M67854-26-I-0202

Section C - Descriptions and Specifications

DRAFT PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT

FOR

PORTFOLIO ACQUISITION EXECUTIVE - MARINE CORPS

GROUND COMBAT VEHICLE TESTING, RESEARCH AND DEVELOPMENT

C.1 SCOPE

This Performance Work Statement (PWS) documents the general types of work to be performed by the Contractor under each task order issued against this Basic Ordering Agreement (BOA). The task orders may include work in the following areas: prototype development, testing, technical support, systems engineering, program management, and logistical support for ground vehicle systems within Portfolio Acquisition Executive - Marine Corps (PAE-MC) and other Department of Defense agencies to include Special Operations Commands (SOCOM) of the Army, Air Force, Navy and Marine Corps of the United States Armed Forces.

C.2 BACKGROUND

Program Managers within PAE-MC are responsible for the evaluation of emerging ground vehicle technologies, testing of candidate commercial and military ground vehicle systems, and the conduct of engineering efforts to support the life cycle management of ground vehicles. Standard engineering and testing, services along with the associated test courses, facilities, ranges, and instrumentation must be available to support the Program Managers.

This PWS identifies the work, including, but not limited to, engineering design support and testing that must be provided in order for Program Managers within PAE-MC to succeed in developing the best ground vehicle capabilities for the Marine Corps and to assist other Department of Defense agencies in attaining the same success.

C.3 APPLICABLE DOCUMENTS

The documents specified below form a part of this PWS to the extent specified herein. The most recent revision of the referenced document at the time of task order award shall be used unless otherwise specified. In the event of a conflict between the applicable documents and this PWS, the PWS shall take precedence. All second tier and below references cited in mandatory compliance documents shall be considered as guidance only. Nothing in this document, however, supersedes applicable laws and regulations unless a specific exemption has been obtained.

3.1 MILITARY STANDARDS AND SPECIFICATION – MANDATORY COMPLIANCE

MIL-STD-To be identified in each task order as applicable.

Unless otherwise indicated, copies of specifications, standards, and handbooks are available in person from the Standardization Document Order Desk, 7000 Robbins Avenue, Bldg. 4D, Philadelphia, PA or online at https://www.dsp.dla.mil/Specs-Standards/Access-DSP-Documents/.

3.2 NON-GOVERNMENT DOCUMENTS

To be identified in each task order as applicable.

3.3 OTHER GOVERNMENT DOCUMENTS, DRAWINGS AND PUBLICATIONS

To be identified in each task order as applicable.

C.4 REQUIREMENTS

The following applies to all task orders placed against this BOA:

https://www.dsp.dla.mil/Specs-Standards/Access-DSP-Documents/

4.1 PROGRAM MANAGEMENT

The Contractor shall identify a designated Program Manager (PM)/Test Director (TD) to serve as the principal representative of the Contractor throughout the performance of each task order. The PM/TD shall organize, plan, schedule, implement, control, analyze, and report on all elements of the task order to the Government. The Contractor’s PM/TD shall be prepared at all times to present and discuss the status of the contract activities, requirements, and issues with the Contracting Officer and the Contracting Officer’s Representative (COR). The PM/TD shall coordinate all conferences and meetings with the Government and shall have the responsibility for ensuring overall contract performance.

The Contractor shall establish and maintain a program management team to support the Contractor’s TD with efficient administration and effective supervision of the efforts under each order. The Contractor shall provide personnel with the commensurate analytical, maintenance, operational, and technical skills to perform the requirements of the task order and to complete the required assignments to meet the performance objectives at the established cost or price.

4.1.1 PROJECT PLANNING, INITIATION, EXECUTION, MONITORING AND CONTROL

Performance of the work under this contract is subject to written task orders issued by the Procuring Contracting Officer. The Contractor shall not perform any work under this contract that is not covered by an executed task order.

Any Contractor work performed without proper authorization shall be at the sole risk of the Contractor.

The Contractor shall use a structured program management approach to perform authorized tasks under each task order placed against this BOA. The structured program management approach comprises the following phases: (1) Task/Project Planning; (2) Task/Project Initiation; (3) Task/Project Execution; (4) Task/Project Monitoring and Control; and (5) Task/Project Closeout.

When the Government desires to open an engineering task/project under this contract, the Contracting Officer will issue a formal not-to-exceed task order request for proposal requesting the Contractor to develop a task/project proposal. The Contractor shall provide - at a minimum - the following in its task/project proposal:

1) Technical approach to perform the task- the technical approach shall identify:

a. Task Outcomes:

i. Desired Task Outcomes

ii. Required Task Outcomes

b. Proposed Period of Performance with task initiation and completion dates

c. Technical approach to fulfill and satisfy task requirements

d. Resources - internal and subcontractor - required to perform the task

e. Schedule:

i. Plan of Action and Milestones (POA&M) that includes the planning, initiation (including task ramp-up), execution, and close out phases of the task/project

ii. Defined milestone gates for each task/project's phases

iii. Exit criteria for completion of each task/project phase

f. Contractor /Government roles and responsibilities

g. Government Furnished Information/Property required to perform task/project:

i. Government Furnished Information (GFI)

ii. Government Furnished Property (GFP)

iii. Need dates for GFP and GFI

h. Proposed Not-To-Exceed Cost for task/project:

i. Estimated Labor Hours

ii. Burdened Labor Cost

iii. Burdened Material

iv. Fixed Fee

2) Basis of estimate for each task/project phase with supporting data:

The Contracting Officer will use the information provided in the Contractor's task/project proposal to negotiate the not-to-exceed cost or price, schedule and performance parameters for task efforts with the Contractor. Upon completion of negotiation, the Contracting Officer will issue a task order to the Contractor for performance. The Contractor shall complete authorized assignments in a manner that thoroughly fulfills task order performance objectives within established schedule requirements and established cost controls. The Contractor shall provide personnel with the commensurate analytical and technical skills, material, facilities and other necessary resources to perform task order requirements.

4.2 TECHNICAL REPRESENTATIVE TASKS

Performance of the work under each task order is subject to written directions issued by the Contracting Officer. The Contractor shall not perform any work that is not covered by a task order from the Contracting Officer.

4.2.1 VEHICLE TESTING

As stated in each task order, the Contractor shall conduct ground vehicle testing over natural and man-made terrain profiles and under climatic conditions consistent with those encountered during Marine Corps operations worldwide and based on the Marine Corps Operational Mission Profile with a defined roughness and obstacles as depicted in Attachment 2. The Contractor shall develop test plans, test criteria, and provide test operating procedures. Vehicle testing may include:

a. Accelerated Life

b. Durability testing over natural terrain profiles representative of the Marine Corps Mission Profile

c. Electromagnetic Interference testing

d. Federal Motor Vehicle Safety Standards testing

e. Ground Vehicle testing

f. Vehicle Dynamics

g. Terrain Profiling

h. Tire testing

i. Digital Twin Development and Virtual Proving Ground Testing

j. Performance/Mobility testing to include, but not limited to:

- Soft soil (coarse and fine grain) testing

- Coarse grain sand slope testing over naturally occurring sand dunes up to 60% slopes with less than 1% moisture content

- Tractive effort testing (Drawbar Pull) on mud, sand and pavement

- Low coherence natural terrain profiles with Root Mean Square values ranging from 1.0-5.0

- Vehicle Cone Index

- Ascending/Descending Longitudinal Grades up to 60%

- Traversing side slopes up to 40% in a sinusoidal maneuver on natural occurring terrain

k. Reliability, Availability, and Maintainability over natural terrain profiles representative of the Marine Corps Mission Profile

l. Acceleration and Braking to include Mountain Descent Braking down 6% - 9% grades

m. Transportability and interoperability testing

n. Corrosion, Environmental, and Shock and Vibration testing

o. Fording and Deep water swimming testing

p. Rollover and stability and other non-Federal Motor Vehicle Safety Standards tests

q. Weapons/Lethality testing

r. Characteristics (examples: Center of Gravity, vehicle weights)

s. Survivability, under body blast, human factors, signature management, and ballistic vulnerability testing

t. Vehicle Occupancy Protection testing

u. Amphibious vehicle swim testing including land/water transition, littoral conditions, and launch/recovery from watercraft

v. Fuel Efficiency testing over natural terrain profiles representative of the Marine Corps Mission Profile

w. Full Load and Road Load Cooling testing

x. Steering and handling/safety testing including North Atlantic Treaty Organization Lane Change on pavement and gravel surfaces

y. Support in the conduct of on-site Operational Testing Events including driver training and instruction development

z. Attending Government and/or OEM on-site or off-site equipment orientation or training.

As required by task orders placed under the BOA, the Contractor shall provide engineering support for testing. Such support may include the following:

a. Engineering and technical assessments of operational safety issues and test failures

b. Review and recommendations related to prime Contractor responses to test incident reports

c. Engineering and technical recommendations for correction of test related issues

d. Preparation of documentation of test results (test reports, test incident reports, etc.)

e. Modeling & simulation, including mobility modeling and other computer based simulations of vehicle and test events

f. Development and application of test related instrumentation

g. Other engineering support to include Engineering Change Proposal (ECP)/Technical Data Package

(TDP) development, vehicle and subsystem prototype design, modeling, fabrication and testing

h. Industry days and technical rodeos/demonstrations

i. Expeditionary testing and engineering support for CONUS/OCONUS activities

j. Accident reconstruction and subject matter expertise for urgent need responses

The Contractor shall complete authorized performance in a manner that completely fulfills performance objectives within established schedule requirements and established cost controls as stated within each task order. The Contractor shall prepare and submit a Test Plan and Test Report in accordance with specific task order parameters.

4.2.2 TEST PLANS AND TEST REPORTS

The Contractor shall prepare and submit a Test Plan no less than thirty (30) calendar days prior to start of testing.

The Government will review and respond or approve the test plan within fifteen (15) calendar days and compare the Test Plan for conformance with specific Order parameters. Contractor test reports shall also document test results and lessons learned from the test event. The Contractor shall deliver Test Report Contract Data Requirements Lists (CDRLs) to the Government for review and approval within thirty (30) calendar days after test completion unless otherwise stated in individual order. CDRLs will be identified at the Order level.

4.3 TECHNICAL SUPPORT: The technical services delivered by the Contractor shall be as stated in each task order.

4.3.1 DATA COLLECTION

The Contractor shall provide and install vehicle instrumentation to monitor vehicle Controller Area Network (CAN) bus messages, Acceleration, Shock, Vibrations, Power, Speed, Temperature, Flow, Pressure, Force/Torque, Stress Analysis, Sound, Light, Displacement/Proximity, Global Positioning System tracking, Toxic Gas, Electrical Power Loads, Electrical Properties and Parameters as required in each task order. The Contractor shall provide and install vehicle instrumentation required to obtain data for model parameters and to verify modeling and simulation predictions.

4.3.2 DATA ANALYSIS

The Contractor shall perform data analysis of test results to include all time- and frequency-domain statistics, spectral analysis, digital filtering, transfer functions, and model predictions. The Contractor shall provide a variety of capabilities to transfer data in current, standard industry computer formats, including Microsoft 365 (M365) compatible Excel spreadsheet (e.g., .xlsx).

4.3.3 FAILURE ANALYSIS

The Contractor shall deliver Test Incident Reports that identify component or system failures or incidents. The Contractor shall conduct a failure analysis to determine root cause and deliver the necessary engineering assessment to develop and recommend corrective actions.

4.3.4 FINAL SCIENTIFIC AND TECHNICAL REPORTS

The Contractor shall prepare and deliver a final scientific and technical status report of specific order. The final report shall summarize the work completed; the contract tasks not completed and significant accomplishments, problems or delays. The report shall include a thorough description of what specific approaches/procedures have been used in the test project, the status of on-going studies if any, and studies completed during testing and the analysis and impact on the program. This report shall also offer recommendations on what strategies/approaches might be considered for future development.

4.4 MODELING & SIMULATION: The Contractor shall perform modeling and simulation services as stated in each task order.

4.4.1 MODEL DEVELOPMENT / UPDATE

The Contractor shall develop and maintain a 3D multi-body physics-based model (e.g. Automated Dynamics Analysis of Mechanical Systems (ADAMS) or compatible) of the vehicle under test. The Contractor shall develop and maintain a kinematic (e.g. ADAMS or compatible) model of the vehicle under development, test, or other mission profile representative events that may be studied as part of the development activity for the vehicle of interest. This includes but is not limited to: blast, hydrostatics/hydrodynamics, thermal, computational fluid dynamics, route planning, and other associated models relevant to the vehicle's environment or mission. The Contractor shall provide vehicle simulations corresponding to each test event conducted for the Government, including model predictions compared to measured test data in accordance with specific task order parameters. The Contractor shall deliver the computer models in native computer-aided design (CAD) format. All models become property of the Government.

4.4.2 SIMULATION STUDIES

The Contractor shall conduct simulations using the model to support evaluations of vehicle configuration changes, technology upgrades, or to quantify vehicle safety limitations. All simulation studies conducted by the Contractor shall include the complete model as a deliverable to the Government. The model delivered by the Contractor shall include all input data necessary for the Government to independently reproduce the same simulation results. All models become property of the Government.

4.5 SYSTEMS ENGINEERING: The Contractor shall perform systems engineering services as stated in each task order.

4.5.1 REQUIREMENTS DEVELOPMENT

The Contractor shall provide systems engineering services to derive performance requirements and identify threshold performance values for legacy and future developmental ground vehicles and subsystems utilizing alternative fuels, onboard power sources, fuel efficiency upgrades, advance suspension components or other emerging technologies.

4.5.2 DESIGN

The Contractor shall provide mechanical, electrical, and software engineering design, analysis, fabrication, procurement, integration, and sustainment support services. These services may include material and component procurement; system, subsystem, and vehicle integration; development, fabrication, installation, modification, and testing of prototype and production-representative hardware and software; implementation of minor and major corrective actions for components, subsystems, and systems identified through testing or operational assessments;

and integration of prototype components or subsystems on vehicles to evaluate technology demonstrations, capability enhancements, and potential Engineering Change Proposals (ECPs). The Contractor shall also develop and deliver associated technical data packages (TDPs), engineering analyses, ECP documentation, installation instructions, logistics product data, provisioning information, configuration management documentation, and other technical artifacts necessary to support implementation, fielding, sustainment, and lifecycle management of the resulting designs.

4.5.3 TRADE STUDIES

The Contractor shall perform market research, trade studies, and engineering analyses to evaluate legacy, developmental, commercial, and emerging vehicle systems, subsystems, technologies, and capabilities. Such efforts may include assessments of vehicle performance, mobility, survivability, transportability, reliability, maintainability, sustainability, interoperability, human systems integration, safety, power generation and distribution, autonomy, communications, and other operational or technical characteristics.

Trade studies may evaluate performance under varying payloads, tire conditions, inflation settings, ground conditions, environmental conditions, mission profiles, operational concepts, and other factors identified during requirements development, system design, engineering analyses, testing, or operational assessments. The Contractor may conduct full-system or subsystem combinatorial trade studies, alternative concept analyses, technology insertion assessments, and cost, weight, schedule, performance, and risk evaluations to support requirements development, concept refinement, modernization planning, engineering change proposals, acquisition decisions, and capability development.

The Contractor shall identify technical, programmatic, operational, and lifecycle risks associated with the alternatives evaluated and provide recommendations for risk mitigation, performance optimization, and implementation strategies.

4.5.4 SAFETY

The Contractor shall provide safety expertise to support Government conducted safety assessments and to support accident investigations involving Marine Corps vehicles.

4.5.5 MEETINGS

4.5.5.1 Task Order Post Award Conference (PAC). Specific time and date for PAC shall be identified in each task order and coordinated with all parties. The purpose of the PAC is for the Contractor to review and demonstrate to the Government the management procedures, provide progress assessments, review technical and other specialty area statuses, and to establish schedule dates for near term critical meetings and actions. The Contractor shall present management, key personnel, and program ramp-up during the PAC.

4.5.5.2 Quarterly Program Management Review (PMR) Meetings as identified in each task order. The Contractor shall plan, host, attend, coordinate, support and conduct meetings, formal reviews, conferences, and audits (hereinafter called "reviews") as requested by the Government.

The Contractor shall conduct PMRs at Government or Contractor facilities or by other means (e.g. teleconference) as agreed to by the Contracting Officer. Reviews requiring demonstration and/or examination of equipment shall be conducted at the Contractor's facility. All such reviews shall be included in the program schedule and may be held concurrently with the Government’s approval. The Contractor shall prepare agendas and conference presentation materials, and deliver minutes and reports following each review.

The Government reserves the right to cancel any review or to require any review to be scheduled at critical points during the period of performance. Action item documentation, assignment of responsibility for completion and due dates shall be determined prior to adjournment of all reviews.

The Contractor shall summarize and submit all action items, responsible parties, and estimated completion dates with the Minutes as designated in each task order.

4.6 INVOICES

The Contractor shall submit invoices in accordance with the invoicing requirements specified in each task order. The Contractor shall provide a copy of submitted invoices to the COR within three (3) days of submission to Wide Area Workflow (WAWF).

4.7 GOVERNMENT PROPERTY MANAGEMENT: As stated in each task order.

The Contractor shall have a system to manage (control, use, preserve, protect, repair, and maintain and dispose) Government property. The system shall be able to satisfy the requirements of this contract. The Contractor shall initiate and maintain the processes, systems, procedures, records, and methodologies necessary for effective control of Government property during the period of performance. The Contractor shall submit a Property Management Plan and disclose any significant changes to their property management system to the Contracting Officer prior to implementation. The Contractor's responsibility extends from the initial acquisition and receipt of property, through stewardship, custody, and use until formally relieved of responsibility by authorized means, including task, consumption, expending, disposition, or via a completed investigation, evaluation, and final determination for lost, damaged, destroyed, or stolen property. This requirement applies to all Government property, either furnished or acquired under task orders issued against this BOA, under the Contractor's accountability, stewardship, possession or control, including its vendors and subcontractors.

The Contractor shall include these requirements in all subcontracts under which Government property is acquired or furnished for subcontract performance.

The Contractor shall use Government property, either furnished or acquired under this contract, only for performing this contract, unless otherwise provided for in this contract or approved by the Contracting Officer in writing. The Contractor shall not modify, cannibalize, or make alterations to Government property unless this contract or task order specifically identifies the modifications, alterations or improvements as work to be performed.

“Contractor Acquired Property” means property acquired, fabricated or otherwise provided by the Contractor for performing a contract and to which the Government has title.

“Government property” means all property owned or leased by the Government. Government property includes both Government-furnished and Contractor-acquired property. Government property includes material, equipment, special tooling, special test equipment, and real property. Government property does not include intellectual property and software.

“Inventory” means to physically locate an item for inspection and data collection purposes.

“Failure Analysis” means a systematic examination of failed devices to determine the root cause of failure and to use such information to eventually improve product reliability. Failure analysis is designed to: identify the failure modes (the way the product failed); identify the failure site (where in the product failure occurred); identify the failure mechanism (the physical phenomena involved in the failure); determine the root cause (the design, defect, or loads which led to failure); and recommend failure prevention methods.

“Material” means property that may be consumed or expended during the performance of a contract, component parts of a higher assembly, or items that lose their individual identity through incorporation into an end item.

Material does not include equipment, special tooling, special test equipment, or real property.

“Scrap” means recyclable, waste and discarded materials derived from items that have been rendered useless beyond repair, rehabilitation, or restoration such that the item’s original identity, utility, form, fit and function have been destroyed. Items can be classified as scrap if processed by cutting, tearing, crushing, mangling, shredding, or melting.

Unless otherwise noted, the Government does not authorize the Contractor to enter into bailment agreements with external parties for Government Property under this BOA or any subsequent task orders.

4.8 GOVERNMENT FURNISHED PROPERTY (GFP): The GFP shall be identified in each task order.

The Government may furnish Government-owned property as deemed necessary to assist the Contractor in the performance of the task order requirements. GFP delivery dates will be specified at the task order level. The Contractor shall perform accountability, security, and storage for the GFP provided. Upon completion of the task order or in the event of the termination of the task order, all Government owned property, which will have become surplus or excess to any remaining task order requirements, shall be reported immediately by the Contractor to the Contracting Officer for redistribution, shipping instructions, release for disposal, or other actions.

GFP provided after award of the BOA will be listed in Section J of each task order.

The Contractor is required to submit a Baseline Physical Inventory at the beginning of each task order.

The Contractor shall submit a Government Property (GP) Status Report in order to maintain proper audit control of GP in accordance with the Federal Acquisition Regulation (FAR). The GP Status Reports are to identify what changed in the physical inventory from the previous reporting period and the reason for the change.

The Contractor shall submit an Annual Government Property Physical Inventory Status Report.

The Contractor shall have a Property Management Plan. The Property Management Plan shall include but not be limited to, processes to report discrepancies; loss, theft, damage or destruction; physical inventory results; audits and self-assessments; corrective actions; and other property related reports as directed by the Contracting Officer.

4.8.1 MAINTENANCE OF GFP: As stated in each task order.

The Contractor shall properly maintain Government property. The Contractor's maintenance program shall enable the identification, disclosure, and performance of normal and routine preventative maintenance and repair. The Contractor shall disclose and report to the Contracting Officer the need for repair and replacement of GFP and submit a GFP Failure Report. In the event that any GFP identified in this contract is outside of the warranty period provided by a third party, sustains loss or damage resulting from a risk for which the Contractor is not liable in accordance with FAR clause 52.245-1, and subject to the availability of funds, the Contractor shall:

• Repair any item of GFP that fails, subject to the cost of repair thresholds established in each task order.

• Where the cost of the repair will exceed this threshold, the Contractor shall obtain written approval from the Contracting Officer prior to repair of that item.

The Contractor shall contact the Contracting Officer for disposition instructions for all GFP.

The Contractor shall induct failed hardware for repair and track the status of all failed hardware during the repair cycle. By the tenth day of each month or as identified in each task order, the Contractor shall deliver to the Contracting Officer GFP Failure Reports and cost data for all GFP.

4.9 GOVERNMENT FURNISHED INFORMATION (GFI): As stated in each task order.

The Government may furnish Government information as deemed necessary to assist the Contractor in the performance of each task order requirement. GFI delivery dates will be specified at the task order level. The Contractor shall provide for accountability, security, and storage for the GFI provided. GFI provided after a task order is awarded will be listed in the task order.

4.10 CONTRACTOR ACQUIRED PROPERTY: As stated in each task order.

Contractor acquired property in performance of this BOA and invoiced under each task order shall be property of the United States Government. The Contractor shall list and report Contractor acquired property as Government property in the task order.

4.11 FINAL DISPOSITION OF GFP: As stated in each task order.

The Contractor shall dispose of property in accordance with subpart 45.6 of Title 48 Code of Federal Regulations, FAR 52.245-1 and Defense FAR Supplement (DFARS) Subpart 245.6, Current version of Defense Demilitarization Manual (DoD 4160.28 Volume 1, Change Effective 15 July 2019), Trade Security Controls requirements in accordance with DoD Instruction 2030.08 “Implementation of Trade Security Controls (TSC) for Transfers of DoD U.S. Munitions List (USML) and Commerce Control List (CCL) Personal Property to Parties Outside DoD Control.”

The Contractor is authorized to utilize the Defense Logistics Agency Disposition Services for disposal of excess property requiring demilitarization (DEMIL) upon approval of the Government Contracting Officer. The Contractor shall use the property disposal process through the Defense Contracts Management Agency (DCMA) and identify property Federal Stock Codes and demilitarization codes to the DCMA Plant Clearance Officer on the Inventory Disposal Schedule.

The Contracting Officer will provide guidance as to the disposition of GFP assets at the completion of the contract.

Disposition of assets provided under each individual task order executed against this BOA will be funded at the task order level.

4.12 ADDITIONAL TASKS

4.12.1 STATUS REPORTS

The Contractor shall deliver monthly status reports in current, standard industry formats (e.g., Microsoft 365 compatible formats or PDF) that identify status of performance for open orders. At a minimum, these reports shall include a schedule for the order with milestones and monthly expenditures.

4.12.2 LOGISTICAL SUPPORT

The Contractor shall maintain accountability of ground vehicles with all associated components, system support packages (consumables, spare parts, special tools), and GFP that is provided by the Government to support testing.

4.12.3 DRIVER TRAINING:

The Contractor shall provide on-road and off-road operator (tactical or other) driver training on various ground vehicles as identified in each task order. Driver training may include but is not limited to the development of an appropriate Program of Instruction, specific discrete or non-discrete events, equipment operation and trailer or towed systems.

C.5 SECURITY

Contractor facility must have a Secret Facility Clearance. DoD Contract Security Classification Specification (DD254) requirements will be included in each task order as required.

If a task order requires the Contractor to have a Secret Facility Clearance and certain Contractors to obtain and maintain classified access eligibility, the Contractor shall have a valid Secret Facility Clearance and a Secret Safeguarding Level prior to classified performance at the Contractor’s facility. The Prime Contractor and all Sub- Contractors (through the Prime Contractor) shall adhere to all aspects of 32 CFR Part 117 NISPOM. All personnel identified to perform on this BOA, and task orders awarded under this BOA, shall maintain compliance with Department of Defense, Department of the Navy, and Marine Corps Information and Personnel Security Policy to include completed background investigations (as required) prior to classified performance. The Facility Security Officer (FSO) is however required to establish, populate, and own the DISS record of every Contractor processed for and/or issued a Common Access Card (CAC).

In accordance with DoDI 5200.48 - Controlled Unclassified Information (CUI), all Contractors supporting MARCORSYSCOM who receive, store, or generate CUI are required to take the DoD Mandatory CUI Training, available on the Security Awareness Hub at: https://securityawareness.usalearning.gov/cui/index.html. Per DoDI

5200.48 and pursuant to contractual requirements, DoD Contractors require initial CUI training and annual CUI refresher training. Additional MARCORSYSCOM specific CUI training and guidance can be attained by contacting the MARCORSYSCOM Security Classification Management Office at 703-432-3141 / 3140 or MCSC_ACSG2_SCMO@usmc.mil.

While performing aboard NAVY/USMC sites, the Contractor shall comply with the provisions of DoD Directive 5205.02E, “DoD Operations Security (OPSEC) Program,” SECNAVINST 3070.2A, “Operations Security,” MCSCO 3070.1B, “Operations Security Program,” Marine Corps Order 3070.2A, “The Marine Corps Operations Security (OPSEC) Program,” and the MARCORSYSCOMO P5510.2C, “Security Manual,” at all other sites the Contractor shall comply with the local command and/or program OPSEC plan. Contractor Personnel shall follow OPSEC concepts and principles in the conduct of this requirement to protect critical information, personnel, facilities, equipment, and operations from compromise. All Contractors (including Subcontractors) shall supplement their current security practices by requiring any personnel involved in executing this BOA, or a task order awarded under this BOA, to complete Government-sponsored and administered OPSEC training.

The FSO’s are responsible for notifying the MARCORSYSCOM Personnel Security (PERSEC) Office at 703-432- 3952/3490/3374 if any Contractor on this BOA, or a task order awarded under this BOA, receives an unfavorable adjudication. Any issued CAC would need to be Revoked and Retrieved. Due to Insider Threat concerns, the FSO is also requested to notify the PERSEC Office, within 24 hours of any adverse/derogatory information associated with the 13 Adjudicative Guidelines concerning any Contractor performing on this BOA, or a task order awarded under this BOA, if they have been granted an IT designation, issued a CAC and/or a MARCORSYSCOM building badge. The FSO shall notify the Government (written notice) within 24 hours of any Contractor Personnel added or removed from the BOA, or a task order awarded under the BOA, that have been granted IT designations, issued a CAC and/or a MARCORSYSCOM building badge.

C.6 ORGANIZATIONAL CONFLICT OF INTEREST

In consideration for the award and performance of this BOA and any subsequent task orders / contracts, the Contractor shall be an independent testing and engineering organization that itself does not have a contract or subcontract for manufacturing vehicles or vehicle components and subsystems; and is not affiliated with, or owned by, or have an interest in another Contractor that possesses a Department of Defense contract for manufacturing vehicles, vehicle components, or vehicle subsystems including, but not limited to, components or subsystems for the Utility Task Vehicle (UTV), Ultra Light Tactical Vehicle (ULTV), Joint Light Tactical Vehicle (JLTV), Medium Tactical Vehicle Replacement (MTVR), Logistics Vehicle System Replacement (LVSR), Amphibious Combat Vehicle (ACV), Light Armored Vehicle (LAV), Advanced Reconnaissance Vehicle (ARV) and the P19R Firetruck.

In addition, the Contractor shall be prohibited from performing as a prime Contractor or subcontractor on any program or task order involving a non-developmental item for which it had a role in the drafting or development of a work statement, performance statement, or requirements to be used in a competitive acquisition. Notwithstanding the foregoing sentence, the Contractor may perform orders under this BOA to produce prototypes of vehicle parts or components for testing, analysis and investigation of vehicle maintenance, sustainment, operations, and performance issues.

These prohibitions and restrictions shall be in effect during the period of performance of this BOA and for one year after completion of this BOA and any orders there under.

Except as limited above and by FAR subpart 9.5, the Contractor shall be allowed to provide test and evaluation services as a prime Contractor, subcontractor or in a vendor relationship to vehicle manufacturers and vehicle component or subsystem providers.

The Contractor shall notify the contracting Officer immediately when it becomes aware that its activities may result in any actual or potential Organizational Conflict of Interest (OCI) as defined in FAR 2.101 and subpart 9.5, and shall promptly submit a mitigation plan to the Contracting Officer to avoid or mitigate any such OCI.

C.7 CYBERSECURITY DOCUMENTS

7.1 REFERENCE DOCUMENTS

• Federal Standard – Mandatory Compliance 1, Defense Federal Acquisition Regulation Supplement Clause 252.204-7012 (Safeguarding Unclassified Controlled Technical Information) Version 2.0 August 2015

• Federal Standard – Mandatory Compliance 2, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

• Federal Standard – Technical Evaluation Criteria 1, NIST Special Publication 800-171A, Assessing Security Requirements for Controlled Unclassified Information

• NIST Special Publication 800-53

• Federal Information Processing Standards (FIPS) 140-2

7.2 PROGRAM RELATED DOCUMENTATION

The following documentation is provided in Section J:

• Contractor Controlled Unclassified Information (CUI)-System Security Plan (SSP) Template 20 Nov 2018-final (Attachment 2)

• DoD Guidance for Reviewing System Security Plans and the NIST SP 800-171 Security Requirements Not Yet Implemented Exhibit(s) (Attachment 3)

C.8 CYBERSECURITY REQUIREMENTS

8.1 SYSTEM SECURITY PLAN AND PLANS OF ACTION AND MILESTONES (SSP/POAM) REVIEWS

a) Within thirty (30) days of contract award, the Contractor shall make its SSP(s) for its covered contractor information system(s) available for review by the Government at the contractor’s facility. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government’s review of the SSPs at the Contractor’s facility.

b) If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The Contracting Officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the Contracting Officer of any failure or anticipated failure to meet a milestone in such a POAM.

c) Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor’s facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

d) The Government may, in its sole discretion, conduct subsequent reviews at the Contractor’s site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days’ notice to the Contractor.

CDRL A001, System Security Plan (SSP) and Associated Plan of Action

8.2 COMPLIANCE TO NIST 800-171

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev.

1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the Contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi- factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the Contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

4) Audit user privileges on at least an annual basis;

5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation- program);

6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

8.3 CYBER INCIDENT RESPONSE:

a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

b) Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

c) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The Contracting Officer will approve or disapprove the request after coordination with DC3.

CDRL A002, Cyber Incident Reporting for a Contractor’s Internal Unclassified Information System http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx.

8.4 NAVAL CRIMINAL INVESTIGATIVE SERVICE (NCIS) OUTREACH

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies.

8.5 NCIS/INDUSTRY MONITORING

a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators;

pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the Contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.

8.6 CONTRACTOR’S RECORD OF TIER 1 LEVEL SUPPLIERS WHO RECEIVE OR DEVELOP

COVERED DEFENSE INFORMATION

The Contractor shall supply record of Tier 1 Level Suppliers who receive or develop Covered Defense Information. In accordance with CDRL A003, the Contractor shall provide its plan to track flow down of covered defense information and to assess DFARS Clause 252.204-7012 compliance of known Tier 1 Level suppliers.

CDRL A003: Record of Tier 1 Level Suppliers Receiving/Developing Covered Defense Information