Attachment 1_DRAFT PWS.pdf

PP

Program Executive Office for 2

Digital & Enterprise Services (PEO Digital) 3

Performance Work Statement For Base Area Network (BAN) Modernization

M67854-22-R-4911 10 March 2022

Prepared By:

United States Marine Corps

Program Executive Office, Digital and Enterprise Services

Infrastructure Services, Transport and Communications 17

PART 1 20

GENERAL INFORMATION 22

1. GENERAL 24

This is a multiple award, Indefinite Delivery/Indefinite Quantity (IDIQ) contract for the PEO 25 Digital Infrastructure Services Transport and Communication (ISTC) Program Office to 26 modernize and refresh the Marine Corps telecommunications and network infrastructure. This 27 IDIQ contract will also provide the ability to support individual equipment procurement 28 actions and future capabilities. 29 The services included in any task order (TO) will be non-personal services. The Government 31 shall not exercise any supervision or control over the contract service providers performing the 32 services herein. Such contract service providers shall be accountable solely to the Contractor 33 who, in turn is responsible to the Government. The Government will describe the specific 34 performance requirements at the task order level, but all work performed will fall within the 35 general scope described herein. 36

1.1 DESCRIPTION OF SERVICES/INTRODUCTION 38

The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, 39 materials, supervision, and other items and non-personal services necessary to perform the 40 refresh and/or modernization as defined in this PWS except for those items specified as 41 Government Furnished Property (GFP) and services at the task order level. The Contractor 42 shall perform to the standards articulated in this contract. 43

1.2 BACKGROUND 45

Traditionally, Marine Corps Systems Command (MCSC), ISTC Program Office (previously 46 known as the Network Communications Infrastructure) has been responsible for the upgrade 47 and expansion of the Marine Corps’ legacy Time Division Multiplexing (TDM) voice systems, 48 Synchronous Optical Network (SONET), and outside plant (OSP) cable infrastructure. These 49 previous efforts were typically executed via individual Firm Fixed Price (FFP) contracts. Due 50 to advancing technologies and increased requirements, the ISTC mission expanded to include 51 the complete modernization/replacement of all Low Speed Time Division Multiplexing 52 (LSTDM) technologies. More recently, the ISTC mission has expanded to include the 53 modernization of the Distribution and Access Layer Transport infrastructure to the End-user 54 Building (EUB). As a result, ISTC is now responsible for the modernization of the 55 telecommunication and network infrastructure at every Marine Corps Installation. 56 The USMC Network Modernization Plan V2.2, dated June 2021 established the framework to 58 transform the MCEN into a converged, multi-tenant local area networks to support coverage, 59 reliable, reconfigurable, resilient Base/Post/Camps/Stations (B/P/C/S) network. ISTC is 60 responsible for providing the transport and network infrastructure to enable communication 61 capability and capacity from the enterprise to the tactical edge across the Marine Corps 62 B/P/C/S. 63

1.3 OBJECTIVES 65

The objective of this contract is to reduce the procurement acquisition lead time, create the 66 flexibility to support multipleawards and projects, to promote selected multi-vendor, to 67 promote agility to implement material solutions in support of world-wide emerging 68 requirements and standardization. 69 The objectives of this initiative are to modernize and refresh the telecommunications and 71 network infrastructure on each Marine Corps Installation. This effort will include: 72

a. Replacement of equipment in accordance with the current baseline for refresh, and 73

b. Integration, testing, and fielding of Technology Readiness Level 9 (TRL-9) 74 capabilities. 75

1.4 SCOPE 77

The Contractor shall Engineer, Furnish, Install, Secure, and Test (EFIST) and make operational 78 the refreshed and modernized capabilities for the telecommunication and network 79 infrastructure at all required USMC B/P/C/S in accordance with (IAW) individual task orders. 80 The Contractor shall also provide all required equipment, labor, training, software, firmware, 82 licenses, and interfaces associated with these capabilities to deliver a complete solution. The 83 Contractor shall provide all supporting documentation associated with the delivered solution. 84

1.5 GENERAL INFORMATION 86

1.5.1 RECOGNIZED HOLIDAYS 88

The Contractor is not required to perform work or services on the Federal Government 89 holidays identified below. 90 New Year’s Day Labor Day 92 Martin Luther King Jr.’s Birthday Columbus Day 93 President’s Day Veteran’s Day 94 Memorial Day Thanksgiving Day 95 Independence Day Christmas Day 96 Juneteenth 97

1.5.2 WORK HOURS 99

Working hours for on-site Contractors shall be within the hours of 0700-1800 local time. No 100 overtime will be authorized. No work shall be performed at Government facilities when the 101 Government is closed. 102

1.5.3 PLACE OF PERFORMANCE 104

The work to be performed under this IDIQ contract will be performed at current or future U.S. 105 Marine Corps Contiguous United States (CONUS) and Outside Continental United States 106 (OCONUS) Installations and Detachments that include, but are not limited to, the following: 107

Marine Corps Base Camp Pendleton, CA** 109 Marine Corps Air Station Miramar, CA 110 Marine Corps Air Station Yuma, AZ 111 Marine Corps Logistics Base Barstow, CA 112 Marine Corps Air Ground Combat Center Twentynine Palms, CA 113 Marine Corps Mountain Warfare Training Center Bridgeport, CA 114 Marine Corps Recruit Depot San Diego, CA 115 Marine Corps Base Camp Lejeune, NC** 116 Marine Corps Air Station Cherry Point, NC 117 Marine Corps Air Station Beaufort, SC 118 Marine Corps Logistics Base Albany, GA 119 Marine Corps Support Facility Blount Island, FL 120 Marine Corps Recruit Depot Parris Island, SC 121 Marine Corps Base Quantico, VA** 122 Marine Corps Base Camp Butler, Okinawa, Japan** 123 Marine Corps Air Station Iwakuni, Japan 124 Marine Corps Installation Camp Mujuk, South Korea** 125 Marine Corps Base Hawaii, HI** 126 Marine Corps Detachment at any other geographically separate location to include Marine 127 Forces Reserve (MFR) 128 **Denotes the Regional Centers that are identified as Component Enterprise Data Centers (CEDC) in accordance 130 with the Joint Information Environment (JIE) Implementation Guide. All other Installations are designated as 131 Installation Service Nodes (ISN) or Special Purpose Processing Nodes (SPPN). 132

1.5.4 TYPE OF CONTRACT 134

The Government will award a multiple award FFP IDIQ contract with Individual FFP TOs 135 issued for specific work at specific Installations or locations. 136

1.5.5 PHYSICAL SECURITY 138

The Contractor shall be responsible for safeguarding all Government equipment, information 139 and property provided for Contractor use. At the close of each work period, Government 140 facilities, equipment, and materials shall be secured. 141

1.5.6 SECURITY REQUIREMENTS 143

The information provided to the Contractor will be unclassified and/or Controlled Unclassified 144 Information (CUI). Certain Contractors will be required to perform IT-I/II duties that require 145 favorably adjudicated Tier 5/3 Level investigations. The Defense Counterintelligence Security 146 Agency (DCSA) will not authorize contractors to submit the necessary Tier Level 147 investigations, solely in support of IT level designation requirements, without a valid classified 148 requirement as specified in a DD-254. This effort does not warrant a DD-254, therefore the 149 Government Contracting Activity Security Office (GCASO) is required to submit any required 150 investigations in support of IT level designations. The Contractor is required to provide a 151 roster of prospective Contractor employees performing IT Level II and/or IT Level I duties to 152 the MCSC Contracting Officer’s Representative (COR). This roster shall include: full names, 153 Social Security Numbers, IT Level required, e-mail address, and phone number for each 154 Contractor requiring investigations in support of IT Level designations. The COR will verify 155 the IT Level requirements and forward the roster to the GCASO. Contractors found to be 156 lacking required investigations will be contacted by the GCASO. 157 Facility Security Officers (FSOs) are responsible for notifying the Marine Corps Systems 159 Command (MCSC) AC/S G-2 Personnel Security Office (PERSEC Office) via encrypted e-160 mail to MCSC_Security@usmc.mil or 703-432-3374/3952 if any Contractor performing on 161 this contract receives an unfavorable adjudication. The FSO must also notify the PERSEC 162 Office, within 24 hours, of any adverse/derogatory information associated with the 13 163 Adjudicative Guidelines concerning any Contractor performing on this contract, if they have 164 been granted an IT designation, issued a CAC and/or a MCSC Building Badge. The FSO shall 165 notify the Government (written notice) within 24 hours of any Contractor personnel added or 166 removed from the contract that have been granted IT designations, issued a Common Access 167 Card (CAC) and/or a MCSC Building badge/access. 168

1.5.6.1 DEFENSE BIOMETRIC IDENTIFICATION (DBID) CARD 170

Certain Contractors may require the issuance of a DBID card in order to gain access to Marine 171 Corps Base/Post/Camps/Stations (B/P/C/S). The Contracting Officer Representative (COR) 172 will identify and approve only those Contractor personnel performing on this contract that 173 require a DBID card in order to perform their job function aboard the base. All contractor 174 personnel accessing Marine Corps Base Quantico and Marine Corps Systems Command must 175 be in compliance Access Control policy identified within MCSCO 5530.2A Access Control 176 Order. 177

1.5.6.2 CONTRACTOR SCREENING 179

The Contractor shall return a completed Contractor Screening Form, which will be provided as, 180 an attachment to the executed TO in order to identify all Contractor personnel requiring access 181 to Installations/Detachments, base facilities, and/or handling Government assets. This form 182 includes personal identification information for respective Contractor personnel and shall be 183 either: Hand delivered to the Installation Technical Support Officer (TSO) or sent in a 184 password protected document. If the vendor screening form is sent via email, the password 185 shall be provided and sent in a separate email. The Contractor shall provide a completed form 186 to the TSO no later than two (2) weeks prior to the start of work for processing and vetting by 187 the Installation/Detachment Security Office. The Security Office will respond with any 188 favorable or unfavorable screening outcomes as they are received from the Installation PMO. 189 Any personnel receiving an unfavorable outcome will not be authorized access to the 190 Installation for the purpose of performing work related to this contract. 191 All required escorts shall be provided by Base, G/S-6 staff. It is the Contractor’s responsibility 193 to secure any facility upon exiting the facility for which they are provided a key and unescorted 194 access. The Base, G/S-6 will exercise security supervision over all Contractor personnel 195 working on this project and will provide security support to the Contractor. The Contractor 196 shall comply with all emergency rules and procedures established for this Base. All personnel 197 aboard the Base are subject to random inspections of their vehicles, personal items, and of 198 themselves. Consent to these inspections is considered to have been given upon entrance to the 199 base and its facilities. Photography, videotaping, and/or audio recordings aboard the base are 200 strictly prohibited without proper authorization by the local Base authorities. 201

1.5.6.3 COMMON ACCESS CARD (CAC) 203

The COR will identify and only approve those contractor employees performing on this 205 contract that require a CAC in order to perform their job function. In accordance with 206 Headquarters, United States Marine Corps issued guidance relative to Homeland Security 207 Presidential Directive – 12 (HSPD-12), all personnel must meet eligibility criteria to be issued 208 a CAC. In order to meet the eligibility criteria, contractor employees requiring a CAC must 209 obtain and maintain a favorably adjudicated Personnel Security Investigation (PSI). Prior to 210 authorizing a CAC, the employee’s Defense Information System for Security (DISS) record 211 must indicate a completed and favorably adjudicated PSI or (at a minimum) that a PSI has 212 been submitted and accepted (opened). The minimum acceptable investigation is a T-1 or a 213 National Agency Check with Written Inquiries (NACI). If a contractor employee’s open 214 investigation closes and is not favorably adjudicated, the CAC must be immediately retrieved 215 and revoked. CACs are not issued for convenience. 216 Facility Security Officers (FSOs) are responsible for notifying the MCSC AC/S G-2 Personnel 218 Security Office (PERSEC Office) at 703-432-3490/3952 if any contractor performing on this 219 contract receives an unfavorable adjudication after being issued a CAC. Due to Insider Threat 220 concerns, the Company is requested to notify the MCSC AC/S G-2 Personnel Security Office 221 (PERSEC Office) at 703-432-3952/3490/3374, within 24 hours, of any adverse/derogatory 222 information associated with the 13 Adjudicative Guidelines concerning any contractor 223 performing on this contract, if they have been issued a CAC and/or a MCSC Building Badge. 224 Each CAC is issued with a “ctr@usmc.mil” e-mail account that the individual contractor is 226 responsible to maintain as active by logging in on a regular basis (at least twice a month), 227 sending an e-mail and clearing any unneeded e-mails. Contractors issued a CAC are 228 prohibited from “auto- forwarding” e-mail from their .mil e-mail account to their .com e-229 mail account. If the “ctr@usmc.mil” e-mail account is not kept active, G-6 will deactivate the 230 account and the CAC will also lose its functionality. Contractor employees shall solely use 231 their government furnished “ctr@usmc.mil” e-mail accounts for work supporting the USMC, 232 conducted in fulfillment of this contract, and shall not use a contractor supplied or personal e-233 mail account to conduct official U.S. government business. The use of a contractor or 234 personal e-mail account for contractor business or personal use is allowed, but only when 235 using cellular or a commercial internet service provider. 236 If a contractor loses their eligibility for a CAC due to an adverse adjudicative decision, they 238 have also lost their eligibility to perform on MCSC contracts. 239

1.5.6.4 MARINE CORPS ENTERPRISE NETWORK (MCEN) COMPUTER ACCESS 241

Contractor personnel accessing Marine Corps Systems Command Information Systems must 242 maintain compliance with United States Marine Corps Enterprise Cybersecurity Manual 007 243 Resource Access Guide. Contractor personnel will submit a DD 2875 and a completion 244 certificate for the CYBERC course located on MarineNet located at 245 https://www.marinenet.usmc.mil. The CYBERC course consist of the DOD Cyber 246 Awareness Challenge and the Department of the Navy Annual Privacy Training (PII). 247 mailto:ctr@usmc.mil mailto:ctr@usmc.mil mailto:ctr@usmc.mil http://www.marinenet.usmc.mil/ http://www.marinenet.usmc.mil/

Contractors will have to create a MarineNet account in order to complete the required 248 training. 249 MCEN IT resources, if provided, are designated for official use only and other limited 251 authorized purposes. DOD military, civilian personnel, consultants, and contractor personnel 252 performing duties on MCEN information systems may be assigned to one of three position 253 sensitivity designations. 254

1) ADP-I (IT-1): Favorably adjudicated T-5, T5R, (formerly known as 256 Single Scope Background Investigation (SSBI)/SSBI Periodic Reinvestigation 257 (SBPR)/SSBI Phased Periodic Reinvestigation (PPR)) 258

2) ADP-II (IT-2): Favorably adjudicated T-3, T3R, (formerly known as Access 260

National Agency Check and Inquiries (ANACI)/ National Agency Check with Law 261 and Credit (NACLC)/Secret Periodic Review (S-PR)) 262

3) ADP-III (IT-3): Completed T-1, (formerly known as National Agency Check 264 with Inquiries (NACI)) 265 Privileged users must maintain the baseline Cyberspace Workforce Information Assurance 267 Technical (IAT) or Information Assurance Manager (IAM) relating to the position being 268 filled. Privileged users are defined as anyone who has privileges over a standard user 269 account as in system administrators, developers, network administrators, code signing 270 specialist and Service Desk technicians. 271 All MCEN users must read, understand, and comply with policy and guidance to protect 273 classified national security information, Controlled Unclassified Information (CUI), and 274 prevent unauthorized disclosures in accordance with United States Marine Corps Enterprise 275 Cybersecurity Manual 007 Resource Access Guide and CJCSI 6510.01F. 276 MCEN Official E-mail usage – MCEN IT resources are provided for official government 278 use only and other limited authorized purposes. Authorized purposes may include 279 personal use within limitations as defined by the supervisor or the local Command. Auto 280 forwarding of e- mail from MCEN-N to commercial or private domains (e.g., Hotmail, 281 Yahoo, Gmail, etc.) is strictly prohibited. E-mail messages requiring either message 282 integrity or non-repudiation are digitally signed using DOD PKI. All e-mail containing 283 CUI, an attachment, or embedded active content must be digitally signed. 284 MCEN users will follow specific guidelines to safeguard CUI, which includes Personally 286 Identifiable Information (PII) and Health Insurance Portability and Accountability Act 287 (HIPAA) information. Non-official e-mail is not authorized for and will not be used to 288 transmit any CUI. Non-official e-mail is not authorized for official use unless under 289 specific situations where it is the only means for communication available to meet 290 operational requirements. This can occur when the official MCEN provided e-mail is not 291 available but must be approved prior to use by the Marine Corps Authorizing Official 292

(AO). 293

All personnel will use DOD authorized PKI certificates to encrypt e-mail messages if 295 they contain any of the following: 296

1) Controlled Unclassified Information (CUI). 298

2) Any contract sensitive information that normally would not be disclosed to 299 anyone other than the intended recipient as this is considered CUI. 300

3) Any privacy data, PII, or information intended for inclusion in an employee’s 301 personal file or any information that would fall under the tenets of MSGID: 302 DOC/5 USC 552A. Personal or commercial e-mail accounts are not 303 authorized to transmit CUI. 304

4) Any medical or health data, to include medical status or diagnosis concerning 305 another individual. 306

5) Any operational data regarding status, readiness, location, or deployment of 307 forces or equipment. 308

1.5.6.5 KEY CONTROL 310

The Contractor shall establish and implement methods of making sure all keys/key cards issued 311 to the Contractor by the Government are not lost or misplaced and are not used by 312 unauthorized persons. 313 NOTE: All references to keys include key cards. 315 No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall 317 develop procedures covering key control that shall be included in the Quality Control Plan 318 (QCP). Such procedures shall include turn-in of any issued keys by personnel who no longer 319 require access to locked areas. The Contractor shall immediately report any occurrences of lost 320 or duplicate keys/key cards to the Contracting Officer. 321 In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon 323 direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the 324 Government, at its option, may replace the affected lock or locks or perform re-keying. When 325 the replacement of locks or re-keying is performed by the Government, the total cost of re-326 keying or the replacement of the lock or locks shall be deducted from the next payment due to 327 the Contractor. In the event a master key is lost or duplicated, all locks and keys for that 328 system shall be replaced by the Government and the total cost deducted from the next payment 329 due to the Contractor. 330 The Contractor shall prohibit the use of Government issued keys/key cards by any persons 332 other than the Contractor’s employees. The Contractor shall prohibit the opening of locked 333 areas by Contractor employees to permit entrance of persons other than Contractor employees 334 engaged in the performance of assigned work in those areas, or personnel authorized entrance 335 by the Contracting Officer. 336

1.5.6.6 LOCK COMBINATIONS 338

The Contractor shall establish and implement methods of ensuring that all lock combinations 339 are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations 340 are changed when personnel having access to the combinations no longer have a need to know. 341 These procedures shall be included in the Contractor’s QCP. 342

1.5.7 POST AWARD CONFERENCE/PERIODIC MEETINGS 344

The Contractor agrees to attend a Post Award Conference (PAC) convened by the contracting 345 activity in accordance with Federal Acquisition Regulation (FAR) Subpart 42.5. The 346 Contracting Officer, COR, and other Government personnel, as appropriate, may meet 347 periodically with the Contractor to review the Contractor's performance. At these meetings the 348 Contracting Officer will apprise the Contractor of how the Government views the Contractor's 349 performance and the Contractor will apprise the Government of problems, if any, being 350 experienced. Meeting frequency shall be established by CDRLs Matrix and any additional 351 meetings to resolve any issues shall be at no additional cost to the Government. 352

1.5.8 CONTRACTING OFFICER’S REPRESENTATIVE 354

The COR(s) will be identified by separate letter(s) and monitors all technical aspects of the 355 contract and assists in contract administration. The COR(s) is/are authorized to perform the 356 following functions: assure that the Contractor performs the technical requirements of the 357 contract; perform inspections necessary in connection with contract performance; maintain 358 written and oral communications with the Contractor concerning technical aspects of the 359 contract; issue written interpretations of technical requirements, including Government 360 drawings, designs, specifications; monitor Contractor's performance and notify both the 361 Contracting Officer and Contractor of any deficiencies; coordinate availability of Government 362 Furnished Property (GFP); and provide site entry of Contractor personnel. The COR(s) is/are 363 not authorized to change any of the terms and conditions of the resulting order, especially any 364 terms that affect price, delivery schedule, or period of performance. 365

1.5.9 KEY PERSONNEL 367

The Contractor shall provide a Project Manager who shall be responsible for the performance 368 of the work. The name of this person and an alternate who shall act for the Contractor when 369 the manager is absent shall be designated in writing to the Contracting Officer. The Project 370 Manager or alternate shall have full authority to act for the Contractor on all contract matters 371 relating to daily operation of this contract. 372 The Project Manager or alternate shall be available between 0700 to 1800 Monday thru Friday 374 based on the time zone of the location/installation except Federal holidays or when the 375 Government facility is closed for administrative reasons. 376 Qualifications for all key personnel are listed in Table 1. 378

Table 1 - Key Personnel 380

1.5.10 IDENTIFICATION OF CONTRACTOR EMPLOYEES 383

All contract personnel attending meetings, answering Government telephones, and working in 384 any situations where their Contractor status is not obvious to third parties are required to 385 identify themselves as such to avoid creating an impression in the minds of members of the 386 public that they are Government officials. They must also ensure that all documents or reports 387 produced by Contractors are suitably marked as Contractor products or that Contractor 388 participation is appropriately disclosed. Contractors shall obtain visitor badges in accordance 389 with local Installation security policy. 390

1.5.11 CONTRACTOR TRAVEL 392

The Contractor shall be required to travel within CONUS and OCONUS during the 393 performance of this contract. The Contractor may be required to travel to off-site training 394 locations and to ship training aids to these locations in support of this PWS. Contractor may be 395 authorized travel expenses consistent with the substantive provisions of the FAR 31.205-46, 396 Travel Costs, and the limitation of funds specified in each TO. All travel requires prior 397 Government approval/authorization by the COR(s). 398

1.5.12 ORGANIZATIONAL CONFLICT OF INTEREST 400

To the extent that the work under this contract requires access to proprietary, business 401 confidential, or financial data of other companies, and as long as these data remain proprietary 402 or confidential, the Contractor shall protect the data from unauthorized use and disclosure and 403 agrees not to use it to compete with those other companies. 404

(a) “Organizational Conflict of Interest” means that because of other activities or 406 relationships with other persons, a person is unable or potentially unable to render impartial 407 assistance or advice to the Government, or the person’s objectivity in performing the contract 408

Key Personnel Certifications Experience Skill Project Phase

Project Manager Certified PMP or equivalent experience

7 Years Project Management

Proven leadership, management, and organizational skills

Site Survey Engineering

Implementation

On-Site Project Manager Certified PMP or equivalent experience

7 Years Project Management

Proven leadership, management, and supervisory skills

Site Survey Engineering

Implementation

Quality Control / Quality Assurance Manager

BICSI Installer Certified 7 years QC/QA Management

Proven telecommunications quality management skills

Engineering Implementation

Lead Systems Engineer (LSE) BS Science/Engineering 10 Years Engineering Discipline

Licensed Professional Engineer (PE)

Site Survey Engineering

Implementation

Network / Telecommunications Engineer

Registered Communications Distriution Design (RCDD)

10 Years Network / Telecommunications

Proven telecommunications design and installation skills

Site Survey Engineering

Implementation

Logistician Certified Professional Logistician

5 Years Logistics Management

Proven leadership, management, and organizational skills

Site Survey Engineering

Implementation work is or might be otherwise impaired, or a person has an unfair competitive advantage. 409 “Person” as used herein includes corporations, partnerships, joint ventures, and other business 410 enterprises. 411

(b) The Contractor warrants that to the best of its knowledge and belief, and except as 413 otherwise set forth in the contract, the Contractor does not have any organizational conflict of 414 interest(s) as defined in paragraph (a). 415

(c) It is recognized that the effort to be performed by the Contractor under this contract 417 may create a potential organizational conflict of interest on the instant contract or on a future 418 acquisition. In order to avoid potential conflict of interest, and at the same time to avoid 419 prejudicing the best interest of the Government, the right of the Contractor to participate in 420 future procurement of equipment and/or services that are the subject of any work under this 421 contract shall be limited as described below in accordance with the requirements of FAR 422 Subpart 9.5. 423

(d) The Contractor agrees: 425

(1) That it shall not release, disclose, or use in any way that would permit or result in 427 disclosure to any party outside the Government any information provided to the Contractor by 428 the Government during or as a result of performance of this contract. Such information 429 includes, but is not limited to, information submitted to the Government on confidential basis 430 by other persons. Further, the prohibition against release of Government provided information 431 extends to cover such information whether or not in its original form, e.g., where the 432 information has been included in Contractor generated work or where it is discernible from 433 materials incorporating or based upon such information. This prohibition shall not expire after 434 a given period of time. See, Defense Federal Acquisition Regulation Supplement (DFARS) 435 252.204-7000, Disclosure of Information, included in the contract. 436

(2) The Contractor agrees that it shall not release, disclose, or use in any way that 438 would permit or result in disclosure or any party outside the Government any information 439 generated or derived during or as a result of performance of this contract. 440

(3) The prohibitions contained in subparagraphs (d)(1) and (d)(2) shall apply with equal 442 force to any affiliate of the Contractor, any sub-Contractor, consultant, or employee of the 443 Contractor, any joint venture involving the Contractor, any entity into or with which it may 444 merge or affiliate, or any successor or assign of the Contractor. The terms of paragraph (f) of 445 the Special Contractor Requirement relating to notification shall apply to any release of 446 information in contravention of this paragraph (d). 447

(e) The Contractor further agrees that during the performance of this contract and for a 449 period of three years after completion of performance of this contract, the Contractor; any 450 affiliate of the Contractor; any sub-Contractor, consultant, or employee of the Contractor; any 451 joint venture involving the Contractor; any entity into or with which it may subsequently 452 merge or affiliate; or any other successor or assign of the Contractor, shall not furnish to the 453 Marine Corps, either as a prime Contractor or as a sub-Contractor, or as a consultant to a prime 454 Contractor or as a sub-Contractor, any system, component or services which is the subject of 455 the work to be performed under this contract. This exclusion does not apply to any re-456 competition for those systems, components, or services on the basis of work statements 457 growing out of the effort performed under this contract, developed from a source other than the 458 Contractor, sub-Contractor affiliate, or assign of either. During the course of performance of 459 this contract or before the three-year period following completion of this contract has lapsed, 460 the Contractor may, with the authorization of the cognizant contracting officer, participate in a 461 subsequent procurement for the same system, component, or service. In other words, the 462 Contractor may be authorized to compete for procurement(s) for systems, components or 463 services subsequent to an intervening procurement. 464

(f) The Contractor agrees that, if after award, it discovers an actual or potential 466 organizational conflict of interest; it shall make immediate and full disclosure in writing to the 467 contracting officer. The notification shall include a description of the actual or potential 468 organizational conflict of interest, a description of the action, which the Contractor has taken or 469 proposes to take to avoid, mitigate, or neutralize the conflict, and any other relevant 470 information that would assist the contracting officer in making a determination on this matter. 471 Notwithstanding this notification, the Government may terminate the contract for the 472 convenience of the Government if determined to be in the best interest of the Government. 473

(g) Notwithstanding paragraph (f) above, if the Contractor was aware, or should have been 475 aware, of an organizational conflict of interest prior to the award of this contract or becomes, 476 or should become aware of an organizational conflict of interest after award of this contract 477 and does not make an immediate and full disclosure in writing to the contracting officer, the 478 Government may terminate this contract for default. 479

(h) If the contactor takes any action prohibited by this requirement or fails to take action 481 required by this requirement, the Government may terminate this contract by default. 482

(i) The contracting officer's decision as to the existence or nonexistence of the actual or 484 potential organization conflict of interest shall be final and is not subject to the clause of this 485 contract entitled "DISPUTES" (FAR 52.233.1). 486

(j) Nothing in this requirement is intended to prohibit or preclude the Contractor from 488 marketing or selling to the United States Government its product lines in existence on the 489 effective date of this contract; nor, shall this requirement preclude the Contractor from 490 participating in any research and development. Additionally, sale of catalog or standard 491 commercial items are exempt from this requirement. 492

(k) The Contractor shall promptly notify the contracting officer, in writing, if it has been 494 tasked to evaluate or advise the Government concerning its own products or activities or those 495 of a competitor in order to ensure proper safeguards exist to guarantee objectivity and to 496 protect the Government's interest. 497

(l) The Contractor shall include this requirement in subcontracts of any tier which involve 499 access to information or situations/conditions covered by the preceding paragraphs, 500 substituting "sub-Contractor" for "contactor" where appropriate. 501

(m) The rights and remedies described herein shall not be exclusive and are in addition to 503 other rights and remedies provided by law or elsewhere included in this contract.5.4. 504 Proprietary Information Exchange Agreement (PIEA)/Non-Disclosure Agreements (NDA). 505 The Contractor shall arrange the signature on all PIEA/non-disclosure agreements necessary to 506 interface with other Contractors to accomplish the contract requirements in accordance with 507 FAR 9.505-4 prior to beginning any efforts associated with this PWS. Copies of all non-508 disclosure agreements required for this contract shall be provided to the Contracting Officer 509 and COR. 510

1.5.13 SYSTEM SECURITY PLAN 512

1. System Security Plan (SSP) and Plans of Action and Milestones (SSP/POA&M) 513 Reviews: 514

a) Within thirty (30) calendar days of contract award, the Contractor shall make its 515 SSP(s) for its covered Contractor information system(s) available for review by the 516 Government at the Contractor s facility. The SSP(s) shall implement the security requirements 517 in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which 518 is included in this contract. The Contractor shall fully cooperate in the Government s review of 519 the SSPs at the Contractor’s facility. 520

b) If the Government determines that the SSP(s) does not adequately implement the 521 requirements of DFARS clause 252.204-7012 then the Government will notify the Contractor 522 of each identified deficiency. The Contractor shall correct any identified deficiencies within 523 thirty (30) calendar days of notification by the Government. The contracting officer may 524 provide for a correction period longer than thirty (30) calendar days and, in such a case, may 525 require the Contractor to submit a plan of action and milestones (POA&M) for the correction 526 of the identified deficiencies. The Contractor shall immediately (within twenty-four (24) hours) 527 notify the contracting officer of any failure or anticipated failure to meet a milestone in such a 528

POA&M. 529

c) Upon the conclusion of the correction period, the Government may conduct a follow-530 on review of the SSP(s) at the Contractor s facilities. The Government may continue to conduct 531 follow-on reviews until the Government determines that the Contractor has corrected all 532 identified deficiencies in the SSP(s). 533

d) The Government may, in its sole discretion, conduct subsequent reviews at the 534 Contractor’s site to verify the information in the SSP(s). The Government will conduct such 535 reviews at least every three (3) years (measured from the date of contract award) and may 536 conduct such reviews at any time upon thirty (30) calendar days’ notice to the Contractor. 537

2. Compliance to NIST 800-171 539

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) 541 and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 542 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-543 171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered Contractor 544 information systems affecting this contract. 545 Notwithstanding the allowance for such variation, the Contractor shall identify in any SSP and 547 POA&M their plans to implement the following, at a minimum: 548

(i) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-549 factor authentication is required for all users, privileged and unprivileged accounts 550 that log into a network. In other words, any system that is not standalone should be 551 required to utilize acceptable multi-factor authentication. For legacy systems and 552 systems that cannot support this requirement, such as CNC equipment, etc., a 553 combination of physical and logical protections acceptable to the Government may be 554 substituted; 555

(ii) Implement Control 3.1.5 (least privilege) and associated Controls, and identify 556 practices that the Contractor implements to restrict the unnecessary sharing with, or 557 flow of, covered defense information to its sub-Contractors, suppliers, or Contractors 558 based on need-to-know principles; 559

(iii) Implement Control 3.1.12 (monitoring and control remote access sessions) - 560 Require monitoring and controlling of remote access sessions and include 561 mechanisms to audit the sessions and methods. 562

(iv) Audit user privileges on at least an annual basis; 563

(v) Implement: 564

a. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA 565 or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or 566 compensating controls as documented in a SSP and POAM); and, 567

b. NIST Cryptographic Algorithm Validation Program (CAVP) (see 568 https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program); 569

(vi) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide 570 a POAM for implementation which shall be evaluated by the Navy for risk 571 acceptance. 572

(vii) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of 573 action for implementation which can be evaluated by the Government Program 574 Manager for risk to the program. 575

3. Cyber Incident Response: 576

a) The Contractor shall, within fifteen (15) calendar days of discovering the cyber 577 incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the 578 contract that the Contractor determines is impacted by the incident and begin assessment of 579 potential warfighter/program impact. 580

b) Incident data shall be delivered in accordance with the Department of Defense Cyber 581 Crimes Center (DC3) Instructions for Submitting Media available at 582 http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx. In 583 delivery of the incident data, the Contractor shall, to the extent practical, remove Contractor-584 owned information from Government covered defense information. 585

c) If the Contractor subsequently identifies any such data not previously delivered to 586 DC3, then the Contractor shall immediately notify the contracting officer in writing and shall 587 deliver the incident data within ten (10) calendar days of identification. In such a case, the 588 Contractor may request a delivery date later than ten (10) calendar days after identification. 589 The contracting officer will approve or disapprove the request after coordination with DC3. 590

4. Naval Criminal Investigative Service (NCIS) Outreach 592

The Contractor shall engage with NCIS industry outreach efforts and consider 594 recommendations for hardening of covered Contractor information systems affecting DON 595 programs and technologies. 596

5. NCIS/Industry Monitoring 598

a) In the event of a cyber-incident or at any time the Government has indication of a 599 vulnerability or potential vulnerability, the Contractor shall cooperate with NCIS, which may 600 include cooperation related to: threat indicators; pre-determined incident information derived 601 from the Contractor's infrastructure systems; and the continuous provision of all Contractor, 602 sub-Contractor or Contractor logs that show network activity, including any additional logs the 603 Contractor, sub-Contractor or Contractor agrees to initiate as a result of the cyber incident or 604 notice of actual or potential vulnerability. 605

b) If the Government determines that the collection of all logs does not adequately 606 protect its interests, the Contractor and NCIS will work together to implement additional 607 measures, which may include allowing the installation of an appropriate network device that is 608 owned and maintained by NCIS, on the Contractor's information systems or information 609 technology assets. The specific details (e.g., type of device, type of data gathered, monitoring 610 period) regarding the installation of an NCIS network device shall be the subject of a separate 611 agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may 612 install network sensor capabilities or a network monitoring service, either of which must be 613 reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject 614 of a separate agreement negotiated between NCIS and the Contractor. 615

c) In all cases, the collection or provision of data and any activities associated with this 616 PWS shall be in accordance with federal, state, and non-US law. 617

1.5.14 OPERATIONS SECURITY (OPSEC) 619

1.5.14.1 GENERAL CONTRACTOR OPSEC REQUIREMENTS 621

1. During the course of this contract, in addition to those restrictions, instructions and 622 guidelines delineated in the contract PWS, Deliverables Table, and/or other references 623 provided, the Contractor will adhere to the following minimum requirements in support of 624 Program Executive Office Digital Enterprise Services Installation Services Transport and 625 Communications (PEO-DES ISTC) OPSEC Program: 626

a) Introduction of personnel electronic devices into Government spaces, laptops, tablet 628

PCs, cellular phones, cameras, recording devices, and data recording/storage devices is 629 STRICTLY controlled and forbidden in most cases. Company issued equipment required for 630 the performance of work must be approved by the PEO-DES ISTC and/or Government 631 Security Officer. Photography and recording is not allowed except for official use and by 632 permit only. (Unless otherwise stipulated in the contract, contact the Installation Security 633 Officer for approval.) Photographs will be reviewed by Security to ensure sensitive and/or 634 classified information is not revealed. 635

b) Contractor personnel shall not discuss Government operations in public or over 637 unprotected or unencrypted communications. Official Business, controlled unclassified 638 information may only be transmitted as directed in the PWS. 639

c) The Contractor shall not post to company websites, publications, newsletters or 641 other media any images, data or information that reveal sensitive Government operations, 642 personnel, equipment, and/or classified or controlled unclassified information, refer to 643 paragraph (d) below. When in doubt, company press releases related to this contract should be 644 coordinated through the COR or Technical Point of Contact, as applicable. 645

d) Because observation of events, operations, physical changes, etc. may reveal 647

National Security information, specific restrictions are needed to preclude unintentional 648 release of this information to unauthorized parties. (Unauthorized disclosure and transfer of 649 National Security Information is punishable under 18 USC § 793.) Therefore, Contractor 650 personnel shall not disclose to unauthorized third parties, post to unofficial sites (including 651 Social Networking sites) any images, data or information, or observed events that reveal 652 sensitive Government operations, personnel, equipment, including, but not limited to: 653

i) Tactics, techniques and procedures (TTPs), production or work schedules, any 655 visible or concealed modifications, upgrades, additions to vessels, aircraft, or weapons or 656 equipment; increases, change, or decreases in work/deployment frequency or Government 657 personnel, vehicle, vessel or aircraft movements; specialized equipment orders, deliveries, 658 shipments, etc. Unauthorized disclosures and attempts to solicit this type of information by 659 unauthorized third parties or others not affiliated with this contract shall be reported to the 660 PEO-DES ISTC and/or installation Security Office, contract point of contact, and your 661 company FSO and/or the Defense Security Service. Non-Disclosure requirements remain in 662 effect during the duration of this contract and indefinitely thereafter. 663

e) Government issued badges, identification shall be removed and/or concealed from 665 plain sight when off station and shall not be left in vehicles or unprotected. Badges and passes 666 may not be duplicated or copied or loaned to others. Lost or stolen identification badges, 667 vehicle passes etc. will be immediately reported to the PEO-DES ISTC and/or installation 668 Security Office. 669

f) Practice OPSEC and implement countermeasures to protect Critical Information 671

(CI) and other sensitive unclassified information and execution of military operations 672 performed or supported by the contractor in support of the mission. Protection of CI will 673 include the adherence to and execution of countermeasures which the contractor initiates or as 674 provided by PEO-DES ISTC, for CI on or related to the PWS. 675

g) It is strongly recommended the Contractor mark and protect related internal 677 production schedules, deliverables, inventories and shortages and identified vulnerabilities 678 related to production of Government material. Internal company markings e.g., Business 679 Sensitive, etc., are appropriate for identifying the aforementioned as sensitive information. 680 Specific Government-provided information, drawings etc., will be protected in accordance with 681 guidance in applicable paragraphs of the PWS and clauses included in the solicitation/contract. 682

h) All Government information must be destroyed at contract termination or returned 684 to the Government at the Government’s discretion. 685

2) Permanent Onsite Contractors: Where a contract includes permanent/embedded contract 687 personnel at PEO-DES ISTC facilities, these additional requirements apply: 688

a) Assign an OPSEC Point of Contact (POC) for this contract (this maybe the FSO or 690 company security manager or site manager). 691

b) OPSEC Awareness Education and Training will be provided or coordinated through 693

Government channels (PEO-DES ISTC OPSEC Program, IOSS, etc.) as an expense within the 694 Cost Management Process when developing a project bid. All personnel supporting the 695 contract will receive initial OPSEC awareness training and annual OPSEC Refresher training. 696 Contact the PEO-DES ISTC Operations Security Officer to assist in this requirement. 697

c) CI listed below and that listed in the PEO-DES ISTC Command Critical 699 Information List (CIL) or additional information identified PEO-DES ISTC or the contract 700 COR will be marked and handled appropriately as FOR OFFICIAL USE ONLY (FOUO) or 701 other required marking in accordance with guidance in applicable paragraphs of the 702 SOW/PWS and solicitation/contract clauses. Government CI includes but is not limited to: 703 known or probable vulnerabilities to any U.S. system and their direct support systems, details 704 of information about military operations, unit, vessel, aircraft movements/arrivals, missions 705 and exercises, etc. 706

d) An applicable list of PEO-DES ISTC CI will be provided to the Contractor site 708 manager (if assigned) by the Keyport OPSEC Officer upon award of the contract. Questions 709 regarding CI shall be directed toward the PEO-DES ISTC OPSEC Program Manager. 710

e) OPSEC requirements are additional to the requirements of the NISPOM. 712

3) OPSEC Training Requirements. 714

4) Where a contract requires long term access to PEO-DES ISTC facilities or other 716 Government facilities, such as embedded Contractors or participates in our operations, they 717 must follow the provisions of the PEO-DES ISTC OPSEC Instruction, to include training and 718 awareness. 719

5) Initial training may be provided by computer-based training, live training or a combination 721 of both. 722

6) OPSEC training is required initially within 30 days of assignment and annually thereafter. 724

7) The Contractor is required to…