1.05 Draft PWS.pdf

CUI

i

Naval Oceanographic Office

(NAVOCEANO)

Performance Work Statement (PWS) to Maintain, Sustain and

Modernize Integrated Survey System (ISS-60) Survey Software

Version 1.0

Prepared by:

Naval Oceanographic Office ii

Table of Contents

1.0 GENERAL INFORMATION

2.0 BACKGROUND

3.0 APPLICABLE DOCUMENTS

4.0 PRE-PLANNED PRODUCT IMPROVEMENTS (P3I) REQUIREMENTS AND ENGINEERING SUPPORT

SERVICES

Program Management

Conferences, Meetings, and Reviews

Program Status Reviews (PSRs)

Technical Meeting

Configuration Management (CM)

Quality Control (QC)

Quality Control (QC) will be managed under the Capability Maturity Model Integrated (CMMI) model and the

Quality Assurance Surveillance Plan (QASP)

Systems Engineering

Software Engineering Services

Capability Maturity Model Integration (CMMI)

Work Package Agreements

Installation and System Testing

Test Environment

Factory Acceptance Test (FAT)

Pre-System Acceptance Test (Pre-SAT)

System Acceptance Test (SAT) / Government Acceptance Test (GAT)

Trial Cards

5.0 TRAINING

6.0 CYBERSECURITY

Design, Integration, Configuration or Installation of Hardware and Software

Safeguarding Covered Defense Information

7.0 TRAVEL

8.0 PRIMARY PLACE(S) OF PERFORMANCE

9.0 SECURITY REQUIREMENTS

10.0 OPERATIONS SECURITY (OPSEC) REQUIREMENTS

Local and Internal OPSEC Requirement

OPSEC Training

NAVOCEANO OPSEC Program iii

11.0 GOVERNMENT FURNISHED PROPERTY (GFP)

Government Furnished Equipment (GFE)

Government Furnished Information (GFI)

12.0 TECHNICAL ASSISTANCE AGREEMENT (TAA)

13.0 PERFORMANCE BASED CRITERIA

Performance Requirement

Method of Surveillance

14.0 MISCELLANEOUS

LIABILITY INSURANCE – FIXED PRICE CONTRACTS

1.0 GENERAL INFORMATION

This Performance Work Statement (PWS) sets forth Contractor requirements for engineering services support of two major and six minor software releases to include software integration, analysis and modernization to the Integrated Survey System (ISS-60) survey software.

2.0 BACKGROUND

The ISS-60 survey software is currently in-service aboard the Transportation Auxiliary General

Survey (T-AGS) 60 Class Ships and Hydrographic Survey Launches (HSLs) attached to T-AGS.

These oceanographic survey vessels are capable of effectively performing operations that satisfy a broad spectrum of oceanographic requirements. The T-AGS 60 ships are Survey Ships that are designed and constructed to provide multi-purpose oceanographic capabilities in coastal and deep ocean areas including: physical, chemical, and biological oceanography; multi-discipline environmental investigations; ocean engineering and marine acoustics; marine geology and geophysics; and bathymetric, gravimetric, and magnetometric surveying. The HSLs are Survey

Vessels that are designed and constructed to provide same purpose as T-AGS, but in shallow water (100m or less water depth).

The ISS-60 survey software provides a uniquely and specifically designed integrated data collection, storage and processing capability for these platforms to perform a variety of missions.

The ISS-60 survey software acquires, stores, displays, and processes data collected by various mission systems using a fiber-optic network configuration. These configurations can be installed on a variety of vessels and may reside on a single computer. Additionally, the ISS-60 survey software configuration is maintained at the same version level across all platforms to provide end users with a familiar setting as they move ship-to-ship. ISS-60 survey software is a critical component in the Naval Oceanographic Office’s (NAVOCEANO) ability to collect and integrate oceanographic information in support of surface and subsurface navigation as well as provide environmental characterization of the Battlespace. Furthermore, the data will be integral to the

U.S. Navy in supporting the Information Dominance Roadmap.

3.0 APPLICABLE DOCUMENTS

This section lists documents applicable to the accomplishment of the tasking within this PWS.

The Contractor shall be responsible for monitoring and conforming to all current Government standards, processes and procedures. Documents will be made available upon request.

Table 1: ISS-60 Procurement Applicable Documents

ISS-60 Procurement Applicable Documents

Document Version

a. Application and Security Development Document, Security and Technical Implementation Guide (STIG)

Version 5, Release 3, Dated

20 July 2023

b. Department of Defense (DoD) 5000.02: Operation of the Defense Acquisition System

Dated 23 January 2020

c. DoD Risk, Issue, and Opportunity Management Guide for Defense Acquisition Programs

Dated 9 January 2017

d. Department of Defense Instruction (DoDI) 8500.01

Cybersecurity

e. Defense Federal Acquisition Regulation Supplement

(DFARS)

f. DoDI 8510.01: Risk Management Framework (RMF) for DoD Information Technology (IT)

Dated 19 July 2022

g. Engineering and Technical Authority Manual (ETAM) Version 1, Dated 10 July

h. Institute of Electrical and Electronics Engineers (IEEE) and the Electronic Industries Alliance (EIA) 12207

Dated November 2017

i. National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-171

Revision 2

j. Navy Security Control Assessor (SCA) & Authorizing

Official (AO) Cybersecurity Authorization and

Assessment (AA) Testing Guidance

Version 1.1

k. PEO C4I Configuration Management Naming and

Numbering Standard

Dated 21 November 2016

l. PEO C4I SS Configuration Management Policy

Implementation

Dated 12 November 2019

m. SPAWARINST 5400.3A: Systems Engineering

Technical Review (SETR) Policy

Dated 22 August 2016

4.0 PRE-PLANNED PRODUCT IMPROVEMENTS (P3I) REQUIREMENTS AND

ENGINEERING SUPPORT SERVICES

All tasks contained in this section describe the efforts required for the modernization, integration, and testing of the ISS-60 survey software.

Program Management

The Contractor shall perform program management activities to ensure all work conducted under this contract is planned and executed in a manner that will achieve all management, technical, cost, and schedule objectives stated within and In Accordance With (IAW) Department of

Defense (DoD) 5000.02: Operation of the Defense Acquisition System (Document b, Table 1).

The contactor shall submit a Contractor’s Progress, Status and Management Report IAW CDRL

A001. The report shall document immediate plans, program status (including action item status), progress, risk, cybersecurity status, all Government Furnished Property (GFP) items received and required, Integrated Master Schedule (IMS) of upcoming events (including stop and start dates, meetings and reviews, and testing milestones), and other required information. All risks identified in the Management Report shall follow the guidance identified in the DoD Risk, Issue, and Opportunity Management Guide for Defense Acquisition Programs (Document c, Table 1).

CDRL Deliverable:

A001: Contractor’s Progress, Status and Management Report (DI-MGMT-80227)

Conferences, Meetings, and Reviews

The Contractor shall conduct meetings and reviews, including the below referenced meetings, in support of all tasks executed under this contract. The Contractor shall produce presentation material and conference agendas and submit IAW CDRLs A002 and A003. Upon completion of formal meetings and reviews, the Contractor shall document meeting minutes and coordinate key action items resulting from the meeting with the Government IAW CDRL A004.

CDRL Deliverables:

A002: Presentation Material (DI-ADMN-81373)

A003: Conference Agenda (DI-ADMN-81249B)

A004: Report, Record of Meeting/Minutes (DI-ADMN-81505)

Program Status Reviews (PSRs)

The Contractor shall conduct Program Status Reviews (PSRs). These reviews shall occur at the

Contractor’s facility unless specifically requested by the Government to occur elsewhere. The

PSR content shall cover all aspects of this contract addressing delivery schedule and contract performance (e.g. to include topics such as progress against major milestones, risk management, configuration management, software engineering, logistics, and obsolescence). Prior to each

PSR, the Contractor shall provide presentation material and an agenda IAW CDRL A002 and

A003. PSRs shall be conducted at the discretion of the Government and may consist of up to four

(4) per year. Upon completion of each PSR, the Contractor shall provide meeting minutes IAW

CDRL A004.

A002: Presentation Material (DI-ADMN-81373)

A003: Conference Agenda (DI-ADMN-81249B)

Technical Meeting

The Contractor shall participate in monthly informal System Engineering Working Group

(SEWG) meetings and technical meetings. As an output of the meeting, the Contractor shall provide meeting minutes, IAW CDRL A004.

Configuration Management (CM)

The Contractor shall perform software configuration management in accordance with PEO C4I and Survey System (SS) Configuration Management Policy Implementation (Document 1, Table

1).

The Configuration Management Plan (CMP), CDRL A005, shall include the following:

procedures designating the levels of control each identified entity must pass through (for example, author control, project-level control, acquirer control); the persons or groups with authority to authorize changes and to make changes at each level (for example, the programmer/analyst, the software lead, the project manager, the acquirer): and the steps to be followed to request authorization for changes, process change requests, track changes, distribute changes, and maintain past versions. Changes that affect an entity already under acquisition control shall be formally proposed to the acquirer.

A005: Configuration Management Plan (CMP) (DI-SESS-81875)

Quality Control (QC)

Quality Control (QC) will be managed under the Capability Maturity Model Integrated (CMMI) model and the Quality Assurance Surveillance Plan (QASP).

Systems Engineering

The Contractor shall utilize Systems Engineering principles in software modernization, integration, testing and delivery on the survey platform. Additionally, the Contractor shall follow the guidance of Engineering and Technical Authority Manual (ETAM) (Document g, Table 1) related to System Engineering. The guidance in the ETAM in regard to Systems Engineering

Technical Reviews (SETRs) shall be tailored to support modernization and documentation of changes to the ISS-60 software as outlined in the SETRs policy (Document m, Table 1). The

Contractor shall deliver an Engineering Program Plan IAW with CDRL A006.

A006: Contractor Engineering Program Plan (DI-SESS-82195)

Software Engineering Services

The Contractor shall perform software engineering services and verification functions that demonstrate all products delivered meet the requirements defined by the Government and IAW

Institute of Electrical and Electronics Engineers and the Electronic Industries Alliance

(IEEE/EIA) 12207 standard (Document h, Table 1) to support two major and six minor software releases as defined per PEO C4I Configuration Management Naming and Numbering Standard

(Document k, Table 1). The Contractor shall provide engineering services in support of analysis, modernization, and integration of the ISS-60 Survey Software. In order to ensure the ISS-60

Survey Software meets the Software Requirements Specification (SRS) the Contractor’s services shall include the following:

The Contractor shall deliver updated source code (Computer Software Product, CDRL

A007) to the Government with each software version release.

The Contractor shall provide proof-of-concept products that either demonstrate expected interfaces and functionality, such as story boards, or produce prototype demonstrations that show the operations of particular functions.

The Contractor shall update and deliver the Software Requirements Specifications (SRS), CDRL A015, which specifies the requirements for a Computer Software Configuration

Item (CSCI) and the methods to be used to ensure that each requirement has been met.

The Contractor shall ensure each software release remains backward compatible with all previous software versions and sensors that remain in service onboard the T-AGS ships.

The Contractor shall use current industry design and implementation tools to facilitate future enhancements as outlined in the Software Maintenance Manual (SMM). The SMM shall be updated by the Contractor IAW CDRL A010. The system shall be scalable to process and store additional data sets and increasing volumes of data and use a modular, open-systems approach, when feasible.

The Contractor shall ensure the software is produced with preset configurations and workflow automation to remove repetitive and redundant steps to the maximum extent possible while retaining human review and quality control of data.

The Contractor shall ensure the software supports remote capability to monitor system status, troubleshoot, configure, correct defects, and install cybersecurity patches to the maximum extent possible.

The Contractor shall sustain the ISS-60 Survey Software to provide updates to support changes to hardware and software base lines based on life cycle upgrades and refreshes.

The Contractor shall perform a software integration Systems Engineering Technical

Review (SETR) per document m, Table 1. SETR documentation shall be provided in accordance with the Engineering Technical Review provided by the Government.

The Contractor shall ensure all software delivered operates with the latest Government approved versions of Microsoft Windows and/or Red Hat software. All subroutines, libraries, files and scripts written shall conform to the Application and Security

Development Document, Security and Technical Implementation Guide (STIG)

(Document a, Table 1) latest release. No deviations from these standards will be accepted unless approval is granted by the Naval Oceanographic Office Contracting Officer’s

Representative (COR).

Additionally, any updates to the baseline of the ISS-60 Survey Software shall be IAW the framework defined software engineering process and include updates to the following documents with each version release:

o ISS-60 Source Code IAW CDRL A007 o Software Development Plan (SDP) IAW CDRL A008 o Software Design Description (SDD) IAW CDRL A009 o Software Maintenance Manual (SMM) IAW CDRL A010 o Interface Control Document (ICD) IAW CDRL A011 o Software Test Manual (STM) CDRL IAW CDRL A012 o Software User Manual (SUM) IAW CDRL A013 o Software Version Description (SVD) IAW CDRL A014 o Software Requirements Specification (SRS) IAW CDRL A015 o Software Development Process Description Document (SDPDD) IAW CDRL

A016

Any content errors in the above referenced documentation shall be captured in Documentation

Discrepancy Cards (DDCs). For more information on DDCs as they relate to the performance standard of this contract, reference Quality Assurance Surveillance Plan (QASP).

A007: Computer Software Product; ISS-60 Source Code (DI-IPSC-81488)

A008: Software Development Plan (SDP) (DI-IPSC-81427B)

A009: Software Design Description (SDD) (DI-IPSC-81435)

A010: Revisions to Existing Government Documents: Software Maintenance Manual (SMM)

(DI-ADMN-80925A)

A011: Interface Control Document (ICD) (DI-SESS-81248B)

A012: Revisions to Existing Government Documents; Software Test Manual (STM) (Di-

ADMN-80925A)

A013: Software User Manual (SUM) (DI-IPSC-81443A)

A014: Software Version Description (SVD) (DI-IPSC-81442A)

A015: Software Requirements Specification (SRS) (DI-IPSC-81433A)

A016: Software Development Process Description Document (SDPDD) (DI-IPSC-82208)

Capability Maturity Model Integration (CMMI)

The Contractor shall possess, at a minimum, a CMMI Software Maturity Level 3 for software production and maintenance. The Contractor, with concurrence from the Government, shall assess each task and determine the level of difficulty based on the established process. Any deviations from the approved assessments directed by the Government during the implementation phase will be defined as a new task with a new Work Package.

Work Package Agreements

The Government will provide additional information and clarity via Work Package Agreements for needed software engineering services. The Contractor shall perform software engineering services and verification functions that demonstrate all products delivered meet the requirements defined by the SRS. A Work Package Agreement will further clarify the scope of work needed.

Work package agreements shall be delivered IAW CDRL A017.

A017: Revisions to Existing Government Documents; Work Package Agreement (DI-ADMN-

80925A)

Installation and System Testing

The Contractor shall support the following test events for each release of the system.

Test Environment

The Contractor shall receive as Government Furnished Property the ISS-60 testbed. The

Contractor shall install and test the Government Furnished Equipment (GFE) ISS-60 testbed which replicates the functionality of the shipboard ISS-60 configuration. The testbed shall provide support for software updates as well as testing capabilities to support each Factory

Acceptance Test (FAT).

The Contractor shall ensure the operational status of the ISS-60 testbed through the contract

Period of Performance (PoP) and provide adequate testbed space in a Contractor furnished facility. The Contractor shall receive and install upgrades for hardware, software, firmware, network capability and associated components in the testbed (these items may include

Government Furnished Material (GFM), Contractor purchased and provided items, or a combination thereof). The Contractor shall report any changes to the GFE test environment monthly IAW CDRL A018.

The Contractor shall, at the Government’s request, de-install the testbed and ship all components to the Government at the end of this contract.

A018: Status of Government Furnished Equipment (GFE) Report (DI-MGMT-80269)

Factory Acceptance Test (FAT)

The Contractor shall conduct a Factory Acceptance Test (FAT) at the Contractor’s facility using the Testing Environment described in Section 4.4.1. Prior to the start of the FAT, the Contractor shall provide a test plan and test cases for review as part of the SETR Test Readiness Review

(TRR) IAW CDRL A019. At the conclusion of each FAT, the Contractor shall provide a

Software Test Report (STR) IAW CDRL A020. All discrepancies identified during FAT shall be documented IAW section 4.4.5, Trial Cards.

A019: Software Documentation; Test Readiness Review (TRR) (DI-IPSC-81756)

A020: Software Test Report (STR) (DI-IPSC-81440A)

Pre-System Acceptance Test (Pre-SAT)

After successful completion of the FAT, the Contractor shall support the Pre-System Acceptance

Test (Pre-SAT) conducted by the Government on an operational vessel at a location selected by the Government.

The Contractor shall support the Pre-SAT in accordance with the Government’s schedule. The location(s) of the vessels will be made available approximately 30 days prior to the start of the test. The Contractor shall provide on-site support to Government personnel conducting Pre-SAT activities. This support shall include, but is not limited to:

Update and modify software coding based on test cases as required to support ship configuration.

Review test errors of failure and provide resolution of prioritized Level 1 and Level 2

Trial Cards.

Mitigation of prioritized Level 1 and Level 2 Trial Cards.

If travel is required in support of a Pre-SAT, it shall be IAW Section 8.0 of this PWS. The

Contractor shall report all discrepancies identified during Pre-SAT and document them IAW section 5.4.5, Trial Cards.

System Acceptance Test (SAT) / Government Acceptance Test (GAT)

The Contractor shall support the System Acceptance Test/Government Acceptance Test

(SAT/GAT) conducted by the Government for the lead ship on an operational vessel at sea.

The Contractor shall support the SAT/GAT IAW the Government’s schedule. The location(s) of the vessels will be made available approximately 30 days prior to the start of the test. If travel is required in support of a SAT/GAT, it shall be IAW Section 8.0 of this PWS.

The Contractor shall support ISS-60 SAT/GAT validation utilizing applicable test batteries. All deviations from test cases shall be documented within a Trial Card for prioritization and resolution IAW section 5.4.5, Trial Cards. This support shall include but is not limited to:

Update and modify software coding based on test cases as required to support ship configuration.

Review test errors of failure and provide resolution of all Trial Cards, irrespective of level, as required by this PWS.

Mitigation of all Trial Cards, irrespective of level, as required by this PWS.

For each minor release of the software, the Contractor shall support minor test events. Each test event shall result in trial cards generated and prioritized by the Government. The SAT/GAT shall be considered complete when it meets the requirements of the approved task during the test phase and is free of Level 1 and Level 2 Trial Cards. For more detail on Trial Cards, see Section

4.4.5 of this PWS.

At the conclusion of each SAT/GAT, the Contractor shall provide a Software Test Report (STR)

IAW CDRL A020.

Trial Cards

Trial Cards are a way of formally documenting an observation or issue regarding the ISS-60 system functional performance (CDRL A021). Trial Cards can be written during any acceptance testing milestone phase. In most situations, the observation pertains to a deficiency written against whether, or how, the ISS-60 system meets the functional ISS-60 requirements contained in the SRS, although Trial Cards can also be written to describe recommended enhancements or requested enhancements to the system. Each trial card is uniquely identified with an identification number, and the name of the acceptance test in which it was found. The Trial Card

Levels are defined as follows:

Level 1: System crash or major failure

Level 2: Critical component crash, hang or failure

Level 3A: Corrupted or erroneous data file

Level 3B: Data files missing fields or records

Level 3C: Workaround, increases operator workload

Level 3D: Acceptable workaround exists

Level 3E: Misinformation or corrupt display problem

Level 3F: Non-critical component crash, hang or failure

Level 3G: Hardware or COTS Software configuration

Level 4: Cosmetic or minor deficiency

Level 5: Enhancement or new feature

Level 6: Non-issue, Operator error

Level 7: Non-issue, Duplicate Trial Card

Level 8: Document discrepancy

The Contractor shall correct Trial Cards identified in the previous FAT, Pre-SAT, and SAT events which affect the proper or preferred operation of the ISS-60 software IAW CDRL A021 with Government concurrence. All high-level specified software corrections shall be delivered by the next testing phase as a new version. The Government will prioritize the Trial Cards and provide the list to the Contractor. The task shall be considered complete when it meets the requirements of the approved task during a testing phase and is free of Level 1 and Level 2 Trial

Cards; all remaining Trial Cards will be “bundled” in the deficiency’s remediation task, prioritized, and corrected. Any deviations from the approved assessments directed by the

Government will be defined as a new task.

All testing will include cybersecurity as outlined in section 6.0.

A021: Revisions to Existing Government Documents; Trial Cards (DI-ADMN-80925A)

5.0 TRAINING

The Contractor shall provide shore-based and/or at-sea training with every major software version release. Additional training may be required during performance of the contract.

The Contractor shall produce and deliver training materials IAW CDRL A022 and provide on-the-job training in-port and at-sea. Training shall be delivered at the referenced place of performance per Table 2.

A022: Training Materials (DI-ILSS-80872)

6.0 CYBERSECURITY

Cybersecurity (which replaced the term Information Assurance (IA)) is defined as prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation. Contractor personnel shall perform tasks to ensure Navy applications, systems, and networks satisfy Federal/DoD/DON/Navy cybersecurity requirements as described below.

Design, Integration, Configuration or Installation of Hardware and Software

The Contractor shall ensure any equipment/system installed or integrated into a Navy platform will meet the cybersecurity requirements as specified under the Cybersecurity, Department of

Defense Instruction (DoDI) 8500.01 (Document d, Table 1). The Contractor shall ensure that any design change, integration change, configuration change, or installation of hardware and software is in accordance with established DoD/DON/Navy cyber-directives listed in Table 1 and does not violate the terms and conditions of the accreditation/authorization issued by the appropriate Accreditation/Authorization Official.

The Contractor shall ensure cybersecurity requirements are addressed in the software development process. The Contractor shall conduct security testing and evaluation, document vulnerabilities, correct vulnerabilities, and document the resolution or mitigation of vulnerabilities IAW the Navy’s Risk Management Framework (RMF) process guide, DoDI

8510.01 (Document f, Table 1). The Contractor shall demonstrate compliance with the applicable cybersecurity controls through performance of a Contractor Cybersecurity Self-

Assessment (CCSA) as addressed in the National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-171 (Document i, Table 1) and complies with the language in

Defense Federal Acquisition Regulation Supplement (DFARS) (Document e, Table 1), clause

252.204-7012. The Contractor shall evaluate the software end-item against the applicable

Security Technical Implementation Guides (STIGs) (Document a, Table 1), Security

Requirements Guides (SRGs) or checklists as provided by the Defense Information Systems

Agency (DISA) on its website (http://iase.disa.mil/stigs/index.html). All software produced under this Contract shall comply with the requirements of the Application and Security

Development STIG (Document a, Table 1), including the requirement for source code security analysis. Source code security analysis shall include the scanning of source code, identification of source code findings, and their correction and/or mitigation. The Contractor shall perform cybersecurity testing with the use of automated source code security analysis tools.

Source code cybersecurity compliance shall be evaluated IAW the requirements of the STIG

(Document a, Table 1). The Contractor shall identify all “raw” source code security issues, issues determined to be false positives based on analysis, planned corrective actions for validated findings and mitigation statements for issues that cannot be corrected. For STIGs or checklists that are supported by automated test tools, the Contractor shall provide the test reports generated by the automated test tool including source code scanning tools. For STIGs and checklists that are not supported by automated test tools, the Contractor shall deliver test results in an STR, CDRL A020.

The Contractor shall correct Category (CAT) I and CAT II findings or institute a Navy

Authorizing Official (NAO) approved mitigation if a fix does not exist so that the finding will be reported as a CAT III IAW CDRL A023. Cybersecurity evaluations are to be in accordance with

Navy Security Control Assessor (SCA) & Authorizing Official (AO) Cybersecurity

Authorization & Assessment (A&A) Testing Guidance, (Document j, Table 1). Cybersecurity test results will be reported in accordance with the Navy Authorizing Official and Security

Control Assessor RMF Process Guide v3.0 on the SECNAV website

(https://portal.secnav.navy.mil/orgs/OPNAV/N2N6/DDCION/N2N6BC4/RMF/nqv/SitePages/H ome.aspx).

A023: Cybersecurity Vulnerability Report (DI-MGMT-82191) http://iase.disa.mil/stigs/index.html https://portal.secnav.navy.mil/orgs/OPNAV/N2N6/DDCION/N2N6BC4/RMF/nqv/SitePages/Home.aspx https://portal.secnav.navy.mil/orgs/OPNAV/N2N6/DDCION/N2N6BC4/RMF/nqv/SitePages/Home.aspx

Safeguarding Covered Defense Information

The contractor shall comply with the following Navy Marine Corps Acquisition Regulation

Supplement Annex 16:

1. System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews

a) Within thirty (30) days of contract award, the Contractor shall make its System Security

Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the

Government at the contractor s facility. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause

252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the

Government s review of the SSPs at the Contractors facility.

b) If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the

Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

c) Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor s facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

d) The Government may, in its sole discretion, conduct subsequent reviews at the

Contractor’s site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days’ notice to the Contractor.

2. Compliance to NIST 800-171

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev.

1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

(1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

(4) Audit user privileges on at least an annual basis;

(5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or

NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

ii. INST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

(6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a

POAM for implementation which shall be evaluated by the Navy for risk acceptance.

(7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

3. Cyber Incident Response:

a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the

Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

b) Incident data shall be delivered in accordance with the Department of Defense Cyber

Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Me.... In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

c) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

4. Naval Criminal Investigative Service (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies.

5. NCIS/Industry Monitoring

a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval

Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type o device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.

7.0 TRAVEL

The Contractor shall travel in support of deliveries, test events, meetings and other efforts related to the performance of ISS-60 support. The Contractor shall provide a trip report IAW CDRL

A024, for all travel associated with this task and deliver to the Government within 14 business days after completion of the trip.

All Contractor travel shall be coordinated with and approved by the primary or alternate Contracting

Officer’s Representative (COR) prior to incurring travel expenses. The Contractor shall follow and adhere to the current Department of the Navy (DoN) travel policies. Representative annual travel is annotated in Table 2. Additional CONUS travel or slight variations to the Table 2 travel schedule may occur during the performance of this contract.

Note: A Request for Foreign Travel form shall be submitted for each traveler, in advance of the travel to initiate the release of a clearance message at least 40 days in advance of departure.

Table 2: Annual Travel

# Trips # People # Nights/Days From (Location) To (Location)

1 1 6/7 Contractor Facility Charleston, SC

5 2 4/5 Contractor Facility Stennis, MS

1 1 6/7 Contractor Facility Port Canaveral, FL

1 2 15/16 Contractor Facility Port Canaveral, FL

1 2 15/16 Contractor Facility Fort Lauderdale, FL

1 2 15/16 Contractor Facility Key West, FL

1 1 6/7 Contractor Facility Orange Beach, AL

2 1 6/7 Contractor Facility Lynnwood, WA

1 1 6/7 Contractor Facility Toronto, Ontario

3 1 6/7 Contractor Facility Norway

1 2 15/16 Contractor Facility Honolulu, HI

1 1 15/16 Contractor Facility Philippines

1 1 15/16 Contractor Facility Malta

1 2 15/16 Contractor Facility Singapore

1 1 7/8 Contractor Facility Greece

1 2 7/8 Contractor Facility Spain

A024: Trip/Travel Report (DI-MISC-81943)

8.0 PRIMARY PLACE(S) OF PERFORMANCE

Activities performed under this contract shall be performed at the Naval Oceanographic office

(NAVOCEANO), Stennis Space Center MS, forward deployed USNS T-AGS 60 class ships, Contractor’s site, or other locations deemed appropriate by the Government. The Government shall not incur any additional costs if the Contractor changes the location for convenience. Any changes to the locations must be mutually agreed upon by the Government and the Contractor.

The Government shall not incur any additional costs if the Contractor changes the location for convenience.

9.0 SECURITY REQUIREMENTS

The scope of the contract will be limited to SECRET. Performance of work will require access to classified data and computer resources within NAVOCEANO’s controlled workspaces and forward deployed USNS T-AGS 60 class ships. Contracting company must possess a facility clearance level (FCL) at time of contract award from Defense Counterintelligence Security

Agency (DCSA) at or above level of contract.

All contract personnel shall comply with the directives and policies established in DoD

5220.22-M “National Industrial Security Program, Operating Manual”, SECNAVINST

5510.30C “Personnel Security Program”, and SECNAVINST 5510.36B “DoN

Information Security Policy”.

All contractor employees performing services under this contract will be required hold and maintain a SECRET eligibility through a valid and current NACLC, Tier 3 (T3) or higher investigation in accordance with SECNAVINST 5510.30C at time of contract award.

Contractor employees will have access to NAVOCEANO’s classified and unclassified scientific network and Navy Marine Corps Intranet (NMCI) systems. All contractors require non-critical sensitive information access as defined in SECNAVINST 5510.30C.

All contract personnel shall complete applicable Information Assurance (IA) training, sign non-disclosure agreements, and complete System Authorization Access Request

Navy (SAAR-N) forms before accessing any Navy Information Technology resources.

All training and documentations shall be forwarded to the COR immediately upon assignment. Failure to provide the required documentation shall result in delaying the individual’s start date.

The contractor shall ensure the required security training, security application paperwork, and system access requests for all new employees are submitted to NAVOCEANO in sufficient time such the required facility and system access credentials can be provided by NAVOCEANO prior to the contractor reporting to the facility.

All contract personnel shall in-process with the Navy Command’s Security Manager and

Information System Security Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

All information, products delivered, or services performed may not be disclosed by any means without prior approval of the authorized COR. Dissemination or public disclosure includes, but is not limited to, permitting access to such information by foreign nationals or other person or entity; publication of technical or scientific papers; advertising and or other proposed public release.

The potential consequence for failing to meet any of the requirements listed above includes a determination on untrustworthiness and denial of access for the proposed contractor employee. Failure to obtain a favorable trustworthiness determination in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees for working in non-sensitive positions, with sensitive information, and/or on Government IT systems. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have physical access to a federally controlled facility and/or access to a federally-controlled information system/network and/or access to Government information.

Physical Security: The contractor shall be responsible for safeguarding all government property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

10.0 OPERATIONS SECURITY (OPSEC) REQUIREMENTS

Security programs are oriented towards protection of classified information and material.

Operations Security (OPSEC) is an operations function, which involves the protection of any critical information – focusing on unclassified information that may be susceptible to adversary exploitation. Note: OPSEC requirements are applicable when contractor personnel have access to unclassified Critical Program Information (CPI), controlled unclassified information (CUI) or

Department of Navy (DoN) networks.

Local and Internal OPSEC Requirement

Contractor personnel, including subcontractors if applicable, shall adhere to the OPSEC program policies and practices as cited in the Naval Oceanographic Office OPSEC plan, NAVOCEANOINST 3070.2F and existing local site OPSEC procedures. The Contractor shall ensure their own internal OPSEC program aligns with NAVOCEANO OPSEC requirements. The Contractor’s program shall identify the current Contractor site OPSEC

Officer/Coordinator/Point of Contact.

OPSEC Training

The Contractor shall track and ensure applicable personnel receive initial and annual OPSEC awareness training. Training may be provided by the Government or by the Contractor’s

OPSEC Officer. Contractor training shall include, at a minimum, cover OPSEC as it relates to contract work; discuss the Critical Information applicable in the contract; applicable review of

Government Critical Information and Indicators List(s) (CIIL); social media awareness and vulnerabilities; local threats; how to protect, transmit and destroy controlled unclassified information; risks and guidance pertaining to geolocation-capable devices, applications, and services; and OPSEC review procedures for public release. The Contractor shall ensure that training materials produced by the Contractor shall be reviewed by the NAVOCEANO Officer if requested, who will ensure it is consistent with NAVOCEANO OPSEC plan. OPSEC training requirements are applicable for personnel during their entire term supporting NAVOCEANO contracts and for the duration of DoN network access.

NAVOCEANO OPSEC Program

If required, the Contractor shall participate in NAVOCEANO OPSEC program briefings and working meetings and complete any required OPSEC survey or data call within the timeframe specified.

11.0 GOVERNMENT FURNISHED PROPERTY (GFP)

Government Furnished Equipment (GFE)

Government Furnished Equipment (GFE) includes Property, Plant and Equipment (PP&E)

(equipment, machine tools, test equipment, etc.), Special Test Equipment (STE), and Special

Tooling (ST). GFE to be provided to the Contractor shall consist of equipment identified in the

Scheduled Government Furnished Property (SGFP) Form. All GFE will be provided within 30 days after contract award, see GFE/GFI inventory list. All material provided by the Government shall be returned to designated Government spaces after completion of the contract. The Government will provide the property listed in Attachment 5 to the solicitation in an "as is" condition. After receipt of

GFE, the Contractor shall update and complete all information listed in the SGFP/RGFP and return any revisions to the COR within seven (7) days of receipt. The Contractor shall also update the

Wide Area Workflow (WAWF) GFP property module to receive property transfer. The COR will upload the SGFP/RGFP form(s) to Electronic Document Access (EDA).

A full list of GFE is included as Attachment 5 to the solicitation.

Government Furnished Information (GFI)

Government Furnished Information (GFI) includes any information owned by the authority and/or third party owned information provided by the authority to the prime Contractor to facilitate performance of the contract. The Contractor shall use online sources to obtain copies of any necessary documentation needed for performance on this contract. For those documents not available online, the Government will provide the following GFI listed in Table 4 below as well as the identified software in the GFE Inventory List. The contractor shall use the GFI provided only to support this contract – use of GFI document(s) to support other projects beyond this contract is not allowed. Unless otherwise specified, all GFI will be provided by the Government by the estimated delivery date listed in the table below and the Contractor shall return all GFI to the Government at completion of the contract. Note: If a Contractor requires additional GFI other than what is listed, the Contractor shall submit a request to the COR within 30 days after contract award.

Table 3: Government Furnished Information

Item

Description GFI Estimated Delivery Date

1.

ISS-60: Software Version Description (SVD)

Version 3.X

14 Days After Contract Award

(DACA)

2. ISS-60: Software User Manual (SUM) Version 3.X 14 DACA

3. ISS-60: Software Test Manual (STM) Version 3.X 14 DACA

4.

ISS-60: Software Requirements Specification (SRS)

Version 3.X

14 DACA

5.

ISS-60: Software Maintenance Manual (SMM)

Version 3.X

14 DACA

6.

ISS-60: Software Design Description (SDD)

Version 3.X

14 DACA

7.

ISS-60: Interface Control Document (ICD) Version

3.X

14 DACA

8. ISS-60 Source Code Version 3.X 14 DACA

12.0 TECHNICAL ASSISTANCE AGREEMENT (TAA)

The Contractor shall obtain a Technical Assistance Agreement (TAA) with foreign businesses as part of the International Traffic in Arms Regulations (ITAR) within 6 months after contract award. Part 120 from the ITAR defines the TAA as a means for the disclosure of regulated technical data. The foreign businesses include the following:

Kongsberg Underwater Technology, LLC

13.0 PERFORMANCE BASED CRITERIA

Performance Requirement

The Contractor’s performance shall meet all of the requirements of this PWS and comply with all applicable guidelines, directives, and standards. The Contractor shall deliver all contract data items IAW the authorities, content, format, media, marking, application, quantities, frequency and submission date, delivery method, addressee, and requirements specified in the CDRL, DD

Form 1423.

Method of Surveillance

The Government will monitor and assess the Contractor’s performance against the Acceptable

Quality Level IAW this contract’s Quality Assurance Surveillance Plan (QASP).

14.0 MISCELLANEOUS

LIABILITY INSURANCE – FIXED PRICE CONTRACTS

(a) The following types of insurance are required in accordance with the FAR 52.228-5 “Insurance—Work on a

Government Installation” clause and shall be maintained in the minimum amounts shown:

(1) Workers’ compensation and employers’ liability: minimum of $100,000

(2) Comprehensive general liability: $500,000 per occurrence

(3) Automobile liability: $200,000 per person

$500,000 per occurrence

$ 20,000 per occurrence for property damage

(b) Upon notification of contract award, the contractor shall furnish to the Contracting Officer, as required by paragraph (b) of the FAR 52.228-5 “Insurance—Work on a Government Installation” clause, a certificate or written statement of insurance prior to commencement of work under this contract. The written statement of insurance must contain the following information: policy number, policyholder, carrier, amount of coverage, dates of effectiveness (i.e., performance period), and contract number. The contract number shall be cited on the certificate of insurance.

Table 4: CDRL Table

CDRL Para CDRL Title DID Subtitle

A001 4.1 Contractor’s Progress, Status and Management Report DI-MGMT-80227

A002 4.1.1, 4.1.2 Presentation Material DI-ADMN-81373

A003 4.1.1, 4.1.2 Conference Agenda DI-ADMN-81249B

A004 4.1.1, 4.1.2, 4.1.3 Report, Record of Meeting / Minutes DI-ADMN-81505

A005 4.2 Configuration Management Plan (CMP) DI-SESS-81875

A006 4.3 Contractor Engineering Program Plan DI-SESS-82195

A007 4.3.1 Computer Software Product DI-IPSC-81488 ISS-60 Source Code Versions 3.x

A008 4.3.1 Software Development Plan (SDP) DI-IPSC-81427B

A009 4.3.1 Software Design Description (SDD) DI-MISC-80508B

A010 4.3.1 Revisions to Existing Government Documents DI-ADMN-80925A Software Maintenance Manual (SMM)

A011 4.3.1

Interface Control Document (ICD)

DI-SESS-81248B

A012 4.3.1 Revisions to Existing Government Documents DI-ADMN-80925A Software Test Manual (STM)

A013 4.3.1 Software User Manual (SUM) DI-IPSC-81443A

A014 4.3.1 Software Version Description (SVD) DI-IPSC-81442A Operations Training

A015 4.3.1 Software Requirements Specification (SRS) DI-IPSC-81433A

A016 4.3.1 Software Development Process Description Document (SDPDD) DI-IPSC-82208

A017 4.3.3 Revisions to Existing Government Documents…