Att 01 Statement of Work 26-R-3005 (SENSS).pdf

STATEMENT OF WORK FOR

AIRBORNE SYSTEMS INTEGRATION DIVISION

SECURE EXECUTIVE NETWORK SOFTWARE SUPPORT

1.0 Scope.

As the organic Lead Systems Integrator® (oLSI®) for the Naval Air Warfare Center Aircraft Division (NAWCAD), Webster Outlying Field (WOLF) operates under a product-based business model whereby NAWCAD WOLF civilians lead and manage the execution of the requirements with combined Government-Industry teams. Using this oLSI® approach, the Government maintains control of intellectual property and data rights, enabling WOLF to rapidly adapt solutions to the dynamic needs of the warfighter.

The NAWCAD WOLF Airborne Systems Integration (ASI) Division provides the rapid insertion and transition of advanced technologies, systems, sensors, and weapons which enable Programs of Record (PoR) to successfully execute and deliver the direct insertion of capabilities to meet urgent fleet needs. The NAWCAD WOLF ASI Division, operating under the oLSI® model, has requirements for engineering and integration of various airborne capabilities to include, but not be limited to, sensors, communications systems, weapons systems, and control technologies for a variety of manned and unmanned airborne platforms. Specifically, the ASI Division requires the Contractor to support development, design, prototyping, low-rate production, demonstration, testing, integration, technical installation, transition through Initial Operational Capability (IOC), and maintenance in the domains of cyber, Maritime Domain Awareness (MDA), situational awareness, data management and dissemination, and other rapid capability software requirements with the ASI Division in support of Department of Navy (DON), Department of Defense (DoD), and other Government agency projects. This SOW includes, but is not limited to, software development, network design and architecture, cyber engineering, cybersecurity accreditation support, engineering services, installation, integration, design engineering for airborne capabilities, test and evaluation, and user and maintainer training.

2.0 Applicable Documents.

The documents listed below are presented only as representative sources of the technological interface details that may be required during TO performance. Likewise, the documentation listed is not all-inclusive, but is representative of the type of information that may be necessary to perform the work. The applicable document version is the latest version at time of award.

2.1 Department of Defense (DoD) Specifications.

2.1.1 DoD National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulation Part 117, NISPOM Rule.

2.1.2 DoDM 5200.01 Vol. 2, Marking of Classified Information, Change 4, 28 Jul 2020.

2.1.3 SECNAV M-5510.36B, Department of the Navy, Information Security Program, 12 Jul 2019.

2.1.4 DoDI 5200.48, Controlled Unclassified Information (CUI), 6 Mar 2020.

2.1.5 DoDD 5400.07, DoD Freedom of Information Act (FOIA) Program, 5 Apr 2019.

2.1.6 DoDI 5230.24, Distribution Statements on Technical Documents, Change 3,10 Jan 2023.

2.1.7 SECNAV M-5510.30C, Department of the Navy, Personnel Security Program, 24 Jan 2020.

2.1.8 OPNAVINST 3440.17A, Navy Installation Emergency Management Program, 1 Aug 2014.

2.1.9 DoDI 1035.01, Telework and Remote Work, 8 Jan 2024.

2.1.10 SECNAVINST 5239.3B, Department of the Navy Information Assurance Policy.

2.1.11 SECNAVINST 5239.25, Department of the Navy Cyberspace Workforce Qualification and Management Program, 10 Oct 2023.

2.1.12 DoDD 8140.01,Cyberspace Workforce Management,5 Oct 2020.

2.1.13 DOD Manual 8140.03 Cyberspace Workforce Qualification and Management Program, 15 Feb 2023.

2.2 DoD Standards.

2.2.1 DoDI 8510.01, Risk Management Framework (RMF) for DoD Systems, 19 Jul 2022.

2.2.2. DoDI 8500.01, Cybersecurity.

2.2.3 DoDM 4161.2-M, DoD Manual for the Performance of Contract Property Administration.

2.2.4 DoDM 5200.02, Procedures for the DoD Personnel Security Program (PSP).

2.2.5 DoDI 8140.02, Identification, Tracking, and Reporting of Cyberspace Workforce Requirements.

2.3 Other Government Documents.

2.3.1 National Institute of Standards and Technology (NIST) Special Publication (SP), 800-59.

2.3.2 National Security Presidential Memorandum-28 (NSPM-28), dated 05 Jun 1999.

2.3.3 NAVAIRINST 4355.19E, Systems Engineering Technical Review Process.

2.3.4 Intelligence Community Directive (ICD) 503, Intelligence Community Information Environment Risk Management, dated Oct 2024.

2.3.5 NAVAIR SWP4P00-047.3, Cybersafe Certification.

2.4 Industry documents.

2.4.1 American Society for Testing and Materials (ASTM) Manual A.

2.4.2 Institute of Electrical and Electronics Engineers (IEEE) 12207-2017 – ISO/IEC/IEEE International Standard – Systems and software engineering – Software life cycle processes.

3.0 Requirements.

3.1 General Requirements.

3.1.1 Compatibility. The Contractor shall maintain the capability to prepare documents and software packages compatible with the Government Information Technology (IT) environment through the security classification of Secret as specified on DD Form 254, Contract Security Classification Specification Form (Attachment 01). The current operating environment required for this TO includes:

Microsoft Windows 2016 or greater

Microsoft Project 2016 or greater

Microsoft Office Professional Plus 2016 or greater

Adobe Acrobat Reader

Internet access

Flank Speed

Microsoft Office 365

The Contractor shall maintain the ability to interface with and transfer data to and from requiring office software applications and their upgraded versions. The Contractor shall ensure that all media are virus free when delivered. The Contractor shall be capable of internet and Local Area Network (LAN) communications with the ASI Division. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with the ASI Division during working hours whether at Contractor work site or on travel.

3.1.2 Work Location, Facilities, and Telework.

3.1.2.1 Work Location. Approximately 51% of work will be performed at Government site and 49% of work to be performed at contractor site. Government sites include NAWCAD WOLF, St.

Inigoes, MD and Naval Air Station (NAS) Patuxent River, Patuxent River, MD.

3.1.2.1.1 Government Site Requirements. Contractors performing on-site support will be provided access to workspaces, telephones, printers, facsimile machines, copy machines, shredders, computers, and network access including web servers and applicable databases or other applications necessary to carry out assigned tasks.

3.1.2.1.2 Contractor Site Requirements. The Contractor shall provide its own primary support facilities needed to perform the tasking of this TO, which must be located within 50 drivable miles of NAWCAD WOLF, St. Inigoes, MD in order to satisfy the daily support and administrative operations of this TO. The cost of general purpose business items/expenses required for the Contractor to conduct its normal business operations will not be considered an allowable direct cost in the performance of this TO. General purpose business items include, but are not limited to, the cost for items such as telephones and telephone charges, reproduction machines, personal computers, and other office equipment and supplies. The Government will not assume responsibility to retain the facility or take control of the title after the TO is complete.

3.1.2.2 Meeting Support. In support of the tasking outlined in this Statement of Work (SOW), the Contractor shall have the capability to host and conduct meetings at the classification level up to secret with the capacity to support a minimum of 15 persons. This support shall be provided within 50 drivable miles of NAWCAD WOLF, St. Inigoes, MD.

3.1.2.3 Telework.

The Contractor may allow Contractor employees to telework in accordance with (IAW) DoDI 1035.01, Telework and Remote Work, and in section 3.4 of this SOW. The Contractor may utilize alternate work sites/locations to telework to support continued performance of SOW tasks IAW company policy. When using telework, the Contractor remains responsible for TO performance and compliance with any applicable cost accounting standards and contract cost principles/procedures.

Telework is defined as an alternative workplace arrangement under which a position performs the duties and responsibilities of the assigned position and other authorized activities from an approved alternative worksite but is required to report to the agency’s worksite on a regular and recurring basis. Telework can be either routine or situational. Routine telework is performed from an alternative worksite on regularly scheduled telework day(s), whereas situational telework is authorized on a case-by-case basis as the need arises or when opting for unscheduled telework and may be authorized for routine teleworkers in such circumstances on regularly scheduled in-office days.

Telework-eligible positions require routine on-site performance of two days per week. On-site performance may be required outside of routine on-site performance days and shall be provided when requested by the Contracting Officer's Representative (COR).

At any time during TO performance, the COR may determine that a position is no longer eligible for routine telework and/or situational telework by providing a notice 30 calendar days in advance so the Contractor can address changes needed to support mission requirements.

3.1.3 TO Status Reporting. The Contractor shall provide the following documentation.

3.1.3.1 Monthly Progress and Financial Status Report. The Contractor shall provide a progress and financial status report IAW the Contract Data Requirements List (CDRL). The report shall include work accomplished since submittal of the last report, both monthly and cumulative work hour labor costs expended by labor category, and material and travel costs.

(CDRL A001)

3.1.4 Work schedule to include Compressed Work Schedule (CWS), holidays, and installation closure.

3.1.4.1 Work Schedule. The Contractor shall provide the required services and staffing coverage during normal working hours. Normal working hours are usually 8.5 hours (including a 30-minute lunch break), from 0730 to 1600 each Monday through Friday (except on the legal holidays as specified in paragraph 3.1.4.1.2). Some supported Government offices have flexibility to start as early as 0600 and end as late as 1800 Monday – Friday.

3.1.4.1.1 CWS. CWS is an alternative work schedule to the traditional 5 8.5-hour workdays (which includes a 30-minute lunch break) worked per week. Under a CWS schedule, an employee completes the following schedule within a 2-week period of time: 8 weekdays are worked at 9.5 hours each (which includes a 30-minute lunch break), 1 weekday is alternately worked at 8.5 hours (which includes a 30-minute lunch break), and 1 weekday is not worked by the employee. The result is 80 hours worked every 2 weeks, with 44 work hours 1 week and 36 work hours the other.

The Contractor may allow its employees to work a CWS schedule provided the requirements of this SOW are met. If the Contractor chooses to allow its employees to work a CWS schedule in support of this TO, any additional costs associated with the implementation of the CWS schedule vice the standard schedule are unallowable costs under this TO and will not be reimbursed by the Government. Additionally, the CWS schedule shall not prevent contractor employees from providing necessary staffing and services coverage as required by the Government to the COR/Alternate Contracting Officer’s Representative (ACOR).

3.1.4.1.2 Holidays. The Government observes the Federal holidays identified on the Office of Personnel Management (OPM) website: https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview. With the exception of the events in section 3.1.4.1.3 below, the Contractor is permitted to observe Federal holidays IAW its corporate policy.

3.1.4.1.3 Installation Closure. When Federal facilities are closed by the Government or when Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility-related problem that prevents Federal personnel from working at the Government facility, Contractor personnel assigned to work at that facility in support of such Federal employees shall follow their parent company’s policies.

While generally Contractor personnel may not perform work on-site at a Government facility without oversight from Federal personnel, in very limited circumstances, work being performed by contractor personnel may be deemed mission essential and performance of such mission essential work may be authorized to continue at the Government facility despite the facility being otherwise closed for normal operations. The circumstances permitting work being performed by Contractor personnel to be deemed mission essential are extremely limited and generally only apply to performance of efforts related to public health, safety, or matters related to national security shall be IAW National Security Decision Directive 298. The cognizant Contracting Officer (KO) must concur with any determination that work being performed by Contractor personnel is mission essential.

3.1.5 Other Direct Costs (ODCs). Procurement (PROC); Operations and Maintenance (O&M);

Foreign Military Sales (FMS); Research, Development, Test and Evaluation (RDT&E); and Working Capital Funds (WCF).

3.1.5.1 Travel. Travel may include general and administrative expenses but shall not include profit. Temporary travel to other locations in support of program tasking is required. If required, temporary travel includes both Continental United States (CONUS) and Outside the Continental United States (OCONUS) locations. CONUS locations may include, but are not limited to: San Diego, CA; Jacksonville, FL; Lake Charles, LA; Oklahoma City, OK; Waco, TX; and Norfolk, VA. OCONUS locations may include, but are not limited to: Australia, Guam, Japan, and Korea.

This list is not all inclusive as locations may change over the life of the TO.

3.1.5.1.1 Local Travel Reimbursement. Reimbursement of local travel to and from NAS Patuxent River, NAWCAD WOLF, the Contractor’s facility or facilities, and the surrounding area by the Contractor or Subcontractor at a distance equal to or less than 50 drivable miles of NAWCAD WOLF is not an allowable cost.

3.1.5.1.2 Travel Request Authorization. The Contractor shall complete travel requests IAW CTXT.232-9509, Travel Approval and Reimbursement Procedures. Upon completion of the travel, the Contractor shall complete a travel report. (CDRL A002)

3.1.5.1.3 Synchronized Pre-Deployment & Operational Tracker (SPOT). The Contractor may travel to U.S. Central Command locations. IAW Clauses 252.225-7040 and 5152.225-5908, SPOT enables the validation of Contractors Authorized to Accompany the Force (CAAF), their authorization and eligibility for access to specific DoD facilities, and their eligibility for specific Government Furnished Support (GFS). The Contractor shall initiate a Letter of Authorization (LOA) for each prospective traveler. The Contractor shall use the SPOT link (https://spot.dmdc.mil/privacy.aspx) to enter and maintain data with respect to traveling/deployed personnel and to generate LOAs.

3.1.5.1.4 LOA. The Contracting Officer will provide an LOA for official travel OCONUS, when applicable, in support of the TO. The LOA will identify local authorizations, privileges, etc. as specified by DoD requirements. All defense contractor employees working under this TO shall carry an LOA with them, when applicable, at all times while deployed OCONUS.

3.1.5.2 Material. Incidental material will be required in the performance of this TO, and all incidental material purchases shall be IAW CTXT-242.9520, Procedures and Approvals Required Prior to Incurring Direct Material Costs. All materials not depleted during the performance of this TO shall become Government property upon completion of this TO. The Contractor shall transfer all materials not depleted to the COR by way of a DD Form 250, Material Inspection and Receiving Report. Material costs may include general and administrative expenses but shall not include profit/fee. (CDRL A003)

3.1.6 Subcontractors. Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this TO. All provisions of this SOW shall flow down to subcontractors providing support under this TO.

3.1.6.1 The Contractor shall submit a Small Business Participation Commitment Document

(SBPCD) (CDRL A004).

3.1.7 Management of Contractor Personnel. The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual Contractor employees. The Contractor shall manage its employees and guard against any actions that are of the nature of personal services or actions that give the perception of personal services.

3.1.8 Transition-Out Strategy.

The Contractor’s overall transition-out strategy shall be built around maintaining the mission of the ASI Division with minimal impact, not only in terms of timeliness of performance but also to ensure that critical data and knowledge transfer occurs. Prior to the termination or expiration of the TO, the Contractor shall ensure an orderly transition of responsibilities, while minimizing impact to the operation. The Contractor shall submit a Transition-Out Plan, to include the minimum elements listed below IAW CDRL A005.

- Work turnover. The Contractor shall provide a plan of action to effectively transfer tasked work that is in process at the expiration or termination of the TO to the successor company and establish and maintain effective communication with the incoming Contractor or Government personnel for the period of transition via weekly status meetings.

- Quality Assurance (QA). The Contractor shall provide a plan of action to ensure continuation of quality review processes during the transition period to the successor company.

- Risk mitigation strategies. The Contractor shall provide a plan of action to mitigate TO performance risks (quality and schedule) encountered during the transition period.

- Data/information transfer. The Contractor shall provide a plan of action for the efficient inventory and transfer of program data to the successor company.

3.1.9 Technical Direction Letters (TDLs). When necessary, technical direction or clarification concerning the details of specific tasks set forth in the TO will be given through issuance of written TDLs. TDLs will not, in any manner, alter the scope of the TO. For further direction see HTXT.242-9502, Technical Direction (Variation) in Section H of the TO. The Contractor shall prepare and deliver a COR Management Report for TDLs IAW CDRL A001.

3.1.10 Organizational Conflicts of Interest (OCI) and Non-Disclosure Agreement (NDA) Status Certification. The Contractor shall report OCI Mitigation Plan compliance and compliance status changes. (CDRL A006)

3.1.11 Government Furnished Property (GFP). Any GFP that may be required will be listed during execution of the TO and will be provided to the Contractor to support the TO. Disposition of GFP will be made at TO completion. (CDRLs A007)

3.2 Security.

3.2.1 Citizenship Requirements. Only U.S. citizens may perform under this TO, unless waived by the Government. If the Contractor cannot find qualified U.S. citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office. The waiver request should include:

a) The individual's name, date and place of birth, position title, and current citizenship.

b) A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements.

c) A statement of the unusual expertise possessed by the applicant.

d) A statement that access will be limited to a specific Government contract (specify contract number).

e) A statement that the Contractor has obtained an export license for the information required to perform the TO.

3.2.2 Investigative Requirements.

Unclassified: All Contractor personnel must be eligible to perform Non-Critical Sensitive work as defined by SECNAV M-5510.30C. All Contractor personnel are required to have a favorably adjudicated Tier-3 investigation from the OPM. The Contractor shall submit a request for personnel security investigation to the Government Security Office. The Government Security Office shall initiate the Contractor employee's Electronic Questionnaire for Investigations Processing (eQIP) and shall perform a preliminary screening of the Contractor employee's eQIP for suitability and derogatory information. The Contractor employee shall provide all requested information pursuant to the Privacy Act of 1974. The Government Security Office may deny the Contractor employee access to Government facilities and information and may prohibit the Contractor employee from performing sensitive duties for failure to provide requested information or when derogatory or adverse information is present on the Contractor employee's eQIP. In such cases, the Contractor employee may not perform on the TO.

Classified: All Contractor personnel shall maintain security clearance eligibility commensurate with the level of classification of the work performed as annotated in the Contract's DD Form 254, Contract Security Classification Specification Form. Contractor personnel shall require access to classified information in performance of this TO up to and including Top Secret Special Compartmentalized Information (TS SCI) facility level per Director of Central Intelligence Directive (DCID) 6/3, Protecting Sensitive Compartmented Information within Information Systems, with a safeguarding level of Secret. Contractor personnel will require access to classified information in performance of this TO up to and including Top Secret (TS)/Sensitive Compartmented Information (SCI). The Contractor will require a final Top Secret Facility Clearance Level (FCL), with an approved safeguarding level of Secret.

The Contractor is responsible for ensuring that all personnel receive the requisite investigation and are favorably adjudicated IAW National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulation Part 117, NISPOM Rule and DoDM

5200.01 Vol. 2, Marking of Classified Information, Change 4, 28 Jul 2020. Contractor employees who fail to meet security clearance requirements may not access classified information or perform sensitive duties. In such cases, the Contractor employee may not perform on the TO.

3.2.3 Contractor Personnel Labor Category Security Requirements. All personnel shall have, at a minimum, interim Secret clearances within 60 calendar days of award with the exceptions noted in the table below.

LABOR CATEGORY

DoD SECURITY

CLEARANCE

LEVEL (INTERIM

CLEARANCE

ACCEPTABLE)

NUMBER OF

CLEARED

EMPLOYEES

REQUIRED

OFF-

SITE/ON-

SITE

REQUIRED

CALENDAR

DAYS AFTER

ISSUANCE OF

TO

Computer Network Architects, Intermediate, 15-1241

Top Secret with favorable Tier 5

On-Site

Computer Systems Analysts, Advanced, 15-1211

Engineers, All Other (Systems Engineer), Journeyman, 17-2199

Engineer), Senior, 17-2199, KEY

Off-Site

General and Operations Managers (Tactical Network and Computer Systems Administrator), Intermediate, 11-1021

(Tactical Network and Computer Systems Architect), Advanced, 11-1021

Information Security Analysts, Advanced, 15-1212

Network and Computer Systems Administrators, Intermediate, 15-

Operations Research Analysts (Cyber Analyst/Modeler), Advanced, 15-2031

Software Developers, Intermediate, 15-1252

Software Developers, Advanced, 15-

1252, KEY

Software Quality Assurance Analysts and Testers, Advanced, 15-1253

3.2.4 Common Access Card (CAC)/Public Key Infrastructure (PKI) and System Authorization Access Request (SAAR).

3.2.4.1 SAAR. All Contractor personnel requiring access to Government IT systems shall have an approved DD Form 2875, System Authorization Access Request (SAAR) form on file and complete required Annual Information Awareness Training. New employees must submit their SAAR forms within 30 business days of their first day of work. SAAR forms shall be submitted to the COR, Government Technical Point of Contact (TPOC), or to the assigned Government Mission Partner Identity, Credential, and Access Management (MP ICAM) Trusted Associate

(TA).

3.2.4.2 CAC/Local Badges. Contractor CACs and facility-specific identification badges will be issued by the Government to on-site Contractor personnel and shall be visible at all times while personnel are at the Government site. The Contractor shall furnish all requested information required to facilitate issuance of identification badges. All CACs and identification badges issued to Contractor employees shall be returned to the TA following completion of the TO, relocation or termination of an employee, or upon request from the COR/Procuring Contracting Officer (PCO). The Government will provide the Contractor access to Government facilities, as required, for performance of tasks under this TO.

3.2.4.3 DD Form 254. The Contractor shall comply with security requirements specified in the DD Form 254 attached to this TO. Information or data that the Contractor accesses shall be handled at the appropriate classification level. Unclassified information shall be handled in accordance with the appropriate designation (Controlled Unclassified Information (CUI); Legacy

For Official Use Only (FOUO); Covered Defense Information (CDI)). Distribution is authorized to the Requiring Office’s Organization and supported Activity only. Other requests for deliverables under this TO shall be referred to the TPOC/COR of this TO for approval.

3.2.5 Information Security. If the work is performed at the Contractor's facility, the Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and CUI and to control distribution of CUI IAW National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulations Part 117, NISPOM Rule and SECNAV M-5510.36B, Department of the Navy, Information Security Program. If the work is performed at the Government's facility, the Contractor shall comply with facility security procedures and controls.

All Contractor facilities shall provide an appropriate means of storage for CUI and materials. All CUI including legacy FOUO and CDI (meeting the definition DFARS Clause 252.204–7012, Safeguarding Covered Defense Information and Cyber Incident Reporting) generated and/or provided under this TO shall be marked and safeguarded as specified in DoD Instruction 5200.48, Controlled Unclassified Information (CUI) available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF.

Any product containing CDI shall be assigned a distribution statement (distribution statements B through F) using the criteria set forth in DoDI 5230.24, Distribution Statements on Technical Documents and have this statement displayed per DoDI 5230.24, Enclosures 3 and 4.

Distribution is authorized to the Requiring Office's Organization and supported Activity only.

Other requests for deliverables under this TO shall be referred to the TPOC/COR of this TO for approval.

All controlled unclassified technical information shall be appropriately identified and marked with the following distribution statement:

Distribution Statement (Insert Appropriate Letter and Authorization Title), (Insert Appropriate Reason Category) (dated – (Date of Distribution Authorization)). Other requests shall be referred to: Commander, Naval Air Systems Command, Attn: ASI COR, 17800 Moll’s Cove Road, Building 8125, St. Inigoes, MD 20684.

The Contract deliverables (including reports, software and hardware) will not be classified at the SCI level. SCI shall be utilized and accessed as part of routine work only.

3.2.5.1 Marking. All information generated by the Contractor shall be properly marked.

Classified information shall be marked IAW DoDM 5200.01, Vol 2, Marking of Classified Information. CUI, including legacy FOUO information generated and/or provided under this TO, shall be marked IAW DoDI 5200.48, Controlled Unclassified Information (CUI). Technical information shall also be marked with appropriate Distribution Statements and Export Control warnings IAW DoDI 5230.24, Distribution Statements on Technical Documents and program Security Classification Guidance.

3.2.5.2 Public Release. Any CUI pertaining to this TO shall not be released for public dissemination, including posting to any social media sites such as Facebook or X (formerly known as Twitter), unless it has been approved for public release by appropriate U.S.

Government authority. Proposed public releases shall be submitted for approval prior to release through the NAWCAD WOLF ASI Division COR, NAVAIR Form 5720.10, which must be completed and attached.

3.2.5.3 Loss, compromise, and/or electronic spillage of classified information or CUI. All instances of loss, compromise, and electronic spillage of classified information or CUI shall be reported to the COR, TPOC, and Government Security Office within 72 hours of the incident occurring.

3.2.6 Operations Security (OPSEC). The Contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the Contractor and any Subcontractor during performance of the TO. The Contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. This program may include Information Assurance (IA) and Communications Security (COMSEC). The OPSEC program shall be IAW National Security Decision Directive (NSDD) 298 and at a minimum shall include:

1) Assignment of responsibility for OPSEC direction and implementation.

2) Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

3) Establishment of OPSEC education and awareness training.

4) Provisions for management, annual review, and evaluation of OPSEC programs.

5) Flow down of OPSEC requirements to subcontractors when applicable.

While performing at Naval Air Systems Command (NAVAIR) or NAVAIR sites, the Contractor shall comply with facility OPSEC program instructions and contribute to organization-level OPSEC efforts; include OPSEC as part of its ongoing security awareness program and take all required Agency training; be responsive to the Supporting OPSEC Manager on a non-interference basis; and protect sensitive unclassified information and activities that could compromise classified information or operations or degrade the planning and execution of operations performed by the Requirements Owner and Contractor in support of the mission.

(CDRL A008)

3.2.7 Antiterrorism Force Protection and Emergency Management. The work performed on this TO is not Emergency Essential IAW OPNAVINST 3440.17A, Navy Installation Emergency Management Program and Government Emergency Management, Antiterrorism, and/or Continuity of Operations Plans. Contractor personnel shall comply with all Government Emergency Management, Antiterrorism, and/or Continuity of Operations Plans and directives.

Contractor personnel shall not report for work at Government facilities upon declaration of Force Protection Condition CHARLIE or in any event or emergency where Government officials direct curtailment of operations to “Mission Essential Only.” All Contractor personnel assigned to a Government facility shall complete annual Antiterrorism (Level One) and Active Shooter training.

3.3 Detailed Support Requirements.

3.3.1 Software Support.

3.3.1(a) (PROC) Provide software support to modify, modernize, retrofit, integrate, and conduct initial training and production engineering on software, computers, and networks during the production phase of a project’s life cycle. Applicable to paragraphs 3.3.1.1 – 3.3.1.3.

3.3.1(b) (O&M) Provide software support to operate, maintain, refurbish, overhaul, train, and perform in-service engineering on software, computers, and networks. Applicable to paragraphs

3.3.1.1 – 3.3.1.3.

3.3.1(c) (FMS) Provide software support to develop, prototype, evaluate, establish performance capabilities, operate, maintain, refurbish, overhaul, train, perform in-service engineering, modify, modernize, retrofit, integrate, and conduct initial training and production engineering on software, computers, and networks for FMS customers. Applicable to paragraphs 3.3.1.1 – 3.3.1.3.

3.3.1(d) (RDT&E) Provide software support to research, develop, prototype, evaluate, establish performance capabilities, support associated testing and evaluation efforts, and support training in order to meet developmental milestones prior to operational use for software, computers, and networks during the RDT&E phase of a project’s life cycle. Applicable to paragraphs 3.3.1.1 – 3.3.1.3.

3.3.1(e) (WCF) Provide software support to develop, prototype, evaluate, establish performance capabilities, operate, maintain, refurbish, overhaul, train, perform in-service engineering, modify, modernize, retrofit, integrate, and conduct initial training and production engineering on software, computers, and networks during all phases of a project’s life cycle IAW Institute of Electrical and Electronics Engineers (IEEE) 12207-2017 – ISO/IEC/IEEE International Standard – Systems and software engineering – Software life cycle processes. Applicable to paragraphs 3.3.1.1 – 3.3.1.3.

3.3.1.1 Software Development Support.

3.3.1.1.1 The Contractor shall support the analysis of requirements for and development of software to include coding and implementation according to applicable coding standards (e.g., the Institute of Electrical and Electronics Engineers (IEEE) 12207-2017 – ISO/IEC/IEEE International Standard – Systems and software engineering – Software life cycle processes), Security Technical Implementation Guides (STIGs), and software governance models. (CDRL A009)

3.3.1.1.2 The Contractor shall provide support by researching, analyzing, developing, and modifying software architectures to meet system requirements and by documenting the architectures in engineering documentation including software requirements specifications, software description documentation, software test plans, and requirements verification matrices.

(CDRLs A010, A011, A012, and A013)

3.3.1.1.3 The Contractor shall support the development of software needed to ensure that aircraft mission systems, ground support equipment, and operator systems are operational and tactically relevant. This may include, but is not limited to, system integration support and fusion of multiple sensors and technologies, communication devices, data sources, and disparate networks.

Representative platform sensors may include, but not be limited to, Geospatial Intelligence (GEOINT), Imagery Intelligence (IMINT), Signals Intelligence (SIGINT), Measurement and Signature Intelligence (MASINT), imagery, and communications. Representative communication systems may include, but not be limited to, Link 16, Digital Video Broadcast Second Generation/Extended (DVB-S2/X), Multi-User Object System (MUOS), and Commercial-Off-the-Shelf (COTS) and Government-Off-the-Shelf (GOTS) Mobile Ad-Hoc Networking

(MANET).

3.3.1.1.4 The Contractor shall support the development of software needed to record and analyze data from system, communication, and sensor technologies. (CDRL A009)

3.3.1.1.5 The Contractor shall support the development of embedded system design software to include, but not be limited to, Programmatic Logic Controllers (PLCs) and Microprocessors using assembly level language as well as higher level languages to include, but not be limited to, Ada, C++ and Java. (CDRL A009)

3.3.1.1.6 The Contractor shall support the development of real time application software for weapon systems, platforms, and networks. Software may be mission critical, flight safety critical, and/or National Defense time critical. (CDRL A009)

3.3.1.1.7 The Contractor shall support the development of bi-directional custom control software and/or firmware to interface with mission system components and IT infrastructure. (CDRL A009)

3.3.1.1.8 The Contractor shall support the development of application software for information systems that support the development, tracking, monitoring, analysis, sustainment, situational awareness, decision making, data fusion, data reduction, and data visualization for DoD business and mission systems. (CDRL A009)

3.3.1.1.9 The Contractor shall support the creation and maintenance of a software repository for COTS, GOTS, and Government-purpose software to include technical documentation, system configurations, and source code. (CDRL A014)

3.3.1.1.10 The Contractor shall support the development of algorithms, autonomy, machine learning, artificial intelligence, and deep learning for advanced selection and processing techniques to enable new cyber capabilities or enhancements to existing capabilities to include, but not be limited to, signal processing, data processing, sensor calibration, performance assessment, and real-time and post-processing tools.

3.3.1.1.11 The Contractor shall support the design and development of software security constructs to include, but not be limited, to Multi-Level Security (MLS) interfaces, devices, and rule creation.

3.3.1.1.12 The Contractor shall support the design and development of prototype software to evaluate and verify the inclusion of capabilities into software baselines.

3.3.1.1.13 The Contractor shall support the research and development of software to consolidate, evaluate, and provide the user with fault detection, isolation, and resolution procedures for the system.

3.3.1.1.14 The Contractor shall support researching and developing intuitive user interfaces and control of complex software implementations in streamlined applications.

3.3.1.2 Software Documentation Support.

3.3.1.2.1 The Contractor shall support the creation of necessary software documentation and artifacts related to the development, use, and administration of software IAW applicable coding guidelines (e.g., Institute of Electrical and Electronics Engineers (IEEE) 12207-2017 – ISO/IEC/IEEE International Standard – Systems and software engineering – Software life cycle processes and Capability Maturity Model Integration (CMMI) guidelines).

3.3.1.2.2 The Contractor shall support the Government with the development of System Engineering Technical Review (SETR) documentation as it relates to the development of software solutions. IAW NAVAIRINST 4355.19E, Systems Engineering Technical Review Process.

3.3.1.2.3 The Contractor shall support the development of Software Requirement Specifications.

(CDRL A010)

3.3.1.2.4 The Contractor shall support analyzing and updating configuration control of software baselines to include tracking changes between major, minor, and incremental software builds in Software Design Descriptions (SDDs). (CDRL A011)

3.3.1.2.5 The Contractor shall support the development of Software Version Descriptions (SVDs). (CDRL A015)

3.3.1.2.6 The Contractor shall support the development of Interface Requirements Specifications.

(CDRL A016)

3.3.1.2.7 The Contractor shall support the development of Interface Design Descriptions (IDDs).

(CDRL A017)

3.3.1.2.8 The Contractor shall support the development of System/Subsystem Design Descriptions. (CDRL A018)

3.3.1.2.9 The Contractor shall support the development of verification matrices associating software components and functions to overall system requirements. (CDRL A013)

3.3.1.2.10 The Contractor shall assist by developing and updating software documentation at a level of detail that is sufficient enough to provide a developer with comparable levels of experience and the ability to further develop software products IAW American Society for Testing and Materials (ASTM) manual A. The software documentation shall include, at a minimum, the following: a complete description of all software-developed instructions for using routines and programs supplied and delivered; a listing of each program supplied and delivered;

source code; and all command line, keys, passphrases, configurations, and executables required for the Government’s continued development and use.

3.3.1.3 Software Testing Support.

3.3.1.3.1 The Contractor shall support the development of software test cases, procedures, and test case results to include, but not be limited to, regression training, suitability testing, and acceptance testing. (CDRL A012)

3.3.1.3.2 The Contractor shall support the preparation of test reports. (CDRL A019)

3.3.1.3.3 The Contractor shall support the design, development, and fabrication of prototype testing software, articles, and equipment.

3.3.1.3.4 The Contractor shall support the process of analyzing software integration on new and existing software code.

3.3.2 IT Support.

3.3.2(a) (PROC) Provide IT support to modify, modernize, retrofit, integrate, and conduct initial training and production engineering on software, computers, and networks during the production phase of a project’s life cycle. Applicable to paragraphs 3.3.2.1 – 3.3.2.4.

3.3.2(b) (O&M) Provide IT support to operate, maintain, refurbish, overhaul, train, and perform in-service engineering on software, computers, and networks. Applicable to paragraphs 3.3.2.1 – 3.3.2.4.

3.3.2(c) (FMS) Provide IT support to develop, prototype, evaluate, establish performance capabilities, operate, maintain, refurbish, overhaul, train, perform in-service engineering, modify, modernize, retrofit, integrate, and conduct initial training and production engineering on software, computers, and networks for FMS customers. Applicable to paragraphs 3.3.2.1 – 3.3.2.4.

3.3.2(d) (RDT&E) Provide IT support to research, develop, prototype, evaluate, establish performance capabilities, support associated testing and evaluation efforts, and support training in order to meet developmental milestones prior to operational use for software, computers, and networks during the RDT&E phase of a project’s life cycle. Applicable to paragraphs 3.3.2.1 – 3.3.2.4.

3.3.2(e) (WCF) Provide IT support to develop, prototype, evaluate, establish performance capabilities, operate, maintain, refurbish, overhaul, train, perform in-service engineering, modify, modernize, retrofit, integrate, and conduct initial training and production engineering on software, computers, and networks during all phases of a project’s life cycle. Applicable to paragraphs 3.3.2.1 – 3.3.2.4.

3.3.2.1 IT Design and Development Support.

3.3.2.1.1 The Contractor shall support the development of information system architectures for systems and systems of systems. This includes, but is not limited to, system requirements, functional diagrams, physical block diagrams, connectivity diagrams, hardware and software lists, and other architecture elements. (CDRLs A017, A018, A020, A021, A022, and A023)

3.3.2.1.2 The Contractor shall support these products through standard architecture tools and/or through Model-Based System Engineering (MBSE) tools.

3.3.2.1.3 The Contractor shall support development of information system device hardware, software, and firmware configurations.

3.3.2.1.4 The Contractor shall support research and development of tools, procedures, applications, and scripts to integrate baseline information technologies configurations into multiple similar or diverse platforms.

3.3.2.1.5 The Contractor shall support analyzing life cycle and maintenance operations through development of networking tools and procedures for systems equipment.

3.3.2.2 IT Testing and Integration Support.

3.3.2.2.1 The Contractor shall support integration and upgrades of mission system components to include, but not be limited to, radios, antennas, servers, switches, routers, virtual machines, cryptographic items, Wide Area Network (WAN) components, LAN components, Cross Domain Systems (CDS), access points, wireless controllers, and related support equipment and peripherals into a cohesive system. (CDRLs A017 and A024)

3.3.2.2.2 The Contractor shall support researching, analyzing, and developing system interfaces to connect systems to external systems to include assessing areas such as satellite connectivity, WANs, telephony systems, data repositories, secure enclaves, and other distributed DoD and non-DoD systems. (CDRL A017)

3.3.2.3 IT Administration and Maintenance Support.

3.3.2.3.1 The Contractor shall support IT administration duties.

3.3.2.3.2 The Contractor shall support the installation, configuration, and troubleshooting co of routers, switches, firewalls, servers, desktop computers, laptop computers, peripheral equipment, and other IT devices.

3.3.2.3.3 The Contractor shall support analyzing and updating repositories of system attributes to include, but not be limited to, networking scripts, configuration files, credentials, address mapping, access control lists, PKI, policies, procedures, and archives.

3.3.2.3.4 The Contractor shall support researching, analyzing, and administering Software Integration Laboratory (SIL) networks to include administering software updates patches and security updates.

3.3.2.3.5 The Contractor shall support configuration analysis and verification of SIL networks.

3.3.2.4 Network Documentation Support.

3.3.2.4.1 The Contractor shall support the development of IT architecture documentation. (CDRL A020)

3.3.2.4.2 The Contractor shall support the development of system designs and drawings for IT architecture. (CDRL A020)

3.3.2.4.3 The Contractor shall support the Government with the development of SETR documentation as it relates to the development of network solutions.

3.3.2.4.4 The Contractor shall support researching, analyzing, and developing configuration control for systems to include documenting system parameters, architectures, interfaces, and scripting languages.

3.3.2.4.5 The Contractor shall support the development of verification matrices, associating network components and functions to overall system requirements. (CDRL A013)

3.3.2.4.6 The Contractor shall support reviewing and analyzing product drawings and associated lists to verify technical adequacy and conformance to technical requirements. (CDRLs A023 and A025)

3.3.2.4.7 The Contractor shall support analyzing new system concepts prior to incorporation into Technical Data Packages (TDPs), which are established baselines of the networks. (CDRL A024)

3.3.3 Cyber Assessment, Accreditation, and Resilience Support.

3.3.3(a) (PROC) Provide cyber assessment, accreditation, and resilience support to modify, modernize, retrofit, integrate, and conduct initial training and production engineering on software, computers, and networks during the production phase of a project’s life cycle.

Applicable to paragraphs 3.3.3.1 – 3.3.3.2.

3.3.3(b) (O&M) Provide cyber assessment, accreditation, and resilience support to operate, maintain, refurbish, overhaul, train, and perform in-service engineering on software, computers, and networks. Applicable to paragraphs 3.3.3.1 – 3.3.3.2.

3.3.3(c) (FMS) Provide cyber assessment, accreditation, and resilience support to develop, prototype, evaluate, establish performance capabilities, operate, maintain, refurbish, overhaul, train, perform in-service engineering, modify, modernize, retrofit, integrate, and conduct initial training and production engineering on software, computers, and networks for FMS customers.

Applicable to paragraphs 3.3.3.1 – 3.3.3.2.

3.3.3(d) (RDT&E) Provide cyber assessment, accreditation, and resilience support to research, develop, prototype, evaluate, establish performance capabilities, support associated testing and evaluation efforts, and support training in order to meet developmental milestones prior to operational use for software, computers, and networks during the RDT&E phase of a project’s life cycle. Applicable to paragraphs 3.3.3.1 – 3.3.3.2.

3.3.3(e) (WCF) Provide cyber assessment, accreditation, and resilience support to develop, prototype, evaluate, establish performance capabilities, operate, maintain, refurbish, overhaul, train, perform in-service engineering, modify, modernize, retrofit, integrate, and conduct initial training and production engineering on software, computers, and networks during all phases of a project’s life cycle. Applicable to paragraphs 3.3.3.1 – 3.3.3.2.

3.3.3.1 Cyber Assessment and Accreditation Support.

3.3.3.1.1 The Contractor shall support the development of a system Assessment and Authorization (A&A) plan to include, but not be limited to, Authority to Operate (ATO), Interim ATO (IATO), Interim Authority to Test (IATT), Interim Authority to Connect (IATC), Authority to Connect (ATC), and Authority to Develop (ATD). (CDRL A026)

3.3.3.1.2 The Contractor shall support the development of documentation required for A&A submission. This includes, but is not limited to, system security plans, security controls analysis report, cyber risk assessment reports, cybersecurity scans, STIG checklists, boundary diagrams, Plan of Action and Milestones (POA&M) inputs, cyber mitigations, and cyber-related policies and procedures. (CDRL A026)

3.3.3.1.3 The Contractor shall support Interim Progress Reviews on all A&A documentation at intervals of 190, 105, and 85 calendar days prior to reaccreditation. (CDRL A026)

3.3.3.1.4 The Contractor shall support the development of Cybersecurity Implementation Plans for systems with qualifying classification levels. (CDRL A027)

3.3.3.1.5 The Contractor shall support the analysis of software, network, and system cybersecurity to include researching existing systems and components to verify their cybersecurity posture.

3.3.3.2 Cyber Resilience and Protection Support.

3.3.3.2.1 The Contractor shall support the identification…