Attachment J-07 - Compliance Documents List.docx

H95001-15-R-0001 Attachment J-07 Compliance Documents Applicable Directives / Regulations The following Directives / Regulations are applicable to all task orders issued under the contract. Tailoring, as necessary, may be done at the task order level.

The IRES contractor shall comply with all directives listed. If there is any conflict between the directive and the Task Order Statement of Objective (SOO) or Contractor Performance Work Statement (CPWS), the SOO takes precedence. If a referenced directive requires compliance with one or more secondary directives, those secondary directives are to be consider guidance in the execution of the SOO requirements unless specifically included in the task order SOO or this attachment. When directive chapters, paragraphs, appendices, attachments, etc. are referenced as a standard (STD) in a Task Order, the STD shall be inclusive of all subordinate paragraphs unless specifically excluded. For example, if the STD lists paragraph 1.2 and paragraph 1.2 has subparagraphs 1.2.1, 1.2.1.1 and 1.2.1.2, those subparagraphs are directive.

The contractor shall stay up to date on all directive updates. Contractor execution shall comply with the current version of the directives. The contractor shall notify the Contracting Officer in writing within 30 days of directive revision, change, supplement, and/or rescission. If there is any cost impact resulting from such revisions, changes, supplements and rescissions the contractor shall provide the cost information with the notification; increases or decreases in the negotiated task order cost / price will not become effective until directed by the Contracting Officer. If the Contracting Officer is not notified in writing within 30 days, the contractor shall perform in accordance with directive revisions, changes, supplements and rescissions at no increase to the negotiated task order cost / price. The Contracting Officer retains the right to negotiate downward revisions to the negotiated task order cost / price should the Government become aware of decreases in requirements as a result of modifications to directives.

1. DoDD 5400.11, DoD Privacy Program, 29 Oct 2014

2. DoDD 8000.01, Management of the Department of Defense Information Enterprise, 10 Feb 2009

3. DoDD 8100.02, Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG), 14 Apr 2004

4. DoDD O-8530.1, Computer Network Defense (CND), 8 Jan 2001

5. DoDI 4140.01, DoD Supply Chain Material Management Policy, 14 Dec 2011

6. DoDI 5205.13, Defense Industrial Base Cyber Security / Information Assurance Activities, 29 Jan 2010

7. DoDI 6055.1, DoD Safety and Occupational Health (SOH) Program, 14 Oct 2014

8. DoDI 8310.01, Information Technology Standards in the Department of Defense, 2 Feb 2015

9. DoDI 8420.01, Commercial Wireless Local Area Network (WLAN) Devices, Systems, and Technologies, 3 Nov 2009

10. DoDI 8500.01, Cybersecurity, 14 Mar 2014

11. DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), 12 May 2014

12. DoDI 8520.2, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, 24 May 2011

13. DoDI O-8530.2, Support to Computer Network Defense (CND), 9 Mar 2001

14. DoDI 8540.01, Cross Domain (CD) Policy, 8 May 2015

15. DoDI 8551.01, Ports, Protocols and Services Management (PPSM), 28 May 2014

16. DoDI 8580.1, Information Assurance (IA) in the Defense Acquisition System, 9 Jul 2004

17. DoDI 8581.01, Information Assurance Policy for Space Systems Used by the Department of Defense, 8 Jun 2010

18. DoDI 8582.01, Security of Unclassified Department of Defense Information on Non-Department of Defense Information Systems, 6 Jun 2012

19. DoD 5000.04-M-1, Cost and Software Data Reporting (CSDR) Manual, 4 Nov 2011

20. DoD O-8530.1-M, Computer Network Defense (CND) Service Provider Certification and Accreditation Process, 17 Dec 2003

21. DoD 8570.01-M, Information Assurance Workforce Improvement Program, 24 Jan 2012

22. DoD 5220.22-M, National Industrial Security Program Operating Manual, 28 Mar 2013

23. DoD 5015.02-STD, Electronic Records Management Software Applications Design Criteria Standard, 25 Apr 2007

24. MDA 3000.02, Ballistic Missile Defense System Asset Management Scheduling, Planning and Execution

25. MDA 3200.06, Missile Defense Test Data, 6 Nov 2013

26. MDA 3200.07, Test and Experiment Event Notification, 17 Dec 2010

27. MDA 5000.15, Ballistic Missile Defense System Requirements Traceability Process, 8 Mar 2013

28. MDA 5200.01, Security Policy, 10 Jun 2012

29. MDA 8110.01, Privacy Program, 13 Nov 2006

30. MDA 8180.01, Enterprise Records Management, 21 May 2015

31. MDA 8400.01, Sustainable Electronics Management Program, 11 Apr 2010

32. MDA 3058.01-INS, Risk Management, 15 Apr 2011

33. MDA 3200.08-INS, Test and Experiment Viewing, 6 May 2011

34. MDA 5003.01-INS, Ballistic Missile Defense System Earned Value Management, 26 Jul 2011

35. MDA 5004.01-INS, Ballistic Missile Defense System Integrated Baseline Reviews, 6 Jul 2011

36. MDA 5200.02-INS, Information Security Program, 14 Apr 2014

37. MDA 5200.08-INS, Critical Program Information Protection within the Missile Defense Agency, 1 Aug 2011

38. MDA 5205.02-INS, Operations Security Program, 15 Aug 2014

39. MDA 5230.01-INS, MDA Foreign National Visits, Assignments, and Event Participation at the Missile Defense Agency, 26 January 2012

40. MDA 5230.02-INS, MDA International Security, 3 April 2014

41. MDA 6055.01 - INS, Safety and Occupational Health (SOH) Program Management, 23 Jul 2012

42. MDA 6055.02-INS, Accident and Mishap Safety Investigations and Reporting, 22 May 2013

43. MDA 6055.04-INS, Work Time Restrictions for Safety and/or Mission Critical Personnel Supporting Tests and Critical Operations, 27 Aug 2012

44. MDA 8400.01-INS, Sustainable Electronics Management Program, 26 Dec 2014

45. MDA 8590.01-INS, Handling Formerly Restricted Data In Information Systems Controlled By Missile Defense Agency Organizations, 11 May 2012

46. MDA 4640.01-M, Telecommunications Management, 31 Mar 2014

47. MDA 5003.01-M, Ballistic Missile Defense System Earned Value Management Contract Requirements, 17 Feb 2012

48. MDA 5004.01-M, Ballistic Missile Defense System Integrated Baseline Reviews, 17 Feb 2012

49. MDA 5200.08-M, Procedures for Protection of Critical Program Information and Mission Critical Functions and Components within the Missile Defense Agency, 7 Nov 2013

50. MDA 5210.01-M, Physical Security Program, 8 Oct 2013

51. MDA Plan 8500.02-P, Information Assurance Program Plan, 3 Oct 2007

52. MDA Policy Memorandum No. 12, MDA Director’s Safety Policy, 10 May 2013

53. MDA Policy Memorandum No. 51, Organizational Conflict of Interest, 30 May 2012

54. MDA Policy Memorandum No. 68, Securing Ballistic Missile Defense Information on Non-Government Sponsored Contractor Networks and Systems, 10 Apr 2013

55. MDA Policy Memorandum No. 69, Securing Ballistic Missile Defense Information on Government and Government Sponsored Networks and Systems, 10 Apr 2013

56. MDA Policy Memorandum No. 70, Supply Chain Risk Management, 10 Apr 2014

57. MDA Policy Memorandum No. 71, Appropriately Marking MDA Unclassified Information as For Official Use Only, 29 Apr 2013

58. MDA Policy Memorandum No. 73, Quality, Safety, and Mission Assurance Directorate Access Authority, 16 Sep 2013

59. MDA Directive Memorandum 001-2015, Insider Threat Program

60. MDA-QS-001, Missile Defense Agency Assurance Provisions (MAP) Rev B, 7 May 2015

61. MDA Information Management Processes and Information Technology Operations, MDA, 28 May 2003

62. MDA Information Technology Disaster Management Plan v3.1, MDA/ICT, May 2014

63. MDA IT Mission Support Facilities Design Guide, MDA/ICT, 3 Feb 2009

64. MDA User Accounts and Password Management Guidance, MDA/ICT, 24 Aug 2007

65. MDA CIO Use and Control of Wireless Mobile Devises in MDA Facilities, MDA/ICT, 8 Oct 2013

66. MDA Directory Services Naming Conventions, MDA/ICT, 22 Feb 2007

67. Executive Order 13514, Federal Leadership in Environmental, Energy, and Economic Performance, 5 Oct 2009

68. DoD ASD(NII) Memorandum, Clarifying Guidance Regarding Open Source Software (OSS), 16 Oct 2009

69. CJCSI 6211.02D, Defense Information System Network (DISN): Policy, Responsibilities and Processes, 24 Jan 2012

70. CJCSI 6212.01F, Net Ready Key Performance Parameter (NR KPP), 21 Mar 2012

71. CJCSI 6510.01F, Information Assurance (IA) and Computer Network Defense (CND), 9 Feb 2011

72. CJCSI 6510.06C, Communications Security Releases to Foreign Nations, 8 Nov 2013

73. Strategic Command Directive (SD) 527-1, Department of Defense (DoD) Information Operation Condition (INFOCON) System Procedures, 27 Jan 2006

74. AFI 32-2001, Fire and Emergency Services Program, 27 Feb 2014

75. AFI 32-7086, Hazardous Materials Management, 4 Feb 2014

76. AFI 63-101_20-101, Integrated Life Cycle Management, 7 Mar 2013

77. AFI 90-803, Environmental, Safety, and Occupational Health Compliance Assessment and Management Program (ESOHCAMP), 24 Mar 2010

78. AFI 90-821, Hazard Communication (HAZCOM) Program, 27 Jan 2014

79. AFH 32-1024, Standard Facility Requirements, 14 Jul 2011

80. 50th Space Wing Host Tenant Support Agreement, FB2502-14110-0221, 20 Apr 2014

81. National Security Telecommunications and Information Systems Security Policy No. 11 (NSTISSP 11), Jul 2003

82. CFR, Title 29, Subtitle B, Chapter XVII, Occupational Safety and Health Administration, parts 1910, 1926, and 1960, 21 Oct 1980

83. NSA Guidance for Addressing Malicious Code Risk, 10 Sep 2007

84. MIL-STD-882E, System Safety, May 2011

85. MIL-STD-46855A, Human Engineering Program, Processes and Procedures, 24 May2011

86. MIL-HDBK-61A, Configuration Management Guidance, 7 Feb 2001

87. Guidelines for Facility Design & Red/Black Installation, NACSIM 5203, NSTISSAM TEMPEST/2-95, 12 Dec 1995

88. Consensus Standard for Configuration Management, ANSI/EIA-649-B

89. National fire Protection Association (NFPA) 70E, Standards for Electrical Safety in the Workplace, 2015

90. International Plumbing Code (IPC), 2015

91. International Building Code (IBC), 2015

92. National Electrical Code (NEC), 2014

93. Intelligence Community Directive (ICD) 704, Personnel Security Standards and Procedures, 1 Oct 2008

94. Unified Facilities Criteria (UFC) 4-010-01, DoD Minimum Antiterrorism Standards for Buildings, 1 Oct 2013

95. Department of Defense (DoD) Enterprise Service Management Framework (DESMF), Edition II, 08 Nov 2013

96. Department of Defense Information Enterprise Architecture (DoD IEA), Version 2.0, Volume I – Management Overview of the DoD IEA, Jul 2012

97. Department of Defense Information Enterprise Architecture (DoD IEA), Version 2.0, Volume II – IEA Description, Jul 2012

98. Federal Enterprise Architecture Framework, Version 2, 29 Jan 2013

May 10, 2016 Page 3 MDA PM 51, Organizational Conflicts of Interest.pdf

GC

DEPARTMENT OF DEFENSE

MISSILE DEFENSE AGENCY

5700 1 8 T H STREET

FORT BELVOIR, VIRGINIA 22060·5573

POLICY MEMORANDUM NO. 21

MEMORANDUM FOR ALL MDA PERSONNEL

SUBJECT: Organizational Conflicts of Interest

MAY 3 0 2012

This memorandum establishes the Missile Defense Agency's policies pertaining to organizational conflicts of interest (OCis ). This revised policy memorandum supersedes Policy Memorandum No. 51, dated July 27,2009.

OCis can deprive the Agency ofthe independent, objective advice of its supporting contractors. OCis occur when a contractor may be unable to provide impartial advice or assistance, when its objectivity in performing a contract is impaired, or when it may obtain an unfair competitive advantage. A contractor can obtain an unfair competitive advantage by obtaining access to non-public information (to include proprietary, budgetary, and acquisition planning information) or when it is in a position to favor its own products or services. Key OCI principles have been promulgated in Federal Acquisition Regulation (FAR) Subpart 9.5 and have been enforced by protest decisions of the Government Accountability Office and the Court of Federal Claims. Consequently, it is critical that the Agency adhere to these processes and procedures in the FAR and this policy memorandum.

As a matter of general policy, contractors which provide advisory and assistance services to the Agency, particularly in the engineering, acquisition support, and quality functional areas, cannot develop or support the development of the Agency's research and development (R&D) efforts. This separation of contractual responsibilities is critical to ensuring the Agency obtains the independent, objective adviye it requires, particularly in establishing requirements for our major R&D efforts and in evaluating the performance of contractors which perform those requirements. While some contractors may be able to provide subcontracting services to the Agency, their prime contractors will be required to demonstrate that the involvement of these subcontractors will not constitute an OCI or place them in a position of evaluating the services or performance of our developmental contractors.

As the Agency head, I retain the authority to grant waivers of bias-type OCis. I intend to exercise that authority in very limited circumstances and only when in the Government's interest.

Generally, temporary OCI waivers will be considered on a case-by-case basis for no more than six months to permit contractors to divest themselves of existing contracts or business units after contract award.

To preserve the integrity of our source selections, all participants shall be free from personal financial interests, to include those of members of their household, in any competitors.

Contractors and members of Federally Funded Research and Development Centers that will have access to proprietary information shall similarly have no fmancial interests in any of the competitors and be free of all OCis.

All Agency personnel shall take appropriate measures to prevent our supporting contractors from obtaining unfair competitive advantages by virtue of their access to nonpublic information. Discussions and development of acquisition strategy will be limited to an appropriate number of personnel. Contractors will be required to establish internal frrewalls and organizational separations to ensure that only employees supporting the Agency have access to nonpublic and sensitive Agency information, and that such information is not provided to other contractor employees or officials, unless the information is available publicly or its transmittal is authorized by the supporting contracting officer.

As the FAR vests responsibility for identifying, mitigating, and resolving OCis in our contracting officers, I expect all personnel to coordinate OCI issues with respect to specific procurements with their supporting contracting officers and legal counsel.

My point of contact for specific issues regarding OCis in the Office of General Counsel is Mr. Norbert Diaz, who can be reached at (256) 450-2806 or Norbert.Diaz@mda.mil.

IZdfJ ,~$ PATRICKJ.t"~~ Lieutenant General, USA Director image1.emf