================================================================

================================================================

The Defense Advanced Research Projects Agency (DARPA) often selects its research efforts through the Broad Agency Announcement (BAA) process. The BAA will be posted directly to FedBizOpps.gov, the single government point-of-entry (GPE) for Federal government procurement opportunities over $25,000. The following information is for those wishing to respond to the Broad Agency Announcement.

ORGANICALLY ASSURED AND SURVIVABLE INFORMATION SYSTEMS (OASIS) DEMONSTRATION AND VALIDATION (DEM/VAL) PROGRAM, SOL BAA 02-16, DUE: 03/28/03; POC: DR. JAYNARAYAN H. LALA, PROGRAM MANAGER, DARPA/ITO; FAX: (703) 522-7161

The Defense Advanced Research Projects Agency (DARPA) has been sponsoring research in the assurance and survivability of information systems for the past few years under the Information Survivability and the Information Assurance and Survivability suite of programs. Many of the research projects have resulted in revolutionary technologies for making DoD’s mission-critical systems and networks highly survivable in the face of large-scale cyber attacks. DARPA is initiating a new two-phase systems program that will integrate and focus these technologies in an exemplar mission-critical system, culminating in a survivable prototype system.

The goals of the OASIS Dem/Val program are to develop survivable system architectures and corresponding assurance arguments. The program is specifically concerned with architectures designed to survive cyber attacks. These include attacks mounted through networks above the physical layer; attacks that attempt to inject malicious software into computers, either when they are being developed or when they are executing; and attempts to exploit accidental software flaws maliciously. This solicitation does not consider physical attacks on the infrastructure, including attempts to destroy computer or communication facilities with kinetic or electromagnetic energy, or the jamming of wireless links. Such attacks are treated in other programs, and effective protective techniques to counter these threats continue to evolve.

This two-phase, two-year systems program will demonstrate a survivable prototype of the Joint Battlespace Infosphere (JBI). A successful demonstration in an operational environment will pave the way for the DoD to infuse cyber survivability throughout its mission-critical systems and networks. It will also accelerate the transition of DARPA-developed cyber defense technologies to the DoD by reducing the risk of employing cutting-edge technologies in DoD’s newer systems and networks that are still on the drawing board.

In the past, survivability has often been an afterthought in the design of information systems. Primary emphasis has been on performance and functionality provided to the user. Non-functional properties such as security, reliability, etc. have been relegated to an appliqué on top of existing architectures, hardware, and software. This program seeks to demonstrate an organic approach to building-in non-functional properties, specifically, survivability in the face of cyber attacks, in mission-critical systems and networks.

Two awards are expected to be made for the system design phase and a down-selection is expected to be made for the system development and demonstration phase. Program duration is 24 months. Awards for the system design phase, 12 months duration, are expected to be up to $5M each and award for the system development phase, 12 months in duration, is expected to be up to $9M.

DARPA information technology programs that are deemed directly relevant to the OASIS Dem/Val program are OASIS and Fault Tolerant Networks (FTN). However, it is the responsibility of the proposer to assess the applicability of other DARPA Information Assurance and Survivability programs as well as other government and commercially developed technologies.

The OASIS Program seeks to provide defense capabilities against sophisticated adversaries to allow sustained operation of mission critical functions in the face of known and future cyber attacks against information systems. The technology development goals are to conceive, design, develop, implement, demonstrate and validate architectures, tools and techniques that would allow fielding of organically survivable systems. The technology products include architectures for building intrusion-tolerant systems from potentially vulnerable components; real-time execution monitors to detect malicious mobile code and prevent damage by and propagation of malicious code; error detection techniques and tolerance triggers; error compensation, error recovery, and error response technologies; and assessment and validation methodologies to evaluate intrusion tolerance mechanisms.

The FTN Program seeks to ensure the continued availability and graceful degradation of the network infrastructure under partially successful attacks, maximizing the residual capacity available to legitimate users. Technologies are being developed to: (a) ensure the fault-tolerance and secure survivability of critical network services; (b) thwart denial-of-service attacks by constraining an attacker's resource consumption; and (c) trace and contain attacks as close to the source as possible.

The principal objectives of this program are to develop an exemplar of a selected Joint Battlespace Infosphere (JBI), from applications down to communications infrastructure, that can operate through a wide class of known and future cyber attacks and to develop system architectures that gracefully degrade system functionality in the face of attacks. The subject system and network will reconfigure dynamically to optimize performance, functionality and survivability as threat conditions warrant.

The cyber-survivability technologies necessary to achieve the OASIS Dem/Val objectives, as previously stated, are being developed under OASIS and FTN programs. Previous DARPA programs in Information Survivability and Information Assurance & Survivability have also produced relevant technologies. The purpose of the OASIS Dem/Val program is to leverage these investments, in combination with commercially available first-generation and second-generation security technologies, to create a pathfinder for the DoD. This program will be one of the major DARPA efforts aimed at accelerating the transition of DARPA-developed cyber defense technologies to DoD operational systems.

The OASIS Dem/Val program will be conducted over approximately 24 months and is divided into two phases. While this solicitation covers both phases, contract award will be made based on the merits of the proposals for Phase 1. Phase 2 will be negotiated with the selected performer after a planned down-select that will be made at the end of Phase 1. Recently, DARPA sponsored a study that produced "Considerations in Developing Survivable Architectures for GIG Systems." This study is intended to be a point of departure for this solicitation. Phase 1 is a 12 month effort and will develop a design and a development plan for the target JBI. A Preliminary Design Review will be conducted late in the 2^nd quarter of FY03 and a Critical Design Review will be conducted late in the 4^th quarter of FY03. Phase 2 is a 12-month development and test effort. The Phase 2 selection will be based on a competitive evaluation of the design and development plans created in Phase 1. Each design will undergo independent assessment to validate performance predictions and assurance arguments. DARPA reserves the right to select none of the performers at the down-select point.

Preliminary Strawman Architecture Study: A short study was conducted internal to DARPA. Overall goal of the study was to articulate cyber-survivability concepts and principles, discuss current technologies and their vulnerabilities, and show the applicability of DARPA-developed technologies to construct survivable systems and networks. A DoD mission-critical system, Global Command & Control System – Maritime (GCCS-M), was used as a representative operational command and control system. The study also put forward a framework for developing assurance arguments. This study should be considered a point of

departure for the Phase 1 System Design. Distribution of this report is limited to government agencies and their contractors and organizations that qualify for DARPA’s Potential Contractor Program (PCP). Requests for this report should be referred to Dr. Jaynaravan H. Lala (jlala@darpa.mil) at DARPA/ITO.

Phase 1, System Design: DARPA expects to make two awards for this phase. This phase is expected to last about 12 months and provide a funding level of up to $5 million for each award.

Expected Phase 1 products/outputs include an approach to cyber-survivability, threats/attacks/vulnerabilities considered, a strawman survivable architecture for the JBI exemplar system and network, a set of assurance arguments to validate system/network survivability approach, residual vulnerabilities, trade-offs considered in arriving at system and network, architectures, and performance overheads at various survivability operating points (a depiction of the performance, functionality and survivability cone). Other products expected from this phase include a detailed Phase 2 development, implementation, and demonstration plan (including cost and schedule); identification of programmatic risks and an accompanying risk mitigation plan; identification of technology gaps to achieve program objectives and an accompanying risk-reduction plan; and a preliminary assessment and validation plan. The plan should clearly show how the quantitative program goals are going to be achieved.

Phase 2, Development and Demonstration: The Phase 2 development and demonstration effort will be approximately 12 months long and include a funding level of up to $9 million. The performer will be expected to deliver a final Survivable JBI prototype and to demonstrate functional, performance, and cyber-survivability properties of the prototype in the face of a determined Red Team cyber attack. This demonstration will show the impact of cyber survivability features on system and network nominal operations, performance under attack, the capability to operate through attacks, the ability to tolerate malicious mobile code and denial-of-service attacks, and application integrity under attack. Also various operating points (performance, functionality and survivability) will be exercised via dynamic reconfigurations, and the system and networks will demonstrate graceful degradation under attack. Additionally, DARPA, at its discretion, may carry out an independent assessment and validation of the prototype.

Exemplar Mission-Critical System: The target exemplar military information system of the future is Joint Battlespace Infosphere. Operationally, JBI is a combat information management system. Technically, it is a platform of processes, protocols and common core functions. JBI promotes information interoperability between many individual information systems and acts as an intermediary between these systems. A JBI is a publish/subscribe process involving a set of clients interconnected via a network to a set of core services. The United States Air Force Scientific Advisory Board Report on Building the Joint Battlespace Infosphere (SAB-TR-99-02) of December 17, 1999 may be accessed at http://www.sab.hq.af.mil/archives/reports/index.htm. A password protected information site containing component and client descriptions and high level architectures will be available with the same restrictions as the Preliminary Strawman Architecture Study described earlier, and requests for the URL should be made in the same manner.

The instantiation of a JBI in this program will be the core services and the functional components needed to execute a mission-critical scenario. The scenario starts with an objective that requires an air strike on an enemy target. The near-real time activities include planning an air combat mission based on a set of specified parameters and creating an air tasking order (ATO). The ATO is sent to the squadron for assignment to a ready element. The mission is then executed. At some time between launch but before the objective strike the weather parameters, in this case the winds at the target area, change to such a degree that the predicted collateral damage is unacceptable and a mission modification is necessary. In real-time the ATO is modified and transmitted to the executing element. Throughout the scenario coordination between the mobility command and the combat command is achieved within the JBI. Components and clients included in this instantiation of the JBI are those inside the red line in the figure below.

During this scenario a Red Team conducts a prolonged, determined cyber attack that, if successful, will deny, disrupt, degrade or otherwise harm mission critical functionality of the JBI to the operators. The Dem/Val program will demonstrate the following survivability goals for the exemplar JBI:

1. Provide 100% of JBI critical functionality when under a determined red team attack.
2. Detect 95% of large-scale attacks within 10 minutes of attack initiation and 99% of

attacks within 4 hours with less than 1% false alarm rate.

3. Display meaningful attack state alarms.
4. Prevent 95% of attacks from achieving attacker objectives for 12 hours.
5. Reduce low-level alerts by a factor of 1000.
6. Show survivability versus cost/performance trade-offs.

Unique ideas in regards to intellectual property are solicited; however a minimum of Government-purpose rights will be required to facilitate the ultimate goal of integrating the technologies developed into a JBI.

Proposed research should investigate innovative approaches and techniques that lead to or enable revolutionary advances in the state-of-the-art. However, proposals should be for research that substantially contributes towards the goals stated. Research should result in prototype hardware and/or software demonstrating integrated concepts and approaches. Specifically excluded is research that primarily results in evolutionary improvement to the existing state of practice or focuses on a specific system or solution. Integrated solution sets embodying significant technological advances are expected . Proposals may involve other research groups or industrial cooperation and cost sharing. This BAA shall remain open and proposals received up to one year following this BAA’s release.

The Defense Advanced Research Projects Agency/Information Technology Office (DARPA/ITO) requires completion of a Broad Agency Announcement (BAA) Cover Sheet Submission for each Proposal, by accessing the URL below:

After finalizing the BAA Cover Sheet Submission, the proposer must submit the BAA Confirmation Sheet that will automatically appear on the web page. Each proposer is responsible for printing the BAA Confirmation Sheet and submitting it attached to the "original" and each designated number of copies. The Confirmation Sheet should be the first page of your Proposal. Failure to comply with these submission procedures may result in the submission not being evaluated.

An original and 4 copies of the full proposal, and 2 electronic copies (i.e., 2 separate disks) of the full proposal (in Microsoft Word ’97 for IBM-compatible, PDF, Postscript, or ASCII format on one 3.5-inch floppy disk or one 100 MB Iomega Zip disk). Each disk must be clearly labeled with BAA 02-16, proposer organization, proposal title (short title recommended) and Copy ___ of 2. The full proposal (original and designated number of hard and electronic copies) must be submitted in time to reach DARPA by 4:00 PM (ET) Friday, May 24, 2002, in order to be considered during the initial evaluation phase. However, BAA 02-16, ORGANICALLY ASSURED AND SURVIVABLE INFORMATION SYSTEMS (OASIS) DEMONSTRATION AND VALIDATION (DEM/VAL) PROGRAM will remain open until 4:00 PM (ET) Friday, March 28, 2003. Thus, proposals may be submitted at any time from issuance of this BAA through Friday, March 28, 2003. While the proposals submitted after Friday, May 24, 2002, deadline will be evaluated by the Government, proposers should keep in mind that the likelihood of funding such proposals is less than for those proposals submitted in connection with the initial evaluation and award schedule. DARPA will acknowledge receipt of submissions and assign control numbers that should be used in all further correspondence regarding proposals.

Restrictive notices notwithstanding: Proposals may be handled, for administrative purposes only, by a support contractor. This support contractor is prohibited from competition in DARPA technical research and is bound by appropriate non-disclosure requirements.

For evaluation purposes, a proposal is the document described in PROPOSAL FORMAT Section I and Section II (see below). Other supporting or background materials submitted with the proposal will be considered for the reviewer's convenience only and not considered as part of the proposal.

Evaluation of proposals will be accomplished in a two-step process as follows. The first step will be a scientific review of each proposal. The second step will be an oral review. The first step criteria, listed in descending order of relative importance, are as follows:

1. Overall Systems Engineering Approach: The overall systems engineering methodology, from requirements definition to trade-off studies to integration and validation, must be clearly identifiable. Of specific concern is the offeror’s strategy for managing the risk inherent in integrating leading-edge, and potentially immature, technologies in creating a stable prototype.
2. Innovative Technical Solution to the Problem: Application of new technology or application of existing technology in a new way that is advantageous to the Program objectives. Identification of types of cyber survivability technologies offeror intends to use, and how the offeror intends to get developed and emerging technologies. The ability to meet the quantitative program goals defined earlier.
3. Offeror’s Capabilities and Related Experience: The qualifications, capabilities, and demonstrated achievements of the proposed principals and other key personnel for the primary and subcontractor organizations or consortia members must be clearly shown. Team experience with design and build of large-scale information systems and networks and thorough knowledge of and familiarity with emerging cyber survivability technologies are essential. Offeror’s understanding of the JBI operating environment is also important.
4. Potential Contribution and Relevance to the DARPA mission: The offeror must clearly address the trade-offs of performance, functionality and additional cost as a function of various levels of survivability.
5. Plans and Capability to Accomplish Technology Transition: Technology transition should be a major consideration in the design of experiments, particularly considering the potential for involving DoD transition organizations in the field assessment phase.
6. Cost Realism: The overall estimated cost to accomplish the effort should be clearly shown as well as the substantiation of the costs for the technical complexity described. Evaluation will consider the value to Government of the research and the extent to which the proposed management plan will effectively allocate resources to achieve the capabilities proposed.

In step two, the list of winners from the step one evaluation will be asked to make oral presentations. Offerors will be expected to answer a wide range of questions on their proposal, including technical, programmatic, and budgetary matters as well as experience in integrating state-of-the-art information system technologies in large-scale systems.

Evaluation criteria for down-selection to Phase 2 will be communicated to winners soon after the contract award.

Proposals may be reviewed by non-government personnel; however, contractors will not be used to conduct evaluations or analyses of any aspect of a proposal submitted under this BAA, unless one of the three conditions identified in FAR 37.203(d) applies.

The Government reserves the right to select for award all, some, or none of the proposals received. Proposals identified for funding may result in a contract, grant, cooperative agreement, or other transaction depending upon the nature of the work proposed, the required degree of interaction between parties, and other factors. If warranted, portions of resulting awards may be segregated into pre-priced options.

Proposals not meeting the format described in this pamphlet may not be reviewed. Proposals MUST NOT be submitted by fax or e-mail; any so sent will be disregarded. This notice, in conjunction with this pamphlet, BAA 02-16 Proposer Information Pamphlet (PIP) and all references, constitutes the total BAA. No additional information is available, nor will a formal Request for Proposal (RFP) or other solicitation regarding this announcement be issued. Requests for same will be disregarded. All responsible sources capable of satisfying the Government's needs may submit a proposal that shall be considered by DARPA. Historically Black Colleges and Universities (HBCUs) and Minority Institutions (MIs) are encouraged to submit proposals and join others in submitting proposals. However, no portion of this BAA will be set aside for HBCU and MI participation due to the impracticality of reserving discrete or severable areas of this research for exclusive competition among these entities.

NEW REQUIREMENTS/PROCEDURES: The Award Document for each proposal selected and funded will contain a mandatory requirement for submission of DARPA/ITO Quarterly Status Reports and an Annual Project Summary Report. These reports, described below, will be electronically submitted via the DARPA/ITO Technical – Financial Information Management System (T-FIMS), utilizing the government furnished Uniform Resource Locator (URL) on the World Wide Web (WWW).

1. Status Report:  Due at least three (3) times per year – Jan, Apr, & Oct

                a)  Project General Information

                b)  Technical Approach

                   -  Accomplishments

• Goals
• Significant changes / improvements

                c)  Deliverables

                d)  Transition Plan

e) Publications

f) Meetings and Presentations

g) Project Plans

h) Near term Objectives

  2)  Financial Report

        3)  Project Status / Schedule

1. Project Summary (PSum): Due once each fiscal year in July

        1)  All Sections of the Status Report

        2)  QUAD Chart

                a)  Visual Graphic

                b)  Impact

                c)  New Technical Ideas

1. Schedule

Proposals shall include the following sections, each starting on a new page (where a "page" is 8-1/2 by 11 inches with type not smaller than 12 point) and with text on one side only. The submission of other supporting materials along with the proposal is strongly discouraged. Sections I and II of the proposal shall not exceed 40 pages. Maximum page lengths for each section are shown in braces {} below.

{1} Cover Page including: (1) BAA number; (2) Technical topic area; (3) Proposal title; (4) Technical point of contact including: name, telephone number, electronic mail address, fax (if available) and mailing address; (5) Administrative point of contact including: name, telephone number, electronic mail address, fax (if available) and mailing address; (6) Summary of the costs of the proposed research, including total base cost, estimates of base cost in each year of

the effort, estimates of itemized options in each year of the effort, and cost sharing if relevant; and (7) Contractor's type of business, selected from among the following categories: "WOMEN-OWNED LARGE BUSINESS," "OTHER LARGE BUSINESS," "SMALL DISADVANTAGED BUSINESS [Identify ethnic group from among the following: Asian-Indian American, Asian-Pacific American, Black American, Hispanic American, Native American, or Other]," "WOMEN-OWNED SMALL BUSINESS," "OTHER SMALL BUSINESS," "HBCU," "MI," "OTHER EDUCATIONAL," "OTHER NONPROFIT", or "FOREIGN CONCERN/ENTITY."

This section provides the detailed discussion of the proposed work necessary to enable an in-depth review of the specific technical and managerial issues. Specific attention must be given to addressing both risk and payoff of the proposed work that make it desirable to DARPA.

1. {1} Innovative claims for the proposed research. This page is the centerpiece of the proposal and should succinctly describe the unique proposed contribution.

9. Cost of the proposed effort for each contract year.

1. Problem Description. Provide concise description of problem area addressed by this research project.
2. Research Goals. Identify specific research goals of this project. Identify and quantify expected performance improvements from this research. Identify new capabilities enabled by this research. Identify and discuss salient features and capabilities of developmental hardware and software prototypes.
3. Expected Impact. Describe expected impact of the research project, if successful, to problem area.

1. {17}Detailed Description of Technical Approach. Provide detailed description of technical approach that will be used in this project to achieve research goals. Specifically identify and discuss innovative aspects of the technical approach.
2. {3}Comparison with Current Technology. Describe state-of-the-art approaches and the limitations within the context of the problem area addressed by this research.

1. {1}Schedule Graphic. Provide a graphic representation of project schedule including detail down to the individual effort level. This should include but not be limited to, a multi-phase development plan which demonstrates a clear understanding of the proposed research; and a plan for periodic and increasingly robust experiments over the project life that will show applicability to the overall program concept. Show all project milestones. Use absolute designations for all dates.
2. {3}Detailed Individual Effort Descriptions. Provide detailed task descriptions for each individual effort in schedule graphic.

12. {5} Cost by task, with breakdown into accounting categories and equipment for the entire

contract and for each contract year. Where the effort consists of multiple portions that

could reasonably be partitioned for purposes of funding, these should be identified as

contract options with separate cost estimates for each. Details of any cost sharing should

also be included.

Government Furnished Property (GFP) MUST attach to the submitted proposals the

following information:

1. A letter on Corporate letterhead signed by a senior corporate official and addressed to Dr. Jaynarayan H. Lala, DARPA/ITO, stating that you either can not or will not provide the information technology (IT) resources necessary to conduct the said research.
2. An explanation of the method of competitive acquisition or a sole source justification, as appropriate, for each IT resource item.
3. If the resource is leased, a lease purchase analysis clearly showing the reason for the lease decision.
4. The cost for each IT resource item.

Awards made under this BAA may be subject to the provisions of the Federal Acquisition Regulation (FAR) Subpart 9.5, Organizational Conflict of Interest. All affirmations must state which office(s) the offeror supports, and identify the prime contract number. Affirmations should be furnished at the time of proposal submission. All facts relevant to the existence or potential existence of organizational conflicts of interest, as that term is defined in FAR 9.501, must be disclosed in Section II, I. of the proposal, organized by task and year. This disclosure shall include a description of the action the Contractor has taken, or proposes to take, to avoid, neutralize, or mitigate such conflict.

A bibliography of relevant technical papers and research notes (published and unpublished) that document the technical ideas, upon which the proposal is based, may be included in the proposal submission. Provide one set for the original full proposal and one set for each of the 4 full proposal hard copies. Please note: The materials described in this section, and submitted with the proposal will be considered for the reviewer’s convenience only and not considered as part of the proposal for evaluation purposes.

Fax: 703-522-7161 Addressed to: DARPA/ITO, BAA 02-16

Electronic Mail: baa02-16@darpa.mil

Electronic File Retrieval: http://www.darpa.mil/ito/Solicitations.html