DRAFT_Performance_Work_Statement.docx

DRAFT

PERFORMANCE WORK STATEMENT

FOR

DEFENSE COMPRESSED AIR TESTING (DCAT) PROGRAM SUPPORT

1.0 SCOPE

The Naval Surface Warfare Center, Panama City Division (NSWC-PCD) requires non-personal services to analyze breathing air for divers, damage control personnel and aviators worldwide. This Performance Work Statement (PWS) identifies the equipment and non-personal services required for analyzing breathing air in support of the Defense Compressed Air Testing (DCAT) Program. The Contractor shall furnish the manpower, facilities, equipment, transportation, and support necessary to complete the requirements of the PWS.

2.0 APPLICABLE DOCUMENTS

The following documents, of the exact issue shown, form a part of this PWS to the extent cited herein. In the event of conflict between the documents referenced and the contents of this PWS, the contents of this PWS shall take precedence. Second tier and lower reference documents (i.e., those referenced in the primary references) shall be for guidance only.

2.1 Military Standards

(a) MIL-STD-1622B (1) Cleaning of Shipboard Compressed Air Systems 15 Nov 2006

2.2 Other Documents

(a) ISO 9001:2015, Quality Management Systems-Requirements 15 Sep 2015 or latest revision

(b) CGA G7.1-2018, Commodity Specification for Air

(c) EIA -649-B-2011, Configuration Management Standard latest revision

(d) ISO/IEC 17025, International Standards Organization-- General Requirements for the Competence of Testing and Calibration Laboratories 2017

(e) NFPA 1989, National Fire Protection Association (NFPA) Standard on Breathing Air Quality for Emergency Services Respiratory Protection, 2008 or latest revision

(f) NAVSEA SS521-AG-PRO-010 US, Navy Diving Manual, 30 Apr 2018 or latest revision

(g) 49 CFR chapter 1, Subpart D, 173.115 class 2, Divisions 2.2 through 2.3, Definitions Oct 2011 or latest revision

(h) SF 86, Questionnaire for National Security Positions

(i) Executive Order 13556, Controlled Unclassified Information

(j) Privacy Act of 1974

(k) DoD 5200.01, Vol. 4, DoD Information Security Program: Overview, Classification, and Declassification, 24 Feb 2012

(l) DoD 8582.01, Security of Unclassified DoD Information on Non-DoD Information Systems, 06 Jun 2012

(m) DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, Oct 2016

(n) NIST Special Publication (SP) 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

(o) NIST SP 800-53, Recommended Security Controls for Federal Information Systems

3.0 REQUIREMENTS

3.1 Definitions

3.1.1 High-Pressure High Flow: System operating pressure of 250-5000 psi, with flow rates of 40-90 standard cubic feet per minute (scfm). (NAVSEA SS521-AG-PRO-010)

3.1.2 High-Pressure Low Flow: System operating pressure 400-5000 psi, with a flow rate less than 40 scfm. (NAVSEA SS521-AG-PRO-010)

3.1.3 Low-Pressure High Flow: System Operating pressure to 400 psi flow sampled at 0 to 150 scfm. (NAVSEA SS521-AG-PRO-010)

3.1.4 Sampling Kit: All equipment necessary for the field activity to obtain valid gas sample, oil mist/particulate sample, and moisture sample, for analysis at Contractor’s facility. The Sampling Kit consists of the Sampling Device and Sampling Media as well as necessary fittings, instructions, shipping labels, and transportable protective case and any other equipment necessary to obtain valid samples for analysis.

3.1.5 Sampling Device: The equipment that connects to the field activity’s source and enables gas sample, oil mist/particulate sample, and moisture sample to be obtained.

3.1.6 Sampling Media: The components which collect and hold the gas sample, oil mist/particulate sample, and moisture sample.

3.2 General

The Contractor shall coordinate with the NSWC PCD Contract Specialist to conduct a kick-off meeting within ten (10) working days after award of the contract. The Contractor shall assume responsibility for providing DCAT Program support within 30 days of contract award with no interruption and reduction in the quality and timeliness of the required breathing air analysis services.

3.2.1 The Contractor shall provide transportable Sampling Kits for collecting gas samples, oil mist/particulate samples, and moisture samples from high pressure and low pressure sources as defined in Section 3.1 of this Performance Work Statement (PWS). The Sampling Kit will be used by military field activities within the continental United States (CONUS), Alaska, and Hawaii and outside the continental United States (OCONUS) to obtain mandatory samples from breathing air sources.

3.2.2 The Contractor shall provide all services for analyzing gas samples, oil mist/particulate samples, and moisture samples collected by the field activity as indicated below in Section 3.4.

3.2.3 On the average, 120 individual orders from field activities are received each month, requiring 150 samples per month. One order may consist of one sample (high pressure or low pressure) or may consist of up to twenty (20) samples (combination of high pressure and low pressure). The Contractor shall plan for each Sampling Kit to be in transit for an average period of forty-five (45) days, and shall maintain a sufficient supply of sampling components to allow for equipment to be in a transit state and still meet the demand of daily orders.

3.2.4 Technical effort management will be performed by the NSWC-PCD Contracting Officer's Representative (COR) or Alternate COR (if appointed). The COR shall schedule all air sample shipments per military field activity. Equipment shall not be shipped by the Contractor unless scheduled by the COR. The Contractor shall notify the COR in accordance with paragraph 3.5.5 below to confirm shipment of scheduled air samples.

3.2.5 The Contractor shall insure rapid response to Government needs. A Contractor primary point-of-contact (POC) shall be designated by the Contractor.

3.2.6 The Contractor shall establish approved procedures to ship or analyze a Sampling Kit during non-working hours and/or on an emergency basis. (CDRL A017)

3.3 Task 1 - Sampling Kit

3.3.1 The Contractor shall provide all equipment for collecting samples for analysis to the Government in kit form. The Sampling Kit shall be self-contained with a unique number for identification.

3.3.2 A complete sample consists of any combination of the following: (1) the gas sample, (2) an oil mist and particulate sample, (3) a moisture sample (dew point), and (4) when required, a separate condensed water test. The COR will designate which combination is required for the individual orders.

3.3.3 The Sampling Media shall be permanently integrated into the Sampling Device or shall be removable from the Sampling Device once samples are collected.

3.3.4 Each Sampling Device/Sampling Media shall be capable of taking ambient or positive pressure air samples from high-pressure and low-pressure life support air compressor stations and air storage facilities presently in use at military field activities.

3.3.5 As a minimum, ten (10) Sampling Kits shall be designed that allow for connecting and sampling within Self-Contained Breathing Apparatus (SCBA) cylinder filling containment units, where the only control devices are a filling pressure gauge and flow valve. The kits shall have a means of collecting and/or measuring gaseous components, oil mist/particulate, and moisture with the compressor system approximating normal SCBA filling rates.

3.3.6 Each Sampling Device shall be designed so that while performing sample collection, there is a positive method for the operator to know that air is passing through the sampling equipment.

3.3.7 For the oil mist/particulate sample, the air sources to be sampled have no means with which to measure volume of air pumped. The Sampling Device itself shall contain a volume measuring device/technique, and shall collect oil mist/particulate at system maximum flow and pressure. There shall be no reducer, filter, or screens upstream of the oil mist/particulate sampling device.

3.3.8 The Sampling Device shall be capable of connecting to:

(a) Standard United States manufactured SCUBA yoke, 5000 psi service.

(b) Male 9/16-18 UNF-3 threads (commonly known as oxygen fitting).

(c) 1/4 Swagelok hex nut.

(d) Male 3/8" NPT.

(e) 1/2" CPV-type, face-seal valve. Adapter fitting should be made of the following components:

(1) CPV reducing tailpiece, 1/2", O-ring face seal to 1/4-18 FNPT, P/N 53R-3-l.

(2) CPV union nut, 1 3/4-12 UN threads PN 50N-3.

(3) Adapter fitting, 1/4-18 MNPT to 1/4" JIC 37 flare, male.

(4) CGA 346 separate Adapter outlet (universal not allowed)

(5) CGA 347 separate adapter outlet (universal not allowed)

(6) Reducing connector 1/2" x 1/4"

3.3.9 The Sampling Device, Sampling Media, and all other components of the Sampling Kit shall be designed with a safety factor of no less than three to one (3:1). Pressure relief mechanisms shall be incorporated in the sampling equipment design.

3.3.10 The Sampling Device and all components of the Sampling Media shall be individually marked with a part name, identification label and serial number. The Contractor shall ensure cleanliness of sampling equipment is maintained and that sampling equipment is not damaged during shipment to or from the field activity.

3.3.11 Sampling Kit design shall incorporate a tamper-proof method for positively indicating whether Sampling Media has been used or not.

3.3.12 Each Sampling Kit shall contain an easy to read, one page, wipe-off plastic, pictogram sampling instruction. The Contractor shall submit all instructions when they are created or modified for COR approval. Each Sampling Kit shall contain a data sheet for the field activity to record pertinent test/contact data such as sampling component identification, air source identity, flow rates, flow times, and POC information to enable the sample to be fully identified and analyzed. The Contractor shall submit the data sheet to the COR for approval. (CDRL A016, A018)

3.3.13 Each Sampling Kit shall contain an inventory list of all equipment. Discrepancies between shipped and received inventories shall be immediately brought to the COR’s attention.

3.3.14 Each Sampling Kit transport case shall be marked as part of the “Defense Compressed Air Testing (DCAT)” Program. The marking shall be permanent or temporary and waterproof. The marking shall include the customer portal website address and cell number (850-628-6717). The transport case shall be sturdy, handled, lockable, fully sealed when closed and have a pressurization valve.

3.3.15 After the analysis is completed, the Contractor shall clean the Sampling Device, Sampling Media and other kit surfaces which come into contact with the sampling air stream, using a Government-approved cleaning procedure conforming to MIL-STD-1622B (1). (CDRL A013)

3.3.16 The Sampling Kit and all components thereof shall remain the property of the Contractor, except as stated below in paragraphs 3.3.17, 3.9, and 3.10.

3.3.17 The Government reserves the right to procure the Sampling Device and other components, to be kept on station at the field activity. The Contractor shall provide only the Sampling Media for Sampling Devices that have been procured by the Government.

3.4 Task 2 - Analysis and Laboratory Capability

3.4.1 The laboratory performing the analysis shall be accredited by the American Association for Laboratory Accreditation (A2LA), the National Voluntary Laboratory Accreditation Program (NVLAP), or the American Industrial Hygiene Association (AIHA) Laboratory Accreditation Program to ISO/IEC 17025, General Requirements for the Competence of Testing and Calibration Laboratories or an equivalent standard acceptable to the Government. Accreditation shall be maintained throughout the contract performance period.

3.4.2 The Contractor shall provide chemical analysis of air samples for all required testing.

3.4.3 The air sample analysis shall be conducted in accordance with the approved process procedures and work instructions which includes identity, type, make and model of laboratory analysis equipment used to conduct said analysis. No equipment substitutions are permitted, unless approved in writing by the COR. (CDRL A010)

3.4.4 The Contractor shall provide calibration information in accordance with ISO/IEC 17025 (or equivalent standard acceptable to the Government) for all analysis equipment to be used on this contract. (CDRL A011)

3.4.5 The Contractor shall complete air sample analysis within two working days of receipt of the Sampling Kit (or Sampling Media).

3.4.6 Sampling Kit in Emergency Status Condition: A Sampling Kit received by the Contractor in emergency status condition (paragraph 3.6.5), shall have all samples analyzed within two hours if the weight gain of the oil mist and particulate filter(s) is less than twice the detectable limits per the provisions of sections 6.4.8, 6.4.9, and 6.4.11 of NFPA 1989. If it is necessary to dry the filter(s) in a desiccant, all samples shall be analyzed within nine hours. The COR shall be notified of the results by telephone and email. The final report(s) shall be emailed or faxed to the COR when the analysis is complete. (CDRL A005)

3.4.7 Analysis Standards

3.4.7.1 The Contractor shall establish a method to determine if the Sampling Media returning from the field activity has been used. The Contractor shall also establish a method to determine if used Media has had an adequate exchange of air to yield valid results.

3.4.7.2 Gas samples, oil mist/particulate samples, moisture samples, and when required, condensed water tests from each Sampling Kit shall be analyzed in accordance with either of the below for the air purity standards, and compared with the acceptable specification limits:

(1) Air Purity Standards for Compressed Breathing Air, Chapter 4, NAVSEA SS521-AG-PRO-010 US Navy Diving Manual (30 April 2018 or latest revision)

(2) NFPA 1989

(3) CGA G7.1, Grade D with moisture (dew point -50° F)

(4) CGA G7.1, Grade E with modified moisture (dew point -50° F)

(5) CGA G7.1, Grade L with moisture (dew point -65° F)

These standards exhibit the representative constituents and reporting limits that will be required by this PWS. In some cases, the specification limit may be modified by the COR for reporting purposes. The COR shall specify which standard/specification limits apply for each Sampling Kit.

3.4.7.3 The requirements for 3.4.7.2(1) and specification limits are in Table 4-1 of the NAVSEA SS521-AG-PRO-010 US Navy Diving Manual are provided below for information purposes.

Table 4- 1. U.S. Navy Diving Breathing Air Standard

Water, by dew point (°F at 1 ATM ABS) or by moisture content (ppm or mg/L)

- 65°F 24 ppm or .019 mg/L (max)

Notes:

1. The water content of compressed air can vary with the intended use from saturated to very dry. For breathing air used in conjunction with a U.S. Navy Diving Life Support System (DLSS) in a cold environment (<50°F), where moisture can condense and freeze causing System malfunction, the verification of the dew point is paramount and shall not exceed -65°F or 10°F lower than the coldest temperature expected in the area, whichever is lower.

2. Dew points of -40°F are acceptable for submarine diver life support systems, including the Dry Deck Shelter (DDS), the VA Class Lockout Trunk (LOT), and the SSGN Lockout Compartment (LOC).

3. Specification is 25 ppm in methane equivalents when measured by a laboratory-based flame ionization detector (FID) calibrated with methane and methane excluded.

4. Specification is 5 ppm in n-hexane equivalents when measured by a laboratory-based (FID) calibrated with n-hexane and methane excluded.

5. Specification is 10 ppm as measured by other portable photoionization detector (PID) containing a 10.6 electron volt lamp and calibrated with isobutylene (includes Analox ACG+Analyzer).

3.5 Task 3 - Reporting

3.5.1 The Contractor shall not place any corporate logos on any test or supporting documentation in the execution of contract requirements. Only DCAT program logos, where appropriate, shall be placed on documentation (test, reporting, etc.) during the contract period of performance.

3.5.2 For each analysis report, the Contractor shall provide the actual readings obtained during analysis along with the allowable limits for all tests conducted. The reports shall be posted to the customer portal website that shall be accessible by the contractor and COR and by field activities and group sponsors as identified by the COR by noon of the 2nd day after receipt of the kits, and the Contractor shall supply a complete analysis report electronically when requested by the COR. (CDRL A005)

3.5.3 Failed/Incomplete Sample.

3.5.3.1 Any sample constituent that exceeds the maximum allowable limits for which it is being analyzed in accordance with the standards in paragraph 3.4.7 is deemed to have failed. Any sample taken but which resulted in inadequate exchange of air to produce valid results is deemed an incomplete sample. The Contractor shall immediately notify the COR by telephone and email of any failed sample or any incomplete sample constituent.

3.5.3.2 If the COR cannot be reached within two hours, the Contractor shall notify the field activity by telephone and email of the failed or incomplete sample.

3.5.3.3 A Notification Contact Form shall be developed by the Contractor to record direct field activity contact, to include action taken, POC information of the person contacted, date, etc. This Form shall be approved by the COR (CDRL A014). All notifications to field activities shall be documented using the approved Form.

3.5.3.4 Each analysis report of failed samples shall be marked to indicate the constituent of the sample that failed. Each analysis report shall provide an explanation of the failure. For a sample that fails the oil mist and particulate test the report shall specify the percentage content for both oil mist and particulates. Each analysis report of incomplete samples shall be marked to indicate which part of the sample was incomplete. (CDRL A005)

3.5.3.5 The final analysis report of a failed sample or incomplete sample shall be emailed to the COR within four (4) hours of completion. (CDRL A005)

3.5.4 As a part of the customer portal Website, the Contractor shall provide and maintain a computer database of laboratory results and tracking data for trends. The Contractor shall update the database quarterly to include identification of command Activity Code, make, model, and serial number of equipment sampled and actual test results. Failure of analysis shall be noted on report. Data shall be maintained for the duration of the contract. (CDRL A012)

3.5.5 The Contractor shall provide the COR with daily reports of Sampling Kits shipped and received. The Contractor shall provide the COR with monthly and end of year reports of individual field unit activity, including number of kits shipped, received, lost, with a breakdown of dollar amount per line item. The Contractor shall provide the COR a monthly accounting of all charges to Delivery Orders. Monthly accounting shall include the Delivery Order and invoice number, exact charges and balance remaining. (CDRL A001, A002, A003, A004)

3.5.6 The Contractor shall provide a list of outstanding Sampling Kits by the 15th of each month. The outstanding list shall include Sampling Kit identification number, ordering field activity, date shipped and number of days out. (CDRL A006)

3.6 Task 4 - Shipping and Transportation

3.6.1 The Contractor shall be responsible for shipment of the Sampling Kit (or Sampling Media) to various military field activities as specified in paragraph 3.2.1 of this PWS. In addition, the Contractor shall make provisions for the Sampling Kit (or Sampling Media) to be shipped back to the Contractor’s facility for analysis.

3.6.2 In accordance with the Department of Transportation (DOT) regulations in 49 CFR Chapter 1, Subpart D, section 173.115, class 2, Divisions 2.2 through 2.3 which defines “compressed gas,” the Contractor’s samples pressure shall be less than 26 psig. This requirement shall be maintained for the duration of the contract when transporting by domestic and international airlines, as well as by courier delivery service providers.

3.6.3 For routine shipping of Sampling Kits, the Contractor shall ship Kits to addresses within the CONUS, Alaska, and Hawaii via lowest cost traceable means that can guarantee no more than five (5) days delivery. CONUS, Alaska, and Hawaii shipments make up approximately 80% of the shipments. Return shipping from the field activity shall be via lowest cost traceable means that can guarantee no later than third (3rd) day delivery.

3.6.4 For routine shipping, Sampling Kits shipped to OCONUS addresses shall be shipped via lowest cost traceable, fastest delivery possible, through the Fleet Post Office (FPO) or through the Army Post Office (APO). Return shipping from OCONUS field activity shall be via the same method.

3.6.5 In certain instances as identified by the COR, a Sampling Kit shall be shipped by the Contractor immediately upon notification by the COR. This Sampling Kit is considered in emergency status condition. The requested kit shall be delivered to the field activity within twenty-four (24) hours of the COR’s authorization to ship (CONUS, Alaska and Hawaii) and the fastest delivery possible OCONUS.

3.7 Task 5 - Dedicated Customer Portal Website

3.7.1 The Contractor shall establish, maintain and update an interactive customer portal website. As a minimum, the website shall: (1) have the capability for field activities to log in securely, place sampling kit orders, maintain a current list of all testable equipment at the field activity, and maintain all analysis reports for their activity, (2) have the capability to allow group sponsors, as identified by the COR, to log in securely to view air sampling status of their group, and (3) have a dedicated page for the COR to log in securely to authorize shipment of Sampling Kit orders. (CDRL A015)

3.7.2 All changes to the customer portal website shall be approved by the COR. The Contractor is required to maintain the security of the customer portal website as required by section 6.5 and 7.0 of this PWS. Only the DCAT program logo and program information shall be placed on the website. The Contractor shall not place any corporate logos or business information / literature on the customer portal website.

3.7.3 As analysis reports are completed, the Contractor shall be responsible for updating the customer portal website with analytical reports twice daily, NLT noon and NLT 1800 CST. (A005)

3.7.4 The Contractor shall be responsible for maintaining and monitoring the customer portal website daily to insure access is maintained. If the website goes offline, the Contractor shall restore the website to online service within 24 hours.

3.8 Task 6 - Unused Samples

A Sampling Kit is considered ‘Unused’ when no component and no sample in the Kit has been used. Unused Sampling Kits returned to the Contractor shall not be analyzed. The Contractor shall bill the Government for only the costs associated with the handling and transportation of the Sampling Kit.

3.9 Task 7 - Breakage and Loss

The Contractor shall be reimbursed for the replacement of the Contractor’s identified equipment/components due to breakage or loss. The Contractor’s List of Components for Breakage and Loss Charges Price Sheet identifies the amount the Contractor shall be reimbursed for each identified equipment/component. If the Contractor is reimbursed for lost components and those components are subsequently found and returned to the Contractor, those components shall become Government Material/Property. The Contractor shall maintain an inventory of all Government Material/Property. The Contractor shall, with the concurrence of the COR, use the Government owned equipment/components in future orders at no additional charge. The Contractor shall document the use of the equipment/component within the Contractor’s inventory database.

3.10 Task 8 - Rental Charges

Rental charges shall not occur on sampling kits mailed to a CONUS, Alaska or Hawaii address for the first sixty (60) days. Rental charges shall not occur on sampling kits mailed to an OCONUS address for the first ninety (90) days. The loan period (60 or 90 days) is computed from the day the kit is received by the Government to the day the kit is delivered to the Contractor's designated carrier for return. In the event kits are held in excess of the 60- or 90- day loan period and the Contractor bills a rental charge, the Contractor shall bill a daily rental charge rate per kit. Total rental charges per kit shall be charged up to the total cost of the kit, at which point, the kit shall become Government Material/Property. The Contractor shall maintain an inventory of all Government Material/Property.

4.0 QUALITY ASSURANCE REQUIREMENTS

4.1 The Contractor shall maintain an approved quality system in accordance with ISO (9001:2015) or an equivalent quality standard acceptable to the Government. The quality system shall govern processes that affect quality of hardware and associated software or manuals. A Laboratory Quality Management System accreditation approach (see Paragraph 3.4.1) equivalent to ISO/IEC 17025 shall be used to supplement the quality system documentation governing analysis methods, equipment, and standards used to execute the requirements of this Performance Work Statement (PWS). The quality system shall be documented in a Quality Assurance Program Plan. Annual performance reviews or audits will be conducted on site or through transmission of documentation at the discretion of and by the COR, in conjunction with the NSWC PCD Maritime Mission Systems Quality Assurance Representative. The Contractor shall submit updates to the Quality Assurance documentation at least bi-annually or more (if program requirements dictate). (CDRL A007)

4.2 The Contractor shall provide documentation as required to support periodic Government audits. The Contractor shall be notified at least 72 hours in advance for all audits. The audits shall include, but are not limited to calibration inspection, quality assurance, lab procedures, CAPT results, and personnel qualifications.

4.3 The Contractor shall be enrolled in the Compressed Air Proficiency Testing (CAPT) Program and submit facility testing results quarterly. In the event the contractor fails to accurately detect contaminants, the Contractor will notify the COR. Failure to detect two consecutive blind samples within the requirements of paragraph 3.4.7 of the known values shall be cause for corrective action. (CDRL A009)

4.4 The Contractor shall maintain configuration control over the approved Sampling Kits. The configuration management system shall be developed in accordance with the requirements of EIA Standard 649 and submitted to the Government for review and approval to the requirements of EIA Standard 649. The Contractor shall notify the Government whenever the Contractor proposes a change in design to the approved configuration management baseline. (CDRL A008)

5.0 GOVERNMENT FURNISHED PROPERTY

5.1 Government Furnished Information

Within 10 calendar days after the award of the contract, NSWC-PCD will provide the Contractor with the NAVSEA SS521-AG-PRO-010 US Navy Diving Manual, Table 4-1 and the DCAT logo to perform the contract tasking during the contract period of performance. The Contractor shall return all Government furnished information (GFI) to NSWC PCD upon completion of the task order.

5.2 Government Furnished Property

None

6.0 DELIVERABLES

6.1 Hardware Deliverables

None

6.2 Data Deliverables

All data deliverables shall be in accordance with the attached Contract Data Requirements List (CDRL) DD Form 1423.

7.0 SECURITY

This requirement is UNCLASSIFIED. The Contractor shall not require access to nor be required to generate or store classified information to perform this requirement.

7.1 Release of Information

(a) Release of information shall be in accordance with Section I, DFARS Clause 252.204-7000, Disclosure of Information.

(b) All technical data provided to the contractor by the Government shall be protected from public disclosure in accordance with the markings contained thereon. All other information relating to the items to be delivered or services to be performed under this contract may not be disclosed by any means without prior approval of the appropriate NSWC PCD authority. Dissemination or public disclosure includes, but is not limited to, permitting access to such information by foreign nationals or by any other person or entity; publication of technical or scientific papers; advertising; or any other proposed public release. The contractor shall provide adequate physical protection to such information to preclude access by any person or entity not authorized such access by the Government.

7.2 Controlled Unclassified Information (CUI)

Controlled unclassified information (CUI) is official information that requires the application of controls and protective measures for a variety of reasons and has not been approved for public release, to include technical information, proprietary data, information requiring protection under the Privacy Act of 1974, and Government-developed privileged information involving the award of contracts. CUI is a categorical designation that refers to unclassified information that does not meet the standards for National Security Classification under Executive Order 13526, but is (a) pertinent to the national interest of the United States or to the important interests of entities outside the Federal Government, and (b) under law or policy requires protection from unauthorized disclosure, special handling safeguards, or prescribed limits on exchange or dissemination.

7.3 Minimum Requirements for Access to Controlled Unclassified Information (CUI)

Prior to access, contractor personnel requiring access to DON controlled unclassified information (CUI) or "user level access to DON or DoD networks and information systems, system security and network defense systems, or to system resources providing visual access and/or ability to input, delete or otherwise manipulate sensitive information without controls to identify and deny sensitive information" Contractors must have clearance eligibility, or submit an Electronic Questionnaire for Investigation Processing (SF 86) to NSWC PCD Security for processing and subsequent adjudication by the DOD Central Adjudication Facility.

7.4 Minimum Protection Requirements for Controlled Unclassified Information

Security classification guides and unclassified limited documents (e.g., FOUO, Distribution Statement Controlled) are not authorized for public release and, therefore, cannot be posted on a publicly accessible webserver or transmitted over the Internet unless appropriately encrypted.

7.5 CUI

CUI is a document designation, not a classification. This designation is used by Department of Defense (DoD) and a number of other federal agencies to identify information or material, which although unclassified, disclosure to the public of the information would reasonably be expected to cause a foreseeable harm to an interest protected by one or more provisions of the Freedom of Information Act (FOIA). This includes information that qualifies for protection pursuant to the provisions of the Privacy Act of 1974, as amended. CUI must be marked, controlled and safeguarded in accordance with DoDI 5200.48, Controlled Unclassified Information (CUI)

7.6 Security of Unclassified DoD Information on Non-DoD Information Systems (DoDI 8582.01) DoD Policy

Adequate security shall be provided for all unclassified DoD information on non-DoD information systems. Appropriate requirements shall be incorporated into all contracts, grants, and other legal agreements with non-DoD entities.

Information Safeguards are applicable to unclassified DoD information in the possession or control of non-DoD entities on non-DoD information systems, to the extent provided by the applicable contract, grant, or other legal agreement with the DoD.

7.6.1 Information Safeguards

Unclassified DoD information that has not been cleared for public release may be disseminated by the Contractor, grantee, or awardee to the extent required to further the contract, grant, or agreement objectives, provided that the information is disseminated within the scope of assigned duties and with a clear expectation that confidentiality will be preserved. Examples include:

a. Non-public information provided to a Contractor (e.g., with a request for proposal).

b. Information developed during the course of a contract, grant, or other legal agreement (e.g., draft documents, reports, or briefings and deliverables).

c. Privileged information contained in transactions (e.g., privileged contract information, program schedules, contract-related event tracking).

It is recognized that adequate security will vary depending on the nature and sensitivity of the information on any given non-DoD information system. However, all unclassified DoD information in the possession or control of non- DoD entities on non-DoD information systems shall minimally be safeguarded as follows:

a. Do not process unclassified DoD information on publically available computers (e.g., those available for use by the general public in kiosks or hotel business centers).

b. Protect unclassified DoD information by at least one physical or electronic barrier (e.g., locked container or room, logical authentication or logon procedure) when not under direct individual control of an authorized user.

c. At a minimum, overwrite media that have been used to process unclassified DoD information before external release or disposal.

d. Encrypt all information that has been identified as CUI when it is stored on mobile computing devices such as laptops and personal digital assistants, compact disks, or authorized removable storage media such as thumb drives and compact disks, using the best encryption technology available to the Contractor or teaming partner.

e. Limit transfer of unclassified DoD information to subcontractors or teaming partners with a need to know and obtain a commitment from them to protect the information they receive to at least the same level of protection as that specified in the contract or other written agreement.

f. Transmit e-mail, text messages, and similar communications containing unclassified DoD information using technology and processes that provide the best level of privacy available, given facilities, conditions, and environment. Examples of recommended technologies or processes include closed networks, virtual private networks, public key-enabled encryption, and transport layer security.

g. Encrypt organizational wireless connections and use encrypted wireless connections where available when traveling. If encrypted wireless is not available, encrypt document files (e.g., spreadsheet and word processing files), using at least application-provided password protected level encryption.

h. Transmit voice and fax transmissions only when there is a reasonable assurance that access is limited to authorized recipients.

i. Do not post unclassified DoD information to website pages that are publicly available or have access limited only by domain or Internet protocol restriction. Such information may be posted to website pages that control access by user identification and password, user certificates, or other technical means and provide protection via use of transport layer security or other equivalent technologies during transmission. Access control may be provided by the intranet (vice the website itself or the application it hosts).

j. Provide protection against computer network intrusions and data exfiltration, minimally including:

(1) Current and regularly updated malware protection services, e.g., anti-virus, anti-spyware.

(2) Monitoring and control of both inbound and outbound network traffic (e.g., at the external boundary, sub-networks, individual hosts), including blocking unauthorized ingress, egress, and exfiltration through technologies such as firewalls and router policies, intrusion prevention or detection services, and host-based security services. Prompt application of security-relevant software patches, service packs, and hot fixes.

k. Comply with other current Federal and DoD information protection and reporting requirements for specified categories of information (e.g., medical, proprietary, Critical Program Information (CPI), personally identifiable information, export controlled) as specified in contracts, grants, and other legal agreements.

l. Report loss or unauthorized disclosure of unclassified DoD information in accordance with contract, grant, or other legal agreement requirements and mechanisms.

m. Do not use external IT services (e.g., e-mail, content hosting, database, document processing) unless they provide at least the same level of protection as that specified in the contract or other written agreement.

7.7 Operations Security

Operations Security (OPSEC) is concerned with the protection of critical information: facts about intentions, capabilities, operations, or activities that are needed by adversaries or competitors to bring about failure or unacceptable consequences of mission accomplishment.

Critical information includes information regarding:

· Operations, missions, and exercises, test schedules or locations;

· Location/movement of sensitive information, equipment, or facilities;

· Force structure and readiness (e.g., recall rosters);

· Capabilities, vulnerabilities, limitations, security weaknesses;

· Intrusions/attacks of DoD networks or information systems;

· Network (and system) user IDs and passwords;

· Movements of key personnel or visitors (itineraries, agendas, etc.); and

· Security classification of equipment, systems, operations, etc.

The Contractor, subcontractors and their personnel shall employ the following countermeasures to mitigate the susceptibility of critical information to exploitation, when applicable:

· Practice OPSEC and facilitate OPSEC awareness;

· Immediately retrieve documents from printers assessable by the public;

· Shred sensitive and Controlled Unclassified Information (CUI) documents when no longer needed;

· Protect information from personnel without a need-to-know;

· When promulgating information, limit details to that essential for legitimacy;

· During testing and evaluation, practice OPSEC methodologies of staging out of sight, desensitization, or speed of execution, whenever possible.

8. DISTRIBUTION LIMITATION STATEMENTS AND WARNING NOTES

Documentation generated under this task order shall have the following Distribution Limitation Statement and Destruction Notice affixed to the front cover and title page. For drawings, the statement shall be in the detail of the drawing. Additionally, each diskette delivered shall be marked externally with the statements.

DISTRIBUTION STATEMENT D: DISTRIBUTION AUTHORIZED TO DEPARTMENT OF DEFENSE AND U.S. DOD CONTRACTORS ONLY (ADMINISTRATIVE/OPERATIONAL USE) (DATE STATEMENT APPLIED). OTHER REQUESTS FOR THIS DOCUMENT MUST BE REFERRED TO COMMANDING OFFICER, NAVAL SURFACE WARFARE CENTER PANAMA CITY DIVISION, 110 VERNON AVENUE, PANAMA CITY, FL 32407-7001. ATTN: CODE A13 WARNING - THIS DOCUMENT CONTAINS TECHNICAL DATA WHOSE EXPORT IS RESTRICTED BY THE ARMS EXPORT CONTROL ACT (TITLE 22, U.S.C., SEC 2751, ET Q.) OR THE EXPORT ADMINISTRATION ACT OF 1979, AS AMENDED, TITLE 50, U.S.C., APP. 2401 ET SEQ. VIOLATIONS OF THESE EXPORT LAWS ARE SUBJECT TO SEVERE CRIMINAL PENALTIES. DISSEMINATE IN ACCORDANCE WITH PROVISIONS OF DOD DIRECTIVE 5230.25., WITHHOLDING OF UNCLASSIFIED TECHNICAL DATA FROM RELEASE.

DESTRUCTION NOTICE - CLASSIFIED INFORMATION, DESTROY IN ACCORDANCE WITH SECNAV M-5510.36, (DON INFORMATION SECURITY PROGRAM) OR DOD 5220.22-M, (NATIONAL INDUSTRIAL SECURITY PROGRAM OPERATING MANUAL). UNCLASSIFIED LIMITED DOCUMENTS, (E.G., FOUO, DISTRIBUTION STATEMENT CONTROL) DESTROY BY ANY METHOD THAT WILL PREVENT DISCLOSURE OF CONTENTS OR RECONSTRUCTION OF THE DOCUMENT.

9.0 Cybersecurity

9.1 Safeguarding Covered Defense Information and Cyber Incident Reporting (DFARS 252.204-7012)

9.1.1 DFARS 252.204-7012 directs how the contractor protects covered defense information. Covered defense information means unclassified controlled technical information or other information, as described in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies.

Contractors are required to deliver a Systems Security Plan (SSP) that implements the security measures in DFARS 252.204-7012. The SSP shall be approved by the program manager and validated by requiring program every three years or on an ad hoc basis with no notice to the contractor. The SSP may also be validated upon replacement of the Government program manager. (CDRL A019)

Program Managers shall not approve a contractor’s submitted SSP that does not:

a. Fully implement Multi-factor authentication, including authentication and authorization of users in a manner that is auditable;

b. Fully implement FIPS 140-2 validated encryption;

c. Employ the principle of lease privilege or “need to know”;

d. Require the contractor to review in a manner that can be audited user privileges at least annually;

e. Require monitoring and controlling remote access sessions and include mechanisms to audit the sessions and methods; and

f. Implement, at a minimum, all security requirements in NIST SP 800-171 standards 3.1 to 3.14; or ensure that any unimplemented security requirements have been adjudicated by an authorized representative of the DoD CIO to be non-applicable or to have an alternate, but equally effective security measure in its place, and provide proof of such adjudication by DoD CIO.

9.1.2 DFARS 252.204-7012 requires that the following areas be addressed to protect covered defense information. Detailed requirements for each area are discussed in DFARS 252.204-7012. Areas that the Contractor deems as not applicable, shall be listed in the SSP as not applicable with an explanation and approved by the DoD CIO.

a. Adequate security. The Contractor shall provide adequate security on all covered contractor information systems. To provide adequate security, the Contractor shall implement, at a minimum, the information security protections listed for in section (b) of DFARS 252.204-7012 for covered contractor information systems that are part of an information technology (IT) service or system operated on behalf of the Government.

1) The covered contractor information system shall be subject to and required to implement the secondary requirements in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.

b. Cyber incident reporting requirement. When the Contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor's ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall follow requirements listed in section (c) of DFARS 252.204-7012.

1) Cyber incidents shall be reported to DoD at http://dibnet.dod.mil within 72 hours of occurrence.

2) All information related to the cyber incident shall be delivered to the Defense Cyber Crime Center within 15 days of the cyber incident. When feasible, DoN CUI shall be segregated from contractor owned information. (CDRL A020)

c. Malicious software.

d. Media preservation and protection.

e. Access to additional information or equipment necessary for forensic analysis.

f. Cyber incident damage assessment activities.

g. DoD safeguarding and use of contractor attributional/proprietary information.

h. Use and release of contractor attributional/proprietary information not created by or for DoD.

i. Use and release of contractor attributional/proprietary information created by or for DoD.

j. The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

k. Other safeguarding or reporting requirements.

l. Subcontracts.

9.2 Recommended Security Controls for Federal Information Systems (NIST SP 800-53)

Additional safeguard requirements are as follows:

a. The contractor is required to encrypt data at rest as defined in NIST SP 800-53, Security Controls SC-13 and SC-28(1).

b. The contractor shall allow the Naval Criminal Investigative Service (NCIS) to install network sensors, owned and maintained by NCIS on the contractor’s information systems or information technology assets when intelligence indicates a vulnerability or potential vulnerability.

c. The contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of DON critical programs and technologies.

10.0 GOVERNMENT AND CONTRACTOR RELATIONSHIP

(a) The services to be delivered under this Task Order are non-personal services and the parties recognize and agree that no employer-employee relationship exists or will exist under the Task Order between the Government and the Contractor's personnel. It is, therefore, in the best interest of the Government to afford both parties a full understanding of their respective obligations.

(b) All Contractor, Subcontractor, and consultant personnel shall wear prominently displayed identification badges at all times when performing work on NSWC PCD property or attending meetings in the performance of this Task Order. The badge shall contain the individual's name, the company name and logo. When participating in such meetings (e.g., as a speaker, panel member), those individuals in Contractor employ must supplement physical identification (e.g., badges, place markers) with verbal announcements so that it is clear to the assembled group that they are employees of the Contractor, not NSWC PCD employees. In addition, when working on NSWC PCD property, all Contractor, Subcontractor, and consultant personnel shall have signs visible on their desks or at their work sites that clearly state that they are not NSWC PCD employees.

(c) The Contractor is responsible for supervision of all Contractor personnel assigned to this Task Order. The Contractor shall exercise ultimate control over all aspects of Contractor personnel day-to-day work under this Task Order including the assignment of work, means and manner of Contractor employee performance and the amount of Contractor supervision provided. The Contractor shall be ultimately responsible for all aspects of performance under this Task Order including the work of its Contractor personnel.

Contractor personnel under this Task Order shall not:

(1) Be placed in a position where they are under the supervision, direction, or evaluation of a Government employee.

(2) Be placed in a position of command, supervision, administration or control over Government personnel, or over personnel of other Contractors under other NSWC PCD contracts, or become a part of the Government organization.

(3) Be used in administration or supervision of Government procurement activities.

(4) Have access to proprietary information belonging to another without the express written permission of the owner of that proprietary information.

(d) Employee Relationship:

(1) The services to be performed under this Task Order do not require the Contractor or its personnel to exercise personal judgment and discretion on behalf of the Government. Rather the Contractor's personnel will act and exercise personal judgment and discretion on behalf of the Contractor.

(2) Rules, regulations, directives and requirements that are issued by the U.S. Navy and NSWC PCD under its responsibility for good order, administration, and security are applicable to all personnel who enter the Government installation or who travel on Government transportation. This is not to be construed or interpreted to establish any degree of Government control that is inconsistent with a non-personal services Task Order.

(e) Inapplicability of Employee Benefits: This Task Order does not create an employer-employee relationship. Accordingly, entitlements and benefits applicable to such relationships do not apply.

(1) Payments by the Government under this Task Order are not subject to the Federal income tax withholdings.

(2) Payments by the Government under this Task Order are not subject to the Federal Insurance Contributions Act.

(3) The Contractor is not entitled to unemployment compensation benefits under the Social Security Act, as amended, by virtue of performance of this Task Order.

(4) The Contractor is not entitled to workman's compensation benefits by virtue of this Task Order.

(5) The entire consideration and benefits to the Contractor for performance of this Task Order are contained in the provisions for payment under this Task Order.

(f) Notice. It is the Contractor's, as well as, the Government's responsibility to monitor Task Order activities and notify the Contracting Officer if the Contractor believes that the intent of this clause has been or may be violated.

(1) The Contractor should notify the Contracting Officer in writing promptly, within three (3) calendar days from the date of any incident that the Contractor considers to constitute a violation of this clause.