SOW Vulnerability and Hardening Engineering Services_2.25.2020.pdf

DRAFT Statement of Work (SOW)

1.0 Background

The Survivability and Weapons Effects Division (Code 66) has been developing and utilizing computer programs to assess the vulnerability of ships over the last 40 years. Naval Surface Warfare Center, Carderock Division (NSWCCD) has developed computer software for the purpose of Modeling & Simulation (M&S) to assess weapons effects and ship vulnerability including the Ship Vulnerability Model (SVM), Ultimate Strength (ULTSTR) and HULLWHIP, which is part of SVM. Weapons effects modeled include fragments and blast from proximity and internal bursts of conventional weapons; shock, whipping, impact and penetration from underwater weapons;

penetration from air delivered threats such as Anti-Ship Cruise Missiles (ASCMs); various kinetic and chemical energy penetrators; and air blast, thermal and shock from nuclear weapons. A common thread in conducting vulnerability assessments for various weapon effects is the use of Government owned and developed computer software for modeling ship description and damage prediction. SVM is a legacy tool accredited by the NAVSEA technical authority for the vulnerability assessment of aircraft carriers. ULTSTR is another legacy tool developed to perform structural analyses of ships while under longitudinal bending conditions. HULLWHIP is a legacy tool accredited by the NAVSEA Technical Warrant Holder for performing structural assessments of whipping loads against ship hulls.

2.0 Applicable Documents

The contractor shall follow the Ship Classification Guides (SCG) from NAVSEA 05P1 as follows:

1) SCG 03-053.1 of 30 August 2013, Ship Passive Protection Technology

2) SCG 03-139.1 of 02 September 2011, Carrier Protection Program

3) SCG 03-124.02 of 02 August 2016, CVN Passive Protection Systems

3.0 Requirements & Task Areas

The contractor shall provide weapons effects engineering and computer program development support to NSWCCD in support of CVN 78 Live Fire Test and Evaluation (LFT&E) efforts to include; Full Ship Shock Trial (FSST), Total Ship Survivability Trial (TSST), Survivability Assessment Report (SAR), Vulnerability Assessment Report (VAR) and Damage Scenario-Based Engineering Assessment (DSBEA). The work to be performed by the contractor shall include the following:

1) Maintenance, de-bugging and documentation of the existing SVM, ULTSTR and HULLWHIP software

2) Conduct vulnerability assessments of US Navy platforms using SVM, ULTSTR and HULLWHIP

3) Training on use of legacy vulnerability M&S software tools

4) Perform or support experimental studies of US Navy platforms

3.1: Regular Maintenance, Debugging and Documentation of SVM, ULTSTR and

HULLWHIP (LEGACY) SOFTWARE

The contractor shall provide support for maintenance, debugging and documentation of the LEGACY software. Tasks shall include:

3.1.1 – The contractor shall provide maintenance of the LEGACY software to support changes in analysis modules that run within the software. This support shall include developing LEGACY software interfaces extensions, Target Description Files (TDF) extensions, Application Program Interfaces (APIs), TDF editor extensions, output graphics, and server extensions required to incorporate analysis module changes. The Contractor shall provide the updated software conveyed on the compatible magnetic media or network. The Contractor shall document changes to existing LEGACY software technical documentation, user manuals, software tooltips, and help files where relevant.

The updated software shall adhere to generally accepted practices for explanatory comment lines in the software.

The Contractor shall provide a report in accordance with Contract Data Requirements List (CDRL_A002).

3.1.2 - The Contractor shall provide fixes to bugs found in the LEGACY software. Both the contractor/user and NSWCCD will submit bug reports with supporting examples to the Contractor, who shall fix the submitted bugs in the software. The Government will provide a facility for executing and testing of the LEGACY software and bug fixes. The Contractor shall provide the updated software conveyed on compatible magnetic media or network. The updated software shall adhere to generally accepted practices for explanatory comment lines in the software. The Contractor shall provide a report in accordance with CDRL_A003, which addresses each bug by documenting the problem and identifying the changes made to the software in order to resolve the issue.

3.2: Conduct Vulnerability Studies of US Navy Platforms Using SVM, ULTSTR and HULLWHIP The Contractor shall provide support towards the execution of the LEGACY software to conduct and document vulnerability analyses of US Navy platforms to include Nimitz and Ford Class aircraft carriers. Weapons effects shall include but not be limited to, air blast, thermal radiation, shock, underwater explosion bubble, shaped-charge jets, and fragments. Tasks shall include:

3.2.1 - The Contractor shall update the digitized descriptions of Navy platforms to include systems and equipment from the as-built ship, for input to the LEGACY software. The Contractor shall develop input data from GFI drawings, 3D product models, equipment descriptions, and system functional diagrams. The contractor shall be responsible for the accuracy of data they create. The Contractor shall provide the new digital products conveyed on compatible magnetic media or network and in accordance with CDRL_A002.

3.2.2 - The Contractor shall execute the LEGACY software to perform weapons effects analyses of US Navy platforms. The Contractor shall execute the software to model weapons effects phenomena and then provide the analytical results in a document for presentation and in accordance with CDRL_A004. The analytical results shall include hardening studies of ship components against weapons effects that will demonstrate design improvements to ship vulnerability. The Government will provide a facility for executing the LEGACY software. The finished vulnerability assessment products shall consist of the reports and the presentation materials that were pulled from the reports. These products will be conveyed on compatible magnetic media or network. (CDRL A004)

3.3: Training On Use Of Legacy Vulnerability M&S Tools The Contractor shall develop training materials and provide training on the execution of the legacy vulnerability M&S tools including SVM, ULTSTR and HULLWHIP (LEGACY) software to conduct vulnerability assessments of US Navy platforms to include Nimitz and Ford Class aircraft carriers. The training materials and training on M&S of weapons effects shall include but not be limited to; air blast, thermal radiation, shock, underwater explosion bubble, shaped-charge jets, and fragments. Tasks shall include:

3.3.1 - The Contractor shall develop vulnerability sections of the classified Weapons Effects Self Study course used in NSWCCD Code 6650 that are specific to aircraft carriers including (CDRL A005):

- Carrier Protection Designs for Underwater Explosion (UNDEX) and Air Explosion (AIREX) threats; Threat Descriptions, Damage Mechanisms, Protection of Critical Spaces, SURFEX protection, Protection Systems

- Carrier Damage Control (DC); Progressive Damage Mechanisms, Fire Protection, DC Operations, DC Systems, Flooding Control and Damage Stability

- Carrier Vulnerability Assessments and Quantification of Vulnerability; Description of Ship and Ship Systems, Deactivation Diagrams, Inactivation Probabilities, Component Kill Criteria, Damage Rules and Algorithms, Monte Carlo Procedures, Weapon Hit Distributions, Vulnerability Assessment Reports (VAR)

- Carrier Vulnerability Assessments with Legacy software; Program Architecture, Program Documentation, Description of Ship and Ship Systems, Deactivation Diagrams, Component Kill Criteria, Methodology for Software Execution

3.3.2 - The Contractor shall train up to 20 NSWCCD vulnerability analysts on the methodology for utilizing the Legacy software to conduct vulnerability analyses on US aircraft carriers as identified in the classified Weapons Effects Self Study course developed in task area 3.3.1. The training will be held in the Protection Analysis Center (PAC) located at NSWCCD. The Contractor will hold up to five training sessions, one per year, that will each last 1-3 days.

3.4: Perform or Support Experimental Studies of US Navy Platforms The Contractor shall provide support for experimental studies of US Navy platforms. The Contractor shall perform or support field hardening tests of US Navy ship structure, ship components, or personnel equipment under weapons effects to determine their vulnerability or to validate hardened designs. The testing shall occur at Aberdeen Test Center (ATC). The contractor shall support test planning documentation, target design and fabrication, target installation, instrumentation, recording, data analysis and reporting of test results. Documentation will be prepared in accordance with CDRL_A004, and these products will be conveyed on compatible magnetic media or network.

Hardening tests of US ship components that the contractor shall perform or support include: Full Ship Shock Trial (FSST), Large Vehicle Shock Testing at Aberdeen Test Center (ATC), Explosive Charge Characterization Testing, MIL-S-901D Shock Qualification Testing, Scaled Model Testing at the Explosive test pond at NSWCCD, Underwater Test Facility (UTF) and at sea. Support the explosive operations and instrumentation planning efforts to conduct Full Ship Shock Trials (FSST) on active Navy combatants at sea. These tests are conducted to ensure the navy combatants design survives potential threats. Support the execution of system shock qualification test series on the Submersible Shock Test Vehicle (SSTV), FSS-8L, Large Floating Shock Platform (LFSP), Floating Shock Platform (FSP), and Paddlewheel Test Vehicle (PWTV). For these tests it includes instrumentation and explosive operations support. This testing is conducted to ensure the equipment survivability level meets the system requirements set by the Navy. Support UNDEX research and development testing to further understand the underwater explosion phenomena to include both explosive and instrumentation planning.

4.0 Travel

Travel shall be required to accomplish the contract objectives. Travel requirements will be provided in the orders. It is anticipated that the contractor will be requirement to travel to HII Shipyard in Newport News VA; ATC in Aberdeen, MD; or other contractor facilities for progress meetings and other support services as defined by the individual order(s).

5.0 Deliverables

The contractor shall deliver all Contract Data Requirements Lists (CDRLs) in accordance with Section B and J of this order.

6.0 Place of Performance

The primary place of performance shall be at NSWCCD facilities or as specified in individual task orders.

7.0 Government Furnished Information

The Government will provide the GFI as specified at the order level.

8.0 Period of Performance

The proposed contract shall have an ordering period of five years from the effective date of contract award.

9.0 Government Points of Contact

The Contracting Officer’s Representative (COR) is Justin Wagner. The Technical Point of Contact (TPOC) will be specified under each individual task order.

10.0 Security

The contractor shall comply with the requirements of the DD Form 254 specified in Attachment 1 of Section J.

11.0 Contractor Personnel Identification

In performance of this contract, contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and by displaying distinguishing badges or other visible identification for meetings, with Government personnel. Contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and formal and informal written correspondence.

12.0 Personnel

Each offeror shall base his labor costs on personnel fitting the following labor categories. Some contractor personnel for all labor categories must be cleared at the SECRET LEVEL, however several personnel including the Project Manager/Principal Engineer, must be cleared at the TOP SECRET LEVEL. All contractors working under this contract shall be U.S. citizens. The following table summarizes the labor categories and estimated hours per year:

12.1 Personnel

The following personnel categories are expected for the performance of this contract:

Hours Per Year eCRAFT Code Site

Key Personnel Program Manager/ Project Engineer

III

1,300 MANP3 NSWCCD

Senior Scientist III 300 S3 NSWCCD Senior Engineer IV 1,880 E4 NSWCCD Senior Computer Programmer II 1,880 14073 NSWCCD

Non-Key Personnel Junior Engineer III 1,880 E3 NSWCCD Engineer Technician IIII 1,880 30083 NSWCCD Total 9,150

13.0 Transferring Classified Data

The contractor shall ensure that personnel transferring classified data to removable media have the proper training and approval to perform Media Transfer Agent functions in accordance with CARDEROCKDIVINST 5510.12. The contractor shall ensure that personnel designated as Media Transfer Agents have the appropriate security clearance in accordance with the attached DD Form 254 Contract Security Classification Specification.

14.0 Information Security and Computer System Usage

In accordance with U.S. Navy policy, any personnel, including the Contractor, who utilizes DOD-owned systems, shall assume responsibility for adherence to restrictions regarding internet and e-mail usage. Navy policy prohibits racist, sexist, threatening, pornographic, personal business, subversive, or politically partisan communications. All personnel, including the Contractor, are accountable and must act accordingly. DOD computer systems are monitored to ensure that the use is authorized, to facilitate protection against unauthorized access, and to verify security procedures, survivability and operational security. During monitoring, information may be examined, recorded, copied, and used for authorized purposes. All information, including personal information, placed on or sent over a DOD system may be monitored. Use of a DOD system constitutes consent to monitoring. Unauthorized use may result in criminal prosecution. Evidence of unauthorized use collected during monitoring may be used as a basis for recommended administrative, criminal, or other adverse action.

15.0 Electronic Spillages

Electronic spillages (ES) are unacceptable and pose a risk to national security. An electronic spillage is defined as classified data placed on an information system (IS), media, or hardcopy document possessing insufficient security controls to protect the data at the required classification level, thus posing a risk to national security (e.g. sensitive compartmented information (SCI) onto collateral, Secret onto Unclassified, etc.). The contractor's performance as it relates to ES will be evaluated by the Government. Electronic spillage reflects on the overall security posture of the Government and demonstrates a lack of attention to detail with regard to the handling of classified information of IS security discipline. In the event that the Government determines the contractor is responsible for an electronic spillage, all direct and indirect costs incurred by the Government for electronic spillage remediation will be charged to the contractor. The incidence will be reflected in the contractor’s performance rating.

NSWCCD command security will be responsible for the corrective action plan in accordance with the security guidance reflected on the DD Form 254 Department of Defense Contract Security Classification Specification.

Command security will identify the Contractor facility and contract number associated with all electronic spillages during the investigation that involve Contractor support. Command security will notify the contracts division of the Contractor facility name and contract number, incident specifics, and associated costs for cleanup. The Contractor shall assist the PCO as the PCO deems necessary to capture the costs of the spillage cleanup. The Contractor shall take Information Security Awareness training annually via their Facility Security Officer (FSO) as part of the mandatory training requirements. If a spillage occurs additional training will be required to prevent recurrence.

16.0 Portable Electronic Devices

The contractor shall comply with Naval Sea Systems Command (NAVSEA) Instruction (NAVSEAINST) 2200.1, NAVSEANOTE 2200, and CARDEROCKDIVINST 5239.6B.

17.0 Contractor Personnel Identification

The contractor shall obtain identification badges from the Government for all contractor personnel requiring regular access to Government property. The identification badge shall be visible at all times while employees are on Government property. The contractor shall furnish all requested information required to facilitate issuance of identification badges and shall conform to applicable regulations concerning the use and possession of the badges.

The contractor shall ensure that all identification badges issued to contractor employees are returned to the appropriate Security Office within 48 hours following completion of the task order, relocation, or termination of an employee or upon request by the PCO. All contractor personnel shall identify their company affiliation when answering or making telephone calls and sending e-mail and when attending meetings relating to the performance of this contract.

18.0 Common Access Card (CAC)/Public Key Infrastructure (PKI) Contractor personnel assigned to perform work under this contract may require access to Navy Information Technology (IT) resources (e.g., computers, laptops, personal electronic devices/personal digital assistants (PEDs/PDAs), NMCI, RDT&E networks, and Navy Web servers requiring Common Access Card (CAC) Public Key Infrastructure (PKI)).

Contractor personnel (prime, subcontractor, consultants, and temporary employees) requiring access to Navy IT resources shall submit a completed System Authorization Access Request Navy (SAAR-N), OPNAV 5239/14 (Rev 9/2011) form or latest version thereof, and have initiated the requisite background investigation (or provide proof of a current background investigation) prior to accessing any Navy IT resources. The contractor shall submit SAAR-N forms to the COR via the contractor's Facility Security Officer (FSO). For those contractors that do not have an FSO, SAAR-N forms shall be submitted directly to the COR or designated SAAR-N Government Sponsor. Copies of the approved SAAR-N forms may be obtained through the COR/ACOR or designated SAAR-N Government Sponsor.

In order to gain and/or maintain access to Navy IT resources, the contractor shall ensure completion of initial and annual IA training, monitor expiration of requisite background investigations, and initiate re-investigations as required. If requested, the contractor shall provide to the COR or designated SAAR-N Government Sponsor documentation sufficient to prove that it is monitoring/tracking the SAAR-N requirements for its employees who are accessing Navy IT resources. For those contractor personnel not in compliance with the requirements of this clause, access to Navy IT resources will be denied or revoked.

19.0 Non-Personal Services/Inherently Governmental Functions

The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. The Government will not direct the hiring, dismissal or reassignment of contractor personnel. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception that personal services are being provided. If the contractor feels that any actions constitute or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the PCO immediately in accordance with FAR clause 52.243-7 Notification of Changes.

Inherently Governmental functions are not within the scope of this task order. Decisions relative to programs supported by the Contractor shall be the sole responsibility of the Government. The Contractor may be required to attend technical meetings for the Government; however, they are not under any circumstances, authorized to represent the Government or give the appearance that they are doing so.

20.0 Enterprise-Wide Contractor Manpower Reporting Application (ECMRA) The contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for NSWCCD via a secure data collection site. Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities;

(4) D, Automatic Data Processing and Telecommunications, IT and Telecom-Telecommunications Transmission (D304) and Internet (D322) ONLY;

(5) S, Utilities ONLY;

(6) V, Freight and Shipping ONLY.

The contractor is required to completely fill in all required data fields using the following web address https://www.ecmra.mil.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://www.ecmra.mil.

21.0 Electronic Cost Reporting and Financial Tracking (eCRAFT) system

(a) The Contractor agrees to upload the Contractor's Funds and Man-hour Expenditure Reports in the Electronic Cost Reporting and Financial Tracking (eCRAFT) System and submit the Contractor’s Performance

Report on the day and for the same timeframe the contractor submits an invoice into the Wide Area Workflow (WAWF) module on the Procurement Integrated Enterprise Environment (PIEE) system. Compliance with this requirement is a material requirement of this contract. Failure to comply with this requirement may result in contract termination.

(b) The Contract Status Report indicates the progress of work and the status of the program and of all assigned tasks. It informs the Government of existing or potential problem areas.

(c) The Contractor's Funds and Man-hour Expenditure Report reports contractor expenditures for labor, materials, travel, subcontractor usage, and other contract charges.

(1) Access:

eCRAFT: Reports are uploaded through the eCRAFT System Periodic Report Utility (EPRU). The EPRU spreadsheet and user manual can be obtained at: http://www.navsea.navy.mil/Home/Warfare-Centers/NUWC- Newport/Partnerships/Commercial-Contracts/Information-eCraft-/ under eCRAFT information. The link for eCRAFT report submission is: https://www.pdrep.csd.disa.mil/pdrep_files/other/ecraft.htm. If you have problems uploading reports, please see the Frequently Asked Questions at the site address above.

(2) Submission and Acceptance/Rejection:

The contractor shall submit their reports on the same day and for the same timeframe the contractor submits an invoice in WAWF. The amounts shall be the same. eCRAFT acceptance/rejection will be indicated by e-mail notification from eCRAFT.

22. Cyberspace IT/Cybersecurity Workforce (CSWF) Program In accordance with Department of Defense (DoD) 8570.01-M, Information Assurance Workforce Improvement Program, Incorporating Change 4, 10 November 2015, all contractor personnel performing Cyberspace IT\Cybersecurity Workforce (CSWF) functions must be designated (in writing) as a member of the DoD CSWF program and meet qualification requirements for their duties.

The CSWF qualifications applicable to each labor category, and when such qualifications must be met or achieved, are referenced in the DoD 8570.01-M. After award, but prior to beginning performance, the Contractor shall provide the following information to the COR for all of the personnel (both Key and Non-Key) that the Contractor intends to assign to perform under this TO:

Personnel’s name Personnel’s assigned labor category and CSWF Information Assurance Technical (IAT) or Information

Assurance Management (IAM) level (i.e. IAT or IAM I, II, or III).

All qualifications (CSWF baseline certification, privileged access OS/CE training certificate of completion, Continuous Learning, and Privileged Access Agreement - PAA form) that each personnel possesses establishing that they meet the minimum requirements for their assigned CSWF IAT/IAM level and labor category.

The Contactor shall be responsible for ensuring all contractor personnel performing under this TO continue to meet all qualification requirements during performance, and do not allow certifications or other credentials to lapse during TO performance. At all times during performance of the TO the Contractor shall be responsible for tracking the qualification status and maintenance of all contractor personnel, and, upon the Government’s request, shall provide documentation of the same to the COR.

Following initial receipt and verification of the above information, the Government will issue a Designation Letter to each contractor CSWF personnel, unless the Government questions the qualifications or suitability of the

Contractor’s proposed contractor CSWF personnel. The Designation Letter will confirm that the Government has verified that the contractor CSWF personnel has the qualifications required for the labor category in which the contractor CSWF personnel will provide services and will authorize access to the Department of the Navy Information System(s) (DON IS(s)) necessary for them to perform duties under this contract. This Designation Letter does not in any way create an independent or separate contract or agreement between the contractor CSWF personnel and the Government, nor does it authorize contractor CSWF personnel to perform any actions that are inherently governmental in nature.

If the Contractor replaces any contractor CSWF personnel at any time during the performance of this TO, in addition to any other contractual requirements regarding substitution of personnel, the Contractor shall notify the COR of the personnel change in writing, and comply with the above instructions for the replacement personnel.

CSWF Qualifications – All contractor CSWF personnel must meet and sustain the qualification requirements for their duties in accordance with DoD 8570.01-M. The Contractor shall not provide any personnel who do not meet the minimum CSWF qualification requirements for the functions they will perform.

The Contractor shall notify the COR if any contractor CSWF personnel fails to obtain or maintain any CSWF qualification(s) during TO performance and replace such personnel as directed by the COR or Contracting Officer.

Upon request, the Contractor shall provide evidence to the COR documenting that its personnel have all necessary certifications and qualifications and have met all continuous learning requirements, including requirements for certification(s), certification maintenance, and proof of continuing education and/or sustainment training required for CSWF functional responsibilities.

The Contractor shall not invoice the Government for any services provided by any contractor CSWF personnel during any time such personnel do not meet and maintain all CSWF requirements without explicit written permission from the Contracting Officer to do so.

CSWF Baseline Certification – The baseline certification is a computer security certification and is required for all CSWF members. Contractors must have an approved baseline certification prior to performing any CSWF duties and this baseline certification is a condition of hire.

Privileged Access – All contractor personnel performing functions under this TO requiring privileged access, as defined in DoD 8570.01-M, must complete a Privileged Access Agreement form and meet the training/certification requirements for each OS and/or CE for which they have privileged access.

All contractor CSWF personnel who perform privileged access services on DON IS(s) under this TO are required to have a satisfactorily adjudicated security clearance, including a T5 investigation, and may be subject to random polygraph examinations.

Continuing Learning Requirements (CLR) – Per DoD 8570.01-M, all personnel performing CSWF functions, including contractor personnel, are required to participate in at least 40 hours of continuous learning per year. This requirement is separate from any CLR necessary for certification and qualification maintenance, although continuous learning hours obtained in the course of qualification or certification maintenance may be counted towards the annual 40 hour CLR. The Contractor is responsible for tracking that its personnel performing CSWF functions under this TO achieve the required 40 hours of continuous learning. The costs required for contractor personnel to meet CLR, to otherwise maintain a specific expertise or commercial certification, or for any other training requirements are not a direct Contractor cost to the Government. The Contractor shall not invoice or charge the Government for training costs, certification tests, or other expenses related to its personnel’s CLR, certifications, or other training.

Termination of Access – Contractor CSWF personnel’s access to, and authorization to perform functions on, DON IS(s) shall be terminated upon the end of TO performance or upon any of the following conditions:

The personnel fails to maintain the CSWF qualifications for the labor category in which the personnel is performing under this TO;

The personnel is no longer performing under this TO;

The personnel is no longer performing CSWF functions under this TO; or For any reason determined by the Government.