Attachment 01_DRAFT SOW_ISO Audit_RE-CERT_APRIL 2026.pdf

STATEMENT OF WORK (SOW)

FOR

International Organization of Standardization (ISO) 9001, ISO 14001, & ISO 45001 & Aerospace Standard (AS) 9110

Registrations and Certifications For Depot Level Activities

N68520-26-RFPREQ-F600000-0079

Controlled by: DEPARTMENT OF THE NAVY Controlled by: COMFRC

CUI Category: General Procurement and Acquisition and Source Selection Distribution/Dissemination Control: FEDCON

POC: Scott Hadley, scott.s.hadley.civ@us.navy.mil

1.0 INTRODUCTION

1.1 BACKGROUND:

1.2 The Naval Air Systems Command (NAVAIR), Commander, Fleet Readiness Centers (COMFRC), Quality Assurance, Safety, and Regulatory Compliance Group Patuxent River, Maryland intends to procure enterprise level Quality, Environmental, and Occupational Safety and Health (QEOSH) certification to all depot Fleet Readiness Centers (FRCs) to ensure conformance with applicable standards and regulatory requirements.

Specifically, supported locations include those operating under the Navy’s Commander, Fleet Readiness Centers (COMFRC) sites, Fleet Readiness Center Southeast (FRCSE), Jacksonville, Florida; Fleet Readiness Center East (FRCE), Cherry Point, North Carolina; Fleet Readiness Center Southwest (FRCSW), North Island, California; Fleet Readiness Center Mid Atlantic (FRCMA), Virginia Beach and Norfolk, Virginia; and Fleet Readiness Center West (FRCW), Lemoore, California. These FRCs are Department of War (DoW) owned and operated naval aviation maintenance depots staffed by civilian and military personnel.

1.3 The Commander, Fleet Readiness Centers (COMFRC) Quality Assurance, Safety, and Regulatory Compliance Group provide enterprise level Quality, Environmental, and Occupational Safety and Health (QEOSH) direction to all Fleet Readiness Centers (FRCs) to ensure conformance with applicable standards and regulatory requirements.

1.4 The FRCs maintain registration to ISO 9001, AS9110, ISO 14001, and ISO 45001, with FRCMA and FRCW registered to AS9110 only. Collectively, the FRCs perform overhaul and repair of designated airframes, engines, and components, and provide field team support, manufacturing, engineering, and logistics services essential to naval aviation sustainment.

1.5 SCOPE:

The Contractor must register and maintain the registration of the Industrial Depot Sites at Fleet Readiness Center Southeast (FRCSE), Jacksonville, Florida; Fleet Readiness Center East (FRCE), Cherry Point, North Carolina; and Fleet Readiness Center Southwest (FRCSW), North Island, California, to the following standards: ISO 9001, AS9110, ISO 14001, and ISO 45001. Fleet Readiness Centers MidAtlantic (FRCMA) and West (FRCW) are required to maintain registration to AS9110 only. The Contractor must perform all required follow up surveillance and maintenance audits through the end of the contract period.

1.5.1 The Contractor must honor all existing certifications issued by prior accredited registrars, including adherence to their established re-certification schedules. Acceptance of existing certificates is contingent upon each certificate being valid and free from suspension, revocation, or any pending action that may result in suspension or revocation. Table 1 identifies the audit scope and facility sizing parameters:

Table #1

Facility Southeast (FRCSE) East (FRCE)

Southwest

(FRCSW)

Mid-Atlantic (Oceana/Norfolk)

(FRCMA) West (FRCW)

Audit Scope Naval Air Station Jacksonville plus

Mayport

Marine Corps Air Station

Cherry Point NC

Naval Air Station North

Island, CA

Norfolk & Oceana VA Lemoore, CA

3688 3591 3135 364 148

2.0 APPLICABLE DOCUMENTS

2.1 The following documents form a part of this SOW to the extent cited herein. The Contractor must comply with the below referenced documents unless otherwise specified within the body of this SOW. In the event of conflict between the documents referenced herein and the contents of this SOW, the order of precedence clause of this contract must apply. Table #2 below identifies these applicable documents and standards, organized by governing authority and category, to provide a consolidated reference framework for all requirements cited throughout this SOW.

TABLE #2

DEPARTMENT OF DEFENSE (DOD)

Category Document / Standard Title Publication Date

DoW

DoD Specs Department of Defense Specifications Various

NISPOM DoD National Industrial Security Program Operating Manual (32 CFR Part 117), NISPOM Rule Current Edition

DoDI 5200.48 Controlled Unclassified Information (CUI) 6-Mar-20 DoDD 5400.07 DoD Freedom of Information Act (FOIA) Program 5-Apr-19 DoDI 5230.24 Distribution Statements on DoW Technical Information 10-Jan-23

DoDI 8582.01 Security of Non DoW Information Systems Processing Unclassified Non Public DoW Information 25-Jan-19

SECRETARY OF THE NAVY / DEPARTMENT OF THE NAVY

SECNAV /

DON

SECNAV M-5510.36B Department of the Navy Information Security Program 12-Jul-19 SECNAV M-5510.30C Department of the Navy Personnel Security Program 24-Jan-20 OPNAVINST 3440.17A Navy Installation Emergency Management Program 1-Aug-14

OTHER GOVERNING DOCUMENTS / EXTERNAL STANDARDS

OTHER

GOVERNING

DOCUMENTS

NIST SP 800-171 Rev. 2 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations Feb-20

NIST SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and Organizations Sep-20

ASTM Manual A American Society for Testing and Materials Manual A

ISO 9001:2015 Quality Management Systems – Requirements September 2015

AS9110C Quality Management Systems – Requirements for Aviation Maintenance Organizations Jan-16

ISO 14001:2015 Environmental Management Systems – Requirements Sep-15

ISO 45001:2018 Occupational Health and Safety Management Systems – Requirements Mar-18

ISO/IEC 17021-1

Conformity Assessment – Requirements for Bodies Providing Audit and Certification of Management Systems

2015 (amended 2021)

ISO 19011 Guidelines for Auditing Management Systems 2018

3.0 REQUIRMENTS

3.1 GENERAL REQUIREMENTS

3.1.1 COMPATIBILITY

The Contractor must maintain the capability to prepare, access, and deliver documents and software packages compatible with the Government IT environment at the Controlled Unclassified Information (CUI) level. At a minimum, the Contractor must support the following platforms and formats:

a. Microsoft Windows 11 Enterprise

b. Microsoft Project Online or Microsoft Project Professional 2019

c. Microsoft 365 Apps for Enterprise

d. Adobe Acrobat Reader DC or Adobe Acrobat Pro DC

e. Ability to deliver files in Government‑approved formats, including .docx, .xlsx, .pptx, .pdf, and .mpp

f. Ability to receive or transmit CUI using Government‑approved secure file transfer tools, such as DoD SAFE when initiated by Government personnel.

3.1.2 INTERNET ACCESS

3.1.3 The Contractor must maintain the ability to interface with and transfer data to and from requiring office software applications and their upgraded versions. The Contractor must maintain state-of-the-art anti-virus software and ensure that all media are virus free when delivered. The Contractor must be capable of Internet and LAN communications with the Commander Fleet Readiness Centers and its FRC’s, NAVAIR Competencies, and other Department of the Navy/Marine Corps offices as required and appropriate. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with the Commander Fleet Readiness Centers and its FRC’s, NAVAIR functional areas, and other offices under the Department of the Navy during working hours whether at Contractor work site or on travel.

3.1.4 WORK LOCATION, FACILITIES, AND TELEWORK:

3.1.4.1 WORK LOCATION:

Approximately (100%) of the work must be performed at Government sites. The Contractor will be accommodated for temporary travel to Fleet Readiness Center Southeast (FRCSE), Fleet Readiness Center East (FRCE), Fleet Readiness Center Southwest (FRCSW), Fleet Readiness Center Mid- Atlantic (FRCMA, Oceana/Norfolk), and Fleet Readiness Center West (FRCW), in accordance with Paragraph 3.2.4.1, Travel.

3.1.4.2 MEETING SUPPORT: N/A

3.1.4.3 TELEWORK/REMOTE WORK: In some rare cases, remote inspection methods may be used in very limited circumstances if agreed upon prior to the beginning of the audit by both the government representative, the contractor, and the audited site management.

3.1.4.4 WAREHOUSING: N/A

3.1.5 CONTRACT STATUS REPORTING & DELIVERABLES (CDRLs):

3.1.5.1 MONTHLY STATUS REPORT (CDRL A001) DI‑MGMT‑80227

Contractor must develop and provide a Monthly Status Report (MSR) by the tenth (10th) of each month via electronic mail to the COMFRC Representative and the COR. The MSR shall include, at a minimum, the following:

a. Activities During the Reporting Period: A summary of activities by task, including ongoing activities, new activities initiated, activities completed, and progress to date. Each task section shall begin with a brief description of the task.

b. Problems and Corrective Actions: Identification of issues or concerns encountered, corrective actions taken, and proposed resolutions for any outstanding issues.

c. Personnel Status: Personnel gains, losses, and status updates, including security clearance information as applicable.

d. Government Actions Required: Any actions, decisions, or inputs required from the Government.

e. Schedule Status: A schedule update showing major tasks, milestones, and deliverables, including planned and actual start and completion dates.

f. Travel Summary: A summary of trips taken and conferences attended during the reporting period.

3.1.5.2 AUDIT PLAN (CDRL A002) DI-MGMT-80507

The Contractor must prepare and submit the Audit Plan, Audit Schedule, and Audit Report for each required ISO/AS audit as a consolidated deliverable under CDRL A002. All submissions shall be provided via the Monthly Status Report (MSR) in accordance with Section 3.1.5.1.

1.1.1.1 Audit Schedule Requirements

The Contractor must prepare and submit an Audit Schedule identifying the audit dates, scope, staffing, standards to be assessed, and coordination requirements. Audit Schedules shall be submitted at least sixty (60) days prior to each audit for Government approval. Each Audit Schedule shall include the audit dates, times, and locations; the audit scope and applicable ISO/AS standards; auditor assignments and qualifications; required documentation and pre‑assessment activities; coordination requirements with FRC Management Representatives and COMFRC; identified risk areas and anticipated constraints;

and any proposed schedule adjustments requiring Government concurrence.

1.1.1.2 Audit Plan Requirements

The Contractor must prepare and submit an Audit Plan identifying the detailed sequence of audit events, locations, and participating personnel. Audit Plans shall be submitted at least twenty‑one (21) days prior to the start of each audit. Each Audit Plan shall include the daily audit timelines and activity blocks;

the assigned auditors and their areas of responsibility; the facility‑wide sequencing for ISO/AS standards; the coordination points for intermediate briefings; and the closing meeting date, time, and location.

3.1.5.2.1 AUDIT REPORT (CDRL A004) DI‑MGMT‑80508

The Contractor must prepare and submit an Audit Report for each ISO/AS standard audited. Audit Reports shall be submitted within seven (7) calendar days of audit completion. Each Audit Report shall include the auditor names, qualifications, and contact information; the areas audited and standards assessed; a summary of activities observed; the non-conformances identified and associated corrective actions; the completed AS9110 checklists, as applicable; and the required documentation for OASIS upload.

3.1.5.3 OASIS QUALITY DATA UPLOAD (CDRL A005) DI-MGMT-81866

For AS9110 audits, the Contractor must upload audit results, completed checklists, and corrective action review outcomes to the Online Aerospace Supplier Information System (OASIS). Assessment results shall be uploaded within thirty (30) days of audit completion, and corrective action review results shall be uploaded within five (5) business days.

The Contractor must upload AS9110 audit checklists within thirty (30) days; upload corrective action reviews within five (5) business days; ensure all OASIS entries meet IAQG data quality requirements; maintain traceability between audit findings, corrective actions, and uploaded data; and provide confirmation of OASIS uploads in the Monthly Status Report (CDRL A001).

3.1.6 WORK SCHEDULE TO INCLUDE COMPRESSED WORK SCHEDULE (CWS), HOLIDAYS,

AND INSTALLATION CLOSURE:

3.1.6.1.1 WORK SCHEDULE: The Contractor must provide all required services and staffing coverage necessary to perform work under the Audit Days CLINs in Table 5 during normal working hours.

This support encompasses audit, surveillance, certification, and related activities across the five (5) primary Fleet Readiness Centers (FRC) Locations (FRCSE, FRCE, FRCSW, FRCMA, and FRCW) as shown in Table 3, as well as specialized training and implementation support modules. Table 4 identifies the distribution of audit days by site location and primary standards for each performance period. These values represent the planned level of effort required to execute the recurring audit cycle and associated training activities throughout the contract lifecycle.

TABLE #3

Site Fleet Readiness Centers (FRC) Locations # Employee

Southeast (FRCSE) Naval Air Station Jacksonville facility plus Mayport 3688 East (FRCE) Marine Corps Air Station Cherry Point, NC 3591 Southwest (FRCSW) Naval Air Station North Island, CA 3135 Mid-Atlantic (Oceana/Norfolk) (FRCMA) Norfolk & Oceana VA 364 West (FRCW) Lemoore, CA 148

TABLE #4

DISTRIBUTION OF AUDIT DAYS BY SITE

FRC Sites ISO Standard Base Year OY 1 OY 2 OY3 OY4 52.2178 TOTAL

R S R S R S R S R S R S R S

FRCSE ISO 9001 0.0 8.0 0.0 8.0 0.0 8.0 0.0 8.0 0.0 8.0 0.0 4.0 0.0 44.0

AS 9110 0.0 8.0 0.0 8.0 16.0 0.0 0.0 8.0 0.0 8.0 0.0 4.0 16.0 36.0

ISO 14001 0.0 8.0 16.0 0.0 0.0 8.0 0.0 8.0 15.0 0.0 7.5 0.0 38.5 24.0

ISO 45001 0.0 8.0 0.0 8.0 15.0 0.0 0.0 8.0 0.0 8.0 0.0 4.0 15.0 36.0

FRCE ISO 9001 0.0 8.0 0.0 8.0 0.0 8.0 0.0 8.0 0.0 8.0 0.0 4.0 0.0 44.0

AS 9110 0.0 8.0 0.0 8.0 15.0 0.0 0.0 8.0 0.0 8.0 0.0 4.0 15.0 36.0

ISO 14001 15.0 0.0 0.0 8.0 0.0 8.0 15.0 0.0 0.0 8.0 0.0 4.0 30.0 28.0

ISO 45001 15.0 0.0 0.0 8.0 0.0 8.0 15.0 0.0 0.0 8.0 0.0 4.0 30.0 28.0

FRCSW ISO 9001 0.0 8.0 0.0 8.0 0.0 8.0 0.0 8.0 0.0 8.0 0.0 4.0 0.0 44.0

AS 9110 14.0 0.0 0.0 8.0 0.0 8.0 14.0 0.0 0.0 8.0 0.0 4.0 28.0 28.0

ISO 14001 14.0 0.0 0.0 8.0 0.0 8.0 14.0 0.0 0.0 8.0 0.0 4.0 28.0 28.0

ISO 45001 14.0 0.0 0.0 8.0 0.0 8.0 14.0 0.0 0.0 8.0 0.0 4.0 28.0 28.0

FRCMA ISO 9001 0.0 5.0 0.0 5.0 0.0 5.0 0.0 5.0 0.0 5.0 0.0 2.5 0.0 27.5

AS 9110 0.0 5.0 0.0 5.0 9.0 0.0 0.0 5.0 0.0 5.0 0.0 2.5 9.0 22.5

LAMOORE

CA ISO 9001 0.0 4.0 0.0 4.0 0.0 4.0 0.0 4.0 0.0 4.0 0.0 2.0 0.0 22.0

AS 9110 0.0 4.0 0.0 4.0 7.0 0.0 0.0 4.0 0.0 4.0 0.0 2.0 7.0 18.0

Travel Sites 72.0 74.0 16.0 106.0 62.0 81.0 72.0 74.0 15.0 106.0 7.5 53.0 244.5 494.0 Audit Training 16.0 0.0 15.0 0.0 16.0 0.0 16.0 0.0 16.0 0.0 8.0 0.0 87.0 0.0 Special Surveillance 17.0 0.0 17.0 0.0 17.0 0.0 17.0 0.0 17.0 0.0 8.5 0.0 93.5 0.0 System Updates 5.0 0.0 5.0 0.0 5.0 0.0 5.0 0.0 5.0 0.0 2.5 0.0 27.5 Audit Days in support of Standards Revision/Integration

10.0 0.0 10.0 0.0 10.0 0.0 10.0 0.0 10.0 0.0 5.0 0.0 55.0 0.0

***R = Recertification ***S = Surveillance

3.2.3.1.1 COMPRESSED WORK SCHEDULE (CWS) – N/A

3.2.3.1.2 HOLIDAYS – The Government observes the Federal holidays identified on the Office of Personnel Management (OPM) website:

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview

The Contractor is permitted to observe the above holidays IAW its corporate policy.

3.2.3.1.3 INSTALLATION CLOSURE - When Federal facilities are closed by the Government, or when

Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility related problem that prevents Federal personnel from working at the Government facility, contractor personnel assigned to work at that facility in support of such Federal employees shall follow their parent company’s policies.

3.2.3.1.4 While generally contractor personnel may not perform work on-site at a government facility without oversight from Federal personnel, in very limited circumstances, work being performed by contractor personnel may be deemed mission essential and performance of such mission essential work may be authorized to continue at the Government facility despite the facility being otherwise closed for normal operations. The circumstances permitting work being performed by contractor personnel to be deemed mission essential are extremely limited and generally only apply to performance of efforts related to public health, safety, or matters related to national security. The cognizant Contracting Officer must concur with any determination that work being performed by contractor personnel is mission essential.

3.2.3.1.5 OVERTIME - ☐ is ☒ is not authorized under this contract.

3.1.7 OTHER DIRECT COSTS (TRAVEL & MATERIAL):

3.1.7.1 TRAVEL (CLIN 7001, 7002, 7003, 7004, 7005 & 7006): Travel, excluding profit, will be required to support program tasking, including general and administrative expenses. Such travel may include temporary visits to various locations for training, evaluation, or inspection.

3.1.7.1.1 The Government anticipates temporary travel to FRC Southeast (Jacksonville, FL) as a requirement of this contract. For reimbursement purposes, long distance travel is defined as travel exceeding 50 miles from the FRC location. Local travel expenses will not be reimbursed. The locations identified are not exhaustive; additional sites may be required during the contract period.

a. Travel Request. Prior to commencing travel to any site in support of this Contract, the Contractor must obtain approval from, and coordinate with, the Contracting Officer Representative (COR). The Contractor shall complete and submit a Travel Authorization Request using the Travel Authorization Request Template (Section J, Attachment 02). Each request must include, at a minimum:

i. Name(s) of traveler(s)

ii. Destination(s)

iii. Duration of stay at each destination

iv. Purpose of each destination

v. Estimated travel costs https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview

b. The COR must approve all travel performed in support of this contract prior to the commencement of the trip.

c. Travel Authorization - Contractor Request: The Temporary Duty (TDY) request must include a detailed cost estimate prepared in accordance with the Joint Travel Regulations (JTR), identifying all anticipated airfare, car rental, lodging, and related expenses. All travel requests must be fully funded prior to performance and will be reimbursed on a reimbursable basis. The Contractor is responsible for planning and securing all airfare, car rental, lodging, and subsistence.

d. Travel Authorization and Procedures:

1. Pre Approval Requirement. All Contractor travel must receive prior written approval from the COR before any arrangements are made or travel is initiated. No travel may be undertaken without documented Government authorization, and all travel must comply with applicable regulations, funding constraints, and contract requirements.

2. Contractor Travel Authorization Request. The Contractor shall submit a Travel Authorization Request that includes a detailed JTR compliant cost estimate identifying all anticipated travel expenses, including airfare, lodging, rental vehicles, per diem, and any other reimbursable costs. All travel requests must be fully funded prior to execution, and travel will be reimbursed in accordance with contract terms and applicable regulations.

Reimbursement for long distance travel shall be limited to costs consistent with the JTR.

3. Submission Requirements. All travel requests must be legible; include a comprehensive description of the proposed trip and its purpose; summarize information by individual traveler; clearly identify the applicable contract number; specify the associated Contract Line Item Number (CLIN); and be submitted no fewer than ten (10) business days prior to planned travel to allow for adequate review and approval.

3.1.7.2 MATERIAL: N/A

3.1.8 SUBCONTRACTOR:

Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this contract. All provisions of this SOW shall flow down to subcontractors providing support under this contract.

3.1.9 MANAGEMENT OF CONTRACTOR PERSONNEL:

The Government will neither supervise contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual contractor employees. The Contractor must manage its employees and guard against any actions that are of the nature of personal services or give the perception of personal services.

3.1.10 PERFORMANCE TRANSITION: KICKOFF MEETING

Upon award and prior to the start of performance, the Contractor must participate in a formal Kickoff Meeting with the COMFRC COR, the Procuring Contracting Officer (PCO), and all designated Government stakeholders. This meeting serves as the official transition between contract award and the commencement of performance. During the Kickoff Meeting, the Government will review all requirements necessary for initial contract mobilization, including performance expectations, reporting requirements, communication protocols, security and access procedures, audit scheduling considerations, and any Government‑furnished information or resources required to begin work. The Contractor must ensure that appropriate management, technical, and administrative personnel are present to address all functional areas relevant to contract execution and to establish the coordination framework that will govern performance throughout the contract lifecycle.

3.1.10.1 At the Kickoff Meeting, The Contractor must identify the personnel who will serve as the primary points of contact for day-to-day contract coordination. These individuals shall be responsible for scheduling training, coordinating site access, managing audit planning activities, and facilitating routine communication between the Contractor and Government representatives. The designated points of contact shall have the authority to make binding commitments on behalf of the Contractor for matters related to transition, scheduling, and daily contract administration. These operational points of contact function in support of, and in coordination with, the Program Manager identified under Section 3.5.13.

3.1.11 GOVERNMENT FURNISHED PROPERTY (GFP)/GOVERNMENT FURNISHED

INFORMATION (GFI): N/A

3.2 SECURITY

All Contractor personnel must be eligible to perform Non-Critical Sensitive work as defined by SECNAV M-5510.30C. Prior to access to Level I areas as well Level II or Level III Restricted Areas, as defined by the SECNAVINST 5500.35, and/or access to CUI or Sensitive information, all Contractor personnel are required to have a favorably adjudicated Tier-3 investigation from the Office of Personnel Management. The Contractor must submit a request for personnel security investigation to the Government Security Office. The Government Security Office shall initiate the Contractor's Electronic Application (eApp), shall do a preliminary screening of the Contractor's eApp for suitability and derogatory information. The Contractor employee shall provide all requested information pursuant to the Privacy Act of 1974. The Government Security Office may deny the Contractor access to Government facilities and information and may prohibit the Contractor from performing sensitive duties for failure to provide requested information or when derogatory or adverse information is present on the Contractor's eApp, in such cases, the Contractor employee may not perform on the Contract

3.2.1 CONTROLLED UNCLASSIFIED INFORMATION (CUI) PROTECTION:

3.2.1.1 The Contractor must implement and maintain security procedures and controls to prevent unauthorized disclosure of controlled unclassified information and to control distribution of controlled unclassified information in accordance with the NISPOM rule, 32 CFR Part 117 and SECNAV M- 5510.36B. All Contractor facilities shall provide an appropriate means of storage for controlled unclassified information and materials.

3.2.1.2 All CUI shall be identified, marked, and handled in accordance with DoD Instruction 5200.48, Controlled Unclassified Information (CUI). CUI that includes Covered Defense Information (CDI), as defined in 48 CFR 252.204–7012(a)) and any CUI generated or provided under this contract shall be safeguarded per DoDI 5200.48___ https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF. Any product containing CDI shall be assigned an appropriate distribution statement (Statements B through F) in accordance with DoDI 5230.24, Distribution Statements on Technical Documents, and the distribution statement shall be displayed as required by DoDI 5230.24, Enclosure 3.

3.2.1.3 All controlled unclassified technical information shall be appropriately identified and marked with distribution statement: D

3.2.2 CITIZENSHIP REQUIREMENTS: Only U.S. citizens may perform under this contract. Contractor personnel working at government sites and in the contractor’s own facilities supporting government work shall undergo the company internal vetting process prior to gaining access to U.S. Government controlled unclassified information, or performing government-related sensitive duties. All personnel working under the resultant contract shall be U.S. citizens. Foreign nationals are prohibited from using FRC assets, and they will not be allowed to access any resource of the FRC legacy network at any time, this includes both the legacy network and the current FRC network, either Navy Marine Corps Intranet (NMCI) or NAUTILUS.

3.2.3 OPERATIONS SECURITY (OPSEC)

The Contractor must develop, implement, and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the Contractor and any subcontractor during performance of the contract. The Contractor must be responsible for the subcontractor’s implementation of the OPSEC requirements. This program may include Information Assurance and Communications Security (COMSEC). The OPSEC program shall be in accordance with National Security Decision Directive (NSDD) 298, and at a minimum shall include:

1) Assignment of responsibility for OPSEC direction and implementation.

2) Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

3) Establishment of OPSEC education and awareness training.

4) Provisions for management, annual review, and evaluation of OPSEC programs.

5) Flow down OPSEC requirements to subcontractors when applicable.

3.2.4 While performing aboard NAVAIR or NAVAIR sites, The Contractor must comply with facility

OPSEC program instructions and contribute to organization-level OPSEC efforts. Include OPSEC as part of its ongoing security awareness program and take all required Agency training. Be responsive to the Supporting OPSEC Manager on a non-interference basis. Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the RO and contractor in support of the mission.

3.2.5 Common Access Card (CAC)/Public Key Infrastructure (PKI), System Authorization Access

Request (SAAR)/ Local Badges & Temporary Local Badges

3.2.5.1 SAAR - All contractor personnel requiring access to Government Information Technology (IT) systems shall have an approved System Authorization Access Request (SAAR) DD Form 2875 (May 2022) on file, and complete required Annual Information Awareness Training. New employees must submit their SAAR forms within thirty (30) days after their first day of work. SAAR forms shall be submitted to the COR or Government Technical Point of Contact (TPOC).

3.2.5.2 COMMAND ACCESS CARDS (CAC) / LOCAL OR TEMPORARY BADGES - Contractor CACs and facility specific identification badges will be issued by the Government to on-site contractor personnel that requires it and shall always be visible while personnel are at the Government site. The Contractor must furnish all requested information required to facilitate issuance of identification badges and shall conform to task order specific instructions and facility guidance. All CACs and identification badges issued to Contractor employees shall be returned to the Contracting Officer Representative at the Government site in accordance with task order instructions and facility guidance following completion of the contract, relocation or termination of an employee, or upon request from the Contracting Officer’s Representative. The Government will provide the Contractor with access to Government facilities, as required, for performance of tasks under this contract.

Contractor personnel shall comply with task order instructions and facility guidance.

Other requests for deliverables under this contract shall be referred to the COR for approval.

3.2.6 Temporary Local Badges:

3.2.6.1 Eligibility and Identification - All Contractor personnel and representatives must be U.S. citizens, with status verification performed by the Prime Contractor. To ensure compliance with installation security:

a. Identify Your Government Sponsor - Contractor must request access from Contracting

Officer’s Representative (COR) or a government employee to gain access.

b. Confirm initiation for temporary access in the DBID system DBIDS Pre-Enrollment site or the installation's specific vetting portal).

c. Completing this online generates a QR code or confirmation number that significantly speeds up time at the Visitor Control Center (VCC).

3.2.6.2 Complete Required Documentation: Contractors will be required to fill out SECNAV 5512/1

(SECNAV 5512/1)

3.2.6.3 Information Needed:

a. Full legal name

b. SSN

c. Date of Birth

d. Citizenship status

e. Employer information

3.2.6.4 Visitor Control Center (VCC): Once the request is approved, the contractor can proceed to the designated base's Pass & ID Office or VCC to be issued a pass. The following information is required:

a. Primary ID: A REAL ID compliant driver’s license or a U.S. Passport.

b. Secondary ID: A Social Security card or Birth Certificate (required if your license is not

REAL ID compliant).

c. Vehicle Documents: Current vehicle registration and proof of insurance (if you are driving onto the base).

d. Proof of Purpose: A copy of the contract or a Letter of Authorization (LOA) from the sponsor.

e. Facility Access and Compliance: The Government will provide access to necessary facilities to support contract execution. All personnel are required to comply with specific instructions and facility-specific security guidance.

3.2.7 INFORMATION SECURITY

If the work is performed at the Contractor’s facility, The Contractor must implement and maintain security procedures and controls to prevent unauthorized disclosure of CUI and to control distribution of CUI in accordance with NISPOM rule, 32 CFR Part 117 and SECNAV M-5510.36B and DoD CUI Instruction 5200.48. If the work is performed at the Government’s facility, The Contractor must https://dbids-global-enroll.dmdc.mil/ https://www.google.com/aclk?sa=L&pf=1&ai=DChsSEwiM15rd1fyRAxU0R0cBHfg6HK0YACICCAEQABoCcXU&co=1&ase=2&gclid=EAIaIQobChMIjNea3dX8kQMVNEdHAR34OhytEAAYASAAEgI5NvD_BwE&cid=CAASuwHkaJPksAiuQo8IBOIuPqR-jEUbq99qH4pAzgm358wKBeDKxdRSTtFZLClCOfoQnXDZmwQkw8GqcoTF7aaoq524batT8_HfAKwxXIk3tLqxtEHSgYdCM46w6VCI4TON3nh9Va3ZOMO-hdb3SL5VjFVwpfAN3UScJx6bA4tU_losEUdTSZN_5CF7Yb0CLbakp-hn7ZDziM8zd_A4L-1ROYvDg2Ko8tY4ExNMaL2e641ZUlQuvOmraUMqyWri&cce=2&category=acrcp_v1_32&sig=AOD64_27IliKvRrmCRPUl52BWBiiHYrjgA&q&nis=4&adurl=https://secnav-5512-1-form.pdffiller.com?keyword%3Dsecnav%25205512%25201%2520form%26campaignid%3D761010603%26adgroupid%3D113252498777%26gad_source%3D1%26gad_campaignid%3D761010603%26gbraid%3D0AAAAADn5P_RTTZOC09uIFYyN-UevmfLVT%26gclid%3DEAIaIQobChMIjNea3dX8kQMVNEdHAR34OhytEAAYASAAEgI5NvD_BwE&ved=2ahUKEwiWiZTd1fyRAxWLFFkFHfu_F5UQ0Qx6BAgMEAE comply with instructions and facility guidance. Contractors shall not store or transmit CUI on personal information technology systems or via personal e-mail. E-mail containing any DoW CUI shall be encrypted. Prior to sending CUI to any non-Navy Marine Corps Internet (NMCI) addressees, the sender must first positively verify all recipients are authorized access to CUI and have need-to-know.

Non-NMCI recipients must have a DoW compliant Public Key Infrastructure certificate that enables electronic transmission via unclassified networks while protecting the CUI with a digital signature and encryption.

3.2.8 MARKING

For Distribution Statement D (Administrative/Operational), all information generated by the Contractor must be properly marked in accordance with applicable DoW and Department of the Navy requirements. Controlled Unclassified Information (CUI), including For Official Use Only (FOUO) and Covered Defense Information (as defined in 48 CFR 252.204‑7012(a)), generated and/or provided under this task order shall be marked and safeguarded in accordance with DoD Instruction 5200.48, Controlled Unclassified Information (CUI). Technical information must also be marked with the appropriate Distribution Statement and any required Export Control warnings in accordance with DoDI 5230.24 and applicable Security Classification Guidance.

3.2.8.1 Other requests shall be referred to:

Commander, Fleet Readiness Centers 47038 McLeod Road, Bldg.

447 Patuxent River, MD 20670-1626

3.2.9 PUBLIC RELEASE FOR CUI: Any controlled unclassified information pertaining to this contract shall not be released for public dissemination, including posting to any social media sites such as Facebook or Twitter, unless it has been approved for public release by appropriate U.S. government authority. Proposed public releases shall be submitted for approval prior to release through:

Commander, Fleet Readiness Center Public Affairs Office, 47038 McLeod Road, BLDG 447, Patuxent River, MD 20670-1547.

3.2.10 LOSS, COMPROMISE or ELECTRONIC SPILLAGE of CLASSIFIED or CUI:

Contractors shall not store or transmit CUI on personal information technology systems or via personal e-mail. Unclassified e-mail containing any DoW CUI shall be encrypted. Prior to sending CUI to any non-NMCI addressees, the sender must first positively verify all recipients are authorized access to CUI and have need-to-know. Non-NMCI recipients must have a DoW compliant PKI certificate that enables electronic transmission via unclassified networks while protecting the CUI with a digital signature and encryption. All instances of loss, compromise, and electronic spillage of classified or CUI shall be reported to the COR, TPOC, and Government Security Office within 24 hours of the incident occurring.

3.2.11 OPERATIONS SECURITY (OPSEC):

The Contractor must develop, implement, and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the Contractor and any subcontractor during performance of the contract. The Contractor must be responsible for the subcontractor’s implementation of the OPSEC requirements. This program may include Information Assurance and Communications Security (COMSEC). The OPSEC program shall be in accordance with National Security Decision Directive (NSDD) 298, and at a minimum shall include:

1. Assignment of responsibility for OPSEC direction and implementation.

2. Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

3. Establishment of OPSEC education and awareness training.

4. Provisions for management, annual review, and evaluation of OPSEC programs.

5. Flow down OPSEC requirements to subcontractors when applicable.

3.2.12 ANTI-TERRORISM FORCE PROTECTION AND EMERGENCY MANAGEMENT:

The work performed on this contract is not Emergency Essential in accordance with OPNAVINST 3440.17A and Government Emergency Management, Antiterrorism, or Continuity of Operations Plans. EMPLOYEE shall comply with all Government Emergency Management, Antiterrorism, or Continuity of Operations Plans and directives. EMPLOYEE shall not report for work at Government facilities upon declaration of Force Protection Condition CHARLIE or in any event or emergency where Government officials’ direct curtailment of operations to “Mission Essential Only.” All EMPLOYEE assigned to a Government facility shall complete annual Antiterrorism (Level One) and Active Shooter training.

3.2.13 CYBERSECURITY

The Contractor must fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800- 171), or establish System Security Plan(s) (SSP) and Plan of Action & Milestones (POA&M) that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

Notwithstanding the allowance for such variation, The Contractor must identify their plans in the SSP and POA&M to implement the following, at a minimum:

3.2.13.1 Cybersecurity Maturity Model Certification (CMMC): CMMC Level 1 Applies

The Contractor must comply with the Cybersecurity Maturity Model Certification (CMMC) requirements established under 32 CFR Part 170 and DFARS 252.2047021. Although the effort is primarily focused on commercial software maintenance renewal and manufacturer level technical troubleshooting, performance under this contract may require the Contractor to exchange limited system information with the Government to support bug identification, diagnostics, and corrective fixes. Such exchanges may include configuration details, system behavior information, or other technical artifacts necessary to replicate and resolve issues and therefore constitute Federal Contract Information (FCI).

The Contractor must maintain a current certification at CMMC Level 1 Self Certification, which is the required level for safeguarding FCI, and shall ensure that all personnel, systems, and processes used in performance of this contract adhere to the applicable CMMC Level 1 practices for the duration of the effort. CMMC Level 1 ensures the implementation of the basic safeguarding requirements necessary to protect FCI during the limited data exchanges required to support troubleshooting and corrective actions.

3.2.14 DATA MONITORING:

In the event of a cyber-incident or at any time the Government has indication of a vulnerability or potential vulnerability, The Contractor must cooperate with the Naval Criminal Investigative Service (NCIS) and associated law enforcement agencies, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems;

and the continuous provision of all Contractor, or vendor logs that show network activity, including any additional logs the Contractor, subcontractor, or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

3.2.14.1 If the Government determines that the collection of all logs does not adequately protect its interests, The Contractor must cooperate with the NCIS to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

3.2.14.2 In all cases, the collection or provision of information data and any activities associated with this contract shall be in accordance with federal, state, and non-US law.

3.2.15 COMMUNICATIONS SECURITY (COMSEC). The Contractor must be required to access COMSEC material. The Contractor must follow the guidance for handling COMSEC material as identified in EKMS-1b - Electronic Key Management System (EKMS) Policy and Procedures for Navy EKMS Tiers 2 & 3 and applicable local instructions.

3.3 DETAILED SUPPORT REQUIREMENTS

3.3.1 Performance requirements – The functional performance requirements for this effort are defined in

Sections 3.3.1 through 3.3.2.9, with applicability across the Base and Option periods identified in Table 5. The Contractor shall provide all required services and staffing coverage necessary to perform work under the Audit Days CLINs listed in Table 5 during normal working hours.

3.3.2

TABLE # 5

Description BASE Option Year 1

(OY1)

Option Year 2

(OY2)

Option Year 3

(OY3)

Option Year 4

(OY4)

FAR 52.217-8

Extension

FRCSE 0001 1001 2001 3001 4001 5001

FRCE 0002 1002 2002 3002 4002 5002

FRCSW 0003 1003 2003 3003 4003 5003

FRCMA

(Oceana/Norfolk)

0004 1004 2004 3004 4004 5004

Lamoore CA 0006 1005 2005 3005 4005 5005 Auditor Training 0007 1006 2006 3006 4006 5006 System Updates 0008 1007 2007 3007 4007 5007 Travel 0009 1008 2008 3008 4008 5008 Optional T&M:

Special Surveillance

0010 1009 2009 3009 4009 5009

3.3.3 The corresponding audit categories and required audit frequencies associated with the functional performance requirements identified in Table 5 are provided in Table 6 below.

TABLE # 5

Task Category Audit Type / Frequency Recertification (R) Mandatory: Conducted once every three (3) years.

Surveillance (S1 & S2) Mandatory: Conducted in Years 2 and 3 of the contracts.

Special Surveillance Optional: Triggered by system failure or risk or when a concern or issue is identified.

Standards Support for Revision & Integration

Optional: Triggered by changes in industry standards or when standards are revised or updated.

3.3.3.1 Audit Registration for FRC Southeast (FRCSE) – CLINs 0001, 1001, 2001, 3001, 4001 & 5001 The Contractor must perform all audit activities required to maintain FRCSE certification to ISO 9001, AS9110, ISO 14001, and ISO 45001. Activities include conducting Recertification (R) and Surveillance (S1, S2) audits, completing audit documentation, and verifying corrective actions in accordance with the required audit days identified for each standard.

3.3.3.2 Audit Registration for FRC East (FRCE) – CLINs 0002, 1002, 2002, 3002, 4002 & 5002 The Contractor must perform all audit activities required to maintain FRCE certification to ISO 9001, AS9110, ISO 14001, and ISO 45001. Activities include Recertification and Surveillance audits, audit reporting, and verification of corrective actions consistent with the audit‑day requirements for each standard.

3.3.3.3 Audit Registration for FRC Southwest (FRCSW) – CLINs 0003, 1003, 2003, 3003, 4003 & 5003 The Contractor must perform all audit activities required to maintain FRCSW certification to ISO 9001, AS9110, ISO 14001, and ISO 45001. Activities include Recertification and Surveillance audits, preparation of audit records, and verification of corrective actions based on the audit‑day requirements for each standard.

3.3.3.4 Audit Registration for FRC Mid-Atlantic (Oceana/Norfolk)FRCMA: CLINs 0004, 1004, 2004, 3004, 4004 & 5004 The Contractor must perform all audit activities required to maintain FRCMA certification to AS9110. Activities include Recertification and Surveillance audits, audit documentation, and verification of corrective actions in accordance with the audit day requirements for AS9110.

3.3.3.5 Audit Registration for FRC West (FRCW) – CLINs 0005, 1005, 2005, 3005, 4005 & 5005 The Contractor must perform all audit activities required to maintain FRCW certification to AS9110.

Activities include Recertification and Surveillance audits, audit reporting, and verification of corrective actions consistent with the audit‑day requirements for AS9110.

3.3.3.6 System Updates – CLINs 0006, 1006, 2006, 3006, 4006 & 5006 The Contractor must provide training and technical support required to update management system documentation when ISO or AS standards are revised. Activities include updating procedures, manuals, and supporting documents to ensure continued conformity.

3.3.3.7 Travel – CLINs 0007, 1007, 2007, 3007, 4007 & 5007

The Contractor must provide all travel necessary to conduct audit activities at FRC locations. Travel shall comply with the Joint Travel Regulations (JTR) and corresponds to the travel‑day requirements associated with each audit cycle.

3.3.3.8 OPTIONAL TIME AND MATERIALS CLINS

3.3.3.8.1 Special Surveillance – OPTIONAL CLINs 0008, 1008, 2008, 3008, 4008 & 5008 The Contractor must conduct Special Surveillance audits when directed by the Government in response to significant events such as major nonconformities, audit failures, safety‑related incidents, or other conditions that may jeopardize an FRC’s certification status. Upon written notification from the Contracting Officer (CO) or the Contracting Officer’s Representative (COR), The Contractor must perform these audits under the Optional Time and Materials (T&M) Special Surveillance CLIN for the applicable performance period. Special Surveillance audits are unscheduled, event‑driven assessments used to verify the effectiveness of corrective actions, evaluate systemic risks, or assess organizational changes that may impact continued conformity to applicable standards. These activities are distinct from the recurring audit cycle and shall only be executed to address specific system failures, emergent compliance concerns, or other conditions requiring immediate Government attention.

3.3.3.8.2 Audit Days – OPTIONAL CLINs 0009, 1009, 2009, 3009, 4009 & 5009 The Contractor must provide the audit labor necessary to conduct Recertification (R) and Surveillance (S1, S2) audits across all applicable management system standards for each Fleet Readiness Center (FRC). Required activities include performing audits, evaluating conformance, issuing updated certifications, and conducting periodic surveillance assessments in accordance with the established audit cycle. In addition to scheduled audit activities, The Contractor must provide specialized technical and transition support under the Optional Time and Materials (T&M) Standards Revision CLIN for the applicable performance period when international standards (e.g., ISO, AS, or SAE) undergo formal revision or when the Government requires integration of additional management system standards. Under this task, The Contractor must conduct gap analyses, develop transition roadmaps, and provide implementation support to ensure each FRC successfully migrates to updated standards within the timelines mandated by the relevant accreditation bodies. These services supplement the recurring audit lifecycle and ensure the FRCs maintain continuous compliance with current industry and regulatory requirements.

3.3.4 DETAIL SUPPORT REQUIREMENT – INTERNATIONAL ORGANIZATION OF

STANDARDIZATION (ISO) 9001, AEROSPACE STANDARD (AS) 9110, ISO 14001, AND

ISO 45001

3.3.4.1 FRC ISO/AS Certification Maintenance Requirements (CDRL A001):

The Contractor must register and maintain the certification of Fleet Readiness Center Southeast (FRCSE), Fleet Readiness Center East (FRCE), Fleet Readiness Center Southwest (FRCSW), Fleet Readiness Center Mid Atlantic (FRCMA – Norfolk and Virginia Beach, VA), and Fleet Readiness Center West (FRCW) to the applicable ISO and AS standards. FRCSE, FRCE, and FRCSW shall be maintained to ISO 9001, AS9110, ISO 14001, and ISO 45001. FRCMA and FRCW shall be maintained to AS9110. The Contractor must perform all required Recertification and Surveillance/Maintenance audits necessary to sustain registration through the end of the contract.

3.3.4.2 Audit Coordination and Deliverable Submission Requirements (CDRL A001):

Each FRC site has an assigned FRC Management Representative. The Contractor must coordinate all audit planning, scheduling, execution, and reporting with the respective FRC Management Representative. The COMFRC Representative serves as the Client Agency Technical Point of Contact (TPOC) and shall coordinate with the Contractor to review, develop, and finalize all reports and deliverables. All deliverables shall be submitted to the COR via the Monthly Status Report. The Contractor must register and maintain the certification of Fleet Readiness Center Southeast (FRCSE), Fleet Readiness Center East (FRCE), Fleet Readiness Center Southwest (FRCSW), Fleet Readiness Center Mid-Atlantic (FRCMA – Norfolk and Virginia Beach, VA), and Fleet Readiness Center West (FRCW) to the applicable ISO and AS standards. FRCSE, FRCE, and FRCSW shall be maintained to ISO 9001, AS9110, ISO 14001, and ISO 45001. FRCMA and FRCW shall be maintained to AS9110. The Contractor must perform all required Recertification and Surveillance/Maintenance audits necessary to sustain registration through the end of the contract.

3.3.4.3 Work under this SOW shall be performed at the FRC locations identified in Section C.3 (Scope).

Telework or remote work may be used when authorized by the Government.

3.3.5 AUDIT PLANNING: The Contractor must perform the following (CDRL A002):

a. Plan each audit, including coordination of dates, times, and scope. Audit dates shall be agreed upon by the COMFRC Representative, the Contractor, and the applicable FRC Management Representative, and submitted with the audit plan at least sixty (60) days prior to the audit.

The Government…