F35 JPO Cloud DevSecOps IDIQ PWS DRAFT.pdf

F-35 JOINT PROGRAM OFFICE

DIRECTORATE OF ENTERPRISE SERVICES ACQUISITION

F-35 JPO Cloud DevSecOps

Indefinite Delivery, Indefinite Quantity

Performance Work Statement

1.0 INTRODUCTION.

The F-35 Lightning II Joint Program Office (JPO) leads the life-cycle program management of the F-35A, F-35B, and F-35C: the fifth-generation joint strike fighter air system of choice for the

U.S. Air Force, U.S. Navy, U.S. Marine Corps, international partners, and foreign military sales customers. The mandate of the JPO is to deliver a capable, available, and affordable air system to the warfighter - outpacing key competitors to win tomorrow's high-end fight as JPO develops, delivers, and sustains war-winning fifth-generation capabilities at high-end fourth-generation costs.

• The JPO ensures that the F-35 is lethal, scalable, adaptable, and capable of competing and keeping the warfighter one step ahead of aggressors.

• The JPO ensures that the F-35 is operative, and parts are available when needed. The long-term goal is an environment of comprehensive sustainment excellence that includes initiatives to keep parts on wing longer, maintain appropriate spares, and enhance repair capability and velocity.

• The JPO ensures that the F-35 is affordable for the U.S. services, international partners, and customers through cost reduction across the acquisition life cycle.

Scope.*

The F-35 Lightning II Joint Program Office (JPO) oversees the life-cycle management of the F-

35A, F-35B, and F-35C fifth-generation joint strike fighter air systems. This program serves the

U.S. Air Force, U.S. Navy, U.S. Marine Corps, International Partners, Foreign Military Sales

(FMS) customers and Defense Industrial Base (DIB) partners associated with production and sustainment of the F-35 Lightning II. The scope of this task order encompasses the provision of comprehensive F-35 JPO Cloud DevSecOps services within the unclassified and classified cloud environments to support this diverse stakeholder group.

To support a F-35 enterprise services capability, the scope includes multiple teams composed of differing skill sets and work locations as defined by the Government. The contractor shall identify and provide dedicated resources composed of personnel with the skillsets (and any https://hub.jsf.mil/sites/OCIO/win10 additional skills required) to meet the Objective and Technical Requirements set forth in the performance requirements below. The contractor shall provide the Full Time Equivalent (FTE) positions, assume a 40-hour work week, with overtime pre-approved as necessary by Contracting

Officer or Technical Point of Contact(s) (TPOC). For this effort, an FTE is defined as work performed for 1,920 hours for one calendar year. The contractor shall support an integrated

Government/Multi-Contractor team-based Agile environment. The Government Product Owner, as identified by the Government, will specify requirements/capabilities (themes/epics) and establish acceptance criteria to the Agile team. The Government Product Owner, supported by subject matter experts and business analysts, will determine whether or not acceptance criteria have been satisfied.

The current environment supports ~1,500 users with an estimated growth of no less than 10% per year with anticipation of ~4,000 users over five years.

Any software procurements bought through the contract vehicle will be managed internally by the contract service provider. Quarterly reports and consolidation will be sent to the appropriate government TPOC and routed through JPO’s software license management.

Key aspects of the scope include:

Streamlining IT and Cloud Capability Support and Innovation at the speed of relevance to the F-35 Enterprise: Providing capabilities for cloud access, collaboration, engineering tools, software suites, DevSecOps pipelines, platform support, cloud infrastructure, cybersecurity and technical management.

Secure Communications: Implement and maintain IT solutions that facilitate secure communications between the JPO, International Partners, and FMS customers within the classified environment.

Government-Owned Sustainable Solutions: Generate and sustain government owned contractor operated solutions that are sustainable and cost efficient.

Agile Program Management & Strategic Support: Implement agile program management and capability generation through agile, DevSecOps, and SecDevOps processes and procedures, enhancing the JPO's ability to collaborate within the defense industry on F-35 program initiatives.

Supporting Defense Industry Collaboration: Extend IT and CS services to include dedicated support to defense partners in the defense industrial base

Supporting International Collaboration: Extend IT and CS services to include dedicated support to International Partners and FMS customers, enhancing the JPO's ability to collaborate globally on F-35 program initiatives.

Unclassified Cloud Environment Management: Provide and manage IT services within the F-

35 JPO unclassified IT networks, ensuring compliance with Department of Defense (DoD) and

USCYBERCOM security standards and mandates.

Unclassified Cloud Capabilities Management: Provide and manage IT capabilities, including access, collaboration, engineering, software, data analytics, data operation, and data visualization tech stacks within the F-35 JPO unclassified cloud networks, ensuring compliance with

Department of Defense (DoD), Special Access Programs (SAP), and USCYBERCOM security standards and mandates.

Classified Cloud Environment Management: Provide and manage IT services within the F-35

JPO unclassified IT networks, ensuring compliance with Department of Defense (DoD) and

USCYBERCOM security standards and mandates.

Classified Cloud Capabilities Management: Provide and manage IT capabilities including access, collaboration, engineering, software, data analytics, data operation, and data visualization tech stacks within the F-35 JPO classified cloud networks, ensuring compliance with Department of Defense (DoD), Special Access Programs (SAP), and USCYBERCOM security standards and mandates.

Scalable Infrastructure: Support global F-35 operating locations with the flexibility to accommodate mission requirement changes and addition of new cloud infrastructures throughout the contract period.

Comprehensive IT Services: Deliver a range of IT and CS services including: program and performance management, multi-cloud/hybrid cloud enterprise architecture, documentation management, life cycle management, operations & maintenance, network consolidation and decommissioning, coalition IT support, enterprise data management, cloud support, and cloud network circuit management.

User Support: Provide IT support services for approximately 1500 users across various networks, including U.S. Military, Government Civilians, support contractors, International

Partners, and FMS customers assigned to the program.

Flexible Operations: While primarily focused on standard business hours support, maintain the capability to address critical issues as they arise and scale to 24-hour operations if deemed necessary.

This scope aims to enhance the effectiveness, efficiency, and productivity of the F-35 Program by providing a unified cloud infrastructure that supports the complex, business associations, international nature of the F-35 Joint Strike Fighter program.

*Verbiage use in Management and Oversight Process for the Acquisition of Services

(MOPAS)/Individual Streamlined Acquisition Plan (ISTRAP).

2.0 APPLICABLE LAWS, REGULATIONS, POLICY, AND REFERENCES.

• DoD Directive (DoDD) 2000.12 DoD Antiterrorism (AT) Program

• DoDD 5200.02 Defense Industrial Personnel Security Clearance Review Program

• DoDD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations

• DoDD 5000.59, DoD Modeling and Simulation Management

• DoD Instruction (DoDI) 4120.24 Defense Standardization Program

• DoDI 5000.02, Operation of the Adaptive Acquisition Framework

• DoDI 5000.88, Engineering of Defense Systems

• DoDI 5000.85, Major Capability Acquisition

• DoDI 5000.87 Operations of the Software Acquisitions Pathway

• DoDI 5000.89 Test and Evaluation

• DoDI 5000.91, Product Support Management for the Adaptive Acquisition Framework

• DoDI 5000.97, Digital Engineering

• DoDI 5200.02 DoD Personnel Security Program (PSP)

• DoDI 5220.31 National Industrial Security Program

• DoDI 5205.11, Management, Administration, and Oversight of DoD Special Access

Programs

• DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology

(IT)

• DoDI 8500.01, Cyber Security

• DoDI 8580.1, Information Assurance (IA) in the Defense Acquisition System

• DoDI 8582.01, Security of Unclassified DoD Information on Non-DoD Information

Systems

• DoD Manual (DoDM) 5200.01, Information Security Program Volumes 1-4

• Air Force Instruction 31-101, Air Force Integrated Defense

• Secretary of the Navy Instruction (SECNAVINST) 5510.30A, Department of Navy

Personnel Security Program

• SECNAVINST 5510.36, Department of Navy Information Security Program

• Joint Special Access Program Implementation Guide (JSIG)

• Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6211.02D, Defense Information

System Network (DISN): Policy, Responsibilities, and Processes

• DoD Enterprise DevSecOps Strategy Guide

• DoD Enterprise DevSecOps Fundamentals

3.0 TASKS/PERFORMANCE REQUIREMENTS. The Contractor shall provide all services and project supervision, as required in connection with the Performance Work

Statement (PWS).

Team Key Personnel Positions and Non-Key Personnel Positions

The Contractor shall provide Key Personnel Positions (KPPs) as designated in the Team

Composition and Operating Location at the award of the contract. Specified skills are detailed in

Labor Categories. For non-KPP, the Contractor shall provide a notional staffing ramp-up at the

Kick-Off Meeting to meet the total quantity of FTEs articulated in Team Composition and

Operating Location per each operating location. Additionally, the contractor shall establish a process to provide additional personnel at the direction of the Government.

The Contractor shall use Agile frameworks such as Kanban, Scrum, or as agreed upon by the

Government, as needed and shall ensure all product backlog are properly defined and sized. The

Government Product Owner (GPO) will provide product backlog prioritization and grooming as needed. The Contractor shall not use the Scaled Agile Framework (SAFe). The Contractor shall support an Agile environment. Outlined below are the critical requirements for this work:

Maintain and support the combined F-35 DevSecOps stack with maximized reuse of DevSecOps capabilities throughout DoD across multiple security classifications.

• Leverage Government Infrastructure as Code (IaC) and Configuration as Code (CaC) to on-board and support a variety of platform teams across the F-35 JPO onto various

Kubernetes distributions for disconnected environments, both classified and unclassified in collaboration with the various companies that created the Kubernetes distributions.

• Enhance the cybersecurity and the code security process of the Government stack across all classified and unclassified environments.

• Utilize new and continuously hardened containers from Government providers as approved by Government Product Owner.

• Create any necessary documentation for JPO government, Defense Industry Base (DIB), or other approved personnel onboarding.

• Create any accreditation documentation following DoD best practices such as the Risk

Management Framework (RMF) process and Joint Special Access Program

Implementation Guide.

• Create and continuously update the DoD Enterprise DevSecOps documents.

• Continuously work with government entities, such as Platform One, Cloud One, Black

Pearl, COSMOS, Navy PEO, JPO teams, and other teams identified by the Government

Product Owner to improve their processes and timeliness for Enterprise DevSecOps deployments.

• Sustain and develop cloud based DataOps products and services. This would involve the following:

o Cloud-Based Data Storage & Ingestion: Design, implement, and maintain scalable and secure cloud-based data storage solutions (e.g., data lakes, data warehouses) for both structured and unstructured data. Automate data ingestion processes from diverse sources, including real-time streaming and batch processing, leveraging cloud-native services.

o Data Processing Automation: Develop and maintain programmatic tools and pipelines using cloud-based technologies for efficient data processing, transformation, and cleaning. Implement robust error handling and monitoring to ensure data integrity and reliability.

o Data Quality Management & Monitoring: Establish and maintain comprehensive data quality monitoring frameworks within the cloud environment. Implement automated checks, data validation rules, and alerting mechanisms to identify and resolve data quality issues proactively. Define and track key data quality metrics.

o Automated Data Integration & Transformation: Develop and automate data integration pipelines using cloud-based ETL/ELT tools to move and transform data between various sources and destinations, ensuring alignment with user requirements and data governance policies.

o Data Catalog Implementation & Management: Deploy and maintain a searchable data catalog within the cloud environment to facilitate rapid data discovery and understanding. Ensure metadata is accurate, up-to-date, and accessible to the entire organization.

o Data Governance & Compliance: Implement standardized data governance policies and procedures within the cloud environment. Define roles and responsibilities for data stewardship, ensuring compliance with regulatory requirements and internal policies.

o Self-Service Data Analytics & Visualization: Develop and maintain self-service data analytics dashboards and reporting solutions using cloud-based business intelligence tools and data visualization libraries. Integrate existing analytical capabilities and enable advanced analytics use cases. Provide training and support to users on utilizing these tools.

Team Competencies: The Cross Environment Team focuses on operations and maintenance of the F-35 shared environments at multiple security classifications to include unclassified, Secret collateral, and SAP environments.

Surge Capabilities

The contractor shall have the ability to expand each team quickly to meet an increased demand for services in the event of an emergent requirement or other need. Effective surge capacity requires the coordination of multiple resources to mobilize staff and, in some cases, coordinate with outside resources to fulfill a need. The Contractor shall have a surge capacity methodology, disclosed at the Kick-Off meeting that discusses a way to address an increased need for personnel within a stated amount of time deemed reasonable by the Government. Any surge capacity issues will be addressed and/or negotiated through the Contracting Officer and will be incorporated by contract modification, if needed. Surge capacity may include Special Projects for the following types of activities:

• Support of any new emerging JSF Cloud support activities needed by the F-35 Program.

• Large-scale relocation of F-35 DevSecOps Cloud environment or DevSecOps pipeline.

Tenant Support

The contractor shall have the ability to expand each team quickly to meet an increased demand for services and support required by JPO Cloud tenants. Any tenant support capacity issues will be addressed and/or negotiated through the Contracting Officer and will be incorporated by contract modification, if needed. Tenant support may include the following types of activities:

• Support F-35 JPO Cloud tenant IaaS, PaaS, or SaaS activities

• Development and sustainment of infrastructure, platform, cybersecurity, application, and

IT support of projects onboarded onto JPO Cloud

Labor Categories

Position Description

Advanced Kubernetes and Container

Management SME

Demonstrated knowledge (mastery preferred) in the following:

- Kubernetes expert

- Container mangement expert

- GitOps

- Custom Kubernetes Operators

- Custom Helm charts

- Custom Admission Controllers

- Custom CRDs

- Custom Controllers

Cloud Security SME Demonstrated knowledge in the following:

- Centralized logging

- Boundary defense

- Web application firewalls

- Comply2Connect

- System patching

- Role Based Access Control (RBAC)

- Attribute Based Access Control (ABAC)

- Microsegmentation

-Vulnerability scanning

- Recursive DNS caching

Cybersecurity SME Demonstrated knowledge in the following:

- Zero trust architectures

- NIST 800 53

- NIST 800 190

- Joint Special Access Program

Implementation Guide

- Kubernetes Environments

- Foreign National Policies

And writing necessary documentation, publications and guidance.

Designer Demonstrated knowledge in the following:

- Design Thinking

- UI/UX frameworks and design technologies

-Customer Discovery

-Marketing Consultation

DevSecOps Engineer Demonstrated knowledge (mastery preferred) in the following:

-DoD Enterprise DevSecOps Ref

Design

- Terraform

- Kubernetes

- Docker

- Sonatype

- Fortify

- Selenium

- GitLab CI

IT Operations Demonstrated knowledge in the following:

- Cloud Native Architectures and Zero

Trust

- Commercial Cloud Environments

- Government Clouds (Preferred)

- Kubernetes

- Maintaining unclassified and classified networks

- Identity Management

- Collaboration Suites

- Engineering Tool Management

Product Manager Demonstrated knowledge in the following:

− Agile

− Scrum

− Lean Cloud Cost Management

− DevSecOps tools

− DoD Cyber Security

Network Engineer Demonstrated knowledge in the following:

− DoD network management

− Palo Alto

− Cisco

− Firewalls

− Networking

− Routing

− Secure communications

− Cloud connections

− Tunneling

System Administrator Demonstrated knowledge in the following:

− Cloud Native Architectures

− Commercial Cloud Environments

− Government Clouds (Preferred)

− Maintaining unclassified and classified networks

− Provisioning, deploying and maintaining tools from the Cloud

Native Computer Foundation ecosystem

License/Documentation Manager Demonstrated knowledge in the following:

- Software License Management

- Documentation Management

- Configuration Management

- Cost projections

- Software acquisitions

IT Service Support Demonstrated knowledge in the following:

- IT Helpdesk

- IT troubleshooting

- Customer service

- Communication skills

DataOps Demonstrated knowledge in the following:

- Data Engineering

- Business Intelligence

- Cloud Architecture

- Data and Machine Learning Operations

- Artificial Intelligence driven Cyber

Operations

- Technical Program Management

Work Criteria

It is anticipated that the contractor’s work products will be inspected and accepted along the following dimensions:

• Architecture Design Quality, Team’s level of expertise, Code Quality and Standards

Adherence. Contractor code will be inspected and accepted by Government team and support providers.

• Business Satisfaction. Each feature completed by a contractor team will be inspected and accepted by the Government Product Owner for that team, and by Government SMEs assigned to the team. At each iteration review, the functionality will be inspected and accepted by a wider audience of Government employees.

• Code Security Quality and Passing code scanners selected by the Government. Because security is a critical key component of this process, passing scanning results will be deliverables under via CDRL A123. This inspection and acceptance will be performed by the Government.

• Code Test Quality and Code Test Coverage. Because automated tests are a key component of this process, test scripts and code will be deliverables via CDRL A123.

These test scripts and code will be assessed for their quality and for the extent to which they test the appropriate functions. This evaluation will be performed by the Government.

Testing documentation shall be provided in accordance with Production Performance.

The contractor will be inspected and accepted on the performance of their code in production: its availability, response time, usability, accuracy and lack of defects.

• Process and Continuous Improvement. The contractor team will be assessed on the processes they implement, their conformance to Government processes, their conformance with Systems Engineering Life Cycle (SELC), DoD Enterprise DevSecOps, and other required frameworks, and their use of retrospectives to continuously improve these processes.

• Collaboration. The contractors will operate within an ecosystem of Federal and contractor staff, with multiple contractor teams working in parallel and with constant interaction with Government employees. The contractor will be graded based on their willingness, effort, and ability to work collaboratively.

• Compliance. The contractor will be assessed on maintaining system boundary authority to operate and compliance with the DoD Enterprise DevSecOps mandates, including the

Reference Design, Container Hardening guide and cybersecurity requirements.

• Timeliness. Performance of technical support response times to outages and customer initiated issues.

4.0 GENERAL INFORMATION.

4.1 Period of Performance. The period of performance (PoP) consists of a 5 year ordering period on the IDIQ level.

4.2 Place of Performance. Government site(s) include 200 12th Street South, 201 12th Street

South, and 2521 South Clark Street in Arlington, Virginia (VA). Other operating locations are at

Lockheed Martin Aeronautics Company at Lockheed Boulevard, Fort Worth, TX, Eglin Air

Force Base, FL, Point Mugu, CA, China Lake, CA, Hill Air Force Base, UT, Wright Patterson

Air Force Base, OH and remote locations approved by the Government Product Owner.

4.3 Hours of Operations. The Contractor shall provide support services as captured in the performance work statement. Current duty hours are 8 hours between 0700 and 1800, Monday through Friday, excluding holidays and authorized down days, as coordinated with F-35 JPO

Senior Leadership Team. The Contractor shall provide the Technical Point of Contact (TPOC) a current schedule for its entire staff assigned to the contract, including planned leave. The

Contractor shall assign alternates to cover assignments of any of its staff that are absent sufficient to ensure that the services are not disrupted.

4.4 Telework.

All contractor personnel will provide on-site support at the Government sites listed above for approximately [PERCENTAGE] of the time. There will be a representative for the contract in each supported office [PERCENTAGE] of the time unless approved by the Contracting Officer

(CO) or Contracting Officer Representative (COR) in writing such as when needed due to operational contingencies or otherwise determined to be in the best interests of the government.

It is impermissible that there be any additional cost to the government for approved telework above the costs specified in this contract. In the event telework is utilized, the Contractor remains responsible for performance and compliance with any applicable cost accounting standards and contract cost principles/procedures.

Work outside of the hours specified above will not normally be required. However, due to unforeseen circumstances, the TPOC may request unusual and lengthy after-hour, weekend, or holiday on-site support for services covered in this scope of work.

4.5 Installation Closure. When Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility related problem that prevents Federal personnel from working at the Government facility, Contractor personnel assigned to work at that facility performing non-mission essential work in support of such Federal employees shall follow their parent company’s policies.

4.6 Non-Personal Services. The services and performance required under this contract are determined to be not inherently governmental. The Contractor shall not perform or give the appearance of performing inherently governmental functions as described in Federal Acquisition

Regulation (FAR) Part 2 and Subpart 7.5, and all applicable DoD policy. The Government shall neither supervise contractor employees nor control the method by which the Contractor performs the required tasks. All contract personnel shall identify themselves as contracted support personnel in all forms of communication with all entities with whom the JPO has business dealings. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services. If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the CO immediately.

4.7 Business Relations. The Contractor shall successfully integrate and coordinate all activity needed to execute the requirements specified herein. The Contractor shall manage the timeliness, completeness, and quality of the contract deliverables. The Contractor shall provide corrective action plans, proposal submittals, timely identification of issues, and effective management of all contractor personnel (including subcontractors). The Contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contract personnel.

4.8 Program Management.

The contractor shall provide contract management support under this contract. This includes the management and oversight of all activities performed by contractor personnel, including subcontractors, to ensure all F-35 JPO Administrative and Operations services satisfy the requirements identified in the Performance Work Statement (PWS). The contractor shall identify a Program Manager (PM) by name, who shall serve as the primary interface and point of contact

(POC) with the Government program authorities and representatives on technical program/project issues. The contractor PM shall provide management, direction, administration, quality assurance, and leadership within the contractor’s team to their personnel for the execution of this contract in support of the F-35 JPO. The contractor shall facilitate communications between the Government and the contractor’s team along with all activities necessary to ensure the accomplishment of timely and effective support, performed in accordance with the requirements contained in this PWS.

The contractor shall use industry best-standards and proven methodologies that assure that all contract activities are identified, documented, and tracked so that the contract shall continuously be evaluated and monitored for timely and quality service by the contractor. The contractor shall notify the COR, CO, and F-35 JPO TPOC in writing of any technical, financial, personnel, or general managerial problems encountered throughout the PoP.

3.9 Contract Management. The Contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to this requirement. The Contractor must maintain continuity between the support operations and the

Contractor's corporate offices.

The Contractor shall establish processes and assign appropriate resources to effectively administer this contract. The Contractor shall respond to Government requests for contractual actions in a timely fashion. The Contractor shall have a single point of contact between the

Government and Contract personnel assigned to support this PWS. The Contractor shall assign work effort and shall maintain proper and accurate time keeping records of personnel assigned to work on this requirement including non-disclosure agreements.

3.10 Subcontract Management. The Contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement. The prime Contractor will manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations. Contractors may add subcontractors to their team after notification to the CO.

3.11 Contract Personnel and Continuity. An integral part of successful performance under this contract is not only the production of quality products described in Section 3.0, but also the responsiveness of contract personnel in the day-to-day output of work products. While the end product or deliverable is vital to successful performance, day-to-day oversight also includes client interaction and responsiveness. Accordingly, the Contractor is required to proactively maintain assigned tasks, and be responsive to all entities with professional business dealings related to the assigned tasks.

3.12 Training. The Contractor shall provide training, as necessary, for their personnel to ensure that personnel are trained on the common suite of Microsoft Office tools (e.g., Word, Excel, PowerPoint, Outlook, Teams and SharePoint) and other applicable programs. The

Contractor shall also ensure that all of its employees have been properly trained and are qualified to perform assigned tasks under this PWS. The Government will provide or coordinate training on any new Government-provided equipment or Government-directed training (e.g., Information

Assurance). If such training requires travel on the part of contractor employees, local travel costs

(e.g., Metro) shall be borne by the contract personnel.

3.13 Public Release/Non-Disclosure Agreement (NDA). The release of all information and material related to this contract is not authorized without the review and approval of the

Government. All contractor personnel are required to sign an NDA. The NDA will be due to the

CO with a courtesy copy to the COR at time of post award conference and immediately upon replacement of any personnel under this contract.

3.14 Public Disclosure. The Contractor shall not disclose or provide to the public information about training events and attendees/students of training events or sessions. The Contractor shall use its own company identity for any training site or posting of event(s), if required by the government task manager, the CO, or the COR. At no time during the performance of the contract will any information be released or posted to the public that identifies the DoD or any of the attendees by name and or their position(s); all this information will be confidential. Note that training provided under this contract will normally be subject to the conditions of this paragraph.

3.15 Copyrights. All training materials and content shall include a fully paid-up, lifetime license for use by the U.S. Government at no additional cost. No external copyright material shall be included in course materials/content unless a paid-up, lifetime copyright license is presented to the Government.

3.16 Organizational Conflict of Interest. Contractor and subcontractor personnel performing work under this contract may inadvertently or intentionally receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests

(OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the CO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

3.17 Information Technology. The Contractor shall not purchase any IT equipment in support of this contract. The Government will provide all necessary reference documents not generally available to the Contractor as required. Throughout the life of the contract, if any instruction or document is replaced or superseded, the replacement or superseding instruction or document shall be applicable to the requirements defined in this PWS.

3.18 Section 508 Compliance. All Electronic and Information Technology (EIT) products and services proposed shall fully comply with Section 508 of the Rehabilitation Act of 1973, per the

1998 Amendments, 29 United States Code (U.S.C.) 794d, and 36 Code of Federal Regulations

(CFR) 1194. The contractor shall identify all EIT products and services proposed, identify the technical standards applicable to all products and services proposed, and state the degree of compliance with the applicable standards. Additionally, the contractor must clearly indicate where the information pertaining to Section 508 compliance can be found (e.g., vendor’s website or other exact web page location). The contractor shall ensure that the list is easily accessible by typical users beginning at TOA and shall inform the COR and TPOC of the information location.

5.0 SECURITY REQUIREMENTS.

4.1 Citizenship Requirements.

Only U.S. citizens may perform under this contract. If the Contractor cannot find qualified U.S.

citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office and COR. The waiver request should include:

• The individual's name, date and place of birth, position title, and current citizenship.

• A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements.

• A statement of the unusual expertise possessed by the applicant.

• A statement that access will be limited to a specific government contract (specify contract number).

• A statement that the Contractor has obtained an export license for the information required to perform the contract.

4.2 Security Requirements DD-254. Contract Security Classification Specification. The

Contractor shall comply with security requirements specified in the DD-254 attached to this contract. Information or data that the Contractor accesses shall be handled at the appropriate classification level, unclassified information shall be handled as Controlled Unclassified

Information (CUI) (or updated unclassification designation). Distribution is authorized to the

Requiring Office’s Organization and supported Activity only.

4.3 Basic Personnel Clearance Requirements. The Contractor shall conform to the provisions of the DoD-I-5220.22, ‘National Industrial Security Program Operations Manual (NISPOM), and shall obtain and maintain security clearances for Contractor employees requiring access to IT systems or controlled areas. The Contractor shall comply with SECNAVINST 5510.30B and

SECNAV M-5510.30 to assure that the proper investigation is conducted for Contractor personnel. Contractor personnel shall have and maintain at minimum a SECRET clearance based on an SSBI or SSBI-PR completed within five (5) years at Time of Performance (TOP) or time of hiring unless otherwise captured at the task order level or as allowed via an interim clearance as stated below. The contractor shall insert this clause in all subcontracts when a subcontractor is required to have physical access to a federally controlled facility or access to a Federal information system.

4.3.1 The security policies, procedures and requirements stipulated in the NISPOM and supplements thereto are applicable, to include the following security requirements and/or guidance whenever contract performance will occur on a DoD installation or within a

DoD controlled facility or activity. The contractor shall possess or acquire a facility clearance equal to the highest classification.

• Full clearance levels must be acquired as soon as possible and maintained throughout the performance of the contract. Interim clearances for Contractors will be accepted for no greater than a period of up to 180 days from time of performance unless approved by the JPO ISSM and Security Manager.

4.4 Common Access Cards (CAC) / Local Badges. Contractor CACs and facility specific identification badges will be issued by the Government to on-site contractor personnel and shall be visible at all times while personnel are at the Government site. The contractor shall furnish all requested information required to facilitate issuance of identification badges and shall conform

to. All CACs and identification badges issued to Contractor employees shall be returned to the

Government Security Department at the Government site where the CAC was received or returned to the COR following completion of the contract, relocation, or termination of an employee, or upon request from the Government. Contract personnel must also read and familiarize themselves with all organizational mission statements and charters, organizational structures, operating instructions, Standard Operating Procedures (SOP), and policy, as appropriate.

4.5 SAAR-N. All Contractor personnel requiring access to Government Information Technology

(IT) systems shall have an approved System Authorization Access Request (SAAR-N) Form

(latest) on file, and complete required Cyber Awareness Training. New employees must submit their SAAR-N forms prior to their first day of work. SAAR-N forms shall be submitted to the

COR, Government lead, or to the assigned Government Identity, Credential, and Access

Management Trusted Associate. The contractor shall submit multiple SAAR-N forms to ensure contractors have the required system access to perform the work.

4.6 Information Security. The Contractor shall comply with DoD, Department of Homeland

Security, U.S. Navy, and U.S. Air Force security instructions specific to each location/facility.

Compromise and/or Electronic Spillage of Classified or Controlled Unclassified Information: All instances of loss, compromise, and electronic spillage of classified or controlled unclassified information shall be reported to the COR, TPOC and Government Security Office within 24 hours of the incident occurring.

All information generated by the Contractor shall be properly marked. Information that has been determined to qualify for Controlled Unclassified Information (CUI) status generated and/or provided under this contract shall be marked IAW DoDI 5200.48. Technical information shall also be marked with appropriate Distribution Statements and Export Control warnings in accordance with DoDI 5230.24 and program Security Classification Guidance. No information pertaining to this contract shall be released for public dissemination, including posting to any social media sites, such as Facebook or Twitter, unless it has been approved for public release by the appropriate U.S. Government authority. Proposed public releases shall be submitted to the

CO for approval prior to release IAW DFARS clause 252.204-7000.

4.7 Operations Security (OPSEC). The contractor shall comply with activity OPSEC program instructions, guidance and contribute to organization-level OPSEC efforts. The contractor will include OPSEC as part of its ongoing security awareness program and take all required activity

OPSEC training. The contractor will protect identified critical information, sensitive unclassified information, and activities, which, if divulged, could further compromise classified or sensitive information or operations, or degrade the planning and execution of operations performed by the

Requiring Office and contractor in support of the mission. The Contractor shall be responsive to the Supporting OPSEC Manager on a non-interference basis.

4.8 Anti-Terrorism Force Protection and Emergency Management. The work performed on this contract is not Emergency Essential in accordance with OPNAVINST 3440.17A and

Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans.

Contractor personnel shall comply with all Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans and directives. Contractor personnel shall not report for work at Government facilities upon declaration of Force Protection Condition CHARLIE or in any event or emergency where Government officials’ direct curtailment of operations to

“Mission Essential Only”.

4.9 DoD Security Regulations. The Contractor shall comply with regulations or publications.

This list is not all-inclusive; additional U.S. Government (USG) or DoD policies may be identified as the program matures.Joint Special Access Program Implementation Guide (JSIG), DoD Risk Management Framework (RMF), DoD Directives, Instructions, and Policies, and further related compliance to information security and privacy pertaining to work performed shall be maintained.

4.10 Proprietary Information Agreement. The Prime Contractor and subcontractors shall obtain, and continue to maintain throughout the life of the contract, Proprietary Information

Agreements (PIAs) with each of the critical F-35 Prime and subcontractor firms as well as the commercial technical information relationships with all key F-35 U.S. and foreign Contractors.

These agreements allow Contractors to share sensitive internal design documents, models, and projections. The Contractor shall have PIAs with Lockheed Martin Aeronautics, Pratt& Whitney, Raytheon, Northrop Grumman Air Combat Systems and Northrop Grumman Electronic Systems within 60-calendar days of the start of the transition period. A list of additional required PIAs will be given to the Contractor upon award and the agreements shall be in place no later than six

(6) months after TO award (TOA). A list of additional required PIAs may be given to the

Contractor as needed. This requirement is to be read in conjunction with the requirements of

Clause 5252.227-9511.

4.11 Technical Assistance Agreement. In order for the contractor, to include subcontractors, consultants, and teaming partners, to engage in technical discussions (defense services) with the

F-35 Foreign Government Defense Agencies within the F-35 Program, all F-35 contractors (to include any subcontractors, consultants, or teaming partners) shall have a TAA authorizing export privileges with the cooperative partners. In order to submit a TAA, the offeror, including any subcontractors, consultants, or teaming partners must be registered with the Director, Defense Trade Controls (DDTC), and U.S. DoS (renewable each year) within 10 days of contract award. Upon award, a TAA shall be submitted to DDTC within thirty (30) days after TOA requesting authorization to participate in defense services with the F-35 Partners/participants

Government Defense Agencies.

The services and technical data provided by the contractor pursuant to this contract are provided by the US DoD to the Governments of Israel, Japan, Singapore, Republic of Korea, Belgium, Poland, Finland, Switzerland, Germany, and the Czech Republic under the Foreign Military

Sales (FMS) program pursuant to a Letter of Offer and Acceptance (LOA) authorizing such transfer. The FMS Case Identifiers are IS-D-SAC, JA-D-SBC, SN-D-SAE, KS-D-SAC, BE-D-

SAD, PL-D-SAI, FI-D-SAB, SZ-D-SAA, and GY-D-SAB as well as any additional FMS case identifiers provided in writing by the Contracting Officer to the contractor. The FMS LOA will be in effect during the period of performance for this contract.

Note, registration does not confer any export privileges but is a prerequisite to export licensing approval. If a company (including subcontractors, consultants, or teaming partners) has already registered with DDTC, the proposal shall include the company’s DDTC Registration number and expiration date.

6.0 TRAVEL AND OTHER DIRECT COSTS.

6.1 Travel. Travel shall be allowable only when it is essential to the performance of the tasks detailed in Section 3.0. All travel within 100 miles of the National Capital Region (NCR) is included in the price of this contract. When movement of contract personnel is required locally

(e.g., Metro) costs will be borne by the contract personnel.

The COR shall approve all travel performed in support of this contract and invoiceable to the government prior to the commencement of the travel. Reimbursement for travel performed shall be in accordance with the Federal Travel Regulation prescribed by the General Services

Administration (www.gsa.gov/federaltravelregulation) and the Joint Travel Regulation, Volume

2, DoD Civilian Personnel, Appendix A, prescribed by the Department of Defense. Travel may include general and administrative expenses, but shall not include profit. Travel authorization request (TAR) shall be submitted on Travel Authorization Form prepared IAW Table 6.1.6.

Outside Contiguous US (OCONUS) Travel. The Contractor shall follow the guidelines as prescribed in the Foreign Clearance Guide (https://www.fcg.pentagon.mil/fcg.cfm) for DoD-

Sponsored Contractors. The Contractor shall ensure that all OCONUS travel is approved by the

COR prior to submitting the respective country clearance request via the Aircraft and Personnel

Automated clearance System (APACS) (https://apacs.milcloud.mil/apacs).

Travel Authorization Request. The Contractor shall submit a travel authorization request no later than 10 business days before the first travel date for CONUS travel and 30 business days for OCONUS travel for COR approval. The TAR should include (at a minimum) the following data for COR approval prior to incurring any costs.

Contract Number;

Name of Traveler;

Dates;

Origin and Destination;

Organization to be visited;

Purpose of Travel;

Estimated Airfare;

Estimated Lodging within regulatory limits;

Estimated Per Diem;

Estimate Ground Transportation;

POV Use;

Miscellaneous Costs;

Justification as to why teleconferencing or video teleconferencing cannot be used;

Employee signature; and

Government Lead Signature

5.2 Other Direct Costs (ODC). Purchase of materials, if required, shall be in accordance with

NAVAIR Clause 5252.242-9515 (Variation) (JUN 2018), Restriction on the Direct Charging of

Material. Invoiced material costs may include general and administrative expenses but shall not include profit. The costs of general-purpose business expenses required for the conduct of the contractor’s normal business operations are not an allowable direct cost in the performance of this contract.

7.0 CONTRACT DELIVERABLES AND APPLICABLE DOCUMENTS.

6.1 Contract Deliverables. The following contract deliverables shall be provided in response to this effort.

6.2 Management and Staffing Plan. The Contractor shall provide a Management and Staffing Plan, CDRL A001 within five days of contract award. The plan shall delineate how the Contractor plans to support this effort. At a minimum, the Contractor’s management plan shall include the following elements:

• Management Plan portion o Team organization structure, management roles and workforce structure, including lines of responsibility, authority, and communication through which all tasks will be managed;

o Subcontractor management plan to include details as to how the subcontractors will be managed (if applicable) to ensure cohesive integration into the overall management approach; describe the integration of the teaming partners into the http://www.fcg.pentagon.mil/fcg.cfm) http://www.fcg.pentagon.mil/fcg.cfm) https://apacs.milcloud.mil/apacs overall management approach; how and why selected subcontractor(s) were chosen;

which knowledge and skills will be acquiring through each subcontract; level of subcontract effort expected;

o Task dependencies and interrelationships;

o Cost management plan;

o Schedule management plan;

o Resource management plan;

o Risk management plan; and o Security plan.

• Staffing Plan portion:

o Plan to attract, train, and retain qualified personnel to meet PWS requirements;

o Labor category titles and functional responsibilities for all key and non-key labor categories as it applies to task orders released at award, to include employee name, current position title, and company; and o Qualifications for key personnel to include educational history and current level of security clearance and status (final, interim, or pending).

Quality Control Plan. The Contractor shall provide a Quality Control Plan, CDRL A002, within five days of contract award. The Contractor shall establish and maintain a QCP that ensures services are performed in accordance with this requirement (see Section 7), applicable laws and regulations, and best commercial practices. The Contractor’s QCP shall provide, (at a minimum), a detailed approach for ensuring effective controls, processes, and procedures are developed and implemented to meet/exceed all requirements of this PWS, and shall be further defined as required at the task order level, allowing for mitigation of any unique risk(s).

The QCP shall discuss how invoice reviews shall be conducted, to include discussion on how the primes, subcontractor, and supplier supporting data shall be reviewed for consistency with contract requirements.

As part of the Contractor’s Monthly Progress Report, the Contractor shall specifically discuss quality control activities over the reporting period and planned activities for the next period. Information shall specifically address WHO conducted the QC, WHEN was the QC executed, HOW was the QC executed and WHAT the findings and corrective actions were.

Trends over time shall be discussed.

Kick-Off Meeting and Slides. The Contractor shall submit Kick-Off Meeting slides, CDRL A003, within three days of contract award and shall attend the Kick-Off Meeting within five days of contract award. The Contractor’s slides shall capture (at a minimum) the following data:

• Introduction of key personnel;

• Roles and responsibilities;

• Communication plan and lines of communication overview;

• Schedule showing major tasks and milestones with start/completion dates;

• Security requirements/issues/facility access procedures (if applicable);

• Sensitivity and protection of information (if applicable);

•…