DRAFT PWS_MRO Suite Sppt.pdf

Performance Work Statement (PWS) for

MAINTENANCE, REPAIR AND OVERHAUL (MRO) SUITE SUPPORT FOR THE

NAVAL AIR FLEET READINESS CENTERS (FRCs)

1. Scope:

This is a non-personnel services contract to provide Original Equipment Manufacturer (OEM) software maintenance, technical consulting, training, specialized services support, and documentation for the United States Navy Fleet Readiness Centers (FRCs) in Jacksonville, FL (FRC Southeast), Cherry Point, NC (FRC East), and North Island, CA (FRC Southwest). The FRCs have implemented the Maintenance, Repair and Overhaul (MRO) Commercial Off-the-Shelf (COTS) Software Suite (hereafter referred to as MRO Suite / See 3.3.1 COTS listing / OEM vendor is JDA Software, Inc.).

The MRO Suite is the “backbone” of the FRC’s enterprise business software application called the Naval Air Systems Command (NAVAIR) Depot Management System (NDMS). The operation of the MRO Suite is central and essential to the operation of NDMS, by providing the capability for a complete, standardized and automated repairables management system for business planning, production planning, master production scheduling, material requirements planning, capacity requirements planning, and the execution support systems for capacity and material.

Currently, all three (3) FRCs are in the sustainment phase. Throughout sustainment, the vendor has provided consistent levels of on-site OEM support, which has enabled the effective operation and periodic upgrade of the MRO Suite.

All three (3) FRCs have a need for ongoing annual OEM annual software maintenance for the MRO Suite applications and supporting software, as well as continued functional and technical on-site OEM provider support and as-needed specialized services support.

2. Applicable Documents:

2.1 Department of Defense specifications

2.1.1 DoD 5220.22-M, National Industrial Security Program Operating Manual, (NISPOM) 28 Feb 2006

2.1.2 SECNAV M-5510.36 Information Security Program, 30 Jun 2006

2.1.3 DoDM 5200.01 (DoD Information Security Program: Controlled Unclassified Information (CUI)) Vol. 4 (enclosure 3 pages 11-18) 24 Feb 2012

2.1.4 DoD 5400.7-R, Freedom of Information Program Chapter 3 (pages 31-42) Sep 1998

2.1.5 DoDD 5230.24 Distribution Statements on Technical Documents, Change 1, Effective 28 Apr 2016

2.1.6 SECNAV M-5510.30 Personnel Security Program Jun 2006

2.1.7 OPNAVINST 3440.17A Navy Installation Emergency Management Program, 1 Aug 2014

3.0 Requirements

3.1 General Requirements

3.1.1 Compatibility - The Contractor shall maintain the capability to prepare documents and software packages compatible with the Government IT environment through the security classification of UNCLASS. The current operating environment required for this contract includes:

Microsoft Windows 10 Microsoft Project 2010 Microsoft Office Professional Plus 2010 Adobe Acrobat XI (reader) Internet access

The Contractor shall maintain the ability to interface with and transfer data to and from requiring office software applications and their upgraded versions. The Contractor shall maintain state-of the-art virus software and ensure that all media are virus free when delivered. The Contractor shall be capable of Internet and LAN communications with the NAVAIR Depot Maintenance System Program Management Office (NDMS PMO) / COMFRC Digital Group Depot MRO Department. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with NDMS PMO / COMFRC Digital Group Depot MRO Department during working hours whether at Contractor work site or on travel.

3.1.2 Work Location and Facilities

3.1.2.1 Work location: The services to be performed herein shall be provided from the contractor’s facility, in addition to temporary travel requirements at the individual sites in accordance with paragraph 3.1.5.1 Travel.

3.1.3 Contract Status reporting. The contractor shall provide the following documentation.

3.1.3.1 Monthly Progress and Financial Status Report: The contractor shall provide a progress and financial status report in accordance with the Contract Data Requirement List (CDRL A001 – Contractor’s Progress and Financial Status Report). The report shall include work accomplished since submittal of the last report, both monthly and cumulative man-hour labor costs expended by labor category and material and travel costs.

3.1.4 Work Schedule to include Compressed Work Schedule (CWS), overtime, holidays, and installation closure.

3.1.4.1 Work schedule: The Contractor shall provide the required services and staffing coverage during normal working hours. Normal working hours are usually

8.5 hours (including a 30-minute lunch break), from 0700 to 1530 each Monday through Friday (except on the legal holidays specified in paragraph 3.1.4.1.2).

Some supported Government offices have flexibility to start as early as 0600/0630 and end as late as 1800, Monday –Friday.

3.1.4.1.1 Compressed Work Schedule (CWS): N/A

3.1.4.1.2 Holidays: The Government observes the following holidays:

New Year’s Day January 1 Martin Luther King’s Birthday Third Monday in January President’s Birthday The third Monday in February Memorial Day Last Monday in May Independence Day July 4 Labor Day First Monday in September Columbus Day Second Monday in October Veteran’s Day November 11 Thanksgiving Day Fourth Thursday in November Christmas Day December 25

With the exception of the events in section 3.1.4.1.3 below, the contractor is permitted to observe the above Holidays in accordance with its corporate policy.

3.1.4.1.3 Installation closure: When Federal facilities are closed by the Government, or when Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility related problem that prevents Federal personnel from working at the Government facility, contractor personnel assigned to work at that facility in support of such Federal employees shall follow their parent company’s policies

While generally contractor personnel may not perform work on-site at a Government facility without oversight from Federal personnel, in very limited circumstances, work being performed by contractor personnel may be deemed mission essential and performance of such mission essential work may be authorized to continue at the Government facility despite the facility being otherwise closed for normal operations. The circumstances permitting work being performed by contractor personnel to be deemed mission essential are extremely limited and generally only apply to performance of efforts related to public health, safety, or matters related to national security. The cognizant Contracting Officer must concur with any determination that work being performed by contractor personnel is mission essential.

3.1.4.1.4 Overtime: Overtime cannot be charged directly to the contract unless first approved in writing by the Chief of the Contracting Office.

3.1.5 Other Direct Costs:

3.1.5.1 Travel: Travel may include general and administrative expenses, but shall not include profit. Temporary travel to other locations in support of program tasking is required. If required, temporary travel locations include the FRC East at Cherry Point, NC; the FRC Southeast at Jacksonville, FL; the FRC Southwest at North Island, CA; as well as possible travel to DISA sites (Mechanicsburg, A; St.

Louis, MO, etc.). This list is not all inclusive as locations may change over the life of the contract.

3.1.5.2 Material: N/A

3.1.6 Subcontractors: Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this contract. All provisions of this PWS shall flow down to subcontractors providing support under this contract.

3.1.7 Management of Contractor Personnel: The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual contractor employees. The contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services

3.2 Security

3.2.1 Citizenship Requirements: Only U.S. citizens may perform under this contract.

If the Contractor cannot find qualified U.S. citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office. The waiver request should include:

a. The individual's name, date and place of birth, position title, and current citizenship.

b. A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements.

c. A statement of the unusual expertise possessed by the applicant.

d. A statement that access will be limited to a specific government contract (specify contract number).

e. A statement that the Contractor has obtained an export license for the information required to perform the contract.

3.2.2 Investigative Requirements:

Unclassified: All Contractor personnel must be eligible to perform Non-Critical Sensitive work as defined by SECNAV M-5510.30. All Contractor personnel are required to have a favorably adjudicated Tier-3 investigation from the Office of Personnel Management. The Contractor shall submit a request for personnel security investigation to the Government Security Office. The Government Security Office shall initiate the Contractor’s Electronic Questionnaire for Investigations Processing (eQIP)), shall do a preliminary screening of the Contractor’s eQIP for suitability and derogatory information. The Contractor employee shall provide all requested information pursuant to the Privacy Act of 1974. The Government

Security Office may deny the Contractor access to Government facilities and information and may prohibit the Contractor from performance of sensitive duties for failure to provide requested information or when derogatory or adverse information is present on the Contractor’s eQIP. In such cases, the Contractor employee may not perform on the Contract.

Under DoD criteria for facilities that provide depot level rework, the FRCs are designated as IT Level Two (IT-2) facilities. All contractor employees who will access facilities, government systems or data at an FRC or the Defense Information Systems Agency (DISA) facility must obtain the following:

• A favorably completed background investigation

• A favorably adjudicated National Agency Check with Local Agency Credit

Check (NACLC) completed within the last ten (10) years as required by current DoN regulations

• A Secret security clearance

• A Common Access Card (CAC)

• Participation in Information Awareness training at the request of the

Government.

3.2.3 Common Access Card (CAC)/Public Key Infrastructure (PKI), System Authorization Access Request (SAAR-N).

3.2.3.1 SAAR-N: All contractor personnel requiring access to Government Information Technology (IT) systems shall have an approved System Authorization Access Request (SAAR-N) Form OPNAV 5239/14 (Rev Sep 2011) on file, and complete required Annual Information Awareness Training. New employees must submit their SAAR forms within thirty (30) days of their first day of work.

Instructions for processing the SAAR-N forms are available at:

http://www.cnrc.navy.mil/publications/Forms/OPNAV_5239_14_SAAR_N.pdf.

SAAR-N forms shall be submitted to the Contracting Officer’s Representative (COR), Government Technical Point of Contact (TPOC), or to the assigned government Trusted Associate Sponsorship System (TASS) Trusted Associate.

3.2.3.2 Command Access Cards (CAC) / Local Badges: Contractor CACs and facility specific identification badges will be issued by the Government to on-site contractor personnel and shall be visible at all times while personnel are at the Government site. The contractor shall furnish all requested information required to facilitate issuance of identification badges and shall conform to local CAC policy.

All CACs and identification badges issued to Contractor employees shall be returned to the Government Security Department at the Government site in accordance with local CAC policy following completion of the contract, relocation or termination of an employee, or upon request from the COR. The Government will provide the Contractor access to Government facilities, for performance of tasks under this contract. Contractor personnel shall comply with local CAC policy.

3.2.3.3 Classifications: Information or data that the Contractor accesses shall be handled at the appropriate classification level, unclassified information shall be http://www.cnrc.navy.mil/publications/Forms/OPNAV_5239_14_SAAR_N.pdf handled as “For Official Use Only.” Distribution is authorized to the Requiring Office’s Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the TPOC/COR of this contract for approval.

3.2.3.4 Navy Marine Corps Intranet Services: Navy Marine Corps Intranet (NMCI) Services. As of 01 October 2015, the Government provides all NMCI services; to include IT related hardware, software, and support, necessary for the performance of this contract/order. Coordination of these services is to be conducted through the TPOC. Disposition or transfer instructions of previously acquired NMCI assets will be provided by the PCO as appropriate.

3.2.4 Information Security. If the work is performed at the Contractor’s facility, the Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and controlled unclassified information (CUI) and to control distribution of CUI in accordance with DoD 5220.22-M (NISPOM), and SECNAV M-5510.36. If the work is performed at the Government’s facility, the Contractor shall comply with local Information Security policy.

3.2.4.1 Marking: All information generated by the Contractor shall be properly marked. For Official Use Only information generated and/or provided under this contract shall be marked in accordance with DoDM 5200.01. Technical information shall also be marked with appropriate Distribution Statements and Export Control warnings in accordance with DoDD 5230.24 and program Security Classification Guidance

3.2.4.2 Public Release: No information pertaining to this contract shall be released for public dissemination, including posting to any social media sites such as Facebook or Twitter, unless it has been approved for public release by the appropriate U.S. government authority. Proposed public releases shall be submitted for approval prior to release through existing NAVAIR 7.4 Public Affairs Office policy.

3.2.4.3 Loss, Compromise and/or Electronic Spillage of Classified or Controlled Unclassified Information: All instances of loss, compromise and electronic spillage of classified or controlled unclassified information shall be reported to the COR, TPOC and Government Security Office within 24 hours of the incident occurring.

3.5.4.4 Software Escrow. The Government requires that the software provided by the contractor be held in escrow by a third-party agent in the event that the contractor becomes dissolved in conditions such as the bankruptcy of the licensor, the cancellation of a software development project, or the express unwillingness of the licensor to fulfil his contractual maintenance obligations. Escrow deliverables expected from the licensor include, but are not limited to, the software code, updated software versions, software tools, knowledge transfer, technical exchange meetings, and systems engineering documentation. In the event that an escrow is required and the code is released to the Government, the Government reserves the right to modify the source code for the purpose of fixing errors, or the right to continue independent development of the software.

3.2.5 Operations Security (OPSEC): The contractor shall comply with activity OPSEC program instructions, guidance and contribute to organization-level OPSEC efforts. The contractor will include OPSEC as part of its ongoing security awareness program and take all required activity OPSEC training. The contractor will protect identified critical information, sensitive unclassified information and activities, which, if divulged, could further compromise classified or sensitive information or operations, or degrade the planning and execution of operations performed by the RO and contractor in support of the mission.

While performing aboard NAVAIR or NAVAIR sites, the contractor shall comply with facility OPSEC program instructions and contribute to organization-level OPSEC efforts. Include OPSEC as part of its ongoing security awareness program and take all required Agency training. Be responsive to the Supporting OPSEC Manager on a non-interference basis. Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the RO and contractor in support of the mission.

3.2.6 Anti-Terrorism Force Protection and Emergency Management: The work performed on this contract is not Emergency Essential in accordance with OPNAVINST 3440.17A and Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans. Contractor personnel shall comply with all Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans and directives. Contractor personnel shall not report for work at Government facilities upon declaration of Force Protection Condition CHARLIE or in any event or emergency where Government officials direct curtailment of operations to “Mission Essential Only”. All Contractor personnel assigned to a government facility shall complete annual Antiterrorism (Level One) and Active Shooter training.

3.2.7 IT-Related Guidance / Information:

3.2.7.1 Information Technology (IT) Requirements. The Government will provide all necessary reference documents not generally available to the Contractor as required. Throughout the life of the contract, if any instruction or document is replaced or superseded, the replacement or superseding instruction or document shall be applicable to the requirements defined in this PWS.

The Contractor shall not purchase any IT equipment on behalf of NAVAIR in support of this Contract, which reports to Program Budget Information System – IT (PBIS- IT), without a NAVAIR Command Information Officer (CIO) approved Navy - Information Dominance Approval System (NAV-IDAS) Information Technology Procurement Request (ITPR).

3.2.7.2 Clinger-Cohen Act. The contractor shall support the program manager during CCA compliance review and assist in responding to reviewer comments; if and when, additional supporting information or revisions are required.

3.2.7.3 System Software / Application Compliance. All IT Systems or software/application development, modification or support shall be performed in accordance with Defense Business Transformation guidance (formerly Business Management Modernization Program (BMMP)), Department of the Navy (DON)/ NAVAIR Functional Area Manager (FAM) Policies and Guidance, Network and Server Registration, and Web Enablement mandates.

3.2.7.4 Web Sites, Web Enablement and Application / System Development, Modification, and Maintenance Support Services. All Information Technology systems, software, and website development, modification or support shall be performed in accordance with all applicable Federal, DoD, DON, and NAVAIR policy, guidance, standards, and strategies, and should be integrated within the NAVAIR Enterprise portal and collaboration environment whenever possible. Any Web sites/servers hosted/located in contractor facilities, or outside NAVAIR enclave, will transition to NAVAIR architecture and infrastructure in accordance with Legacy Shutdown guidance. Policies include, but are not limited to:

a. Office of Management and Budget Management of Federal Information Resources, OMB CIRCULAR NO. A-130 Revised.

<http://www.whitehouse.gov/omb/circulars_a130_a130trans4>

b. OMB Policies for Federal Agency Public Websites, OMB M-05-04.

<http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05- 04.pdf>

c. Section 508 Amendment to the Rehabilitation Act of 1973.

<https://www.section508.gov/content/learn/laws-and-policies>

d. Department of Defense Web Policies and Guidelines.

<http://dodcio.defense.gov/dodwebpolicy>

e. Navy Information Operations Command (NIOC) Norfolk Web Risk Assessment Team Website. <http://www.public.navy.mil/fcc-c10f/niocnorfolk/Pages/AboutWRA.aspx>

f. DON Policy for Content of Publicly Accessible World Wide Web Sites SECNAVINST 5720.47B. <http://www.navy.mil/navydata/internet/secnav5720- 47b.pdf>

g. NAVAIR CIO Website (NAVAIR specific policy and guidelines). To request this policy contact the NAVAIR CIO office – 7.2.2 Applications Integration team – Web Manager: Shane Malamphy at 301- 342-1825.

h. Defense Information Systems Agency (DISA) Hosting of All Navy Websites (NAVADMIN 061/08). <http://www.public.navy.mil/bupers-npc/reference/messages/Documents/NAVADMINS/NAV2008/NAV08061.txt>

i. Consolidation of Navy Web Sites - Reduction of IM/IT Footprint NAVADMIN 145/07. <http://www.public.navy.mil/bupers-npc/reference/messages/Documents/NAVADMINS/NAV2007/NAV07145.txt>

j. DON Web Presence Policy: The Registration, Compliance of, and Investment in, All Unclassified Web Sites and Uniform Resource Locators.

<http://www.doncio.navy.mil/ContentView.aspx?ID=577>

k. Policy and Procedures for Web Risk Assessment (WRA) of Publicly Accessible Navy Sites (ALCOM 129/09). <www.public.navy.mil/fcc-c10f/niocnorfolk/Documents/NTD-08-09.txt>

3.2.7.5 Software Development / Server Procurement. Any tools developed that will be hosted by the NMCI or run on NMCI workstations will be certified for NMCI and comply with NMCI policy. Additionally, any servers supporting this effort will be transitioned to meet the requirements of the current NAVAIR Server Consolidation effort.

3.2.7.6 Cybersecurity. As a minimum, hardware, firmware, software, documentation (data deliverables) and/or IT services delivered by this contract shall be in compliance with the following References:

a. DoDI 8500.01 Cybersecurity, 14 March 2014

b. DoDI 8510.01, Risk Management Framework (RMF) for DoD (IT, 12 March 2014.

c. Committee on National Security Systems Instruction 1253, “Security Categorization and Control Selection for National Security Systems,” March 15, 2012, as amended.

d. DoDD 8570.01 Information Assurance Training, Certification, and Workforce Management, 15 August 2004, Certified Current as of 23 April 2007.

3.2.7.6.1 All Cybersecurity shall be in compliance with the following listed instructions:

a. DoDI 8582.01, ASD (NII) Directive-Type Memorandum (DTM) 08-027 – Security of Unclassified DoD Information on Non-DoD Information Systems, 06 June 2012.

b. Chairman of the Joint Chiefs of Staff Instruction CJCSI 3170.01H (series), Joint Capabilities Integration and Development System, 10 January 2012.

c. CJCSI 6211.02D, Defense Information System Network (DISN): Policy and Responsibilities, 24 Jan 2012.

d. CJCSI 6212.01F, Net Ready Key Performance Parameter (NR KPP), 21 March 2012.

e. CJCSI 6251.01D, Narrowband Satellite Communications Requirements, 30 Nov 2012.

f. CJCSI 6510.01F, Information Assurance (IA) and Support to Computer Network Defense (CND), 09 Feb 2011, certified current 10 Oct 2013.

g. Chairman of the Joint Chiefs of Staff Manual CJCSM 6510.01B – Cyber Incident Handling Program, 10 July 2012.

h. Navy Ports Protocols, and Services (NPPS) Manual, Version 1.5, 16 November 2010.

i. Defense Acquisition Guidebook – Chapter 7, Acquiring Information Technology, Including National Security Systems, Section 7.5, IA.

j. DoD 5220.22-M, National Industrial Security Program Operating Manual, February 28, 2006 (NISPOM).

k. DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19 Dec 2005, (Incorporating Change 3, 24 Jan 2012).

l. DoDD 8000.01, Management of the Department of Defense Information Enterprise, 10 February 2009.

m. DoDD 8100.02, Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG), 14 April 2004, Certified Current, 23 April 2007.

n. DoDD 8570.01, Information Assurance Training, Certification, and Workforce Management, 15 August 2004, Certified Current, 23 April 2007.

o. DoDI 8330.01, Procedures for Interoperability and Supportability of Information Technology (IT) and National Security Systems (NSS), 21 May 2014.

p. DoDI8500.01, Cybersecurity, 14 March 2014.

q. DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, 01 April 2004.

r. DoDI 8551.01, Ports, Protocols, and Services Management (PPSM), 28 May 2014

s. DoDI 8581.01, Information Assurance (IA) Policy for Space Systems Used by the Department of Defense, 8 June 2010.

t. DON CIO Memo 02-10, Department of the Navy Chief Information Officer Memorandum 02-10 Information Assurance Policy Update for Platform Information Technology, 26 April 2010.

u. DON letter 5239 NAVAIR 726/2322 of 18 Feb 09, NAVAIR Data at Rest Policy.

v. FIPS Publications (FIPS PUB)-199, February 2004.

w. National Security Telecommunications and Information Systems Security Policy NSTISSP No. 11, Revised Fact Sheet National Information Assurance Acquisition Policy, July 2003.

x. Office of the Chief of Naval Operations OPNAV INST 5239.1C, Navy Information Assurance (IA) Program, 20 Aug 08.

y. SECNAV M-5239.1, Department of the Navy Information Assurance Program; Information Assurance Manual, November 2005.

z. SECNAVINST 5230.15, Information Management/Information Technology Policy for Fielding of Commercial Off the Shelf Software, 10 April 2009.

aa. SECNAVINST 5239.3B, Department of the Navy Information Assurance Policy, 17 June 2009.

bb. SECNAVINST 5239.19, Department of the Navy Computer Network Incident Response and Reporting Requirements, 18 March 2008.

cc. The National Security Act of 1947.

dd. Title 40/Clinger-Cohen Act.

ee. Title 44/ Federal Information Security Management Act.

ff. National Institute of Standards and Technology Special Publication 800- 53, Security and Privacy Controls for Federal Information Systems and Organizations, Revision 4, April 2013.

3.2.7.7 All IT procured on behalf of this contract shall meet all DoD/DON and NAVAIR cybersecurity polices. Failure to follow these policies will result in denied access to NMCI, One Net, Integrated Shipboard Network System (ISNS) and other DON, DoD and Joint Networks. These cybersecurity policies are standard across the Department and ensure cybersecurity compatibility and interoperability.

IT systems and or networks operated by contractors pursuant to a NAVAIR contract, regardless of the level of data processed, shall be operated in accordance with the NISPOM.

Approved contractor-owned equipment shall be permitted connections to NAVAIR/DoD networks in order to carry out the performance of this contract. All Contractor-owned hardware and/or software shall meet DoDI 8500.1 CS, is subject to validation scanning and must be approved by the NAVAIR site CS Manager prior to connection.

3.2.7.7.1 The following specific criteria must be met before the contractor can be connected to any DoD or NAVAIR network in support of this contract.

Requirements include:

a. Network Vulnerability Scanning. NAVAIR Deputy CIO for Information Assurance maintains authorized auditing tools and shall provide for firewall/port scans, device discovery scan, vulnerability assessment, and other requirements as required to ensure secure interoperability with DoD networks. The contractor shall be responsible for the remediation of any equipment that fails these audits prior to the connection of the system to the networks; Results of approvals shall be documented via Memorandum of Agreement with the Facility Security officer and the Defense Security Service Representative for that contractor.

b. Extent of Validation Scanning. To prevent scanning of corporate assets, all such networks, equipment and connections shall be physically segregated from any government/contractor corporate networks that are not in direct support of DoD contracts.

c. Circuit Provisioning. Any circuit or connection between NAVAIR and/or DoD site and the contractor site shall be provisioned via the Defense information Security Agency and comply with CJCSI 6211.02D, DISN: Policy and Responsibilities, 24 Jan 2012.

d. Servicing Systems from a Remote Contractor Site. Remote Access Service connections that allow off-station operation and/or administration of contractor owned systems, located at any NAVAIR facility or site, shall not be permitted, with the exception of those systems connecting to the Command via the Outreach Services identified in Section 6, Enterprise Architecture.

e. Memorandum of Agreement and Inter-connection Agreements. A Cybersecurity Memorandum of Agreement (MOA) between the contractor owning the equipment and AIR-7.2.6 shall be developed and signed before the equipment can be connected to NAVAIR networks. Failure to comply with the signed MOA shall be grounds for disconnection from the network.

3.2.7.8 Enterprise Architecture.

a. Contractor Networks and Connections. Contractor-owned and operated networks are prohibited on any NAVAIR facility or site in support of this contract. The contractor may access non-government, external IP space via the NAVAIR-provided Virtual Private Network (VPN) Outreach service or NAVAIR CIO approved Internet Protocol (IP) service.

b. Architecture Compliance. The contractor shall ensure all IT solutions, including database solutions, comply with the appropriate NAE Enterprise Architecture, and are verified by the NAVAIR Enterprise Architect (AIR-7.2.3) prior to build out.

c. Disclosure of pre-existing networks, circuits or connections. Any and all networks, circuits or connections between the contractor and any NAVAIR site related to previous contracts shall be identified in the MOA. Failure to comply and subsequent discovery of an unregistered network, circuit or connection shall be grounds for immediate disconnection.

3.2.7.9 Software Process Improvement Initiative (SPII). This link is to the SPII Policy, <http://www.secnav.navy.mil/rda/Policy/2007%20Policy%20Memoranda/13jul07s piicontractlan guage.pdf> which requires that standardized contract language be included in solicitations or contracts under which contractor(s) are required to perform “software development”. As defined in the Assistant Secretary of the Navy (ASN) Memorandum, Software Process Improvement Initiative (SPII) Guidance for Use of Software Process Improvement Contract Language dated 13 July 2007, “Computer Software development” or “software development” means, as applicable developing or delivering new source code, modifying existing source code, coding computer instructions and data definitions, building databases schema, and performing other activities needed to implement the design of a noncommercial computer software product.

This definition recognized that even small changes to software code can result in significant changes to software system behavior and quality, and, consequently, that it is necessary for developers to define and follow disciplined and appropriate processes.”

Mandatory elements of the SPII policy language are:

a. The requirement that Offerors submit a proposed Software Development Plan (SDP) with their proposals, and, during contract performance, deliver a completed SDP (based on the proposed SDP) as a Contract Data Requirements List (CDRL) deliverable, subject to Government review and approval.

b. The information content of the SDPs, which shall follow the framework of Institute of Electrical & Electronics Engineers (IEEE)/Electronics Industries Association (EIA) IEEE/EIA Std 12207 regarding subject content, level of detail, and completeness.

c. The requirement that the SDP serve during contract performance as the benchmark for the contractor’s software development effort.

d. The requirement that the SDP shall be periodically evaluated and updated, as a part of continuous process improvement subject to Government review and approval.

Discretionary elements of the SPII policy language are:

a. Where the language is incorporated in the solicitation and contract.

b. The format of the SDP (including whether it needs to be a single volume or may consist of multiple volumes.)

c. The other elements of IEE/EIA Std 12207 that must be included, as based on the needs of the system to be acquired and its associated work content.

3.3 Detailed Support: Operation and Maintenance, Navy (O&MN) funds apply to all requirements described in this section. Sections 3.3.1 and 3.3.2 shall be Firm Fixed Price (FFP). Section 3.3.3 is anticipated to be a cost-based CLIN type.

3.3.1 (CLIN X001) MAINTENANCE FOR COTS SOFTWARE. The contractor shall support and maintain all COTS software, which comprises the MRO Suite including:

MRO,

Make-to-Order (MTO), Workbenches (Bill Of Material (BOM) and Planner)), Application Programming Interfaces (APIs) purchased by the FRCs including the MTO APIs, I-Loader, MRO APIs, MRO Web Services, and other connectivity tools, Enterprise Project Planner (EPP) (the replacement software application provided as a replacement for the NetWORKS Supply application previously purchased by the FRCs).

The contractor shall provide annually renewable software maintenance for each software product. Maintenance shall include user support and upgrades / new releases as defined in paragraphs 3.3.1.1 and 3.3.1.2 of this PWS.

The contractor shall provide up-to-date software documentation including user manuals, training material and technical documentation in accordance with CDRL A002, Software Documentation.

3.3.1.1 User Support. The contractor shall provide “Premium Maintenance Services” user support (Help Desk) services as consistent with the following requirements:

User support services shall be available by telephone during normal business hours, five (5) days a week, via a toll-free number. Beeper or cell phone support shall be available for critical issues seven (7) days a week.

The contractor shall respond to a call by the Government as a change request within eight (8) business hours of call receipt, and shall assist the user with resolving the reported problem in a timely fashion.

The contractor shall communicate with the reporting user on a timely and regular basis until final resolution. The contractor shall maintain a record and provide report of all active and closed cases reported and resolved and report them in the Monthly Status Report (see PWS paragraph 3.1.3.1).

Contractor personnel providing user support services by telephone shall have sufficient expertise to recommend corrective actions in a timely manner.

Contractor shall provide periodic customer service reviews by a senior product support staff member as required but no less than annually.

The contractor shall provide membership to contractor-hosted user groups and committees, special interest groups, and conferences, and shall provide access to communications such as surveys, newsletters, and other communications. The Government reserves the right to designate a Government contractor employee to represent the Government. Such designation will be provided in writing to the contractor by the respective

TPOC.

3.3.1.2 Upgrades. The contractor shall provide the Government the latest commercial release / upgrade of each software product that is part of the MRO Suite (including changes to affected documentation including user manuals and installation and administration manuals) throughout the maintenance service period. The contractor shall provide new product releases as they become available. The upgrade notices shall include a detailed description of the application upgrade specifying any additional capabilities or problem fixes added to the software. The contractor shall provide written notice to the NDMS Program Office no later than thirty (30) days before planned product release.

3.3.2 (CLIN X002) ONSITE AND OFFSITE FUNCTIONAL AND TECHNICAL

SUPPORT SERVICES. The contractor shall provide a consistent level of knowledgeable and timely on-site (and occasionally off-site) functional and minor technical support for the MRO Suite for each site. A majority of the work shall entail functional support, but some minor technical support shall also be provided.

The contractor shall act as a liaison between technical personnel and the Government to maximize the timely and complete operation of the MRO Suite at each site.

3.3.2.1 Sustainment Services.

3.3.2.1.1 The contractor shall provide sustainment services for the MRO Suite currently in use at the FRCs. Sustainment services shall include software issue validation and analysis, reporting of site-specific issues, and testing of software issue resolutions as they are delivered.

When appropriate, the contractor shall also report any software issues to the help-desk as they are identified in accordance with CDRL A003, Systems Engineering Documentation.

3.3.2.1.2 The contractor shall use subject matter expertise to provide timely, responsive and accurate answers to questions related to daily business processes. The contractor shall analyze and propose solutions to issues as they occur.

3.3.2.1.3 The contractor shall create ad hoc reports to support emergent business, operational and technical requirements in accordance with CDRL A003, Systems Engineering Documentation.

3.3.2.1.4 The contractor shall conduct informal training of new users, or of existing users as new MRO Suite component versions or issue resolutions are released. Training shall include instruction on specific software modules as well the overall use of the software in the FRC business process environment. Any material used to conduct the training shall be provided to the Government in accordance with CDRL A004, Training Materials.

3.3.2.1.5 Support services shall also include occasional analysis and assessment of the impact of business and other initiatives experienced in the course of day-to-day FRC operations on the MRO Suite implementation in accordance with CDRL A003, Systems Engineering Documentation.

3.3.2.2 Upgrade Support. The Contractor shall support each MRO Suite application component version upgrades in planning, execution, and post-upgrade support phases. Support in the planning phase shall include but not be limited to the creation and maintenance of Implementation / Integration Plans that shall include consideration of legacy interfaces in accordance with CDRL A005, Implementation / Integration Plan. The contractor shall conduct assessments of the technical infrastructure; identify all software versions, and all security and Navy Marine Corps Intranet (NMCI or its successor) impacts in accordance with CDRL A003, Systems Engineering Documentation.

Support in the execution of the upgrade shall include validation of mock data conversions, testing of new software functionality and validation of the legacy interfaces. Support in the post-upgrade phase shall include the troubleshooting of software issues, training issues, and business process issues related to the upgrade.

3.3.3 (CLIN X003) SPECIALIZED SERVICES. The contractor shall provide specialized and emergent technical support functions that are “over and above” the ongoing sustainment of the suite of MRO Suite. As the FRCs continue to collapse and consolidate their multiple instances of the common software (including the MRO Suite) solution to a common single instance, the contractor shall be required to provide specialized support that is unrelated to the usual onsite sustainment support at the FRCs. The contractor shall document activities in accordance with CDRL A001, Contractor’s Progress and Financial Status Report.

Furthermore, the contractor shall provide product reconfiguration of inherent MRO Suite capabilities to support the required NAVAIR technological and/or software updates resulting from, but not limited to toolset upgrades, enhancements, security mandates and/or externally-driven factors that may result in unforeseen impacts on NDMS and MRO Suite integrated application functionality. Potential MRO Suite based enhancement drivers will include, but are not limited to, future logistics and maintenance enterprise initiative requirement impacts, operational requirement impacts anticipated from Business Process Reengineering/Continuous Process Improvement (BPR/CPI); Vision 2020; Dynamic Scheduling; Digital, Mission Analytics; Operations Planning, System of Record Transitions, application and report development, and infrastructure consolidation/transition.

Over the course of this contract, the Depot MRO/NDMS Department Head is expected to sponsor strategic initiatives that may impact the NDMS CONOPS, and the currently implemented MRO Suite configuration. When the Depot MRO/NDMS Department Head, or his/her designee, determine that emerging system requirements may significantly impact the operational efficiency or effectiveness of Depot MRO/NDMS products and services, the contractor shall be notified of a requirement to provide an analysis of feasible MRO Suite configuration enhancement concepts. This feasibility analysis shall be performed, in collaboration with designated SME’s from the NDMS Cecil Field (NDMS-CF / located in Jacksonville, FL) Team, for the purpose of determining and documenting an effective technical approach (Systems Engineering Documentation (CDRL A003)), and an efficient project Implementation/Integration Plan (CDRL A005). The contractor shall utilize NDMS CONOPS, and DoD and industry best practices, as appropriate, to develop each approved MRO Suite configuration enhancement project and the contractor shall produce the required Software Documentation (CLIN A002) and Training Materials (CDRL A004) as required.

3.4 Data

The following shall be delivered to the Government:

CDRL A001 – Contractor’s Progress and Financial Status Report;

CDRL A002 – Software Documentation CDRL A003 – Systems Engineering Documentation

CDRL A004 – Training Materials CDRL A005 – Implementation / Integration Plan