20250206_Vessel Architecture Draft PWS.docx

PERFORMANCE WORK STATEMENT

FOR MILITARY SURFACE DEPLOYMENT AND DISTRIBUTION COMMAND (SDDC)

“Vessel Architecture”

06 February 2025

Table of Contents

1.0 BACKGROUND

The Department of Defense (DoD) relies heavily on efficient and effective transportation planning, particularly for the deployment and distribution of forces and equipment. Vessel Architecture is paramount to the success of the Integrated Computerized Deployment System (ICODES) Program. Accurate vessel data is critical to the development and sustainment of the ICODES vessel library used by all DoD vessel load planners. The system provides users the ability to support staging, conveyance load planning, and multi-modal planning across various military and commercial transportation modes, during both peacetime and wartime operations.

The Military Surface Deployment and Distribution Command (SDDC) requires the specialized expertise of a Marine Engineering Organization (MEO) to develop, maintain, and update vessel data for designated ships within the Military Sealift Command Core Fleet, Navy/U.S. Marine Corp Fleet, Foreign Flag, and Commercial Dry Cargo Ships. For the remainder of this document, the contractor shall be referred to as MEO. The MEO plays a critical role in ensuring the accuracy, completeness, and currency of the ICODES vessel library, which is utilized by DoD vessel load planners across the Services. This includes:

· Developing, validating, and maintaining a comprehensive vessel database. This database will house vital technical design specifications, cargo compartment layouts, and other relevant data for all designated vessels.

· Surveying vessels to acquire detailed drawings and data files. This hands-on approach ensures the accuracy and detail of the information incorporated into the ICODES software.

· Providing expertise in vessel trim, stress, and stability. This specialized knowledge is essential for safe and efficient load planning.

· Demonstrating a deep understanding of ship characteristics, drawings, and load planning requirements. This includes familiarity with various vessel types (roll-on roll-off (RORO), lift-on lift-off (LOLO), specialized) and their unique cargo stowage considerations.

The ICODES PMO is responsible for the overarching management of the ICODES program and associated sustainment of the ICODES Vessel Library, which includes the following activities:

· Vessel Requirements: Management of ICODES functional and data requirements for ICODES Vessels as determined by the ICODES Configuration Control Board (CCB).

· Implementation Approval: Receipt and approval of Vessel Create or Update Requests and the associated request forms and Government-internal activities.

· Requesting POCs: Identification of Requesting Points of Contact (POCs) to obtain Vessel Information and coordinate vessel surveys as needed.

· Release Approval: Final release approval of new and updated ICODES Production Vessels for access and operational application by the ICODES user community at large

2.0 SCOPE OF WORK

The contract shall serve as a vehicle to provide technical support services to the ICODES Program Management Office (PMO) for the development, maintenance, and updating of vessel data and conveyance models for ships and watercraft in the ICODES Vessel Library.

The PWS includes the following task areas:

· CONTRACT LEVEL & PROJECT MANAGEMENT

· SUSTAINMENT

· INFORMATION ASSURANCE

· CONTRACT TRANSITION (OPTIONAL)

The Contracting Officer (CO) and Contracting Officer Representative/Alternate Contracting Officer Representative (COR/ACOR) are the points of contact regarding decisions on Government requirements and priorities. Unless otherwise specified in this PWS, all days designated are business days.

3.0 GENERAL TASKS

3.1 TASK AREA 1 – CONTRACT LEVEL & PROJECT MANAGEMENT

This task area consists of the functional activities relating to the administration and management of this effort. The MEO shall provide project management and oversight of all projects and tasks within the scope of this contract and shall provide and prepare documents such as point papers, briefings, and meeting minutes related to the status and performance of projects.

3.1.1 QUARTERLY STATUS REPORT

The MEO shall provide a Quarterly Status Report (QSR), expected to be a high-level executive summary, no more than two pages with attachments as required. QSRs shall be provided to the COR/ACOR no later than (NLT) the first business day in January, April, July, and October of each year. The QSR shall describe the technical approach and management controls employed to meet the cost, performance, and schedule requirements throughout contract execution. The MEO shall prepare and sustain a milestone schedule created in Microsoft Project that defines all tasks, durations, timelines, resources, and dependencies for all projects worked on this contract as part of the QSR. The milestone schedule shall be maintained and kept up to date to identify all in-progress and planned projects and tasks as they progress to completion. The contractor shall ensure the schedule includes each of the lowest level tasks (not exceeding four-week durations) to include those being dependent on the start or finish of another task. The schedule shall reflect the MEO’s most realistic timelines to synchronize other SDDC efforts.

The QSR shall contain the milestone schedule as described above, and shall also contain the following:

· A brief synopsis of the efforts completed, deliverables provided, conference/trips conducted or attended during the reporting period.

· Risk assessment and mitigation recommendations.

· Proposed activities NOT included in the milestone schedule.

· Actual and projected other direct cost (ODC) expenditures.

· Actual travel expenses

3.1.2 MONTHLY PROGRAM MANAGEMENT REVIEW

The contractor shall participate in monthly Program Management Reviews (PMRs) that typically lasts one to two hours. The MEO shall present status, progress, recommendations, concerns, travel, and hands on functional review for mature capability in the development of any tasks or documentation described within this PWS. The PMR shall provide prior PMR actions item updates, new action items, record discussion activity, decisions made, date, locations, attendees, and a copy of the presentation slides used. The MEO shall provide the draft PMR slides to the ICODES contractor, COR and Government Program Manager (PM) NLT five (5) business days prior to the meeting. The MEO shall provide final slides, to include the milestone schedule, at the scheduled meeting.

3.1.3 TRIP REPORT

The MEO shall submit trip reports to the COR/ACOR NLT five (5) business days upon completion of travel. Trip reports shall include the following: traveler’s name, trip purpose, location, length of trip, individuals contacted during trip, synopsis of all discussions, future actions identified, decisions made, and/or issues of concern arising during trip. Travel may be required within the Continental United States (CONUS) and Outside Continental United States (OCONUS). OCONUS trips are not currently planned or anticipated. However, MEO personnel must be prepared to travel OCONUS should the need arise.

3.1.4 EMPLOYMENT STATUS REPORT

The MEO shall ensure all personnel assigned to this contract meet the minimum requirements specified in the contractor’s proposal, in accordance with (IAW) the generic position descriptions provided in the MEO’s proposal. The MEO shall provide an initial Employment Status Report (ESR) (listing/spreadsheet) containing names and labor categories of personnel supporting the tasks identified in the PWS NLT 30 business days after contract start date. The MEO shall notify the COR with updates to the ESR NLT three (3) business days after information is known.

3.1.5 CONVEYANCE TRACKER

The MEO shall provide monthly status updates on MEO tasks for the individual Vessel Create or Update Requests in the Conveyance Tracker table, that is maintained by the ICODES PMO, ICODES Contractor, and MEO, NLT five (5) business days prior to the monthly PMR. The MEO will support other contractors and government personnel in using the Conveyance Tracker to brief the status of outstanding Vessel Create or Update Requests during the monthly PMR meetings.

3.2 TASK AREA 2 – VESSEL LIBRARY SUSTAINMENT

The ICODES Vessel library contains the detailed computer models of the ships and watercraft that can be selected in ICODES to create load plans and associated transportation documentation (e.g., manifests and ships papers). It is a subset of the ICODES Conveyance library which additionally includes ICODES conveyance models for aircraft and railcars.

The MEO shall create and update ICODES Drawings and Trim and Stability (T&S) data in response to Government-approved Vessel Create or Update Requests. These drawings and data are processed by the ICODES Contractor to produce the objectified computer models that the ICODES application uses upon ICODES PMO approval.

See Figure 1 below for depiction of associated process diagram.

Figure1: Vessel Library Sustainment Process Diagram

3.2.1 MEO RESPONSIBILITIES

The MEO is responsible for the marine engineering efforts in support of the ICODES Vessel Library sustainment, which includes the following activities:

· Vessel Information: Gather Vessel Information from ICODES PMO-provided Vessel POCs as needed.

· Vessel Surveys: Coordinate and perform vessel surveys as needed.

· Vessel Data Capture: Identify and capture vessel aspects pertinent to stow planning to create an AutoCAD drawing of the vessel in the ICODES Drawing format provided in Appendix F.

· Trim and Stability Data: Create and validate Trim and Stability (T&S) Data Files for ICODES Vessels as defined in Appendix Fusing an American Bureau of Shipping (ABS)-accredited MEO.

· Conveyance Tracker: Provide monthly status updates IAW paragraph 3.1.5 of this document.

3.2.2 NEW VESSEL CREATION PROCEDURE/VESSEL ENGINEERING

3.2.2.1 DELIVERY OF LOE AND TIMELINE PLAN

The MEO shall document and deliver to the ICODES PMO the estimated level of effort (LOE) to perform all their tasks and the estimated timeline to complete the initial ICODES Drawing and T&S Data deliverables NLT 15 business days after vessel update or creation is requested by the PMO. The MEO shall provide the PMO with up-to-date information pertaining to any changes relevant to submitted LOE / Timeline Plan NLT five (5) business days after discovery.

3.2.2.2 GATHER VESSEL INFORMATION

The MEO shall gather and review Vessel Information provided by the Vessel POCs and collaborate with them directly to obtain additional information and answer questions as needed.

3.2.2.3 SURVEYING OF VESSEL

The MEO shall arrange shipboard visits with the Vessel POC to perform ICODES Vessel Surveys. The ICODES Vessel Survey focuses on documenting the vessel layout and characteristics that affect Roll-on Roll-off (RORO) and Lift-on Lift-off (LOLO) cargo stow planning, transportation documentation requirements (e.g., manifests), vessel aspects specifically needed by the ICODES application functionality, or of particular interest to the ICODES user community. The MEO shall deliver a Trip Report to the ICODES PMO to conclude the Survey Vessel task. Appendix C provides an example Trip Report for a Vessel Survey.

3.2.2.4 CREATE ICODES DRAWING

The MEO shall use the Vessel Information and survey results to create an AutoCAD drawing of the vessel in the ICODES Drawing format described in Appendix E The ICODES Drawing uses predefined layers to unambiguously document the structural and functional details of the vessel that are applicable to stow planning. The MEO shall deliver the PMO an AutoCAD drawing in the ICODES drawing format with delivery of new or updated vessels.

3.2.2.5 CREATION OF TRIM & STABILITY (T&S) DATA

The MEO shall use the ICODES Drawing and Vessel Information to create T&S Data Files in the format described in Appendix F.

The T&S Data is provided to the MEO via an SDA or SH2 file formats derived from the CargoMAX vessel model. The MEO shall be responsible for validating the T&S Data that they create directly in ICODES, by ensuring general agreement with the CargoMax system of record.

The ICODES SDA/SH2 DATA EXPORT FILES DESIGN SPECIFICATION document defines the format of the ICODES T&S component files. This specification was designed with the latest approved update current as of 7 Oct 2015. This document describes the output file formats from the SDAExport decomposition program and the HECSALV 8.1 Ship Project Editor (SPE) SH2 file decomposition program that can be used to populate the ICODES ship data tables. These tools export the ten comma-delimited ASCII T&S component files that ICODES requires. The end of line characters (0Dh0Ah) can also end a data field. The first field of the first line of each file is always the ship name. The second field of the first line is a file type descriptor. The remaining records in the file all have the same format. If there is no data for a specific type of file, the decomposition program will create a file containing only the first record of the ship name and file descriptor.

The MEO shall generate the following files that are input into the ICODES automated processing pipeline together with the ICODES Drawings and Vessel Characteristics to generate an ICODES Production vessel:

· Tankage Definition

· Hydrostatic Table

· Tank Center of Gravity and Free Surface Tables

· Bonjean Area

· Longitudinal Strength

· Draft Mark Location Table

· Required GMT Curves

· Cargo Area Definition

· Stowage Area Definition The MEO shall provide ICODES Contractor validated T&S data via SDA/SH2 file with each delivery of new/updated vessels as required.

3.2.2.6 VESSEL VALIDATION

3.2.2.6.1 VALIDATE ENGINEERING IN ICODES

The MEO shall test the new vessel in ICODES using the associated Test Load Plan. This testing shall focus on the accuracy of the engineering aspects of the vessel model. As possible, this testing shall include validation of the T&S data to ensure ICODES calculations generally agree with the CargoMax system of record. This task may uncover issues that require modifications to the ICODES Drawing and/or T&S Data. If issues are discovered during testing the MEO will provide the required updates/modifications.

3.2.2.6.2 VALIDATION STAMP OF ICODES DRAWING

Once the representation of the ICODES Vessel is confirmed to be accurate and acceptable to the ICODES PMO and ICODES Vessel user representatives, the MEO shall place their Engineering Validation Stamp on the SHIP_NOTES layer of the ICODES Drawing along with the date. This indicates approval of the as-documented ICODES vessel representation from their engineering perspective and denotes the drawing’s correspondence with the physical vessel at the time of completion.

3.2.2.6.3 DELIVERY OF MEO-VALIDATED ICODES DRAWING

Upon ICODES PMO Release approval the MEO shall deliver NLT five (5) business days, the validated ICODES Drawing and final T&S data to the ICODES PMO and ICODES Contractor to initiate the Vessel Release phase.

3.2.2.7 DELIVERY OF MEO VESSEL REPORT

Upon ICODES PMO approval of the new ICODES Production Vessel the MEO shall create and deliver a MEO Vessel Report NLT 10 business days summarizing the activities they performed in executing the New Vessel Creation Procedure along with any findings (e.g., ICODES variances with Cargo Max T&S Calculation results) The MEO shall produce a Vessel Report that supports ICODES PMO invoicing by providing a brief description of the activities performed by the MEO and the associated FTEs consumed in executing individual Vessel Creation or Update Requests via the New Vessel Creation or Existing Vessel Update Procedures. The MEO will provide the Vessel Report NLT 10 business days after PMO vessel approval. The report should identify the following:

· Date of the report

· Version or age of the T&S source data

· Potential T&S issues and/or explain acceptable variances under prescribed tolerances and applications.

· Summary of MEO findings regarding physical vessel characteristics and ICODES model representation in relation to ICODES stow planning functions.

ICODES and CargoMax document aspects of a vessel’s representation based on their differing application requirements, but the overarching T&S model and calculation results should align.

3.2.2.8 CREATION OF ICODES DRAWINGS

The MEO shall utilize Vessel Information and Vessel Surveys to create ICODES Drawings. Previous ICODES Drawings from the ICODES Vessel Data Repository will serve as the starting point for Vessel Update Requests. ICODES Drawings and T&S Data Files are the inputs to the automated processing routines that generate new ICODES Production Vessels for use within the ICODES Single Load Planner application. The format consists of two distinct AutoCAD drawings: a Top-down Deck view, and a Side Profile view. These drawings contain graphical elements and associated data elements. Data elements are embedded in the drawings as text. Predefined layers and object-blocks communicate the semantic meaning of the individual elements on the two drawings. The drawing’s layers, object constraints, and conventions are required for proper processing of the drawings into an ICODES Production Vessel.

The ICODES Production Vessel format is a Jar file that contains the Vessel XML file that interweaves Vessel General Properties (VGP) file contents with the Scaled Vector Graphics (SVG) representations of the deck drawing and side profile, and raster files for the deck drawing and the side profile previews. ICODES Production Vessels are single files that can be imported into individual load plans and served to enterprise users via the ICODES Conveyance Repository Service and Data Manager application.

3.2.3 REFINEMENT OF AUTOCAD DRAWINGS

The ICODES contractor shall collaborate with MEO to refine AutoCAD drawings produced by Sustainment Engineering Tasks to include:

· Cleaning up lines to ensure proper weight and color.

· Verifying objects are in the correct layers.

· Ensuring polygons are closed and do not overlap.

· Positioning textual items and notes for best display within ICODES.

· Ensuring stow plan characteristics are defined (e.g. ramp lengths, load area psf) IAW current ICODES Specification Document referenced in Appendix F.

3.2.4 EXISTING VESSEL UPDATE PROCEDURES

The existing Vessel Update Procedure mirrors the New Vessel Creation Procedure with the addition that the ICODES Contractor will provide the existing ICODES Drawing and T&S Data from the ICODES Vessel Data Repository as the starting point for the Vessel Engineering tasks. Existing vessel updates can dramatically vary in scope and may not require an onsite vessel survey.

3.3 TASK AREA 3 – SHIP LIBRARY SUSTAINMENT ENGINEERING

The Ship Library Sustainment Engineering task area is a critical component of the ICODES load planning process requiring substantial knowledge and use of the system. This task area requires a multidisciplinary team of software engineers, certified professional marine engineers, and other experts to maintain and update the ship domain data, characteristics, drawings, and trim and stability information relevant to ICODES load planning requirements.

3.3.1 SOFTWARE & CERTIFIED MARINE ENGINEER RESPONSIBILITIES

· The MEO shall maintain and update associated data formats (i.e. SH2) and software translator(s) (i.e. Ship Project Editor).

· The MEO shall create, update, and validate trim and stability data files for both empty and stowed vessels within ICODES. In addition, the MEO must possess the ability to compare results in the Cargo Max computerized system.

· The MEO shall validate, and stamp finalized ship drawings.

· The MEO shall collaborate with the Government identified ship Point of Contact (POC) to obtain available vessel information (e.g. as-built general arrangement drawings, structural/scantling drawings, approved trim and stability booklet, cargo capacity plan (Cargo Max), Onboard Stability Instrument – computer model, and cargo securing manual).

The MEO shall use available vessel information to create AutoCad drawings of ships utilizing the ICODES Ship Drawing format and conventions listed in Appendix E.

3.4 TASK AREA 4 - INFORMATION ASSURANCE

3.4.1 INFORMATION ASSURANCE CONTROLS

The MEO shall establish an Information Assurance (IA) Program to implement and sustain appropriate IA management, operation, and technical controls and processes required to safeguard DoD non-public information resident on or transiting the MEO’s unclassified IS from unauthorized access and disclosure.

Protection measures applied must be commensurate with the risks (i.e., consequences and their probability) of loss, misuse, unauthorized access, or modification of information. The MEO shall submit for Government approval an overarching security plan that describes their strategy for implementation of IA and Industrial Security requirements throughout the life of the contract. The MEO shall provide the Draft Security Plan NLT 60 business days after contract has started and Final Security Plan NLT 30 business days after the draft has been reviewed and returned. The security plan shall address the security controls described in NIST SP 800-53 (current version), Security and Privacy Controls for Federal Information Systems and Organizations https://csrc.nist.gov/publications/PubsSPs.html) and should be tailored in scope and depth appropriate to the effort and the specific unclassified DoD information. The MEO shall submit an updated security plan as changes are made to the environment that may affect the security posture NLT 30 business days after change.

3.4.2 PERIODIC GOVERNMENT INSPECTIONS

The MEO shall authorize Government inspections and reviews to assure compliance with DoD IA requirements throughout the contract performance period. The MEO shall be responsible for taking corrective action based upon the impact and severity of identified weaknesses.

3.4.3 REMOTE ACCESS

Contractor Furnished Equipment (CFE) employed for remote access to a Government network must meet equivalent Government Furnished Property (GFP) IA (cyber security) computing requirements. The MEO shall ensure that all CFE (hardware and software) employed to access these environments meets the minimum Government IA (cyber security) requirements and provide periodic certification of compliance as a pre-requisite to being granted network access.

3.4.4 SOFTWARE ASSURANCE & SECURITY ENGINEERING PRACTICES

The MEO shall participate in Government and MEO formal and informal design reviews to identify potential security weaknesses, deficiencies, and/or vulnerabilities in the design. The MEO shall also ensure appropriate security requirements are included as part of the requirements traceability matrix and are evaluated as part of the security test and evaluation (ST&E). As part of the MEO’s change control process, the MEO shall ensure participation by qualified IA representative(s) to evaluate the impact of each change on security.

4.0 GENERAL INFORMATION

4.1 GOVERNMENT FURNISHED INFORMATION

The Government shall provide the contractor with Government Furnished Information (GFI) for various purposes to include location data and existing documentation for inclusion in the ICODES capability. The GFI provided shall remain the property of the Government and shall not be released to others without prior approval of the COR/ACOR.

4.2 PLACE OF PERFORMANCE

Services shall be performed at the MEO’s facility. Remaining full time employees (FTEs) shall be located at a MEO off-base facility. On occasion, MEOs who normally work at MEO facilities shall be required to attend meetings at SDDC, Scott AFB.

4.3 PERIOD OF PERFORMANCE

The period of performance for this contract shall consist of a base, four (4) option periods, and an optional six (6) month extension:

Base Period: 01 June 25 – 30 September 25 Option Period 1: 01 October 25 – 30 September 26 Option Period 2: 01 October 26 – 30 September 27 Option Period 3: 01 October 27 – 30 September 28 Option Period 4: 01 October 28 – 30 September 29 Optional Extension: 01 October 29 – 31 March 30

4.4 INFORMATION ASSURANCE TRAINING

The MEO shall ensure that personnel requiring privileged access to IS have the proper and current IA certifications to perform IA functions IAW DoD 8140.03-M, IA Workforce Improvement Program. DoD-approved IA workforce certifications appropriate for each category and level are listed in the current version of DoD 8140.03-M. The MEO shall upload all baseline and computing environment certifications and training requirements into ATCTS.

4.5 COOPERATION WITH OTHER CONTRACTORS & GOVERNMENT PERSONNEL

The MEO shall cooperate with other contractors and Government personnel performing work for SDDC and USTRANSCOM. The MEO shall avoid interfering with the performance of work by other contractors or Government employees while not compromising health, safety, or security. Any disagreement or cause of delay shall be immediately brought to the attention of the Contracting Officer (CO) and COR/ACOR.

4.6 QUALITY ASSURANCE

The MEO shall support Government agency reviews and audits of all services and support provided under this PWS. The MEO shall be prepared to support QA reviews conducted by the Government. The Government reserves the right to authorize an independent verification and validation of the MEO’s procedures, methods, data, equipment, and other services provided at any time during the performance of this PWS.

4.7 TRAVEL

Performance under this task order may require MEO to travel within CONUS and OCONUS. The MEO shall maintain the ability to travel to ship locations, both CONUS and OCONUS, and gain access to military installations to board and survey vessels as required. The Government shall reimburse the MEO for travel expenses subject to FAR and Joint Travel Regulation (JTR). All MEO travel shall be validated by the COR/ACOR prior to incurring any travel expenses and may require attendance of the MEO at applicable DoD and security briefings. The MEO shall identify personnel who shall be traveling in sufficient time to obtain the lowest possible rates for airfare, rental car, and lodging. MEO invoices (along with associated receipts) shall support all travel reimbursement. Actual travel expenses shall be reported to the COR/ACOR by person, by trip, within the QSR/PMR. The Government shall not reimburse local travel and related expenses to the MEO for daily travel to or from work at the MEO’s facility.

4.8 OTHER DIRECT COSTS

The Government will reimburse the MEO for materials and fees that are necessary for the performance of the PWS, but only if they have been previously coordinated with the COR. If the MEO purchases products to support this effort, all products purchased shall be transferable to the Government in their entirety. The item(s), its (their) specifications, a detailed reason justifying the purchase, and a minimum of three (3) estimated prices shall be submitted to the COR, and/or ACOR for review and approval at least five (5) business days before incurring any expenses. All ODC reimbursement requests must be accompanied by contractor invoices and the associated receipts. It is important to note that the contractor is not authorized to purchase ODCs that exceed the amount of ODC funding specified in the contract.

4.9 SAFETY

The MEO shall be directly responsible for the safety and occupational health (SOH) standards for its employees and must comply with The Occupational Safety and Health Act of 1970; or any other applicable Federal, State, and local laws, codes, ordinances, and regulations.

The MEO shall provide and maintain work environments and procedures which will safeguard the public and Government personnel, property, materials, supplies, and equipment exposed to MEO operations and activities.

The MEO shall provide prevention plans and accident investigation procedures upon request from the COR within seven (7) days.

The MEO shall immediately notify the COR upon discovery of any incident and/or accident that results in injury or death to any personnel or damage to equipment.

In all instances where a reportable accident (i.e., an unplanned event, or series of events that meets the minimum criteria IAW AR 385-10, The Army Safety Program, and Department of the Army Pamphlet (DA PAM) 385-40, Army Accident Investigations and Reporting, for ground Class A–D accidents) or incident occurs, the MEO shall submit a preliminary investigation report to the COR within 24 hours. The MEO shall follow-up with a full incident/accident investigation report identifying all root causes and corrective actions provided to the COR within 30 calendar days of occurrence.

4.10 DELIVERABLES

4.10.1 DELIVERY

The MEO shall provide deliverables as set forth in Table 2. All technical data and noncommercial software delivered under this task order are developed exclusively at the Government’s expense, and IAW DFARS 252.227-7013, 252.227-7014, 252.227-7015, 252.227-7016, 252.227-7017, 252.227-7019, 252.227-7030, and 252.227-7037, the Government has unlimited rights in these deliverables. For all other commercial data delivered under this task order, the Government has the right to use, modify, reproduce, release, display or disclose, in whole or part, in any manner and for any purpose whatsoever, without restrictions of any kind, within and without the Government.

All deliverables shall be made electronically via email to the COR or updates to the appropriate website or tool (e.g., the Help Desk ticket system), or Dimensions in the case of software development source code and associated files. If a delivery is submitted via email and the size or the firewall prevents its delivery, the MEO shall provide a Secure File Transfer site that allows the Government to download the deliverable. If a site is not available or not feasible, the Government shall make one available to the MEO. In case no sites are available, the MEO shall deliver via CD/DVD. The CD/DVD must be properly labeled to identify the content to include classification, version number, and date.

The MEO shall transmit draft versions, whose files sizes typically exceed email capabilities, electronically or by mailing CDs. If sending electronically (preferred by SA-I), use the DoD Safe Access File Exchange (SAFE) website found at https://safe.apps.mil/ and require reviewers to use a CAC to retrieve from that website.

4.10.2 INSPECTION & ACCEPTANCE

A deliverable is a specific, measurable tangible and verifiable activity, outcome, result, item, or product that the MEO shall provide and that shall require formal Government acceptance and approval. The Government shall review, assess, and provide comment, as required on the deliverables identified in Table 2.

Unless otherwise specified, final inspection and acceptance of all work performed, reports, or other deliverables shall be performed at the place of delivery. The Government shall notify the MEO of deliverable acceptance or provide comments in writing.

If the Government determines, after a security audit (e.g., security assessment), that software delivered is non-secure, the Government shall provide written notice to the MEO of each non- conformity. Software shall be "non-secure" under this task area order if it contains a software error listed on the current approved version of the CWE/SANS TOP 25 (http://www.sans.org/top25- software-errors) or a web application security flaw listed on the current approved version of the OWASP Top Ten (http://www.owasp.org/index.php/Category:OW ASP_ Top_ Ten Project). The MEO shall have NLT 30 calendar days after receipt of such notice (remedy period) to remedy each non-conformity by modifying/replacing and redelivering the software to the Government; or shall notify the Government NLT 15 calendar days as to why the remedy cannot be implemented in 30 days and propose a timeline for correction. If the Government determines, after a security audit following a remedy period, that the redelivered software is non-secure, and thus non-conforming, the Government may reject the delivery, provide notice of the non-conformance, and document the MEO's performance record.

The MEO shall have a Remedy Period of 30 days after receipt of such notice to remedy each nonconformity by modifying/replacing and redelivering the software to the Government. The MEO shall notify the Government in a Burn Down Plan NLT 15 days of notification as to why the remedy cannot be implemented in 30 days and propose a timeline for correction. The Burn Down Plan should address the review, assessment, and remediation of all suppressed Fortify findings that have been identified as issues. Audit comments should be updated to identify specifics on how each finding has been remediated/mitigated. Those that can’t be remediated/mitigated should be added to the POA&M and tracked for completion based on severity and risk. If the Government determines, after a security audit following a Remedy Period, that the redelivered software is non-secure, and thus nonconforming, the Government may reject the delivery, provide notice of the nonconformance, and document the MEO’s performance record.

Table 2 Contract Deliverables

Final – NLT at the scheduled Meeting.

Unlimited

Updates – NLT 3 business days after information is known.

Unlimited

Unlimited

Changes – NLT 5 days after discovery Unlimited

Final – NLT 30 business days after the draft is reviewed and returned

Updates – NLT 30 business days after environment change Unlimited

4.11 SERVICE DELIVERY SUMMARY

The Services Delivery Summary (SDS) represents the most important contract objective that, when met, will ensure contract performance is satisfactory. Although not all PWS requirements are listed in the SDS, the MEO is expected to fully comply with all requirements in the PWS.

& Timeline Plan

5.0 SECURITY (PHYSICAL, PERSONNEL, INFORMATION, ANTITERRORISM/FORCE PROTECTION, & INDUSTRIAL) The MEO shall complete administrative actions such as obtaining CACs and base access credentials (line badges), provide non-disclosure agreements (NDAs), establish account access, and set-up development and testing environments (command hosted or in the cloud, as applicable). The MEO shall provide to the Government a list of employees requiring CACs, a listing of accounts to which each employee requires access and a subsequent status of CAC issue and account access NLT 10 calendar days of contract award. Updates to this listing shall be completed and provided to the Government NLT 24-hours of a personnel change. The contractor shall ensure personnel are available to accomplish all PWS tasks at the start of the period of performance.

5.1 GENERAL SECURITY INFORMATION

The overall classification of work associated with this PWS is UNCLASSFIED. Task Areas associated with the deliverables in this PWS shall require SECRET clearance eligibility and access for all contract employees associated. All classified material handled by the contract members shall be safeguarded and derivatively classified IAW EO 13526, AR 380-5 and per SDDC Regulation 380-5 (Information Security Regulation) and all applicable Office of the Secretary of Defense (OSD) Classification Guides. Specific security requirements are identified in the DD Form 254, DoD Contract Security Classification Specification, for this contract.

5.2 PERSONNEL CLEARANCE LEVEL & INVESTIGATION REQUIREMENTS

Personnel assigned to a task order under this contract that require access to CLASSIFIED information and/or systems, shall require a favorably completed Tier 3 or National Agency Check with Local Credit (NACLC), resulting in SECRET eligibility (or higher) when adjudicated by the Defense Counterintelligence Security Agency (DCSA). Interim Secret clearance eligibility is accepted provided it was granted by DCSA and the National Background Investigations Bureau (NBIB) formerly known as the Office of Personnel Management (OPM). The Facility Security Officer (FSO) is responsible for ensuring Tier 3 or NACLC investigations are submitted to DCSA, and a minimum of Interim SECRET granted prior to contract start day. This requirement mandates the MEO have a minimum Facility Clearance Level (FCL) at the SECRET (or higher) level.

Personnel assigned to a task order under this contract who require access to Non-Secure Internet Protocol Router Network (NIPRNET) applications, UNCLASSIFIED Government systems, and/or require CAC, must successfully complete a Tier 1 (T1) investigation, or have a completed National Agency Check with Inquiries (NACI) or suitable investigation meeting the T1/NACI or higher level, resulting in favorable suitability for Public Trust eligibility. T1 investigations must be opened by NBIB with fingerprint, name and criminal records checks returned favorably before MEOs are cleared to begin work on the contract.

Favorable T1/NACI or higher investigation results must be posted in the Defense Information System for Security (DISS) before a MEO is granted a CAC or have access to UNCLASSIFIED Government systems.

All clearance requirements must be maintained throughout the duration of the contract. All derogatory information must be reported through SDDC G2 Personnel Security Manager and reported in DISS immediately upon notification.

5.2.1 T1 REQUESTS

T1 requests shall be submitted by SDDC Security Office, via a Personnel Security Investigation Program (PSIP) form, for processing as soon as the employees are identified.

SDDC shall only process T1/Position of Trust investigations and shall not complete any personnel security investigations for classified access. It is incumbent upon the MEO to have the appropriate investigations completed upon start of the task order.

5.3 MEO FACILITY REQUIREMENTS

The MEO shall provide security at their facility to a level necessary to meet Controlled Unclassified Information (CUI) requirements. All contract personnel shall retain an up-to-date background investigation or be eligible to obtain a CAC for the duration of the contract. All CUI information generated in the performance of this contract, including the studies, shall be marked, stored, and archived, or destroyed accordingly.

The company who is awarded this contract must have a valid FCL at SECRET or higher. Interim FCL levels are acceptable provided they have not expired prior to final adjudication by DCSA. FCL procedures and security guidelines for adjudicative requirements are outlined in 32 CFR Part 117 National Industrial Security Program Operating Manual (NISPOM), DODM 5200.02 and AR 380-67. FCL is required at proposal submission.

5.4 CITIZEN & CLEARANCE REQUIREMENTS

The MEO and subcontractor personnel performing services under this contract and requiring classified access shall be citizens of the United States of America. US Citizens who currently have (either expired or active) foreign passports shall not be able to obtain or hold interim or final security clearances within DoD. These contractors who maintain or have in their possession a valid or expired foreign passport are considered dual citizens and shall not be authorized classified material or access.

5.5 PERSONNEL CLEARANCE VALIDATION

Upon award of this contract, the names and social security numbers of all contract employees supporting this contract shall be submitted to SDDC G2 for vetting in DISS to ensure investigative requirements have been obtained before contract start date. This requirement shall be completed prior to the COR/Trusted Agent (TA) submitting contract employees for their CAC in the DoD Trusted Associate Sponsorship System (TASS). If contract member does not have the appropriate investigative requirement, the contract employee shall be denied the ability to work in support of this contract and shall not be loaded in TASS.

5.6 COMMON ACCESS CARD

Upon notification by the SDDC G2 Industrial Security PM that MEO personnel meet the required investigative levels, personnel shall be loaded in TASS with an expiration date on their CAC for the current period of performance and up to 3 years. Once the CAC application is approved in TASS, the MEO employees may go to the nearest Real-Time Automated Personnel Identification System (RAPIDS)/Defense Enrollment Eligibility Reporting System (DEERS) office for CAC issuance.

5.7 SCOTT AFB/USTRANSCOM/HQ SDDC PHYSICAL ACCESS

Only personnel assigned and physically on Scott AFB at least four (4) days per week shall be issued a Facility Access Badge unless an exception to policy is approved by the SDDC G2 security managers. Permanent badges shall only be issued once contractors have attended SDDC initial security training.

5.8 VISITS BY NON-ASSIGNED CONTRACTORS

Visit(s) by contract personnel not permanently assigned to Scott AFB shall require an electronic visit request in DISS to the Security Management Office (SMO) Code: SDDC-CONT and USTC-SDDC.

5.9 VISITS BY PERMANTENTLY ASSIGNED CONTRACTORS

Contractors permanently assigned to Scott AFB shall require electronic DISS visit requests submitted to SMO Code: SDDC-CONT and USTC-SDDC, Point of Contact (POC) block is the contract number and phone number block shall include COR phone number and last name. Visit requests are no longer required once permanent access badges have been issued. Only contractors working on base at least four (4) days a week shall receive a permanent badge. All off-site contractors shall require a visit request to receive a temporary badge.

5.10 IN & OUT PROCESSING

Upon termination or completion of this contract, the MEO employee shall surrender all Government supplies, materials, classified materials, and equipment to the COR. In addition, the contractors’ CACs and any security badges issued shall be turned into the SDDC/USTRANSCOM Security Service Center (SSC) at Scott AFB, IL. Off-site contractors shall return the CAC to the COR. This shall be accomplished on the last day of the contract or upon any termination/reassignment of a contract employee. CORs who obtain CAC and security badges due to short notice terminations or release of contract employees shall revoke access in TASS and turn the CAC and security badge into the G2 Industrial Security Program Manager for final processing/out- processing. All on-site contract personnel shall complete an in/out-processing checklist supplied by the COR/CO or SDDC G1.

5.11 SECURITY BRIEFING/DEBRIEFING STANDARD FORM 312

Standard Form (SF) 312 shall be completed upon start/completion of the contract if assigned to SDDC at Scott AFB, IL. This shall be completed/executed by the SDDC/USTRANSCOM SSC during in and out-processing.

5.12 SECURITY TRAINING

MEO employees assigned to HQ SDDC at Scott AFB shall attend/complete the following training within 30 calendar days of contract start as prescribed by DoD, Army and SDDC Regulations: Employee Initial Security Briefing, OPSEC, Threat Awareness and Reporting Program (TARP), DoD AT Level 1 Training, Active Shooter, and Workplace Violence Training. This also includes IA training required for specific computing platforms and applications. All Security training, to include Annual Security Awareness Training, is required annually.

Initial Security and AT Level I Training shall be provided by SDDC G2 and G34 and attendance is required within the first 10 calendar days of contract start day at Scott AFB. All other training can be accessed on the SDDC Portal Training site. MEO personnel assigned elsewhere shall attend security training established by their respective Government security offices and/or installations.

NOTE: MEO employees shall report training completion to the COR.

5.13 SECURITY PERMISSIONS DOD SYSTEMS

The MEO shall ensure the roles/privileges assigned to contract employees on the Government computing platforms are limited to the roles/privileges essential to that individual’s performance of his/her assignments.