Attachment 01_Statement of Work.pdf

UNCLASSIFIED

Statement of Work (SOW)

PROJECT TITLE: Application Arsenal (AA) Enterprise Engineering and Lifecycle Support

1.0 TASK ORDER PURPOSE

The purpose of this Task Order is to procure engineering, software development, technical services, and program management for the continued design, implementation, security, and sustainment of the Application Arsenal (AA) enterprise service. The primary objective is to deliver comprehensive lifecycle support to ensure the system operates securely and effectively, meeting the evolving needs of the warfighter and government personnel.

2.0 SCOPE

The scope of this effort includes the full lifecycle of systems engineering and software sustainment for the AA platform. The contractor shall provide all necessary personnel, materials, and services to perform the tasks outlined in this SOW. The primary technical environment for this effort is the government-designated DevSecOps pipeline; however, work may be directed to other mandated environments (e.g., ORION) as required. This contract is intended to be the primary support vehicle for the Application Arsenal platform.

The performance requirements described below may be initiated and funded by diverse DoD Components. The contractor shall support all tasks as directed by the Contracting Officer's Representative (COR), provided the work is within the scope of this SOW.

3.0 BACKGROUND

The Naval Information Warfare Center Pacific (NIWC-PAC) established the Application Arsenal (AA) to provide critical software delivery capabilities to the fleet.

Application Arsenal (AA) is the enterprise distribution, update, and installation service for software at the tactical edge. It enables software developed in a software factory to be sent Over-The-Air (OTA) to the edge across many different environments. AA currently deploys software to Agile Core Services (ACS), the USMC Common Hosting Environment (CHE), the Overmatch Production Environment (OPE), Five Eyes (FVEY) partners, and autonomous vehicles, with more systems projected to come online.

This SOW defines the requirements for contractor-provided services essential to enable the design, implementation, and sustainment of the AA enterprise service for a diverse set of DoD-wide stakeholders, including the Rapid Capabilities Office (RCO), the Portfolio Acquisition Executive for Robotic and Autonomous Systems (PAE RAS), the Portfolio

Acquisition Executive Mission Systems (PAE MS), the U.S. Marine Corps (USMC), and Naval Sea Systems Command (NAVSEA).

4.0 APPLICABLE DOCUMENTS

The following documents are applicable for this effort:

• DODM 5200.01, Volume 1, DoD Information Security Program: Overview, Classification, And Declassification, dated February 24, 2012, Change 3 17 January 2025

• DODM 5200.01, Volume 2, DoD Information Security Program: Marking Of Classified Information, dated February 24, 2012, Change 4 28 July 2020

• DODM 5200.01, Volume 3, DoD Information Security Program: Protection Of Classified Information, dated February 24, 2012, Change 4 17 January

• DODI 5200.48, Controlled Unclassified Information (CUI), dated 6 March

• DoDM 5200.02 - DoD Manual – Procedures for the DoD Personnel Security Program (PSP) dtd 3 Apr 17, Change 1 29 October 2020

• DoDI 5200.02, DoD Personnel Security Program (PSP), 21 Mar 2014, Ch-3, 24 Sep 2020

• DOD 5205.02-M, DOD Operations Security (OPSEC) Program, Ch-2 29 October 2020

• DoDI 5220.31, National Industrial Security Program (NISP), 9 May 2023

• DoDM 5220.32, Volume 1, National Industrial Security Program: Industrial Security

Procedures for Government Activities, 1 August 2018, Ch-2 10 December 2021

• DoDM 5220.32, Volume 2, National Industrial Security Program: Procedures For

Government Activities Relating To Foreign Ownership, Control, Or Influence (FOCI), 17 April 2014, Ch-2 10 December 2021

• Code of Federal Regulations, 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM), 24 Feb 2021

• OPNAVINST 3432.1, DON Operations Security, 4 November 2011

• DoDI O-2000.16 Volume 1, DoD Antiterrorism Program Implementation: DoD

Antiterrorism Standards,17 November 2016, Ch-3 7 May 2021

• SECNAVINST 5510.30C, Department of Navy Personnel Security Program, 24 January

• SECNAVINST 5510.36B, DON Information Security Program, 12 July 2019

• SPAWARINST 3432.1 (Series), Operations Security Policy, 2 February 2005

• DoDD 5205.02E, DoD Operations Security (OPSEC) Program, 20 June 2012, Ch-2 20

August 2020

• National Security Decision, National Operations Security Program (NSDD) 298 Directive

298 (Series)

• Navy Tactics, Techniques, and Procedures (NTTP) Operations Security (OPSEC) Manual:

NTTP 3-13.3 dated 16 December 2022

• NIWCPACINST 5500.1D, Command Security Manual, 15 August 2023

• DoD 5105.21-M Volume 1, Ch-2, Sensitive Compartmented Information (SCI)

Administrative Security Manual: Administration of Information and Information Systems, 6 Oct 2020

• DoD 5105.21-M Volume 2, Ch-2, Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Physical Security, Visitor Control, and Technical Security, 2 Nov 2020

• DoD 5105.21-M Volume 3, Ch-2, Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Personnel Security, Industrial Security, and Special Activities, 14 Sep 2020

5.0 PERFORMANCE REQUIREMENTS

5.1 Engineering & Integration Requirements

o 5.1.1 AA Development: The contractor shall provide the planning, development, testing, and integration required for all new AA releases and enhancements.

Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Top Secret Level to include Sensitive Compartmented Information Facilities (SCIF).

5.1.1.1 Capability Development: Efforts shall include modernizing existing deployment architectures by leveraging and integrating with the government-designated DevSecOps pipeline, deploying with Agile Core Services (ACS), and ensuring alignment with the Common Hosting Environment (CHE) and other shared government platforms. The contractor shall design and implement scalable, secure integration pathways for Navy programs of strategic importance, ensuring compliance with mandated DevSecOps tooling, security guardrails, and enterprise release practices, including interoperability with Five Eyes (FVEY) partners. Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Top Secret Level to include Sensitive Compartmented Information Facilities (SCIF).

o 5.1.1.2 Cybersecurity Engineering: The contractor shall engineer and integrate required cybersecurity controls into new AA releases in alignment with Risk Management Framework (RMF) standards. Deliverables shall include Security Control Traceability Matrices (SCTMs), Plans of Action and

Milestones (POAMs), and other documentation required for the Authority to Operate (ATO). Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Top Secret Levelto include Sensitive Compartmented Information Facilities (SCIF).

5.1.1.3 Fielding: The contractor shall perform the installation, configuration, and testing necessary to field new releases across all authorized operational environments for CONUS and OCONUS locations, ashore and afloat. This effort shall include robust system validation through Factory Acceptance Testing (FAT), Site Acceptance Testing (SAT), and System Operational Verification Testing (SOVT). Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Top Secret Level to include Sensitive Compartmented Information Facilities

(SCIF).

• 5.1.2 Software Delivery Pipeline Integration and Replication

5.1.2.1 DevSecOps Engineering Services: The contractor shall provide engineering services to design, implement, and integrate secure DevSecOps pipeline capabilities within the Government-designated DevSecOps environment (e.g., ACS). Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Top Secret Level to include Sensitive Compartmented Information Facilities

(SCIF).

5.1.2.2 Secure Software Distribution: The contractor shall develop and validate secure methods for efficient transfer and replication of software artifacts to remote and distributed environments, including ashore, afloat, autonomous, and cloud-hosted domains. Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Top Secret Level to include Sensitive Compartmented Information Facilities (SCIF).

• 5.1.3 Infrastructure, Command and Control (C2), Autonomous Systems, and Cross-Domain Solution (CDS) Integration

5.1.3.1 CDS Engineering and Integration: The contractor shall integrate with existing infrastructure and established Cross-Domain Solutions (CDS) to provide the secure, bi-directional data transfer capabilities necessary to support distributed autonomous operations across disparate security domains. Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Top Secret Level to include Sensitive Compartmented Information Facilities (SCIF).

o 5.1.3.2 Integration Support for Autonomous Systems: The contractor shall support the integration of edge servers, autonomous vehicle platforms, and related mission systems with currently fielded and emerging technologies.

This includes the integration of payloads and sensors common to unmanned and autonomous systems. Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Top Secret Level.

5.1.3.3 Support for Autonomous Operations and Data Exchange: The contractor shall leverage and enhance existing infrastructure to support Command and Control (C2) data exchange for real-time operational scenarios, exercises, and mission requirements. This includes data to and from autonomous systems, such as mission tasking, telemetry, and sensor data. Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Top Secret Level to include Sensitive Compartmented Information Facilities (SCIF).

o

5.1.4 Rapid Agile Development & Integration Support (RADIS) (RDT&E):

The contractor shall provide a rapid technical response to issues employing engineering techniques to solve problems using an agile software approach to develop, test, and integrate new C4I capabilities to meet identified Science & Technology (S&T) gaps for the warfighter. Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Top Secret Level to include Sensitive Compartmented Information Facilities (SCIF).

• 5.2 Support Requirements

5.2.1 Application Arsenal (AA) Sustainment: The contractor shall provide comprehensive support to sustain the functionality, security, and operational availability of all fielded AA releases. Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Top Secret Level to include Sensitive Compartmented Information Facilities (SCIF).

5.2.1.1 Operations & Maintenance (O&M): The contractor shall operate, maintain, and sustain all fielded releases, including proactive monitoring, repairs, and routine updates. Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Top Secret Level to include Sensitive Compartmented Information Facilities

(SCIF).

5.2.1.2 System Administration: CSWF-qualified personnel shall perform routine system administration on Linux and Windows servers. Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Top Secret Level to include Sensitive Compartmented Information Facilities (SCIF).

5.2.1.3 Cyber & Information Assurance (IA): The contractor shall provide operational IA support, including managing security patches, conducting vulnerability scanning and remediation, and preparing all required artifacts for cybersecurity compliance. The contractor is not responsible for managing the eMASS ATO record. Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Secret Level to include Sensitive Compartmented Information Facilities

(SCIF).

5.2.1.4 Help Desk: The contractor shall provide help desk support, including remote and on-site assistance. Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Secret Level to include Sensitive Compartmented Information Facilities

(SCIF).

5.2.2 Sustainment of Fielded Capabilities: The contractor shall provide engineering and technical support for the sustainment of previously fielded software, infrastructure, and cross-domain capabilities, including support for exercises and operational events. Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Secret Level to include Sensitive Compartmented Information Facilities

(SCIF).

5.2.3 RADIS (O&M): The contractor shall provide a rapid technical response to enhance, upgrade, test, and integrate C4I capabilities to meet identified S&T gaps for the warfighter, developing user stories in the government-designated DevSecOps pipeline or other Government-mandated environments. Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Secret Level to include Sensitive Compartmented Information Facilities (SCIF).

• 5.2.4 Training and Logistics Support:

5.2.4.1 Training Support: The contractor shall provide user and administrator training for sustained systems. Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Secret Level to include Sensitive Compartmented Information Facilities (SCIF).

5.2.4.2 Logistics Support: The contractor shall provide logistics support to maintain operational readiness, including tracking software licenses and managing version releases. Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Top Secret Level to include Sensitive Compartmented Information Facilities

(SCIF).

5.2.5 Technical Data and Reporting: The contractor shall generate, update, and maintain a complete and accurate Technical Data Package (TDP) for all supported systems and report regularly to government stakeholders.

Personnel shall provide these services within laboratories and vessels that are classified from the unclassified level up to Top Secret Level to include Sensitive Compartmented Information Facilities (SCIF).

6.0 TRAVEL

Travel is anticipated for this effort. All travel is expected to originate from the San Diego, CA area. Contractors may propose alternate origins as required. The Contractor shall attend support meetings, conferences, workshops, and fielding’s at CONUS and OCONUS locations in support of the SOW requirements. Travel to locations within United States Africa Command (USAFRICOM), United States Central Command (USCENTCOM), United States European Command (USEUCOM), United States Indo-Pacific Command (USINDOPACOM), United States Northern Command (USNORTHCOM), United States Southern Command (USSOUTHCOM) may be required. All travel requirements (including plans, agenda, itinerary, or dates) shall be pre-approved by the Government, and is on a strictly cost reimbursable basis in accordance with the Federal Travel Regulations.

7.0 PROPERTY REQUIREMENTS

No Government Furnished Property (GFP) is anticipated for this Task Order.

8.0 SECURITY

The work performed under this effort is anticipated to be up to the SECRET level, with potential for personnel to provide services within laboratories and vessels classified up to TOP SECRET/SCI. The contractor personnel will require access to classified data, information, meetings, and spaces. The Contractor will require access to Communications Security (COMSEC), Secure Internet Protocol Router Network (SIPRNet)/Joint Worldwide Intelligence Communications System (JWICS). The contractor shall adhere to all security requirements outlined in the DD Form 254, Contract Security Classification Specification.

Some contractor personnel will perform non-technical, administrative duties at the Unclassified and/or Controlled Unclassified Information (CUI) level at the contractor facility. These contractors need access to unclassified government computer network/systems but does not need access to the government installation. Therefore, NIWC PAC Personnel Security is responsible for making a Fitness Determination in regards to Common Access Card (CAC) issuance for these contractors. A CAC will be conditionally authorized provided the contractor meets the required benchmarks (i.e., favorable fingerprints, successfully submitted background investigation questionnaire, etc.)

Contractor personnel assigned to this effort who require access to SCI data and spaces must possess a current SSBI/T5/T5R with ICD 704 eligibility (which replaced DCID 6/4 eligibility) and be enrolled in Continuous Vetting.

Although there is no requirement for the contractor to access NATO information under this contract per Naval Intelligence Security Policy Directive 17-008 those contractors who need SCI and those with SCI access that are required to use JWICS and SIPRNet shall be North Atlantic Treaty Organization (NATO) read-on and complete the derivative classification training is provided by the facility security officer. Specific requirements provided in the Department of Defense Contract Security Classification Specification, DD Form 254.

Contractors performing tasks at the TS or below level without SCI access shall only receive the North Atlantic Treaty Organization (NATO) awareness brief and complete the derivative classification training prior to being granted access to SIPRnet. The facility security officer provides training. Specific requirements provided in the Department of Defense Contract Security Classification Specification, DD Form 254.

Personnel requiring privileged access to government information systems must have a favorable Tier 5 background investigation or its equivalent.

The National Industrial Security Program Operating Manual (NISPOM). 32 CFR NISPOM Rule 117.8 implements contractor reporting requirements per SEAD 3. Contractors are required to report certain events such as those that have an impact on: 1) the status of the facility clearance (FCL), 2) the status of an employee's personnel clearance (PCL); may indicate the employee poses an insider threat the proper, 3) the proper safeguarding of classified information, and 4) or an indication that classified information has been lost or compromised. Contractors working under NIWC Pacific contracts will ensure information pertaining to assigned contractor personnel are reported to the Contracting Officer Representative (COR)/Technical Point of Contact (TPOC), the Contracting Specialist, and the Security's COR in addition to notifying appropriate agencies such as Cognizant Security Agency (CSA), Cognizant Security Office (CSO), or Defense Counterintelligence and Security Agency (DCSA) Trust Decision (Adjudications), (TDA) when that information relates to the denial, suspension, or revocation of a security clearance of any assigned personnel;

any adverse information on an assigned employee's continued suitability for continued access to classified access; any instance of loss or compromise, or suspected loss or compromise, of classified information; actual, probable or possible espionage, sabotage, or subversive information; or any other circumstances of a security nature that would affect the contractor's operation while working under NIWC Pacific contracts.

OCONUS travel: If foreign travel is required, all outgoing Country/Theater clearance message requests shall be submitted to the Commanding Officer, Attn: Foreign Travel Team, Naval Information Warfare Center Pacific, 53560 Hull Street Building 27, 2nd Floor - Room 206, San Diego, CA 92152 for action. A Request for Foreign Travel form shall be submitted for each traveler, in advance of the travel, to initiate the release of a clearance message at least 30 days in advance of departure. Each Traveler must also submit a Personal Protection Plan and have a Level 1

Antiterrorism/Force Protection briefing within one year of departure and a country specific briefing within 90 days of departure. Anti-Terrorism/Force Protection (AT/FP) briefings are required for all personnel (Military, DOD Civilian, and contractor) when the Commanders have granted access to their installations or separate facilities per DoDI O-2000.16 Volume

1. Contractor employees must receive the AT/FP briefing annually. The briefing is available at Joint Knowledge Online (JKO): https://jkodirect.jten.mil (prefix): JS; course number:

US007; title: Level 1 Anti-terrorism awareness training, if experiencing problems accessing this website contact the JKO Help Desk (24 hours a day/7 days a week, js.jko.helpdesk@mail.mil, 757-203-5654). This training can also be found on the Total Workforce Management Services (TWMS) site: https://twms.dc3n.navy.mil/selfservice/.

Sere 100.2 Level A code of conduct training is also required prior to OCONUS travel for all personnel. Sere 100.2 Level A training can be accessed https://jkodirect.jten.mil/Atlas2/page/desktop/DesktopHome.jsf, recommend course:

prefix: J3T: course #: A-US1329, for civilian, military, and contractors. Personnel utilizing https://jkodirect.jten.mil/ mailto:JS.JKO.HelpDesk@mail.mil https://twms.dc3n.navy.mil/selfservice/ https://jkodirect.jten.mil/Atlas2/page/desktop/DesktopHome.jsf the JKO site must have a CAC or contractor shall request a sponsored account to access the training. NOTE: Please email or fax the certificate to Foreign Travel Group (NIWC_PAC_FORTRAV@us.navy.mil). Other specialized training for specific locations may also be required contact the NIWC Pacific foreign travel team at (NIWC_PAC_FORTRAV@us.navy.mil). Additional information can be found in NIWCPACINST 4650.3B-Ch-1, dtd 20 February 2019. If you have questions about the process contact your NIWC Pacific COR.

Finally, EUCOM has mandated that all personnel going on official travel to the EUCOM AOR must now register with the Smart Traveler Enrollment Program (STEP). When you sign up, you will automatically receive the most current information the State Department compiles about your destination country. You will also receive updates, including Travel Warnings and Travel Alerts. Sign up is one-time only, after you have established your STEP account, you can easily add official or personal travel to anywhere in the world, not just EUCOM. http://travel.state.gov/content/passports/en/go/step.html.

Operations Security (OPSEC). OPSEC is a six-step continuous analytical process (identify critical information; analyze the threat; analyze vulnerabilities; assess risk; apply countermeasures; and periodic assessment of effectiveness). Critical information is any specific facts about friendly intentions, capabilities, and activities needed by adversaries for them to plan and act effectively so as to guarantee failure or unacceptable consequences for friendly mission accomplishment. Critical information does not necessarily mean CI, but includes all CI, CUI, and certain aggregations of information that meet the definition of critical information. Examples of critical information include research and development information, proprietary operational information, personal identifiable information, and financial information associated with U.S. national security related programs and activities. All personnel working under this task may at some time handle, produce or process critical information or Critical Program Information (CPI), and therefore both Collaborators must practice OPSEC. All work is to be performed in accordance with DoD OPSEC requirements, and in accordance with the OPSEC attachment to the DD 254.

Questions regarding the handling of CUI with regard to the support or performance of this Agreement may be directed to the Naval Information Warfare Systems Command (NAVWAR)/NIWC Pacific, OPSEC Manager, Code 87200.

Security programs are oriented towards protection of CI and classified material. OPSEC is an operations function, which involves the protection of any critical information – focusing on unclassified information that may be susceptible to adversary exploitation. Pursuant to DoDD 5205.02E, SECNAVINST 3070.2A, NAVWARINST 3432.1, Navy Tactics, Techniques, and Procedures (NTTP) Operations Security (OPSEC) Manual, the National Security mailto:NIWC_PAC_FORTRAV@us.navy.mil mailto:NIWC_PAC_FORTRAV@us.navy.mil http://travel.state.gov/content/passports/en/go/step.html

Decision Directive (NSDD) Number 298, and NAVWAR/NIWC Atlantic/NIWC Pacific’s OPSEC program implements requirements in DoD 5205.02-M – OPSEC Program Manual. Note: OPSEC requirements are applicable when contract personnel handle, produce or process critical information, have access to CI, unclassified CPI, CUI, or Department of Navy (DON) networks. CDSE OPSEC Course:

https://securityawareness.dcsa.mil/opsec/index.htm.

Information Security. Pursuant to DoDM 5200.01 and DoDI 5200.48, the contractor shall provide adequate security for all Controlled Unclassified Information (CUI) and Unclassified DoD information passing through non-DoD information system including all subcontractor information systems utilized on contract. If the contractor originates, adds to, or changes any of the DoD information, it must be marked in accordance with DODI 5200.48 and handled properly. The contractor shall disseminate CUI and unclassified DoD information within the scope of assigned duties and with a clear expectation that confidentiality is preserved. Examples of such information include the following: non-public information provided to the contractor, information developed during the course of the contract, and privileged contract information (e.g., program schedules, contract-related tracking). CUI Category descriptions are located:

https://www.dodcui.mil/Home/DoD-CUI-Registry/.

Contractor Requirements for Intelligence Oversight. In compliance with DoDD 5148.13 paragraph 4.1.e and SECNAVINST 3820.3F, all contractor personnel conducting Intelligence or Intelligence-related activities or supporting those efforts under Department of Defense authorities shall report any Questionable Intelligence Activity (QIA) or Significant or Highly Sensitive Matter (S/HSM) to the Naval Information Warfare Systems Command Intelligence Oversight Program Manager or Senior Intelligence Officer.

Questionable Intelligence Activity (QIA): Any Intelligence or Intelligence-related activity when there is reason to believe such activity may be unlawful or contrary to an Executive Order, Presidential Directive, Intelligence Community Directive, or applicable DoD policy governing that activity.

Significant or Highly Sensitive Matter (S/HSM): An Intelligence or Intelligence-related activity (regardless of whether the Intelligence or Intelligence-related activity is unlawful or contrary to an Executive Order, Presidential Directive, Intelligence Community Directive, or DoD policy), or serious criminal activity by Intelligence personnel, that could impugn the reputation or integrity of the Intelligence Community, or otherwise call into question the propriety of Intelligence activities. Such matters might involve actual or potential:

- Congressional inquiries or investigations.

- Adverse media coverage.

https://www.dodcui.mil/Home/DoD-CUI-Registry/

- Impact on foreign relations or foreign partners.

Systemic compromise, loss, or unauthorized disclosure of protected information.

9.0 DELIVERABLES

The contractor shall provide the data deliverables specified in the Contract Data Requirements List (CDRL), DD Form 1423, attached to the Task Order. This includes, but is not limited to, a Software Development Plan (SDP), Monthly Status Reports, and Technical Data Packages (TDP).

10.0 PERFORMANCE REQUIREMENTS SUMMARY

The following table summarizes the key performance requirements for this SOW.

Performance Objective

SOW

Paragraph

Performance Standard / Acceptable Quality Level

(AQL)

System Sustainment & Availability

5.2.1 The Application Arsenal platform shall maintain operational availability during standard business hours, excluding scheduled maintenance.

Rapid Agile Development & Support

5.1.4, 5.2.3

All new features and sustainment actions are managed via approved Agile processes and delivered in planned sprints. AQL: 95% of committed story points completed per sprint.

CDRL Delivery 9.0 All required reports and data deliverables are submitted on time and are accurate. AQL: 100% on-time delivery;

no more than one rejection per CDRL submission.

Cybersecurity & Information Assurance

5.2.1.3, 8.0

Maintain security posture with no incidents from contractor negligence. Remediate vulnerabilities per DoD directives (Critical: 14 days, High: 30 days, Medium: 90 days, Low: 180 days). AQL: 100% compliance.

Training & Logistics Support

5.2.4 All training events are conducted as scheduled, and all logistics deliverables are provided on time. AQL: 100% on-time delivery and execution.