**SEE ATTACHMENT AT BOTTOM OF NOTICE FOR CHANGES TO THIS RFI** Missile Defense Agency Gulf Cooperation Council (GCC) Ballistic Missile Early Warning System (BMEWS) Foreign Military Sales (FMS) Cross Domain Solution (CDS) Request for Information (Restricted to US Companies Only) Office: Missile Defense Agency DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited 1.0 GENERAL INFORMATION These RFI's are Restricted to US Companies Only. As a result of the May 2015 Camp David Summit, the United States Government (USG) agreed to "help conduct a study of GCC [Gulf Cooperation Council] ballistic missile defense architecture and offered technical assistance in the development of a GCC-wide Ballistic Missile Early Warning System" (BMEWS). The USG is releasing three Requests for Information (RFIs) for sensors; command, control, communications (C3); and cross domain solution (CDS). This RFI is one of three RFIs for GCC BMEWS. The Respondents may respond to one, two, or three RFIs. Responses to these RFIs will support the USG's recommendations to the GCC for development of a BMEWS. The Missile Defense Agency (MDA) Command, Control, Communications, Computers, Intelligence, Surveillance & Reconnaissance (C4ISR) Program Element is conducting market research to determine industry interest and capability for development of a CDS that partner nations can purchase through the Foreign Military Sales (FMS) process to enable their integration with the U.S. Air and Missile Defense Systems and to support a GCC-wide BMD architecture. 2.0 BACKGROUND U.S. regional partners are procuring advanced U.S. Air and Ballistic Missile Defense (BMD) systems utilizing both FMS and Direct Commercial Sales (DCS) programs. The advanced technology resident within these U.S. sensor and weapon systems produces information at the U.S. Classified (Confidential and above) level and determined to be releasable when approved for sale. Based on the classification of the sensor and weapon systems and the data produced, our partners are obligated to properly protect the system, network, technology, and the resultant data produced at the appropriate classification levels. Many regional partners desire to integrate these new U.S. systems into their existing communications architecture which operates at an un-protected/unclassified level of security by U.S. standards. Different security domains will be required between U.S. systems and partner nations to accommodate these different levels of classification. To support the interconnection of different security domains, a CDS, installed and primarily operated by our partners in their facilities, is required between these different security environments to protect Classified Military Information (CMI) in the SECRET//REL domain, protect advanced U.S. technology and allow information from the lower domains (national or unclassified domains) to be transferred up to the SECRET//REL domain and from higher domain (SECRET//REL) to lower domains (national or unclassified). The MDA is investigating FMS CDSs for foreign partners to purchase solely via the FMS process. The successful FMS CDS will be available to U.S. partner nations world-wide, starting with the GCC region. A family of FMS CDSs may be required to support different missions. 3.0 DEFINITIONS 3.1 CDS--CNSSI-4009, "National Information Assurance Glossary", April 2010. Defines a Cross Domain Solution (CDS) as a form of controlled interface (CI) that provides the ability to manually and/or automatically access and/or transfer information between different security domains; CDS typically runs on a trusted operating system. 3.2 FMS CDS-A CDS that is specifically developed for foreign military partners to protect U.S. classified military systems and data and sold via FMS process. A FMS CDS by definition shall be built and deployed in accordance with National Security Agency best practices, Committee on National Security Systems Instruction (CNSSI No. 1253) and the associated Cross Domain Solutions Overlay, and DoDI 8510.01 Risk Management Framework. 4.0 FMS CDS CAPABILITIES AND REQUIREMENTS Respondents must incorporate the following capability requirements into their responses. These requirements are provided to Respondents to assist with the process of developing an RFI response. 4.1 Operational requirements. The FMS CDS will 4.1.1 Reside in partner nation's facilities or platforms and will be operated and maintained by partner nation 4.1.2 Be overseen by U.S. personnel in accordance with identified U.S. and partner configuration roles i.e., U.S. will validate configuration management of deployed FMS CDS solutions 4.1.3 Operate in high risk environment e.g., operators/participants from third state nations may be present 4.1.4 When the solution includes U.S. communication security (COMSEC) and associated controlled cryptographic item (CCI) ensure compliance with DoDI 8523.01, Communications Security (COMSEC) April 22, 2008 4.2 Technical requirements. The FMS CDS 4.2.1 Shall protect advanced technologies in U.S. sensor and weapon systems such that technologies are not exposed 4.2.2 Shall protect secure U.S. networks that connect with partner nation's networks 4.2.3 Shall protect U.S. Classified Military Information (CMI), e.g., protect U.S. SECRET//REL data, such as information contained in Link-16 BMD messages to include, but not limited to, launch point, impact point and space track 4.2.4 Shall use National Security Agency (NSA)-approved encryption technology and processes. 4.2.5 Shall protect data at the confidentiality level moderate, integrity level moderate, and availability level moderate within an information system 4.2.6 Shall have sufficient filtering to prevent spillage of U.S. CMI to other domains (e.g., networks). Data to be filtered includes, but is not limited to, geographic, source, message type, message content, threat classification/identity, and exercise 4.2.7 Be designed to be tamper resistant e.g., high probability of detecting and preventing tampering 4.2.8 Shall minimize throughput latency 4.2.9 Shall maintain domain separation, e.g., "catcher/pitcher" one-way transfer approach applied to each domain 4.2.10 Shall be designed for military use and ITAR-compliant (Ref: Category ITAR 13.B4) 4.2.11 Shall minimize footprint, since the FMS CDS may be deployed on aircraft, ship, and other mobile/transportable environments 4.2.12 Shall not be based on currently fielded U.S. CDSs identified on the UCDSMO UCL list (CAT1) 4.2.13 Shall meet RMF requirements for protection of U.S. SECRET//REL data 4.2.14 Shall not use removable media, e.g., back-ups, logs and audits shall be sent to different network device 5.0 DOCUMENTS Responses must conform to the following documents: 5.1 U.S. Department of Defense Instruction (DoDI) 8500.01 Cybersecurity, dated March 14, 2014 5.2 U.S. Department of Defense Instruction (DoDI) 8510.01, "Risk Management Framework (RMF) for DoD Information Technology (IT)", dated March 12, 2014 5.3 Chairman Joint Chiefs of Staff Instruction (CJCSI) 6510.06C, "Communications Security Releases to Foreign Nations", November 8, 2013 5.4 NIST SP 800-53 Rev 4, "Security and Privacy Controls for Federal Information Systems and Organizations," dated April 30, 2013 5.5 Committee on National Security Systems Instruction (CNSSI) No. 1253, "Security Categorization and Control Selection for National Security Systems," dated March 27, 2014 5.6 Releasable Transfer Cross Domain Solution (CDS) Security Controls Guide V1.0, June 2014, Unified Cross Domain Services Management Office (UCDSMO) 5.7 CNSSI 1253, Appendix F, Attachment 3, "Cross Domain Solution Overlay", dated September 27, 2013 5.8 CNSSI 1253, Appendix F Attachment 5, "Classified Information Overlay". May 9, 2014 5.9 United States Munitions List (USML) ITAR Part 121, Category XIII (b) (4) Defense Security Cooperation Agency, "Security Assistance Management Manual", August 9, 2015 5.10 USCENTCOM, "Cybersecurity Handbook for Partner Nations", Version 1.0, 2 September 2015 and associated Foreign Partner Controls 5.11 DoDI 8523.01, Communications Security (COMSEC), dated April 22, 2008 6.0 RESPONSES 6.1 Instructions for Submissions: Respondents to this RFI are invited to prepare and submit, no later than February 16, 2016, the following: 6.1.1 Executive Summary (not to exceed 5 pages or slides) that includes 6.1.1.1 Descriptive Data: 6.1.1.1.1 Company Name 6.1.1.1.2 Point of Contact 6.1.1.1.3 Address 6.1.1.1.4 Telephone and Fax Numbers 6.1.1.1.5 Email Address 6.1.1.1.6 DUNS (Data Universal Number System) Number 6.1.1.1.7 CAGE Code and/or Tax ID Number 6.1.1.1.8 Business Size Standard and applicable NAICS (North American Industry Classification System) codes 6.1.1.2 Identify the Government Furnished Technical Information that is required in order to accomplish the execution of the FMS CDS response and ROM costs identified in this RFI. List and describe this data (does not count toward page limit for Executive Summary) 6.1.2 White Paper: (not to exceed 30 pages) the white paper on FMS CDS will provide specific responses to all requirements in section 4 6.1.3 The Respondents shall provide ROM costs and milestones for development of the proposed FMS CDS 6.1.4 Responses to this RFI should be submitted via e-mail to
[email protected] with the subject line notated as follows: BMEWS CDS RFI 6.1.5 The Missile Defense Agency will host a BMEWS Industry Day on January 14, 2016 at 9 am CST at the Missile Defense Agency Von Braun III Auditorium, Huntsville, Alabama location which will include a presentation/discussion at the classified (SECRET) level. 6.1.5.1 Reservations for the Industry Day are required to attend and VARs must be submitted NLT 5 business days prior to the Industry Day (there will be no exceptions to this requirement). E-mails for the reservation will be accepted at
[email protected]. Please title your e-mail request "BMEWS Industry Day" and include the following information: 6.1.5.1.1 Company Name 6.1.5.1.2 Point of Contact 6.1.5.1.3 Full names of all attendees 6.1.5.1.4 Address 6.1.5.1.5 Telephone and Fax Numbers 6.1.5.1.6 Email Address 6.1.5.1.7 DUNS (Data Universal Number System) Number 6.1.5.1.8 CAGE Code and/or Tax ID Number 6.1.5.2 Attendance at the Industry Day is not a requirement to submit a response to this RFI. 7.0 REQUESTED INFORMATION 7.1 This announcement is published for informational purposes only. It does not constitute a solicitation or request for proposal and shall not be construed as a commitment by the Government. Any response will be treated as information only and shall not be used as a proposal. Replies will be separated from, and have no bearing on, evaluation of proposals submitted in response to any future formal Request for Proposal. Responses in any form are not offers and the Government is under no obligation to award a contract as a result of this announcement. The Government does not intend to pay for the information solicited and will not reimburse any costs associated with responding to this RFI. 7.2 Proprietary information is neither sought nor desired by the Government. If such information is submitted, it must clearly be marked "proprietary" on every sheet containing such information, and the proprietary information must be segregated to the maximum extent practicable from other portions of the response (e.g., use an attachment or exhibit). Respondents are responsible for adequately marking proprietary information contained in their response. The Government intends to use third party, non-Government (.i.e. contractor) support personnel as subject matter experts in the review of responses received, including the review of any marked or unmarked proprietary information provided. Appropriate non-disclosure agreements will be executed between the third party, non-Government support personnel and the Government. A submission of a response to this RFI constitutes the Respondent's acknowledgement and agreement that the information provided in the response, including any marked or unmarked proprietary or source selection information, may be disclosed to these third party, non-Government support personnel. Eligibility in participating in a future acquisition does not depend upon a response to this notice. 8.0 QUESTIONS All unclassified questions related to this RFI should be provided via email to
[email protected]. Contracting Office Address: Missile Defense Agency, MDA-DACB Building 5224 Martin Rd, Redstone Arsenal, AL, 35898, UNITED STATES Point of Contact: Shirlee Madeloff, Procuring Contracting Officer, C2BMC Contracts