Attachment J-1 MUSV SoW.pdf

i

Statement of Work (SOW) for

Medium Unmanned Surface Vessel (MUSV)

March 2026 ii

Table of Contents

1. Scope

2. Applicable Documents

3. General Requirements

4. Program Manager

5. Cybersecurity Support and Physical Security

6. System Security Plan

7. Prototype Taskings

1. Scope

One of the primary purposes of this Statement of Work (SOW) is to award a prototype OT Agreement to perform and successfully complete an MUSV autonomy and vessel performance test.

2. Applicable Documents

The following documents and publications form a part of this SOW to the extent cited herein. Unless otherwise specified, the applicable documents are revisions in effect at the time of contract award.

2.1. Government Documents

• N/A

2.2. Other Government Documents

• NIST SP 800-171 Rev. 3 - Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

• National Industrial Security Program 32 Code of Federal Regulations (CFR) Part 117

• NATO STANAG 4194 - Standardized Wave and Wind Environments and Shipboard Reporting of Sea

Conditions MIL-STD-130N (1)

2.3. Non-Government Publications

• 1972 COLREGs - Convention on the International Regulations for Preventing Collisions at Sea

• American Bureau of Shipping Rules, Guides, and Standards (ABS)

• ISO 1161-2016

• ISO 668-2020

Code of Federal Regulations can be viewed at http://www.ecfr.gov/cgi-bin/ECFR?page=browse.

3. General Requirements

3.1. Post Award Conference (CLIN 0001)

3.1.1. Within 30 days of award, the Contractor shall attend a Post Award Conference (PAC). The PAC shall be less than 6 hours in length and shall be in the Washington DC Metropolitan Area hosted by the Government. The exact date and address will be provided to the Contractor at least two (2) weeks prior to the PAC. The Contractor shall cover the test plan detail, schedule, and information on the production vessel solution during the PAC.

3.2. MUSV Autonomy and Vessel Performance Test (CLIN 0002)

4. Program Manager

4.1. The Contractor shall designate a Program Manager that will be accountable and responsible for all work conducted within this Agreement and ensure that all work is planned, designed and executed in a manner that will achieve all management; hull, mechanical, electrical, propulsion controller, software and auxiliary support equipment; product support including integration; and budget and schedule objectives

4.2. Data Management

4.2.2. The Contractor shall furnish data deliverable(s) as required by this SOW, Exhibit A, and J-attachments, attached hereto. The Contractor shall maintain all deliverables provided to the Government and all deliverables associated with this Agreement for the duration of this Agreement. All deliverables shall be delivered through DoD SAFE or email to the agreements officer and agreements officer representative.

4.2.3. The Contractor shall store technical and product data for the prototype system(s) and subsystems. Technical data includes deficiency reports, test schedules, and associated test procedures and test results. Product data includes the baseline definition and configuration of the test USV, specifications of the MUSV, interface control documentation, supportability procedures, and commercial item descriptions. The Contractor shall maintain all product and technical data provided to the Government and all deliverables associated with this Agreement for the duration of this Agreement.

4.2.4. The Contractor shall use the applications outlined below for delivering documents to the Government, unless specified otherwise in the applicable CDRL requirements. The applications shall be compatible with the latest Government-approved revisions or as previously coordinated with and approved by the Government.

Table 1: Government Approved Application and File Formats Word Processing Microsoft Word® Spreadsheets Microsoft Excel® Presentation Software Microsoft PowerPoint® Engineering/Test Data Native

5. Cybersecurity Support and Physical Security

CDRL Deliverables: C001 – Contractor’s Systems Security Plan

5.1. The Contractor shall fully implement the CUI Security Requirements and associated Relevant Security

Controls in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171) or establish an SSP and POAM that varies from NIST 800-171 in accordance with the terms of the Agreement for all covered contractor information systems affecting this contract.

6. System Security Plan

6.1. The Contractor shall complete and deliver a System Security Plan in accordance with CDRL C001

6.2. The Contractor shall, within fifteen (15) calendar days of discovering a cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

6.3. Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at:

http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx.

6.4. If the Contractor subsequently identifies data not previously delivered to DC3, then the Contractor shall immediately notify the Agreements Officer in writing and shall deliver the incident data within ten (10) calendar days of identification. In such a case, the Contractor may request a delivery date later than ten (10) calendar days after identification. The Agreements Officer will approve or disapprove the request after coordination with DC3.

6.5. In the event of a cyber incident or at any time the Government indicates a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor’s infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including additional logs the contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

6.6. If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor’s information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

7. Prototype Taskings

CDRL Deliverables: E001 – Test Report

7.1. The Contractor shall successfully complete the MUSV Test Event and meet or exceed all test criteria in Attachment J-5 (test criteria to be provided at prototype OT award). The Contractor shall perform the MUSV Test Event in accordance with Attachemnt J-5 MUSV test plan.

7.2. During the PAC, the Contractor shall request approval from the Government for use of its test USV in the MUSV Test Event. The Contractor is only authorized to commence the MUSV test event with a Government-approved test USV and in accordance with Attachemnt J-5 test plan. The Contractor shall accomplish the MUSV Test Event and submit the test report no later than September 30, 2026.

7.3. The Contractor shall provide all labor, travel, vessel(s), test range, material, facilities, tooling, supplies and equipment necessary to perform the MUSV Test Event.

7.4. The Contractor shall be responsible for the test USV and associated support vessel operations, launch and recovery, certifications, insurances, relocations, storage, repair, and maintenance through completion of the Agreement.

7.5. The Contractor shall complete MUSV Test Events beginning and ending out of a port in the Continental United States.

7.6. The Contractor shall develop, provide, and make available copies of all final test plans, test procedures and test schedules to the Government fourteen (14) days prior to the start of the test.

7.6.5. The Contractor shall notify the AO and the AOR no later than twenty-one (21) days before the start of the MUSV Test Event via e-mail.

7.7. The Contractor shall allow Government representatives to inspect the test USV no less than fourteen (14) days before the start of the MUSV Test Event. The Contractor shall allow and provide accommodation (e.g., office space, parking, facility access, internet and telephone communication) for six (6) Government representatives to witness the tests. During the test, the Contractor must allow for three (3) Government representatives at the remote C2 station(s) and three (3) Government representatives on either the chase vessel(s) or the test USV.

7.7.6. The Contractor shall prepare and deliver a Test Report (CDRL E001) to the Government.

ACRONYM LIST

ABS American Bureau of Shipping ACS Autonomous Control System AO Agreements Officer AOR Agreements Officer Representative C2 Command and Control

CDRL

CFR

Contract Data Requirements List Code of Federal Regulations

CLIN Contract Line Item Number COLREGS Convention on the International Regulations for Preventing Collisions at Sea

CUI

DC3

Controlled Unclassified Information Defense Cyber Crimes Center

DoD Department of Defense EO Electro-Optic MUSV Medium Unmanned Surface Vessel NCIS Naval Criminal Investigative Service PAC Post Award Conference PM Program Management POAM Plan of Action and Milestones PSM Product Support Manager RMF Risk Management Framework SOW Statement of Work SSP System Security Plan USV Unmanned Surface Vessel