0224-01-BAE DIGAR Support-SOW Rev1-Final Redactions.pdf

3.1.8 The Contractor shall modify proprietary software required to successfully integrate the DIGAR system with and associated platforms.

3.2 The Contractor shall coordinate with the technical point of contact (TPOC) identified below to complete this work.

4.0 DATA DELIVERABLES

4.1 The Contractor shall provide data

4.2 The Contractor shall provide data

5.0 SECURITY

5.1 The Contractor shall possess and maintain a SECRET facility clearance as verified within the National Industrial Security System.

5.2 Controlled Unclassified Information (CUI), to include For Official Use Only (FOUO) and Personally Identifiable Information (PII), generated and/or provided under this contract shall be safeguarded and marked as specified in DoDI 5200.48 and 5400.7-R Chapters 3 and 4.

5.3 The Contractor shall be responsible for safeguarding all Government information or property provided for Contractor use. At the end of each work period, government information, facilities, equipment and materials shall be secured as specified by the 32 CFR Part 117 and the NSWCDD Command Security Manual. Secret storage is required at the Contractor’s facility to meet requirements of receiving and generating classified material in accordance with this contract.

5.4 Contractor personnel shall follow OPSEC concepts and principles in the conduct of this requirement to protect critical information, personnel, facilities, equipment, and operations from compromise. All Contractors (including SubContractors) shall supplement their current security practices by requiring any personnel involved in executing this contract to complete Government-sponsored and administered Operations Security (OPSEC) training. In addition, all Contractors shall be aware of the Critical Information and Indicators List (CIIL) for the organization they are supporting as well as the OPSEC manual for NSWCDD. These OPSEC requirements will be in effect throughout the life of the procurement from award through the conclusion of services at the end of the period of performance (PoP) or other procurement termination. The Contractor must immediately notify the Government upon the discovery of any nonconformance with the OPSEC manual.

5.5 No safeguarding of classified material is authorized at the Contractor facility. Safeguarding will only be required at the actual performance site listed in Block 8 on the DD254. Actual performance site’s security regulations and guidelines will apply.

5.6 Electronic Spillages (ES) are unacceptable and pose a risk to national security. An electronic spillage is defined as classified data placed on an information system (IS), media or hardcopy document possessing insufficient security controls to protect the data at the required classification level, thus posing a risk to national security (e.g., sensitive compartmented information (SCI) onto collateral, Secret onto Unclassified, etc. The Contractor's performance as it relates to ES will be evaluated by the Government. ES reflects on the overall security posture of NSWCDD and a lack of attention to detail with regard to the handling of classified information of IS security discipline and will be reflected in the Contractor's performance rating. If a Contractor is determined to be responsible for an ES, all direct and indirect costs incurred by the Government for ES remediation could be charged to the Contractor.

5.6.1 NSWCDD Security will be responsible for the corrective action plan in accordance with the security guidance reflected on the DoD Contract Security Classification Specification DD254.

NSWCDD Security will identify the Contractor facility and contract number associated with all electronic spillages that involve the Contractor. NSWCDD Security will notify the Contracts Division with the Contractor facility name and contract number, incident specifics and associated costs for cleanup. The Contracting Officer will be responsible to work with the Contractor Facility to capture the costs incurred during the spillage clean up. The Contractor is also responsible for taking Information Security Awareness training annually, via their Facility Security Officer (FSO), as part of the mandatory training requirements. If a spillage occurs, additional training will be required to prevent recurrence.

5.7 Non-government and/or personally owned portable electronic devices (PEDs) are prohibited in all NSWCDD buildings with the exception of personally owned cell phones, which are authorized for use in General Office Spaces (GOS). All personnel need to be aware of the PED policy what is permitted in a building by asking authorized personnel or reviewing the entrance area signs and instructions. The Contractor/personnel visiting shall ensure the onsite personnel remain compliant with this PED policy. NSWCDD instruction defines PEDs as the following: any electronic device designed to be easily transported, with the capability to store, record, receive or transmit text, images, video, or audio data in any format via any transmission medium. PED’s include, but are not limited to, pagers, laptops, radios, compact discs and cassette players/recorders. In addition, this includes removable storage media such as flash memory, memory sticks, multimedia cards and secure digital cards, micro-drive modules, ZIP drives, ZIP disks, CD-RWs, DVD-RWs, MP3 players, iPADs, digital picture frames, electronic book readers, kindle, nook, cameras, external hard dish drives, and floppy diskettes.

5.7.1 Personal Wearable Fitness Devices (PWFDs) marketed primarily as fitness or sleep devices are allowed in all Navy spaces, if they are compliant with NAVADMIN 216/15, where collateral non- Sensitive Compartmented Information (SCI), classified information is processed, stored, or discussed up to and including Secret. The User must ensure the PWFD is compliant with all requirements in NAVADMIN 216/15, Cyber Hygiene Authorization to use Personal Wearable Fitness Devices (e.g., FitBit, Jawbone UP, etc.) in Navy Spaces, dated 14 September 2015 and register PWFD in the NSWCDD Fitness Device Tracker.

5.7.2 Personnel requiring the use of Medical Portable Electronic Devices (MPEDs) must submit Form NSWCDD 5239/4 for SCIF authorization to the Special Security Officer (SSO). For Special Access Program Facility (SAPF) authorizations, follow the guidance provided by the Government Special Access Program Security Officer (GSSO). Authorizations for use in SAPFs that are co-utilized within NSWCDD SCIFs require coordination between both the GSSO and SSO. For authorizations to use MPED in Collateral Classified spaces, submit form to the Special Programs Branch, Code 1053.

5.7.3 PED’s belonging to an external organization shall not be connected to NSWCDD networks or infrastructure without prior approval from the NSWCDD Information Assurance and Compliance Branch. This approval will be granted using the TARIS form and action tracker process. Personally