CR SOW (V1).docx

-20 December 2022

Statement of Work (SOW) for

Computed Radiography (CR) System

Prepared by

SUPPORT EQUIPMENT AND VEHICLES PROGRAM OFFICE

235 BYRON ST STE 19A

ROBINS AFB GA 31098-1813

THIS PAGE HAS BEEN INTENTIONALLY LEFT BLANK

TABLE OF CONTENTS

2.2 Non-Government publications………………………………………………………………...7

3.1.4 Integrated master schedule (IMS)…………………………………………………………...7

3.2.5 Multi-user ECP Automated Review System (MEARS)…………………………………

3.3.3.4 Software………………………………………………………………………………….11

3.3.3.5.2 Software documentation……………………………………………………………….11

3.5.1 Restoration…………………………………………………………………………………13

3.5.2 Disposition…………………………………………………………………………………13

3.6.3 Production Release…………………………………………………………………………13

1. SCOPE

This document defines the tasks associated with the procurement of the Computed Radiography (CR) System as described by Commercial (Digital) Radiography Imaging System Purchase Description, PD22WRWNZE004.

2. APPLICABLE DOCUMENTS

The following documents are applicable to the Statement of Work (SOW) to the extent specified herein.

2.1 Government documents.

2.1.1 Specifications, standards, and handbooks. The following specifications, standards, and handbooks of the exact revision listed below form a part of this SOW to the extent specified herein.

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

NIST SP 800-37

NIST SP 800-53

Guide for Applying the Risk Management Framework to Federal Information Systems

Security and Privacy Controls for Federal Information Systems and Organizations

2.1.2 Other Government documents, drawings, and publications.

AIR FORCE INSTRUCTION (AFI)

(Copies of these documents are available online at http://www.e-publishing.af.mil/)

DEPARTMENT OF DEFENCE INSTRUCTIONS (DoDI)

DoDI 8510.01

Risk Management Framework (RMF) for DoD Information Technology (IT)

(Copies of this document are available online at http://www.e-publishing.af.mil/.)

COMMITTEE ON NATIONAL SECURITY SYSTEMS INSTRUCTION (CNSSI)

DATA ITEM DESCRIPTIONS (DIDs)

DI-ADMN-81249C

DI-ADMN-81250C

DI-AVCS-80700A NOT 1

DI-ILSS-80872 NOT 2

DI-IPSC-81442A NOT 2

DI-IPSC-82249A

DI-MGMT-81928 NOT1

DI-MGMT-82001A

DI-SCRE-82140

DI-MGMT-82142A

DI-MISC-80508B

DI-MISC-81454D

DI-SESS-80639E

DI-SESS-80640E

DI-SESS-80642E

DI-SESS-81758A NOT 1

DI-SESS-81874

Meeting Agenda Meeting Minutes Computer Software Product End Items Training Materials Software Version Description (SVD) Software Assurance Evaluation Report (SAER) Contractor's Progress and Status Report DoD Risk Management Framework (RMF) Package Deliverables Cybersecurity Test Plan Naval Aviation Cybersecurity Test Report Technical Report – Study/Services Computer Program Identification Number (CPIN) Catalog Information Engineering Change Proposal (ECP) Request for Variance (RFV) Notice of Revision (NOR) Logistics Product Data Engineering Data for Provisioning (EDFP)

(Copies of these documents are available online at http://quicksearch.dla.mil.)

DEPARTMENT OF DEFENSE MANUALS

DEPARTMENT OF DEFENSE HANDBOOKS

PURCHASE DESCRIPTION

2.2 Non-Government publications. The following documents of the exact revision listed below form a part of this document to the extent specified herein.

SOCIETY OF AUTOMOTIVE ENGINEERS (SAE)

(Application for copies should be addressed to SAE, Inc., 400 Commonwealth Drive, Warrendale PA 15096, http://www.sae.org/.)

2.3 Order of precedence. In the event of a conflict between the text of this document and the references cited herein, the text of this document takes precedence. Nothing in this document, however, supersedes applicable laws and regulations unless a specific exemption has been obtained.

3. REQUIREMENTS

3.1 Program management.

3.1.1 Program manager. The contractor shall identify to the Government and maintain a single point of contact (Program Manager) for all contractual matters under this contract. The contractor shall ensure that all program management personnel assigned to the program shall be available, as required to meet program objectives.

3.1.2 Plant access. The contractor shall arrange for full access to applicable contractor facilities and offices by Government representatives conducting any business, making observations, or performing inspections required by public law or by this contract.

3.1.3 Monthly status report. The contractor shall track program progress and document progress via monthly status reports. The contractor shall submit a monthly status report that shall cover a projection of planned work for the remaining effort. Reports shall document tasks, issues, actions, and deliverables. Problem areas shall be identified with proposed solutions and outcomes. (A004, DI-MGMT-81928, Contractor's Progress and Status Report)

3.2 Conferences and program reviews. Throughout the period of performance (POP) of the contract, conferences, meetings, and technical or programmatic reviews may be supplemented with a virtual environment as directed by the PCO if travel restrictions, safety measures, or other program specifics prevent or limit the number of in-person attendees. Virtual meetings can utilize, but shall not be limited to, AF365 Teams or Zoom. The contractor shall adhere to any Federal, State, or local health and well-being regulations and guidelines for contractor-hosted in-person gatherings with Government personnel.

3.2.1 Postaward conference. The Government will convene a postaward conference with the contractor virtually on-line via TEAMS or by telephone within 30 days after contract award. The Procuring Contracting Officer (PCO) will coordinate the actual date, time, and location of the conference with the contractor.

3.2.2 Program Management Reviews (PMRs). The contractor shall participate in and support all reviews, audits, and meetings as requested by the PCO. PMRs shall be conducted quarterly or as required via teleconferences.

3.2.3 Meeting agendas. The contractor shall publish an agenda for all meetings and conferences specified in 3.2.2. The contractor shall request from the Government any items or issues to be discussed or presented at the meetings, and shall include such items in the agenda. Agendas shall be submitted not less than five working days prior to any meeting. (A001, DI-ADMN-81249, Meeting Agenda)

3.2.4 Meeting minutes. The contractor shall provide a written record of the discussions, decisions, and action items identified at each meeting. Minutes shall include presentation material. (A002, DI-ADMN-81250, Meeting Minutes)

3.2.5 Multi-user ECP Automated Review System (MEARS). The contractor shall electronically deliver all contractual data specified herein using the Government-controlled method of delivery, MEARS, http://mears1.redstone.army.mil/mears/Default.aspx. The contractor shall work with the Government to ensure that an adequate number of contractor personnel obtain and possess Public Key Infrastructure (PKI) certification from an accepted Government source. The contractor shall be receptive to the training offered by the Government on the MEARS system. The contractor shall prepare, maintain, and track the contract data status, schedule and ensure timely data deliveries. If MEARS is down for maintenance, the contractor shall use an alternative method of the contractual data deliverables utilizing Defense Information Systems Agency (DISA), known as Department of Defense (DoD) SAFE, via http://safe.apps.mil/. The contractor shall obtain and possess PKI certification from an accepted Government source to access the DoD SAFE.

3.3 Systems engineering.

3.3.1 Hazardous materials. The contractor shall manage hazardous materials, including those embedded in the system or used during operation or maintenance, as an element of the Systems Engineering process. The system shall not generate or use Class I or Class II Ozone Depleting Substances (ODS) during operation, maintenance, or disposal. The use of hexavalent chromium is also prohibited. The contractor shall list any hazardous materials, as defined in AFI 327086, to be delivered under this contract, including locations, quantities, and special handling and disposal procedures.

3.3.2 Parts availability and use of parts brokers. The contractor shall not procure materials, systems, assemblies, subassemblies, or parts from parts brokers when available from Original Equipment Manufacturers (OEM) or their Authorized Distributors. In cases where materials, systems, assemblies, subassemblies, or parts are no longer available from the OEM or their Authorized Distributors, procurement from brokers may be authorized as defined by the contractor’s policy and their CPP. (Ref. 4.1.1, 4.1.2.e., and Appendix A of AS5553)

3.3.2.1 Procurement policies. The contractor shall implement policy directing development and implementation of business practices, procedures, and processes to prevent procurement of Counterfeit materials and parts.

3.3.2.2 Risk assessment. The contractor shall address the risk of using unknown sources and/or unauthorized suppliers in the CPP. Application or technical risk assessments shall establish the effect that counterfeit parts may have on in accordance with performance. Vendor or source of supply risk assessments shall establish the potential for obtaining counterfeit parts. Using any risk analysis tool acceptable to the Government, the contractor shall conduct a risk assessment based upon item characteristics and how likely it is that a counterfeit part will be received.

3.3.2.3 Detection and avoidance responsibilities. The contractor shall establish processes for the review and approval of contractor and applicable subcontractor systems for the detection and avoidance of counterfeit electronic parts and suspect counterfeit electronic parts, which processes shall be comparable to the processes established for contractor business systems under section 893 of the Ike Skelton National Defense Authorization Act for Fiscal Year 2011 (Public Law 111–383; 124 Stat. 4311; 10 U.S.C. 2302 note). The contractor shall flow down such requirements and processes to their subcontractors in accordance with ODASD Memo titled “Overarching DoD Counterfeit Prevention Guidance”, dated 16 March 2012. (Ref. AS5553, 4.1.4, 4.1.5, appendix E)

3.3.2.4 Testing and verification. The contractor shall establish and accomplish testing and verification processes for items not received from an original equipment manufacturer, original component manufacturer, or authorized distributor that is identified as having high risk for counterfeit potential. These processes apply to prime contracts, and to subcontracts or suppliers below the prime contracts. Submittal of Certificates of Compliance indicating the parts are not counterfeit shall be acceptable for verification of testing. (Ref. 4.1.4 and Appendix E of AS5553)

3.3.2.5 Configuration identification and traceability. The contractor shall identify and control the configurations of all systems, assemblies, subassemblies, and parts, and enable mechanisms to provide traceability of parts. The contractor shall report to the Government when control of the configurations of all systems, assemblies, subassemblies, and parts, and mechanisms to provide traceability of parts are not possible. The contractor shall identify the specific systems, assemblies, subassemblies, and parts beyond the contractors’ control. The contractor shall be responsible for detecting and avoiding the use or inclusion of counterfeit materials and parts, to include procured assemblies and subassemblies, in such products and shall be responsible for the rework or corrective action that may be required to resolve the use or inclusion of counterfeit materials and parts. The cost of counterfeit electronic parts and suspect counterfeit electronic parts and the cost of rework or corrective action that may be required to remedy the use or inclusion of such parts are not allowable costs under Department contracts, unless:

a. the contractor has established a counterfeit avoidance/detection system approved by the DoD,

b. the counterfeit parts were procured from a DoD-accredited trusted supplier or provided as Government property.

c. the contractor has provided timely notification to the Government. (Ref. 4.1.6 and Appendix F of AS5553)

3.3.2.6 Counterfeit notification and reporting. The contractor shall report in writing to the Procuring Activity within 30 days of determining any end item, component, part, or material contained in supplies purchased by the Department of Defense, or purchased by a contractor or subcontractor for delivery to, or on behalf of, the Department, contains counterfeit electronic parts or suspect counterfeit electronic parts for the purpose of investigation and notification of the Air Force Office of Special Investigations (AFOSI). The PCO will coordinate reporting to the appropriate Program Management/Item Management, System Engineering Management, the AFMC Discrepant Materiel Reporting Program (DMRP) Office in 406 SCMS/GULAB, and the AFOSI. Additionally, the contractor shall within the same 30 day period ensure all suspected or confirmed counterfeit items are entered into the Government-Industry Data Exchange Program (GIDEP) system, which will serve as the DoD central reporting repository. (Ref. 4.1.7 and Appendix G of AS5553)

3.3.2.7 Counterfeit prevention training. The contractor shall provide appropriate training and shall require all in accordance with personnel working procurement within their company, to include at a minimum their supply chain management specialists, receiving inspectors, and engineers, to complete said training. The contractor shall determine the appropriate training required. Training may be developed in-house or may be other Industry accepted training.

3.3.3 Cybersecurity. The contractor shall implement cybersecurity for the CR systems in accordance with DoDI 8500.01, DoDI 8510.01, and AFI 17-101. The contractor shall provide cybersecurity support to include, but not limited to, engineering and technical analysis and assessment of system cybersecurity, development and delivery of Risk Management Framework (RMF) artifacts, and design, integration, testing, and documentation of implemented cybersecurity controls.

3.3.3.1 Cybersecurity analysis. The contractor shall perform engineering analysis, for risk and technical assessment of system cybersecurity. The engineering analysis shall include, but is not limited to, system hardware and software architecture, input/output (I/O) data flow, supply chain integrity, and operational conditions as it relates to system cybersecurity. The contractor shall perform a comprehensive risk assessment based on the system cyber vulnerabilities and threats. The contractor shall conduct analysis for any commercial of-the-shelf (COTS) and/or non-developmental items to ensure that they are appropriately configured, software/hardware/firmware is controlled, and any unique risks they pose are mitigated. (B007, DI-MISC-80508, Technical Report/Study Services)

3.3.3.2 Risk management framework (RMF). The contractor shall develop and deliver the required artifacts for Platform Information Technology (PIT) Assessment and Authorization (A&A) package to meet the intent and requirements of DoDI 8510.01 and AFI 17-101 for RMF implementation. The contractor shall utilize Committee on National Security Systems Instruction (CNSSI) 1253, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37, NIST SP 800-53, and applicable overlays in addressing the security controls associated with the various artifacts. (B004, DI-MGMT-82001, DoD Risk Management Framework (RMF) Package Deliverables)

3.3.3.3 Cybersecurity testing. The contractor shall define and develop test programs, plans, and procedures, witness and support or conduct testing, evaluate and/or document the results of testing and evaluation for cybersecurity of components, subsystems and/or systems, and associated software. (B005, DI-SCRE-82140, Cybersecurity Test Plan; B006, DI-MGMT-82142, Naval Aviation Cybersecurity Test Report).

3.3.3.4 Software. The contractor shall develop and deliver a Software Assurance Evaluation Report (SAER) to demonstrate that all delivered software functions as intended and is pending free of vulnerabilities (i.e., defects, bugs, malware, etc.) either intentionally or unintentionally inserted as part of the software throughout the CR lifecycle. (B003, DI-IPSC-82249, Software Assurance Evaluation Report (SAER)).

3.3.3.5 Software data deliverables.

3.3.3.5.1 Executable code. The contractor shall own the executable code and shall manage and make in-house revisions/updates as necessary to support the CR systems through the term of the contract. The contractor shall notify the Government of any and all revisions/updates. The Government shall protect the contractor proprietary information embodied in the code and will not disclose this information to a third party without the contractor’s explicit approval. The Government shall have the right to reproduce and distribute the software to users as necessary. The contractor shall deliver the final operating system and application software Computer Software Configuration Items (CSCI) on CD/DVD-ROM, which shall be compatible with the CD/DVD-ROM reader used on the CR system(s). The contractor shall submit a request for Computer Program Number (CPIN) assignment of all custom and/or commercial software and/or firmware to be delivered to the Government, CPIN assignment requests shall be accomplished by direct on-line data entry into Enhanced Technical Information Management System (ETIMS) in accordance with TO 00-5-16 guidelines. (B001, DI-AVCS-80700, Computer Software Product End Items; B008, DI-MISC-81454, Computer Program Identification Number (CPIN) Catalog Information)

For any and all commercial software used on the CR systems that requires a license, the license “key” shall not be external hardware based (for example, universal serial bus (USB)-based dongle key). The ability to utilize any and all commercial software shall not require any additional hardware or internet connection to verify possession of appropriate and corresponding license(s), nor require any recurring license fees for continued use of and reinstallation of the existing software configuration. All licenses shall be “royalty-free,” worldwide, irrevocable, and non-exclusive.

3.3.3.5.2 Software documentation. The contractor shall document all aspects of the CR systems operating system and application software CSCSIs to include executable software description, source files, and software support information, including “as built” design information, compilation, build, and modification procedures via a Software Version Description (SVD). (B002, DI-IPSC-81442, Software Version Description (SVD))

3.4 Logistics.

3.4.1 Technical Order (TO) requirements. The contractor shall develop and deliver a commercial technical manual in accordance with TM-86-01. (A007, TM-86-01, Air Force Technical Manual Contract Requirements)

3.4.2 Provisioning. Contractor shall identify and recommend logical spare/repair parts sufficient to meet system/equipment operation and supportability in accordance with the Air Force Initial Provisioning Performance Specification (IPPS). GEIA-HB-0007B (Logistics Product Data Handbook) should be used as a guide. Format shall be consistent with existing Government Provisioning data system (D220). The following Data Item Descriptions (DIDs) apply:

(A005), DI-SESS-81758A/T, Logistics Product Data. Specific Logistics Product Data to be submitted:

-Short Form Provisioning Parts List (SFPPL) -Design Change Notices (DCNs) -Statement of Prior Submission (SPS)

(A006), DI-SESS-81874, Engineering Data for Provisioning (EDFP).

3.4.2.1 Provisioning Guidance Conference. A Provisioning Guidance Conference (PGC) shall be scheduled by the Prime Provisioning Activity (PPA) and should be held within 45 days after receipt of contract. The PGC is normally held for two days to ensure both the contractor and the Government understand the provisioning requirements on contract. The PGC will be held via telephone and virtually using AF365 Teams. If a PGC is not desired, the contractor shall submit a written request for waiver of the PGC to the PPA. In the event a waiver is approved, a mutual understanding of the Provisioning requirements shall be communicated in some forum in which the AFMC Form 718 (Provisioning Performance Schedule (PPS)) shall be documented/completed, signed by both the Government and contractor, and a contract modification issued, if required. (A001, DI-ADMN-81249, Meeting Agenda; A002, DI-ADMN-81250, Meeting Minutes)

3.5 Testing and evaluation. The contractor shall provide one unit of the system for the Government’s first production testing. Shipping to and from the testing facility shall be provided by the contractor. The contractor shall provide 70% of the training materials to the test site. The contractor shall be available to contact via telephone or TEAMS for technical support within 48 hours of request from the Government. In the event of the system/component breaking, the contractor shall repair and provide shipping of the system/component back to the testing site located FY2305 AF NDI-AFLCMC EZPT NDIO (5295 WAREHOUSE RD BLDG 2211 RM1, TINKER AFB, OK 73145). Operational manual shall be complete and approved by the Government in order to ensure AF personnel can operate and maintain the item during testing. The contractor shall deliver the first production unit within 90 days of contract award. Testing will be performed within 45 days of receiving equipment. The Government will decide which tests listed in the Purchase Description (PD) PD22WRWNZE004, Section 4 will be performed by the Government. Any discrepancies will be shared with contractor and shall be corrected prior to acceptance of first production unit.

3.5.1 Restoration. After completion of first production unit acceptance, the contractor shall be responsible for any repairs that may be necessary to restore the unit to a serviceable, “like new” condition while retaining configuration integrity. Delivery location shall be documented in the order.

3.5.2 Disposition. The approved first production unit shall be shipped to the location(s) specified by the PCO.

3.6 Configuration management.

3.6.1 Engineering Change Proposals (ECPs). Notwithstanding any other provision in the contract, no contractor or subcontractor's change in design, fabrication, assembly, part, material, process, or source of supply shall be made to the unit for Government first production testing unless such change is submitted in writing by ECP and approved by the procuring activity. Any request for change shall be accompanied by complete documentation supporting the need for the change. A system safety impact statement shall be provided as part of the submittal; it shall quantify and qualify the system safety risk identified and how it impacts the system safety risk already identified for the system. A Notice of Revision (NOR) shall be submitted with each ECP. Should the Government approve an ECP, the contractor shall be responsible for submitting updated TOs to reflect the changes made in the ECP. (C001, DI-SESS-80639, Engineering Change Proposal (ECP); C003, DI-SESS-80642, Notice of Revision (NOR))

3.6.2 Request for Variance (RFV). The contractor shall prepare an RFV whenever a departure from the Government approved first production unit baseline is proposed for a specific number of units or for a specific time. (C002, DI-SESS-80640, Request for Variance (RFV))

3.6.3 Production release. Production release is acknowledgment by the procuring activity that the contractor has satisfied all requirements to proceed with delivery of hardware to be furnished under the contract. The contractor cannot start production and delivery of the item until all testing requirements specified herein are competed and results are accepted by the procuring activity and the training materials and T.O. have also been delivered and accepted by the Government.

3.7 Training/familiarization.

3.7.1 Operation and maintenance familiarization/orientation material. The contractor shall develop an interactive multimedia system (program media) on CD-ROM or DVD-ROM for the CR system to be used during the operation and maintenance orientation and for use in the field for familiarization of operational and maintenance personnel at the organizational level. MIL-HDBK-29612/3A shall be used as a general guide, although contractor format is acceptable. This program media shall be in sufficient detail to provide the technician adequate skills to operate and provide general maintenance for the up-keep of the CR systems in the field. Topics to be covered shall include unpacking/re-packing system, scanner, software, maintenance, and troubleshooting. The program media shall also be in sufficient detail to allow user to operate the system without additional instruction. The program media shall consist of all materials (for example, software, firmware) necessary to execute the material on the CR computer. The program media shall be subject to final Government approval before final delivery. Final delivery of two copies of the program media shall be made to the procuring activity. One copy of the program media shall be sent with each CR system as back up data. Note: excluding the first production CR systems, no CR systems delivery acceptance will occur without completed and Government accepted orientation material. (A003, DI-ILSS-80872, Training Materials)

DISTRIBUTION STATEMENT A. Approved for public release: Distribution is unlimited.