DNA IT Enterprise DRAFT PWS.pdf

N0042123R0022

Performance Work Statement (PWS) for

IT Enterprise Engineering, Operations, and Hosting Support Services

1.0 Background

The Naval Air Warfare Center Aircraft Division (NAWCAD) Digital Networks & Applications (DNA) Department is located at the Naval Air Warfare Center in Patuxent River, MD. The DNA department is part of the NAWCAD Digital, Analytics, Infrastructure and Technology Advancement (DAiTA) Group. DNA provides Information Technology (IT) and cybersecurity services and products to NAWCAD, Naval Air Systems Command (NAVAIR) headquarters, other Department of the Navy (DON) components, and the Fleet. The DNA Department provides the people, processes, technologies, facilities, skills, knowledge, and abilities necessary to develop, host, operate, and maintain the critical business and engineering IT environments for NAVAIR and NAWCAD programs and activities.

NAWCAD DNA delivers enterprise-wide systems that support the community with financial, data analytics, business solutions, science and technology, acquisition, logistics and RDT&E information. Cloud computing and related "X-As-A-Service" models [Hardware-As-A-Service (HAAS), Capacity-As-A-Service (CAAS), Infrastructure-As-A-Service (IAAS), Platform-As-A- Service (PAAS), and Software-As-A-Service (SAAS)] are increasingly important to NAWCAD. The need to deliver support to the fleet with increased efficiencies is driving these cloud-based services. Policies, such as the Navy's "Cloud First," further directs the need to move to cloud services; whether or not the cloud deployment model is private, community, public, or hybrid. NAWCAD is seeking assistance in establishing this operating environment that provides better protection, transport, and reliability for business and services and data.

The DNA Department service delivery environment is comprised of a series of interconnected IT systems whose purpose is the integration of information, applications, and processes throughout NAVAIR’s global operations footprint, as well as across DON and Department of Defense (DoD) organizational boundaries. IT is a significant enabler of the NAVAIR war-fighter mission.

The DNA Department hybrid environment using commercial and private cloud computing capabilities will improve the organization’s ability to ensure the continuity, integrity, and availability of business and data. The requirements are applicable to both the current on premise environments and the cloud environment. While a few infrastructures related tasks may be cloud centric, over-all tasking and deliverables are environment independent. Interoperability between the two environments is anticipated.

The DNA Department network transport environments include: Non-Classified Internet Protocol Router Network (NIPR), Secret Internet Protocol Router Network (SIPR), Defense Research and Engineering Network (DREN), Secure Defense Research and Engineering Network, (SDREN), Research Development Test & Evaluation (RDT&E), Defense Information Systems Agency (DISA), and Navy Marine Corps Intranet (NMCI) network services. Ingress and egress from cloud hosted services is performed through a Pax River Data Center owned Physical Device Security Stack (PDSS) located at Equinix facilities near the DISA Cloud Access Point.

The DNA Department and all of its IT Service Area activities are performed in close cooperation and coordination with, but not limited to, the following contracts: Application Integration and Business Intelligence Support, Enterprise Service Desk (ESD) Support Services , Base Telephone Office , Business Operations, Customer Portfolio Management and Horizontal Integration Tasks and Cyber Support Services. Services are typically accomplished through integrated product or project teams, comprised of Government and Contractor personnel. The DNA Department and the associated IT Enterprise provides services to over 100,000 end-users world-wide across over 1,300 unique NAVAIR requirement owners across PEO/PMA, individual projects, laboratories, and other NAVAIR/NAWC organizations. This spans from embedded single person IT support through complete IT systems architecture development, engineering, infrastructure, deployment, sustainment, administration, data hosting, and system retirement.

1.1 Scope

This contract requires the Contractor to provide the skills and experience to provide enterprise-wide applications, server, storage, data protection/recovery, data transport, and data environment engineering, operations, and hosting support services. Requirements include planning, engineering/design, acquiring, provisioning, operating, administering, troubleshooting, repairing and managing all aspects of NAVAIR’s centrally and remotely located IT solutions. This Contractor shall, in coordination and collaboration with DNA Government employees and other DNA Contractors, ensure successful ongoing day-to-day service delivery for all IT service areas and corresponding sub-service areas as referenced in Table 1 below. These areas are considered data environment/network agnostic and includes, but is not limited to, traditional NMCI and corporate/business operations networks, RDT&E network environments, stand-alone environments, on premise and cloud based, and other associated NAVAIR IT enterprise networks and systems.

Table 1

IT Service Area Sub-Service Area IT Management Support IT Governance

Capacity/Demand Management Infrastructure Portfolio Management Infrastructure Asset Management Configuration Management (CM) Infrastructure Problem Management/Monitoring and Reporting Services Security Compliance and Management Services Infrastructure Project Management (PM) Designated Points of Contact (POC’s)

Critical Incident Response and Support Requirements

Incident Response Support and Mitigation

Enterprise Hosting and Architecture Strategy Performance Requirements

On Premise Enterprise Hosting Services Cloud Based Enterprise Hosting Services On-Site Service Delivery Managers On-Site Operation Managers Enterprise Architecture Strategy Support Services

Network, Integration and Systems Engineering

Engineering, Integration, and Implementation for, but not limited to:

Networks, data environments, data transport, multi-level security, Commercial Solutions for Classified

Quality Assurance (QA)/Quality Control (QC) Services

Contractor Continual Service Improvement (CSI) Enterprise Performance Monitoring

Systems Administration Operations & Administration Services Maintenance and Break/Fix Actions Storage Management/Backup and Recovery Services

This tasking shall require access to TOP SECRET // Sensitive Compartmented Information (TS//SCI) facilities, data environments and networks, and information. This tasking will not include the generation or delivery of SCI level data or products.

Specific requirements will be derived from the scope of this PWS and documented through individual Delivery Orders or Task Orders (DO/TO). Orders are expected to be issued as Cost- Plus-Fixed-Fee (CPFF) non-performance based Level of Effort (LOE) and Fixed-Price (FP) performance based requirements derived from any or all sections of this PWS. Orders will consist of short term and long term LOE staffing support and defined project/program completion based activities. Orders may be structured to include any combination of CLIN types in a single order.

2.0 Applicable Documents

The following documents are applicable to the PWS as specified herein. This list is not all-inclusive. This list is for reference only and defines the most common documents, policies, and specifications that may be applicable in the performance of the duties defined within this PWS.

New instruction, supplements, amendments, or revisions to documents may be issued during the term of the contract and shall be in full force and effective immediately upon receipt by the Contractor. In the case of an inconsistency between the industry standards referenced herein and the Government documents referenced below, the Government standard will always take precedence.

In the event of a conflict between the documents referenced herein and the contents of this PWS, the PWS takes precedence. Nothing in this PWS supersedes applicable laws and regulations unless a specific exemption has been or is obtained.

2.1 DoD specifications

2.1.1. Joint Travel Regulation (JTR)

2.1.2. DoD Manual 5105.21, Volumes I-III - Sensitive Compartmented Information (SCI)

Administrative Security Manual, 19 October 2012

2.1.3. DoD Instruction 5200.48 – DoD Information Security Program: Controlled Unclassified Information (CUI), 6 March 2020

2.1.4. National Industrial Security Program Operating Manual (NISPOM)

2.1.5. DoD Instruction 5230.24 – Distribution Statements on DoD Technical Documents, 10

January 2023

2.1.6. DoD Directive 8140.01 – Cyberspace Workforce Management, 5 October 2020

2.1.7. DoD Manual 8570-01-M – DoD Information Assurance Workforce Improvement

Program, 10 November 2015

2.1.8. DoD Instruction 8582.01 – Security of NoN-DoD Information Systems Processing

Unclassified Nonpublic DoD Information, 9 December 2019

2.1.9. NIST SP 800-171 – Special Publication: Protecting Controlled Unclassified Information in

Nonfederal Systems and Organizations, February 2020

2.1.10. NIST SP 800-181 – Special Publication: Workforce Framework for Cybersecurity, November 2020

2.1.11. DoD Instruction 8510.01 Risk Management Framework for DoD Information

Technology (IT), 19 July 2022

2.1.12 Cloud Computing Security Requirements Guide (SRG) Version 1, Release 4 12 Jan 2022

2.2 DoD Standards. Not Applicable.

2.3 Other Government documents (e.g. NAVAIR Documents)

2.3.1. EKMS-1B – Electronic Key Management System (EKMS) Policy and Procedures for

Navy EKMS Tiers 2 & 3, 06 Feb 2015

2.3.2. NASPAXRIVINST 5100.35D – Safety and Occupational Health Manual

2.3.3. NASPAXRIVINST 12610.7H – Employee Reporting Procedures during Emergencies

2.3.4. OPNAVINST 3440.17A – Navy Installation Emergency Management Program, 1 August

2.3.5. OPNAV 5239/14 SAAR-N – System Authorization Access Request Navy (SAAR-N), September 2011

2.3.6. OPNAVINST 5239.1D – US Navy Cybersecurity Program, 18 July 2018

2.3.7. NASPAXRIVINST 5510.15Q – Base Access Regulation

2.3.8. SECNAVINST 5239.20A – Department of the Navy Cyberspace Information Technology

And Cybersecurity Workforce Management And Qualification, 10 February 2016

2.3.9. SECNAVINST 5100.13F – Navy Tobacco Policy, 2 December 2020

2.3.10. SECNAV M-5510.30C – Personnel Security Program, 24 January 2020

2.3.11. SECNAVINST 5510.36B – DoN Information Security Program (ISP) Regulation, 12

July 2019

2.3.12. OPNAVINST 5530.14E – Navy Physical Security and Law Enforcement Program, 28

January 2009

2.3.13. OPNAVINST 3440.17A – Installation Emergency Management Program, 1 August 2014

2.3.14. NASPAXRIVINST 5100.35C – Occupational Safety and Health Manual

2.3.15. NASPAXRIVINST 11320.1N – Fire Bill

2.4 Industry Documents. Not Applicable.

3.0 Requirements

3.1 General Requirements

3.1.1 Compatibility - The Contractor shall maintain the capability to prepare documents and software packages compatible with the Government IT environment through the security classification of TOP SECRET // Sensitive Compartmented Information (TS//SCI). The current operating environment required for this contract includes:

Microsoft Windows 10 Microsoft Project 2016 Microsoft Office Professional Plus 2016 Microsoft SharePoint 2016 Adobe Acrobat XI (reader) Internet access Microsoft Teams

The Contractor shall maintain the ability to interface with and transfer data to and from requiring office software applications and their upgraded versions. The Contractor shall maintain state-of the-art anti-virus software and ensure that all media are virus free when delivered. The Contractor shall be capable of Internet and Local Area Network (LAN) communications with the Government. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with the Government during working hours whether at Contractor work site or on travel.

3.1.2 Work Location, Facilities and Telework

3.1.2.1 Work location:

An estimated 85% of the work will be performed at the Government site inclusive of situational telework and 15% at the Contractor site(s). This estimate may change over the life of the contract as new technologies and hosting approaches enable greater flexibility in the support approach.

3.1.2.1.1. Government Site Requirements:

The principal place of performance for Government site is Naval Air Station (NAS) Patuxent River, MD. Government site(s) outside Patuxent River that may require embedded personnel are anticipated to include the following: Patuxent River remote facilities (St. Inigoes, MD;

Solomon’s Island Naval Center, MD; Washington Liaison Office in Arlington, VA and Government leased spaces within the local proximity of these locations); China Lake, CA; San Diego/North Island, CA; Point Mugu, CA; Jacksonville, FL; Orlando, FL; Pensacola, FL; Cherry Point, NC; Lakehurst, NJ. Temporary performance may be required at other Government sites via travel.

Contractors performing on-site support will be provided access to workspaces, telephones, printers, facsimile machines, copy machines, shredders, computers, network access including web servers, tooling, and applications necessary to carry out assigned tasks.

3.1.2.1.2 Contractor Site Requirements

The predominance of the 15% of the work performed at the Contractor site is related to IT systems engineering and unclassified systems administrative support functions that can be performed via remote virtual network connections. The remaining work to be performed at the Contractor site is related to unclassified systems and training environment development, and asset pre-deployment build out and storage.

The Contractor shall provide a facility within 50 driving miles to NAS Patuxent River with at a minimum the ability to support the unclassified systems and training environment development and asset pre-deployment build out and storage activities. The Contractor shall provide sufficient industrial space for the receipt, storage, inventory, and shipment of equipment associated with assigned projects. Historically, the storage space required to meet requirements has been no less than 2,000 square feet. Additionally, the space shall be equipped with Heating, Ventilation, and Air Conditioning (HVAC) systems capable of sustaining a controlled environment consistent with the storage, assembly, and operation of electronic equipment. The space shall be configured to meet requirements for receiving, material receipt inspection, storage awaiting build up, integration, and testing and storage of completed systems. The space shall be equipped to protect Government Property. The Government will not have desk occupancy at the location and will not take possession of the facility at contract termination.

3.1.2.1.3 A full-time, Government site, designated Program Manager (PM)(Manager/Operations Manager) shall be physically located at Patuxent River during normal working hours to conduct overall management coordination with the Government. The contractor shall propose an acting PM (with equivalent approval authority) for periods when the

PM is on leave, travel, reserve duty, or similar. The Program Manager is responsible for work across all sites. Not all buildings within each site are within walking distance of each other. The location of some buildings may require the PM to drive between them.

3.1.3 Contract Status Reporting. The Contractor shall deliver the following documentation.

3.1.3.1 Monthly Financial Status Report

The Contractor shall deliver a financial status report in accordance with the Contract Data Requirement List (CDRL) A001. Reference Section 3.5.

3.1.3.2 Monthly Progress Report

The Contractor shall deliver a monthly progress report in accordance with CDRL A002.

Reference Section 3.5

3.1.3.3 Personnel Locator Report

The Contractor shall deliver a Personnel Locator Report in accordance with CDRL A003.

Reference Section 3.5

3.1.3.4 Government Material Tracking Report

The Contractor shall deliver a Government Material Tracking Report in accordance with CDRL A005. Reference Section 3.5

Additional status reporting may be required and defined at the individual DO/TO level.

3.1.4 Work Schedule to include Compressed Work Schedule (CWS), overtime, holidays and installation closure

3.1.4.1. Work Schedule: The Contractor shall provide the required services and staffing coverage during normal working hours. Normal working hours are usually 8.5 hours (including a 30-minute lunch break), from 0730 to 1600 each Monday through Friday (except on the legal holidays specified below). Some supported Government offices have flexibility to start as early as 0600 and end as late as 1800, Monday through Friday. If different hours are needed by a Government team or the Contractor (e.g. individual groups or locations may allow or require different hours) on a long term basis, they will be coordinated through the Technical Point of Contact (TPOC) associated with that work and approved by the Contracting Officer Representative (COR).

3.1.4.1.1 Compressed Work Schedule (CSW): CWS is an alternative work schedule to the traditional five 8.5-hour workdays (which includes a 30-minute lunch) worked per week. Under a CWS schedule, an employee completes the following schedule within a two-week period of time: eight weekdays are worked at 9.5 hours each (which includes a 30-minute lunch), one Friday is alternately worked as 8.5 hours (which includes a 30-minute lunch) and one Friday is not worked by the employee. The result is 80 hours worked every two weeks, with 44 work hours one week and 36 work hours the other.

The Contractor may allow its employees to work a CWS schedule provided the requirements of this PWS are met. If the Contractor chooses to allow its employees to work a CWS schedule in support of this contract, any additional costs associated with the implementation of the CWS schedule vice the standard schedule are unallowable costs under this contract and will not be reimbursed by the Government. Additionally, the CWS schedule shall not prevent Contractor employees from providing necessary staffing and services coverage as required by the Government.

3.1.4.1.2 Outage Weekends

The Contractor shall provide support for four (4), twenty-four (24) hour scheduled outage periods (typically the second and fourth Saturday and Sunday) per month to provide time for system security compliance, upgrades, implementations, and other maintenance activities requiring service disruption. These are commonly referred to as “Outage Weekends”.

3.1.4.1.3 PAX River (PAXR) Operations Monitoring

PAXR Operations Monitoring will provide 24x7x365 operational situational awareness of the on premise and cloud infrastructure using monitoring tools provided by NAWCAD. The Contractor shall work closely with enterprise hosting infrastructure and systems administrators during events and incidents. The Contractor will respond to Tier I events and incidents according to documented Event Response Procedures and escalate to Tier II or Tier III support as required.

They will coordinate with NAVAIR National Helpdesk (NNHD) on events and incidents. They will create and maintain 24x7x365 support processes. The Contractor, during maintenance windows, will perform maintenance functions according to Configuration Control Board (CCB) approved tickets and work orders.

Contractor work schedules shall be coordinated with the Technical Point of Contact (TPOC) and Contracting Officer Representative (COR) to ensure: 1) coverage during critical periods and critical tasking, 2) coordination of tasks involving other Contractors, and 3) security compliance for buildings/areas where access is controlled.

3.1.4.1.3.1 NAWCAD DNA defines “Critical Systems” as those systems/applications or incident types that require and are authorized to receive 24x7x365 support through agreed upon Service Level Commitments as contained in Customer Agreements or other associated contractual documentation. Additionally, some incident types (classified data spillage, data center facility incidents, major circuit outages, etc.) are defined as ‘critical’ due to the seriousness and/or wide ranging mission impact such incidents have. Below is a representative list, not all inclusive, of Critical Systems that the Government deem authorized to receive 24x7x365 support.

• NHD Automated Call Distribution (ACD) System

• Help Desk Systems

• Navy Enterprise Resource Planning (ERP)

• Cyber Security Incidents

• Voice Mail System

• Airworthiness (NIPR and SIPR)

• SharePoint/MyTeam

• Standard Procurement System (SPS)

• Joint Deficiency Reporting System (JDRS)

Additionally, as determined by the Government, certain support teams under this contract, shall be available to support after hours and weekend maintenance activities outside core business hours (0700-1700, Monday through Friday) as Tier II or Tier III support, which may include patching, testing, troubleshooting, and responding to customer requests. When notified of these customer specific support requirements, the Contractor shall coordinate with the TPOC and COR and develop a staffing approach to respond to service requests notifications within 30 minutes and report to work or login to begin working within two (2) hours of request. On-call coverage should not negatively impact the ability of the Contractor to cover core business hours.

3.1.4.2 Holidays

The Government observes the Federal holidays identified on the Office of Personnel Management (OPM) website: https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview. With the exception of the events in section 3.1.4.5 below, the Contractor is permitted to observe Federal holidays in accordance with (IAW) its corporate policy.

3.1.4.3 Overtime (OT)

Overtime as defined in this contract refers to hours worked by a Contractor employee in excess of the employee’s normal workweek. When support requirements outside of normal working hours occur, the Contractor shall ensure qualified personnel are available to support the requirements through the use of overtime. Overtime is authorized under this contract, provided COR approval is obtained in advance. The COR may provide concurrence for overtime on a task, event, program, project, or general function basis. The total cost for overtime over the life of the contract cannot exceed the amount specified in clause 52.222-2 Payment for Overtime Premiums unless first approved in writing by the Procuring Contracting Officer (PCO).

3.1.4.4 Travel/Temporary Duty (TDY): When personnel are temporarily deployed offsite, the Contractor shall modify the traveler’s working hours to best support the assigned tasking and minimize overtime.

3.1.4.5 Installation closure:

When Federal facilities are closed by the Government, or when Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility related problem that prevents Federal personnel from working at the Government facility, Contractor personnel assigned to work at that facility in support of such Federal employees shall follow their parent company’s policies and conform to one of the following possible courses of action:

Report for work at an alternate site if available, permitted by the terms of the contract, and they receive advance authorization from the COR or Contracting Officer; or

Telework, provided telework is permitted by the terms of the contract and they receive advance authorization to telework from the COR or Contracting Officer; or

Follow parent company’s policies regarding taking leave (administrative or other).

While generally Contractor personnel may not perform work on-site at a Government facility without oversight from Federal personnel, in very limited circumstances, work being performed by Contractor personnel may be deemed mission essential and performance of such mission essential work may be authorized to continue at the Government facility despite the facility being otherwise closed for normal operations. The circumstances permitting work being performed by Contractor personnel to be deemed mission essential are extremely limited and generally only apply to performance of efforts related to public health, safety, or matters related to national security. The cognizant Contracting Officer (KO) must concur with any determination that work being performed by Contractor personnel is mission essential.

Error! Reference source not found. identifies procedures Government employees are to follow when an emergency condition is identified. The Contractors shall follow the procedures as defined with the exception of being granted administrative leave. Contractors that are at work when a delay or restricted access is announced shall cease work and exit the base as soon as it is safe to do so.

3.1.4.6 Telework:

The Contractor may allow employees to telework with approval from the COR in writing, that a positions tasking is eligible for telework. The Contractor may utilize alternate worksites/locations and telework to support continued performance of PWS tasks in accordance with company policy. When using telework, the Contractor remains responsible for contract performance and compliance with any applicable cost accounting standards and contract cost principles / procedures.

3.1.5 Other Direct Costs:

3.1.5.1 Travel: The Contractor shall be required to travel in support task orders issued under this contract. Travel will be allowable only when it is essential to the performance of the tasks detailed in the task order. The COR shall approve in writing all travel performed in support of this contract prior to the commencement of the travel. Travel may include general and administrative expenses but shall not include profit. Costs associated with travel and lodging shall be reimbursed IAW the JTR.

3.1.5.1.1 Travel locations may include, but are not limited to, various commercial facilities, Contractor facilities, Navy facilities and ships, DoD facilities/installations, other Government agency offices (e.g. test ranges, operational activities, project/program offices, and support activities), including travel OCONUS. This list is not all-inclusive as locations may change over the life of the contract.

3.1.5.1.2 The numbers of trips and types of personnel traveling shall be limited to the minimum required to accomplish work requirements. Personnel traveling for a common mission shall utilize common facilities and transportation (e.g. hotels and rental cars) as much as is practical.

The Government will not reimburse travel costs incurred in replacing personnel at a TDY site when such replacement is at the Contractor’s or employee’s convenience. Exceptions may be made with COR approval when considering the circumstances of the stated travel.

3.1.5.1.3 Contractor personnel may be authorized to be a passenger on Government or military aircraft, ships, and barges during non-test periods in the performance of their duties under this contract. This authorization may only be granted if the aircraft, ship, or barge is a test asset.

Contractor personnel will never be authorized to be a passenger if the aircraft, ship or barge is an Engineering and Manufacturing Development (EMD) item. Contractor personnel may also be authorized to be a passenger in Government-operated shuttles. Contractor transport on Government or military vehicles will be authorized only when such transport is essential to the performance of the contract and is determined to be cost-effective for the Government. The Contractor's travel request to the COR shall specifically request the use of Government transportation when applicable.

3.1.5.2 Material:

Applicable to CLIN X002 materials incidental to the performance of non-performance based tasking. The Contractor shall obtain written approval from the COR for material and ODC purchases IAW CTXT-242.9520 PROCEDURES AND APPROVALS REQUIRED PRIOR TO

INCURRING DIRECT MATERIAL COSTS (APR 2022).

All materials not depleted during the performance of this contract shall become Government property upon completion of this contract. The Contractor shall transfer all materials not depleted to the COR by way of Material Inspection and Receiving Report (DD Form 250).

Material costs may include general and administrative expenses but shall not include profit/fee.

3.1.6 Contract Performance Management

3.1.6.1 The Contractor shall develop, implement, execute in accordance with, and maintain a

Contract Performance Management (CMP) Plan for the life of the contract. (CDRL A007)

3.1.6.2 The Prime Contractor shall manage all contractor team members IAW their CMP Plan (A007) and shall ensure that all provisions stated herein shall be clearly and effectively communicated to all Subcontractors providing support under this contract. All provisions of this PWS shall flow down to Subcontractors providing support under this contract.

3.1.7 Management of Contractor Personnel

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual Contractor employees. The Contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services.

Contractor personnel shall remain employees of the Contractor and will not be considered employees of the Government. The Contractor Program Manager (PM) shall ensure the Contractor workforce understands this employer difference when issues arise that affect the Government, but does not include Contractor personnel.

All Subcontractor personnel working on this contract are viewed by the Government as part of the Prime’s workforce. As such, there shall be no processes, requests, approvals, or other documents or procedures that are presented to the Government from the Subcontractor. All Subcontractors shall conform to the same processes and documentation as the Prime when interfacing with the Government. Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this contract. All provisions of this PWS shall flow down to subcontractors providing support under this contract.

3.1.8 Training

3.1.8.1 New Hire Orientation

The Contractor is responsible for providing an orientation to new hires to enable them to adequately perform their tasking. Orientation shall include, but is not limited to:

Physical knowledge of the base and Government facilities Contract information (Contractor/COR interaction and basic contract requirements) Labor category requirements Specific process requirements (Government and Contractor) Org chart/hierarchy for both Contractor and Government

Introductions (COR/ACOR, Government task lead, Contractor task lead, etc.)

Security

3.1.8.2 Labor Category Training Requirements

The Contractor is responsible for providing individuals who are trained, certified, and qualified to perform the tasks outlined in the PWS. Training to meet labor category requirements is the sole responsibility of the Contractor—both initial training and required re-certifications. The Contractor is responsible for the cost of the training (class, travel, supplies) and the labor associated with the training. These training requirements shall be met prior to the Contractor personnel reporting for duty except as identified in the specific labor category. Due to availability and location of some training classes, exceptions may be made to allow personnel to begin working while waiting for the training to become available with prior approval by the COR. In the case of re-certifications, the Contractor shall plan ahead of time so as to not impact workload due to missed days for training or expiring certifications.

3.1.8.3 Technical Training

Due to the technical nature of the work, there may be special, unique, and emergent training required during the execution of this contract. This training may include, but is not limited to, specific software, hardware, and procedures as required for the specific system or requirements being supported. All requests for cost reimbursable training shall include a written justification by a Government Technical Point of Contact (TPOC) and course information including, but not limited to, the source of the training, the dates of the training, a training course description, and training cost including quotes from the vendor. General educational courses or programs for enhancement of basic qualifications or academic standing of employees shall not be accomplished at the Government’s expense. No cost reimbursable training shall be scheduled or executed without written approval from the COR in accordance with CTXT.242.9520

PROCEDURES AND APPROVALS REQUIRED PRIOR TO INCURRING DIRECT

MATERIAL COSTS (APR 2022).

3.1.8.4 Mandated Training

For performance at Government facilities, this contract requires Contractor personnel to complete training such as Anti-Terrorism and Active Shooter (as referenced in paragraph 3.2.6), and any required Operational Security (OPSEC) topics (as referenced in paragraph Error!

Reference source not found.). In addition, during the course of the contract, the Government may mandate training for all personnel. This training may be computer or instructor based.

Contractor personnel shall participate in these training requirements. Participation may be at live training, events, computer based training, or via review of a provided set of documents. This training shall be provided and/or reimbursable by the Government. Contractor personnel supporting functions where Personally Identifiable Information (PII) or classified data may be handled, shall complete the Navy provided “Security Awareness training” and “Privacy Act Training” within forty-five (45) days of assignment to such functions and annually thereafter.

The Contractor Program Manager shall ensure all Contractors on the contract are trained and shall report compliance to the COR within five (5) working days after the announced deadline of the training.

3.1.9 Non-Disclosure Agreements (NDAs)

In the performance of the contract, the Contractor may have access to non-public proprietary information. The Contractor shall require that any employee performing services under the contract execute a NDA satisfactory to the Contracting Officer or their designated representative.

The NDA shall acknowledge the Contractor and employees’ duties with respect to non-public information and promise to comply with those obligations. A copy of the executed NDAs shall be provided to the COR upon request.

3.1.10 Aircraft Facility Related Activities

In the performance of the contract, the Contractor may have access to aircraft hangars, flight lines, maintenance areas, mobile and fixed ground control stations, or other facilities or spaces that operate under Ground Operating Procedures. All Contractor personnel shall follow the local instructions, policies, and procedures in regard to physical access, foreign object damage, tool control, and reporting requirements.

3.1.11 Transition Strategy

3.1.10.1 Transition In Activities

Due to the IDIQ structure of this contract, transition activities may occur throughout the lifecycle of the contract. This includes basic contract award and individual orders. The Contractor shall support the Government in transition activities to include, but not limited to, the following actions:

Customer requirements analysis and order level contract structure (i.e. New vs modification of existing order, CLINs, cost type, options, TDLs, etc.)

recommendations

Customer resourcing recommendations Generation of rough orders of magnitude of cost and schedule Identification of required Government Furnished Property and Information Performance Location requirements assessment and recommendations Identification and requirements definition of additional order level CDRLs

3.1.10.2 Transition Out Strategy

The Contractor’s overall transition out strategy shall be built around maintaining the mission of the program/division with minimal impact, not only in terms of timeliness of performance but also to ensure that critical data and knowledge transfer occurs. Upon termination or expiration of the contract, the Contractor shall ensure an orderly transition of responsibilities, while minimizing impact to the operation. The Contractor shall submit a Transition Out Plan, to include the minimum elements listed below in accordance with CDRL A006.

- Work Turnover. The Contractor shall provide a plan of action to effectively transfer tasked work that is in process at the expiration or termination of the contract to the successor company. Establish and maintain effective communication with the incoming Contractor or Government personnel for the period of transition via weekly status meetings.

-Quality Assurance. The Contractor shall provide a plan of action to ensure continuation of quality review processes during the transition period to the successor company.

-Risk Mitigation Strategies. The Contractor shall provide a plan of action to mitigate contract performance risks (quality and schedule) encountered during the transition period.

-Data/Information Transfer. The Contractor shall provide a plan of action for the efficient inventory and transfer of program data to the successor company.

3.1.10.3 Order Specific Close Out / Transition Out

Due to the IDIQ structure of this contract, order level close out or transition activities may occur throughout the lifecycle of the contract. The Contractor shall support the Government in close out / transition activities to include, but not limited to, the following actions:

Personnel Resource Planning Deliverables Audit Audit and disposition/return of Government Furnished Property and Government

Furnished Information Performance Review and Lessons Learned Financial reconciliation

3.1.12 Technical Direction Letters (TDLs):

When necessary, technical direction or clarification concerning the details of specific tasks set forth in the DO/TOs will be given through issuance of written TDLs. TDLs will not, in any manner, alter the scope of the TO. For further direction see NAVAIR Clause 5252.242-9502 Technical Direction (Variation) in Section H of the Contract. The Contractor shall prepare and deliver a Contracting Officer’s Management Report for TDLs IAW CDRL A00X.

3.2 Security

3.2.1 Citizenship Requirements: Only United States (U.S.) citizens may perform under this contract. If the Contractor cannot find qualified U.S. citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office. The waiver request should include:

a) The individual's name, date and place of birth, position title, and current citizenship.

b) A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements.

c) A statement of the unusual expertise possessed by the applicant.

d) A statement that access will be limited to a specific Government contract (specify contract number).

e) A statement that the Contractor has obtained an export license for the information required to perform the contract.

3.2.2 Investigative Requirements:

All Contractor personnel shall maintain security clearance eligibility commensurate with the level of classification of the work performed as annotated in the Contract's DD-254, Contract Security Classification Specification Form.

Contractor personnel shall require access to classified information in performance of this contract up to and including TOP SECRET//Sensitive Compartmented Information with a safeguarding level of NONE. The Contractor is responsible for ensuring that all personnel receive the requisite investigation and ae favorably adjudicated in accordance with National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulation Part 117. Contractor employees who fail to meet security clearance requirements may not access classified information or perform sensitive duties. In such cases, the Contractor employee may not perform on the contract.

The Contractor shall comply with security requirements specified in the DD-254 attached to this contract. Information or data that the Contractor accesses shall be handled at the appropriate classification level. Unclassified information shall be handled in accordance with the appropriate designation (Controlled Unclassified Information; Covered Defense Information). Distribution is authorized to the Requiring Office's Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the TPOC/COR of this contract for approval.

Additional investigative requirements apply for all personnel supporting TS//SCI tasking;

reference Section 3.2.10.

3.2.3 Common Access Card (CAC)/ Public Key Infrastructure (PKI), System

Authorization Access Request (SAAR-N)

3.2.3.1 SAAR-N:

All Contractor personnel requiring access to Government IT systems shall access and operate IT systems and networks IAW shall have an approved Error! Reference source not found. form on file, and complete required Annual Information Awareness Training. New employees must submit their SAAR-N forms within thirty (30) days of their first day of work. Instructions for processing the SAAR-N forms are available at:

https://www.cnatra.navy.mil/local/docs/forms/5239.14.pdf

SAAR-N forms shall be submitted to the COR, Government TPOC, or to the assigned Government Trusted Associate Sponsorship System (TASS) Trusted Associate.

3.2.3.2 CAC/Local Badges:

Contractor CACs and facility specific identification badges will be issued by the Government to on-site Contractor personnel and shall be visible at all times while personnel are at the Government site. The Contractor shall furnish all requested information required to facilitate issuance of identification badges and shall conform to local installation policies and guidance as appropriate. All CACs and identification badges issued to Contractor employees shall be returned to the Government Security Department at the Government site in accordance with local installation policies and guidance as appropriate following completion of the contract, relocation or termination of an employee, or upon request from the COR. The Government will provide the Contractor access to Government facilities, as required, for performance of tasks under this contract. Contractor personnel shall comply with local CAC requirements.

3.2.3.3 DD-254:

The Contractor shall comply with security requirements specified in the DD-254 attached to this contract. Information or data that the Contractor accesses shall be handled at the appropriate classification level, unclassified information shall be handled as “Controlled Unclassified Information (CUI).” Distribution is authorized to the Requiring Office’s Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the COR of this contract for approval.

3.2.3.4 Other Badging:

Badges to special, classified, limited access, and/or commercial facility (e.g. Prime Contractor for a project or platform) areas may be required by the Contractor based on location and tasking.

The Contractor shall adhere to the rules governing the issuance of those badges.

3.2.4 Information Security:

If the work is performed at the Contractor’s facility, the Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and CUI and to control distribution of CUI IAW the National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulation Part 117, NIPSOM Rule, and Error! Reference source not found.. If the work is performed at the Government’s facility, the Contractor shall comply with instructions/guidance required by that facility.

Information at the TS//SCI level will be protected in accordance with DoDI 5200.01 DoD Information Security Program and Protection of Sensitive Compartmented Information (SCI).

All contractor facilities shall provide an appropriate means of storage for CUI and materials. All CUI including legacy FOUO information and Covered Defense Information (CDI) (meeting the definition DFARS Clause 252.204–7012, Safeguarding Covered Defense Information and Cyber Incident Reporting) generated and/or provided under this Contract shall be marked and safeguarded as specified in DoD Instruction 5200.48, Controlled Unclassified Information (CUI) available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF.

3.2.4.1 Marking:

All information generated by the Contractor shall be properly marked. CUI including Covered Defense Information (meeting the definition of 48 CFR 252.204–7012(a)) generated and/or provided under this contract shall be marked and safeguarded as specified in DoD Instruction 5200.48, Controlled Unclassified Information (CUI) available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF. Technical information shall also be marked with appropriate Distribution Statements and Export Control warnings IAW the National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulation Part 117, Error! Reference source not found., and program Security Classification Guidance. Any product containing Covered Defense Information shall be assigned and marked accordingly a distribution statement (distribution statements B through F) using the criteria set forth in DODI 5230.24 (Distribution Statements on Technical Documents); and have this statement displayed per DODI 5230.24, Enclosure 3.

3.2.4.2 Public Release:

No information pertaining to this contract shall be released for public dissemination, including posting to any social media sites such as Facebook or Twitter, unless it has been approved for public release by the appropriate U.S. Government authority. Proposed public releases shall be submitted to the COR for initial approval and awareness. Upon initial approval, the Contractor shall submit proposed public releases for approval prior to release through the NAWCAD Procuring Contracting Officer, and through;

Public Affairs Office

NAVAIR

navairpao@us.navy.mil 301-757-1487

3.2.4.3 Loss, Compromise and/or Electronic Spillage of Classified or Controlled Unclassified

Information:

All instances of loss, compromise and electronic spillage of classified or controlled unclassified information shall be reported to the COR, TPOC, and Government Security Office within 24 hours of the incident occurring.

3.2.4.4 Compliance to NIST 800-171:

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

(1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication.

For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

(4) Audit user privileges on at least an annual basis;

(5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

(6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

(7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

3.2.5 Operational Security (OPSEC):

For work performed at the Contractor facility, the Contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the Contractor and any subcontractor during performance of the contract. The Contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. This program may include Information Assurance and Communications Security (COMSEC). The OPSEC program shall be in accordance with National Security Decision Directive (NSDD) 298, and at a minimum shall include:

a) Assignment of responsibility for OPSEC direction and implementation.

b) Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

c) Establishment of OPSEC education and awareness training.

d)…