CMRS FY26 PWS - draft.pdf

PERFORMANCE WORK STATEMENT (PWS)

CLARINET MERLIN RECEIVING SYSTEM (CMRS)

MAINTENANCE AND SUPPORT FOR

COMMANDER, NAVAL INFORMATION FORCES

1.0 GENERAL

This is a non-personnel services contract to provide Commander, Naval Information Forces (NAVIFOR) maintenance and support of the Clarinet Merlin Receiving System (CMRS).

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform maintenance and support to the CMRS as defined in this Performance Work Statement (PWS). The contractor shall meet the standards in this contract.

1.2 Background: CMRS supports the Submarine Emergency Communications System.

1.3 Objectives:

Maintain the CMRS in a high state of readiness Provide BCA Operator training to include concept of operations, procedures during a buoy activation, loss of connectivity and critical/non-critical failure reporting Ensure Information Assurance (IA) compliance by monitoring the Vulnerability Remediation Asset

Manager (VRAM) and reporting Information Assurance Vulnerability Management (IAVM) compliance in VRAM and the Enterprise Mission Assurance Support Service (eMASS) IAW NAVWAR and US CYBERCOM directives and maintaining the CMRS Authority to Operate (ATO).

Assured Compliance Assessment Solution (ACAS) scanning.

Service Life Extension Program (SLEP) III and Antenna Sensor updates ISO CMRS.

CMRS Reporting System Upgrades located at Naval Information Warfare Center (St. Julien’s Creek), Maintenance

Engineering Facility (MEF), and Longwave Lab.

1.4 Scope: NAVIFOR requires maintenance of the Clarinet Merlin receiving sites, BCA server sites, and associated hardware of the CMRS. This PWS describes the Government's objectives and requirements for the CMRS. The effort will include the maintenance of the entire CMRS including the receiving subsystems, interface/display equipment, BCA operator training, and testing and updates of applicable Information Assurance Vulnerability Managements (IAVMs) and ACAS scanning at each site. SLEP III and Antenna sensor updates at specific locations. St. Julien’s Creek NIWC Lab upgrades as required.

1.5 Period of Performance: The period of performance shall be for one (1) Base Period of 12 months and four (4) 12-month option years and one (1) six-month option to extend services in accordance with FAR 52.217-8.

1.6 General Information

1.6.1 Quality Assurance: The Government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards.

1.6.2 Place of Performance: The majority of the work to be performed under this contract will be performed at the Maintenance Engineering Facility (MEF), the Long Wave Inc. lab, St. Julien’s Creek and the CMRS sites.

Required travel includes Hawaii, Alaska, Virginia, Portugal, United Kingdom, and Guam.

Tasks may also be performed at other Government sites and contractor facilities.

1.6.3 Type of Contract: The Government will award a Firm-Fixed-Price (FFP) contract.

1.6.4 Security Requirements: Contractor personnel performing work under this contract must have a Top-Secret clearance at time of the proposal submission and must maintain the level of security required for the life of the contract. The security requirements are in accordance with the attached DD254.

1.6.4.1 Physical Security: The contractor shall be responsible for safeguarding all Government equipment, information and property provided for contractor use. The contractor shall ensure that their location is approved for the handling and storage of classified information/material up to and including the Top-Secret classification.

1.6.4.2 Cyber Security Workforce Qualifications:

In accordance with DFARS 252.239-7001, Information Assurance Contracting Training and Certification herein and DOD Manual (DODM) 8140.03, all personnel performing Cyber IT/Cybersecurity functions must be trained and qualified. In addition, personnel should maintain the appropriate security clearance per SECNAV M-5510.30 to perform the tasks associated with their assigned positions.

The contractor shall:

1. Earn and maintain appropriate credentials from the Cyber IT/CSWF Qualification Matrix (described in DODM8140.03) associated with the specialty area and proficiency level commensurate with the scope of major assigned duties for the position and tasking being performed.

2. Participate in continuous learning (CL) program as described in SECNAVINST 1543.2. All contractor support personnel supporting IA tasking shall at a minimum complete 40 hours of Cyber IT/CSWF related continuous learning (CL) annually. The baseline qualifications for each specialty area/proficiency level are identified in DODM8140.03. If privileged access to Operating Systems is required, the contractor shall complete a privileged access agreement, SECNAV 5239/1, and submit it to the COR (Attachment 11). Contractor personnel shall obtain the appropriate DON approved baseline job qualification standard prior to being engaged. Contractors have up to 6 months to obtain any additional qualifications required for their position to include but not be limited to applicable operating system/computing environment training if required. A copy of the certificate of completion shall be provided to the COR. Per SECNAVINST 1543.2 all responsibility for training that is required for the contractor to maintain a specific expertise, commercial certification, or continuous learning is the sole responsibility of the contractor employee and or the contractor’s employer.

3. Contractors shall use DODM8140.03, specifically with regards to vendor certifications. At that time education and military training may be used regarding contractor qualifications.

Cyber Security Workforce Reporting

The contractor shall provide a list of all personnel assigned to the contract personnel performing Cyber IT/Cybersecurity functions as a part of monthly reporting. The report shall include employee name, list of applicable Cyber IT/Cybersecurity function category/level, required certifications and fulfillment status and CL status.

1.6.5 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The Contracting Officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will appraise the contractor of how the Government views the contractor's performance and the contractor will appraise the Government of problems, if any, being experienced. Appropriate action should be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.6.6 Contracting Officer Representative (COR): The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of Government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially regarding changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.7 Key Personnel: The following personnel are considered key personnel by the Government:

a. CMRS Program Manager.

The contractor shall provide a CMRS Program Manager who shall be responsible for the performance of the work.

The name of this person shall be designated in writing to the contracting officer. The program manager shall have full authority to act for the contractor on all matters relating to daily operation of this program. Qualifications for all key personnel are listed below:

1.6.7.1 The CMRS Program Manager must have 10 years’ experience working in electronics systems maintenance in the communications field or possess equivalent military experience at the rank of E7 or above, and 5 years direct CMRS operations and maintenance experience.

1.6.8 Contractor Travel: Contractor will be required to travel to support maintenance and training at the BCA’s and CMRS receiving sites. Contractor shall be responsible for all costs, administrative paperwork, ticketing, etc.

associated with all travel required.

2.0 DEFINITIONS AND ACRONYMS

2.1 DEFINITIONS

2.1.1 Broadcast Control Authority (BCA) Sites: The Government sites identified in paragraph 1.6.2.

2.1.2 CMRS or "The System": The entire system includes all CMRS receiver sites, all the equipment at the receiver sites, and the BCAs.

2.1.3 Contractor: A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.4 Contracting Officer: A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

2.1.5 Contracting Officer's Representative (COR): An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such an appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.6 Defective Service: A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.7 Deliverable: Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

2.1.8 Key Personnel: Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the people that are listed in the proposal.

2.1.9 Physical Security: Actions that prevent the loss or damage of Government property.

2.1.10 Quality Assurance: The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.11 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.12 Quality Control: All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.13 Receiver Sites: The Government remote sites identified in paragraph 1.6.2.

2.1.14 Receiver System: The equipment is located at each receiver site.

2.2. ACRONYMS:

Ao Operational Availability ACAS Assured Compliance Assessment Solution ATO Authority to Operate BCA Broadcast Control Authority C&A Certification and Accreditation CFR Code of Federal Regulations CMRS Clarinet Merlin Receiving System COMSUBLANT Commander, Submarine Force, Atlantic COMSUBPAC Commander, Submarine Force, Pacific CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTS Commercial-Off-the-Shelf DD250 Department of Defense Form 250 (Receiving Report) DD254 Department of Defense Contract Security Requirement List DFARS Defense Federal Acquisition Regulation Supplement DOD Department of Defense DON CIO Department of the Navy Chief Information Office FAR Federal Acquisition Regulation FFP Firmed-Fixed-Price FRD Fleet Readiness Directorate IA Information Assurance IAVA Information Assurance Vulnerability Alerts MEF Maintenance Evaluation Facility NAVIFOR Naval Information Forces KO Contracting Officer OCONUS Outside Continental United States (includes Alaska and Hawaii) OCRS Online Compliance Reporting System PIPO Phase In/Phase Out POC Point of Contact PWS Performance Work Statement QA Quality Assurance QASP Quality Assurance Surveillance Plan SLEP Service Life Extension Program SME Subject Matter Expertise SPAWAR Space and Naval Warfare Command SS Sole-Source SUBOPAUTH WAN Submarine Operating Authority Wide Area Network TE Technical Exhibit

3.0 GOVERNMENT FURNISHED ITEMS AND SERVICES

3.1 Equipment. The Government will provide the necessary antennas and CMRS connectivity to the SUBOPAUTH WAN via a GFE router located at each CMRS receiving and BCA site.

4.0 CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES

4.1 General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Section 3 of this PWS.

4.2 Top Secret Clearance: The Contractor employees performing work in support of this contract shall have been granted a Top-Secret security clearance from the Defense Industrial Security Clearance Office in accordance with the DD254.

4.3 Materials: The Contractor shall furnish materials, supplies, and equipment necessary to meet the requirements under this PWS.

5.0 SPECIFIC TASKS

5.1. Basic Services and Operation: The Contractor shall provide maintenance and support to the CMRS and will insure the CMRS meets or exceeds its Operational Availability (Ao) of 95%.

5.2 Performance: The contractor shall maintain the CMRS in a high state of readiness. All work performed shall be performed in a timely and efficient manner, during the period of performance specified.

5.2.1 The contractor shall maintain an Ao of each CMRS site (BCA and Receiver) at 95% or greater where:

Ao = Uptime/ (Uptime + Downtime) X 100

Downtime is any condition that prevents reception of any CMRS data on any CMRS frequency at any CMRS station from reaching the operator at the BCA or any condition that degrades information presented to the operator on status or any condition that reduces the operator's ability to control the system.

5.2.2 The contractor shall notify the COR, within 24 hours of the detection of a failure. The contractor shall provide the COR with a report of each failure within 30 days of each event. The report shall include:

a. Date / Time failure detected

b. Component that failed

c. Corrective action taken

d. Time to repair

5.2.3 The contractor shall provide periodic (quarterly or in conjunction with a maintenance visit) BCA operator training to include concept of operations, procedures during a buoy activation, loss of connectivity and critical/non-critical failure reporting.

5.2.4 The contractor shall test and install corrections for Information Assurance Vulnerability Alerts (IAVA) in accordance with references 6.1 (b) and (c).

5.2.5 The contractor shall acknowledge and report IAVA compliance in VRAM, and eMASS in accordance with Department of the Navy, Chief Information Office (DON CIO) direction for Information Assurance (IA) management.

5.2.6 The contractor shall provide subject matter expertise (SME) assistance to PMW-770 specialists as required to maintain the CMRS ATO (i.e., development of Certification and Accreditation (C&A) documentation, support of test events, collaboration meetings, etc.).

5.2.7 The contractor shall scan each location with the approved ACAS scanning software and provide a report of the results and a POA&M to mitigate the discrepancies to the COR within 30 days of each event.

5.2.8 The contractor shall notify the Government, in a timely manner, of any anticipated system changes (i.e., hardware, software, connection, etc.).

5.3 Planning: The contractor shall develop a management plan that includes points of contact and responsibilities for all key members of the CMRS team, system description including functional description, functional block diagram, requirements, allocation of requirements to functional blocks, interface control diagram and description, and product numbers.

5.4 Contract Management Plan: A Contract Management Plan shall be submitted to the COR within 90 days of contract award. The plan shall contain the following information at a minimum:

a) Contract summary

b) Identification of contact management team

c) Roles and responsibilities

d) Contract management process

5.5 Monthly Activity Report: The Monthly Activity Report shall be submitted to the COR not later than the 10th of each month. The report shall contain the following information at a minimum:

a) Summary status (include activity for past month, Information Assurance Vulnerability Status, equipment failures, training conducted, etc.)

b) Action Status (include failure summary, plans for next reporting period, etc.)

c) Availability calculations

d) Considerations requiring Government involvement

5.5.1 Trip Report: The Trip Report shall be submitted to the COR not later than the 15 days from return of a trip.

The report shall contain the following information at a minimum:

a. Summary (include overview of trip, actions taken)

b. Action Status (include any pending actions required)

5.5.2 Trouble Report: A Trouble Report shall be submitted to the COR within 30 days of an equipment failure. The report shall contain the following information at a minimum:

a. Date / Time failure detected

b. Component that failed

c. Corrective action taken

d. Date / Time of repair

5.5.3 IAVA Plan of Action and Milestones: A CMRS IAVA Plan of Action and Milestones (POA&M) shall be submitted on a template provided by the Government to the NAVWAR PMW-770 and entered in eMASS as required. The template shall contain the following information.

a. IAVA number

b. Number of units patched

c. Projected test and compliance date

d. VRAM Mitigation Plan ID number

e. Date mitigation plan entered in VRAM

5.5.4 Assured Compliance Assessment Solution (ACAS). At a minimum the contractor shall.

a. Validate the CMRS baseline software using the Assured Compliance Assessment Solution (ACAS) tool to verify the CMRS is compliant with the most current Security Technical Implementation Guide (STIG) requirements.

b. Perform a weekly scan on the system located within the contractor’s facility and upload scan results to eMASS monthly per NAVWAR directives

c. Scan the Fielded CMRS in conjunction with the quarterly maintenance cycle. Upload the scan results to eMASS quarterly per NAVWAR directives.

Monitor the NAVWAR Vulnerability Remediation Asset Manager (VRAM) Web site on a weekly basis for newly released IA vulnerabilities. A Mitigation Plan will be entered into VRAM for all applicable IAVAs. Applicable IAVAs will be downloaded and tested and then IAW the quarterly patching strategy.

REQUIREMENT DUE DATE

CMRS Management Plan 90 Days after contract award Monthly Status Report NLT 10th of each month Trip Reports NLT 15 days after return Trouble Reports As required (see para 5.2.2.)

PAO&M Reports (SPAWAR FRD) As required ACAS Scans to VRAM As Required ACAS POA&M As Required

5.5.5 Service Life Extension Program (SLEP) III and Antenna Sensor updates ISO CMRS

a. The contractor will upgrade obsolete hardware and software as they reach end of life/end of support.

b. The contractor will update drawings and configurations databases as applicable.

c. The contractor will provide updated information to PMW-770 to maintain/update the ATO.

5.5.6 TRAVEL AUTHORIZATION REQUEST

a. The contractor shall provide notification to the COR and contracting officer in writing no later than thirty days prior to the start of travel to a location where personnel are ordered to a mandatory self-quarantine period or Restriction of Movement ROM) for self-monitoring.

b. Contractor will provide a detailed cost breakout to include all costs associated with the requested travel.

6.0 APPLICABLE PUBLICATIONS

6.1. References:

a. NAVCYBERFORINST C2008.1 Policy and Procedures for the Clarinet Merlin Communications System, 07 Sep 10

b. DoDD 8500.1E, Information Assurance (IA), 24 Oct 02

c. DoDI 8500.2, Information Assurance Implementation, 6 Feb 03

7.0 SERVICE CONTRACT REPORTING (SCR)

Services Contract Reporting (SCR) requirements apply to this contract. The contractor shall report required SCR data fields using the SCR section of the System for Award Management (SAM) at following web address:

https://sam.gov/sam/.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://sam.gov/sam/.

8.0 TECHNICAL EXHIBIT 1

DELIVERABLES SCHEDULE

Deliverable Frequency # of Copies Medium/Format Submit

To CMRS Management Plan 90 Days after contract award Original 90 days after contract award

Microsoft Office compatible format

COR

Monthly Status Report Monthly One soft copy NLT 10th of each month

Microsoft Office compatible format

COR

Trip Reports As Required One soft copy NLT 15 days after return

Microsoft Office compatible format

COR

Trouble Reports As required (see para 5.2.2)

One soft copy Microsoft Office compatible format

COR

IAVM Non-compliance Reports (SPAWAR FRD)

As Required One soft copy OCRS Website and Microsoft Office compatible format

COR and

FRD

ACAS Scans to VRAM As Required One soft copy Microsoft Office compatible format

COR

ACAS POA&M As Required One soft copy Microsoft Office compatible format

COR