DRAFT LVC SW and MGMT Services PWS 20230301.docx

DOCX document 310 KB Posted

Attached to
Canceled: Live Virtual Constructive (LVC) Industry Engagement
Solicitation number
M67854-23-R-8026
Issued by

View the file

Other files

File Type Posted
LVC Industry Day Attendees.pdf PDF
PdM STS TL LVC Organization Concept (002).pdf PDF
LVC Comments Resolution Matrix.xlsx XLSX spreadsheet
LVC Contractor Information Form.xlsx XLSX spreadsheet

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

UNCLASSIFIED M67854-23-R-8026 Attachment J1 Performance Work Statement (PWS) Live Virtual Constructive - Enterprise Software and Management Services

1 Mar 2023

UNCLASSIFIED VERSION 0.1

UNCLASSIFIED

TABLE OF CONTENTS

1GENERAL- 6 -
1.1Description of services- 6 -
1.2Background- 6 -
1.3Objectives- 6 -
1.4Scope- 6 -
1.5Period of Performance- 7 -
1.6General Information- 7 -
1.6.1Non-personal Services- 7 -
1.6.2Business relations- 8 -
1.6.3Contractor personnel, disciplines and specialities- 10 -
1.6.5SECURITY REQUIREMENTS- 13 -
1.6.6VISIT REQUESTS- 19 -
1.6.7SAFETY- 20 -
1.6.8LOCATIONS AND HOURS OF WORK- 20 -
1.6.9PROGRAM MANAGEMENT- 27 -
1.6.10PHASE IN AND PHASE OUT PERIOD- 32 -
1.6.11IDENTIFICATION OF CONTRACTOR PERSONNEL- 34 -
1.6.12CONFERENCES AND REVIEWS- 35 -
1.6.13DATA- 38 -
2DEFINITIONS AND ACRONYMS- 39 -
2.1DEFINITIONS- 39 -
2.1.1CONTRACTOR- 39 -
2.1.2CONTRACTING OFFICER (KO)- 39 -
2.1.3CONTRACTING OFFICER'S REPRESENTATIVE (COR)- 39 -
2.1.4DEFECTIVE SERVICE- 39 -
2.1.5DELIVERABLE- 39 -
2.1.6KEY PERSONNEL- 39 -
2.1.7PHYSICAL SECURITY- 40 -
2.1.8QUALITY ASSURANCE- 40 -
2.1.9QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)- 40 -
2.1.10QUALITY CONTROL- 40 -
2.1.11SUBCONTRACTOR- 40 -
2.1.12WORK DAY- 40 -
2.1.13WORK WEEK- 40 -
2.2ACRONYMS- 40 -
3GOVERNMENT FURNISHED ITEMS AND SERVICES- 40 -
3.1Services (If applicable)- 40 -
3.2Facilities (If applicable)- 41 -
3.3Utilities- 41 -
3.4Equipment (If applicable)- 41 -
3.5Materials (If applicable)- 41 -
4CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:- 41 -
4.1General (If applicable)- 41 -
4.2Secret Facility Clearance (If applicable)- 41 -
4.3Materials (If applicable)- 41 -
4.4Equipment (If applicable)- 42 -
5Specific Tasks:- 42 -
5.1Basic Services- 42 -
5.2P/L Management, Organization and Processes:- 42 -
5.3LVC-E Configuration and Variation ManagemenT- 43 -
5.4Cybersecurity- 43 -
5.5P/L Shared Asset Development and Evolution:- 43 -
5.6Product Development, Integration, Fielding and Sustainment:- 44 -
5.7P/L Facilities, Labs and P/L Customer Support:- 45 -
5.8Program Management:- 46 -
5.9Contractor Facility:- 46 -
5.10Integrated Product and Process Development (IPPD):- 46 -
5.11Integrated Master Plan and Integrated Master Schedule (IMP/IMS):- 46 -
5.12Earned Value Management System (EVMS)- 47 -
5.13Contractor Integrated Performance Management:- 47 -
5.14Integrated Baseline Review (IBRs):- 47 -
5.15Systematic Quality:- 47 -
5.16Risk Management:- 48 -
5.17Associate Contractor Agreements (ACAs):- 48 -
5.18Subcontractor Management:- 48 -
5.19Cost as an Independent Variable (CAIV):- 48 -
5.20Systems Engineering:- 49 -
5.20.1Software Engineering:- 49 -
5.20.2Software Design and Implementation:- 49 -
5.20.3Software Development Test:- 49 -
5.20.4Software Requirements and Architecture Development and Review:- 50 -
5.20.5Hardware Engineering:- 51 -
5.20.6Test Engineering:- 51 -
5.20.7System Safety Program:- 52 -
5.20.8Supportability Engineering:- 52 -
5.20.9Hardware Component Manufacturing:- 52 -
5.20.10Reliability Engineering Program- 52 -
5.20.11Maintainability Engineering Program- 52 -
5.20.12Producibility Engineering Program- 52 -
5.20.13Human System Integration (his)- 52 -
5.20.14Program and Design Reviews- 52 -
5.20.15Value Engineering- 53 -
5.20.16Logistics- 53 -
5.20.17Contractor Support:- 53 -
5.20.18Instructional Systems Development:- 53 -
5.20.19Re-competition Support Package:- 53 -
5.20.20LVC-E Product Support:- 54 -
5.20.21Transition to Life Cycle contractor Support (LCCS):- 54 -
6APPLICABLE PUBLICATIONS- 54 -
APPENDIX AJOINING CONTRACTOR MACHINE TO THE MCEN- 58 -
APPENDIX BUSMC CONTRACT SUPPORT USER AGREEMENT FOR THE MCEN- 59 -
APPENDIX CCONTRACTS TO BE PERFORMED IN JAPAN- 63 -
APPENDIX DSTATUS OF FORCES AGREEMENT (SOUTH KOREA)- 70 -

LIST OF TABLES

Table 31. Acceptable Quality Level - 15 -

TABLE OF FIGURES

No table of figures entries found.

M67854-21-F-8xxx Attachment J1
UNCLASSIFIEDM67854-23-R-8026 Attachment J1

UNCLASSIFIED

- 3 -

UNCLASSIFIED

GENERAL

This Performance Work Statement is in support of the Live Virtual Constructive – Enterprise (LVC-E). This PWS is structured for maximum flexibility in the form of the issuance of task orders (TOs) through an expedited ordering process to satisfy the LVC-E requirements for overall total life cycle management support, as well as other Marine Corps training requirements that fall within the scope described below. TO PWSs will provide the specific performance requirements, performance standards, metrics, assessment measures, and schedules for each TO.

The Contractor shall provide all personnel, equipment, tools, materials, supervision, and quality control necessary to perform the LVC-E requirements defined in this PWS and subsequent TOs.

Description of services All DoD services fall within one of nine (9) Service Portfolio Groups within DoD’s Taxonomy of Services, which is required pursuant to DoD FAR Supplement (DFARS) Policy, Guidance, and Instruction (PGI) 237.102-74. The Program Manager, Training Systems (PM TRASYS) contracting authority is limited to the Marine Corps Systems Command’s (MARCORSYSCOM’s) authority delegated in SECNAVINST 5400.15C. PM TRASYS is the MARCORSYSCOM Program Manager responsible for the life cycle systems support for training systems, services, environments, and devices. Therefore, PM TRASYS has the authority to award contracts in support of five (5) of the 9 Service Portfolio Groups identified in DoD’s Taxonomy of Services, which includes the LVC-E Portfolio Group.

PM TRASYS intends to award a contract that is primarily aligned with the Service Portfolio Group within DoD’s Taxonomy of Services. This PWS is in support of the LVC-E Portfolio Group, which includes the following Service Portfolios, which have Portfolio Categories and corollary PSCs identified in DoD’s Taxonomy of Services: IT Services; Telecom Services; Equipment Maintenance; and Equipment Leases Background.

Objectives

· Develop processes and manage tools to support establishing and maintaining a common product line

· Provide program analysis, planning and support

· Provide systems engineering support to include analysis, design, test, configuration management and fielding support

· Provide system prototyping

· Provide training analysis and courseware development support

· Provide software development and post deployment software support

· Hardware analysis, design, procurement, and fielding

· Provide cyber security services for compliance, development of artifacts, and Risk Management Framework processes to establish and maintain an Authority to Operate/Connect

Scope The scope of this effort is intended to be broad in nature and entails LVC-E support for all existing and any future USMC training systems and any corollary Foreign Military Sales including, but not limited to: the Live Virtual Constructive – Training Environment (LVC-TE), Marine Air-Ground Task Force (MAGTF) Tactical Warfare Simulation System (MTWS); the Deployable Virtual Training Environment (DVTE); Combined Arms Command and Control Training Upgrade System (CACCTUS); Combat Convoy Simulator (CCS); Indoor Simulated Marksmanship Trainer (ISMT); Marine Corps Driver Trainer (MCDT); Supporting Arms Virtual Trainer (SAVT); and Combat Vehicle Training Systems (CVTS).

In general, equipment to be supported under this award are simulators or simulations systems that use electronic and/or mechanical means to reproduce conditions necessary for an individual, team, unit, or crew to rehearse operational tasks and technical skills in accordance with training objectives. The simulators and simulations systems replicate the functions and environment of actual equipment or systems and consist of training devices, machines, or apparatuses that reproduce operational conditions synthetically.

Each TO will provide the specific performance requirements, locations, schedules, standards, metrics, and assessment measures in accordance with this LVC-E PWS. In the event of a conflict between this Base Contract PWS and the TO PWS, the TO PWS requirements that are specific to the training system takes precedence. The specific scope of the TO can include but is not limited to the following: system analysis, design and test, software development, post deployment software support (PDSS); non-PDSS; and cybersecurity.

This LVC-E does not include any construction of real property. Construction of real property is an installation requirement and will be performed by Government personnel or under a Naval Facilities Engineering Command contract. Should the Contractor identify a requirement for the construction or repair of real property, it shall report it to the Contracting Officer Representative for appropriate action.

Period of Performance

TO BE DETERMINED

GeNeral Information Non-personal Services This is a non-personal services contract to provide Live Virtual Constructive-Enterprise Software and Management Services. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.The Contractor shall manage its personnel and guard against any actions that give the perception of personal services. To provide a clear distinction between Government employees and Contractor employees, Contractor employees shall identify themselves as such by introducing themselves or being introduced as Contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel, as well as appropriately identifying themselves as Contractor personnel in telephone conversations and in formal and informal written correspondence. Contractor personnel shall present their badges upon request by Government employees and their representatives. If the Contractor believes that any actions constitute or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (KO) and the Contracting Officer’s Representative (COR) immediately.

Business relations The Contractor shall successfully integrate and coordinate all activities needed to execute the requirements contained herein and in any TO. The Contractor shall provide corrective action plans, proposal submittals, timely identification of issues, and effective management of subcontractors. The Contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all Contractor personnel.

cooperation While it is not planned, there may be instances in which more than one contractor is required to work on the same base/location. In such instances, it is the expectation of the Government that the Contractor extends basic professional courtesy and collaborative interaction. Should an issue arise, the Contractor shall reach a mutual agreement without the assistance of the Government. In the event that the contractors cannot resolve an issue, it is the responsibility of the Contractor to promptly notify the KO in writing and furnish recommendations for a solution. The Contractor shall not be relieved of its obligations under the base contract (and corresponding TO) or be entitled to any other adjustment because of failure to promptly refer matters to the KO or failure to implement the KO’s directions. The Contractor is not relieved of any contract requirements or entitled to any adjustments to the contract terms or price because of a failure to resolve a disagreement with another contractor unless the Contractor provides prior notice to the KO and proof to the KO that the failure to resolve was not due to the Contractor’s negligence, fault, failure to cooperate, or failure to perform its obligations in good faith.

Should KO intervention be required, the Government reserves the right to terminate the TOs for convenience at no cost to the Government. If a TO is terminated, the Government may make an award to (or negotiate an award with) another contractor based on proposals received in response to the initial request for TO proposals.

Constructive changes No modification, statement, or conduct of Government personnel who might visit the Contractor’s facility or in any other manner communicate with Contractor personnel during the performance of this contract will constitute a change under the “Changes” clause of this contract. No understanding or agreement, contract modification, change order, or other matter deviating from or constituting an alteration or change of the terms of the contract will be effective or binding upon the Government unless formalized by contractual documents executed by the KO.

The KO is the only person authorized to approve changes in the requirements of this contract, and, notwithstanding provisions contained elsewhere in the contract, the said authority remains solely with the KO. In the event that the Contractor effects any change(s) at the direction of any person other than the KO, these change(s) will be at the Contractor’s expense. No adjustment will be made in the contract price or other contract terms and conditions, as the KO did not approve consideration for the unauthorized change. Further, should the unauthorized change be to the Government’s detriment, the Contractor may be held financially responsible for its correction.

responsibility in subcontracting The Contractor shall provide the technology processes, test procedures, data, drawings, and other information required to facilitate competition to the fullest extent feasible and ensure performance by selected subcontractors. The Contractor shall be fully responsible for ensuring that all appropriate contractual provisions and clauses are flowed down to its subcontractors and that those provisions are enforced.

task orders TOs for services or work described herein may be issued by the KO at any time during the effective term of this contract. The KO will be responsible for assuring that the requirements of DFARS 215.404 are met in the event that the conditions identified in FAR 16.505(b)(2) are utilized.

Except as otherwise provided in a specific TO, the Contractor shall furnish all materials and services necessary to accomplish the work specified therein. These materials shall include consumable items, device repair parts/components, tools and test equipment, and support equipment not otherwise provided by the Government to the Contractor. The provisions of this agreement apply to all TOs issued, and to the extent that any inconsistency between a TO and this base might take place, the base shall take precedence.

Each TO will be individually funded. The appropriation and accounting data required to obligate funds will be included in each TO. As provided in each TO, Contractors may be required to track and invoice multiple lines of accounting (LOA) on each Contract Line Item Number (CLIN). As a result, Contractors must be able to track performance and report based on the applicable LOA.

Cor and ACOR The use of the term COR throughout this document also includes the term Alternate COR (ACOR), if an ACOR is appointed in writing by the KO, unless specifically excluded. An ACOR, if appointed, can only act in the absence of the appointed COR. There can only be one COR for a contract, and the duties of the COR are not delegable.

quality assurance surveillance plan The Government shall evaluate the contractor’s performance under this contract in accordance with the QASP. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

Contractor personnel, disciplines and specialties The Contractor shall satisfy the requirements of this PWS and subsequent TOs by employing and utilizing personnel with an appropriate combination of education, knowledge, skills, abilities, and experience (if applicable). The Contractor shall match the appropriate labor categories and the labor hours required to meet all the work required to be performed under the TO. All personnel training, licenses, certification, and qualifications specified in this PWS and/or subsequent TOs shall be obtained, maintained, paid for, and otherwise provided for by the Contractor.

MARINE CORPS ENTERPRISE NETWORK (MCEN)

All computer assets necessary to perform any tasks and that are otherwise required by the Contractor to meet the performance requirements of this PWS and subsequent TOs, whether to be connected to the MCEN or to be employed as standalone assets, shall be provided by the Contractor.

Contractor personnel accessing Marine Corps Systems Command Computer systems, must maintain compliance with United States Marine Corps Enterprise Cybersecurity Manual 007 Resource Access Guide. Contractor personnel will submit a DD 2875, and completion certificates for the CYBERC course located on MarineNet located at https://www.marinenet.usmc.mil. The CYBER course consists of the DOD Cyber Awareness Challenge and Department of the Navy Annual Privacy Training (PII). Contractors will have to create a MarineNet account in order to acquire the required training.

MCEN IT resources if provided are designated for official use only and other limited authorized purposes. DoD military, civilian personnel, consultants, and contractor personnel performing duties on MCEN information systems may be assigned to one of three position sensitivity designations.

1) ADP-I (IT-1): Favorably adjudicated T-5, T5R, (formerly known as Single Scope Background Investigation (SSBI)/SSBI Periodic Reinvestigation (SBPR)/SSBI Phased Periodic Reinvestigation (PPR))2) ADP-II (IT-2): Favorably adjudicated T-3, T3R(formerly known as Access National Agency Check and Inquiries (ANACI)/ National Agency Check with Law and Credit (NACLC)/Secret Periodic Review (S-PR))3) ADP-III (IT-3): Completed T-1, (formerly known as National Agency Check with Inquiries (NACI))Privileged users must maintain the baseline Cyberspace Workforce Information Assurance Technical (IAT) or Information Assurance Manager (IAM) relating to the position being filled. Privileged users are defined as anyone who has privileges over a standard user account as in system administrators, developers, network administrators, code signing specialist and Service Desk technicians.

All MCEN users must read, understand, and comply with policy and guidance to protect classified information and CUI, and to prevent unauthorized disclosures in accordance with United States Marine Corps Enterprise Cybersecurity Manual 007 Resource Access Guide and CJCSI 6510.01F.

MCEN Official E-mail usage – MCEN IT resources are provided for official government use only and other limited authorized purposes. Authorized purposes may include personal use within limitations as defined by the supervisor or the local Command. Auto forwarding of e- mail from MCEN-N to commercial or private domains (e.g., Hotmail, Yahoo, Gmail, etc.) is strictly prohibited. E-mail messages requiring either message integrity or non-repudiation are digitally signed using DoD PKI. All e-mail containing an attachment or embedded active content must be digitally signed MCEN users will follow specific guidelines to safeguard Controlled Unclassified Information (CUI), including PII and Health Insurance Portability and Accountability Act (HIPAA) information. Non-official e-mail is not authorized for and will not be used to transmit any CUI. Non-official e-mail is not authorized for official use unless under specific situations where it is the only mean for communication available to meet operational requirements. This can occur when the official MCEN provided e-mail is not available but must be approved prior to use by the Marine Corps Authorizing Official (AO).

All personnel will use DoD authorized PKI certificates to encrypt e-mail messages if they contain any of the following:

1.Controlled Unclassified Information (CUI)
2.Any contract sensitive information that normally would not be disclosed to anyone other than the intended recipient.
3.Any privacy data, PII, or information that is intended for inclusion in an employee’s personal file or any information that would fall under the tenets of MSGID: DOC/5 USC 552A. Personal or commercial e-mail accounts are not authorized to transmit unencrypted CUI.
4.Any medical or health data, to include medical status or diagnosis concerning another individual.
5.Any operational data regarding status, readiness, location, or deployment of forces or equipment.

Contractor assets connectivity to the MCEN – The contracting company will comply with MCENMSG-Unification 003-14 ENABLING CONTRACTOR ASSET CONNECTIVITY TO THE MCEN. The Contractor representative will transfer the contractor owned laptops to the MCSC G-6, Information Technology Asset Management (ITAM) department to have the MCEN images places on each laptop before it is authorized to connect to the MCEN.

All Contractor owned laps must meet or exceed the USMC laptop specifications. A list of laptops authorized to be attached to the MCEN can be obtained from MCSC G-6 upon request.

Upon completion of the contact or at such time as the contractor reclaims the asset from the USMC, non-Government owned internal\external hard drives shall become the property of the U.S. Government. Once the hard drives have been removed, the laptops\assets will be returned to the Contractor. For additional questions regarding current system specifications contact the MCSC, Electronic Maintenance Facility, lead at Berton.whisenant@usmc.milMagnetic Hard Drive Storage Devices – This paragraph covers the requirements of classified and unclassified internal and removable magnetic and Solid State hard drives that store the Government data. This includes, but is not limited to, storage area network (SAN) devices, servers, workstations, laptops/notebooks, printers, copiers, scanners, and multi-functional devices (MFD) with internal hard drives, removable hard drives, and external hard drives. Upon disposal, replacement, turn in of hard drives or completion of the contract, non-Government owned internal\external hard drives shall become the property of the U.S. Government in accordance with GENADMIN Processing of Magnetic Hard Drive Storage Media for Disposal.

SECURITY REQUIREMENTS

SECURITY REQUIREMENTS

TOs may require the contractor to have a Secret Facility Clearance and will require certain contractors to obtain and maintain classified access eligibility. If a Secret Facility Clearance is a requirement of the TO, then the Contractor shall have a valid Secret Facility Clearance prior to classified performance. The prime contractor and all sub-contractors (through the prime contractor) shall adhere to all aspects of 32 CFR Part 117 NISPOM. All personnel identified to perform on this contract shall maintain compliance with Department of Defense, Department of the Navy, and Marine Corps Information and Personnel Security Policy to include completed background investigations (as required) prior to classified performance. This contract shall include a DoD Contract Security Classification Specification (DD-254) as an attachment. Certain contractors will be required to perform IT-I/II duties that will require favorably adjudicated Tier 5/3 Level investigations. The Defense Counterintelligence Security Agency (DCSA) will not authorize contractors to submit the necessary Tier Level investigations solely in support of IT level designation requirements but are required to submit investigations for those employees requiring both Secret access and IT-II designation. The Government Contracting Activity Security Office (GCASO) is required to submit any required investigations in support of IT-I level designations. The contractor FSO is however required to establish, populate, and own the DISS record of every contractor processed for and/or issued a CAC or submitted for IT level duties.

The Contractor is required to provide a roster of prospective contractor personnel performing IT-I duties to the MCSC Contracting Officer’s Representative (COR). This roster shall include: full names, Social Security Numbers, e-mail address and phone number for each contractor requiring investigations in support of IT Level designations. The COR will verify the IT-I requirements and forward the roster to the GCASO. Contractors found to be lacking required investigations will be contacted by the GCASO. This contract shall include a DoD Contract Security Classification Specification (DD-254) as an attachment.

In accordance with DODI 5200.48 - DOD Controlled Unclassified Information (CUI), all contractors supporting MARCORSYSCOM who receive, store, or generate CUI are required to take the DOD Mandatory CUI Training, available on the Security Awareness Hub at: https://securityawareness.usalearning.gov/cui/index.html. Per DoDI 5200.48 and pursuant to contractual requirements, DOD contractors require initial CUI training and annual CUI refresher training. Additional MARCORSYSCOM specific CUI training and guidance can be attained by contacting the MARCORSYSCOM AC/S G-2 at (703) 432-3141 / 3140 or MCSC_ACSG2_SCMO@usmc.mil.

OPSEC Requirements. While performing aboard NAVY/USMC sites, the contractor shall comply with the provisions of DoD Directive 5205.02E, "DoD Operations Security (OPSEC) Program," SECNAV 3070.2, CMDO 3070.1A, MCO 3070.2A, and the MARCORSYSCOMO P5510.2B Security Manual, at all other sites the contractor shall comply with the local command and/or program OPSEC plan." Contractor personnel shall follow OPSEC concepts and principles in the conduct of this requirement to protect critical information, personnel, facilities, equipment, and operations from compromise. All Contractors (including Subcontractors) shall supplement their current security practices by requiring any personnel involved in executing this contract to complete OPSEC Awareness for Military Members, DOD Employees and Contractor training, available on the Security Awareness Hub at: https://securityawareness.usalearning.gov/opsec/index.htm Facility Security Officers (FSOs) are responsible for notifying the MCSC AC/S G-2 Personnel Security Office (PERSEC Office) at 703-432-3952/3490/3374if any contractor performing on this contract receives an unfavorable adjudication as any issued CAC would need to be Revoked and Retrieved. Due to Insider Threat concerns, the FSO is also requested to notify the PERSEC Office, within 24 hours, of any adverse/derogatory information associated with the 13 Adjudicative Guidelines concerning any contractor performing on this contract, if they have been granted an IT designation, issued a CAC and/or a MCSC Building Badge. The FSO shall notify the Government (written notice) within 24 hours of any contractor personnel added or removed from the contract if they have been granted classified access, granted IT designations, and issued a CAC and/or a MCSC Building Badge.

The TO COR will identify and only approve those contractor employees performing on this contract that require a CAC in order to perform their job function. In accordance with Headquarters, United States Marine Corps issued guidance relative to Homeland Security Presidential Directive – 12 (HSPD-12), all personnel must meet eligibility criteria to be issued a CAC. In order to meet the eligibility criteria, contractor employees requiring a CAC must obtain and maintain a favorably adjudicated Personnel Security Investigation (PSI). Prior to authorizing a CAC, the employee’s Defense Information System for Security (DISS) record must indicate a completed and favorably adjudicated PSI or (at a minimum) that a PSI has been submitted and accepted (opened). The minimum acceptable investigation is a T-1 or a National Agency Check with Written Inquiries (NACI). If a contractor employee’s open investigation closes and is not favorably adjudicated, the CAC must be immediately retrieved and revoked. CACs are not issued for convenience. Facility Security Officers (FSOs) are responsible for notifying the MCSC AC/S G-2 Personnel Security Office (PERSEC Office) at 703-432-3490/3952 if any contractor performing on this contract receives an unfavorable adjudication after being issued a CAC. Due to Insider Threat concerns, the Company is requested to notify the MCSC AC/S G-2 Personnel Security Office (PERSEC Office) at 703-432-3952/3490/3374, within 24 hours of any adverse/derogatory information associated with the 13 Adjudicative Guidelines concerning any contractor performing on this contract if they have been issued a CAC and/or a MCSC Building Badge. Each CAC is issued with a “ctr@usmc.mil” e-mail account that the individual contractor is responsible to maintain as active by logging in on a regular basis (at least twice a month), sending an e- mail and clearing any unneeded e-mails. Contractors issued a CAC are prohibited from “auto- forwarding” e-mail from their .mil e-mail account to their .com e-mail account. If thectr@usmc.mil” e-mail account is not kept active, G-6 will deactivate the account and the CAC will also lose its functionality. Contractor employees shall solely use their government furnished “ctr@usmc.mil” e-mail accounts for work supporting the USMC, conducted in fulfillment of this contract, and shall not use a contractor supplied or personal e-mail account to conduct official U.S. government business. The use of a contractor or personal e-mail account for contractor business or personal use is allowed, but only when using cellular or a commercial internet service provider.

If a contractor loses their eligibility for a CAC due to an adverse adjudicative decision, they have also lost their eligibility to perform on MCSC contracts.

PUBLIC KEY INFRASTRUCTURE (PKI) REQUIREMENTS

Where interoperable DOD PKI is required for the exchange of unclassified information between DOD and its vendors and Contractors for access to PK-enabled information systems and websites, industry partners shall obtain all necessary certificates. A DOD PKI certificate or Interim External Certificate Authority (IECA) certificate is required to enable the Contractor to access to the DOD, USMC, and task/program-specific collaboration resources. Information concerning this certificate can be obtained at the http://iase.disa.mil/pki/eca/index.html website.

PHYSICAL SECURITY

At the close of each work period, Government facilities, equipment, and materials shall be secured.

WEAPONS SECURITY

Any LVC-E training system weapons are simulated/demilitarized weapons utilized for training and are not real weapons. Notwithstanding that they are not real weapons, in some cases a Federal Firearms License is required (see paragraph under Special Qualifications below). However, any LVC-E training system weapons shall be securely stored and transported in accordance with federal, state, and other laws and regulations to ensure security, loss prevention and accountability.

SYSTEM SECURITY

1.System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews
a.Within 30 days of TO award, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the contractor’s facility. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government's review of the SSPs at the Contractor's facility.
b.lf the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within 30 days of notification by the Government. The contracting officer may provide for a correction period longer than 30 days and, in such a case, may require the Contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.
c.Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor's facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).
d.The Government may, in its sole discretion, conduct subsequent reviews at the Contractor's site to verify the information in the SSP(s). The Government will conduct such reviews at least every three

(3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty days' notice to the Contractor.

2.Compliance to NIST 800-171
a.The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. I) (NIST SP 800-171), or establish a SSP(s) and POAMs that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.
b.Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POAM their plans to implement the following, at a minimum:
(1)Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;
(2)Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;
(3)Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.
(4)Audit user privileges on at least an annual basis;
(5)Implement:
i.Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e., FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,
ii.NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program).
(6)Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.
(7)Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.
3.Cyber Incident Response:
a.The Contractor shall, within 15 days of discovering the cyber incident (inclusive of the 72-hour reporting period covered in 3.1.5.7 below), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.
b.Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at

http:/ www.acq.osd.mil/dpap/dars/pgi/docs/Instructions _for_Submitting_Media.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

c.If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within 10 days of identification. In such a case, the Contractor may request a delivery date later than 10 days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.
4.Naval Criminal Investigative Service (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies.

5.NCIS/Industry Monitoring
a.In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the Contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.
b.If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor1s information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.
c.In all cases, the collection or provision of data and any activities associated with this performance work statement shall be in accordance with federal, state, and non-US law.

ADDITIONAL SYSTEM SECURITY REQUIREMENTS

To provide adequate security, the Contractor shall implement National Institute of Standards and Technology (NIST) Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, the Contractor shall provide a System Security Plan (SSP) and Plan of Action and Milestones (POAMs) in accordance with Contractor’s SSP (CDRL A001) indicating whether the Contractor has implemented the security requirements therein, plans to implement the security requirements, or that the requirement is not applicable.

The Contractor shall submit a list in accordance with the Contractor’s Record of Tier 1 Level Suppliers Receiving/Developing CUI (CDRL A002) of all supporting Tier 1 Level suppliers receiving or developing covered defense information, otherwise known as CUI. In addition, the Contractor shall provide its plan to government review and approval to track flow down of covered defense information and to assess DFARS Clause 252.204-7012 compliance of known Tier 1 Level suppliers.

The Contractor shall document and report all cyber incidents that affect the covered Contractor information system or the covered defense information residing therein, or that affect the Contractor’s ability to perform requirements designated as operationally critical support via the Cyber Incident Reporting (CDRL A003). The Contractor shall submit malicious software discovered and isolated in connection with a reported cyber incident to the DoD Cyber Crime Center. The Contractor shall report all cyber incidents or compromise related to Government CUI in accordance with DFARS 252.204-7012 to the Damage Assessment Office (DAMO) via the DIB- NET Website (http://dibnet.dod.mil) within 72 hours. The Contractor shall if requested, submit media and additional information to support damage assessment.

CDRL A001: DI-MGMT-82247 Contractor’s System Security Plan CDRL A002: DI-MISC-80508B Contractor’s Record of Tier 1 Level Suppliers

VISIT REQUESTS

The Contractor shall comply with DoD 5220.22-M, National Industrial Security Program Operating Manual and SECNAV M‐5510.30, JUN 2006, DoN Personnel Security Program, ALMAR 010/01, USMC Policy on Civilian Guests and Federal Acquisition Regulation (FAR) 52.204‐2 for access to USMC bases and information. All Contractor visits requiring a visit access request (VAR) shall be provided by the Facility Security Officer (FSO) via the JPAS system a minimum of five working days prior to scheduled visits. Contractor personnel shall have two forms of picture identification, which shall include a valid employee badge issued by the Contractor, when visiting a worksite either at the home work station or while traveling to other sites.

SAFETY

ACCIDENTS, MISHAPS, AND GOVERNMENT DECLARED EMERGENCIES

The Contractor shall immediately report any accident/incident with safety/security implications or any other conditions or incidents that could reasonably be expected to be of interest to the COR and the Contracting Officer no more than four hours from the accident or mishap. Damage to Government property or injury to Government or Contractor personnel or civilian guests must be reported to the COR and Contracting Officer within four hours. Contractor initial reports may be verbal but shall be followed up in writing within 24 hours. Contractor reports of incidents with security implications shall include full details of the incident, any remedial actions that were taken by the contractor, and shall comply with all applicable security instructions.

The Contractor shall investigate all accidents occurring on Government property involving Contractor personnel and report the findings (on applicable forms) to the COR and Contracting Officer within three calendar days of the incident.

Reportable incidents shall be reported to the Government by the Contractor in accordance with the requirements of this PWS via submission of CDRL B001 - Accident Mishap Report. The data deliverable shall be generated and delivered to the Government for reportable events in accordance with the specific performance requirements that accompany each individual TO for services.

The Contractor may experience an unexpected suspension of training or operation aboard USMC facilities due to Government declared medical or other emergencies. TOs may require Contractor action in response to Government-declared medical or other emergencies to ensure the training systems and related equipment continue to be suitable for training.

CDRL B001: DI-MGMT-82188 Accident Mishap Report

LOCATIONS AND HOURS OF WORK

Each TO for services will identify the specific places of performance applicable to the period of performance for that TO. In addition, each TO will also address any specific conditions applicable to the hours of work related to performance under the order. Federal law (5 U.S.C. 6103) establishes the following public holidays, which will be recognized for the purpose of this requirement:

•New Year's Day
•Birthday of Martin Luther King, Jr.
•Washington's Birthday
•Memorial Day
•Juneteenth National Independence Day
•Independence Day
•Labor Day
•Columbus Day
•Veterans Day
•Thanksgiving Day
•Christmas Day

However, the Government may schedule training events on Federal Government holidays that require Contractor support.

This is a performance-based services acquisition. Therefore, the Contractor is required to meet performance requirements as part of the proposed TO even where the Government’s needs necessitate Contractor performance beyond the typical eight-hour workday or forty hour work week.

INCLEMENT WEATHER

In the event of inclement weather, the Contractor shall comply with the local installation’s Inclement Weather Policy. The Contractor will provide notice to the KO and COR, as soon as is reasonably possible, when inclement weather conditions impact one or more of the places of performance provided for under the contract. The Contractor is not required to return to any Government facilities to survey equipment or conduct operations checks until the installation has announced "all clear."

INSTALLATION ACCESS

The Contractor shall comply with installation, facility, and area commander installation/facility access and local security policies and procedures. The Contractor shall be responsible for all costs it incurs that are associated with classified and unclassified installation access and providing all of the information required to obtain clearances, permits, passes, or security badges that are required for Contractor personnel or equipment access. This includes information required for police, background checks, or investigations. The Contractor shall be responsible for ensuring such clearances, permits, passes, or security badges are promptly returned to the issuing activity upon the termination of an employee, completion of a project, or termination of a contract or subcontract.

The Contractor shall follow all installation access requirements at host installations. Host installations may require some or all of the following for entry on to the installation: proof of a valid state driver’s license, vehicle insurance, and/or a DoD Common Access Card (CAC).

CONTRACTOR PERSONNEL ACCESS

Contractor personnel shall be on the approved Government access list before entering any access- controlled area during the term of the contract. At any time during the term of this contract, should any Contractor personnel fail to meet base, state, federal, or local access requirements, the Contractor shall immediately revoke the individual’s access, retrieve any Government provided access cards, and notify the local Government representative, COR, and KO within one hour. The Contractor shall continue to ensure that the requirements of this PWS and any TO requirements are met.

BASE ACCESS

The Installation Commander of each base has broad authority to remove or exclude any person from the military installation to protect personnel and property in order to maintain good order and discipline and to ensure the successful and uninterrupted performance of the Marine Corps mission. In the exercise of this authority, the Commanding Officer may refuse to grant personal entry passes or may bar Contractor personnel, including individuals who have been granted a personal entry pass. Refusal to grant a personal entry pass or debarment of an individual does not relieve the Contractor of the responsibility to continue TO performance.

Base access requirements and procedures may change during the term of a contract. The Contractor shall comply with all changes and shall incur all costs associated with base access requirements throughout contract performance. The Contractor agrees that such compliance shall not be grounds for a request for an equitable adjustment or other contract modification. Contractor personnel performing work under this contract shall meet current base requirements at the time the proposal is submitted and shall maintain the level of security required for the term of the contract.

Should the Force Protection Condition (FPCON) change at a facility or installation that is located at a place of performance provided for under the contract, the Contractor shall comply with the FPCON policy and notify the KO or COR as soon as is reasonably possible. It is the Government's decision as to whether the contract price will be affected as a result of FPCON changes. In the event the Government determines the FPCON changes should affect the contract price, a negotiated settlement will be reached as deemed appropriate by the KO.

Generally, the following situations apply:

(1)Contractor personnel that are able to continue contract performance (either on-site or at a site other than their normal work location) shall continue to work, provided that there is sufficient funding on any TO issued under the contract, and the contract price will not be adjusted.
(2)Contractor personnel that are not able to continue contract performance (either on-site or at a site other than their normal work location) may be asked to stop work, and the contract price may be adjusted.

Nothing in this section abrogates the rights and responsibilities of the parties relating to any stop work or termination clause or provision included in other sections of this contract.

TRAINING SYSTEM ACCESS

The Contractor shall ensure only Contractor personnel engaged in the performance of assigned work or personnel authorized entrance by the designated Government representative are allowed to enter locked areas.

Unauthorized access shall be reported to the COR, KO, and local Government representative immediately but no later than one hour from the unauthorized access.

The Contractor shall not permit any unauthorized Contractor personnel or civilian access to any training system, facility, parts, or related material without designated Government representative’s written approval. PM TRASYS personnel responsible for the LVC-E systems are “authorized” personnel and do not require COR or designated Government representative written approval to access any training facility, parts, or related material.

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it. Updated .