DRAFT NDD SOW_Sources Sought.pdf

NAVAIR DIGITAL DEPARTMENT SUPPORT SERVICES STATEMENT OF WORK

1. Background and Scope

The Naval Air Systems Command (NAVAIR) Digital Department (NDD) leads the digital transformation of NAVAIR and works to accelerate and scale digital and analytic technologies and capabilities across the NAVAIR Enterprise as a means to increase speed in the delivery and sustainment of warfighting capability. The NDD is part of the NAVAIR Engineering & Cyber Warfare Group and consists of the NAVAIR Chief Information Officer (CIO), the Command Data and Analytics Officer (CDAO), the Chief Information Security Officer (CISO), the Enterprise Architect, as well as other Echelon II digital leaders. The NDD delivers and executes command-wide strategies that align activities and provides the workforce with agile self-service infrastructure, data accessibility, visualization and analytic tools, and digital/Information Technology (IT) services to rapidly research, create, deploy, integrate, and maintain applications, enterprise solutions, and other digital capabilities. NAVAIR’s digital transformation requires leveraging advanced digital tools to implement fundamentally different business models across all business, technology development, workforce, and mission operation domains. NAVAIR is committed to a digital culture that empowers the workforce to accelerate, innovate, collaborate, develop, and deliver capabilities to meet mission outcomes.

The Contractor shall provide various types of support including: digital transformation planning and execution;

enterprise alignment; technology exploration, acceleration, and integration; digital/IT consultation; business intelligence; application portfolio management; software modernization; systems integration; Enterprise Architecture (EA) design and management; web management; Navy Marine Corps Intranet (NMCI)/Next Generation Enterprise Network (NGEN) program management; Unified Communications (UC), IT Operations;

cybersecurity; cloud services; multi-layer security support, maintenance functions; network security; automation;

digital modeling and virtual environment support; talent management; change management; data analytics and integration; artificial intelligence (AI), business process management and improvement; as well as general IT and digital support. Services are required in support of numerous current and planned initiatives (i.e., Cybersecurity related events, Cloud initiatives, emerging and disruptive technologies, IT consolidations initiatives) and infrastructure improvements.

As the NDD works collaboratively across the NAVAIR Enterprise and the Department of Defense (DoD) to align efforts and accelerate advances in digital technology, the Contractor may be required to provide support across the NAVAIR Enterprise, the Program Executive Offices (PEOs), the supported Commands (including all echelon levels), and other DoD Services, sites, and activities as required.

2. Applicable documents

The following documents are provided for reference. The documentation listed is not all-inclusive but is representative of the type of information that may be necessary to perform the work. The document version applicable to tasking will be the most current published document. A comprehensive list of Navy regulatory documents can be found at the Department of the Navy (DON) CIO IT Policy and Guidance website, https://www.doncio.navy.mil/. Throughout the life of this contract, if any policy, instruction, or regulation is replaced or superseded, the replacement or superseding version shall apply. The Contractor is responsible for researching and complying with any additional regulations applicable to the specific task area. Additional documents may be identified at the individual Task Order (TO) level. Applicable documents are listed below, but are not limited to:

2.1 DoD Specifications / Standards / other Government Documents

2.1.1 DoDM 5220.22-M National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulations Part 117, NISPOM Rule

2.1.2 SECNAV M-5510.36 By, Department of the Navy, Information Security Program

2.1.3 DODI 5200.48 – DoD Information Security Program: Controlled Unclassified Information (CUI)

2.1.4 DoDD 5400.07, DoD Freedom of Information Act (FOIA) Program

2.1.5 DODI 5230.24 – Distribution Statements on Technical Documents, Change 3

2.1.6 SECNAV M-5510.30C, Department of the Navy, Personnel Security Program

2.1.7 OPNAVINST 3440.17A, Navy Installation Emergency Management Program

2.1.8 DODI 8582.01 - Security of NON-DOD Information Systems Processing Unclassified Non-Public DOD Information

2.1.9 NIST SP 800-171 – Special Publication: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

2.1.10 DoDM 5105.21, Volumes I-III - Sensitive Compartmented Information (SCI) Administrative Security Manual

2.1.11 DODD 8140.01 – Cyberspace Workforce Management

2.1.12 DODI 8140.02 – Identification, Tracking, and Reporting of Cyberspace Workforce Requirements

2.1.13 DODM 8140.03 – Cyberspace Workforce Qualification and Management Program

2.1.13 NIST SP 800-181 – Special Publication: Workforce Framework for Cybersecurity

2.1.14 DODI 5000.75 Business Systems Requirements and Acquisition

2.1.15 DoDD 8500.01 - Cybersecurity

2.1.16 DoDI 8510.01 - Risk Management Framework for DoD Systems

2.2 Department of Defense Standards

Not applicable.

2.3 Navy Documents

2.3.1 NASPAXRIVINST 5100.35D – Safety and Occupational Health Manual

2.3.2 NASPAXRIVINST 12610.7H – Employee Reporting Procedures During Emergencies OPNAVINST 3440.17A – Navy Installation Emergency Management Program

2.3.3 OPNAV 5239/14 SAAR-N – System Authorization Access Request Navy (SAAR-N) OPNAVINST 5239.1D- US Navy Cybersecurity Program

2.3.4 NASPAXRIV 5510.15Q- Base Access Regulation

2.3.5 SECNAVINST 5239.20A – Department of the Navy Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification

2.3.6 SECNAV M-5510.36 – Information Security Program

2.3.7 SECNAVINST 5510.36B - DoN Information Security Program (ISP) Regulation

2.3.8 OPNAVINST 5530.14E Navy Physical Security and Law Enforcement Program

2.4 Industry Standards

Not applicable.

3. Requirements

3.1 General Requirements

3.1.1 Compatibility. The Contractor shall maintain the capability to prepare documents and software packages compatible with the Government IT environment through the security classification of Top Secret. The current operating environment required includes:

Microsoft Windows 10 Microsoft Project 2016 or greater Microsoft Office Professional Plus 2016 or greater Microsoft SharePoint 2016 Adobe Acrobat XI (reader) Internet access Microsoft Teams (64-bit) Microsoft 365

The Contractor shall maintain the ability to interface with and transfer data to and from requiring office software applications and their upgraded versions. The Contractor shall ensure that all media are virus free when delivered.

The Contractor shall be capable of Internet and LAN communications with the Government. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with the Government during working hours whether at Contractor work site or on travel.

3.1.2 Work Location, Facilities, and Telework

3.1.2.1 Work location. Approximately 30 percent of work will be performed at Government site and 70 percent of work will be performed at Contractor site. The Contractor shall support the NAVAIR enterprise-wide environment within the Continental United States (CONUS), which is comprised of facilities at Patuxent River, Maryland, Patuxent River remote facilities (St. Inigoes, Solomon’s Island Naval Center, Washington Liaison Office in Arlington VA, and leased spaces within the 30 mile range); China Lake, California; San Diego/North Island, California; Point Mugu, California; Jacksonville, Florida; Cherry Point, North Carolina; Lakehurst, New Jersey; and Orlando, Florida. Work in support of this Statement of Work (SOW) shall be primarily performed at the Contractor’s facility or at Patuxent River, MD; however, the place of performance is not limited to the above locations due to the evolving, integrated and capability-focused enterprise requirements throughout NAVAIR and the DoD. Specific work locations will be included in individual Task Orders (TO). Contractors performing on-site support will be provided access to workspaces, telephones, printers, facsimile machines, copy machines, shredders, computers, and network access including web servers and applicable databases or other applications necessary to carry out assigned tasks.

3.1.2.2 Meeting support. In support of the tasking outlined in this SOW, the Contractor shall have the capability to host and conduct meetings at the classification levels up to unclassified with the capacity to support a minimum of 30 persons and have contractor furnished telephone and VTC capability as well as sufficient equipment to conduct meetings with presentations including compatible software as required in Paragraph 3.1.1). This support shall be provided at a local facility within a 15 mile radius to NAS Patuxent River, MD location.

3.1.2.3 Telework. The Contractor may allow employees to telework with approval from the Contracting Officer's Representative (COR) in writing, that the positions tasking is eligible for telework, may utilize alternate worksites/locations and telework to support continued performance of the SOW tasks in accordance with (IAW) company policy. Contractor discretion is required when making alternate worksite and telework decisions based upon the nature of support provided by the employees. In the event telework is utilized, the Contractor remains responsible for performance, and compliance with any applicable cost accounting standards and contract cost principles / procedures.

Various positions will be required to routinely access Secure Internet Protocol Router Network (SIPRNet) in performance of the contract. Therefore, telework employees who require SIPRNet access, shall be within proximity and commutable distance to a SIPR facility.

3.1.3 Contractor reporting. The Contractor shall provide the following Contract Data Requirements List (CDRL) deliverables as specified in the IDIQ contract or individual TOs.

CDRL Title A001 Monthly Progress and Financial Status Report A002 Contractor Personnel Locator Report A003 Transition Out Plan (IDIQ level) A004 Technical Report-Study/Services A005 Software Documentation / Application / Interface Code A006 OPSEC Plan (IDIQ level) A007 Standard Operating Procedures and Desk Guides

3.1.3.1 Monthly Progress and Financial Status Report. The Contractor shall provide a progress and financial status report IAW CDRL A001. Throughout contract performance, the Contractor shall maintain an updated and current staffing plan and obtain approval from the Government, prior to incurring additional costs and/or adding personnel to the contract. The report shall include work accomplished since submittal of the last report, both monthly and cumulative man-hour labor costs expended by individual personnel and labor category as well as material and travel costs.

a) Cost Plus Fixed Fee (CPFF) Contract Line Item Numbers (CLINs): The Contractor shall provide information by CLINs/Subcontract Line Item Numbers (SLINs)/Appropriations, to include, cost details (i.e.

Employee Name, Labor Category, Rate, Current and Cumulative Hours & Costs etc.), financial status of cost CLINs (i.e., funding applied, expenses incurred during current reporting period, total expenses to date, amount remaining, etc.) and forecast of funds depletion by CLIN type based on known requirements.

b) Cost Reimbursable CLINs: The Contractor shall provide information by CLIN/SLIN/Appropriation, to include, travel details (i.e. Traveler Name(s), Dates of Travel, Destination, & Purpose for travel); ODC expense details (Item/Name, Description, Unit Cost, Number of Units, & Extended Costs for ODCs, etc.);

financial status of cost-related CLINs (i.e., funding applied, expenses incurred during current reporting period, total expenses to date, amount remaining, etc.) and forecast of funds depletion by CLIN type based on known requirements.

c) Government Furnished Property/Equipment (GFP/GFE)/Contractor Acquired Property (CAP) Reporting:

The Contractor shall maintain a documented property accountability system and procedures whereby all GFP/GFE and CAP are tracked by documenting all pertinent information about property, including item nomenclature, serial number, and location. Upon termination of the Contract, all GFP/GFE/CAP shall revert to the Government.

3.1.3.2 Contractor Personnel Locator Report. The Contractor shall provide a Contractor Locator Report IAW CDRL A002.

3.1.3.3 Other Reporting. The Contractor may be required to provide additional reporting, documentation, products, and schedules, IAW CDRLs incorporated in individual TOs. Other reporting requirements may include, but are not limited to: specific technical reports, documentation, multimedia products, training courses and materials, data, evaluations and analysis, digital information, etc.

All other CDRL details will be included in each CDRL Form DD1423.

3.1.4 Work Schedule to include Compressed Work Schedule (CWS), overtime, holidays, and installation closure.

3.1.4.1 Work schedule. The Contractor shall provide the required services and staffing coverage during normal working hours. Normal working hours are usually 8.5 hours (including a 30-minute lunch break), from 0600 to 1800 each Monday through Friday (except on the legal holidays specified in paragraph 3.1.4.1.2).

3.1.4.1.1 Compressed Work Schedule (CWS). CWS is an alternative work schedule to the traditional five 8.5 hour workdays (which includes a 30-minute lunch) worked per week. Under a CWS schedule, an employee completes the following schedule within a two-week period of time: eight weekdays are worked at 9.5 hours each (which includes a 30-minute lunch), one weekday is alternately worked as 8.5 hours (which includes a 30-minute lunch) and one weekday is not worked by the employee. The result is 80 hours worked every two weeks, with 44 work hours one week and 36 work hours the other.

The Contractor may allow its employees to work a CWS schedule provided the requirements of this SOW are met.

If the Contractor chooses to allow its employees to work a CWS schedule in support of this contract, any additional costs associated with the implementation of the CWS schedule vice the standard schedule are unallowable costs under this contract and will not be reimbursed by the Government. Additionally, the CWS schedule shall not prevent Contractor employees from providing necessary staffing and services coverage as required by the Government to the Alternate/Contracting Officer’s Representative (A/COR).

3.1.4.1.2 Holidays. The Government observes the Federal holidays identified on the Office of Personnel Management (OPM) website: https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview.

With the exception of the events in section 3.1.4.1.3 below, the Contractor is permitted to observe federal holidays in accordance with its corporate policy.

3.1.4.1.3 Installation closure. When Federal facilities are closed by the Government, or when Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility related problem that prevents Federal personnel from working at the Government facility, contractor personnel assigned to work at that facility in support of such Federal employees shall follow their parent company’s policies.

While generally contractor personnel may not perform work on-site at a Government facility without oversight from Federal personnel, in very limited circumstances, work being performed by contractor personnel may be deemed mission essential and performance of such mission essential work may be authorized to continue at the Government facility despite the facility being otherwise closed for normal operations. The circumstances permitting work being performed by contractor personnel to be deemed mission essential are extremely limited and generally only apply to performance of efforts related to public health, safety, or matters related to national security. The cognizant Contracting Officer must concur with any determination that work being performed by contractor personnel is mission essential.

3.1.4.1.4 Overtime. Overtime as defined in this contract refers to hours worked by a Contractor employee in excess of the employee’s normal workweek. When support requirements outside of normal working hours occur, the Contractor shall ensure qualified personnel are available to support the requirements through the use of overtime.

Overtime is authorized under this contract to the extent specified in individual TO, provided COR approval is obtained in advance. The COR may provide concurrence for overtime on a task, event, program, project, or general function basis. The total cost for overtime over the life of the contract cannot exceed the amount specified in clause 52.222-2 Payment for Overtime Premiums unless first approved in writing by the approved in writing by the Chief of the Contracting Office.

3.1.5 Other Direct Costs (ODCs). The COR/ACOR approval shall be obtained prior to the purchase of any material or travel expenses in accordance with CTXT.242-9520.

3.1.5.1 Travel. Travel will be allowable only when it is essential to the performance of the tasks detailed in Section

3.3. Reimbursement for travel performed shall be IAW the DoD Joint Travel Regulation (JTR). Travel may include general and administrative expenses, but shall not include profit. Temporary travel to other locations in support of program tasking is required. Temporary travel locations may include Cherry Point, NC; Jacksonville, FL; Orlando, FL; San Diego, CA; China Lake, CA; Pt. Mugu, CA; Atsugi, Japan. This list is not all-inclusive as locations may change over the life of the contract.

3.1.5.2 Material/other ODCs. The Contractor may be required to purchase material and other ODCs in support of performance under individual TOs on an “as required” basis. IAW CTXT.242-9520, the Contractor shall obtain advance written approval for material purchases. All materials not depleted during the performance of this contract shall become Government property upon completion of this contract. The Contractor shall transfer all materials not depleted to the COR by way of Material Inspection and Receiving Report (DD Form 250). Material costs may include general and administrative expenses, but shall not include profit/fee.

The costs of general purpose business expenses required for the conduct of the Contractor’s normal business operations are not an allowable direct cost in the performance of this contract. General purpose business expenses include, but are not limited to, the cost for items such as telephones and telephone charges, reproduction machines, word processing equipment, personal computers and other office equipment and office supplies.

3.1.6 Subcontractors. Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this contract. Provisions of this SOW shall flow down to subcontractors providing support under this contract, as applicable.

3.1.7 Management of Contractor Personnel. The Government will neither supervise contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual contractor employees. The Contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services.

3.1.7.1 Technical Training. Due to the technical nature of the work, there may be special, unique, and emergent training required during the execution of this contract. This training may include, but is not limited to, specific software, hardware, and procedures as required for the specific system or requirements being supported. All requests for cost reimbursable training shall include a written justification by a Government Technical Point of Contact (TPOC) and course information including, but not limited to the source of the training, the dates of the training, a training course description, and training cost including quotes from the vendor. General educational courses or programs for enhancement of basic qualifications or academic standing of employees shall not be accomplished at the Government’s expense. No cost reimbursable training shall be scheduled or executed without written approval from the COR in accordance with CTXT.242-9520 PROCEDURES AND APPROVALS REQUIRED PRIOR TO

INCURRING DIRECT MATERIAL COSTS (APR 2022).

3.1.8 Transition Out Strategy.

The Contractor’s overall transition out strategy shall be built around maintaining the mission of the program with minimal impact, not only in terms of timeliness of performance but also to ensure that critical data and knowledge transfer occurs. Prior to the termination or expiration of the contract, the Contractor shall ensure an orderly transition of responsibilities, while minimizing impact to the operation. The Contractor shall submit a Transition Out Plan CDRL A003, to include the minimum elements listed below:

- Work Turnover. The Contractor shall provide a plan of action to effectively transfer tasked work that is in process at the expiration or termination of the contract to the successor company. Establish and maintain effective communication with the incoming contractor or Government personnel for the period of transition via weekly status meetings.

- Quality Assurance. The Contractor shall provide a plan of action to ensure continuation of quality review processes during the transition period to the successor company.

- Risk Mitigation Strategies. The Contractor shall provide a plan of action to mitigate contract performance risks

(quality and schedule) encountered during the transition period.

- Data/Information Transfer. The Contractor shall provide a plan of action for the efficient inventory and transfer of program data to the successor company.

3.1.9 Program Unique Requirements.

3.1.9.1 Compliance and Collaboration.

The Contractor shall perform all digital/IT services in accordance with the latest applicable guidance and policies.

Contractor support activities shall be performed in accordance with Federal, DoD, DON, and NAVAIR statutory and regulatory requirements, such as Application Portfolio Management, Defense Business Transformation Guidance, Navy Enterprise Application Developer’s Guide, Clinger Cohen Act (CCA), Federal Information Security Management Act (FISMA), and Web Enablement. Any tools that will be hosted by NMCI or run on NMCI workstations must be certified for NMCI and comply with NMCI policy.

As there are multiple digital/IT projects, initiatives, and activities ongoing throughout the NAVAIR Enterprise and the DoD, the Contractor shall work in close cooperation, collaboratively, and in an integrated manner with other support contractors as required, to maximize organizational alignment and technology acceleration.

3.1.9.2 Rapid Response to Evolving Technologies.

It is anticipated that the majority of support under this contract will be required for digital/IT innovation including complex, emerging, and rapidly evolving technology acceleration and modernization needs. The Contractor may be required to respond rapidly, to meet surge requirements, across a wide portfolio of emerging and disruptive technology areas [e.g., Cloud computing and related “X-As-A-Service”, block chain, internet of things, AI /machine learning (ML), robotics process automation, container technologies, edge computing, quantum computing, Progressive Web Apps, 5G, LiFi technologies, etc.]. As digital technology rapidly evolves and emerges, the Contractor may be required to support digital technology areas not specifically listed herein.

3.1.9.3 Quality Control.

The Contractor shall maintain an effective quality control program to ensure services are performed IAW the SOW and the Contract Surveillance Plan (CSP). The Contractor shall implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Government shall evaluate the Contractor’s performance under this contract IAW the CSP.

3.1.9.4 Task Order Requirements.

Specific requirements will be outlined in individual TOs and will be provided in the form of a SOW.

3.1.9.5 Non-Disclosure Agreements (NDAs) and Organizational Conflicts of Interest.

In the performance of the contract, the Contractor may have access to non-public information. The Contractor shall provide signed NDAs for those employees, as requested by the COR, no later than five (5) business days after TO award.

Consistent with the terms and conditions of paragraph (e) of NAVAIR 5252.209-9510 Organizational Conflicts of Interest (Services), with respect to proprietary data of third parties, and DFARS 252.227-7025, Limitations on the Use Or Disclosure of Government-Furnished Information Marked with Restrictive Legends, with respect to technical data, the Contractor shall not use, modify, reproduce, release, perform, display, and disclose any non-public information provided to or obtained by the Contractor in the course of performing this contract for other than Government purposes, and shall not do so for any commercial or personal purpose.

In the event that the Contractor knows of or identifies that it has a commercial interest in the subject matter of any proposed or on-going agreement with respect to which contract services are to be performed, the Contractor shall consider such interest a potential conflict of interest under NAVAIR 5252.209-9510(g) and promptly disclose it to the Contracting Officer Representative and Administrative Contracting Officer (ACO).

3.2 Security.

3.2.1 Citizenship Requirements. Only U.S. citizens may perform under this contract unless waived by the Government. If the Contractor cannot find qualified U.S. citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office. The waiver request should include:

a. The individual's name, date and place of birth, position title, and current citizenship.

b. A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements.

c. A statement of the unusual expertise possessed by the applicant.

d. A statement that access will be limited to a specific government contract (specify contract number).

e. A statement that the Contractor has obtained an export license for the information required to perform the contract.

3.2.2 Investigative Requirements.

Unclassified. All Contractor personnel must be eligible to perform Non-Critical Sensitive work as defined by SECNAV M-5510.30C. All Contractor personnel are required to have a favorably adjudicated Tier-3 investigation from the OPM. The Contractor shall submit a request for personnel security investigation to the Government Security Office. The Government Security Office shall initiate the Contractor employee’s Electronic Questionnaire for Investigations Processing (eQIP)), shall do a preliminary screening of the Contractor employee's eQIP for suitability and derogatory information. The Contractor employee shall provide all requested information pursuant to the Privacy Act of 1974. The Government Security Office may deny the Contractor access to Government facilities and information and may prohibit the Contractor from performance of sensitive duties for failure to provide requested information or when derogatory or adverse information is present on the Contractor employee's eQIP, In such cases, the Contractor employee may not perform on the Contract.

The Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of controlled unclassified information and to control distribution of controlled unclassified information in accordance with the National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulation Part 117, NISPOM Rule, and SECNAV M-5510.36B. All Contractor facilities shall provide an appropriate means of storage for controlled unclassified information and materials. All controlled unclassified information shall be appropriately identified and marked in accordance with DoD Instruction 5200.48, Controlled Unclassified Information (CUI).

Controlled Unclassified Information including Legacy FOUO and Covered Defense Information (meeting the definition of 48 CFR 252.204–7012(a)) generated and/or provided under this contract shall be marked and safeguarded as specified in DoD Instruction 5200.48, Controlled Unclassified Information (CUI). available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF. Any product containing Covered Defense Information shall be assigned a distribution statement (distribution statements B through F) using the criteria set forth in DoDI 5230.24 (Distribution Statements on Technical Documents); and have this statement displayed per DoDI 5230.24, Enclosure 3.

All controlled unclassified technical information shall be appropriately identified and marked with the following distribution statement(s):

Distribution Statement (Insert Appropriate Letter and Authorization Title), (Insert Appropriate Reason Category) (dated – (Date of Distribution Authorization). Other requests shall be referred to: Commander, Naval Air Systems Command, Attn: (Program/User Agency mailing address).

Classified. All Contractor personnel shall maintain security clearance eligibility commensurate with the level of classification of the work performed as annotated in the Contract's DD-254, Contract Security Classification Specification Form.

Contractor personnel shall require access to classified information in performance of this contract up to and including Top Secret, with a safeguarding level of Secret. The Contractor is responsible for ensuring that all personnel receive the requisite investigation and are favorably adjudicated IAW NISPOM codifying 32 Code of Federal Regulation Part 117, NISPOM Rule. Contractor employees who fail to meet security clearance requirements may not access classified information or perform sensitive duties. In such cases, the Contractor employee may not perform on the contract.

The contractor shall comply with security requirements specified in the DD-254 attached to this contract.

Information or data that the contractor accesses shall be handled at the appropriate classification level. Unclassified information shall be handled in accordance with the appropriate designation (Controlled Unclassified Information;

Legacy FOUO; Covered Defense Information). Distribution is authorized to the Requiring Office's Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the TPOC/COR of this contract for approval.

Controlled Unclassified Information including Legacy FOUO and Covered Defense Information (meeting the definition of 48 CFR 252.204–7012(a)) generated and/or provided under this contract shall be marked and safeguarded as specified in DoD Instruction 5200.48, Controlled Unclassified Information (CUI). available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF. Any product containing Covered Defense Information shall be assigned a distribution statement (distribution statements B through F) using the criteria set forth in DoDI 5230.24 (Distribution Statements on Technical Documents); and have this statement displayed per DoDI 5230.24, Enclosure 3.

3.2.3 Common Access Card (CAC)/Public Key Infrastructure (PKI), System Authorization Access Request (SAAR- N).

3.2.3.1 SAAR-N. All contractor personnel requiring access to Government IT systems shall have an approved System Authorization Access Request (SAAR-N) Form OPNAV 5239/14 (Rev Sep 2011) on file, and complete required Annual Information Awareness Training. New employees must submit their SAAR forms within thirty (30) days of their first day of work. Instructions for processing the SAAR-N forms are available at:

http://www.cnrc.navy.mil/publications/Forms/OPNAV_5239_14_SAAR_N.pdf.

SAAR-N forms shall be submitted to the COR, TPOC, or to the assigned government Trusted Associate Sponsorship System (TASS) Trusted Associate.

3.2.3.2 Command Access Cards (CAC)/Local Badges. Contractor CACs and facility specific identification badges will be issued by the Government to on-site contractor personnel and shall be visible at all times while personnel are at the Government site. The Contractor shall furnish all requested information required to facilitate issuance of identification badges and shall conform to local installation policies and guidance as appropriate. All CACs and identification badges issued to Contractor employees shall be returned to the Government Security Department at the Government site IAW local installation policies and guidance as appropriate following completion of the contract, relocation or termination of an employee, or upon request from the COR. The Government will provide the Contractor access to Government facilities, as required, for performance of tasks under this contract.

3.2.2.3 DD-254. The contractor shall comply with security requirements specified in the DD-254 attached to this contract. DD-254 guidelines may be updated in performance of the contract, as required. DD-254 guidelines may be updated in performance of the contract, as required. Individual task orders may include task order specific DD-254s that provide security guidance applicable to a project/program associated with the individual task order. Information or data that the Contractor accesses shall be handled at the appropriate classification level, unclassified information shall be handled as “Controlled Unclassified Information (CUI)”. Distribution is authorized to the Requiring Office’s (RO) Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the TPOC/COR/ACOR of this contract for approval.

3.2.4 Information Security. If the work is performed at the Contractor's facility, the Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and CUI and to control distribution of CUI IAW NISPOM codifying 32 Code of Federal Regulation Part 117, NISPOM Rule, and SECNAV M-5510.36B. If the work is performed at the Government's facility, the Contractor shall comply with the applicable Facilities Instructions/Guidance, the latest applicable Program Protection Plan(s), and applicable Security Classification Guide(s).

3.2.4.1 Marking. All information generated by the Contractor shall be properly marked. CUI information generated and/or provided under this contract shall be marked IAW DoDM 5200.01. Technical information shall also be marked with appropriate Distribution Statements and Export Control warnings IAW DoDD 5230.24 and program Security Classification Guidance.

3.2.4.2 Public Release. Any CUI pertaining to this contract shall not be released for public dissemination, including posting to any social media sites such as Facebook or Twitter, unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release through NAVAIR HDQTRS, Public Affairs Office, 47123 Buse Road, RADM William A. Moffett Building, Patuxent River, MD 20670-1547.

3.2.4.3 Loss, Compromise and/or Electronic Spillage of Classified or CUI. All instances of loss, compromise and electronic spillage of classified or CUI shall be reported to the COR, TPOC, and Government Security Office within 24 hours of the incident occurring.

Classified data spills occur when classified data is introduced either onto an unclassified information system or to an information system with a lower level of classification, or to a system not accredited to process data of that restrictive category. The number of classified spillages on Defense Department information systems continues to rise, resulting in significant costs to NAVAIR, particularly in light of the current resource-constrained environment.

The Navy’s IT Service Provider (NMCI) has been charging the Government per contaminated workstation to contain and clean an electronic classified spillage. The Contractor will be responsible for all costs associated with containment, clean up, and remediation of any classified spillage that is the result of the unauthorized disclosure of classified information by any Contractor employee.

3.2.4.4 Compliance to NIST 800-17. In accordance with DOD INSTRUCTION 8582.01 SECURITY OF NON- DOD INFORMATION SYSTEMS PROCESSING UNCLASSIFIED NONPUBLIC DOD INFORMATION, the Contractor shall implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a System Security Plans (SSP) and Plans of Action and Milestones (POA&M) that varies from NIST 800-171 only IAW DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

The Contractor shall, at a minimum, meet the Basic Safeguarding Requirements as follows to meet the comparable security requirements of the NIST SP 800-171 as indicated.

The Government may, in its sole discretion, conduct reviews at the Contractor’s site to verify compliance. The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days’ notice to the Contractor.

If the Government determines that the security controls do not adequately implement the requirements of NIST 800- 171, then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The ACO may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a POA&M for the correction of the identified deficiencies. The Contractor shall immediately notify the ACO of any failure or anticipated failure to meet a milestone in such a POA&M.

Upon the conclusion of the correction period, the Government may conduct a follow-on review at the Contractor’s facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies.

3.2.5 Operations Security (OPSEC). The Contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the Contractor and any subcontractor during performance of the contract. The Contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. This program may include cybersecurity, Information Assurance (IA) and Communications Security (COMSEC). The OPSEC program shall be IAW National Security Decision Directive (NSDD) 298, and at a minimum shall include:

1) Assignment of responsibility for OPSEC direction and implementation.

2) Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

3) Establishment of OPSEC education and awareness training.

4) Provisions for management, annual review, and evaluation of OPSEC programs.

5) Flow down of OPSEC requirements to subcontractors when applicable.

While performing aboard NAVAIR or NAVAIR sites, the Contractor shall comply with facility OPSEC program instructions and contribute to organization-level OPSEC efforts. Include OPSEC as part of its ongoing security awareness program and take all required Agency training. Be responsive to the Supporting OPSEC Manager on a non-interference basis. Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the RO and Contractor in support of the mission.

3.2.6 Anti-Terrorism Force Protection and Emergency Management. The work performed on this contract is not Emergency Essential IAW OPNAVINST 3440.17A and Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans (COOP). Contractor personnel shall comply with all Government Emergency Management, Antiterrorism and/or COOP and directives. Contractor personnel shall not report for work at Government facilities upon declaration of Force Protection Condition CHARLIE or in any event or emergency where Government officials direct curtailment of operations to “Mission Essential Only.” All Contractor personnel assigned to a government facility shall complete annual Antiterrorism (Level One) and Active Shooter training.

3.2.7 Program Unique Requirements:

3.2.7.1 Policy Adherence. DOD and DON IA Program outlined in Secretary of the Navy Instruction (SECNAVINST) 5239.3C, ‘DON Security Policy’ and SECNAV M-5239.2, ‘DON Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual,’ apply to efforts under this contract. Contractor personnel providing services under this contract shall comply with all Federal, DOD, DON, and NAVAIR IA policies. In addition, the Contractor shall comply with SECNAVINST 5510.30B to assure that the proper security investigation is conducted for those Contractor personnel performing services under this contract.

3.2.7.2 Information Technology Security. DON ADP Security Program outlined in SECNAVINST 5239.3C, ‘DON Security Policy’ and SECNAV M-5239.2, ‘DON I Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual,’ applies to efforts under this contract. Contractor personnel providing services under this contract shall comply with all Federal, DOD, and DON IA statutory and regulatory requirements. The Contractor shall comply with SECNAVINST 5510.30C to assure that the proper investigation (SSBI) is conducted for those contractor personnel who require IT Level 1 access. The Contractor shall coordinate with the COR/ACOR and TPOC to identify applicable positions.

3.2.7.3 Cybersecurity Workforce (CWF) – DODD 8140.01 – Cyberspace Workforce Management, DODI 8140.02, Identification, Track and Reporting of Cyberspace Workforce Requirements, and DOD Manual 8140.03, Cybersafe

Workforce Qualification and Management Program, provides guidance for the identification and categorization of positions and certification of personnel conducting cybersecurity functions within the DOD Workforce. The DOD CWF includes but is not limited to all individuals performing any of the CWF functions described in Directive 8140.03-M. All Contractor personnel supporting this contract must comply with DOD Directive 8140.03-M, where applicable, and any training required to comply with this directive is at the expense of the Contractor, and can be found in the Labor Category Qualifications. The COR in conjunction with TPOC/Alternate (A)TPOC will assign the appropriate certification category based on the duties and responsibilities being performed, relative to the current published DOD 8140 Manual.

Exceptions to this requirement shall require approval from Command CWF Program Manager (PM) and shall not exceed a six (6) month duration to become compliant with the requirements of this contract. All Contractor personnel providing services under this contract shall comply with all NAVAIR and DON IA policies and guidance where applicable and any training or certification required to comply with this directive is at the expense of the Contractor.

3.2.7.3.1 On-Boarding/Transition. The Contractor, upon the on-boarding of new employees in designated CWF positions or transition of an existing employee to an alternate position with a different identified CWF code, shall provide the Government the substantiating documents to demonstrate compliance with the identified CWF code in the time frame as defined in Section 4.5.8.3.

3.2.7.3.2 Qualification/Certification Continued Compliance. For those positions with recurring requirements to maintain qualification/certification, the Contractor shall make available to the Government for review the substantiating documents to demonstrate continued compliance IAW the required schedule of the identified CWF code.

3.2.7.3.3 Security Clearance Re-Verification. The Contractor shall, for all designated CWF personnel, provide a re-verification of the individual’s security clearance on no less than a quarterly basis. This shall be documented as part of the Personnel Locator CDRL A002.

3.2.7.3.4 Privileged User Validation: The Contractor shall coordinate, schedule, and execute CWF employee “privileged users” validation with the Command CWF PM or their designated representative. Validation is required for all designated CWF employee “privileged users” with frequency as defined by current Navy directive.

Validation is a “face-to-face” activity to confirm the individual’s identity and validation of their roles, current access rights, process compliance, and certification requirements. All “privileged users” require the submission and approval of a “Privileged Access Agreement” prior to performing privileged user duties.

3.2.7.4 Cyber Incident Response.

The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period, reference https://dibnet.dod.mil/portal/intranet/, deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

Incident data shall be delivered IAW the Department of Defense Cyber Crimes Center (DC3). Reference https://www.dc3.mil/Organizations/DIB-Cybersecurity/DIB-Cybersecurity-DCISE/

In delivery of the incident data, the Contractor shall, to the extent practical, remove Contractor-owned information from Government covered defense information.

If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the ACO in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The ACO will approve or disapprove the request after coordination with DC3.

3.2.7.5 Naval Criminal Investigative Service (NCIS) /Industry Monitoring

In the event of a cyber-incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the NCIS and associated law enforcement agencies, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, or vendor logs that show network activity, including any additional logs the Contractor, subcontractor, or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor shall cooperate with the NCIS to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

In all cases, the collection or provision of data and any activities associated with this SOW shall be IAW federal, state, and non-US law.

3.3 Program Support Requirements (NWCF, RDT&E O&M, Procurement, FMS)

This Section provides the detailed support to be provided by the Contractor. The Contractor shall provide all personnel, supervision and other non-personal services necessary to perform the tasks defined in individual TOs.

3.3.1 The Contractor shall provide technical, analytical, and managerial support for NAVAIR’s general objectives in the following major functional areas:

3.3.1.1 Digital/Information Technology Management. Activities related to management support of Digital/IT related policy development, strategic planning, enterprise architecture (EA) and infrastructure, cybersecurity, information resource management, COOP and execution, procurement actions and capital planning and investment control process to procure, use, and manage IT.

3.3.1.2 Systems Development and Engineering. Activities pertaining to software development support for existing, planned, and future NAVAIR/Navy IT systems and digital/virtual environments. Typical duties include capturing user and business owner requirements; coordinating with appropriate departmental personnel regarding EA;

identifying functional, security, and performance requirements; developing logical and physical database models;

performing coding, testing, quality assurance, design, and program documentation; implementation; and maintaining interoperability between future and existing hardware and software applications.

3.3.1.3 Operations Support.