Att 01 Statement of Work.pdf

N00421-26-R-1006 Attachment 01

STATEMENT OF WORK FOR

SMALL UNMANNED AIR SYSTEMS REUSABLE ARCHITECTURE

1.0 Scope.

As the organic Lead Systems Integrator® (oLSI®) for the Naval Air Warfare Center Aircraft Division (NAWCAD), Webster Outlying Field (WOLF) operates under a product-based business model whereby NAWCAD WOLF civilians lead and manage the execution of the requirements for defense weapon systems programs with combined Government-Industry teams. Using this oLSI® approach, the Government maintains control of intellectual property and data rights, enabling WOLF to rapidly adapt solutions to the dynamic needs of the warfighter.

The NAWCAD WOLF Ship and Air Integrated Warfare (SAIW) Division provides systems engineering and life cycle support for requirements definition, development, customization, integration, certification, maintenance, software development, and In-Service Engineering Agent (ISEA) activities for various new and/or existing Unmanned Air Systems (UASs). The SAIW Division has been tasked by the Naval Air Systems Command (NAVAIR) Program Manager, AIR (PMA) 263 to provide systems engineering and evaluation, Small Unmanned Air Systems (SUAS) Reusable Architecture (SRA) cybersecurity, technical management support, and SRA life cycle support for new and existing SUAS. The SAIW Division, operating under the oLSI® model, has requirements for utilizing SRA Reference Implementation Prototypes (RIPs) that demonstrate the standardization of key interfaces through the application of:

– A baseline hardware and software architecture decomposing SUAS into their functional components delivered as a set of Interface Control Documents (ICDs) with supporting technical documentation.

– Reference hardware and software implementations supporting baseline capabilities.

– Widely-supported open-source software (OSS) adapted to meet Department of

Defense (DoD) cybersecurity requirements for use with both developmental and fielded SUAS.

This Statement of Work (SOW) will provide systems engineering and evaluation, Small Unmanned Air Systems (SUAS) Reusable Architecture (SRA) cybersecurity, technical management support, and SRA life cycle support for new and existing SUAS.

2.0 Applicable Documents.

The documents and document versions applicable to tasking will be the most current published document at the time of this contract award.

2.1 DoD Specifications.

2.1.1 DoD National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulation Part 117, NISPOM Rule.

2.1.2 DoDM 5200.01 Vol. 2, Marking of Classified Information, Change 4, 28 Jul 2020.

2.1.3 SECNAVINST 5510.36B, Department of the Navy Information Security Program, 12 Jul 2019.

2.1.4 DoDI 5200.48, Controlled Unclassified Information (CUI), 6 Mar 2020.

2.1.5 DoDD 5400.07, DoD Freedom of Information Act (FOIA) Program, 5 Apr 2019.

2.1.6 DoDI 5230.24, Distribution Statements on Technical Information, 10 Jan 2023.

2.1.7 SECNAVINST 5510.30C, Department of the Navy Personnel Security Program, 24 Jan 2020.

2.1.8 OPNAVINST 3440.17A, Navy Installation Emergency Management Program, 1 Aug 2014.

2.1.9 SECNAVINST 5239.20A, Department of the Navy Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification, 10 Feb 2016.

2.1.10 DoDD 8140.01, Cyberspace Workforce Management, 5 Oct 2020.

2.2 DoD Standards.

2.2.1 DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology

(IT).

2.2.2 MIL-STD-31000B, Technical Data Packages.

2.3 Other Government Documents.

2.3.1 National Security Decision Directive 298, dated 22 January 1988 Public Law 100-235, Section 3(d)(4).

2.3.2 DISA Security Technical Implementation Guides (STIGs).

2.3.3 SAIW Division Operations Manual.

2.3.4 SAIW Division Project Realization Standard Operating Procedure (SOP).

2.4 Industry Documents.

2.4.1 American National Standards Institute/American Society for Quality (ANSI/ASQ) ISO 9001:2015.

3.0 Requirements.

3.1 General Requirements.

3.1.1 Compatibility. The Contractor shall maintain the capability to prepare documents and software packages compatible with the Government Information Technology (IT) environment through the security classification of Secret as specified on the DD Form 254, Contract Security Classification Specification Form (Attachment XX). The current operating environment required for this Task Order (TO) includes:

Microsoft Windows 2016 or newer Microsoft Project 2016 or newer Microsoft Office Professional Plus 2016 or newer Adobe Acrobat Internet access Flank Speed

The Contractor shall maintain the ability to interface with and transfer data to and from requiring office software applications and their upgraded versions. The Contractor shall ensure that all media are virus free when delivered. The Contractor shall be capable of internet and Local Area Network (LAN) communications with the SAIW Division. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with the SAIW Division during working hours whether at contractor work site or on travel.

3.1.2 Work Location, Facilities, and Telework/Remote Work.

3.1.2.1 Work Location. Approximately 7% of work will be performed at Government site and 93% of work to be performed at contractor site. Government site includes NAWCAD WOLF St.

Inigoes, MD.

3.1.2.1.1 Government Site Requirements. Contractors performing on-site support will be provided access to workspaces, telephones, printers, facsimile machines, copy machines, shredders, computers, and network access including web servers and applicable databases or other applications necessary to carry out assigned tasks.

3.1.2.1.2 Contractor Site Requirements. The Contractor shall provide its own support facilities needed to perform the tasking of this TO within 50 drivable miles of NAWCAD WOLF, St.

Inigoes to satisfy the requirements of this TO. The Government will not assume responsibility to retain the facilities or take control of the title after the TO is completed. The Contractor shall have occupancy of these facilities by the base year Period of Performance (PoP) start date specified in Section F.

3.1.2.2 Meeting Support. In support of the tasking outlined in this SOW, the Contractor shall have the capability to host and conduct meetings at the classification levels up to Secret with the capacity to support a minimum of 10 persons. The meeting space shall have contractor-furnished telephone and Video Teleconference (VTC) capability as well as sufficient equipment to conduct meetings with presentations including compatible software as required in section 3.1.1. This support shall be provided within 50 drivable miles of NAWCAD WOLF, St. Inigoes, MD.

3.1.2.3 Telework/Remote Work.

The Contractor may allow contractor employees to telework and/or work remotely in accordance with (IAW) the information in section 3.4. The Contractor may utilize alternate worksites/locations to telework and/or work from a remote location to support continued performance of SOW tasks IAW company policy. When using telework and/or remote work, the Contractor remains responsible for TO performance and compliance with any applicable cost accounting standards and contract cost principles/procedures.

Telework is defined as an alternative workplace arrangement under which a position performs the duties and responsibilities of the assigned position and other authorized activities from an approved alternative worksite, but is required to report to the agency’s worksite on a regular and recurring basis. Telework can be either routine or situational. Routine telework is performed from an alternative worksite on regularly scheduled telework day(s), whereas situational telework is authorized on a case-by-case basis as the need arises or when opting for unscheduled telework and may be authorized for routine teleworkers in such circumstances on regularly scheduled in-office days.

Telework eligible positions require routine on-site performance of two days per week. On-site performance may be required outside of routine on-site performance days, and shall be provided when requested by the Contracting Officer’s Representative (COR).

Remote work is an alternative work arrangement that allows for a position to perform official duties at an approved alternative worksite away from an agency worksite, without regularly returning to the agency worksite during each pay period. Remote work can be either local or distant.

Local remote work is defined as a position that does not require regular and recurring on-site performance but includes enough required on-site performance that the position is required to be staffed within 50 drivable miles of NAWCAD WOLF, St. Inigoes, MD.

Distant remote work is defined as a position that does not require regular and recurring on-site performance and is not required to be staffed within 50 drivable miles of NAWCAD WOLF, St.

Inigoes, MD but shall be staffed within the contiguous United States.

In the event that telework tools become unavailable while working off-site, the Contractor shall require positions defined as telework and local remote work to report on-site in order to access the tools required for performance of this TO.

At any time during TO performance, the COR may determine that a position is no longer eligible for telework and/or local remote work by providing a notice 30 calendar days in advance and/or for distant remote telework positions by providing a notice 90 calendar days in advance so the Contractor can address changes needed to support mission requirements.

3.1.2.4 Industrial Space. The Contractor shall provide sufficient industrial support space for the receipt, storage, inventory, and shipment of equipment associated with assigned projects. It is anticipated that the space required to meet SOW requirements has been no less than 2,000 square feet. Additionally, the space shall be equipped with Heating, Ventilation, and Air Conditioning (HVAC) systems capable of sustaining a controlled environment consistent with the storage, assembly, and operation of electronic equipment. The space shall be configured to meet requirements for receiving, material receipt inspection, storage awaiting build up, integration and testing, and storage of completed systems. The space shall be equipped to protect Government property and shall be located within 50 drivable miles of NAWCAD WOLF, St. Inigoes, MD. The Government will not have desk occupancy at the location and will not take possession of the facility at TO termination.

3.1.3 TO Status Reporting. The Contractor shall provide the following documentation.

3.1.3.1 Monthly Progress and Financial Status Report. The Contractor shall provide a progress and financial status report In Accordance With (IAW) the Contract Data Requirements List (CDRL). The report shall include work accomplished since submittal of the last report, both monthly and cumulative work hour labor costs expended by labor category, and material and travel costs. (CDRLs A001 and A002)

3.1.3.2 Organizational Conflicts of Interest (OCI) and Non-Disclosure Agreement (NDA) Status Certification. The Contractor shall report OCI Mitigation Plan compliance and compliance status changes. (CDRL A003)

3.1.4 Work schedule to include Compressed Work Schedule (CWS), holidays, and installation closure.

3.1.4.1 Work Schedule. The Contractor shall provide the required services and staffing coverage during normal working hours. Normal working hours are usually 8.5 hours each day (including a 30-minute lunch break), from 0800 to 1630 each Monday through Friday (except on the legal holidays as specified in paragraph 3.1.4.1.2). Some supported Government offices have flexibility to start as early as 0600 and end as late as 1800 Monday – Friday.

3.1.4.1.1 CWS. CWS is an alternative work schedule to the traditional 5 8.5-hour workdays (which includes a 30-minute lunch break) worked per week. Under a CWS schedule, an employee completes the following schedule within a 2-week period of time: 8 weekdays are worked at 9.5 hours each day (which includes a 30-minute lunch break), 1 weekday is alternately worked at 8.5 hours (which includes a 30-minute lunch break), and 1 weekday is not worked by the employee. The result is 80 hours worked every 2 weeks, with 44 work hours 1 week and 36 work hours the other.

The Contractor may allow its employees to work a CWS schedule provided the requirements of this SOW are met. If the Contractor chooses to allow its employees to work a CWS schedule in support of this TO, any additional costs associated with the implementation of the CWS schedule vice the standard schedule are unallowable costs under this TO and will not be reimbursed by the Government. Additionally, the CWS schedule shall not prevent contractor employees from providing necessary staffing and services coverage as required by the Government to the COR/Alternate Contracting Officer’s Representative (ACOR).

3.1.4.1.2 Holidays. The Government observes the Federal holidays identified on the Office of Personnel Management (OPM) website: https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview. With the exception of the events in section 3.1.4.1.3 below, the Contractor is permitted to observe Federal holidays IAW its corporate policy.

3.1.4.1.3 Installation Closure. When Federal facilities are closed by the Government or when Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility-related problem that prevents Federal personnel from working at the Government facility, contractor personnel assigned to work at that facility in support of such Federal employees shall follow their parent company’s policies.

While generally contractor personnel may not perform work on-site at a Government facility without oversight from Federal personnel, in very limited circumstances, work being performed by contractor personnel may be deemed mission essential and performance of such mission essential work may be authorized to continue at the Government facility despite the facility being otherwise closed for normal operations. The circumstances permitting work being performed by contractor personnel to be deemed mission essential are extremely limited and generally only apply to performance of efforts related to public health, safety, or matters related to national security. The cognizant Contracting Officer (KO) must concur with any determination that work being performed by contractor personnel is mission essential.

3.1.5 Other Direct Costs (ODCs). Procurement (PROC); Operations and Maintenance (O&M); and Research, Development, Test and Evaluation (RDT&E).

3.1.5.1 Travel. Travel may include general and administrative expenses, but shall not include profit. Temporary travel to other locations in support of project tasking is required. If required, temporary travel locations include: Yuma, AZ; San Diego, CA; Simi Valley, CA; Cherry Point, NC; Jacksonville, NC, Hood River, OR; Fort Worth, TX; and Norfolk, VA. This list is not all inclusive as locations may change over the life of the TO.

The Contractor shall complete travel request(s) IAW CTXT.232-9509, Travel Approval and Reimbursement Procedures (NAVAIR) (OCT 2013). Upon completion of travel, contractor employees shall complete a trip/travel report. The COR shall approve all travel performed in support of this Contract prior to the commencement of the travel and travel shall result in a trip report. (CDRL A004)

3.1.5.2 Material. Incidental material will be required in the performance of this TO, and all incidental material purchases shall be IAW CTXT-242.9520, Procedures and Approvals Required Prior to Incurring Direct Material Costs. All materials not depleted during the performance of this TO shall become Government property upon completion of this TO. The Contractor shall transfer all materials not depleted to the COR by way of a DD Form 250, Material Inspection and Receiving Report. Material costs may include general and administrative expenses but shall not include profit/fee. (CDRL A005)

3.1.6 Subcontractors. Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this TO. All provisions of this SOW shall flow down to subcontractors providing support under this TO.

3.1.7 Management of Contractor Personnel. The Government will neither supervise contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual contractor employees. The Contractor shall manage its employees and guard against any actions that are of the nature of personal services or actions that give the perception of personal services.

3.1.8 Transition-Out Plan.

The Contractor’s overall transition-out plan shall be built around maintaining the mission of the Division with minimal impact, not only in terms of timeliness of performance but also to ensure that critical data and knowledge transfer occurs. Prior to the termination or expiration of the TO, the Contractor shall ensure an orderly transition of responsibilities, while minimizing impact to the operation. The Contractor shall submit a Transition-Out Plan, to include the minimum elements listed below IAW CDRL A006.

̶ Work turnover. The Contractor shall provide a plan of action to effectively transfer tasked work that is in process at the expiration or termination of the TO to the successor company and establish and maintain effective communication with the incoming Contractor or Government personnel for the period of transition via weekly status meetings.

̶ Quality Assurance (QA). The Contractor shall provide a plan of action to ensure continuation of quality review processes during the transition period to the successor company.

̶ Risk mitigation strategies. The Contractor shall provide a plan of action to mitigate contract performance risks (quality and schedule) encountered during the transition period.

̶ Data/information transfer. The Contractor shall provide a plan of action for the efficient inventory and transfer of project data to the successor company.

3.1.9 Technical Direction Letters (TDLs). When necessary, technical direction or clarification concerning the details of specific tasks set forth in the TO will be given through issuance of written TDLs. TDLs will not, in any manner, alter the scope of the TO. For further direction see HTXT.242-9502, Technical Direction (Variation) in Section H of the TO. The

Contractor shall prepare and deliver a COR Management Report for TDLs IAW CDRL A001.

3.1.10 Project Unique Requirements.

3.1.10.1 Quality Management. The Contractor shall develop, implement, document, audit and maintain a Quality Management System (QMS) to ensure conformance with contractual requirements and the specific quality and performance requirements issued under this contractual document. At a minimum, the QMS should meet the intent of the American National Standards Institute/American Society for Quality (ANSI/ASQ) ISO 9001:2015, and/or equivalent governing body. Regardless of the standards that are applied, the Contractor’s quality approach should be clearly defined and recognize the need to focus on quality management principles including customer focus, process approach, improvement, evidence-based decision making and relationship management. Registered QMS (to the International Organization for Standardization (ISO) standards or equivalent governing body) and QMS required internal audit results verifying Contractor’s compliance with the documented processes and procedures, established to execute the Contractor’s work efforts and product delivery, shall be made available to the Government.

(CDRLs A007 and A008)

3.1.10.2 Process Documentation. These written procedures and work instructions shall be made available to the contractor employees required to perform the specific task. All procedures and work instructions shall be consistent with the Contractor’s QMS. (CDRL A008)

3.2 Security.

3.2.1 Citizenship Requirements. Only U.S. citizens may perform under this TO, unless waived by the Government. If the Contractor cannot find qualified U.S. citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office. The waiver request should include:

a) The individual's name, date and place of birth, position title, and current citizenship.

b) A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements.

c) A statement of the unusual expertise possessed by the applicant.

d) A statement that access will be limited to a specific Government contract (specify contract number).

e) A statement that the Contractor has obtained an export license for the information required to perform on the TO.

3.2.2 Investigative Requirements.

Unclassified: All contractor personnel must be eligible to perform Non-Critical Sensitive work as defined by SECNAVINST 5510.30C, Department of the Navy Personnel Security Program.

All contractor personnel are required to have a favorably adjudicated Tier-3 investigation from the OPM. The Contractor shall submit a request for personnel security investigation to the Government Security Office. The Government Security Office shall initiate the contractor employee's Electronic Questionnaire for Investigations Processing (eQIP) and shall perform a preliminary screening of the contractor employee's eQIP for suitability and derogatory information. The contractor employee shall provide all requested information pursuant to the Privacy Act of 1974. The Government Security Office may deny the contractor employee access to Government facilities and information and may prohibit the contractor employee from performance of sensitive duties for failure to provide requested information or when derogatory or adverse information is present on the contractor employee's eQIP. In such cases, the contractor employee may not perform on the TO.

Classified: All contractor personnel shall maintain security clearance eligibility commensurate with the level of classification of the work performed as annotated in the TO’s DD Form 254, Contract Security Classification Specification Form. Contractor personnel shall require access to classified information in performance of this TO up to and including Secret facility level, with a safeguarding level of Secret. The Contractor is responsible for ensuring that all personnel receive the requisite investigation and are favorably adjudicated IAW National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulation Part 117, NISPOM Rule. Contractor employees who fail to meet security clearance requirements may not access classified information or perform sensitive duties. In such cases, the contractor employee may not perform on the TO.

3.2.2.1 Contractor Personnel Labor Category Security Requirements. All personnel shall have the appropriate DoD Security Clearance Level or Interim Clearance IAW the chart below. All personnel not listed in the table below shall have the ability to obtain a Secret DoD Security Clearance or Interim Clearance within 60 business days of Government request.

LABOR CATEGORY

DoD SECURITY

CLEARANCE

LEVEL (INTERIM

CLEARANCE

ACCEPTABLE)

REQUIRED BUSINESS DAYS

AFTER ISSUANCE OF TO

Engineers, All Other (Systems Engineer), Junior Secret 60

Engineers, All Other (Systems Engineer), Journeyman Secret 60

General and Operations Managers (Program Manager), Journeyman (Key) Secret 60

General and Operations Managers (Project Manager), Journeyman (Key) Secret 60

Project Management Specialists, Journeyman Secret 60

Computer Network Architects, Basic Secret 60 Computer Network Architects, Intermediate Secret 60

Computer Network Architects, Advanced Secret 60 Computer Programmers, Basic Secret 60 Computer Programmers, Intermediate Secret 60 Computer Programmers, Advanced Secret 60 Computer Systems Analysts, Basic Secret 60 Computer Systems Analysts, Intermediate Secret 60 Computer Systems Analysts, Advanced Secret 60 Information Security Analysts, Basic Secret 60

Information Security Analysts, Intermediate Secret 60

Information Security Analysts, Senior (Key) Secret 60

Network and Computer Systems Administrators, Basic Secret 60

Network and Computer Systems Administrators, Intermediate Secret 60

Network and Computer Systems Administrators Secret 60

3.2.3 Common Access Card (CAC)/Public Key Infrastructure (PKI) and System Authorization Access Request (SAAR).

3.2.3.1 SAAR. All contractor personnel requiring access to Government IT systems shall have an approved DD Form 2875, System Authorization Access Request (SAAR) form on file and complete required Annual Information Awareness Training. New employees must submit their SAAR forms within 30 business days of their first day of work. SAAR forms shall be submitted to the COR, Government Technical Point of Contact (TPOC), or to the assigned Government Mission Partner Identity, Credential, and Access Management (MP ICAM) Trusted Associate

(TA).

3.2.3.2 CAC/Local Badges. Contractor CACs and facility-specific identification badges will be issued by the Government to on-site contractor personnel and shall be visible at all times while personnel are at the Government site. The Contractor shall furnish all requested information required to facilitate issuance of identification badges. All CACs and identification badges issued to contractor employees shall be returned to the TA following completion of the TO, relocation or termination of an employee, or upon request from the COR/Procuring Contracting Officer (PCO). The Government will provide the Contractor access to Government facilities, as required, for performance of tasks under this TO.

3.2.3.3 DD Form 254. The Contractor shall comply with security requirements specified in the DD Form 254 attached to this TO. Information or data that the Contractor accesses shall be handled at the appropriate classification level. Unclassified information shall be handled in accordance with the appropriate designation (Controlled Unclassified Information (CUI); Legacy For Official Use Only (FOUO); Covered Defense Information (CDI)). Distribution is authorized to the Requiring Office’s Organization and supported Activity only. Other requests for deliverables under this TO shall be referred to the TPOC/COR of this TO for approval.

3.2.4 Information Security. If the work is performed at the Contractor's facility, the Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and CUI and to control distribution of CUI IAW National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulations Part 117, NISPOM Rule and SECNAVINST 5510.36B, Department of the Navy Information Security Program. If the work is performed at the Government's facility, the Contractor shall comply with SAIW Division security procedures and controls.

All contractor facilities shall provide an appropriate means of storage for CUI and materials. All CUI including legacy FOUO and CDI (meeting the definition DFARS Clause 252.204–7012, Safeguarding Covered Defense Information and Cyber Incident Reporting) generated and/or provided under this TO shall be marked and safeguarded as specified in DoD Instruction 5200.48, Controlled Unclassified Information (CUI) available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF.

Any product containing CDI shall be assigned a distribution statement (distribution statements B through F) using the criteria set forth in DoDI 5230.24, Distribution Statements on Technical Information and have this statement displayed per DoDI 5230.24, Enclosures 3 and 4.

Distribution is authorized to the Requiring Office's Organization and supported Activity only.

Other requests for deliverables under this TO shall be referred to the TPOC/COR of this TO for approval.

All controlled unclassified technical information shall be appropriately identified and marked with the following distribution statement:

Distribution Statement (Insert Appropriate Letter and Authorization Title), (Insert Appropriate Reason Category) (dated – (Date of Distribution Authorization)). Other requests shall be referred to: Commander, Naval Air Systems Command, Attn: SRA COR, 17134 Webster Field Road, Bldg. 8225, St. Inigoes, MD 20684-4009.

3.2.4.1 Marking. All information generated by the Contractor shall be properly marked.

Classified information shall be marked IAW DoDM 5200.01, Vol 2, Marking of Classified Information. CUI, including legacy FOUO information generated and/or provided under this TO, shall be marked IAW DoDI 5200.48, Controlled Unclassified Information (CUI). Technical information shall also be marked with appropriate Distribution Statements and Export Control warnings IAW DoDI 5230.24, Distribution Statements on Technical Information and program Security Classification Guidance (SCG).

3.2.4.2 Public Release. Any CUI pertaining to this TO shall not be released for public dissemination, including posting to any social media sites such as Facebook or X (formerly known as Twitter), unless it has been approved for public release by appropriate U.S.

Government authority. Proposed public releases shall be submitted for approval prior to release through NAWCAD WOLF Public Affair Office (PAO) via the COR identified in GTXT.201- 9501, Designation of Contracting Officer’s Representative.

3.2.4.3 Loss, compromise, and/or electronic spillage of classified information or CUI. All instances of loss, compromise, and electronic spillage of classified information or CUI shall be reported to the COR, TPOC, and Government Security Office within 72 hours of the incident occurring.

3.2.5 Operations Security (OPSEC). The Contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the Contractor and any subcontractor during performance of the TO. The Contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. This program may include Information Assurance (IA) and Communications Security (COMSEC). The OPSEC program shall be IAW National Security Decision Directive (NSDD) 298 and at a minimum shall include:

1) Assignment of responsibility for OPSEC direction and implementation.

2) Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

3) Establishment of OPSEC education and awareness training.

4) Provisions for management, annual review, and evaluation of OPSEC programs.

5) Flow down of OPSEC requirements to subcontractors when applicable.

While performing aboard Naval Air Systems Command (NAVAIR) or NAVAIR sites, the Contractor shall comply with facility OPSEC program instructions and contribute to organization-level OPSEC efforts; include OPSEC as part of its ongoing security awareness program and take all required Agency training; be responsive to the Supporting OPSEC Manager on a non-interference basis; and protect sensitive unclassified information and activities that could compromise classified information or operations or degrade the planning and execution of operations performed by the Requirements Owner and Contractor in support of the mission.

(CDRL A009)

3.2.6 Antiterrorism Force Protection and Emergency Management. The work performed on this TO is not Emergency Essential IAW OPNAVINST 3440.17A, Navy Installation Emergency Management Program and Government Emergency Management, Antiterrorism, and/or Continuity of Operations Plans. Contractor personnel shall comply with all Government Emergency Management, Antiterrorism, and/or Continuity of Operations Plans and directives.

Contractor personnel shall not report for work at Government facilities upon declaration of Force Protection Condition CHARLIE or in any event or emergency where Government officials direct curtailment of operations to “Mission Essential Only.” All contractor personnel assigned to a Government facility shall complete annual Antiterrorism (Level One) and Active Shooter training.

3.3 Detailed Support Requirements.

3.3.1 Systems Engineering and Evaluation Support.

3.3.1(a) (PROC) Provide systems engineering and evaluation support for SUAS throughout the procurement and production phases of the system’s life cycle. Applicable to SOW paragraphs

3.3.1.1 – 3.3.1.4.

3.3.1(b) (O&M) Provide systems engineering and evaluation support for SUAS throughout the O&M phases of the system’s life cycle. Applicable to SOW paragraphs 3.3.1.1 – 3.3.1.4.

3.3.1(c) (RDT&E) Provide systems engineering and evaluation support for SUAS throughout the research and development phases of the system’s life cycle. Applicable to SOW paragraphs

3.3.1.1 – 3.3.1.4.

3.3.1.1 Research Evaluation and Implementation.

3.3.1.1.1 The Contractor shall provide support by evaluating SUAS acquisition artifacts (Top- Level Requirements (TLRs)), Initial Capabilities Documents, Capabilities Development Documents (CDDs), Capability Production Documents (CPDs), National Defense Authorizations (NDAAs), etc.) to determine applicability to SUAS architecture and key interface standardization. (CDRL A010)

3.3.1.1.2 The Contractor shall provide support by researching relevant cyber and physical security policies, requirements, and processes to assess and document engineering and configuration control impacts to SUAS key interface standardization efforts. (CDRL A010)

3.3.1.1.3 The Contractor shall, upon completion of the initial requirements evaluation, provide support by drafting a requirements summary outlining the results of their evaluation. (CDRL A010)

3.3.1.1.4 The Contractor shall provide support by maintaining the requirements summary throughout the effort and delivering the updated versions to the Government as significant changes are incorporated. (CDRL A010)

3.3.1.1.5 The Contractor shall provide support by investigating necessary updates to the existing RIPs based on changes to the SRA architecture, if necessary. Updates include flight controller source code, flight controller/mission computer (MC) communications, and the payload interface MC Secure Host Baseline (SHB). (CDRLs A010, A011, and A012)

3.3.1.1.6 The Contractor shall assist with the development of new RIP designs, if required by the Government, based on necessary updates found while completing SOW paragraph 3.3.1.1.5.

(CDRLs A011, A012, and A013)

3.3.1.2 SRA Architecture Diagrams.

3.3.1.2.1 The Contractor shall provide support by maintaining a detailed architecture identifying each element of the SRA and by identifying data flow and directionality for all communications within the architecture to include both air and ground segments. (CDRLs A014 and A015)

3.3.1.2.2 The Contractor shall assist with updating the architecture diagram throughout the life of the TO and by delivering updated versions to the Government as significant changes are incorporated. (CDRLs A014 and A015)

3.3.1.3 Documentation Maintenance.

3.3.1.3.1 The Contractor shall provide support by modifying and maintaining all SRA documentation to include hardware diagrams, dataflow diagrams, software release notes, user guides, ICDs, Security Technical Implementation Guides (STIGs), system vulnerability assessments, test procedures/reports, user guides, briefing materials, and schedules. STIGs shall be modified IAW DISA Security Technical Implementation Guides (STIGs). (CDRLs A011, A012, A013, A014, A015, A016, A017, and A018)

3.3.1.4 SRA Portal.

3.3.1.4.1 The Contractor shall provide support by developing, deploying, and maintaining a web-based portal to facilitate communication with SUAS industry partners, academia, and Government agencies. The portal will include:

− Reference information for vendors seeking SRA compliance validation.

− Information related to software and hardware components currently covered under the SRA cybersecurity type authorization. Information should include product nomenclature, vendor, part or model number, software/firmware version number(s), and associated risk characterization details.

− Container registry for SRA-compliant container images. This registry should include associated vulnerability analyses, CycloneDX (or similar) compliant Software Bills of Material (SBOM), and software provenance information.

− User manuals and supplemental materials for all SRA-related software applications and tools.

(CDRLs A010, A017, A019, and A020)

3.3.1.4.2 The Contractor shall provide support by ensuring that the portal implements all necessary security and access control mechanisms in order to restrict CUI access to only those users with DoD PKI or External Certificate Authority (ECA) certificates and a valid need to know.

3.3.2 SRA Cybersecurity Engineering Support.

3.3.2(a) (PROC) Provide cybersecurity support for SRA throughout the procurement and production phases of the architecture’s life cycle. Applicable to SOW paragraphs 3.3.2.1 – 3.3.2.3.

3.3.2(b) (O&M) Provide cybersecurity support for SRA throughout the O&M phases of the architecture’s life cycle. Applicable to SOW paragraphs 3.3.2.1 – 3.3.2.3.

3.3.2(c) (RDT&E) Provide cybersecurity support for SRA throughout the research and development phases of the architecture’s life cycle. Applicable to SOW paragraphs 3.3.2.1 – 3.3.2.3.

3.3.2.1 Assessments and Authorizations.

3.3.2.1.1 The Contractor shall assist with Assessment & Authorization (A&A) activities to include preparation of Interim Authority to Test (IATT) and Authorization to Operate (ATO) requests IAW the DoDI 8510.01, Risk Management Framework (RMF) for DoD Systems.

(CDRL A019)

3.3.2.1.2 The Contractor shall provide support by preparing the necessary cybersecurity artifacts, responding to cyber-related Requests for Information (RFI) and by producing the necessary Body of Evidence (BOE) to support Authorizing Official (AO) decision. (CDRL A019)

3.3.2.1.3 The Contractor shall assist with maintaining all RMF package artifacts for the duration of this TO. (CDRL A019)

3.3.2.1.4 The Contractor shall provide support by updating all cybersecurity artifacts throughout the life of the TO and by delivering updated versions to the Government as significant changes are incorporated. (CDRL A019)

3.3.2.1.5 The Contractor shall assist with conducting periodic vulnerability and STIG assessments against the baseline SRA architecture in order to maintain compliance with the SRA ATO/Authority to Connect (ATC). (CDRLs A019 and A020)

3.3.2.1.6 The Contractor shall assist with maintaining the SRA RMF authorization package to include periodic updates to all associated security artifacts to include system diagrams, vulnerability and mitigation reports, System Security Plan (SSP), security control information, etc. (CDRLs A019 and A020)

3.3.2.1.7 The Contractor shall provide support to regularly assess the RMF Plan of Action & Milestones (POA&M) to ensure it accurately captures all outstanding security findings and anticipated remediation dates.

3.3.2.1.8 The Contractor shall provide support to facilitate the exchange of vendor-submitted SRA Compliance Body of Evidence (CBoE) data between the submitter and Government Information Systems Security Manager (ISSM) and/or Information Systems Security Officer

(ISSO). (CDRL A021)

3.3.2.2 Patches and Improvements.

3.3.2.2.1 The Contractor shall provide support to continuously patch and harden affected baseline SRA software components (mission computer images, container base images, etc.) to include maintaining hardened versions of Family of Small Unmanned Air Systems (FoSUAS)-common system images to ensure compliance with SRA security requirements.

3.3.2.3 Program Protection-related Activities.

3.3.2.3.1 The Contractor shall assist with conducting initial Program Protection Plan (PPP) activities in support of SRA to include periodic assessments for Critical Program Information/Critical Technology (CPI/CT), Criticality Analysis, Software Assurance, Anti- Tamper (AT), and FoSUAS SCG impacts. (CDRL A020)

3.3.3 Technical Project Management.

3.3.3(a) (PROC) Provide Technical Project Management support for SRA throughout the procurement and production phases of the architecture’s life cycle. Applicable to SOW paragraphs 3.3.3.1 – 3.3.3.3.

3.3.3(b) (O&M) Provide Technical Project Management support for SRA throughout the O&M phases of the architecture’s life cycle. Applicable to SOW paragraphs 3.3.3.1 – 3.3.3.3.

3.3.3(c) (RDT&E) Provide Technical Project Management support for SRA throughout the research and development phases of the architecture’s life cycle. Applicable to SOW paragraphs

3.3.3.1 – 3.3.3.3.

3.3.3.1 Meeting Support.

3.3.3.1.1 The Contractor shall assist by communicating and coordinating with internal and external stakeholders on technical and programmatic issues.

3.3.3.1.2 The Contractor shall assist with internal and external working-level technical conferences and status meetings to include meeting minutes and/or reports of formal and informal meetings. (CDRLs A017 and A021)

3.3.3.2 Project Planning.

3.3.3.2.1 The Contractor shall assist by supporting the development of project scheduling documentation including, but not limited to, Work Breakdown Structures (WBSs), POA&Ms, and Integrated Master Schedules (IMSs). (CDRL A018)

3.3.3.3 The Contractor shall collaborate with SAIW Government personnel to research and define the scope, requirements, risks, and deliverables of assigned projects IAW the SAIW Division Operations Manual and SAIW Product Realization SOP. (CDRL A010)

3.3.4 SRA Life Cycle Support.

3.3.4(a) (PROC) Provide life cycle support for SRA throughout the procurement and production phases of the architecture’s life cycle. Applicable to SOW paragraphs 3.3.4.1 – 3.3.4.5.

3.3.4(b) (O&M) Provide life cycle support for SRA throughout the O&M phases of the architecture’s life cycle. Applicable to SOW paragraphs 3.3.4.1 – 3.3.4.5.

3.3.4(c) (RDT&E) Provide life cycle support for SRA throughout the research and development phases of the architecture’s life cycle. Applicable to SOW paragraphs 3.3.4.1 – 3.3.4.5.

3.3.4.1 Configuration Management.

3.3.4.1.1 The Contractor shall provide support by coordinating with the FoSUAS Technical Review Board (TRB) and Configuration Control Board (CCB) in order to establish configuration management control of all SRA-related engineering artifacts under the NAVAIR PMA-263 FoSUAS Integrated Product Team (IPT). This includes current and future Technical Data Packages (TDPs) IAW MIL-STD-31000B, Technical Data Packages, installation and assembly drawings, Cable Run Books (CRBs), Cable Run Sheets (CRSs), As-Build documentation, and software. (CDRL A022)

3.3.4.1.2 The Contractor shall assist by working with the TRB and CCB to establish an approved repository for SRA-related software source code and, if necessary, transition all code to the aforementioned repository. (CDRLs A010 and A011)

3.3.4.2 Test Environments.

3.3.4.2.1 The Contractor shall assist by updating and maintaining SRA Software-in-the-Loop (SITL) and Hardware-in-the-Loop (HITL) configurations to mirror SRA surrogate platforms as well as fielded or deployment-representative systems, at the direction of the Program Office.

(CDRLs A011, A012, A013, A015, A016, and A017)

3.3.4.3 Industry Collaboration.

3.3.4.3.1 The Contractor shall provide support for collaborating with Industry UAS vendors and military operational units to support retrofit/upgrade of existing systems and planning of new developmental UAS programs.

3.3.4.3.2 The Contractor shall provide support for liaising with Government-designated UAS vendors and military operational units to support SRA integration activities.

3.3.4.4 Modification of Fielded SUAS.

3.3.4.4.1 The Contractor shall assist with the modification of existing FoSUAS in order to facilitate bringing fielded platforms into compliance with SRA.

3.3.4.4.2 The Contractor shall provide support by assessing currently-fielded SUAS FoSUAS platforms to characterize the level of effort needed to realize SRA compliance. (CDRL A010)

3.3.4.4.3 The Contractor shall assist by either procuring or receiving as Government Furnished Equipment (GFE), fielded or deployment representative SUAS for the modification of fielded

SUAS.

3.3.4.4.4 The Contractor shall provide support by modifying fielded SUAS, with Government approval, to ensure SRA compliance. (CDRLs A010 and A014)

3.3.4.5 Training and Logistics Support Activity (TALSA) Coordination.

3.3.4.5.1 The Contractor shall provide support by maintaining coordination and engagement with the Navy & Marine Corps SUAS user communities and TALSA to support program efforts to train fleet-facing support personnel on the use of SRA tools to include:

− Periodically inspect vendor systems for SRA compliance.

− Access and extract log data from SRA-compliant systems.

− Retrieve and apply approved software updates to SRA-compliant systems.

− Conduct periodic vulnerability and STIG assessments against FoSUAS-focused commercial, open-source, and Government-Off-the-Shelf (GOTS) components in order to facilitate ongoing NAVAIR participation in security and interoperability-enhancing activities.

− Retrieve and deploy authorized hardware and software payload capabilities to SRA-compliant systems.

(CDRLs A011, A014, A016, A017, and A020)

3.3.4.5.2 The Contractor shall provide support by defining, implementing, and improving a process for extraction and backhaul of Reconnaissance, Surveillance, and Target Acquisition (RSTA) payload data from the TALSAs and FoSUAS Inventory Control Points (ICPs) to PMA- 263 in order to facilitate further development, training, and testing of Artificial Intelligence/Machine Learning (AI/ML) capabilities. This process should be automated to the fullest extent possible. (CDRL A010)

3.4 Personnel Qualifications.

3.4.1 The following defines the minimum education and experience for each non-Service Contract Act (non-SCA) labor category and further describes the functional description for each labor category. The Contractor shall be responsible for employing personnel having at least the minimum level of education, training, and experience as stated under each labor category specified herein. All personnel shall have the required security clearance identified in paragraph 3.2.2.1.

3.4.1.1 Key Personnel. Key personnel are those who will be performing in key labor categories as specified for applicable labor categories below. All other labor categories and Full Time Equivalent (FTE) employees (defined as 1,920 hours) are considered non-key. Key personnel are subject to the substitution restrictions clause within CTXT.237-9501, Addition or Substitution of Key Personnel (Services).

KEY LABOR CATEGORY LEVEL

BUREAU OF LABOR STATISTICS

(BLS) STANDARD OCCUPATIONAL

CLASSIFICATION (SOC) CODE

NUMBER OF

KEY

PERSONNEL

REQUIRED

General and Operations Managers (Program Manager) Journeyman 11-1021 One

General and Operations Managers (Project Manager) Journeyman 11-1021 One

Information Security Analysts Advanced 15-1212 One

3.4.1.2 Definitions.

3.4.1.2.1 “Years of experience” shall mean full, productive years of participation.

3.4.1.2.2 “Productive years” shall mean 52 weeks of work reduced by reasonable amounts of time for holiday, annual, and sick leave.

3.4.1.2.3 “Part-time” shall mean if participation was part-time or if less than one-half of the standard work week was spent performing qualifying functions. The actual time spent performing qualifying functions may be accumulated to arrive at full years of experience.

3.4.1.2.4 “College degree” shall mean all degrees shall be obtained from an accredited college or university as recognized by the U.S. Department of Education (ED). This includes Associate of Arts (A.A.), Associate of Science (A.S.), Bachelor of Arts (B.A.), Bachelor of Science (B.S.), Master of Arts (M.A.), Master of Science (M.S.), and/or Doctorate (Ph.D.) degrees.

3.4.1.2.5 “Degree major” shall mean the specific major field required, which will be noted under the applicable labor category.

3.4.1.2.6 “Engineering or engineering discipline,” when used in relation to educational or work experience requirements, shall mean any of the following specific subjects, disciplines, or areas of work experience only: computer, electrical, electronics, mechanical, information systems, or engineering technology.

3.4.1.2.7 “Technical discipline,” when used in relation to educational or work experience requirements, shall mean any of the following specific subjects, disciplines, or areas of work experience only: computer science, information systems management, computer engineering, mathematics, physics, electrical engineering, or mechanical engineering.

3.4.1.2.8 “Computer science or IT discipline,” when used in relation to educational or work experience requirements, shall mean any of the following specific subjects, disciplines, or areas of work experience only: computer science, computer engineering, software engineering, network engineering, information systems, cybersecurity, or management information systems technology.

3.4.1.2.9 “Business or business discipline,” when used in relation to educational or work experience requirements, shall mean any of the following specific subjects, disciplines, or areas of work experience only: business administration, business management, technical management, economics, finance, or accounting.

3.4.1.2.10 “Technical certification training” shall mean the specified certification training noted under the applicable labor category.

3.4.1.2.11 “Active or current certification” shall mean individuals must be able to demonstrate that they possess a valid certification, per vendor recertification standards, at the time of proposal submission and at the time of TO award.

3.4.2 Non-SCA and Non-Cybersecurity Workforce (non-CSWF) labor categories experience and education level definitions: If…