Attachment 1 Draft Statement of Work.pdf

Attachment 1: Draft Statement of Work

Acquisition Management Systems (AMS) Support Services Statement of Work (SOW)

For Naval Air Systems Command (NAVAIR) – Procurement Group Acquisition Technology

Department (PGATD)

1. SCOPE

1.1. Introduction

The responsibility for the requirement is to continuously analyze, design, develop, test, deploy, sustain, upgrade, manage, evaluate, and oversee the Acquisition Management System (AMS) applications, the Knowledge Management System (KMS) portal, and other associated software application interfaces—including the analytics and visualizations derived from these systems—resides within the Procurement Group, Acquisition Technology Division (PGATD), located at Patuxent River, Maryland.

The AMS suite consists of a collection of interrelated, web-based acquisition management software applications designed to standardize and streamline a wide range of program, project, and procurement management tasks. These applications support NAVAIR Enterprise and selected external stakeholders including Naval Sea Systems Command (NAVSEA), Naval Information Warfare Systems Command (NAVWAR), Military Sealift Command (MSC), Office of Naval Research (ONR), Strategic Systems Program (SSP), Uniformed Services University of the Health Sciences (USUHS), Headquarters Marine Corps (HQMC), Installations and Logistics-Headquarters Marine Corps (I&L), U.S. Naval Research Laboratory (NRL), and Naval Facilities Engineering Systems Command (NAVFAC).

AMS functionality is driven by a disciplined software development approach focused on delivering tailored solutions that meet the evolving needs of acquisition stakeholders. This is accomplished through:

1. Comprehensive analysis of customer requirements.

2. Design, development, and integration of new software applications as needed.

3. Continuous enhancement and deployment of software updates to existing systems.

4. Effective sustainment and maintenance to ensure usability and reliability.

5. Delivery of high-quality analytics and visualizations through platforms such as Tableau.

Currently supported AMS applications include:

• Procurement Management Tool (PMT), which incorporates the Electronic Contract File (ECF) module.

• Common Spend Plan Tool (CSPT).

• Contract Data Requirements List (CDRL) Tool.

• KMS Portal.

AMS also supports integration with a variety of external systems of record and provides detailed analytics and visual dashboards to aid decision-making at both operational and leadership levels. To maintain technical relevance and operational efficiency, AMS is actively transitioning to modern data architecture.

2. APPLICABLE DOCUMENTS

The following documents are applicable to the SOW as specified herein. This list is not all-inclusive. This list is for reference only and defines the most common documents, policies, specifications that may be applicable in the performance of the duties defined within this SOW. New instructions, supplements, amendments, or revisions to documents may be issued during the term of the contract and shall be in full force and effective immediately upon receipt by the Contractor. In the case of an inconsistency between the industry standards referenced herein and the Government documents referenced below, the Navy/Department of Defense (DoD) standard will always take precedence.

2.1. Department of Defense Specifications

2.1.1. DoD 8140 – Cyber Workforce Qualification Program.

2.1.2. DoD National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of

Federal Regulations Part 117, NISPOM Rule.

2.1.3. DoDD 5220.22 - National Industrial Security Program.

2.1.4. DoDD 5230.24 - Distribution Statements on Technical Documents.

2.1.5. DoDD 8140.01 - Cyberspace Workforce Management.

2.1.6. DoDI 1035.01 - Telework and Remote Work.

2.1.7. DoDI 5200.48 - Controlled Unclassified Information (CUI), 6 Mar 2020.

2.1.8. DoDI 5230.24 - Distribution Statements on Technical Documents, Change 3, 15 Oct 2018.

2.1.9. DoDI 8140.02 - Identification, Track and Reporting of Cyberspace Workforce Requirements.

2.1.10. DoDI 8582.01 - Security of NON-DOD Information Systems Processing Unclassified Non-Public

DOD Information.

2.1.11. DoDM 5200.01 - DoD Information Security Program: Protection of Classified Information.

2.1.12. DoDM 8140.03 - Cyberspace Workforce Qualification and Management Program.

2.2. Department of Defense Standards

2.2.1. Not Applicable

2.3. Other Government Documents (e.g. NAVAIR Documents)

2.3.1. NASPAXRIVINST 5510.15q – Procedures for Naval Air Station Patuxent River and Webster Field, Maryland.

2.3.2. SECNAV M-5510.36B - Department of the Navy, Information Security Program, 12 Jul 2019.

2.3.3. NIST 800-60 – Guide for Mapping Types of Information and Information Systems of Security

Categories.

2.3.4. NIST SP 800-53 – Security and Privacy Controls for Information Systems and Organizations.

2.3.5. NIST SP 800-171 Rev. 3 – Special Publication: Protecting Controlled Unclassified Information in

Nonfederal Systems and Organizations (Revision 3)

2.3.6. OPNAVINST 3440.17A - Navy Installation Emergency Management Program, 1 Aug 2014.

2.3.7. SECNAV M-5510.30C - Department of the Navy, Personnel Security Program, 24 Jan 2020.

2.3.8. SECNAV M-5239.2 - DON Cyberspace Information Technology and Cybersecurity Workforce

Management and Qualification Manual

2.3.9. SECNAVINST 5239.3C - DON Cybersecurity Policy

2.3.10. SECNAVINST 5510.30C – DON Personnel Security Program

2.3.11. Workforce Management and Qualification Manual.

2.3.12. Section 508 of the Rehabilitation Act.

2.3.13. National Security Decision Directive (NSDD) 298.

2.3.14. Department of Defense Contract Security Classification Specification (DD-254).

2.3.15. Privacy Act of 1974.

2.3.16. Material Inspection and Receiving Report (DD-250).

2.3.17. Covered Defense Information (meeting the definition of 48 CFR 252.204-7012(a)).

2.3.18. Form OPNAV 5239/14 (Rev Sep 2011).

2.3.19. System Authorization Access Request (DD-2875).

2.4. Industry Documents

2.4.1. Not Applicable

3. REQUIREMENTS

3.1. General Requirements

3.1.1. Compatibility

The Contractor shall maintain the capability to prepare documents and software packages compatible with the Government Information Technology (IT) environment through the security classification specified in the DD-254. The current operating environment required for this contract includes:

a. Microsoft Windows 11

b. Microsoft Project 2021

c. Microsoft Office Professional Plus 2021

d. Microsoft Visio 2021

e. Microsoft Teams, Slack, Zoom

f. Adobe Acrobat XI (reader)

g. Internet Access

The Contractor shall maintain the ability to interface with and transfer data to and from the Requiring Office (RO) software applications and their upgraded versions. The Contractor shall ensure that all media are virus-free when delivered. The Contractor shall be capable of Internet and Local Area Network (LAN) communications with the Government. Contractor personnel shall be capable of maintaining real-time communication, both voice and data transfer capabilities, with the Government during working hours, whether at the Contractor work site or on travel.

3.1.2. Work Location, Meeting Support, and Telework

3.1.2.1. Work Location

Approximately 10% of the work will be performed at the Government site and 90% of the work will be performed at the Contractor site. Contractors performing on-site support will be provided, but are not limited to: Access to workspaces, telephones, printers, facsimile machines, copy machines, shredders, computers, and network access including web servers and applicable databases or other applications that are deemed necessary to carry out assigned tasks.

3.1.2.2. Meeting Support

In support of the tasking outlined in this SOW, the Contractor shall have the capability to host and conduct meetings at the classification levels up to Classified with the capacity to support a minimum of 50 persons and have contractor furnished telephone and Video Teleconferencing (VTC) capability utilizing Microsoft Teams, as well as sufficient equipment to conduct meetings with presentations including compatible software as required in Paragraph 3.1.1. This support shall be provided at a facility within a 15-mile radius of the NAS Patuxent River, MD location.

3.1.2.3. Telework

The Contractor may allow employees to telework with approval from the Contracting Officer’s Representative (COR) in writing that a position’s tasking is eligible for telework. The Contractor may utilize alternate worksites/locations and telework to support continued performance of SOW tasks in accordance with company policy. When using telework, the Contractor remains responsible for contract performance and compliance with any applicable cost accounting standards and contract cost principles / procedures.

Various positions will be required to routinely access the SIPRNet in the performance of the contract and will be determined at the Task Order level. Therefore, telework employees who require SIPRNet access shall be within proximity and commutable distance to a SIPR facility. Commutable distance is considered to be within 50 miles of the SIPR facility. The Government will not provide reimbursement for any travel-related expenses for employees to access SIPR at a SIPR facility.

3.1.3. Contract Status Reporting and Deliverables

The Contractor shall provide the following Contract Data Requirements List (CDRL) deliverables as specified in he contract and/or individual TOs.

3.1.3.1. Monthly Progress and Financial Status Report

The Contractor shall provide a progress and financial status report in accordance with (IAW) CDRL A001 and A002. Throughout contract performance, the Contractor shall maintain an updated and current staffing plan and obtain approval from the Government prior to incurring additional costs and/or adding personnel to the contract. The report shall include work accomplished since submittal of the last report, both monthly and cumulative man-hour labor cost expended by individual personnel and labor category as well as material and travel costs.

a. Cost Plus Fixed Fee (CPFF) Contract Line-Item Numbers (CLINs): The Contractor shall provide information by CLINs/Subcontract Line Item Numbers (SLINs)/Appropriations, to include, cost details (i.e., Employee Name, Labor Category, Rate, Current and Cumulative Hours and Cost, etc.), financial status of cost CLINs (i.e., funding applied, expenses incurred during current reporting period, total expenses to date, amount remaining, etc.) and forecast of funds depletion by CLIN type based on known requirements.

b. Cost Reimbursable CLINs: The Contractor shall provide information by CLIN/SLIN/Appropriation, to include, travel details (i.e. Traveler Name(s), Date of Travel, Destination, and Purpose for Travel); Other Direct Cost (ODC) expense details (Item/Name, Description, Unit Cost, Number of Units, and Extended Costs for ODCs, etc.); financial status of cost-related CLINs (i.e., funding applied, expenses incurred during current reporting period, total expenses to date, amount remaining, etc.) and forecast of funds depletion by CLIN type based on known requirements.

c. Governmental Furnished Property/Equipment (GFP/GFE)/Contractor Acquired Property (CAP) Reporting: The Contractor shall maintain a documented property accountability system and procedures whereby all GFP/GFE and CAP are tracked by documenting all pertinent information about property, including item nomenclature, serial number, and location. Upon termination of the Contract, all GFP/GFE/CAP shall revert to the Government. GFP will be tracked at the Task Order (TO) level.

3.1.3.2. Other CDRLs

The table below lists all CDRLs that will be required under this contract. All other CDRL details will be included in each CDRL Form DD1423.

CDRL Title Subtitle

A001 Management Report Monthly Progress and Status Report for each AMS Application

A002 Expenditure Report Funds and Man-Hours Expenditures

A003 Software Requirements Specifications (SRS) SRS including Computer Software Configuration Item (CSCI)

A004 Software Documentation Software Architecture and Design

A005 Software Design Description (SDD) Database and Interface Design Documentation

A006 Database Design Description (DBDD) IT source and related code

A007 System Authorization Access Request SAAR DD Form 2875

A008 Non-Disclosure Agreement Confidentiality Agreement

A009 Training Support and Material Training Support (Classroom, Virtual, Cue Cards, etc.) Documents

A010 OPSEC Operation Security Plan

A011 Transition Out Strategy Minimal Impact Transition

3.1.4. Work Schedule to include Compressed Work Schedule (CSW), holidays, and installation closure

3.1.4.1. Work Schedule

The Contractor shall provide the required services and staffing coverage during normal working hours.

Normal working hours are usually 8.5 hours (including a 30-minute lunch break), from 0700 to 1530 each Monday through Friday (except on the legal holidays specified in paragraph 3.1.4.3), with the flexibility to start as early as 0600 and end as late as 1800, Monday–Friday.

3.1.4.1.1. Compressed Work Schedule (CWS)

CWS is an alternative work schedule to the traditional five 8.5-hour workdays (which include a 30-minute lunch) worked per week. Under a CWS schedule, an employee completes the following schedule within a two-week period: Eight (8) weekdays are worked at 9.5 hours each (which includes a 30-minute lunch), one (1) weekday is alternately worked as 8.5 hours (which includes a 30-minute lunch) and one (1) weekday is not worked by the employee. The result is 80 hours worked every two weeks, with 44 work hours one week and 36 work hours worked the other.

The Contractor may allow its employees to work a CWS schedule provided the requirements of this SOW are met. If the Contractor chooses to allow its employees to work a CWS schedule in support of this contract, any additional costs associated with the implementation of the CWS schedule vice the standard schedule are unallowable costs under this contract and will not be reimbursed by the Government. Additionally, the CWS schedule shall not prevent Contractor employees from providing necessary staffing and services coverage as required by the Government to the COR.

3.1.4.1.2. Holidays: The Government observes the Federal holidays identified on the Office of Personnel Management (OPM) website: https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview. The Contractor is permitted to observe the above Federal Holidays IAW its corporate policy.

3.1.4.1.3. Installation Closures

When Federal facilities are closed by the Government, or when Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility related problem that prevents Federal personnel from working at the Government facility, contractor personnel assigned to work at that facility in support of such Federal employees shall follow their parent company’s policies.

While generally contractor personnel may not perform work on-site at a Government facility without oversight from Federal personnel, in very limited circumstances, work being performed by contractor personnel may be deemed mission essential and performance of such mission essential work may be authorized to continue at the Government facility despite the facility being otherwise closed for normal operations. The circumstances permitting work being performed by contractor personnel to be deemed mission essential are extremely limited and generally only apply to performance of efforts related to public health, safety, or matters related to national security. The cognizant Contracting Officer must concur with any determination that work being performed by contractor personnel is mission essential.

3.1.4.1.4. Overtime

Overtime as defined in this contract refers to hours worked by a contractor employee in excess of the employees’ normal work week. When support requirements outside of normal working hours occur, the Contractor shall ensure qualified personnel are available to support the requirements using overtime. Overtime is authorized under this contract to the extent specified in the individual TO, provided COR approval is obtained in advance. The COR may provide concurrence for overtime on a task, event, program, project, or general function basis. If the COR is unavailable then concurrence may be given by the Alternate COR (ACOR).

3.1.5. Other Direct Cost (ODCs)

COR approval shall be obtained prior to the purchase of any material or travel expenses.

3.1.5.1. Travel

Travel may include general and administrative expenses but shall not include profit. Temporary travel to other locations in support of program tasking may be required. Estimates of all travel costs shall be compiled and submitted for review and pre-authorization/ approval by the COR and ACOR in the event the Technical Point of Contact (TPOC). If required, temporary travel locations include California, Virginia, and Japan. This list is not all-inclusive, as locations may change over the life of the contract.

3.1.5.2. Material

Incidental material will be required in the performance of this Contact, and all incidental material purchases shall be IAW CTXT-242.9520 PROCEDURES AND APPROVALS REQUIRED PRIOR TO INCURRING DIRECT MATERIAL COSTS (Apr 2022). All materials not depleted during the performance of this contract shall become Government property upon completion of this contract. The contractor shall transfer all materials not depleted to the COR by way of Material Inspection and Receiving Report (DD Form 250). Material costs may include general and administrative expenses but shall not include profit/fee.

The costs of general-purpose business expenses required for the conduct of the Contractor’s normal business operations are not an allowable direct cost in the performance of this contract. General purpose business expenses include, but are not limited to, the cost of items such as telephones and telephone charges, reproduction machines, word processing equipment, personal computers and other office equipment and office supplies.

3.1.5.3. Subcontractors

The provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this contract. Provisions of this SOW shall flow down to subcontractors providing support under this contract.

3.1.5.4. Management of Contractor Personnel

The Government will neither supervise contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual contractor employees. The Contractor shall manage its employees and guard against any actions that are of the nature of personal services or give the perception of personal services.

3.1.5.5. Transition Out Strategy

The Contractor shall facilitate the accomplishment of a smooth, orderly, and seamless transition of workload under this contract. The overall transition strategy shall be built around maintaining the mission and ensuring that critical data and knowledge is transferred with minimum disruption to vital Contractor services and AMS activities.

The Contractor’s overall transition-out strategy shall be built around maintaining the mission of the program with minimal impact, not only in terms of timeliness of performance but also to ensure that critical data and knowledge transfer occur. Prior to the termination or expiration of the contract, the Contractor shall ensure an orderly transition of responsibilities while minimizing impact to the operation (CDRL A011).

3.1.5.5.1. Work Turnover

The Contractor shall provide a plan of action to effectively transfer the tasked work that is in process at the expiration or termination of the contract to the successor company. Establish and maintain effective communication with the incoming contractor or Government personnel for the period of transition via weekly status meetings.

3.1.5.5.2. Quality Assurance

The Contractor shall provide a plan of action to ensure continuation of quality review processes during the transition period to the successor company.

3.1.5.5.3. Risk Mitigation Strategies

The Contractor shall provide a plan of action to mitigate contract performance risks (quality and schedule) encountered during the transition period.

3.1.5.5.4. Data and Information Transfer

The Contractor shall provide a plan of action for the efficient inventory and transfer of program data to the successor company.

3.1.6. Program Unique Requirements

3.1.6.1. Compliance and Collaboration

The Contractor shall perform all digital/IT services IAW the latest applicable guidance and policies.

Contractor support activities shall be performed IAW Federal, DoD, DON, and NAVAIR statutory and regulatory requirements, such as Application Portfolio Management, Defense Business Transformation Guidance, Navy Enterprise Application Developer’s Guide, Clinger Cohen Act (CCA), Federal Information Security Management Act (FISMA), and Web Enablement. Any tool that will be hosted by Navy/Marine Corps Intranet (NMCI) or run on NMCI workstations must be certified for NMCI and comply with NMCI policy.

As there are multiple digital/IT projects, initiatives, and activities ongoing throughout the NAVAIR Enterprise and the DoD, the Contractor shall work in close cooperation, collaboratively, and in the integrated manner with other support contractors as required, to maximize organizational alignment and technology acceleration. This mainly includes the Nautilus Virtual Desktop (NVD) for FlankSpeed. The NVD allows users to maintain their NMCI accounts and use common workspaces.

Further information can be found at https://crl.helpspot.com/index.php?pg=kb.page&id=155.

3.1.6.2. Rapid Response to Evolving Technologies

The Contractor may be required to respond rapidly, to meet surge requirements, across a wide portfolio of emerging and disruptive technology areas (i.e., Cloud computing, AI, Robotics process automation, Progressive Web Apps, etc.). As digital technology rapidly evolves and emerges, the Contractor may be required to support digital technology areas not specifically listed herein.

3.1.6.3. Quality Control

The Contractor shall maintain an effective quality control program to ensure services are performed IAW the SOW and the Contract Surveillance Plan (CSP). The Contractor shall implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Government shall evaluate the Contractor’s performance under this contract IAW the CSP.

3.1.6.4. Task Order Requirements

Contract services shall be performed IAW the SOW as detailed in individual TOs. The TOs’ SOW will detail tasks that fall within the scope of the base contract. CLIN’s by appropriation will be separately priced in the individual TOs so that the hours/dollars can be drawn down as orders and issued during the applicable performance period.

3.1.6.5. Non-Disclosure Agreements (NDAs) and Organizational Conflicts of Interest (OCI) In the performance of the contract, the Contractor may have access to non-public information. The Contractor shall provide signed NDAs for those employees, as requested by the COR, no later than five (5) business days after employee hire. To ensure ethical and impartial contract performance, all contractor personnel supporting this contract are required to complete the company-sponsored Organizational Conflict of Interest (OCI) training within fourteen (14) calendar days of contract award.

Consistent with the terms and conditions of paragraph (e) of NAVAIR HTXT.209-9510 Organizational Conflicts of Interest (Services) (FEB2025), with respect to proprietary data of third parties, and DFARS 252.227-7025, Limitations on the Use Or Disclosure of Government-Furnished Information Marked with Restrictive Legends(JAN 2025), with respect to technical data, the Contractor shall not use, modify, reproduce, release, perform, display, and disclose any nonpublic information provided to or obtained by the Contractor in the course of performing this contract for other than Government purposes, and shall not do so for any commercial or personal purpose.

If the Contractor knows of or identifies that it has a commercial interest in the subject matter of any proposed or on-going agreement with respect to which contract services are to be performed, the

Contractor shall consider such interest a potential conflict of interest under NAVAIR HTXT.209-9510 (FEB2025) and promptly disclose it to the COR.

Contractor personnel are strictly prohibited from discussing or disclosing any information obtained during contract performance to any unauthorized parties.

3.1.6.6. Technical Training

Due to the technical nature of the work, there may be special, unique, and emergent training required during the execution of this contract. This training may include, but is not limited to, specific software, hardware, and procedures as required for the specific system, or requirements being supported. All requests for cost reimbursable training shall include a written justification by a Government TPOC and course information including, but not limited to, the source of the training, the dates of the training, a training course description, and training cost, including quotes from the vendor.

General educational courses or programs for enhancement of basic qualifications or academic standing of employees shall not be accomplished at the Government’s expense. No cost reimbursable training shall be scheduled or executed without written approval from the COR IAW CTXT.242-9520

PROCEDURES AND APPROVALS REQUIRED PRIOR TO INCURRING DIRECT MATERIAL

COSTS (APR 2022).

3.2. Security

3.2.1. Citizenship Requirements

Only U.S. citizens may perform under this contract, unless waived by the Government. If the Contractor cannot find qualified U.S. citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office. The waiver request should include:

a. The individual's name, date and place of birth, position title, and current citizenship.

b. A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements.

c. A statement of the unusual expertise possessed by the applicant.

d. A statement that access will be limited to a specific government contract (specify contract number).

e. A statement that the Contractor has obtained an export license for the information required to perform the contract.

3.2.2. Investigative Requirements

Unclassified: All contractor personnel must be eligible to perform Non-Critical Sensitive work as defined by SECNAV M-5510.30C. All contractor personnel are required to have a favorably adjudicated Tier-3 investigation from the OPM. The Contractor shall submit a request for personnel security investigation to the Government Security Office. The Government Security Office shall initiate the contractor employee's Electronic Questionnaire for Investigations Processing (eQIP) and shall perform a preliminary screening of the contractor employee's eQIP for suitability and derogatory information. The contractor employee shall provide all requested information pursuant to the Privacy Act of 1974. The Government Security Office may deny the contractor employee access to Government facilities and information and may prohibit the contractor employee from performing sensitive duties for failure to provide requested information or when derogatory or adverse information is present on the contractor employee's eQIP. In such cases, the contractor employee may not perform on the Contract.

Controlled Unclassified Information including Legacy For Official Use Only (FOUO) and Covered Defense Information (meeting the definition of 48 CFR 252.204-7012(a)) generated and/or provided under this contract shall be marked and safeguarded as specified in DoD Instruction 5200.48, Controlled Unclassified Information (CUI), available at DoDI 5200.48, "Controlled Unclassified Information (CUI)," Effective March 6, 2020. Any product containing Covered Defense Information shall be assigned a distribution statement using the criteria set forth in DoDI 5230.24; and have this statement displayed per DoDI 5230.24, Enclosure 3.

AND

Classified: All Contractor personnel shall maintain security clearance eligibility commensurate with the level of classification of the work performed as annotated in the Contract's DD-254, Contract Security Classification Specification Form. Contractor personnel shall require access to classified information in performance of this Contract up to and including Top Secret facility level, with a safeguarding level of Top Secret, non-possessing. The Contractor is responsible for ensuring that all personnel receive the requisite investigation and are favorably adjudicated IAW National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulation Part 117, NISPOM Rule. Contractor employees who fail to meet security clearance requirements may not access classified information or perform sensitive duties. In such cases, the Offeror employee may not perform under the Contract.

Controlled Unclassified Information, including Legacy FOUO and Covered Defense Information (meeting the definition of 48 CFR 252.204–7012(a)) generated and/or provided under this contract shall be marked and safeguarded as specified in DoD Instruction 5200.48, Controlled Unclassified Information (CUI).

available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF. Any product containing Covered Defense Information shall be assigned a distribution statement (distribution statements B through F) using the criteria set forth in DoDI 5230.24 (Distribution Statements on Technical Documents); and have this statement displayed per DoDI 5230.24, Enclosure 3.

3.2.3. Common Access Card (CAC)/Public Key Infrastructure (PKI), System Authorization Access

Request (SAAR)

3.2.3.1. SAAR Form

All contractor personnel requiring access to Government Information Technology (IT) systems shall have an approved System Authorization Access Request (SAAR) Form OPNAV 5239/14 (Rev Sep 2011) on file, and complete required Annual Information Awareness Training. New employees must submit their SAAR forms within thirty (30) days of their first day of work. Instructions for processing the SAAR forms are available within the DD Form 2875, System Authorization Access Request (August 2009). SAAR forms shall be submitted to the COR or the assigned Government Trusted Associate Sponsorship System (TASS) Trusted Associate.

3.2.3.2. Command Access Cards (CAC) and Local Badges

Contractor CACs and facility-specific identification badges will be issued by the Government to on-site Contractor personnel and shall always be visible while personnel are at the Government site. The Contractor shall furnish all requested information required to facilitate issuance of identification badges and shall conform to local installation policies and guidance as appropriate. All CACs and identification badges issued to Contractor employees shall be returned to the TASS following completion of the contract, relocation or termination of an employee, or upon request from the COR/Procuring Contracting Officer (PCO).

The Government will provide the Contractor with access to Government facilities, as required, for the performance of tasks under this contract. All contractor personnel must comply with NASPAXRIVINST 5510.15Q, which governs access procedures for Naval Air Station Patuxent River and Webster Field, Maryland.

3.2.3.3. DD-254 Form

The Contractor shall comply with security requirements specified in the DD-254 attached to this contract. Information or data that the Contractor accesses shall be handled at the appropriate classification level. The Contractor shall provide personnel, expertise, and technical support across both Sensitive Compartmented Information (SCI) and non-SCI environments, IAW applicable security regulations and mission requirements.

Non-SCI Support:

The contractor shall perform development, integration, sustainment, and user support functions for systems and data operating within non-SCI environments. This includes but is not limited to:

Application development, testing, and deployment within unclassified or collateral

(Confidential/Secret) domains System and database administration in Controlled Unclassified Information (CUI) and collateral environments Documentation preparation, compliance reporting, and support for Risk Management Framework

(RMF) accreditation packages in alignment with NIST SP 800-171/53 standards End-user training, help desk operations, and troubleshooting on general-purpose networks

SCI Support:

The contractor shall also support mission systems and operations within SCI-designated environments.

This includes:

Development, maintenance, and enhancement of software, analytics tools, and data integration platforms that process SCI Administration of networks, infrastructure, and cybersecurity controls within SCIFs Support for Intelligence Community (IC)-specific compliance requirements, including ICD 503, cross-domain solutions, and security control inheritance Technical assistance in classified data analysis, visualization, and operational workflows requiring

TS/SCI cleared personnel

All personnel assigned to SCI duties must possess active Top Secret (TS) clearances with SCI eligibility and access approval and must work within accredited SCIF facilities as required.

3.2.4. Non-Disclosure Agreement

Because of the changing nature of the EA Operating environment, open collaboration is essential for the NAVAIR team to perform in a coordinated and timely manner. This team consists of military, Government civilians, and contractors. Under this SOW, there may be multiple contractors (i.e. from more than one contract vehicle/company) working in the same or dispersed locations supporting NAVAIR and other locations, tasked to work on the same or related activities. The contractor shall work with these other contractors cooperatively to achieve Government requirements, goals and objectives as efficiently and effectively as possible.

This cooperation may include but is not limited to sharing information like white papers, training efforts, exchanging tactics, tools, and/or procedures resulting from the work required by this SOW or previous Government efforts, and/or working as a team to perform analysis as well as technical tasks and contingency activities in concert.

To the extent work to be performed under this contract requires access to proprietary data of other companies, the contractor must enter into agreements with such other companies by procedures deemed adequate by those companies (i) to protect such data from unauthorized use or disclosure so long as it remains proprietary and (ii) to refrain from using the information for any other purpose other than that for which it was furnished. (CDRL A008).

3.2.5. Security Training and Compliance Mandates

To ensure strict adherence to federal security protocols, the Contractor is required to implement and enforce key security training and awareness measures. Key Requirements:

a. The Contractor shall educate and regularly brief all personnel on the proper handling, safeguarding, and protection of classified materials IAW DoD Directive 5220.22, National Industrial Security Program (NISP).

b. All contractor personnel must complete annual security training as mandated by applicable federal and Department of Defense regulations.

This ensures all personnel maintain awareness of security responsibilities and uphold the standards necessary to protect classified and sensitive Government information.

3.2.6. Information Security

If the work is performed at the Contractor's facility, the Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and CUI and to control distribution of CUI IAW NISPOM codifying 32 Code of Federal Regulations Part 117, NISPOM Rule and SECNAV M-5510.36B, Department of the Navy, Information Security Program. If the work is performed at the Government's facility, the Contractor shall comply with the applicable Facilities Instructions/Guidance, the latest applicable Program Protection Plan(s), and applicable Security Classification Guide(s).

All contractor facilities shall provide an appropriate means of storage for CUI and materials. All CUI including legacy FOUO information and Covered Defense Information (CDI) (meeting the definition DFARS Clause 252.204–7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (MAY 2024)) generated and/or provided under this Contract shall be marked and safeguarded as specified in DoD Instruction 5200.48, Controlled Unclassified Information (CUI) available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF

Any product containing CDI shall be assigned a distribution statement (distribution statements B through F) using the criteria set forth in DoDI 5230.24, Distribution Statements on Technical Documents and have this statement displayed per DoDI 5230.24, Enclosures 3 and 4. Distribution is authorized to the Requiring Office's Organization and supported Activity only. Other requests for deliverables under this Contract shall be referred to the COR/ACOR of this Contract for approval.

3.2.6.1. Markings

All information generated by the Contractor shall be properly marked. CUI information generated and/or provided under this contract shall be marked IAW DoDM 5200.01. Technical information shall also be marked with appropriate Distribution Statements and Export Control warnings IAW DoDD

5230.24 and Program Security Classification Guidance.

3.2.6.2. Public Release

Any CUI pertaining to this Contract shall not be released for public dissemination, including posting to any social media sites such as Facebook or Twitter, unless it has been approved for public release by the appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release through:

NAS Public Affairs Office 22268 Cedar Point Road, Building 409

Patuxent River, MD 20670

3.2.6.3. Loss, Compromise, and/or Electronic Spillage of Classified or Controlled Unclassified Information

All instances of loss, compromise, and electronic spillage of classified or unclassified controlled information shall be reported to the COR, TPOC, and Government Security Office within twenty-four

(24) hours of the incident occurring.

Classified data spills occur when classified data is introduced either onto an unclassified information system or to an information system with a lower level of classification, or to a system not accredited to process data of that restrictive category. The Navy’s IT Service Provider (NMCI) has been charging the Government per contaminated workstation to contain and clean an electronic classified spillage. The Contractor will be responsible for all costs associated with containment, clean-up, and remediation of any classified spillage that is the result of the unauthorized disclosure of classified information by any Contractor employee.

3.2.6.4. Compliance to NIST 800-171

IAW DOD INSTRUCTION 8582.01 SECURITY OF NON-DOD INFORMATION SYSTEMS

PROCESSING UNCLASSIFIED NONPUBLIC DOD INFORMATION, the Contractor shall implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a System Security Plans (SSP) and Plans of Action and Milestones (POA&M) that varies from NIST 800-171 only IAW DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

The Government may, in its sole discretion, conduct reviews at the Contractor’s site to verify compliance. The Government will conduct such reviews at least every three (3) years (measured from the date of the contract award) and may conduct such reviews at any time upon thirty (30) days’ notice to the Contractor.

If the Government determines that the security controls do not adequately implement the requirements of NIST 800-171, then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestones (POA&M) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POA&M.

Upon the conclusion of the correction period, the Government may conduct a follow-on review of the Contractor’s facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies.

The Contractor shall, at a minimum, meet the Basic Safeguarding Requirements as follows to meet the comparable security requirements of the NIST SP 800-171 as indicated.

3.2.6.5. Operations Security (OPSEC)

The Contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the Contractor and any subcontractor during performance of the contract. The Contractor shall be responsible for the subcontractor’s implementation of the OPSEC requirements. This program may include Information Assurance and Communications Security (COMSEC). The OPSEC program shall be IAW National Security Decision Directive (NSDD) 298, and at a minimum it shall include:

a) Assignment of responsibility for OPSEC direction and implementation.

b) Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

c) Establishment of OPSEC education and awareness training.

d) Provisions for management, annual review, and evaluation of OPSEC programs.

e) Flow down OPSEC requirements to subcontractors when applicable.

While performing aboard NAVAIR or NAVAIR sites, the Contractor shall comply with facility OPSEC program instructions and contribute to organization-level OPSEC efforts. Include OPSEC as part of its ongoing security awareness program and take all required Agency training. Be responsive to the Supporting OPSEC Manager on a non-interference basis. Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the RO and Contractor in support of the mission.

The Contractor shall develop, implement, and maintain an OPSEC Plan (CDRL A010) to protect classified and sensitive information to be used at a Contractor's and Subcontractor's facilities during the performance of this contract.

3.2.6.6. Anti-Terrorism Force Protection and Emergency Management The work performed on this contract is not Emergency Essential IAW OPNAVINST 3440.17A and Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans. Contractor personnel shall comply with all Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans and directives. Contractor personnel shall not report for work at Government facilities upon declaration of Force Protection Condition CHARLIE or in any event or emergency where Government officials’ direct curtailment of operations to “Mission Essential Only”. All Contractor personnel assigned to a Government facility shall complete annual Antiterrorism (Level One) and Active Shooter training.

3.2.7. Additional Program Unique Requirements

3.2.7.1. Policy Adherence

Department of Defense (DOD) and Department of the Navy (DON) Information Assurance (IA) Program outlined in Secretary of the Navy Instruction (SECNAVINST) 5239.3C, ‘DON Security Policy’ and SECNAV M-5239.2, ‘DON Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual,’ apply to efforts under this contract. Contractor personnel providing services under this contract shall comply with all Federal, DOD, DON, and NAVAIR IA policies. In addition, the Contractor shall comply with SECNAVINST 5510.30B to assure that the proper security investigation is conducted for those Contractor personnel performing services under this contract.

3.2.7.2. Information Technology Security

DON Automated Data Processing (ADP) Security Program outlined in SECNAVINST 5239.3C, ‘DON Security Policy’ and SECNAV M-5239.2, ‘DON I Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual,’ applies to efforts under this contract. Contractor personnel providing services under this contract shall comply with all Federal, DOD, and DON IA statutory and regulatory requirements. The Contractor shall comply with SECNAVINST 5510.30C to assure that the proper investigation (Single Scope Background Investigation (SSBI)) is conducted for those contractor personnel who require IT Level 1 access. The Contractor shall coordinate with the COR and TPOC to identify applicable positions.

3.2.7.3. Cybersecurity Workforce (CSWF)

DODD 8140.01 – Cyberspace Workforce Management, DODI 8140.02, Identification, Track and Reporting of Cyberspace Workforce Requirements, and DOD Manual 8140.03, Cybersafe Workforce Qualification and Management Program, provides guidance for the identification and categorization of positions and certification of personnel conducting cybersecurity functions within the DOD Workforce.

The DOD CSWF includes but is not limited to all individuals performing any of the CSWF functions described in Directive 8140.03-M. All Contractor personnel supporting this contract must comply with DOD Directive 8140.03-M, where applicable, and any training required to comply with this directive is at the expense of the Contractor and can be found in the Labor Category Qualifications.

The COR/ACOR in conjunction with TPOC will assign the appropriate certification category based on the duties and responsibilities being performed, relative to the current published DOD 8140 Manual.

Exceptions to this requirement shall require approval from Command CSWF Program Manager (PM) and shall not exceed a six (6) month duration to become compliant with the requirements of this contract. All Contractor personnel providing services under this contract shall comply with all NAVAIR and DON IA policies and guidance where applicable and any training or certification required to comply with this directive is at the expense of the Contractor.

3.2.7.4. On-Boarding and Transition

The Contractor, upon the on-boarding of new employees in designated CSWF positions or transition of an existing employee to an alternate position with a different identified CSWF code, shall provide the Government the substantiating documents to demonstrate compliance with the identified CSWF code in the time frame as defined in Section 3.4.

3.2.7.5. Qualification and Certification Continued

For those positions with recurring requirements to maintain qualification/certification, the Contractor shall make available to the Government to review the substantiating documents to demonstrate continued compliance IAW the required schedule of the identified CSWF code.

3.2.7.6. Security Clearance Re-Verification

The Contractor shall, for all designated CSWF personnel, provide a reverification of the individual’s security clearance on no less than a quarterly basis. This shall be documented as part of the System Authorization Access Request CDRL A007.

3.2.7.7. Cyber Incident Response

The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 24-hour reporting period, reference https://dibnet.dod.mil/portal/intranet/), deliver all data used in performance of the contract that the Offeror determines is impacted by the incident and begin assessment of potential warfighter/program impact.

Incident data shall be delivered IAW the Department of Defense Cyber Crimes Center (DC3).

Reference https://www.dc3.mil/Organizations/DIB-Cybersecurity/DIB-Cybersecurity-DCISE/

In delivery of the incident data, the Contractor shall, to the extent practical, remove Contractor-owned information from Government covered defense information.

If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The Contracting Officer will approve or disapprove the request after coordination with DC3.

3.2.7.8. Naval Criminal Investigative Service (NCIS) and Industry Monitoring In the event of a cyber-incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the NCIS and associated law enforcement agencies, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, or vendor logs that show network activity, including any additional logs the Contractor, subcontractor, or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor shall cooperate with the NCIS to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets.