0701-03_PPM_BIDDING 027-24_DD254 CUI.pdf

Please wait...

If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.

You can upgrade to the latest version of Adobe Reader for Windows®, Mac, or Linux® by visiting http://www.adobe.com/go/reader_download.

For more assistance with Adobe Reader visit http://www.adobe.com/go/acrreader.

Windows is either a registered trademark or a trademark of Microsoft Corporation in the United States and/or other countries. Mac is a trademark of Apple Inc., registered in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

UNCLASSIFIED

BIDDING 027-24

CONTINUATION – DD FORM 254 BLOCK 13

BLOCK 13 CONTINUATION STATEMENTS:

1. CLASSIFIED OR UNCLASSIFIED TECHNICAL PAPERS TO BE PRESENTED AT A

CLASSIFIED SYMPOSIUM MUST BE APPROVED BY THE NSWCDD CONTRACTING

OFFICER'S REPRESENTATIVE PRIOR TO THE PRESENTATION.

2. SECURITY CLASSIFICATION GUIDES (SCG’s) AND UNCLASSIFIED LIMITED DOCUMENTS

(E.G., C U I , DISTRIBUTION STATEMENT CONTROLLED) ARE NOT AUTHORIZED

FOR PUBLIC RELEASE; THEREFORE, THEY CANNOT BE POSTED ON A PUBLICLY

ACCESSIBLE WEB SERVER OR TRANSMITTED OVER THE INTERNET UNLESS

APPROPRIATELY ENCRYPTED. REQUEST FOR PUBLIC RELEASE CANNOT BE

TRANSMITTED VIA THE INTERNET UNTIL THE CONTRACTOR RECEIVES FINAL

APPROVAL FROM THE COR.

3. ALL CONTRACTOR REQUESTS FOR SHARING OF CLASSIFIED AND OTHER

SENSITIVE INFORMATION BETWEEN PRIME CONTRACTS MUST BE FORWARDED IN

WRITING TO THE NSWCDD SECURITY OFFICE POC IDENTIFIED IN BLOCK 17 OF THIS

FORM FOR APPROVAL. SUBCONTRACTORS MUST SUBMIT REQUESTS FOR PUBLIC

RELEASE THROUGH THE PRIME CONTRACTOR. THE PRIME CONTRACTOR IS

REPSONSIBLE FOR SUBMITTING THE SUBCONTRACTOR’S REQUEST FOR PUBLIC

RELEASE TO THE GCA PUBLIC RELEASE AUTHORITY IDENTIFIED IN BLOCK 12.

4. PERSONNEL DESIGNATED AS DERIVATIVE CLASSIFIERS SHALL RECEIVE DERIVATIVE

CLASSIFICATION TRAINING PRIOR TO ACCESS FROM THE CONTRACTOR'S FACILITY

SECURITY OFFICER (FSO). THE FSO SHALL ENSURE PERSONNEL RECEIVE INITIAL AND

ANNUAL REFRESHER TRAINING DURING THE LIFE OF THIS CONTRACT. EVIDENCE OF

COMPLETION, TRAINING CERTIFICATES OR EQUIVALENT, SHALL BE PROVIDED TO THE

INFORMATION SYSTEMS SECURITY MANAGER (ISSM) NO LATER THAN THE INDIVIDUAL'S

DUE DATE.

5. ALL CLASSIFIED DOCUMENTS MUST BE DESTROYED USING A NATIONAL SECURITY

AGENCY (NSA) APPROVED HIGH SECURITY CROSSCUT SHREDDER LISTED ON THE

NSA/CSS EVALUATED PRODUCTS LIST(EPL) FOR HIGH SECURITY CROSSCUT PAPER

SHREDDERS, OR OTHER APPROVED METHOD FOR DESTROYING CLASSIFIED

INFORMATION.

6. COPIES OF PRELIMINARY INQUIRY OR INVESTIGATIVE REPORTS OF SECURITY INCIDENTS

INVOLING CLASSIFIED INFORMATION SHALL BE SCANNED AND FORWARDED TO THE

CERTIFYING OFFICIAL IN ITEM 17 OF THIS DD 254 FOR CLASSIFICATION REVIEW.

7. ALL SECURITY RELATED ISSUES, INCIDENTS, OR REQUESTS PERTAINING TO THIS

CONTRACT SHALL BE PRESENTED IN WRITING BY THE CONTRACTOR'S FACILITY

SECURITY OFFICER (FSO) TO THE INDIVIDUAL IDENTIFIED IN BLOCK 16(A) OF THIS

DD254. THE CONTRACTOR SHALL ABIDE BY OTHER REPORTING REQUIREMENTS

OUTLINED IN THE 32 CFR PART 117.

CONTINUATION – DD FORM 254 BLOCK 13

8. FORWARD A COPY OF SUBCONTRACTOR DD 254S ISSUED UNDER THIS CONTRACT TO

THE OFFICIALS SHOWN IN ITEM 16 AND 17 OF THIS DD254.

CONTINUATION – DD FORM 254 ITEM 13

DODI 5200.48

SEPT 2021

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

1. DEFINITION. CUI is defined as information that Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. CUI does not include classified information.

2. ORGANIZATIONAL INDEX GROUPINGS (OIG) and CUI CATEGORIES: CUI consists of OIGs and their categories with marking guidance. Categories have definitions and legal authorities to help determine if information meets the criteria to be marked as CUI. A complete list of OIGs and categories are located at the National Archives and Records Administration (NARA) website https://www.archives.gov/cui/registry/category-list.

3. GENERAL GUIDANCE: Security Classification Guides (SCG) and documents marked as Controlled Unclassified Information (CUI), legacy For Official Use Only (FOUO), or Distribution Statements B thru F are not authorized for public release and cannot be placed on a publicly accessible web site or web server.

a. All contractors supporting an NSWCDD contract will comply with the DoD phased CUI implementation as determined by DUSN (I&S). NSWCDD is currently in phase one of CUI implementation. Phase one consists of the following marking requirements:

▪ Mark emails containing CUI with CUI banner at the TOP and BOTTOM of the email

▪ Use Designation Indicator Block along with signature block or in place of signature block.

CUI contains Non-technical Information

▪ CUI attachments in emails must have _CUI at the end of the filename: Filename_CUI.

▪ All emails containing CUI must be digitally signed and encrypted.

▪ FOR OFFICIAL USE ONLY (FOUO) is no longer an authorized marking for new documents and materials in the DOD.

▪ During phase one, portion markings are not required.

Controlled by: Department of the Navy

Controlled by: NSWCDD, Code, Branch, Dept

CUI Category: OPSEC (example category)

Limited Dissemination Control: FEDCON

POC: Name & office phone of CONTRACTOR who authored

CUI contains Technical Information

Controlled by: Department of the Navy

Controlled by: NSWCDD, Code, Branch, Dept

CUI Category: CTI

Distribution Statement::D

POC: Name & office phone of CONTRACTOR who authored https://www.archives.gov/cui/registry/category-list

CONTINUATION – DD FORM 254 ITEM 13

b. Controlled Technical Information (CTI): Dissemination of CTI will be controlled with Distribution Statement (B-F) in the Distribution/Dissemination Control line with CTI as the CUI Category.

i. All controlled technical data provided to the contractor by the government will be protected from public disclosure in accordance with the markings contained therein.

ii. Follow guidance for marking CTI in accordance with DODI 5230.24, Distribution Statements for Technical Documents.

c. Marking guidance for deliverables shall be provided by the owning government office in the form of:

iii. Security Classification Guidance

iv. Properly marked source document in the form of a:

i. Memorandum,

ii. Plan,

iii. Message document (Any physical medium in or on which information is recorded or stored, to include written or printed matter, audiovisual materials, and electromagnetic storage material.)

iv. Letter, or

v. Publication.

4. TRANSMITTAL. All emails containing such information or attachments must be appropriately marked, and digitally signed and encrypted if being transmitted within Navy networks, or outside a Navy network to an approved contractor email address. All transmissions to personal email accounts (AOL, Yahoo, Hotmail, Comcast, etc.) are prohibited.

5. OFFSITE HANDLING. The contractor shall provide adequate physical protection to such information as to preclude access by any person or entity not authorized such access by the government.

6. DISCLOSURE POLICY: All other information relating to the items to be delivered or services to be performed under this contract may not be disclosed by any means without prior approval of the authorized representative of the contracting officer. Dissemination or public disclosure includes, but is not limited to, permitting access to such information by foreign nationals or by any other person or entity; publication of technical or scientific papers; advertising; or any other proposed public release. Due to the sensitivity of this program, no classified or CUI material received or generated under this contract will be transferred to any other contractor or agency without the approval of the Contracting Officer or Contracting Officer’s Representative (COR).

Additional guidance can be found at DODI 5200.48.

DEPARTMENT OF THE NAVY

NAVAL SURFACE WARFARE CENTER

DAHLGREN DIVISION

6149 WELSH ROAD SUITE 203

DAHLGREN VIRGINIA 22448-5117

IN REPLY REFER TO

Ser 105/401

NOV 2 7 2023

From: Commanding Officer, Naval Surface Warfare Center, Dahlgren Division

Subj: CRITICAL INFORMATION AND INDICATORS LIST

Ref: (a) DoDM 5205.02, DoD Operations Security (OPSEC) Program Manual of 3 November 2008

(b) SECNAVINST 3070.2A, May 2019

(c) OPNAVINST 3432.1 A of 4 August 2011

(d) NTTP 3-13.3M, Operations Security (OPSEC) of September 2017

(e) NAVSEAINST 3070.2 of December 2021

End: (1) (CUI) NSWCDD Critical Information and Indicators List (CIIL)

1. In order to maintain an effective Operations Security (OPSEC) Program per references (a) through (e), it is necessary to protect our Critical Information (Cl) from discovery and exploitation by our adversaries. The list below represents an overview of our CL

2. References (a) through (e) define Critical Information and Indicators List (CIIL) as essential facts, elements, or components of a research, development, acquisition, test and evaluation program that, if compromised, could:

a. Cause significant degradation in mission effectiveness;

b. Shorten the expected combat-effective life of the system;

c. Reduce technological advantage;

d. Significantly alter program direction; or

e. Enable an adversary to defeat, counter, copy, or reverse engineer the technology or capability.

3. All personnel assigned to Naval Surface Warfare Center, Dahlgren Division (NSWCDD) including the lower echelon command are required to become familiar with the enclosure (1); in addition, the OPSEC Cue Card should be posted in visible locations throughout work centers.

4. The following CIIL, derived from references (a) through (e) and augmented with NSWCDD-specific items, identifies critical and unclassified information requiring application of OPSEC Measures.

Subj: CRITICAL INFORMATION AND INDICATORS LIST

5. The point of contact for this matter is Ms. Cyndi Howard. Ms. Howard may be reached via phone at (540) 653-7614 or via email at cynthia.e.howard3.civ@us.navy.mil.

THILIP R. MLYNARSKI

mailto:cynthia.e.howard3.civ@us.navy.mil

CUI

NSWCDD CRITICAL INFORMATION AND INDICATORS LIST (CIIU

1. COMMAND/CORPORATE OPERATIONS/COMPTROLLER/CONTRACTS

a. Proprietary and business sensitive information;

b. Specific details about missions, threats, gaps, vulnerabilities, requirements, or urgent needs that NSWCDD supports or mitigates;

c. Information about capabilities, vulnerabilities, and limitations or information revealing a security weakness;

d. New, projected, or expanded secure communications capabilities;

e. Specific details about current or future exercises/operations;

f. Key personnel or very important person schedules and itinerary;

g. Information system and network capabilities and vulnerabilities;

h. Security measures and countermeasures taken to protect a system;

i. Association of abbreviations, acronyms, nicknames or code words with projects or locations designated as CUI;

j. Security operating procedures and emergency plans;

k. Physical security pitfalls related to physical security maintenance and improvement;

l. Deployment schedules, dates, and locations;

m. Contractual Documents, including Acquisition Strategy, Statement of Work, and Contract Data Requirement.

Controlled By: Department of the Navy Controlled By: NSWCDD, Code 1051 CUI Category: OPSEC Distribution Control: FEDCON POC: Cynthia Howard, (540) 653-7614

Enclosure (1)

NSWCDl) CI^ITICAL INFORMATION AND INDICATORS LIST (CIIU

STRATEGIC AND COMPUTING SYSTEMS DEPARTMENT

a. Re-entry systems trajectory details;

b. Re-entry systems material properties and fabrication methods;

c. Re-entry systems vulnerabilities, degradations, limitations, problems, or errors in the system that could be exploited;

d. TOMAHAWK capabilities, limitations, vulnerabilities, degradations, test results, errors, problems, actual performance, fleet exercise, tactical operations;

e. Submarine Launched Ballistic Missile/Submersible, Ship Guided Missile, Nuclear (SLBM/SSGN) vulnerabilities, degradations, limitations, problems or errors in the system that could be exploited;

f. SLBM/SSGN systems capabilities;

g. SLBM targeting capabilities;

h. Ship, submersible, ballistic, submarine guided nuclear ship schedules, deployment dates, and locations;

i. Plans and schedules associated with strategic targeting changes;

j. SLBM/SSGN facilities and capabilities;

k. Mean time between failures and mean time to repair values for maintenance plan;

l. Public network internet protocol addresses associated with combat system elements;

m. Combat system cyber capabilities and limitations;

n. Deployment of capabilities upgrades and schedules for rapidly prototyped systems;

o. Technical details of support efforts for Department of Defense (DoD) and non-DoD infrastructures and networks;

p. Information concerning specific mission analysis;

q. Near real time and surge operations in response to natural and man-made event;

r. Infrastructure site assessment locations.

3. ELECTROMAGNETIC & SENSOR SYSTEMS DEPARTMENT

a. Specific frequencies of operation;

b. Targets of interest;

c. Test data, specifically effects on a target, to include no effect;

d. Specific power on target;

e. References to transitioning existing system and their applications as a weapon system;

f. General system parameters;

g. Radar cross sections;

h. Electromagnetic interference measurement data, analysis results, predictions, and risk ratings;

i. Advanced technology applications;

j. Specific knowledge of targets tactics, techniques, and procedures;

k. Analysis of system performance, target capabilities or vulnerabilities;

l. Current system technological, organizational, or operational vulnerabilities;

m. Counter technology efforts;

n. Specific biological capability gaps and/or limits of protection associated with fielded or developing biological defense equipment and/or system technical design details;

o. Scientific and technical or test and evaluation data for CBR defense related research.

4. INTEGRATED ENGAGEMENT SYSTEMS DEPARTMENT

a. Details of plans, programs, operations, test events and exercises, contracts, designs and milestones before approved public release;

b. Specific explosive experimental area capabilities and limitations;

c. Specific information related to Railgun and Hypervelocity Projectile and associated testing;

d. Specific information relating to hypersonic technology, programs, and associated testing;

e. Contents of magazines;

NSWCDD CRITICAL INFORMATION AND INDICATORS LIST (CIIL)

f. Targets of interest, analysis of target capabilities or vulnerabilities;

g. Weapon’s effects and lethality on targets; tactics, techniques and procedures (TTP’s);

h. Unmanned aerial vehicle capabilities and detailed results of testing;

i. Speeific frequencies or wavelengths of operations;

j. Waveform specifics; e.g. frequency and pulse width;

k. Power on target;

l. References to transitioning existing systems and their applications as a weapon system;

m. Electromagnetic interference measurement and ratings;

n. Specific information relating to laser technology, testing and high power microwave technology and testing;

o. Current system technological, organizational, or operation vulnerabilities and;

p. Counter technology efforts;

q. Specific information related to signals of opportunity technology, programs, and associated testing.

5. WEAPONS CONTROL & INTEGRATION DEPARTMENT

a. Details of counter-improvised explosive device projeets eommissioned by combatant commands, services, and agencies;

b. Battle Management System concept of operations; capabilities; performance, and limitations;

c. AEGIS Ballistic Missile Defense (ABMD), AEGIS Weapons Control System, AN/SQQ-89, Littoral Combat Ship, Vertical Launch Systems capabilities, limitations, vulnerabilities, degradations, test results, errors, problems, actual performance, fleet exercises, tactical operations, threats, missions, data and algorithms;

d. Association of specific projects with non-Navy sponsors, information identifying our non-Navy sponsors and stakeholders;

e. Locations and schedules of Navy ships, personnel deployment and outdoor testing facilities;

f. Correlation of project titles with development spaces and laboratories;

g. Any specific association of a project, initiative or program with Project Overmatch;

CUI Enclosure (1)

NSWCDD CRITICAL INFORMATION AND INDICATORS LIST fCIIU

h. Targets and threats of interest, analysis of target eapabilities or vulnerabilities;

i. Weapon’s effects and lethality on targets; tactics, techniques and procedures (TTP’s);

j. Specific information related to threats, modeling and simulation, testing events and associated testing;

k. Specific details about missions, threats, gaps, vulnerabilities, requirements, or urgent

l. Digital threat characterizations and traceable threat products;

m. Threat models used to develop threat assessment products;

n. Intelligent Automated Warfare System concepts of operations; capabilities;

performance, and limitations; and specific use of technology to enhance unmanned weapon systems.

6. WARFARE ANALYSIS & DIGITAL MODELING DEPARTMENT

a. Information concerning specific mission analysis (e.g. content results);

b. Specific details about missions, threats, gaps, vulnerabilities, requirements or urgent

c. Surface Warfare models and simulation products;

d. Force analysis and warfare studies examining foree struetures and arehitectures to be utilized for investment deeisions;

e. Mission-level and force-level capabilities and limitations;

f. Counter threat strategies;

g. Analysis of system performance, eapabilities or vulnerabilities;

h. Information system and network capabilities and vulnerabilities;

i. Security measures and countermeasures taken to protect a system.

7. INTEGRATED COMBAT SYSTEMS DEPARTMENT

a. Combat System and Warfare System specifications/design details for all Surface Ship Combat Systems including AEGIS, Aegis BMD (ABMD), Ship Self Defense System (SSDS), FFG 62, Unmanned Surfaee Vehicle (USV), DDG 1000, Littoral Combat Ships (ECS), and U.S. Coast Guard (USCG), ineluding tactical and virtualized environments;

b. Baseline Development, Cost Analysis, Testing, Installation and Delivery Schedules of Surface Navy Combat Systems including AEGIS, ABMD, SSDS, FFG 62, USV, DDG 1000, USCG and LCS;

c. Development of netted, flexible, automated and rapid capabilities for the integrated combat system that will be nodes in the distributed maritime operations;

d. Warfare and Combat System capabilities or limitations;

e. Interoperability and Combat Control systems capabilities or limitations including concept and design Shipboard Gridlock System/Automatic Correlation, System Track Manager/Track Server Cooperative Engagement Capability, Cryptologic Technician Network, Navigation and Ground Based Air Defense;

f. Information system/network capabilities and vulnerabilities;

g. Laboratory/test site locations, capabilities, operational and access requirements for the Integrate Warfare Systems Lab Complex, and other Combat System support laboratory/test sites;

h. Security measures/countermeasures taken to protect a system;

i. Identification of special access elements within a program;

j. Application of Program Protection to Warfare and Combat Systems;

k. Combat system virtualization efforts, virtualization experimentation, and virtualization prototypes;

l. Combat System operational employment, concepts and tactic;

m. Combat system integration efforts for new surface ship design;

n. Battle management aid/tactical aids and mission planning tools for surface Navy.

8. READINESS & TRAINING SYSTEMS DEPARTMENT

a. Installation and delivery schedules of ships and submarines;

b. Research & development technical information new, projected or expanded technical capabilities, performance data, vulnerabilities and limitations for ships, subs, missiles, littoral mine warfare systems and integrated warfare systems;

c. Details of plans, programs, operations, test events, exercises, contracts, designs, and milestones before approved public release. Specific exercises will provide separate OPSEC lists if required;

d. Travel details of any kind revealing information which could impact Causality Reports or ship status;

Enclosure (I)

e. Procurement of sensitive items or higher technology;

f. Maintenance and material support that could reveal sensitive projects;

g. Special codes assigned to platforms in association with other platform-specific information.

LAB EQUIPMENT MAINTENANCE

STATEMENT OF WORK

1.0 OVERVIEW

This Statement of Work (SOW) describes the requirement for preventive and remedial maintenance services for Government-owned commercial computer equipment under the cognizance of the Integrated Warfare Systems Lab (IWSL). The equipment consists mainly of

Hewlett Packard and former Digital Equipment Corporation (Compaq) CPUs (Alpha and Intel), and peripherals and networking components from Digital Equipment Corporation (Compaq) and other manufacturers. The equipment covered by the contract is located at the Naval Surface

Warfare Center Dahlgren Division (NSWCDD).

This is a firm-fixed price contract requiring preventive maintenance and on-call remedial maintenance (remedial maintenance during the Principal Period of Maintenance (PPM). The PPM for this contract is 16 hours per day, Monday through Friday, 0500 – 2100, excluding federal holidays. During the PPM, the contractor shall respond onsite to calls for service within four (4) hours and return the equipment to normal service (i.e. return the hardware and operating system to regular operation) within twelve (12) hours from the time service is requested. The contract also contains requirements for the contractor to enter data into an onsite system service log. Contractor maintenance personnel that require access to the equipment to be maintained shall possess and maintain at least a SECRET level security clearance.

2.0 APPLICABLE DOCUMENTS/DEFINITIONS

2.1 Applicable Documents:

2.1.1 Original Equipment Manufacturer (OEM) Specifications;

2.1.2 Equipment List (attached);

2.1.3 NAVSWC 5239.1, Department of the Navy Information Assurance Manual; and

2.1.4 DD254, Department of Defense Contract Security Classification Specification (attached);

2.2 Definitions:

2.2.1 Contracting Officer’s Representative (COR) - The Government person responsible for technical matters under the contract, acceptance of services/review of invoices, and general coordination among the contractor, System Administrators, and the Contracting Officer.

2.2.2 Down Time – The time from when a Government Representative makes a request for service from the contractor until the time equipment is returned to the Government in operable condition (i.e. the hardware and operating system ready for regular operation) ready to perform the scheduled workload. The maximum allowable Down Time under this contract is twelve (12) PPM hours. Down Time is only accumulated during the PPM when the contractor is provided access to the equipment.

3.0 REQUIREMENTS

3.1 The contractor shall provide all labor, equipment, tools, materials, parts, test equipment, travel, transportation, management and supervision, training, and other items and services necessary to maintain the overall functional operation of the equipment on-site at the NSWCDD.

3.2 Maintenance service shall provide coverage for all mechanical, electrical, and electronic components of the equipment in accordance with the Original Equipment Manufacturer (OEM) specifications.

3.3 Repair parts may be furnished on an exchange basis (i.e., parts replaced become the property of the contractor). Some removed parts may need to remain on-site temporarily to be sanitized before release to the contractor (example – disk drives). In some cases, failed parts may need to be destroyed on-site and not be released at all.

3.4 It is the responsibility of the contractor to maintain and store spare parts. The government may provide storage space for spare parts as available.

3.5 Equipment Lists

The Government believes the listed equipment to be in good operating condition and at the current revision levels (i.e., eligible for OEM maintenance). The successful contractor may inspect the equipment without charge to the government. Within 60 days from date of award, if the listed equipment is found not to be in good operating condition, the contractor shall immediately notify the government and provide a written estimate of the cost to bring the piece(s) of equipment up to good operating condition. The government may request the contractor to update the equipment to good operating condition.

3.5.1 The equipment listed in the attached equipment lists are identified by OEM ordering part number and/or equipment plate identification information. It is the responsibility of the contractor to perform any necessary cross referencing required for equipment identification.

3.6 No remote diagnostics (a communications link to any equipment outside of the site or carried from the site) shall be allowed for classified systems. Remote diagnostics may be authorized for unclassified systems upon approval by the proper Government authority.

3.6.1 The contractor shall have any Automated Information Systems (AIS) equipment utilized on this contract configured to meet requirements as stated in NAVSWC 5239.1 (i.e. accreditation, virus protection, logging, etc.)

3.6.2 The contractor is responsible for the actions of his employees and subcontractors performing under this contract. The contractor shall not disseminate information concerning means of access (entry) to any system or component under contract. The contractor shall not introduce any software that affects in any way the performance of any component or of the system as a whole (virus, etc.). The contractor is liable for costs to rectify the situation if determined that contractor’s equipment or negligent use of tools introduced a virus etc.

3.7 Maintenance shall include any firmware installation required as part of remedial service to restore the equipment to the previous operational state. The contractor shall notify the government when a firmware upgrade is required. If the firmware upgrade is available free of charge, it will be furnished and installed by the contractor. If a cost is associated with the firmware upgrade, it will be the responsibility of the government to obtain the firmware and the responsibility of the contractor to install it.

3.8 Preventive Maintenance (PM) shall be performed to keep the systems in good operating condition.

3.8.1 Preventive maintenance shall be scheduled and performed so as not to interfere with

Government operations. Government operation prime time is 0630-1800, Monday through Friday.

3.8.2 The contractor shall communicate all PM schedules to ensure operations are not affected.

3.9 Remedial Maintenance

3.9.1 The Contractor shall provide on-call maintenance services during Principal Period of

Maintenance (PPM), 0500-2100, Monday through Friday (not including Federal Government holidays).

3.9.2 On-site response by qualified Contractor maintenance personnel fully prepared to diagnose and repair non-functioning equipment shall be within (4) hours from the time that the

Government notifies the Contractor that remedial maintenance is required.

3.9.3 If the Contractor personnel fail to arrive at the site prepared to respond to the reported problem within the designated response time, the Contractor shall grant a credit to the

Government. Service is expected to continue until the equipment is operational.

3.10 Response Time Credits

3.10.1 If equipment remains unusable due to an equipment malfunction, through no fault or negligence of the Government, for a total of twelve (12) PPM hours or more the Contractor shall

(1) provide technical expert assistance to the maintenance personnel to determine the cause of the malfunction and the appropriate corrective action and (2) grant a credit to the Government.

3.10.2 Equipment shall not be removed from the Government sites for repair unless authorized by the COR and a loaner/replacement unit of the same make/model is installed at the site prior to the removal of the faulty equipment.

3.10.3 There shall be no additional charges for off-site repairs and loaner equipment.

3.10.4 The Contractor shall be responsible for all equipment from the time that it is removed from the facility until it is returned, installed, and proven to be in good operating condition.

3.10.5 If after Remedial Maintenance is performed, the piece of equipment fails or malfunctions with the same defect within two (2) days, the Contractor shall respond within 4 hours of notification and return the equipment to usable condition, even if outside the PPM, at no additional charge to the Government.

3.10.6 If the Contractor responds to a maintenance call and determines that the problem resulted from a malfunctioning attachment that is not under the scope of this contract, the Contractor shall

(1) notify the COR or System Administrator of the problem, and (2) assist/advise the COR or

System Administrator as to the source of the malfunction.

3.11 Equipment Modifications

3.11.1 Modifications - The Government retains the right to make minor changes to system hardware common to the engineering development environment. This may include such things as installation of interface boards, connection to external signal and communication lines, relocation of equipment, or system re-configurations. This shall be with no change in the fixed monthly maintenance prices.

3.12 Non-Billables

There shall be no additional charges for the following:

3.12.1 Replacement parts, unless such parts are required due to the fault or negligence of the

Government.

3.12.2 Preventive maintenance – The only exception is Preventive Maintenance specifically requested by the contract COR to be performed outside the PPM. This request must be in writing.

3.12.3 Remedial maintenance, which was requested during the Principal Period of

Maintenance. The only exception is if the COR or Contracting Officer specifically requests that service be provided outside of the PPM. This request must be in writing.

3.12.4 Time spent by maintenance personnel after arrival at the site awaiting the arrival of additional maintenance personnel and/or delivery of parts, etc., after a service call has commenced.

3.12.5 Remedial maintenance required on any machine when the scheduled preventive maintenance for that machine preceding the malfunction had not been performed (unless deferred by the Government).

3.12.6 Remedial maintenance required within a 2-day period due to a recurrence of the same malfunction.

3.13 The Contractor shall provide each Contractor employee with the personal protective equipment required to do their job safely and in compliance with all applicable regulations.

3.13.1 All contractor personnel shall maintain social distancing and wear a facemask at all times while onsite at the NSWCDD base until notified otherwise by the government.

4.0 TRAVEL

The contractor will be required to travel in performance of this contract. The number of trips and types of personnel traveling shall be limited to the minimum required to accomplish work requirements and shall be coordinated with the COR. All travel shall be conducted in accordance with the Federal Travel Regulations (FTR). Travel to NSWCDD throughout the period of performance with 12 trips anticipated.

5.0 RESPONSIBILITIES OF THE GOVERNMENT

5.1 Government personnel will not perform maintenance or attempt repairs to equipment while such equipment is subject to Contractor maintenance under the purview of this contract, unless agreed by the Contractor/Contractor personnel.

5.2 Subject to security regulations, the Government will permit access to the equipment which is to be maintained.

5.3 The Government will provide reasonable computer system resources for installation and use by the Contractor of its maintenance aids, including maintenance software updates and modifications to maintenance aids.

6.0 TECHNICAL POINT OF CONTACT

The COR will be identified at the time of contract award.

7.0 SECURITY

Some of the equipment to be maintained is in a classified environment. Contractor maintenance personnel that require access to the equipment to be maintained shall be cleared to the level of

SECRET. Access to classified spaces and handling of classified material shall be in accordance with DD Form 254. The security clearance of each individual must be on file with the Security

Officer at the Naval Surface Warfare Center Dahlgren Division.

(1) Facility Clearance: The Contractor shall possess and maintain a SECRET facility clearance as verified within the National Industrial Security System.

(2) Physical Security: The Contractor shall be responsible for safeguarding all Government information or property provided for Contractor use. At the end of each work period, Government information, facilities, equipment and materials shall be secured as specified by the 32 CFR Part 117 and the NSWCDD Command Security Manual.

(3) Physical Security: No safeguarding of classified material is authorized at the contractor facility. Safeguarding will only be required at the actual performance site listed in Block

13 on the DD254. Actual performance site’s security regulations and guidelines will apply.

7.1 Electronic Spillage

7.1.1 Electronic Spillages (ES) are unacceptable and pose a risk to national security. An electronic spillage is defined as classified data placed on an information system (IS), media or hardcopy document possessing insufficient security controls to protect the data at the required classification level, thus posing a risk to national security (e.g., sensitive compartmented information (SCI) onto collateral, Secret onto Unclassified, etc). The contractor's performance as it relates to ES will be evaluated by the Government. ES reflects on the overall security posture of

NSWCDD and a lack of attention to detail with regard to the handling of classified information of

IS security discipline and will be reflected in the contractor's performance rating. In the event that a contractor is determined to be responsible for an ES, all direct and indirect costs incurred by the

Government for ES remediation will be charged to the contractor.

7.1.2 NSWCDD Security will continue to be responsible for the corrective action plan in accordance with the security guidance reflected on the DOD Contract Security Classification

Specification - DD254. NSWCDD Security will identify the contractor facility and contract number associated with all electronic spillages during the investigation that involve contractor support. NSWCDD Security will notify the Contracts Division with the contractor facility name and contract number, incident specifics and associated costs for cleanup. The Contracting Officer will be responsible to work with the Contractor Facility to capture the costs incurred during the spillage clean up. The Contractor is also responsible for taking Information Security Awareness training annually, via their Facility Security Officer (FSO), as part of the mandatory training requirements. If a spillage occurs additional training will be required to prevent recurrence.

7.2 Portable Electronic Devices (PEDs)

7.2.1 Non-government and/or personally owned portable electronic devices (PEDs) are prohibited in all NSWCDD buildings with the exception of personally owned cell phones, which are authorized for use in General Office Spaces (GOS). All personnel need to be aware of PED’s policy and being permitted in a building by asking authorized personnel or reviewing the entrance area signs and instructions. The Contractor/personnel visiting shall ensure the onsite personnel remain compliant with this PED policy. NSWCDD instruction defines PEDs as the following: any electronic device designed to be easily transported, with the capability to store, record, receive or transmit text, images, video, or audio data in any format via any transmission medium. PED’s include, but are not limited to, pagers, laptops, radios, compact discs and cassette players/recorders. In addition, this includes removable storage media such as flash memory, memory sticks, multimedia cards and secure digital cards, micro-drive modules, ZIP drives, ZIP disks, CD-RWs, DVD-RWs, MP3 players, iPADs, digital picture frames, electronic book readers, kindle, nook, cameras, external hard dish drives, and floppy diskettes.

7.2.2 Personal Wearable Fitness Devices (PWFDs) marketed primarily as fitness or sleep devices are allowed in all Navy spaces, if they are compliant with NAVADMIN 216/15, where collateral non-Sensitive Compartmented Information (SCI), classified information is processed, stored, or discussed up to and including secret. The User must ensure the PWFD is compliant with all requirements in NAVADMIN 216/15, Cyber Hygiene Authorization to use Personal

Wearable Fitness Devices (e.g., FitBit, Jawbone UP, etc.) in Navy Spaces, dated 14 September

2015 and register PWFD in the NSWCDD Fitness Device Tracker.

7.2.3 Personnel requiring the use of Medical Portable Electronic Devices (MPEDs) must submit

Form NSWCDD 5239/4 for SCIF authorization to the Special Security Officer (SSO). For Special

Access Program Facility (SAPF) authorizations, follow the guidance provided by the Government

Special Access Program Security Officer (GSSO). Authorizations for use in SAPFs that are co-utilized within NSWCDD SCIFs require coordination between both the GSSO and SSO. For authorizations to use MPED in Collateral Classified spaces, submit form to the Special Programs

Branch, Code 1053.

7.2.4 PED’s belonging to an external organization shall not be connected to NSWCDD networks or infrastructure without prior approval from the NSWCDD Information Assurance and

Compliance Branch. This approval will be granted using the TARIS form and action tracker process.

Personally owned hardware or software shall not be connected or introduced to any NSWCDD hardware, network or information system infrastructure.”

Navy-issued peripheral:

Government procured headsets with or without microphones must be wired, use either a 3.5 millimeter (mm) audio jack or universal serial bus (USB) port, cannot contain active-noise cancelling functionality and may be used on systems and may be used on systems of classification up to and including collateral Top Secret. The headsets are considered unclassified when unplugged, and must be unplugged when not in use within classified spaces or when classified discussions are taking place in unclassified spaces.

Government procured Bluetooth earbuds and headsets that do not require a USB dongle or any other physical connection to enable wireless connectivity are allowed for use on government issued tablets, phones, and personal devices in telework environments or unclassified general office space where no classified discussion are occurring.

Web cameras may only be used on systems at the classification level of the space. For example, in a collateral SECRET open storage area an external web camera may be connected to the SECRET workstation only. No camera pass is required for these devices.

Government provided printers and/or scanners are authorized in a telework environment. Users must ensure that any paper or media containing controlled unclassified information (CUI) or unclassified information not authorized for public release is safeguarded by locking in a drawer, cabinet or room. CUI and unclassified information not approved for public release must be returned to the worksite for destruction.

Government issued peripherals may be used on personal devices.

While connected to any Navy network, whether on site or while in a telework environment, the use of headsets with microphones and web cameras are restricted to official government duties.

7.3 Operations Security (OPSEC)

7.3.1 Contractor personnel shall follow OPSEC concepts and principles in the conduct of this requirement to protect critical information, personnel, facilities, equipment, and operations from compromise. All Contractors (including Subcontractors) shall supplement their current security practices by requiring any personnel involved in executing this contract to complete Government-sponsored and administered Operations Security (OPSEC) training. In addition, all Contractors should be aware of the Critical Information and Indicators List (CIIL) for the organization they are supporting as well as the OPSEC plan for NSWCDD. These OPSEC requirements will be in effect throughout the life of the procurement from award through the conclusion of services at the end of the period of performance (PoP) or other procurement termination. The Contractor must immediately notify the Government upon the discovery of any nonconformance with the OPSEC

Plan.

7.4 Privacy Program Training

7.4.1 Privacy Program Training. Privacy training is mandatory for all NSWCDD personnel

(military, civilian, and contractor) and must be completed annually. Total Workforce

Management Services (TWMS) is the official database for workforce training and is the tool for taking and recording privacy act training. The contractor is responsible for ensuring individual annual privacy training requirements are met.

7.5 Controlled Unclassified Information (CUI), to include For Official Use Only (FOUO) and

Personally Identifiable Information (PII), generated and/or provided under this contract shall be safeguarded and marked as specified in DoDI 5200.48 and 5400.7-R Chapters 3 and 4.

QUALITY ASSURANCE SURVEILLANCE PLAN

This Quality Assurance Surveillance Plan (QASP) has been developed to evaluate contractor actions while implementing this Statement of Work. It is designed to provide an effective surveillance method of monitoring contractor performance for each listed objective, both onsite and offsite of the IWSL equipment represented in attachment Equipment List J.1.

The QASP provides a systematic method to evaluate the hardware maintenance provided.

This QASP is based on the premise that the Government desires to maintain the IWSL commercial equipment in good operating condition during the Principal Period of Maintenance.

The contractor, and not the Government, is responsible for management and quality control actions to meet the terms of the contract. The role of the Government is quality assurance to ensure contract standards are achieved.

In this contract, the quality control program is the driver for product quality. The contractor is required to develop a comprehensive program of inspections and monitoring actions. The first major step to ensuring a “self-correcting” contract is to ensure that the quality control program approved at the beginning of the contract provides the measures needed to lead the contractor to success.

Once the quality control program is approved, careful application of the process and standards presented in the remainder of this document will ensure a robust quality assurance program.

Performance Objective Performance Standard Performance Threshold

Preventative

Maintenance (PM) and

On-Call Remedial

Maintenance (RM)

Equipment placed under maintenance service will be in good operating condition.

Preventive Maintenance (PM) shall be performed to keep the systems in good operating condition. If the equipment is not in good operating condition (i.e., not eligible for OEM maintenance), the Contractor shall repair or replace the items. The preventive maintenance and on-call remedial maintenance requires the contractor to respond to onsite calls for service within four (4) hours and return the equipment to normal service (i.e. return the hardware and operating system to regular operation) within forty-eight (48) hours from the time service is requested. The

Contractor shall provide on-call maintenance services during

Principal Period of Maintenance

(PPM), 0700-2100, Monday through Friday (not including

Federal Government holidays).

95% of all PM and RM performed IAW SOW

SURVEILLANCE: The Contracting Officer’s Representative (COR) will receive feedback from

Government personnel and pass them to the contractor for action.

STANDARD: 95% of all maintenance is without customer complaints for the month or service period. The COR shall notify the Contracting Officer for appropriate action in accordance with

FAR 52.212.4, Contract Terms and Conditions-Commercial Items (February 2007) or the appropriate Inspection of Services clause, if any of the above service areas exceed five customer complaints.

PROCEDURES: Any Government employee that observes unacceptable services, either incomplete or not performed, for the above performance objective should immediately contact the

COR and the COR will complete appropriate documentation to record the complaint and resolution.

SURVEILLANCE: The Government COR will evaluate the services required to ensure compliance.

STANDARD: The Contractor shall perform all work required in a satisfactory manner in accordance with the appropriate SOW paragraph. The COR shall not consider the tasking complete until all deficiencies have been corrected.

PROCEDURES: The Government COR will inspect all work tasks required to ensure contractor compliance with the Statement of Work (SOW) each time the service(s) is performed. Record results of inspection, noting the date and time of inspection. If inspection indicates unacceptable performance, notify the contractor of the deficiencies for correction. The Contractor shall execute an agreeable plan to correct the unacceptable performance.

DRAFT

SAMPLE

PREVIOUS EDITION IS OBSOLETE.

Page of

DD FORM 254, APR 2018

NEEDS DD67

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

June 30, 2025 The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

b. REVISED (Supersedes all previous specifications.)

4. IS THIS A FOLLOW-ON CONTRACT?

If yes, complete the following:

Classified material received or generated under

5. IS THIS A FINAL DD FORM 254?

If yes, complete the following:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor)

8. ACTUAL PERFORMANCE (Click button to add more locations.)

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

e. NATIONAL INTELLIGENCE INFORMATION:

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

13. SECURITY GUIDANCE

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract; and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

List of Attachments (All Files Must be attached Prior to Signing, i.e., for any digital signature on the form)

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.