BEAR ECU Statement of Work (SOW).pdf

DISTRIBUTION STATEMENT A. Approved for public release: Distribution is unlimited.

22 April 2025

Statement of Work (SOW) for

BEAR Environmental Control Unit (ECU)

Prepared by

AFLCMC/ROZ SUPPORT EQUIPMENT & VEHICLES

235 BYRON STREET

BLDG 300 WEST WING, BAY D, SUITE 27A

ROBINS AFB GA 31098-1813

THIS PAGE HAS BEEN INTENTIONALLY LEFT BLANK

TABLE OF CONTENTS

1. SCOPE

2. APPLICABLE DOCUMENTS

2.1 Government documents

2.1.1 Specifications, standards, and handbooks

2.1.2 Other Government documents, drawings, and publications

2.2 Non-Government publications

2.3 Order of precedence

3. DEFINITIONS

3.1 Controlled Unclassified Information (CUI)

3.2 Loss of Government property

3.3 Risks

4. REQUIREMENTS

4.1 Program management

4.1.1 Common Access Card (CAC)

4.1.2 Access to Government systems

4.1.3 Controlled Unclassified Information (CUI)

4.1.4 Data delivery and transfer

4.1.5 Program manager

4.1.6 Plant access

4.1.7 Monthly status report

4.1.8 Integrated Master Plan (IMP)

4.1.9 Integrated Master Schedule (IMS)

4.2 Conferences and program reviews

4.2.1 Postaward conference

4.2.2 System Engineering Technical Reviews (SETRs)

4.2.2.1 Design reviews

4.2.2.1.1 Design review location and schedule

4.2.2.1.2 Design review content

4.2.2.2 Test Readiness Review (TRR)

4.2.2.3 SETR documentation

4.2.3 Program Management Reviews (PMRs)

4.2.4 Production Readiness Review (PRR)

4.2.5 Conference room

4.2.6 Meeting agendas

4.2.7 Meeting minutes

4.3 Systems engineering

4.3.1 Environment, Safety, and Occupational Health (ESOH)

4.3.1.1 System safety

4.3.1.2 Hazardous materials

4.3.2 Corrosion control

4.3.3 Risk management

4.4 Logistics

4.4.1 Technical Order (TO) requirements

4.4.2 Provisioning

4.4.2.1 Provisioning Guidance Conference (PGC)

4.4.3 Training and familiarization

4.5 Testing and evaluation

4.5.1 Design analysis

4.5.2 Test support

4.5.3 First article test

4.5.3.1 First article test procedures

4.5.3.2 First article testing

4.5.3.3 First article test daily situation reports (SITREPs)

4.5.3.4 Compatibility testing

4.5.3.5 First article test report

4.5.4 Restoration

4.5.5 Disposition

4.5.6 Conformance test

4.6 Configuration management

4.6.1 Configuration requirements

4.6.1.1 Baselines

4.6.1.1.1 Functional baseline

4.6.1.1.2 Allocated baseline

4.6.1.1.3 Product baseline

4.6.1.2 Production release

4.6.2 Engineering Change Proposals (ECPs)

4.6.3 Request for Variance (RFV)

4.7 Cybersecurity

4.7.1 Cybersecurity analysis

4.7.2 Risk management framework (RMF)

4.7.3 Cybersecurity security controls design, integration, and testing

4.7.4 Supply Chain Risk Management (SCRM)

1. SCOPE

This document defines the tasks associated with the procurement of the BEAR ECU as described by PD25WRROZ001 and is to be used in conjunction with PD25WRROZ001.

2. APPLICABLE DOCUMENTS

The following documents are applicable to the SOW to the extent specified herein.

2.1 Government documents.

2.1.1 Specifications, standards, and handbooks. The following specifications, standards, and handbooks of the exact revision listed below form a part of this SOW to the extent specified herein.

FEDERAL STANDARDS

FED-STD-313F Material Safety Data, Transportation Data, and Disposal Data for Hazardous Materials Furnished to Government Activities

DEPARTMENT OF DEFENSE STANDARDS

MIL-STD-882E(1) System Safety MIL-STD-1568E Materials and Processes for Corrosion Prevention and

Control in Aerospace Weapons Systems

2.1.2 Other Government documents, drawings, and publications.

DATA ITEM DESCRIPTIONS (DIDs)

DI-MGMT-80004A Management Plan DI-SAFT-80101C System Safety Hazard Analysis Report (SSHAR) DI-MISC-80508B Technical Report/Study Services DI-NDTI-80603A Test Procedure DI-SESS-80639E Engineering Change Proposal (ECP) DI-SESS-80640E Request for Variance (RFV) DI-SESS-80642E Notice of Revision (NOR) DI-NDTI-80809B Test/Inspection Report DI-ILSS-80872 Training Materials DI-SESS-81248B Interface Control Document (ICD) DI-ADMN-81249C Meeting Agenda DI-ADMN-81250C Meeting Minutes DI-MFFP-81403B Corrosion Prevention and Control Plan DI-SAFT-81626 System Safety Program Plan (SSPP) DI-SESS-81757A Design Review Information Package (DRIP)

DI-SESS-81758A Logistics Product Data DI-MGMT-81861C Integrated Program Management Data and Analysis Report

(IPMDAR)

DI-SESS-81874 Engineering Data for Provisioning (EDFP) DI-MGMT-81928 Contractor's Progress and Status Report DI-MGMT-82001A DoD Risk Management Framework (RMF) Package

Deliverables DI-SESS-82019 Product Baseline Index (PBLI) DI-MGMT-82140A Cybersecurity Test Plan DI-MGMT-82142A Naval Aviation Cybersecurity Test Report DI-MGMT-82133 Requirements Traceability Verification Matrix (RTVM) DI-MGMT-82256A Supply Chain Risk Management (SCRM) Plan DI-SESS-82304 Systems Architecture Deliverable DI-SESS-82380 Model Based Systems Engineering (MBSE) Development

Plan (MDP)

(Copies of these documents are available online at http://quicksearch.dla.mil/.)

DEPARTMENT OF DEFENSE GUIDES

(no identifier) Department of Defense Risk, Issue, and Opportunity Management Guide for Defense Acquisition Programs, dated September 2023

DEPARTMENT OF DEFENSE MANUALS

TM-86-01R Air Force Technical Manual Contract Requirements

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

SP 800-37 Rev. 2 Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy

SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and Organizations

SP 800-171 Rev. 2 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations [including updates as of 01-28-2021]

(Copies of this document are available online at https://nvlpubs.nist.gov/.)

PURCHASE DESCRIPTIONS

PD25WRROZ001 BEAR Environmental Control Unit (ECU) http://quicksearch.dla.mil/ https://nvlpubs.nist.gov/

2.2 Non-Government publications. The following documents of the exact revision listed below form a part of this document to the extent specified herein.

SAE International

GEIA HB-0007B Logistics Product Data Handbook

(Application for copies should be addressed to SAE International, Inc., 400 Commonwealth Drive, Warrendale PA 15096, http://www.sae.org/.)

2.3 Order of precedence. In the event of a conflict between the text of this document and the references cited herein, the text of this document takes precedence. Nothing in this document, however, supersedes applicable laws and regulations unless a specific exemption has been obtained.

3. DEFINITIONS

3.1 Controlled Unclassified Information (CUI). CUI is defined as unclassified information that laws, regulations, or Government-wide policies allow for, or require, safeguarding.

3.2 Loss of Government property. Unintended loss of or damage to Government property including property that cannot be found after a reasonable search, loss due to inadequate storage, loss due to lack of security, theft, damage requiring repair to restore the item to usable condition, or damage that renders the property useless for its intended purpose or Beyond Economical Repair (BER). Loss of Government property does not include manufacturing defects, obsolescence, normal wear and tear, or purposeful destructive testing. Unless otherwise stated in the contract/order, loss of Government property does not include normal and reasonable inventory adjustments, that is, losses of low priority consumable material, such as common hardware, as agreed to by the contractor and the Government Property Administrator.

3.3 Risks. Potential future events or conditions that may have a negative effect on achieving program objectives for cost, schedule, and performance.

4. REQUIREMENTS

4.1 Program management.

4.1.1 Common Access Card (CAC). The contractor shall ensure a CAC is obtained by all contractor/subcontractor personnel who require access to Department of Defense (DoD) computer networks/systems, for DoD facility entry control, and/or for physical access to facilities and buildings to perform tasks under the contract/order. The contractor shall provide a list of contractor/subcontractor personnel who require a CAC to the Procuring Contracting Officer (PCO). The Government will provide the contractor instructions on how to complete a Contractor Verification System (CVS) application and notify the contractor of approval/disapproval of contractor/subcontractor personnel application.

http://www.sae.org/

Contractor/subcontractor personnel shall obtain the CAC from the local Real Time Automated Personnel Identification Documentation System (RAPIDS) issuing facility (usually the Military Personnel Flight (MPF)).

The contractor shall notify the PCO of any change to the list of contractor/subcontractor personnel who require a CAC and provide an updated list within seven calendar days. The contractor shall immediately (within the same day) report a lost or stolen CAC to the PCO. The contractor shall return any issued CAC to the PCO within seven calendar days once contractor personnel no longer require computer network/system access. The contractor shall return any and all CACs to the PCO within seven calendar days after completion/termination of the contract.

4.1.2 Access to Government systems. The procuring activity will provide and/or arrange contractor personnel access to system(s) necessary to perform tasks under the contract/order. The contractor shall ensure contractor personnel who require access to an unclassified Government computer network/system have the appropriate background check or security investigation conducted. The procuring activity will provide and/or arrange system access subject to approval of the DD Form 2875, System Authorization Access Request (SAAR). Upon completion/termination of the contract/order or transfer/termination of contractor personnel, the contractor shall ensure the system account(s) are closed.

4.1.3 Controlled Unclassified Information (CUI). CUI is defined as unclassified information that laws, regulations, or Government-wide policies allow for, or require, safeguarding. Knowledge and/or generation of CUI is required for performance of the contract/order. This SOW governs work that contains the development and transfer of CUI between contractors and the United States (U.S.) Government. All CUI shall be controlled until authorized for public release. The contractor shall ensure personnel, information, system, property, and facility security requirements are met. The contractor shall comply with Government security regulations including, but not limited to, Department of Defense (DoD) 5200.2-R, Personnel Security Program; DoD 5220.22-M; DoD Directive (DoDD) 5205.02E, DoD Operations Security (OPSEC) Program; and DoD Manual 5205.02-M, DoD Operations Security (OPSEC) Program Manual to protect Government interests. Determine if Cybersecurity Maturity Model Certification (CMMC) is required and what level. The contractor shall ensure the security of any Information Technology (IT) environment at the contractor's facility that hosts CUI. The contractor shall maintain a cyber-secure environment for all components of a non-federal IT system that processes, stores, and/or transmits CUI as defined in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 to preclude potential security incidents or violations including potential unauthorized disclosure or compromise of CUI. Contractors shall ensure their employees have been trained in the proper marking of CUI; authorized and approved training material will be provided to the contractor prior to contract award. The contractor shall ensure that all personnel handling CUI associated with this contract have been properly trained, have been approved to handle CUI, have a valid need to handle CUI, and shall safeguard any CUI in their possession at all times. The contractor shall maintain a cyber-secure IT environment that reduces and manages risk by meeting the intent of Cybersecurity Maturity Model Certification (CMMC) Level I. The contractor shall also take necessary precautions and actions to ensure that the IT environment for any software development is secure and free of malware and malicious code. The contractor shall report any cyber incidents to the Government in accordance with DFARS Clause 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) as applicable.

4.1.4 Data delivery and transfer. To promote effective schedule management, email shall be utilized to the maximum extent possible for tasks identified in this SOW. Department of Defense (DoD) Secure Access File Exchange (SAFE) shall be the secondary (backup) electronic data exchange, located at https://safe.apps.mil/, and utilized when temporary circumstances do not permit use of AF365 Teams.

4.1.5 Program manager. The contractor shall identify to the Government and maintain a single point of contact (program manager) for all matters under this contract. The contractor shall also ensure that all program management personnel assigned to the program shall be available, as required, to meet program objectives.

4.1.6 Plant access. The contractor shall arrange for full access to applicable contractor facilities and offices by Government representatives conducting any business, making observations, or performing inspections required by public law or by this contract.

4.1.7 Monthly status report. The contractor shall track program progress and document such via monthly status reports. The contractor shall submit a monthly status report that shall cover the engineering and technical development of the system and subsystems as well as a projection of planned work for the remaining effort. Reports shall document tasks, issues, actions, and deliverables. Problem areas shall be identified with proposed solutions and outcomes. The current program Integrated Master Schedule (IMS) (see 4.1.9); and risk management analysis, mitigation plan, and tracking (see 4.3.3) shall be provided as attachments to the monthly status report. (DI-MGMT-81928, Contractor's Progress and Status Report)

4.1.8 Integrated Master Plan (IMP). The contractor shall implement and maintain the proposed IMP for this program. (DI-MGMT-80004, Management Plan)

4.1.9 Integrated Master Schedule (IMS). A baseline IMS shall be developed at the start of the program in accordance with 1.2.2 of DI-MGMT-81861. The contractor shall implement and maintain the IMS using the original baseline schedule as an unchanging reference. The IMS shall be provided in both Microsoft Project and PDF formats as an attachment to the monthly status report (see 4.1.7). (DI-MGMT-81861, Integrated Program Management Data and Analysis Report (IPMDAR))

4.2 Conferences and program reviews. Throughout the Period of Performance (POP) of the contract, conferences, meetings, and technical or programmatic reviews may be supplemented with a virtual environment as directed by the Procuring Contracting Officer (PCO) if travel restrictions, safety measures, or other program specifics prevent or limit the number of in-person attendees. Virtual meetings can utilize, but shall not be limited to, AF365 Teams. The contractor shall adhere to any Federal, State, or local health and well-being regulations and guidelines for contractor-hosted in-person gatherings with Government personnel.

4.2.1 Postaward conference. The Government will convene a postaward conference with the contractor at the contractor's facility, Robins AFB, or AF365 Teams within 60 calendar days after contract award. The PCO will coordinate the actual date, time, and location of the conference with the contractor.

4.2.2 System Engineering Technical Reviews (SETRs).

4.2.2.1 Design reviews.

4.2.2.1.1 Design review location and schedule. The contractor shall conduct a preliminary design review (PDR) and a critical design review (CDR). The design reviews shall be held at at the contractor's facility. The PCO will coordinate the actual date and time of the reviews with the contractor.

4.2.2.1.2 Design review content. The PDR and CDR shall include formal technical reviews of the proposed design; program risks shall be reviewed on a technical and schedule basis. Each review shall include, but is not limited to, preliminary calculations; any necessary design studies or analyses including the design analysis (see 4.5.1); preliminary drawings, including equipment layout drawings (packaging), proprietary or restricted design processes, components, and information; electrical and mechanical design; environmental control; thermal design aspects;

software design; training materials; lists of materials, parts, and processes; human engineering elements; corrosion control; maintainability; production capability and manufacturing; and quality considerations. Final drawings, final calculations, and any mockups or any assemblies shall be made available for the Government review as well. All applicable comments from the PDR shall be incorporated into the CDR design documentation.

4.2.2.2 Test Readiness Review (TRR). The contractor shall conduct a TRR 14 calendar days prior to the start of the test. The TRR shall assess test objectives, test methods and procedures, scope of tests, and determine if required test resources have been properly identified and coordinated to support planned tests. The TRR shall be held at at the contractor's facility. The PCO will coordinate the actual date and time of the TRR with the contractor.

4.2.2.3 SETR documentation. The contractor shall prepare all necessary detailed status reports for the SETR meetings, Meeting Agendas, and Meeting Minutes. The contractor shall prepare formal documentation of the PDR, CDR, and TRR. (DI-ADMN-81249, Meeting Agenda; DI- ADMN-81250, Meeting Minutes; DI-SESS-81757, Design Review Information Package (DRIP);

DI-MISC-80508, Technical Report - Study/Services)

4.2.3 Program Management Reviews (PMRs). The contractor shall participate in and support all reviews, audits, and meetings as requested by the PCO or the contractor. PMRs shall be conducted quarterly or as required at a mutually agreeable location or via AF365 Teams. (DI- ADMN-81249, Meeting Agenda; DI-ADMN-81250, Meeting Minutes)

4.2.4 Production Readiness Review (PRR). A PRR shall be conducted to ensure the contractor is ready to begin production. The PRR shall include an evaluation of the contractor's manufacturing readiness processes, quality management system, production planning (that is, facilities, tooling and test equipment capacity, personnel development and certification, process documentation, inventory management, supplier management, etc.). Unless otherwise specified or directed by the PCO, the PRR shall be conducted at the contractor's facility within 30 days following procuring activity approval of the test report.

4.2.5 Conference room. The contractor shall provide a conference room suitable for meetings of up to other Government representatives, plus contractor personnel, in support of scheduled meetings at the contractor's facility. The conference room shall support AF365 Teams access for virtual attendees.

4.2.6 Meeting agendas. The contractor shall publish an agenda for all meetings and conferences specified in 4.2.2 - 4.2.4. The contractor shall request from the Government any items or issues to be discussed or presented at the meetings and shall include such items in the agenda. Agendas shall be submitted not less than seven calendar days prior to any meeting. (DI-ADMN-81249, Meeting Agenda)

4.2.7 Meeting minutes. The contractor shall provide a written record of the discussions, decisions, and action items identified at each meeting. Minutes shall include presentation material. (DI-ADMN-81250, Meeting Minutes)

4.3 Systems engineering.

4.3.1 Environment, Safety, and Occupational Health (ESOH).

4.3.1.1 System safety. The contractor shall establish, conduct, document, and maintain a system safety program in accordance with MIL-STD-882. The contractor shall document their approach for analyzing, eliminating, or minimizing ESOH hazards during all phases of the program. The contractor shall initiate changes in the system design based on safety analysis results such that the associated risk is reduced to a level acceptable to the Government. An initial system safety hazard analysis shall be provided 14 calendar days prior to the PDR; updated versions of the analysis shall be provided 14 calendar days prior to the CDR, 14 calendar days prior to the TRR, and with the test report. (DI-SAFT-81626, System Safety Program Plan (SSPP); DI-SAFT- 80101, System Safety Hazard Analysis Report (SSHAR))

4.3.1.2 Hazardous materials. The contractor shall manage hazardous materials, including those embedded in the system or used during operation or maintenance, as an element of the Systems Engineering process. The system shall not generate or use Class I or Class II Ozone Depleting Substances (ODS) during operation, maintenance, or disposal. The use of hexavalent chromium is also prohibited. The contractor shall list any hazardous materials to be delivered under this contract, including locations, quantities, and special handling and disposal procedures. This information shall be documented in the design analysis (see 4.5.1) and reviewed at the technical reviews; it shall be in accordance with FED-STD-313.

4.3.2 Corrosion control. The contractor shall establish, conduct, document, and maintain a corrosion prevention control program; it shall be documented in a corrosion prevention and control plan in accordance with 4.1 of MIL-STD-1568. The initial corrosion prevention and control plan shall be provided 14 calendar days prior to the PDR; the second submission of the plan shall be provided 14 calendar days prior to the CDR. (DI-MFFP-81403, Corrosion Prevention and Control Plan)

4.3.3 Risk management. The contractor shall develop, implement, and conduct a risk management program; criteria can be found in the Department of Defense Risk, Issue, and Opportunity Management Guide for Defense Acquisition Programs. Risks are potential future events or conditions that may have a negative effect on achieving program objectives for cost, schedule, and performance. Risks are defined by (1) the probability (greater than 0, less than 1) of an undesired event or condition and (2) the consequences, impact, or severity of the undesired event, were it to occur. The risk management process model includes the following activities, performed on a continuous basis:

a. Risk Identification,

b. Risk Analysis,

c. Risk Mitigation Planning,

d. Risk Mitigation Plan Implementation, and

e. Risk Tracking.

Risk identification, risk analysis, risk mitigation planning, risk mitigation plan implementation, and risk tracking shall be included as an attachment to the monthly status report (see 4.1.7).

4.4 Logistics.

4.4.1 Technical Order (TO) requirements. The contractor shall develop and deliver technical manuals in accordance with TM-86-01. No production BEAR Environmental Control Unit (ECU) will be accepted prior to Government approval of the technical manuals. (TM-86-01, Air Force Technical Manual Contract Requirements)

4.4.2 Provisioning. The contractor shall identify and recommend logical spare/repair parts sufficient to meet system/equipment operation and supportability in accordance with the Air Force Initial Provisioning Performance Specification (IPPS). GEIA-HB-0007B (Logistics Product Data Handbook) should be used as a guide. The format shall be consistent with existing Government Provisioning data system (D220). The following DIDs apply:

a. DI-SESS-81758, Logistics Product Data. Specific Logistics Product Data to be submitted:

i. Provisioning Parts List (PPL) Top-down sequence

ii. Design Change Notices (DCNs)

iii. Statement of Prior Submission (SPS)

iv. Long Lead Items List (LLIL)

b. DI-SESS-81874, Engineering Data For Provisioning (EDFP).

(DI-SESS-81758, Logistics Product Data; DI-SESS-81874, Engineering Data For Provisioning

(EDFP))

4.4.2.1 Provisioning Guidance Conference (PGC). A Provisioning Guidance Conference (PGC) shall be scheduled by the Prime Provisioning Activity (PPA) and should be held within 45 days after receipt of contract in conjunction with the postaward conference. The PGC is normally held at AFGLSC PPA for approximately two days to ensure both the contractor and the Government understand the provisioning requirements on contract. If a PGC is not desired, the contractor shall submit a written request for waiver of the PGC to the PPA. In the event a waiver is approved, a mutual understanding of the Provisioning requirements shall be communicated in some forum in which the AFMC Form 718 (Provisioning Performance Schedule (PPS)) shall be documented/completed, signed by both the Government and contractor, and a contract modification issued, if required. (DI-ADMN-81249, Meeting Agenda; DI-ADMN-81250, Meeting Minutes)

4.4.3 Training and familiarization. Training shall be provided so that users and maintainers can operate and maintain the BEAR Environmental Control Unit (ECU) properly. Video training shall be provided with each unit on a CD/DVD-ROM. Video training in the CD/DVD-ROM shall have multiple videos labeled according to the specific tasks for easy search. A hard copy of the training manual shall be supplied with each unit; an electronic copy of the training manual shall also be provided on the video training CD/DVD-ROM. The training manual shall contain written descriptions and procedures with images that explains step by step how to operate and maintain the unit. A copy of all training materials shall be provided to and approved by the procuring activity prior to providing with each unit. (DI-ILSS-80872, Training Materials)

4.5 Testing and evaluation.

4.5.1 Design analysis. A design analysis of the system and each subsystem shall be performed to verify compliance with this SOW and each applicable requirement of the PD. The analysis shall include, but is not limited to, environmental and hazardous material management (see 4.3.1.2);

an electrostatic discharge analysis (see 4.X.X of the PD); a service life analysis (see 4.X.X of the PD); a snow load analysis (see 4.X.X of the PD); a surface transportability analysis (see 4.X.X of the PD); an air transportability analysis (see 4.X.X of the PD); a tie down provision analysis (see 4.X.X of the PD); and a lifting provision analysis (see 4.X.X of the PD). A Material Safety Data Sheet (MSDS) shall be provided for each hazardous material identified for use in the program (see 4.3.1.2). (Note that the system safety hazard analysis is addressed in 4.3.1.1.) An initial design analysis shall be provided 14 calendar days prior to the PDR; updated versions of the analysis shall be provided 14 calendar days prior to the CDR, 14 calendar days prior to the TRR, and with the test report. (DI-MISC-80508, Technical Report - Study/Services)

4.5.2 Test support. The contractor shall ensure common repair parts are available during all phases of testing specified herein so that failures do not delay the test beyond the repair time required to return the equipment to serviceable condition. In the event that one or more replacement parts are required to repair a failure, the contractor shall ship the part(s) to the test location via “same day” or “overnight” service at the direction of the procuring activity. Copies of the latest draft TOs shall be available for Government use during compatibility testing and operational test and evaluation.

4.5.3 First article test.

4.5.3.1 First article test procedures. The contractor shall develop detailed test procedures, which shall address all requirements identified in the PD and this SOW, except for the compatibility testing (see 4.5.3.4). The test procedures shall include data record sheets, charts, graphs, identification of test instruments by manufacturer, model number, and serial number. The test procedures shall address modeling and simulation (M&S); if M&S is not applicable, the test procedures shall be so noted. (DI-NDTI-80603, Test Procedure)

4.5.3.2 First article testing. After Government approval of the first article test procedures, the contractor shall schedule the testing to be conducted. If shipping is required to move the item(s) to and from a test site away from the contractor’s facility, the contractor shall be responsible for all costs associated with the shipment. The contractor shall notify the Government of the date, time, and location of first article testing 30 calendar days prior to the start of testing. The test will be witnessed by one or more Government representatives.

4.5.3.3 First article test daily situation reports (SITREPs). Throughout the first article test, the contractor shall submit a daily situation report (SITREP) that shall cover all monitored daily test activities. Examples are:

a. Test logs.

b. Observed data to include: Observations, comments, anomalous conditions, or other items completed for each first article unit.

c. Recorded data as applicable to the type of equipment.

d. Records of preventive maintenance activities performed.

(DI-MGMT-81928, Contractor's Progress and Status Report)

4.5.3.4 Compatibility testing. During the first article test, a test item shall be shipped to {TBD} for compatibility testing in accordance with {paragraph number} of the PD. Air Force personnel will perform the test and any required maintenance; contractor personnel shall witness the test and maintenance and advise the Air Force personnel. At the conclusion of the compatibility test, the test item shall be shipped to the contractor's facility. The contractor shall be responsible for all costs associated with shipping the item to the compatibility test location and returning it to the contractor's facility.

4.5.3.5 First article test report. The contractor shall submit a first article test report upon completion of the first article test. The test report shall document all testing performed, including results of any unsuccessful test attempts. Failure reports generated as a result of the FRACAS process (see 4.5.4 of the PD) shall be included with results of unsuccessful test attempts. (DI- NDTI-80809, Test/Inspection Report)

4.5.4 Restoration. After completion of first article acceptance, the first article BEAR ECUs shall be shipped, within 30 calendar days, to the contractor's facility for restoration. The contractor shall be responsible for any repairs that may be necessary to restore the first article BEAR ECUs to a serviceable, "like new" condition while retaining configuration integrity. The contractor shall be responsible for all costs associated with shipping of the first article BEAR ECUs to the contractor's facility for restoration.

4.5.5 Disposition. The approved units shall be shipped to the location(s) specified in the contract.

4.5.6 Conformance test. The contractor shall test each production item in accordance with {Conformance Test Para} of the PD utilizing a subset of the first article test procedures.

4.6 Configuration management.

4.6.1 Configuration requirements.

4.6.1.1 Baselines.

4.6.1.1.1 Functional baseline. The functional baseline is PD.

4.6.1.1.2 Allocated baseline. All of the documents used to produce and define the configuration at the conclusion of the TRR shall constitute the allocated baseline.

4.6.1.1.3 Product baseline. All of the documents used to produce and define the accepted units shall be identified in a Product Baseline Index (PBLI). The list shall identify the applicable version number as required. (DI-SESS-82019, Product Baseline Index (PBLI))

4.6.1.2 Production release. Production release is acknowledgment by the procuring activity that the contractor has satisfied all requirements to proceed with delivery of hardware to be furnished under the contract. The contractor assumes all risks in initiating production before the test report and TOs have been delivered and approved by the procuring activity.

4.6.2 Engineering Change Proposals (ECPs). Notwithstanding any other provision in the contract, no contractor or subcontractor's change in design, fabrication, assembly, part, material, process, or source of supply shall be made to the allocated or product baseline unless such change is submitted in writing by ECP and approved by the procuring activity. Any request for change shall be accompanied by complete documentation supporting the need for the change. A system safety impact statement shall be provided as part of the submittal; it shall quantify and qualify the system safety risk identified and how it impacts the system safety risk already identified for the system. A Notice of Revision (NOR) shall be submitted with each ECP. Should the Government approve an ECP, the contractor shall be responsible for submitting updated TOs and the system safety hazard analysis report (see 4.3.1.1) to reflect the changes made in the ECP.

(DI-SESS-80639, Engineering Change Proposal (ECP); DI-SESS-80642, Notice of Revision

(NOR)).

4.6.3 Request for Variance (RFV). The contractor shall prepare an RFV whenever a departure from the contractually-specified base line is proposed for a specific number of units or for a specific time. (DI-SESS-80640, Request for Variance (RFV))

4.7 Cybersecurity. The contractor shall implement cybersecurity in accordance with Department of Defense Instruction (DoDI) 8500.01, DoDI 8510.01, and AFI 17-101. The contractor shall provide cybersecurity support to include, but not limited to, engineering and technical analysis and assessment of system cybersecurity, development and delivery of Risk Management Framework (RMF) artifacts, and design, integration, testing, and documentation of implemented cybersecurity controls. The contractor shall include cybersecurity activities and events on the IMS. The contractor shall address technical details of cybersecurity requirements as part of applicable SETRs.

4.7.1 Cybersecurity analysis. The contractor shall perform an engineering analysis and risk and technical assessment of system cybersecurity for each end item. The engineering analysis shall include, but not be limited to, system hardware and software architecture, I/O data flow, supply chain integrity, and operational conditions as it relates to system cybersecurity. The contractor shall perform a comprehensive risk assessment based on the system cyber vulnerabilities and threats. The contractor shall also conduct analysis for any commercial-off-the-shelf and/or non-developmental items to ensure that they are appropriately configured, software, hardware and firmware is controlled, and any unique risks they pose are mitigated. (DI-MISC-80508, Technical Report - Study/Services, Cybersecurity Analysis)

4.7.2 Risk management framework (RMF). The contractor shall develop and deliver the required artifacts for the Platform Information Technology (PIT) Assessment and Authorization (A&A) package to meet the intent and requirements of DODI 8510.01 and AFI 17-101 for RMF implementation. The contractor shall utilize NIST SP 800-37, NIST SP 800-53, and applicable overlays in addressing the security controls associated with the various artifacts. The contractor shall include cybersecurity RMF activities and events on the IMS. (DI-MGMT-82001, DoD RMF Package Deliverables)

4.7.3 Cybersecurity security controls design, integration, and testing. The contractor shall provide design, integration, and testing support for system modification(s) of hardware and/or software solutions to mitigate or resolve cybersecurity risks for given vulnerabilities and threats.

The contractor shall conduct all specified SETRs to adequately convey the approach to requirements analysis, design, integration, and testing. The contractor shall define and develop test programs, plans, and procedures, witness and support or conduct testing, evaluate and/or document the results of testing and evaluation for cybersecurity of components, subsystems and/or systems, and associated software. (DI-MGMT-82140, Cybersecurity Test Plan; DI- MGMT-82142, Naval Aviation Cybersecurity Test Report)

4.7.4 Supply Chain Risk Management (SCRM). An SCRM plan or strategy shall be developed to address risks such as obsolescence of hardware components or software, as well as the integrity of the supply chain, to include hardware sources and software development and distribution. (DI- MGMT-82256, Supply Chain Risk Management (SCRM) Plan)

Spares Technical Manual TM 86-01 Provisioning Training Color designation

The following table is deleted after the CDRLs are constructed.

Data Item No. Title of Data Item Subtitle Contract Reference

DI-ADMN-

81249 Meeting Agenda SOW Para 4.2.2.3, 4.2.3, 4.2.6, 4.4.2.1

DI-ADMN-

81250 Meeting Minutes SOW Para 4.2.2.3, 4.2.3, 4.2.7, 4.4.2.1

DI-ILSS-

80872 Training Materials SOW Para 4.4.3

DI-MFFP-

81403

Corrosion Prevention and Control Plan

SOW Para 4.3.2

DI-MGMT-

80004 Management Plan Integrated Master

Plan (IMP) SOW Para 4.1.8

DI-MGMT-

81861

Integrated Program Management Data and Analysis Report

(IPMDAR)

Integrated Master Schedule (IMS) SOW Para 4.1.9

DI-MGMT-

81928

Contractor's Progress and Status Report

Daily Situation Report (SITREP) SOW Para 4.5.3.3

DI-MGMT-

81928

Contractor's Progress and Status Report

Monthly Status Report SOW Para 4.1.7

DI-MGMT-

82001 DoD RMF Package Deliverables SOW Para 4.7.2

DI-MGMT-

82140 Cybersecurity Test Plan SOW Para 4.7.3

DI-MGMT-

82142

Naval Aviation Cybersecurity Test Report

SOW Para 4.7.3

DI-MGMT-

82256

Supply Chain Risk Management (SCRM) Plan

SOW Para 4.7.4

DI-MISC-

80508 Technical Report - Study/Services Cybersecurity

Analysis SOW Para 4.7.1

DI-MISC-

80508 Technical Report - Study/Services Design Analysis SOW Para 4.5.1

DI-MISC-

80508 Technical Report - Study/Services Test Readiness

Review (TRR) SOW Para 4.2.2.3

DI-NDTI-

80603 Test Procedure First Article Test

Procedure SOW Para 4.5.3.1

DI-NDTI-

80809 Test/Inspection Report First Article Test

Report SOW Para 4.5.3.5

Data Item No. Title of Data Item Subtitle Contract Reference

DI-SAFT-

80101

System Safety Hazard Analysis Report (SSHAR)

SOW Para 4.3.1.1

DI-SAFT-

81626 System Safety Program Plan (SSPP) SOW Para 4.3.1.1

DI-SESS-

80639 Engineering Change Proposal (ECP) SOW Para 4.6.2

DI-SESS-

80640 Request for Variance (RFV) SOW Para 4.6.3

DI-SESS-

80642 Notice of Revision (NOR) SOW Para 4.6.2

DI-SESS-

81757

Design Review Information Package

(DRIP)

SOW Para 4.2.2.3

DI-SESS-

81758 Logistics Product Data SOW Para 4.4.2

DI-SESS-

81874

Engineering Data For Provisioning

(EDFP)

SOW Para 4.4.2

DI-SESS-

82019 Product Baseline Index (PBLI) SOW Para 4.6.1.1.3

TM-86-01 Air Force Technical Manual Contract Requirements

SOW Para 4.4.1