(c). This republishing also includes the following changes: (a) Update NAICS CODE; (b) Section I: Add information on Fundamental Research and Cloud Computing; (c) Section III: Updated to reflect current access requirements; (d) Section VI.1: updated proposal instructions; and (e) Section VI.2: Update the DLIS information. No other changes have been made. _________________________________________ NAICS CODE: 541715 FEDERAL AGENCY NAME: Department of the Air Force, Air Force Materiel Command, AFRL - Rome Research Site, AFRL/Information Directorate, 26 Electronic Parkway, Rome, NY, 13441-4514 BROAD AGENCY ANNOUNCEMENT (BAA) TITLE: Mission Awareness for Mission Assurance (MAMA) BAA ANNOUNCEMENT TYPE: Initial announcement BAA NUMBER: BAA RIK-2014-0014 CATALOG OF FEDERAL DOMESTIC ASSISTANCE (CFDA) Number: 12.800 I. FUNDING OPPORTUNITY DESCRIPTION: The Information Directorate of the Air Force Research Laboratory (AFRL/RI), Rome Research Site, is soliciting white papers under this announcement for innovative technologies to enable effective cyber situational awareness (SA) during mission execution to achieve mission assurance for military operations. AFRL/RI conducts research in the areas of information management and dissemination as well as cyber science and technology. This research has led to the development of service oriented information management and dissemination implementations, in particular, Phoenix Prime. The continued development and maturation of innovative concepts and enhanced services that maximize the situational awareness during mission execution to achieve mission assurance of military operations is the primary focus of this BAA. Background: The Information Management Technologies Branch of the Information Directorate of the Air Force Research Laboratory (AFRL), Rome Research Site, are researching and developing techniques and services for information management in diverse military environments. Information Management (IM) is defined as a set of intentional activities to maximize the value of information to support the objectives of the military enterprise. These activities include role/policy based information access control, information tagging and contextualization through semantic assessment, discovery and identification, scalability and responsiveness to resource availability and the administrative activities that support them. Understanding how concepts for sharing information amongst disparate producers, consumers and operational domains and the technologies that can be applied in the unique military operational and tactical domains are of critical importance. AFRL's information centric technology vision has culminated in a suite of AFRL Information Management (IM) services known as Phoenix Prime. Phoenix Prime is a service oriented information system that enables the management of all information interactions through domain independent "universal services" whose functions include obtaining, discovering, characterizing, identifying, prioritizing, mediating, persisting and disseminating information within and between mission partners. The most recent Phoenix Prime developments correlate users with operational activities, determine information requirements, assess information for mission relevance and establish information processing priorities based upon mission importance and system resource availability. A new consolidated program called "Mission Awareness for Mission Assurance" (MAMA) is being started under this BAA. The goal of MAMA is to enhance cyber situational awareness by the automated assessment of mission execution through the analysis of network traffic flows. This resultant capability is an enabler to achieving mission assurance by allowing prioritization of mission essential functions, mapping of critical cyber assets, vulnerability assessment of mission essential functions and mitigation of vulnerabilities and risks. A key component of the Cyber Vision 2025 tenet of "Assure and Empower the mission" is that ensuring survivability and freedom of action in contested and denied environments requires enhanced cyber situational awareness (SA) for air, space, and cyber commanders. This can be enabled by, in part, mission mapping. The vision goes on to identify then enabling science and technology (S&T) for mission assurance and empowerment as mission mapping to systems components, cyber mission verification across sensors/platforms and dynamic cyber mission configuration. This program acknowledges that cyber is inextricably entwined with the air and space missions, yet the Air Force has no "true" cyber SA, even for limited critical missions; therefore, the vision of this program is to expand upon the Cyber Vision 2025 S&T platform to not only cyber missions, but to all Air Force missions. Much like the recommendations made by Cyber Vision 2025, the Scientific Advisory Board Study on Cyber Situational Awareness also advocates S&T investment in automated mission mapping, data tagging, utilization of context-aware routers and the evaluation of these technologies in an operationally relevant environment. The study sees this investment crucial to addressing the fact that, even for critical missions, there is almost no understanding of Air Force mission dependencies on information systems. The global AF enterprise relies heavily on communication networks to achieve its mission of global vigilance, global reach and global power. However, as the AF and the nation are gaining unprecedented capabilities from high capacity global networks, it is also contending with increasingly sophisticated threats to its networks and systems. These threats range from distributed denial of service, to Anti-satellite (ASAT), to insider threats. While there are significant investments seeking to mitigate these threats, none will eliminate them. AFRL/RI recognizes that the first step to mission assurance, despite the presence of these threats, is improved SA for decision makers at all levels. This program seeks to provide mission awareness through extraction and analysis of content transiting the Air Force Network (AFNET), to inform Command and Control (C2) elements monitoring mission execution, and to control critical network elements to improve mission effectiveness. MAMA's challenge is to first identify what specific missions are supported by what specific information flows. This is called "mapping information to missions." However, simply counting packets between endpoints may provide a measure of network performance, but it does not indicate much about mission performance. The Air Force must separate the SA needed to support cyber-dependent mission assurance from awareness of network health and status. Reports to commanders must be at the mission-impact level, not at the network level. The key is to operate higher in the Open Systems Interconnection (OSI) stack by tagging information objects with mission relevant data. MAMA will extract semantic content from mission relevant metadata of transiting information objects to assess mission status. In addition to supporting a MAMA's goal of addressing current missions, it is anticipated that the massive amount of extracted semantic content will be useful for other goals such as identification of "low and slow" cyber threats, a big data problem that falls outside the scope of MAMA, but within the scope of AFRL/RI. AFRL/RI is uniquely suited to develop the MAMA concept because it draws heavily upon a maturing, moderate Technology Readiness Level (TRL), set of prior investments to accomplish its objectives. Among these is the Content and Context-aware Trust Router (CCTR) as the high capacity broker that is capable of extracting and brokering information around the AFNET. The broker will forward selected traffic to Phoenix Prime, a cloud-scale enterprise-class information management system that will extract semantic content into a triple store accessible to backend analytics engines. The triple stores will challenge AFRL/RI's high performance computing expertise to maintain performance over time in an effort to continuously assess mission status. Perhaps most importantly, it will marry up AFRL/RISA's adaptive mission templates with a specific mission domain to semantically model the mission space, extract mission orders, and support mission awareness. The Department of Defense (DoD) and AF are operating within a contested cyber environment and its ability to accomplish their mission will require responding to network dynamics. In addition, peer competitors may deny us continuous communications with mission assets, leading to uncertainty for commanders. MAMA, while not directly assuring the mission, supports mission assurance by providing a network elements basis for resource allocation, and monitors information flows to infer mission performance on a large scale. AFRL/RIS proposes to focus this program on the Space domain for several reasons. First, as a less mature domain, it is more receptive to technology insertion than the Air domain that has more mature processes and is in the midst of major acquisition efforts. The high level challenge of providing mission awareness for mission assurance can be broken down into several sub-challenges that are addressed within the program structure. This BAA comprises three projects with each having its own technical risks that require substantial S&T: 1) Mapping the Mission to Information Flows 2) Mission Information Sufficiency, Correlation, and Event Learning (MISCEL) and 3) Integration, Demonstration and Validation of MAMA. At a high level, MAMA brings together three types of data: 1) models of information flows that support known mission types, 2) knowledge of specific missions being executed with principals mapped to corresponding roles, and 3) the information transiting the network either in support of these missions or from other unmapped data flows. Based upon these components, MAMA will provide mission awareness to C2 operators and provide feedback to Quality of Service mechanisms in the CCTR. FY17/18 Focus Area: Red Teaming, Validation, and Demonstration The key focus area for this phase of the BAA is quality, performance, scalability, and evaluation of Mission Awareness for Mission Assurance (MAMA) program technologies (Content-Aware Context-Aware Trusted Router, Ontologies, Semantic Metatagger, Adaptive Mission Templates (AMT), OSCAR, and STAMPEDE Mission Services) through red teaming, validation, and experimentation, with secondary objectives for extending technology functionality and domain applicability. Activities within this phase should drive an increase in technology quality, standards-based representations and pluggability, cyber and security resiliency, reusability, and ease of use. Additionally, it should result in gauging how well the Semantic Templates for Assured Missions in a Proxy-Enabled Dissemination Environment (STAMPEDE) technologies fulfill their intended purposes and contribute, in practice, to solving challenges involving multiple organizations and domains, big-data mission environments, mission and cyber situational awareness (SA) needs, and mission assurance decision support. Validation: Multiple forms of objective validation should be applied at the distinct tiers of the technology development "V" in order to assess and improve quality, functionality, security, and performance. Baselines for quality can be established, and subsequently improved, through objective testing, experimentation, code analysis, ontology review, and rigorous quality control metrics generated from deployment and event log analysis, platform monitoring, and 3-V (Velocity, Variety, Volume) Information Management (IM) analysis. Functional validation can also be justified through experimentation and peer-reviewed publications that evaluate, describe, and provide conclusive evidence of holistic system mission awareness and assurance capabilities. Peer review in high quality research conferences, journals, or DoD conferences/summits provide a means of gauging the criticality, novelty, and S&T substance of core STAMPEDE technologies, as well as providing objective feedback and guidance from highly relevant and technologically aligned subject matter experts (SMEs). Red Teaming: Red teaming should be used to ensure that MAMA technologies are well designed and robust to cyber threats. Performing objective testing and red teaming matures technology and exposes flaws. At a minimum, this activity requires fully mapping out and evaluating architectural, functional, and exploitation resiliency requirements. At maximum, activities should include performing functional, intrusion, and penetration testing to determine technology weaknesses, flaws, and vulnerabilities for mitigation. These resulting recommendations should be generated early in any proposed schedule, in order to have strategies and plans in place for mitigation. Experimentation: The goal of this project is to develop a fully validated and functionally assessed architecture, components, services, and technology installation for enhanced mission awareness and assurance. Exercising a limited technology experiment within an operational context is a target milestone that would drive more enhanced systems integration, qualitatively assess performance and functional capabilities, and demonstrate mission-critical technologies for how well they provision, support, represent, and inform mission assurance. The semantic services of STAMPEDE support these approaches but must balance their innovative use cases for relationships extracted from either published information or knowledge within data lakes, archives, or database siloes, and in accordance with mission and service requirements. Experimentation targets to evaluate and improve compliance with functional and validation metrics include: - Bi-directional Cyber Situational Awareness SA - Support cyber posture and ISR tools by making operational dependencies and mission prioritization data available through standards-based web services and runtime analytics within STAMPEDE's architecture. - Holistic Mission Support - Demonstrating STAMPEDE support for multi-domain information formats (Air, Space, Cyber, US TRANSCOM) are integrated into the fabric of semantic mission awareness that is represented and persisted in STAMPEDE. - Commander and Mission-driven Assurance Decision Support - Demonstrate STAMPEDE information-level support for SA integration of multi-domain (Air, Space, Cyber, US TRANSCOM) mission effectiveness analytics, commander's critical information requirements, and mission information flows. - Cyber Integrated Multi-Domain SA and Vulnerability Analysis - Demonstrate STAMPEDE information-level support of network health/status (e.g. Cauldron Scoring, Cyber SA, etc.), cyber threat awareness (STIX, Snort, NMap, etc.), and mission-mapped cyber dependencies. - Multi-Domain Mission Representation and Analysis - Demonstrate multi-domain (Air, Space, Cyber, US TRANSCOM) mission representations within AMT, with support for inter-dependent mission essential functions (MEF) discovery that span across kinetic ops, information, authority, and cyber flows. - Performance and Scalability - Establish key performance parameters based upon operationally relevant criteria for applied use cases, and seek to enhance STAMPEDE performance and scalability to those operationally required levels. STAMPEDE Technology Maturity and Domain Applications: This program phase will mature the current semantic mission awareness technologies of STAMPEDE through functional development, with advanced applied research and development intended to extend STAMPEDE to more operational domains, validate a greater breadth of multi-domain mission awareness use cases, and increase the holistic maturity and functional robustness of STAMPEDE's technologies. Options for targeted functional development and framework maturity include: - Demonstrate the full-spectrum of mission awareness semantic ontologies and technologies that span the cyber, information, domain, and mission relationships. - Design, develop, and prototype an enhanced data lake for integration with STAMPEDE for operationally relevant big-data experiments, with pluggable interfaces for multi-data lake implementations, tagging re-queried information for analysis via the STAMPEDE monitoring capability and visualization. - Develop a data lake monitoring service that examines workflows, retrieves information tags, and executes queries against a data lake's metadata, resulting in documents, messages, & files that are fed into STAMPEDE for tagging, alignment, mapping and brokering/routing. - Quality of Service (QoS) improvements for CCTR and STAMPEDE use cases involving messaging metrics and priority based MIO policy management/routing. - Development of CCTR encrypted communication capabilities for SSL/TLS adherence, and other modern standards and improvements to message delivery reporting capability. - Develop interfaces between STAMPEDE and CSA Explorer for live integration and visualization through monitoring, filtering, and mission assurance decision-making. - Transform Mission Assurance from Situational Awareness (MASA) MASA data into the CSA Explorer data model while identifying and utilizing geo-location, mission mappings, operating systems, attack graphs, and cyber threats for use in operator visualizations. - Develop the necessary APIs and interfaces to enable STAMPEDE semantic services to interface with Phoenix Prime, and leverage combinational STAMPEDE/Phoenix Prime semantic brokering for mission awareness and assessing the benefits gained through a shared mix of capabilities, components and ontologies. - Enables administrators to efficiently monitor all aspects of system and service states, manage active missions and information requirements, define and modify service configurations, and define and deconflict domain, organization, environment specific information, and tagging processes. In summary, the primary goal of this phase is to develop a fully validated and functionally assessed architecture, components, services, and technology installation for enhanced mission awareness and assurance. In order for STAMPEDE technologies to be transitioned they must be relatively easy to deploy, configure, administer and monitor. Ease of deployment will also require the porting of STAMPEDE technologies to appropriate domain and technology environments. Achieving the objectives of this development phase will result in subjecting program technologies to architectural and functional validation, objective architectural, functional, and exploitative red teaming, and in-depth, qualitative, multi-domain scenario experimentation that exercises the full-range of mission support, awareness, interoperability, and assurance capabilities. Offerors are encouraged to provide an on-site contractor presence working at AFRL/RISA Rome, NY to foster collaboration with other in-house teams, to minimize integration risks and to effectively leverage experimentation/demonstration resources. Phoenix Prime software and documentation are available upon request to Timothy Blocher (contact@example.gov). STAMPEDE software and documentation are available upon request to Jason Bryant (contact@example.gov). Security Classification: Software development will largely be UNCLASSIFIED but the domain specific activities may be up to Top Secret/Sensitive Compartmented Information (TS/SCI). IMPORTANT NOTES REGARDING: FUNDAMENTAL RESEARCH. It is DoD policy that the publication of products of fundamental research will remain unrestricted to the maximum extent possible. National Security Decision Directive (NSDD) 189 defines fundamental research as follows: - Fundamental research' means basic and applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific community, as distinguished from proprietary research and from industrial development, design, production, and product utilization, the results of which ordinarily are restricted for proprietary or national security reasons. As of the date of publication of this BAA, the Government cannot identify whether work proposed under this BAA may be considered fundamental research and may award both fundamental and non-fundamental research. Proposers should indicate in their proposal whether they believe the scope of the research included in their proposal is fundamental or not. While proposers should clearly explain the intended results of their research, the Government shall have sole discretion to select award instrument type and to negotiate all instrument terms and conditions with selectees. Appropriate clauses will be included in resultant awards for non-fundamental research to prescribe publication requirements and other restrictions, as appropriate. For certain research projects, it may be possible that although the research being performed by the awardee is restricted research, a sub-awardee may be conducting fundamental research. In those cases, it is the awardee's responsibility to explain in their proposal why its sub-awardee's effort is fundamental research. CLOUD COMPUTING. In accordance with DFARS Clause 252.239-7010, if the development proposed requires storage of Government, or Government-related data on the cloud, offerors need to ensure that the cloud service provider proposed has been granted Provisional Authorization by the Defense Information Systems Agency (DISA) at the level appropriate to the requirement. II. AWARD INFORMATION: 1. FUNDING: Total funding for this BAA is approximately $24.9M. The anticipated funding to be obligated under this BAA is broken out by fiscal year as follows: FY15 - $1.4M FY16 - $5.2M FY17 - $4.6M FY18 - $7.7M FY19 - $6.0M Individual awards will not normally exceed 24 months with dollar amounts normally ranging from $250K to $1.5M. There is also the potential to make awards up to any dollar value. The Government reserves the right to select all, part, or none of the proposals received, subject to the availability of funds. All potential Offerors should be aware that due to unanticipated budget fluctuations, funding in any or all areas may change with little or no notice. 2. FORM. Awards of efforts as a result of this announcement will be in the form of contracts. 3. BAA TYPE: This is a two-step open broad agency announcement. This announcement constitutes the only solicitation. As STEP ONE - The Government is only soliciting white papers at this time. DO NOT SUBMIT A FORMAL PROPOSAL. Those white papers found to be consistent with the intent of this BAA may be invited to submit a technical and cost proposal, see Section VI of this announcement for further details regarding the proposal. III. ELIGIBILITY INFORMATION: 1. ELIGIBILITY: All qualified offerors who meet the requirements of this BAA may apply. 2. FOREIGN PARTICIPATION/ACCESS: a. This BAA is closed to foreign participation. This includes both foreign ownership and foreign nationals as employees or subcontractors. b. Exceptions. 1. Fundamental Research. If the work to be performed is unclassified, fundamental research, this must be clearly identified in the white paper and/or proposal. See Part II, Section I for more details regarding Fundamental Research. Offerors should still identify any performance by foreign nationals at any level (prime contractor or subcontractor) in their proposals. Please specify the nationals' country of origin, the type of visa or work permit under which they are performing and an explanation of their anticipated level of involvement. You may be asked to provide additional information during negotiations in order to verify the foreign citizen's eligibility to participate on any contract or assistance agreement issued as a result of this announcement 2. Foreign Ownership, Control or Influence (FOCI) companies who have mitigation plans/paperwork in place. Proof of approved mitigation documentation must be provided to the contracting office focal point, Gail E. Marsh, Contracting Officer, telephone +1 (555) 000-0000, or e-mail contact@example.gov prior to submitting a white paper and/or a proposal. For information on FOCI mitigation, contact the Defense Security Service. Additional details can be found at: http://www.dss.mil/isp/foci/foci_mitigation.html 3. Foreign Nationals as Employees or Subcontractors. Applicable to any effort not considered Fundamental Research. Offerors are responsible for ensuring that all employees and/or subcontractors who will work on a resulting contract are eligible to do so. Any employee who is not a U.S. citizen or a permanent resident will be restricted from working on any resultant contract unless prior approval of the Department of State or the Department of Commerce is obtained via a technical assistance agreement or an export license. Violations of these regulations can result in criminal or civil penalties. c. Information Regarding Non-US Citizens Assigned to this Project 1. Contractor employees requiring access to USAF bases, AFRL facilities, and/or access to U.S. Government Information Technology (IT) networks in connection with the work on contracts, assistance instruments or other transactions awarded under this BAA must be U.S. citizens. For the purpose of base and network access, possession of a permanent resident card ("Green Card") does not equate to U.S. citizenship. This requirement does not apply to foreign nationals approved by the U.S. Department of Defense or U.S. State Department under international personnel exchange agreements with foreign governments. It also does not apply to dual citizens who possess US citizenship, to include Naturalized citizens. Any waivers to this requirement must be granted in writing by the Contracting Officer prior to providing access. Specific format for waiver request will be provided upon request to the Contracting Officer. The above requirements are in addition to any other contract requirements related to obtaining a Common Access Card (CAC). 2. For the purposes of Paragraph 1, it an IT network/system does not require AFRL to endorse a contractor's application to said network/system in order to gain access, the organization operating the IT network/system is responsible for controlling access to its system. If an IT network/system requires a U.S. Government sponsor to endorse the application in order for access to the IT network/system, AFRL will only endorse the following types of applications, consistent with the requirements above: a) Contractor employees who are U.S. citizens performing work under contracts, assistance instruments or other transactions awarded under this BAA. b) Contractor employees who are non-U.S. citizens and who have been granted a waiver. Any additional access restrictions established by the IT network/system owner apply. 3. FEDERALLY FUNDED RESEARCH AND DEVELOPMENT CENTERS AND GOVERNMENT ENTITIES: Federally Funded Research and Development Centers (FFRDCs) and Government entities (e.g., Government/National laboratories, military educational institutions, etc.) are subject to applicable direct competition limitations and cannot propose to this BAA in any capacity unless they meet the following conditions: a. FFRDCs: FFRDCs must clearly demonstrate that the proposed work is not otherwise available from the private sector; and FFRDCs must provide a letter on official letterhead from their sponsoring organization citing the specific authority establishing their eligibility to propose to Government solicitations and compete with industry, and their compliance with the associated FFRDC sponsor agreement's terms and conditions. This information is required for FFRDCs proposing to be prime contractors or sub-awardees. b. Government Entities: Government entities must clearly demonstrate that the work is not otherwise available from the private sector and provide written documentation citing the specific statutory authority and contractual authority, if relevant, establishing their ability to propose to Government solicitations. While 10 U.S.C. 2539b may be the appropriate statutory starting point for some entities, specific supporting regulatory guidance, together with evidence of agency approval, will still be required to fully establish eligibility. FFRDC and Government entity eligibility will be determined on a case-by-case basis; however, the burden to prove eligibility for all team members rests solely with the proposer. Government agencies interested in performing work related to this announcement should contact the Technical Point of Contact (TPOC). If resulting discussions reveal a mutual interest, cooperation may be pursued via other vehicles. IV. APPLICATION AND SUBMISSION INFORMATION: All responses to this announcement must be addressed to the Technical point of contact (POC) listed in SECTION VII. DO NOT send white papers to the Contracting Officer. 1. SUBMISSION DATES AND TIMES: It is recommended that white papers be received by 3 PM Eastern Standard Time (EST) on the following dates to maximize the possibility of award: FY15 by 01 Nov 2014 FY16 by 01 Sep 2015 FY17 by 10 Oct 2016 FY18 by 01 Sep 2017 FY19 by 01 Sep 2018 White papers will be accepted until 3 PM Eastern Time on 30 Sep 2019, but it is less likely that funding will be available in each respective fiscal year after the dates cited. This BAA will close on 30 Sep 2019. All offerors submitting white papers will be contacted by the technical POC, referenced in Section VII of this announcement. Offerors can email the technical POC for status of their white paper/proposal no earlier than 45 days after submission. 2. CONTENT AND FORMAT: Offerors are required to submit 2 copies of a 5-6 page white paper summarizing their proposed approach/solution. The purpose of the white paper is to preclude unwarranted effort on the part of an offeror whose proposed work is not of interest to the Government. The white paper will be formatted as follows: a. Section A: Title, Period of Performance, Estimated Cost, Name/Address of Company, Technical and Contracting Points of Contact (phone and email)(this section is NOT included in the page count); b. Section B: Task Objective; and c. Section C: Technical Summary and Proposed Deliverables. All white papers shall be double spaced with a font no smaller than 12 point. In addition, respondents are requested to provide their Commercial and Government Entity (CAGE) Code, their unique entity identifier and electronic funds transfer (EFT) indicator (if applicable), an e-mail address and reference BAA RIK-2014-0014 with their submission. Multiple white papers within the purview of this announcement may be submitted by each offeror. If the offeror wishes to restrict its white papers, they must be marked with the restrictive language stated in FAR 15.609(a) and (b). 3. HANDLING AND MAILING INSTRUCTIONS: a. CLASSIFICATION GUIDANCE. All Proposers should review the NATIONAL INDUSTRIAL SECURITY PROGRAM OPERATING MANUAL, (NISPOM), dated February 28, 2006 and incorporating Change 2 dated May 18, 2016, as it provides baseline standards for the protection of classified information and prescribes the requirements concerning Contractor Developed Information under paragraph 4-105. Defense Security Service (DSS) Site for the NISPOM is: http://www.dss.mil/. In the event of a possible or actual compromise of classified information in the submission of your white paper or proposal, immediately but no later than 24 hours, bring this to the attention of your cognizant security authority and AFRL Rome Research Site Information Protection Office (IPO): Vincent Guza +1 (555) 000-0000 0730-1630 Monday-Friday +1 (555) 000-0000 Evenings and Weeken...