Transparent, Integrated, Autonomous Multi-Level Access and Transfer (TIAMAT)

AMENDMENT 1 for BAA FA8750-18-S-7003 The purpose of this modification is to republish the original announcement pursuant to FAR 35.016(c). This republishing also includes the following changes: (a) Part I-updated BAA manager, Contracting Officer point of contacts and FY20 submission date information (b) Section I, added focus areas and added information regarding Fundamental Research and Cloud Computing; (c) Section III, Eligibility Information has been updated; (d) Section IV, updated the FY20 submission date information; (e) Section V, updated Review and Selection Process; (f) Section VI, updated Administrative and National Policy Requirements language, and added Small Business Participation language; (g) Section VII, Agency Contacts are updated; No other changes have been made. NAICS CODE: 541715 FEDERAL AGENCY NAME: Department of the Air Force, Air Force Materiel Command, AFRL - Rome Research Site, AFRL/Information Directorate, 26 Electronic Parkway, Rome, NY, 13441-4514 BAA ANNOUNCEMENT TYPE: Modification/Amendment BROAD AGENCY ANNOUNCEMENT (BAA) TITLE: Transparent, Integrated, Autonomous Multi-level Access and Transfer (TIAMAT) BAA NUMBER: FA8750-18-S-7003 PART I - OVERVIEW INFORMATION This announcement is for an Open, 2 Step BAA which is open and effective until 30 Sep 2022. Only white papers will be accepted as initial submissions; formal proposals will be accepted by invitation only. While white papers will be considered if received prior to 4:00 PM Eastern Standard Time (EST) on 30 Sep 2022, the following submission dates are suggested to best align with projected funding: FY19 by 31 Jan 2018 FY20 by 28 Feb 2019 FY21 by 31 Jan 2020 FY22 by 29 Jan 2021 Offerors should monitor the Federal Business Opportunities website at http://www.fbo.gov in the event this announcement is amended. CONCISE SUMMARY OF FUNDING OPPORTUNITY: Seeking innovative research to provide new or improved functionality to Multi-Level Security (MLS) and cyber security environments. Research should promote the state of the art for secure, accreditable resilient and reactive capabilities to enhance the sharing of information between multiple security domains within both enterprise and mobile/tactical environments. BAA ESTIMATED FUNDING: Total funding for this BAA is approximately $49.9M. Individual awards will not normally exceed 36 months with dollar amounts normally ranging from $1M to $3M. There is also the potential to make awards up to any dollar value as long as the value does not exceed the available BAA ceiling amount. ANTICIPATED INDIVIDUAL AWARDS: Multiple Awards are anticipated. TYPE OF INSTRUMENTS THAT MAY BE AWARDED: Contracts, grants, cooperative agreements or other transactions. AGENCY CONTACT INFORMATION: All white paper and proposal submissions and any questions of a technical nature shall be directed to the cognizant Technical Point of Contact (TPOC) as specified below (unless otherwise specified in the technical area): All white paper submissions and any questions of a technical nature shall be directed to the cognizant TPOC as specified below (unless otherwise specified in the technical area): BAA MANAGER: Major Camdon Cady AFRL/RIEBA 525 Brooks Rd Rome, NY 13441-4505 Telephone: (315)330-2117 Email: camdon.cady@us.af.mil Questions of a contractual/business nature shall be directed to the cognizant contracting officer, as specified below (email requests are preferred): Amber Buckley Telephone (315) 330-3605 Email: Amber.Buckley@us.af.mil Emails must reference the solicitation (BAA) number and title of the acquisition. Pre-Proposal Communication between Prospective Offerors and Government Representatives: Dialogue between prospective offerors and Government representatives is encouraged. Technical and contracting questions can be resolved in writing or through open discussions. Discussions with any of the points of contact shall not constitute a commitment by the Government to subsequently fund or award any proposed effort. Only Contracting Officers are legally authorized to commit the Government. Offerors are cautioned that evaluation ratings may be lowered and/or proposal rejected if proposal preparation (Proposal format, content, etc.) and/or submittal instructions are not followed. PART II - FULL TEXT ANNOUNCEMENT BROAD AGENCY ANNOUNCEMENT (BAA) TITLE: Transparent, Integrated, Autonomous Multi-level Access and Transfer (TIAMAT) BAA NUMBER: BAA FA8750-18-S-7003 CATALOG OF FEDERAL DOMESTIC ASSERTION (CFDA) Number: 12.800 I. FUNDING OPPORTUNITY DESCRIPTION: The Cross Domain Innovation & Science (CDIS) group of the Air Force Research Laboratory's Information Directorate is interested in new innovative technologies and capabilities within the Multi-Level Security (MLS) and cyber security environments, that promote the state of the art for secure, accreditable resilient and reactive capabilities to enhance the sharing of information between multiple security domains within both enterprise and mobile/tactical environments. This BAA focuses on developing new technologies to decrease the entry barrier for implementing secure and usable cross security domain in operational environments, and providing high quality inspection and analysis of risky assets moving across security domains. While the following focus areas cover the items of greatest current interest in the multi-level security (MLS) field the CDIS group welcomes innovative white papers across the entire scope of MLS. 1. Enterprise Integration and Enablement Current cross-domain solutions (CDS) are designed for a specific application - data transfer or access - this focus area is looking for CDS technologies that are designed for the functionality and workflow of enterprise systems by developing software and hardware solutions that enables an intuitive and transparent access to and sharing of data from other domains. Specific areas of interest include enterprise collaboration tools, improved local and remote CDS administration, concurrent full motion video, and shared databases. A final area of interest within this focus area is improving the user experience in CDS operations by reducing user actions required to initiate transfer or access, 2. Mobile and Embedded Augmentation As the DoD looks to increase the information battlespace to warfighters at the edge on mobile systems, they are inhibited by multilevel access and transfer solutions that are currently extremely computationally intensive and rigid. While several proof of concept mobile cross domain devices have been developed, they fail under operational conditions because of the modifications and power requirements drastically reducing their functionality and increasing cost. Research and develop methods that allow for cross domain solutions to exist in size, weight, and power constrained devices that are securely compatible with commercial-off-the-shelf devices with little or no modification. Specific topics of interest include multilevel systems optimized for disruptive, intermittent and latent communications and tactical mesh networks, moving logical separation of security domains higher up the system stack without increasing risk, and integrating cross domain transfer solutions with a mobile access device. This research also extends to all swap constrained devices such as low power sensors and military-enabled internet of things devices. 3. Complex Data Formats and Content A current outstanding requirement for reducing risk of cross domain operations is analysis and sanitization of high risk data, such as video, audio, and human readable text. Primary interest is not only in the development of streaming and human readable content filters but also modular frameworks and methods for rapidly adding support of new data types to a filter or filter suite. This includes human-in-the-loop analytic systems, near real time automated redaction tools, and explainable machine intelligence. These capabilities are needed for effective transfer of data from higher to lower privileged security domains without an unsustainable human administrator burden. 4. Scalable and Service Oriented Solutions Current guard architecture consists of an accredited rigid logical flow tied to specific hardware. As mission needs more and more call for distributed resources and information access, the current paradigm for cross domain must switch from that of a single device per task to a scalable and modularized solution. This requires containerization, modularization, and scalability of the individual guard components, with the goal of creating an adaptive CDS to handle disparate access and transfer of rapidly changing volumes and formats of data to a variable number of end-points. Of interest are proposals to develop accreditable containerized, modular, and scalable guard components or guard architectures enabling the secure use of such guard components. 5. AFRL is interested in white papers that could significantly increase the performance and/or security of inter virtual machine data transfers using novel methods. Efforts must focus on transfers within the local hypervisor on the Intel processor families. While technical approaches can vary, proposed solutions should be exposable using current industry interfaces (e.g. V4V) to ensure backwards compatibility with existing solutions. Measures of effectiveness could include processor overhead, speed of transfers relative to impact on overall system performance. Further research topics are sought to address the challenges with software integrity using multichip modules. Existing systems such as intel's TXT and VPRO technologies have limitations, such as only running at boot time. These modules should provide an external source of trust to monitor the integrity of the operating system or hypervisor with greater frequency or fidelity. Cloud technologies may provide an avenue to accelerate the topic's goals of a modularized system in the cloud. However, the root of trust in hardware and accesses to these facilities the cloud vendors choose to provide creates many questions. AFRL is seeking white papers to evaluate the extent or depth of trust possible in both the hardware and software. The trust boundary should only leverage commercially available products from vendors without modification. Research the capability to provide Mandatory Access Controls between cloud services instances and develop automated verification and policy analysis prototypes of those mandatory access controls. These security controls should be applicable to providing approximately equal controls to strict, well formed SELinux policies that exist on operating systems and will progress the use of distributed microservices architectures on national security systems. Measures of effectiveness include transport overhead when compared to commercial systems, satisfaction of Cross Domain Solution security controls, and proof of non-bypassibility of inter-process communications. White papers that require making major modifications to existing cloud services are not of interest. Strong white papers will be able to demonstrate technology effectiveness on already existing cloud infrastructure services and national security systems policies in use today. 6. Machine Learning (ML) technologies have the potential to greatly decrease the time-to-field for new cross-domain capabilities while also increasing the agility of these capabilities once fielded. That said, ML technologies need to contribute towards an informed risk acceptance decision. The lack of measurable, adaptable adversarial resilience is a significant shortfall in the current state of the possible. This focus area is looking to investigate novel techniques to address adversarial evasion of ML algorithms supporting a cross domain use case. The threat model denies the adversary the ability to influence training of the classifiers in question Otherwise, the adversary has full knowledge of classification algorithms, feature sets, network topologies (in the case of neural networks) and hyper-parameters. White papers regarding data poisoning defenses are not of interest. One area of interest is to assess an existing classifier's resilience to adversarial evasion (difficulty of sample perturbation resulting in misclassification) and to develop countermeasures that objectively increase this resilience against previously unseen attacks. Approaches should not rely upon underlying, hidden peculiarities of the classifiers' feature sets or encodings. Approaches should address resilience to adversarial evasion, impacts to classifier accuracy and precision, impacts to classifier performance, extensibility to multiple functional domains. 7. The Government is interested in white papers that research and develop utilization of Android Project Treble Hardware Abstraction Layers for use in Cross Domain Access solutions to increase the portability of cross domain solutions between different generations and builds of hardware systems. Additionally, research providing trap and catch methodology for isolating resource control between specific containers using well-crafted Security Enhanced (SE) Android policies. Measures of effectiveness include reducing performance overhead on computational resources and battery life from added services, ability to refactor quickly from different generations of equipment and original equipment manufacturers (OEM), and the invasiveness of changes that are required on any privileged portions of the Operating System. White papers that require rooting the phone for operational use or hardware modifications of an OEM device are not of interest. Strong white papers will contain strong technical innovations and will not merely port existing concepts and software into a custom solution The Government is interested in white papers that research and develop containerization methods of Android devices that can provide logical isolation to contain applications of multiple classification levels. This focus area is looking for providing an application environment that can isolate Android applications and allow multiple containers to run concurrently at different classification levels. The Containers should contain a tie back to hardware root of trust and should not require major changes to an OS such as adding root level permissions. Measures of Effectiveness include reducing performance overhead on computational resources and battery life from added services, ability to refactor quickly from different generations of equipment and OEM manufacturers. IMPORTANT NOTES REGARDING: FUNDAMENTAL RESEARCH. It is DoD policy that the publication of products of fundamental research will remain unrestricted to the maximum extent possible. National Security Decision Directive (NSDD) 189 defines fundamental research as follows: - Fundamental research' means basic and applied research in science and engineering, the results of which ordinarily are published and shared broadly within the scientific community, as distinguished from proprietary research and from industrial development, design, production, and product utilization, the results of which ordinarily are restricted for proprietary or national security reasons. As of the date of publication of this BAA, the Government cannot identify whether work proposed under this BAA may be considered fundamental research and may award both fundamental and non-fundamental research. Proposers should indicate in their proposal whether they believe the scope of the research included in their proposal is fundamental or not. While proposers should clearly explain the intended results of their research, the Government shall have sole discretion to select award instrument type and to negotiate all instrument terms and conditions with selectees. Appropriate clauses will be included in resultant awards for non-fundamental research to prescribe publication requirements and other restrictions, as appropriate. For certain research projects, it may be possible that although the research being performed by the awardee is restricted research, a sub-awardee may be conducting fundamental research. In those cases, it is the awardee's responsibility to explain in their proposal why its sub-awardee's effort is fundamental research. CLOUD COMPUTING. In accordance with DFARS Clause 252.239-7010, if the development proposed requires storage of Government, or Government-related data on the cloud, offerors need to ensure that the cloud service provider proposed has been granted Provisional Authorization by the Defense Information Systems Agency (DISA) at the level appropriate to the requirement. II. AWARD INFORMATION: 1. FUNDING: Total anticipated funding for this BAA is approximately $49.9M. The anticipated funding to be obligated under this BAA is broken out by fiscal year as follows: FY19 - $12.4M FY20 - $12.6M FY21 - $12.4M FY22 - $12.5M a. Individual awards will not normally exceed 36 months with dollar values ranging from $1M to $3M. There is also the potential to make awards up to any dollar value as long as the value does not exceed the available BAA ceiling amount. b. The Government reserves the right to select all, part, or none of the proposals received, subject to the availability of funds. All potential Offerors should be aware that due to unanticipated budget fluctuations, funding in any or all areas may change with little or no notice. 2. FORM. Awards of efforts as a result of this announcement will be in the form of contracts, grants, cooperative agreements or other transactions depending upon the nature of the work proposed. 3. BAA TYPE: This is a two-step open broad agency announcement. This announcement constitutes the only solicitation. As STEP ONE - The Government is only soliciting white papers at this time. DO NOT SUBMIT A FORMAL PROPOSAL. Those white papers found to be consistent with the intent of this BAA may be invited to submit a technical and cost proposal. See Section VI of this announcement for further details regarding the proposal. III. ELIGIBILITY INFORMATION: 1. ELIGIBILITY: All qualified offerors who meet the requirements of this BAA may apply. 2. FOREIGN PARTICIPATION/ACCESS: a. This BAA is closed to foreign participation. This includes both foreign ownership and foreign nationals as employees or subcontractors. b. Exceptions. 1. Fundamental Research. If the work to be performed is unclassified, fundamental research, this must be clearly identified in the white paper and/or proposal. See Part II, Section I for more details regarding Fundamental Research. Offerors should still identify any performance by foreign nationals at any level (prime contractor or subcontractor) in their proposals. Please specify the nationals' country of origin, the type of visa or work permit under which they are performing and an explanation of their anticipated level of involvement. You may be asked to provide additional information during negotiations in order to verify the foreign citizen's eligibility to participate on any contract or assistance agreement issued as a result of this announcement 2. Foreign Ownership, Control or Influence (FOCI) companies who have mitigation plans/paperwork in place. Proof of approved mitigation documentation must be provided to the contracting office focal point, Amber Buckley, Contracting Officer, telephone (315) 330-3605, or e-mail Amber.Buckley@us.af.mil prior to submitting a white paper and/or a proposal. For information on FOCI mitigation, contact the Defense Security Service. Additional details can be found at: http://www.dss.mil/isp/foci/foci_mitigation.html 3. Foreign Nationals as Employees or Subcontractors. Applicable to any effort not considered Fundamental Research. Offerors are responsible for ensuring that all employees and/or subcontractors who will work on a resulting contract are eligible to do so. Any employee who is not a U.S. citizen or a permanent resident will be restricted from working on any resultant contract unless prior approval of the Department of State or the Department of Commerce is obtained via a technical assistance agreement or an export license. Violations of these regulations can result in criminal or civil penalties. c. Information Regarding Non-US Citizens Assigned to this Project a. Contractor employees requiring access to USAF bases, AFRL facilities, and/or access to U.S. Government Information Technology (IT) networks in connection with the work on contracts, assistance instruments or other transactions awarded under this BAA must be U.S. citizens. For the purpose of base and network access, possession of a permanent resident card ("Green Card") does not equate to U.S. citizenship. This requirement does not apply to foreign nationals approved by the U.S. Department of Defense or U.S. State Department under international personnel exchange agreements with foreign governments. It also does not apply to dual citizens who possess US citizenship, to include Naturalized citizens. Any waivers to this requirement must be granted in writing by the Contracting Officer prior to providing access. Specific format for waiver request will be provided upon request to the Contracting Officer. The above requirements are in addition to any other contract requirements related to obtaining a Common Access Card (CAC). b. For the purposes of Paragraph 1, it an IT network/system does not require AFRL to endorse a contractor's application to said network/system in order to gain access, the organization operating the IT network/system is responsible for controlling access to its system. If an IT network/system requires a U.S. Government sponsor to endorse the application in order for access to the IT network/system, AFRL will only endorse the following types of applications, consistent with the requirements above: a) Contractor employees who are U.S. citizens performing work under contracts, assistance instruments or other transactions awarded under this BAA. b) Contractor employees who are non-U.S. citizens and who have been granted a waiver. Any additional access restrictions established by the IT network/system owner apply. 3. FEDERALLY FUNDED RESEARCH AND DEVELOPMENT CENTERS AND GOVERNMENT ENTITIES: Federally Funded Research and Development Centers (FFRDCs) and Government entities (e.g., Government/National laboratories, military educational institutions, etc.) are subject to applicable direct competition limitations and cannot propose to this BAA in any capacity unless they meet the following conditions: a. FFRDCs: FFRDCs must clearly demonstrate that the proposed work is not otherwise available from the private sector; and FFRDCs must provide a letter on official letterhead from their sponsoring organization citing the specific authority establishing their eligibility to propose to Government solicitations and compete with industry, and their compliance with the associated FFRDC sponsor agreement's terms and conditions. This information is required for FFRDCs proposing to be prime contractors or sub-awardees. b. Government Entities: Government entities must clearly demonstrate that the work is not otherwise available from the private sector and provide written documentation citing the specific statutory authority and contractual authority, if relevant, establishing their ability to propose to Government solicitations. While 10 U.S.C. 2539b may be the appropriate statutory starting point for some entities, specific supporting regulatory guidance, together with evidence of agency approval, will still be required to fully establish eligibility. FFRDC and Government entity eligibility will be determined on a case-by-case basis; however, the burden to prove eligibility for all team members rests solely with the proposer. Government agencies interested in performing work related to this announcement should contact the Technical Point of Contact (TPOC). If resulting discussions reveal a mutual interest, cooperation may be pursued via other vehicles. IV. APPLICATION AND SUBMISSION INFORMATION: All responses to this announcement must be addressed to the Technical Point of Contact (TPOC) listed in SECTION VII. DO NOT send white papers to the Contracting Officer. 1. SUBMISSION DATES AND TIMES: It is recommended that white papers be received by 4:00 PM Eastern Standard Time (EST) on the following dates to maximize the possibility of award: FY19 by 31 Jan 2018 FY20 by 28 Feb 2019 FY21 by 31 Jan 2020 FY22 by 29 Jan 2021 White papers will be accepted until 4:00 PM EST on 30 Sept 2022, but it is less likely that funding will be available in each respective fiscal year after the dates cited. This BAA will close on 30 Sept. 2022. All offerors submitting white papers will receive notification of their evaluation results within 45 days of submission. Offerors should email the TPOC and the Contracting Officer listed in Section VII, for status of their white paper(s) after 45 days, if no such correspondence has been received. 2. CONTENT AND FORMAT: Offerors are required to submit 3 copies of a 3 to 5 page white paper summarizing their proposed approach/solution. The purpose of the white paper is to preclude unwarranted effort on the part of an offeror whose proposed work is not of interest to the Government. The white paper will be formatted as follows: a. Section A: Title, Period of Performance, Estimated Cost, Name/Address of Company, Technical and Contracting Points of Contact (phone and email)(this section is NOT included in the page count); b. Section B: Task Objective; and c. Section C: Technical Summary and Proposed Deliverables. All white papers shall be double spaced with a font no smaller than 12 point. In addition, respondents are requested to provide their Commercial and Government Entity (CAGE) Code, their unique entity identifier and electronic funds transfer (EFT) indicator (if applicable), an e-mail address and reference BAA FA8750-18-S-7003 with their submission. Multiple white papers within the purview of this announcement may be submitted by each offeror. If the offeror wishes to restrict its white papers, they must be marked with the restrictive language stated in FAR 15.609(a) and (b). 3. HANDLING AND MAILING INSTRUCTIONS: a. CLASSIFICATION GUIDANCE. All Proposers should review the NATIONAL INDUSTRIAL SECURITY PROGRAM OPERATING MANUAL, (NISPOM), dated February 28, 2006 and incorporating Change 2, dated May 18, 2016, as it provides baseline standards for the protection of classified information and prescribes the requirements concerning Contractor Developed Information under paragraph 4-105. Defense Security Service (DSS) Site for the NISPOM is: http://www.dss.mil/. In the event of a possible or actual compromise of classified information in the submission of your white paper or proposal, immediately but no later than 24 hours, bring this to the attention of your cognizant security authority and AFRL Rome Research Site Information Protection Office (IPO): Information Protection Office (contact only if a security compromise has occurred) Monday-Friday (0730-1630): Call 315-330-4048 or Email: vincent.guza@us.af.mil Evenings and Weekends: Call 315-330-2961 b. CLASSIFIED SUBMISSIONS. AFRL/RIEBA will accept classified responses to this BAA when the classification is mandated by classification guidance provided by an Original Classification Authority of the U.S. Government, or when the offeror believes the work, if successful, would merit classification. Security classification guidance in the form of a DD Form 254 (DoD Contract Security Classification Specification) will not be provided at this time since AFRL is soliciting ideas only. Offerors that intend to include classified information or data in their white paper submission or who are unsure about the appropriate classification of their white papers should contact the technical point of contact listed in Section VII for guidance and direction in advance of preparation. c. MAILING INSTRUCTIONS. Any mailed responses, unclassified/classified, to this announcement must be sent U.S. Postal Service, registered mail or similar service and addressed to AFRL/RIEA, 525 Brooks Road, Rome NY 13441-4505, and reference BAA FA8750-18-S-7003. When mailing follow the directions regarding the number of copies required. Unclassified electronic submission to the TPOC identified in Section VII will also be accepted. Encrypt or password-protect all proprietary information prior to sending. Offerors are responsible to confirm receipt with the TPOC. AFRL is not responsible for undelivered documents. If electronic submission is used, only one copy of the documentation is required. Questions can be directed to the TPOC listed in Section VII. 4. OTHER SUBMISSION REQUIREMENTS/CONSIDERATIONS: a. COST SHARING OR MATCHING: Cost sharing is not a requirement. Cost sharing may be proposed and will be considered on a case-by-case basis. b. SYSTEM FOR AWARD MANAGEMENT (SAM). Offerors must be registered in the SAM database to receive a contract award, and remain registered during performance and through final payment of any contract or agreement. Processing time for registration in SAM, which normally takes forty-eight hours, should be taken into consideration when registering. Offerors who are not already registered should consider applying for registration before submitting a proposal. The provision at FAR 52.204-7, System for Award Management (Oct 2016) applies. c. EXECUTIVE COMPENSATION AND FIRST-TIER SUBCONTRACT/ SUBRECIPIENT AWARDS: Any contract award resulting from this announcement may contain the clause at FAR 52.204-10 - Reporting Executive Compensation and First-Tier Subcontract Awards (Oct 2016). Any grant or agreement award resulting from this announcement may contain the award term set forth in 2 CFR, Appendix A to Part 25 which can be viewed at: http://www.ecfr.gov/cgi-bin/text-idx?SID=8fb6c83606df57968c3e7e145e7d683c&mc=true&node=ap2.1.25_1360.a&rgn=div9 d. ALLOWABLE CHARGES: The cost of preparing white papers/proposals in response to this announcement is not considered an allowable direct charge to any resulting contract or any other contract, but may be an allowable expense to the normal bid and proposal indirect cost specified in FAR 31.205-18. Incurring pre-award costs for ASSISTANCE INSTRUMENTS ONLY are regulated by 2 CFR part 200.458, Pre-Award Costs. e. GOVERNMENT APPROVED ACCOUNTING SYSTEM: An offeror must have a government approved accounting system prior to award of a cost-reimbursement contract per limitations set forth in FAR 16.301-3(a) to ensure the system is adequate for determining costs applicable to the contract. The acceptability of an accounting system is determined based upon an audit performed by the Defense Contract Audit Agency (DCAA). IMPORTANT: If you do not have a DCAA approved accounting system access the following link for instructions: https://www.fbo.gov/index?s=opportunity&mode=form&id=1cffad228f48b58057072a6c9113799d&tab=core&_ cview=1 f. HUMAN USE: All research involving human subjects, to include the use of human biological specimens and human data, selected for funding must comply with Federal regulations for human subject protection. Further, research involving human subjects that is conducted or supported by the DoD must comply with 32 CFR 219, "Protection of Human Subjects" found at: http://www.access.gpo.gov/nara/cfr/waisidx_07/32cfr219_07.html, and DoD Instruction 3216.02, "Protection of Human Subjects and Adherence to Ethical Standards in DoD-Supported Research" found at: http://www.dtic.mil/whs/directives/corres/pdf/321602p.pdf. 1) Institutions awarded funding for research involving human subjects must provide documentation of a current Assurance of Compliance with Federal regulations for human subject protection, for example a Department of Health and Human Services, Office of Human Research Protection Federal Wide Assurance found at: http://www.hhs.gov/ohrp. 2) All institutions engaged in human sub...