AEWTTR II DRAFT SOW.docx

DRAFT

STATEMENT OF WORK (SOW)

FOR

SUSTAINMENT, UPGRADE, AND DEVELOPMENT

OF

AIRCREW ELECTRONIC WARFARE TACTICAL TRAINING RANGE (AEWTTR-II)

THREAT RADAR SYSTEMS AND SIMULATORS

NAVAL AIR WARFARE CENTER WEAPONS DIVISION

CHINA LAKE, CALIFORNIA

ELECTRONIC WAREFARE THREAT SYSTEMS (EWTS) PROJECT OFFICE

CODE DB46200

10/01/2020

AIRCREW ELECTRONIC WARFARE TACTICAL TRAINING RANGE (AEWTTR-II)

MULTIPLE AWARD CONTRACT (MAC)

SOLICITATION N6893620R0081

CONTENTS

Appendixes:

PURPOSE

The Electronic Warfare Threat Systems (EWTS) Project Office at the Naval Air Warfare Center Weapons Division (NAWCWD), China Lake, CA, is the system support activity (SSA) that provides engineering expertise for the Naval Aviation Training Systems Program management Activity (PMA 205) and Department of Defense (DoD) activities supporting the training and Test & Evaluation (T&E) Ranges. EWTS engineering expertise includes oversight over the development, upgrade and life cycle sustainment of real-time and simulated multi-spectral threat emitting equipment required to provide lethal capability and operational readiness. All work described in this Statement of Work (SOW) will be performed via task orders awarded under an Indefinite Delivery Indefinite Quantity (IDIQ) Multiple Award Contract (MAC).

Background The EWTS Project Office has been designated, by the Naval Air Systems Command (NAVAIR), to develop, sustain, and upgrade training systems aimed to improve aircrew lethality and survivability. Training systems include threat simulators, radars, and training instrumentation capable of operation in the Network-Centric Warfare and Battlespace environments. In order to maintain the warfighters relevancy, these complex systems are continuously modified and modernized to provide realistic battlefield scenarios.

General Scope The scope of this SOW covers acquisition of products and services associated with EWTS, and EWTS peripheral instrumentation supporting DoD and foreign, test and evaluation (T&E), and training ranges engaged in pre-deployment aircrew training and weapons and countermeasures development. The T&E and Training ranges, hereafter will be referred to as Ranges. The scope shall include: research, development, procurement, sustainment, upgrade, technology insertion, integration, testing, networking, cybersecurity, and Configuration and Data management (CM/DM). Appendix A is a representative list of EWTS and peripheral instrumentation covered under this acquisition.

APPLICABLE DOCUMENTS

a. ANSI/EIA-748 Earned Value Management System (EVMS ), March 2013

b. Assistant Secretary of Defense (ASD) Networks and Information Integration (NII) Directive-Type Memorandum (DTM) 08-027 – Security of Unclassified DoD Information on Non-DoD Information Systems, 31 July 2009

c. Chief of Naval Operations/Headquarters, United States Marine Corps (CNO N614/HQMC C4) – Navy-Marine Corps Unclassified Trusted Network Protection (UTN-Protect) Policy, Version 1.0, 31 October 2002

d. CJCSI 6250.01F – Department of Defense Satellite Communications, 26 February 2019

e. CMS-1 Department of the Navy (DON) Communications Security (COMSEC) Policy and Procedures Manual, 01 Jul 2019

f. Department of Defense Instruction (DoDI) 5200.02 – Department of Defense Personnel Security Program, 11 May 2018

g. DoDI 8523.01 – Communications Security (COMSEC), 22 April 2008

h. DON Chief Information Officer (CIO) Memo 01-09 Information Assurance Policy for Platform Information Technology, 30 January 2009

i. DON DIACAP Handbook – DoD Information Assurance Certification and Accreditation Process (DIACAP) Handbook, 15 July 2008

j. MIL-STD-31000A – Technology Data Packages, February 2013

k. MIL-HDBK-61A – Configuration Management Guidance, 7 February 2001

l. National Security Telecommunications and Information Systems Security Policy (NSTISSP) No. 11 – Revised Fact Sheet National Information Assurance Acquisition Policy, July 2003

m. National Security Agency Central Security Service NSA/CSS Policy 1-52 Issue Date: 16 November 2012

n. National Security Agency Central Security Service NSA/CSS Manual 1-52 Issue Date: 30 September 2013 Revised: 23 May 2014

o. OPNAVINST 2221.5C – Release of Communications Security (COMSEC) Material to U.S. Industrial Firms Under Contract to the U.S. Navy, 7 February 2007

p. Secretary of the Navy Instruction (SECNAVINST) 3070.2A Operations Security, 9 May 2019

q. SECNAVINST 5239.3B – Department of the Navy Information Assurance Policy, 17 June 2009

Information Technology (IT) The Government will provide all necessary obsolete reference documents and those not generally available to the contractor as requested.

The Contractor shall not purchase any IT equipment on behalf of NAVAIR in support of this Contract, which reports to PBIS-IT, without a Naval Air Systems Command (NAVAIR) Command Information Officer (CIO) approved NAV-IDAS ITPR.

Clinger-Cohen Act (CCA) The contractor shall conduct analysis of program/project needs, acquisition strategy and program artifacts to identify and capture specific factors required to satisfy the 11 elements of Clinger-Cohen Act (CCA) compliance listed in DODI 5000.02, Enclosure 1, Table 9. Using Microsoft Word, the contractor shall prepare a CCA compliance matrix following the organization and appearance of Table 11 with additional separate columns for the display of artifact: titles, date(s) of approval, page number(s), and paragraph or section number(s). The right-hand column shall include an embedded object permitting the reader to open unclassified artifacts. The column shall identify classified artifacts and shall describe approved classified channels for access of classified artifacts.

Updating approved CCA compliance packages: For updates of approved CCA compliance packages, the contractor shall conduct analysis of program/project needs, acquisition strategy and program artifacts to identify and to determine if each of the Eleven (11) elements of CCA has changed and if no change has occurred a notation stating “no change” shall be entered in the CCA compliance matrix. If changes have been found, the Contractor shall update the CCA compliance matrix to reflect the changes.

The contractor shall support the program manager during CCA compliance review and assist in responding to reviewer comments if and when additional supporting information or revisions are required.

System Software/Application Compliance All Information Technology Systems or software/application development, modification or support shall be performed in accordance with Defense Business Transformation guidance (formerly Business Management Modernization Program (BMMP)), Department of the Navy (DON)/Naval Air Systems Command (NAVAIR) Functional Area Manager (FAM) Policies and Guidance, Network and Server Registration, and Web Enablement mandates.

Websites, Web Enablement and Application/System Development, Modification, and Maintenance Support Services All Information Technology systems, software, and website development, modification or support shall be performed in accordance with all applicable Federal, DoD, DON, and NAVAIR policy, guidance, standards, and strategies, and should be integrated within the NAVAIR Enterprise portal and collaboration environment whenever possible. Any Web sites/servers hosted/located in contractor facilities, or outside NAVAIR enclave, will transition to NAVAIR architecture and infrastructure in accordance with Legacy Shutdown guidance. Policies include, but are not limited to:

a. Office of Management and Budget Management of Federal Information Resources, OMB CIRCULAR NO. A-130 Revised. <http://www.whitehouse.gov/omb/circulars_a130_a130trans4>

b. OMB Policies for Federal Agency Public Websites, OMB M-05-04 <http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-04.pdf>

c. Section 508 Amendments to the Rehabilitation Act of 1973. <http://www.section508.gov/Section-508-Of-The- Rehabilitation-Act>

d. Department of Defense Web Policies and Guidelines. <http://www.defense.gov/webmasters>

e. Navy Information Operations Command (NIOC) Norfolk Web Risk Assessment Team Website. <http://www.public.navy.mil/fcc-c10f/niocnorfolk/Pages/AboutWRA.aspx>

f. DON Policy for Content of Publicly Accessible World Wide Web Sites SECNAVINST 5720.47B. <http://www.navy.mil/navydata/internet/secnav5720-47b.pdf>

g. NAVAIR CIO Website (NAVAIR specific policy and guidelines). To request this policy contact the NAVAIR CIO office – 7.2.2 Applications Integration team – Web Manager: Shane Malamphy at 301- 342-1825.

h. Defense Information Systems Agency (DISA) Hosting of All Navy Websites (NAVADMIN 061/08).<http://www.public.navy.mil/bupers-npc/reference/messages/Documents/NAVADMINS/NAV2008/NAV08061.txt>

i. Consolidation of Navy Web Sites - Reduction of IM/IT Footprint NAVADMIN 145/07. <http://www.public.navy.mil/bupers- npc/reference/messages/Documents/NAVADMINS/NAV2007/NAV07145.txt>

j. DON Web Presence Policy: The Registration, Compliance of, and Investment in, All Unclassified Web Sites and Uniform Resource Locators. <http://www.doncio.navy.mil/ContentView.aspx?ID=577>

k. Policy and Procedures for Web Risk Assessment (WRA) of Publicly Accessible Navy Sites (ALCOM 129/09). <www.public.navy.mil/fcc-c10f/niocnorfolk/Documents/NTD-08-09.txt>

Software Development/Server Procurement Any tools developed that will be hosted by the Navy Marine Corps Intranet (NMCI) or run on NMCI workstations will be certified for NMCI and comply with NMCI policy. Additionally, any servers supporting this effort will be transitioned to meet the requirements of the current NAVAIR Server Consolidation effort.

Cybersecurity The contractor shall conduct investigation and analysis of acquisition program artifacts such as but not limited to Initial Capabilities Document (ICD), Capability Description Document (CDD), Capability Production Document (CPD), Navy urgent operational need (UON) and Marine Corps urgent universal need statement (UUNS), joint urgent operational needs (JUONs), threat assessments and acquisition strategies (AS). Knowledge gained from this analysis shall be used when developing the Cybersecurity Strategy (CS) needed to steer and inform the program’s development of a Security Plan (SP) in accordance with DoDI 8510.01, of 12 March 2014.

As a minimum, hardware, firmware, software, documentation (data deliverables) and/or Information Technology (IT) services delivered by this contract shall be in compliance with the following References:

a. DoDI 8500.01 Cybersecurity, 14 March 2014

b. DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), 12 March 2014, Incorporating Change 1, May 24, 2016.

c. Committee on National Security Systems Instruction 1253, “Security Categorization and Control Selection for National Security Systems,” March 27, 2014, as amended.

d. DoDD 8140.01, Cyberspace Workforce Management, 11 August 2015.

e. DoD 8570.01-M Information Assurance Workforce Improvement Program, 15 August 2004, Certified Current as of 10 November 2015.

The contractor shall conduct investigation and perform analysis including; criticality analysis threat assessment, and vulnerability assessments. All findings and recommendations shall be reported to the government in technical reviews and submitted as written reports or documents as listed in Contract Data Requirements Lists (CDRL). The contractor shall support government efforts needed for Information systems (IS) (enclaves or major applications), Platform Information Technology (PIT) or PIT systems to successfully categorize the system, achieve favorable assessment for selection, implementation and testing of security controls and authorization (approval to operate) before use or interconnection in an operating environment in accordance with references (a), (b) and (c). This includes IT that is standalone and IT that is connected to other systems, networks or enclaves. Information systems (IS) (enclaves or major applications), Platform Information Technology (PIT) or PIT systems delivered prior to award of this contract but included in the performance of this contract may have been delivered in compliance with Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) and as such shall require transition to Risk Management Framework cybersecurity compliance. Transition planning proposed or performed under this contract shall be in compliance with reference (b) Enclosure 8, Figure 2 and all hardware, firmware and software deliverables shall be capable of receiving Authorization to Operate in accordance with reference (b).

Information technology services shall only be performed by personnel who are qualified and certified in accordance with reference (d). Personnel proposed and/or used in the performance of this contract as certified personnel shall be limited to those whose specifically assigned duties and responsibilities require certification.

Designation of Platform IT (PIT) and PIT Systems:

The contractor shall investigate and conduct analysis in order to provide technical reviews to make a recommendation with data supporting the proposal(s) for the need for designation (or not) of the system, network or enclave as platform IT (PIT) or a PIT system in accordance with DoDI 8500.01, Cybersecurity, 14 March 2014. The proposal shall include all technical data required to engage in collaboration with the security control assessor, the authorizing official (staff) and PIT designating official(s). In the event the collaboration results in redesign or follow-up action after collaboration requiring additional or revised documentation, the contractor shall continue to assist the collaboration process.

System Characterization and Security Control Selection:

The contractor shall investigate and conduct analysis in order to provide technical reviews to make a recommendation with data supporting characterization and selection of security controls in accordance with DoDI 8500.01, Risk Management Framework (RMF) for DoD Information Technology (IT), 12 March 2014 Incorporating Change 1, May 24, 2016, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, Revision 4, April 2013, NIST SP 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems, February 2010, Federal Information Processing Standards Publication (FIPS 199, February 2004. Contractor performed analysis shall include; criticality analysis, threat assessment and vulnerability assessments. The contractor shall propose characterization of the system and selection of security controls use Committee on National Security Systems Instruction (CNSSI) 1253, Security Categorization and Control Selection for National Security Systems, 27 March 2014 to tailor the NIST guidance. The proposal shall include all technical data required to engage in collaboration with the security control assessor and the authorizing official (staff). In the event the collaboration results in redesign or follow-up action after collaboration requiring additional or revised documentation, the contractor shall continue to assist the collaboration process.

Security Plan:

The contractor shall investigate and conduct analysis in order to provide technical reviews to make a recommendation with data supporting the development of the Security Plan. Contractor performed analysis shall include; criticality analysis, threat assessment and vulnerability assessments. The security Plan shall be prepared for the first program/project decision point and updated for each subsequent decision point. The proposal shall include all technical data required to engage in collaboration with the security control assessor and the authorizing official (staff). In the event the collaboration results in redesign or follow-up action after collaboration requiring additional or revised documentation, the contractor shall continue to assist the collaboration process.

Cybersecurity Instructions All Cybersecurity shall be in compliance with the following listed instructions:

aa. SECNAVINST 5239.3C, Department of the Navy Cybersecurity Policy, 2 May 2016.

bb. SECNAVINST 5239.19, Department of the Navy Computer Network Incident Response and Reporting Requirements, 18 March 2008.

cc. The National Security Act of 1947.

dd. Title 40/Clinger-Cohen Act.

ee. Title 44/ Federal Information Security Management Act.

ff. National Institute of Standards and Technology Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, Revision 4, April 2013 (Updated 22 Jan 2015).

All IT procured on behalf of this contract shall meet all DoD/DON and NAVAIR cybersecurity polices. Failure to follow these policies will result in denied access to NMCI, One Net, Integrated Shipboard Network System (ISNS) and other DON, DoD and Joint Networks. These cybersecurity policies are standard across the Department and ensure cybersecurity compatibility and interoperability.

IT systems and or networks operated by contractors pursuant to a NAVAIR contract, regardless of the level of data processed, shall be operated in accordance with the NISPOM.

Approved contractor-owned equipment shall be permitted connections to NAVAIR/DoD networks in order to carry out the performance of this contract. All Contractor-owned hardware and/or software shall meet DoDI 8500.1 Cybersecurity (CS), is subject to validation scanning and must be approved by the NAVAIR site CS Manager prior to connection.

The following specific criteria must be met before the contractor can be connected to any DoD or NAVAIR network in support of this contract. Requirements include:

e. Memorandum of Agreement and Inter-connection Agreements. A Cybersecurity Memorandum of Agreement (MOA) between the contractor owning the equipment and AIR-7.2.6 shall be developed and signed before the equipment can be connected to NAVAIR networks. Failure to comply with the signed MOA shall be grounds for disconnection from the network.

Enterprise Architecture

a. Contractor Networks and Connections. Contractor-owned and operated networks are prohibited on any Naval Air Systems Command (NAVAIR) facility or site in support of this contract. The contractor may access non-government, external IP space via the NAVAIR-provided Virtual Private Network (VPN) Outreach service or NAVAIR CIO approved Internet Protocol (IP) service.

b. Architecture Compliance. The contractor shall ensure all IT solutions, including database solutions, comply with the appropriate NAE Enterprise Architecture, and are verified by the NAVAIR Enterprise Architect (AIR-7.2.3) prior to build out.

c. Disclosure of pre-existing networks, circuits or connections. Any and all networks, circuits or connections between the contractor and any NAVAIR site related to previous contracts shall be identified in the MOA. Failure to comply and subsequent discovery of an unregistered network, circuit or connection shall be grounds for immediate disconnection.

Software Process Improvement Initiative (SPII) The Contractor shall follow the Software Development Plan (SDP) that they develop and submit in accordance with CDRL A007. The SDP will follow the framework of Institute of Electrical & Electronics Engineers (IEEE)/Electronics Industries Association (EIA) IEEE/EIA Std 12207 regarding subject content, level of detail, and completeness. The SDP shall serve during contract performance as the benchmark for the contractor’s software development effort and shall be periodically evaluated and updated as specified in the CDRL, as a part of continuous process improvement subject to Government review and approval.

REQUIREMENTS

The work shall be performed in accordance with individual Task/Delivery Orders (T/DOs) and Integrated Product/Project Baselines (IPBs). The contractor shall apply systems engineering principles and practices to deliver complete end items, software, components, building blocks, assemblies, instrumentation, equipment, devices, documentation and spare parts associated with EWTS. The contractor shall provide performance specifications, manuals, technical data packages, reports, and drawings as specified by T/DOs.

EW Threat Systems (EWTS) Sustainment and Service Life Extension The contractor shall maintain, repair, update, modify, test, deliver, and integrate components to systems listed in Appendix A. Systems that require sustainment or service life extension may include software development and upgrade and/or hardware integration of end items. The contractor shall maintain the Government-approved system configuration for hardware and software baselines. The contractor shall conduct Engineering Investigations (EIs) based on failures and Deficiency Reports (DRs) submitted by Ranges. In conducting diagnostics of malfunctions and failures, the contractor may determine parts to be beyond economical repair, obsolete, or are no longer available. If so, the contractor shall identify a possible modification or alternate corrective action, and provide the Government with an estimated cost to repair or modify, and an estimated completion time for the parts. If the end item configuration requires alteration, prior to conducting changes, the contractor shall submit a change proposal for approval. The contractor shall generate failure reports, Requests for Variance (RFVs), and Engineering Change Proposals (ECPs) to remedy equipment failures. The contractor shall document all maintenance required to repair the system. All documentation shall be stored in a Government-specified web accessible electronic library. System service life extension shall incorporate new modifications and enhancements into hardware/software baselines to extend systems service life. (CDRLs A001, A004, A008, A009, A00B, A00K, A00P, A00Q, A00R, A00S, A00X and A00Y).

Range Instrumentation, Equipment and EWTS Connectivity The contractor shall develop, document, deliver, integrate, and conduct acceptance testing of range instrumentation, equipment, servers, guards, switches, multiplexers to be networked with EWTS for the purpose of aircrew training, weapons evaluation, and countermeasures development. The characteristics of the networked product will be specified in the SOW of the T/DO. (CDRLs A001, A002, A003, A004, A006, A008, A009, A00A, A00B, A00C, A00D, A00E, A00F, A00G, A00H, A00J, A00K, A00Q, A00R, A00S, and A00V) Open Loop and Closed Loop EWTS Life Cycle Logistics & Spare Parts The contractor shall develop, assemble, and deliver parts, assemblies, and subsystems to replace depleted inventory and maintain operational status of connected and isolated EWTS and peripheral equipment and instrumentation for the systems listed in Appendix A and new threat presentation systems developed under this contract. The characteristics of the spare parts, assemblies, and subsystems will be specified in the SOW of the T/DO.

Man-Portable Air Defense System (MANPADS) Interface Instrumentation The contractor shall develop, deliver, and install interface instrumentation and devices that will gather data on the MANPADS to a single connection port and then transmit all of the required data to/from EWTS and peripheral equipment. This instrumentation will provide system position data (Global Positioning System [GPS]), system pointing data (azimuth and elevation), target aircraft engagement pairing, weapon fly-outs, and video. The contractor shall provide end item documentation as specified in the order. (CDRLs A001, A008, A009, A00B, A00K, A00Q, A00R, and A00S)

Opposition Forces (OPFOR) Communication Systems and Electronic Attack (EA) The contractor shall design, develop, upgrade, and install OPFOR communication systems capable of radio frequency (RF) transmission to enable enhanced Electromagnetic Maneuver Warfare (EMW) system to degrade, neutralize, or destroy enemy combat capability. The systems shall be integrated into the Ship’s Signals Exploitation Equipment (SSEE) system for aircraft EA jamming effectiveness training. The contractor shall deliver end item documentation as specified in the order. (CDRLs A001, A004, A006, A007, A008, A009, A00B, A00C, A00D, A00E, A00F, A00G, A00H, A00J, A00K, A00Q, A00R, A00S, A00V and A00Y)

OPFOR Communication Systems The contractor shall design, develop, assemble, upgrade, and install OPFOR communication systems capable of RF transmission to enable crew training for enhanced EMW system operators to degrade, neutralize, or destroy enemy combat capability. The contractor shall deliver end item documentation as specified in the order. (CDRL A00N)

OPFOR EA Systems The contractor shall design, develop, assemble, upgrade, and install OPFOR EA systems capable of RF transmission to enable crew training in an electromagnetic denied environment. The contractor shall deliver end item documentation as specified in the order. (CDRL A00N)

OPFOR Integrated Air Defense System (IADS) Components The contractor shall design, develop, assemble, sustain, upgrade, and install OPFOR IADS subsystems such as Plot extractors, Threat Command and Control (C2) Displays, and C2 software. The contractor shall deliver end item documentation as specified in the order. (CDRL A00N) EW Multiplexer (EWMUX) The contractor shall upgrade and sustain the EW information system (EWMUX). Delivered EWMUX units shall have classified and unclassified solutions in support of individual ranges’ cybersecurity requirements. The contractor shall sustain and upgrade the EWMUX interface hardware and software and implement enhancements to satisfy operational requirements and Armed Forces combat readiness training requirements. The contractor shall deliver end item documentation, which includes design, development, testing, integration, acceptance, and drawings, as specified in the order. (CDRLs A001, A008, A009, A00A, A00B, A00C, A00D, A00E, A00F, A00G, A00H, A00K, A00Q, A00R, and A00S)

Smart Target/Multispectral Threats Development The contractor shall design, develop, assemble, deliver, and integrate smart targets/multispectral threats systems and related range instrumentation. The frequency spectrum for the smart targets/multispectral threats includes radio frequency (RF), ultraviolet (UV), infrared (IR), electro-optic (EO), and visual stimulation capabilities. The contractor shall deliver end item documentation, which includes design, development, testing, integration, acceptance, and drawings. (CDRLs A001, A003, A008, A009, A00B, A00K, A00Q, A00R and A00S)

Studies, Analyses, and Site Surveys The contractor shall travel to ranges identified in Appendix B, analyze, assess, and provide upgrade solutions to improve functionality of currently active threat systems, and to activate threat systems currently inactive due to obsolete technology. Appendix A represents 28 currently active threat systems, while the rest represent inactive threat systems and peripheral equipment. Elements that shall be considered are quality, reliability, maintainability, interoperability, foreign threat intelligence data, frequency allocation applications, vulnerability to high-power irradiation, and EW threat presentation capabilities by the Ranges. Analysis shall include operational risk management (ORM) associated with the operation of EWTS, peripheral instrumentation, and networks. (CDRL A00N). Note: Appendix A and Appendix B are not all inclusive. Additional ranges, systems and equipment could be added under individual T/DO.

Web-Accessible Database The contractor shall develop, maintain, and upgrade a web-accessible database. This database will host design information, Technical Data Packages (TDPs), software/hardware configuration, prediction analyses, testing and training documentation, data revision tracking information, and procured or licensed original equipment manufacturer (OEM) documentation. The database will provide data entry forms and maintenance data, status of threat systems, component accounting information, failure reports, software problem reports (SPRs), corrective action reports, DRs, EI reports, maintenance and repair logs, trouble calls, recommended corrective actions, and budget tools. The contractor shall maintain the web-accessible database with the most current data within 5 working days after receipt of the data. The contractor shall also maintain a mirror backup site. The website database shall be available 24 hours per day, 7 days per week. The contractor shall notify the Government of changes within 24 hours via email. The website may be down up to 1 hour per week for maintenance. If the website is down any longer than 1 hour, the contractor shall notify the Government and use its mirror backup site. (CDRL A001)

EWTS System Support Activity (SSA) The contractor shall provide engineering, configuration management/data management (CM/DM), and logistics, in support of EWTS SSA located at NAWCWD China Lake. The contractor shall respond to trouble calls from the Ranges and provide corrective actions and inventory status. The contractor shall provide a response to the caller within 24 hours of received trouble call. (CDRL A00L)

Cybersecurity The contractor shall provide the technical expertise and means to develop documentation in support of EWTS compliance with System Security Accreditation Agreement (SSAA), RMF or variants, Authority to Connect (ATC), and Authority to Operate (ATO). (CDRL A00N and A00S)

Training The contractor shall create or modify documentation covering the operational procedures of newly developed or modified EWTS and peripherals. The contractor shall provide training for the operation of systems and the preventive field maintenance of systems and components. Training may include hands-on training, classroom training, instruction manuals, or online tutorials. (CDRL A001 and A006)

Future Capabilities The contractor shall assess new foreign threats and their impact on Aircrew Training Systems. The contractor shall create concepts, engineering models, prototypes, surrogates of foreign threats and integrate into ranges capabilities, combat training systems and readiness. (CDRL A001, A00B, A00C, and A00W)

DELIVERABLES

Monthly Status Report The contractor shall deliver a monthly Cost/Schedule Status Report (C/SSR) that includes cumulative funds/hours expended, a summary of work performed per project and task, problems encountered, problems resolved, compliance to schedules, risks to completion of the T/DO and other relevant information. The Travel Section of the report shall contain the following for each travel trip taken during the month: name(s) of travelers, travel dates, destinations, and purpose of the trip. This report shall be submitted in accordance with CDRL A00L.

Monthly Funds and Man-Hours Expenditure Report The contractor shall submit a report detailing all labor, material, and travel costs to the Government. (CDRL A00U)

Quality Assurance (QA) The contractor shall conduct QA in accordance with the T/DO and applicable documents. The contractor shall deliver QA audits conducted on products and software development processes. QA audits shall cover project initialization, project planning, project execution, project closure, requirements management, CM, subcontracting, metrics collected, material purchases. (CDRL A00Z)

0. Configuration Management The contractor shall submit a Configuration Management Plan (CMP) in accordance with CDRL A005 to serve, during the contract performance period, as the benchmark for controls to be used for effective software, hardware, and firmware configuration. The CMP shall be periodically evaluated and updated as specified in CDRL A005, as part of continuous process improvement efforts subject to Government review and approval.

Earned Value When applicable, the contractor shall implement an Earned Value Program. Specific efforts shall include preparation of Work Breakdown Structures (WBSs) with associated cost and schedule plans, work package tracking, status accounting at any level identified in an individual WBS, management reserve control and status accounting, and cost and schedule trend predictions.

Product Delivery Schedule As required by individual T/DOs, the contractor shall provide a delivery schedule.

PERTINENT INFORMATION

Material The contractor shall manage material and consumable supplies at levels to meet mission requirements. The contractor must obtain prior approval from the Contracting Officer’s Representative (COR) for any purchases valued over $3,500. The contractor must obtain prior approval from the Contracting Officer for any purchases valued over $125,000. The contractor shall submit a consent package providing a description, price, evidence of adequate price competition, or if unavailable, a justification for use of a single source, and a determination that the price is fair and reasonable. The contractor shall submit all consent packages to the COR for either approval of material purchasing over $3,500 or initial review of material purchasing over $125,000. The COR will forward consent packages for material purchasing over $125,000 to the Contracting Officer for approval. These requirements apply to all contractor purchases.

Government-Furnished Equipment (GFE) The Government will provide threat systems and equipment that will be called out in applicable IPBs applicable to each order. (CDRL A00T)

Travel The contractor shall be required to travel in performance of this contract. The contractor shall be responsible for all transportation, billeting, and messing for the contractor personnel except in those cases where Government transportation, billeting, and messing are the only services available. All travel will require prior approval of the Technical Point of Contact (TPOC) and COR. All travel shall be conducted in accordance with the Joint Travel Regulations in force during the term of this contract. (CDRL A002)

Facilities The contractor shall perform the above-delineated requirements at a variety of locations and using a variety of Government and contractor provided facilities as required by the T/DO.

Contractor Facilities The contractor shall maintain suitable facilities for the execution of those tasks not requiring specific performance at government facilities. The Government will not provide facilities unless use of a specific facility at a specific location is necessary to the execution of the T/DO. These facilities shall meet the security requirements as outlined in the applicable DoD Contract Security Classification Specification (DD Form 254, Attachment TBD).

DoD/Foreign Facilities The contractor shall perform specified tasks (such as installation, integration, and testing) at various DoD locations, foreign range locations, or subcontractor and vendor facilities. Appendix B provides a list of potential range work locations.

Data Rights The contract contains clauses defining the Government’s rights regarding technical data generated under orders issued during the term of the contract. Other than restrictions associated with commercially available products, the contractor shall not use its own proprietary data or intellectual property in the performance of this contract without prior approval of the Government. The contractor shall notify the Government of its intent to use any intellectual property with less than unlimited Government rights prior to responding to a Request for Proposal (RFP) for a new order and shall provide a completed Data Rights Assertion List as required in Defense Federal Acquisition Regulation Supplements (DFARSs) 252.227-7013 and 252.227-7014.

SECURITY

Security Requirements for Classified Programs The security requirements specified herein shall apply to the contractor and subcontractors. The contractor shall safeguard classified information and meet the security requirements and IA/cybersecurity requirements identified in the applicable DoD Contract Security Classification Specification (DD Form 254). The contractor shall enforce these safeguards throughout the life of the contract.

Personnel Security Requirements The contractor shall provide personnel with the appropriate personnel security clearance levels for the work to be performed. Access to Secret information is required in the performance of this contract and shall be in accordance with the DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), incorporating change 2, 18 May 2016, applicable DoD personnel security regulations, and DoD Contract Security Classification Specification (DD Form 254). The contractor shall maintain sufficiently cleared personnel to perform the tasks required by this SOW IAW the DD Form 254 and the contract. All contractor personnel shall possess the requisite security clearance, accesses, and need-to-know commensurate with the requirements of their positions.

All contractor personnel with access to unclassified information systems, including e-mail, shall have at a minimum a favorable Tier 3 (T3) investigation.

Operations Security (OPSEC). The contractor shall comply with the OPSEC requirements outlined within the DD Form 254.

The Contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified activities, information, equipment, and material used or developed by the contractor and any subcontractor during performance of the contract. The contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. The OPSEC program shall be in accordance with DoD and DON operations security (OPSEC) requirements, to include:

1) Assignment of responsibility for OPSEC direction and implementation

2) Planning guidance for the use of the OPSEC Process to identify vulnerabilities and apply applicable countermeasures (Contact NAWCWD Industrial Security Office for a current OPSEC Annex and CI Guide)

3) Establishment of OPSEC education and awareness training

4) Provisions for management, annual review, and evaluation of OPSEC programs

5) Oversight for accountability of OPSEC requirements to subcontractors

Information Security (Access to CUI, For Official Use Only, or Government IT Systems) Direct support contractor personnel working under the purview of a DON Commanding Officer/Commander shall comply with the local security provisions and the requirements of SECNAV M-5510.36 (series). The contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of CUI and to control distribution of CUI in accordance with DoD 5220.22-M, NISPOM, and SECNAV M-5510.36.

For Official Use Only information generated and/or provided under this contract shall be marked and safeguarded as specified in Department of Defense Manual (DoDM) 5200.01, Information Security Program Manual (Volume 4) available at http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf. Contractor shall not store or transmit CUI on personal IT systems or via personal email. Unclassified email containing any DoD CUI shall be encrypted. Prior to sending CUI to any non-NMCI addressees, the sender must first positively verify all recipients are authorized access to CUI and have need-to-know. Non-NMCI recipients must have a DoD compliant PKI certificate that enables electronic transmission via unclassified networks while protecting the CUI with a digital signature and encryption.

Common Access Cards (CACs) The CAC shall be the principal identity credential for supporting interoperable access to DoD installations, facilities, buildings, and controlled spaces. All contractor CAC applications will be sent to the appointed NAWCWD COR Trusted Agent(s) to ensure vetting requirements have been met.

Communications Security (COMSEC) The contractor will require access to COMSEC at Government/contractor locations. U.S. cryptographic equipment inventory information, as well as the systems and manner in which each particular equipment is used, is for official use only. Publication or release of any related COMSEC information by any means, by the contractor, without prior written approval of the contracting officer is prohibited. The contractor must be a U.S. citizen, have a final Government security clearance with the appropriate personnel security background investigation for the level of classification involved, have strict need-to-know, have the appropriate COMSEC briefing before access is granted, and granted access only in conformance with procedures established for the particular type of COMSEC information involved. The contractor shall adhere to the DD Form 254 COMSEC security requirements, facility COMSEC material control and operating procedures, and all applicable COMSEC regulations, instructions, and policies. Prior approval from the Government Contracting Activity is required in order for a prime contractor to grant COMSEC access to a subcontractor.

Operations Security (OPSEC) The contractor shall comply with the OPSEC requirements outlined within the DD Form 254.

The contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified activities, information, equipment, and material used or developed by the contractor and any subcontractor during performance of the contract. The contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. The OPSEC program shall be in accordance with DoD and DON OPSEC requirements, to include

a. Assignment of responsibility for OPSEC direction and implementation.

b. Planning guidance for the use of OPSEC practices and principles to identify vulnerabilities and apply applicable countermeasures.

c. Establishment of OPSEC education and awareness training.

d. Provisions for management, annual review, and evaluation of OPSEC programs.

e. Flow down of OPSEC requirements to subcontractors when applicable.

The contractor shall enforce these safeguards throughout the life of the contract. The contractor shall prepare an OPSEC plan for government review in accordance with (CDRL A00M).

Public Release Disclosure of information is covered by DFARS 252.204-7000 Disclosure of Information, incorporated in Section I of the contract. Concerning subsection (a)(2), “information otherwise in the public domain” is information officially released into the public domain, e.g., via Distribution Statement A, and does not include information in the public domain that has not been officially released. For disclosure of unclassified information that has not been officially released, the contractor must seek specific approval from the Contracting Officer, with approval from the NAWCWD Public Affairs Office (PAO).

ACRONYMS