Contract Data Requirements List - Exhibit A (amend 0002).pdf

For the best experience, open this PDF portfolio in

Acrobat X or Adobe Reader X, or later.

Get Adobe Reader Now!

http://www.adobe.com/go/reader

DD FORM 1423-1, FEB 2001 PREVIOUS EDITION MAY BE USED. Page 1 of 2 Pages Adobe Professional 8.0

18. ESTIMATED

TOTAL PRICE

17. PRICE GROUP

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item)

Form Approved

OMB No. 0704-0188

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the Government Issuing Contracting Officer for the Contract/PR No. listed in Block E.

A. CONTRACT LINE ITEM NO. B. EXHIBIT

A

C. CATEGORY:

TDP TM OTHER

D. SYSTEM/ITEM

P5 SSU

E. CONTRACT/PR NO. F. CONTRACTOR

1. DATA ITEM NO.

A010

2. TITLE OF DATA ITEM

Configuration Audit Plan

3. SUBTITLE

4. AUTHORITY (Data Acquisition Document No.)

DI-SESS-81646B/T

5. CONTRACT REFERENCE

TSRD Para 2.10; SOW Para 4.2.6, 4.6, 4.6.10, 4.7, 4.7.2

6. REQUIRING OFFICE

AFLCMC/HBZP

7. DD 250 REQ

LT

9. DIST STATEMENT

REQUIRED

SEE BLK 16

10. FREQUENCY

12. DATE OF FIRST SUBMISSION

SEE 16

14. DISTRIBUTION

a. ADDRESSEE

b. COPIES

8. APP CODE

11. AS OF DATE

13. DATE OF SUBSEQUENT

SUBMISSION

Draft

Final

Reg Repro

16. REMARKS

Ref Blk 4:

Refer to TSRD

Submit separate plans for NSA and non-NSA FCAs and PCAs. Submit in Microsoft Office

Word.

Revision changes and additions from earlier versions shall be identified by a solid vertical bar, with additions identified by red text color. Deletions and formatting changes shall be indicated in the page margin. An appendix to the report shall be used to track comments along with the appropriate responses and/or changes. These responses shall be used to track comments along with the appropriate response and/or changes. These responses shall reference corresponding locations in the body of the document, which are marked by change bars. These comments and responses stay with the report with each revision.

Requires 0N number

Ref Blk 8: The Government will provide response NLT 45 calendar days after each submittal/resubmittal. Approval required prior to TRR.

Ref Blk 9: The Contractor shall coordinate the distribution statement with the Government prior to use to ensure other or special circumstances have not occurred that may warrant change in the distribution statement and that the most current information is applied. Apply

Export Control Statement and Destruction Notice IAW DoDI 5230.24. Distribution F applies to all NSA related products.

Ref Blks 10, 11, 12, and 13: The Contractor shall deliver initial submittal NLT 30 calendar days before PDR and as required until approved. Resubmittals incorporating Government comments required NLT 15 calendar days after receipt. Send directly to NSA.

Ref Blk 14: Data Items are to be delivered in the governments Wide Area Workflow

(WAWF) system. For data items that exceed the file size limit of the WAWF system, a

Letter of Submittal containing a listing of the Data Items shall be submitted in WAWF and the Data Items shall be submitted concurrently through approved secure electronic means.

The contractor shall notify the government via email when Data Items are being delivered outside of WAWF. Addresses for AFLCMC/HBZP and NSA:

See Block 16*

NSA

15. TOTAL 0 0 0

G. PREPARED BY H. DATE I. APPROVED BY J. DATE

FA8210-21-R-5002

Reset

D. SYSTEM/ITEM E. CONTRACT/PR NO.

F. CONTRACTOR

16. REMARKS (Continued)

6049 Wardleigh Rd

Bldg 1205

Hill AFB, UT

84056

MARYLAND PROCUREMENT OFFICE

ATTN: C242 (Ziaur Rahman)

9800 SAVAGE ROAD, SUITE 6755

FORT GEORGE G. MEADE, MD 20755-6733

DD FORM 1423-1, FEB 2001 Page 2 of 2 Pages

2021-04-22T07:26:59-0600

ADAMSON.STEVEN.JOEL.1599119724

2021-04-22T07:55:54-0600

SMITH.GILES.K.1054935443

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the

E. CONTRACT/PR NO.

A045

Contractor’s Risk Management Plan

DI-MGMT-81808

SOW Para 4.5.6

NA

D

Monthly

NA

Ref Blk 4: Contractor’s format is acceptable, however it shall be presented in MS Word.

The Contractor’s Risk Management Plan will be used to monitor management, cost and schedule of the contract efforts relative to a system and equipment. This information will provide the government with risk data for all risks associated with the system/equipment.

Ref Blks 10, 11, 12, 13: The Contractor shall submit initial report NLT 30 calendar days after contract award, and NLT 10 calendar days after the first of each month for subsequent reports.

Letter of Submittal containing a listing of the Data Items shall be submitted in WAWF and the Data Items shall be submitted concurrently through approved secure electronic means. The contractor shall notify the government via email when Data Items are being delivered outside of WAWF.

Hill AFB, UT 84056

2021-04-22T07:32:56-0600

ADAMSON.STEVEN.JOEL.1599119724

2021-04-22T08:20:50-0600

SMITH.GILES.K.1054935443

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the

A011

Configuration Audit Summary Report/Certification

DI-SESS-81022D/T

TSRD Para 2.10; SOW Para 4.2.6, 4.2.8, 4.6, 4.6.10, 4.7

Submit separate plans for NSA and non-NSA FCAs and PCAs. Submit in Microsoft Office

Word.

Prior to certification, two baseline data packages shall be submitted with each package containing the following:

a) one CD-ROM reserved for the final, clean copy version of approved

Program Documentation (CDRL)

b) one CD-ROM reserved for Engineering Drawings

c) one CD-ROM reserved for the software code (if applicable)

d) one CD-ROM reserved for HDL code (if applicable)

RRef Blk 8: The Government will provide response NLT 45 calendar days after each submittal/resubmittals. The Government will not approve the Report until all audit write-ups/changes/issues are incorporated/corrected/resolved as required based on audit results, action items resolved and closed, and all exit criteria are met. Also, the Government shall not exit FCA or PCA until the data item is approved.

Export Control Statement and Destruction Notice IAW DoDI 5230.24. Distribution F applies to all NSA related products.

Ref Blks 10, 11, 12, and 13: The Contractor shall deliver initial submittal NLT 30 calendar days before PDR and as required until approved.

Resubmittals incorporating Government comments required NLT 15 calendar days after receipt. Send directly to NSA.

Ref Blk 14: Data Items are to be delivered in the governments Wide Area Workflow (WAWF) system. For data items that exceed the file size limit of the WAWF system, a Letter of Submittal containing a listing of the Data Items shall be submitted in WAWF and the Data Items shall be submitted concurrently through approved secure electronic means. The contractor shall notify the government via email when Data Items are being delivered

2021-04-22T07:23:25-0600

ADAMSON.STEVEN.JOEL.1599119724

2021-04-22T07:57:07-0600

SMITH.GILES.K.1054935443

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the

A047

Software Requirements Specification (SRS)

DI-IPSC-81433A/T

SOW Para 4.6, 4.6.10, 4.6.11

Ref Blk 4: Update existing SRSs and develop new SRSs based on requirements allocation.

If DOORS product is used, DOORS product is acceptable except for FCA/PCA submissions.

The Contractor shall deliver full specifications in Microsoft Word for all specifications affected by P5 SSU, as approved by the Government.

Change the last sentence of Paragraph 3.3.1 to read: External interface diagrams depicting data flow, control flow, and other relevant information shall be used to aid in this description. If constituent capabilities have been identified, mutual interface diagrams shall be at this level. Add as last sentence to Paragraph 3.4: Internal interface diagrams depicting data flow, control flow, and other relevant information shall be used to aid in this description. If constituent capabilities have been identified, mutual interface diagrams shall be at this level. Add to Paragraph 5.a, This paragraph shall contain a mapping of the engineering requirements in this specification to the individual requirements applicable to

CSCIs contained in the system specification. This paragraph shall also provide the traceability for the CSCI requirements allocation to the individual requirement in the system specification to the individual engineering requirements of this specification. Traceability shall Include system specification requirements that have been allocated to all contractor software, including commercial off the shelf and non-developmental software. List in a traceability table the following information: a) specification abbreviation and requirement number (list each specification document name, number, date, and abbreviations used in this column in a legend at the beginning of matrix; b) specification paragraph number

(when applicable) and requirement test; c) test case name where requirement is tested; d)

CSC and CSU names; e) method of verification using “T” for test, “D” for demonstration, “E” for examination, “A-P” for analysis previously tested, “A” for analysis. Provide the requirements traceability table as an appendix in each SRS document.

indicated in the page margin. An appendix to the document shall be used to track comments change bars. These comments and responses stay with the document with each revision.

Ref Blk 8: The Government will provide response NLT 20 calendar days after receipt of submittals. Submittals for review required for PDR and CDR. The Government will respond to resubmittals NLT 10 calendar days after receipt. Government approval is required to exit CDR.

AFLCMC/HBZP 2 2

15. TOTAL 2 0 2

Ref Blk 9: The Contractor shall coordinate the distribution statement with the Government prior to use to ensure other or special circumstances have not occurred that may warrant change in the distribution statement and that the most current information is applied. Apply Export Control Statement and Destruction Notice IAW DoDI 5230.24.

Ref Blks 10, 11, 12 and 13: The Contractor shall submit SRSs NLT 45 calendar days before PDR (preliminary) and CDR (final). The Contractor shall deliver resubmittals NLT 10 calendar days after receipt of Government comments. Deliver full specifications in Microsoft Word for approval by the

Government NLT 30 calendar days prior to FCA/PCA.

Ref Blk 14: Data Items are to be delivered in the governments Wide Area Workflow (WAWF) system. For data items that exceed the file size limit of the WAWF system, a Letter of Submittal containing a listing of the Data Items shall be submitted in WAWF and the Data Items shall be submitted concurrently through approved secure electronic means. The contractor shall notify the government via email when Data Items are being delivered outside of WAWF.

2021-04-22T07:07:16-0600

ADAMSON.STEVEN.JOEL.1599119724

2021-04-22T08:24:28-0600

SMITH.GILES.K.1054935443

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the

A012

TEMPEST Test Plan

DI-SESS-81683D/T

TSRD Para 2.11.2; SOW Para 4.2.2, 4.2.6, 4.6.9, 4.6.10, 4.9.5

F

Include a requirements traceability table that lists each requirement that shall be verified by the test plan. List in a table the following information: a) specification abbreviation and requirement number (list each specification document name, number, date and abbreviation used in this column in a legend at the beginning of the table); b) specification paragraph number (when applicable) and requirement text; c) test case name where requirement is tested; d) steps in procedures where requirement is verified; e) method of verification using

“T” for test, “D” for demonstration, “E” for examinations, “A-P” for analysis previously tested, and “A” for analysis; f) pass/fail criteria. Provide the requirements traceability tables as an appendix in the document.

Provide signature and data blocks at the end of each test case for test witness signoff by

Government Representative, Contractor Test Director, and Contractor QA.

Data recording steps shall correlate to the data input blocks as they occur in the step-by-step procedures/plans.

indicated in the page margin. An appendix to the plan shall be used to track comments change bars. These comments and responses stay with the plan with each revision.

Provide a copy of the actual as run signed off test procedures and any changes (red-lines) to the test procedures that occurred during testing and a copy of any test data to the

Government at the conclusion of each test.

Requires ON number.

Ref Blk 8: The Government will provide response NLT 45 calendar days after receipt of submittal. The Government will respond to resubmittal NLT 7 calendar days after receipt.

Approval is required prior to TRR

TEMPEST POC

Ref Blk 9: Reference DoDI 5230.24. The Contractor shall coordinate the distribution statement with the Government prior to use to ensure other or special circumstances have not occurred that may warrant change in the distribution statement and that the most current information is applied. Apply

Export Control Statement and Destruction Notice IAW DoDI 5230.24

Ref Blks 10, 11, 12 and 13: Submit NLT 60 calendar days prior to TRR for TEMPEST Testing. Resubmittals incorporating Government comments required NLT 7 calendar days after receipt. Send directly to NSA and TEMPEST POC.

Ref Blk 14: Data Items are to be delivered in the governments Wide Area Workflow (WAWF) system. For data items that exceed the file size limit of the WAWF system, a Letter of Submittal containing a listing of the Data Items shall be submitted in WAWF and the Data Items shall be submitted concurrently through approved secure electronic means. The contractor shall notify the government via email when Data Items are being delivered

2021-04-22T07:26:15-0600

ADAMSON.STEVEN.JOEL.1599119724

2021-04-22T07:58:41-0600

SMITH.GILES.K.1054935443

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the

A003

Security Verification Report

DI-QCIC-81690/T

TSRD Para 2.3; SOW Para 4.2.6

1. Revision changes and additions from earlier versions shall be identified by a solid vertical bar, with additions identified by red text color. Deletions and formatting changes shall be indicated in the page margin. An SHRS Traceability Matrix (SRM) shall be attached showing requirements traced to the specific test procedures which will be used to track comments along with the appropriate response and/or changes. These responses shall

Change Bars. These comments and responses stay with the SVR with each revision.

When delivering the procedures and reports, an accompanying Requirement Traceability

Matrix (RTM) with requirements traced to the specific test procedures shall be delivered with it.

All test reports shall include copies of the Test Incident Reports, Problem Change Requests

(PCR), Deficiency Reports (DR) and any other documentation associated with all problems and known errors. Provide the ‘Master as run’ test plans including any red-lines (additions, deletions and deviations) with the test report. Provide copies of all data recorded during the tests (e.g., CD(s) or DVD(s)). Any data recorded on paper such as test logs, etc., may be scanned and loaded onto CD(s) or DVD(s) for digital presentation.

submittal/resubmittal.

Export Control Statement and Destruction Notice IAW DoDI 5230.24.

Ref Blks 10, 11, 12, 13: First submission due 30 calendar days after test completion.

Resubmittal, if required, due 15 calendar days after receipt of Government comments. Send directly to NSA.

Ref Blk 14: Data Items are to be delivered in the governments Wide Area Workflow (WAWF) system. For data items that exceed the file size limit of the WAWF system, a Letter of Submittal containing a listing of the Data Items shall be submitted in WAWF and the Data Items shall be submitted concurrently through approved secure electronic means. The contractor shall notify the government via email when Data Items are being delivered

2021-04-22T07:29:09-0600

ADAMSON.STEVEN.JOEL.1599119724

2021-04-22T09:22:17-0600

SMITH.GILES.K.1054935443

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the

A048

System/Subsystem Specification (S/SS)

DI-IPSC-81431A/T

4.6.11

Ref Blk 4: Contractor format is acceptable. The Contractor shall update the system and subsystem specifications.

If DOORS product is used, DOORs product is acceptable except for FCA/PCA submissions. For FCA/PCA the Contractor shall deliver full specifications in Microsoft

Word for all specifications affected by P5 SSU, as approved by the Government. The

System Specifications shall address all requirements and capabilities of the system to include peculiar support equipment (PSE). The Subsystem Specifications shall include all requirements derived from the System Specification to include the security assurance requirements, as well as additional improved capabilities.

Ref Paragraph 5: The Contractor shall list in traceability tables the following: a) specification abbreviation and requirement number (list each specification document name, number, date and abbreviation used in this column in a legend at the beginning of the matrix); b) specification paragraph number (when applicable) and requirement text; c) test case name where requirement is tested; and d) method of verification using “T” for test, “D” for demonstration, “E” for examination, “A-P” for analysis-previously tested, and “A” for analysis. The contractor shall provide the requirements traceability tables as an appendix in each system/subsystem specification document.

tested; and d) method of verification using “T” for test, “D” for demonstration, “E” for examination, “A-P” for analysis-previously tested, and “A” for analysis. The contractor shall provide the requirements traceability tables as an appendix in each system/subsystem specification document.

Ref Blk 8: The Government will provide response NLT 20 calendar days after submittals.

The Government will respond to resubmittals NLT 10 calendar days after receipt.

Approved System Specification required to exit SRR. Subsystem Specification submittals required for review before PDR and CDR. Approved Subsystem Specifications required to exit CDR.

change in the distribution statement and that the most current information is applied.

Apply Export Control Statement and Destruction Notice IAW DoDI 5230.24.

Ref Blks 10, 11, 12 and 13: The Contractor shall submit System Specification NLT 45 calendar days prior to SRR. The Contractor shall submit

Subsystem Specifications NLT 45 calendar days before PDR (preliminary) and CDR (final). The Contractor shall deliver resubmittals NLT 10 calendar days after receipt of Government comments. Deliver full specifications in Microsoft Word for approval by the Government NLT 30 calendar days prior to FCA/PCA.

Ref Blk 14: Data Items are to be delivered in the governments Wide Area Workflow (WAWF) system. For data items that exceed the file size limit of the WAWF system, a Letter of Submittal containing a listing of the Data Items shall be submitted in WAWF and the Data Items shall be submitted concurrently through approved secure electronic means. The contractor shall notify the government via email when Data Items are being delivered

2021-04-22T07:06:58-0600

ADAMSON.STEVEN.JOEL.1599119724

2021-04-22T08:24:53-0600

SMITH.GILES.K.1054935443

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the

A013

TEMPEST Test Evaluation Report

DI-EMCS-81684/T

TSRD Para 2.11.3; SOW Para 4.2.2, 4.2.6, 4.6.10, 4.9.5

Provide copies of all data recorded during TEMPEST test (e.g., CD(s) or DVD(s)). Any data recorded on paper such as test logs, etc., may be scanned and loaded onto CD(s) or

DVD(s) for digital presentation.

All test reports shall include copies of the System Incident Reports (SIR), Problem Change

Requests (PCR), Deficiency Reports (DR) and any other documentation associated with all problems and known errors.

The report must contain only original photographs and signatures.

Provide the ‘Master as run’ test plans including any red-lines (additions, deletions and deviations) with the test report.

Ref Blk 8: The Government will provide response NLT 45 calendar days after receipt of

Export Control Statement and Destruction Notice IAW DoDI 5230.24.

Ref Blks 10, 11, 12, 13: The Contractor shall submit report NLT 30 calendar days after completion of test. Resubmittals incorporating Government comments required NLT 15 calendar days after receipt. Send directly to NSA and TEMPEST POC

TEMPEST POC

Ref Blk 14: Data Items are to be delivered in the governments Wide Area Workflow (WAWF) system. For data items that exceed the file size limit of the WAWF system, a Letter of Submittal containing a listing of the Data Items shall be submitted in WAWF and the Data Items shall be submitted concurrently through approved secure electronic means. The contractor shall notify the government via email when Data Items are being delivered

2021-04-22T07:23:08-0600

ADAMSON.STEVEN.JOEL.1599119724

2021-04-22T07:59:06-0600

SMITH.GILES.K.1054935443

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the

A014

In-Process Accounting Procedures (IPAP)

DI-QCIC-81691A/T

TSRD Para 2.12.1; SOW Para 4.2.6

Ref Blks 10, 11, 12 and 13: The Contractor shall submit NLT 40 calendar days prior to

CDR. Resubmittals incorporating Government comments required NLT 15 calendar days after receipt.

Send directly to NSA.

2021-04-22T07:22:51-0600

ADAMSON.STEVEN.JOEL.1599119724

2021-04-22T07:59:33-0600

SMITH.GILES.K.1054935443

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the

A049

DoD Risk Management Framework (RMF) Package

Deliverables

DI-MGMT-82001/T

4.9.2

Ref Blk 4: Paragraph 1: Contractor format acceptable.

Paragraph 2. Content. Change to: The content of the RMF package artifacts shall contain the necessary artifacts required by the AO or ISSM to successfully achieve Interim

Authority to Test (IATT) or Authority to Operate (ATO).

Paragraph 2.1.1. IATT Request. Replace entire paragraph with: Contractor to work with

Government Program Office ISSM personnel to receive IATT through AO.

Paragraph 2.1.2. Security Plan (SP). Change to: The SP shall contain at a minimum System

Information, Mission Description, Concept of Operations (CONOPS), Environment, Operating and Computing Environment, Physical Security Measures, System Architecture

Description, Components, Configurations, Accreditation Boundaries, External Interfaces and Data Flow, Internal Data Flow, User Description and Clearances, Security Roles, Hardware Lists, Software Lists, Ports, Protocols, and Services (PPS) and Milestone Based

Management Plan. The SP shall also include plans for accomplishing Security Technical

Implementation Guides (STIG), Secure Content Automation Protocol (SCAP) and Assured

Compliance Assessment Solution (ACAS) reports.

Paragraphs 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.1.11, 2.1.13 (Scorecard) through

2.1.17 deleted.

Paragraph 2.1.10. Plan of Action and Milestones (POA&M). Add to Paragraph: The

Contractor shall develop/deliver an internal POA&M and use as a tool for the contractor to track open STIG and SCAP findings and work with the Government to correct the findings by providing artifacts.

Paragraph 2.1.12. Vulnerability Scans. The Contractor shall accomplish the Assured

Compliance Assessment Solution (ACAS) with the latest plugins within 7 calendar days prior to the execution of each vulnerability scan. The Contractor shall document findings and submit a comprehensive ACAS vulnerability scan report to the Government ISSM after each scan and provide an ACAS raw vulnerability output in .NEXUS format to ISSM for approval. The Contractor shall implement software patches to fix “LOW” or higher ACAS findings, or provide rationale and impact statement for non-compliance to the Government

ISSM. Vulnerability scans shall be handled and transmitted in accordance with the

System’s classification level.

Paragraph 2.1.13. Change to: Security Technical Implementation Guides (STIG), Secure Content Automation Protocol (SCAP) Benchmarks. The

Contractor shall harden the system using the required and approved STIG, SCAP Benchmarks, and other approved hardening tools. The Contractor shall document non-compliant STIG, SCAP Benchmarks and other findings in the Contractor POA&M. Updates to the STIG and SCAP Benchmarks are released on a monthly, quarterly, and yearly basis. The Contractor shall implement updates to the STIG and SCAP Benchmarks into the System as they are released. The Contractor shall document non-compliant STIG and SCAP Benchmark findings in the Contractor POA&M. The Contractor shall handle STIG and SCAP Benchmark artifacts in accordance with the System’s classification level. At a minimum the Contractor shall submit

STIG and SCAP Benchmarks electronically to the ISSM on a monthly basis. The Contractor shall protect STIG and SCAP Benchmark results in accordance with the System’s classification.

Ref Blk 8: The Government will provide a response NLT 15 calendar days after Contractor submittal of each preliminary and final SP submittal. The

Government will provide response to resubmittal NLT 10 calendar days after receipt. The Government will respond to STIG and ACAS reports NLT

15 calendar days after receipt.

Ref Blk 9: The Contractor shall coordinate the distribution statement with the Government prior to use to ensure other or special circumstances have not occurred that may warrant change in the distribution statement and that the most current information is applied. Apply Export Control Statement and Destruction Notice IAW DoDI 5230.24.

Ref Blks 10, 11, 12, and 13: The Contractor shall deliver the preliminary SP NLT 30 calendar days prior to SRR and final SP NLT 30 calendar prior to

PDR. Resubmit incorporating all Government comments NLT 10 calendar days after receipt of Government response. The contractor shall submit

STIG/SCAP and ACAS results NLT 15 calendar days before PDR and NLT 15 calendar days after release of benchmarks.

Ref Blk 14: Data Items are to be delivered in the governments Wide Area Workflow (WAWF) system. For data items that exceed the file size limit of the WAWF system, a Letter of Submittal containing a listing of the Data Items shall be submitted in WAWF and the Data Items shall be submitted concurrently through approved secure electronic means. The contractor shall notify the government via email when Data Items are being delivered

2021-04-22T07:05:46-0600

ADAMSON.STEVEN.JOEL.1599119724

2021-04-22T08:25:14-0600

SMITH.GILES.K.1054935443

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the

A015

Quality Program Plan (QPP)

Security Production Assurance (SPA) Description

DI-QCIC-81722/T

TSRD Para 2.13; SOW Para 4.2.6

Ref Blk 8: The Government will provide response NLT 45 calendar days after

Ref Blks 10, 11, 12 and 13: The Contractor shall submit NLT 40 calendar days prior to

CDR. Resubmittals incorporating Government comments required NLT 15 calendar days after receipt.

Send directly to NSA.

2021-04-22T07:26:01-0600

ADAMSON.STEVEN.JOEL.1599119724

2021-04-22T07:59:59-0600

SMITH.GILES.K.1054935443

DD FORM 1423-1, FEB 2001 PREVIOUS EDITION MAY BE USED. Page 1 of 7 Pages

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the

A050

Scientific and Technical Reports

Remanence and Covert Analyses

DI-MISC-80711A/T

4.9.6, 4.9.7

Ref Blk 4: Contractor format acceptable. Mark IAW contractual requirements. Develop

Covert Channel Analysis and Remanence Analysis to support Government Risk

Management Framework for DoD Information Technology for P5CTS IAW DoDI 8510.01.

At a minimum these analyses shall address all IA controls IAW National Institute of

Standards and Technology (NIST) Special Publication 800-53 Rev 4 for all P5CTS configurations to include the Ground Subsystem.

Ref Blk 8: The Government will provide a response NLT 30 calendar days after Contractor submittal. The Government will provide response to resubmittal NLT10 calendar days after receipt.

change in the distribution statement and that the most current information is applied.

Apply Export Control Statement and Destruction Notice IAW DoDI 5230.24.

Ref Blks 10, 11, 12, and 13: Deliver P5CTS baseline report NLT 60 calendar days after contract award and final report NLT 30 calendar days prior to FCA/ PCA. Resubmit incorporating all Government comments NLT 15 calendar days after receipt of Government response.

DD FORM 1423-1, FEB 2001

SUPPLEMENTARY INFORMATION

MARKINGS FOR SCIENTIFIC AND TECHNICAL INFORMATION

AND

SOFTWARE MEDIA LABELS

Document Revisions: Use track changes. Identify by a solid vertical bar, revision changes and additions from earlier versions, identified by red text color. Indicate in the page margin, deletions and formatting changes. Note specific CDRL for additional information.

Mark documents with appropriate destruction notice

• Controlled Unclassified STINFO destruction:

– Preferred method is SHREDDING

DESTRUCTION NOTICE—Destroy by any method that will prevent disclosure of contents or reconstruction of the document.

• For classified STINFO

DESTRUCTION NOTICE—Follow the procedures in DoD 5220.22-M, National Industrial Security Program

Operating Manual (NISPOM), section 5-705, or DoD 5200.01M, Information Security Program, Vol 3, Protection of

Classified Information.

Mark documents with export control:

WARNING - This document contains technical data whose export is restricted by the Arms Export Control Act (Title

22, U.S.C., Sec 2751, et seq.) or the Export Administration Act of 1979 (Title 50, U.S.C., App. 2401 et seq.), as amended. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.

Mark with correct distribution statement according to DD Form 1423. The Contractor shall coordinate the distribution statement with the Government prior to use to ensure other or special circumstances have not occurred that may warrant change in the distribution statement and that the most current information is applied.

DISTRIBUTION STATEMENT B. Distribution authorized to U.S. Government Agencies only, Limited Rights

Data, Export Controlled, 11 August 2010. Other requests for this document shall be referred to AFLCMC/HBZP, 6049 Wardleigh Ave, Bldg 1205, Hill AFB UT 84056-5116

DISTRIBUTION STATEMENT C. Distribution authorized to U.S. Government Agencies and their contractors, Critical Technology, Export Controlled, 16 December 2002. Other requests for this document shall be referred to

AFLCMC/HBZP, 6049 Wardleigh Ave, Bldg 1205, Hill AFB UT 84056-5116

DISTRIBUTION STATEMENT D. Distribution authorized to the Department of Defense and U.S. DoD contractors only, Critical Technology, Export Controlled, 16 December 2002. Other requests for this document shall be referred to AFLCMC/HBZP, 6049 Wardleigh Ave, Bldg 1205, Hill AFB UT 84056-5116

DISTRIBUTION STATEMENT F: Further dissemination only as directed by AFLCMC/HBZP, 6049 Wardleigh

Ave, Bldg 1205, Hill AFB UT 84056-5116, 16 December 2002, or higher DoD authority.

Advise PCO via Email and formal notice of delivery in ATIMS (e.g., transmittal letter) of any data deliveries through other than ATIMS. For items delivered to addresses through other than ATIMS contact data manager to ensure correct address prior to delivery.

IMPORTANT: COORDINATE WITH GOVT PROGRAM OFFICE PRIOR TO DELIVERY TO

ENSURE CORRECTLY MARKED

MARK SOFTWARE AS IDENTIFIED BELOW - EXAMPLE:

UNCLASSIFIED

SOFTWARE TITLE

Subtitle

DISTRIBUTION STATEMENT:

WARNING: This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C. 2751 et seq.) or the Export Administration Act of 1979 (Title 50, U.S.C., App. 2401, et seq), as amended. Violation of these export laws is subject to severe criminal penalties. Dissemination of this document is controlled under DoD Directive 5230.25.

DESTRUCTION NOTICE: Destroy by any method that will prevent disclosure of contents or reconstruction of the document.

(CPIN)

(SOFTWAE TITLE)

(PART NUMBERS)

(T.O. NUMBER)

(ALTERNATE ID or SWID)

REV ###

DDMMMYYYY

CLAS U

001/001

UNCLASSIFIED

MARK SOFTWARE AS IDENTIFIED BELOW – EXAMPLE

(CLASSIFICATION MARKING)

Derived from:

SCG: (Date) Declassify on: (Date)

WARNING: This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C. 2751 et seq.) or the Export Administration Act of 1979 (Title 50, U.S.C., App. 2401, et seq), as amended. Violation of these export laws is subject to severe criminal penalties. Dissemination of this document is controlled under DoD Directive 5230.25.

(SOFTWARE TITLE)

(PART NUMBERS)

(T.O. NUMBERS)

CLAS S

MARK SOFTWARE AS IDENTIFIED BELOW – EXAMPLE

Derived from:

SCG: (Date) Declassify on: (Date)

WARNING: This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C. 2751 et seq.) or the Export Administration Act of 1979 (Title 50, U.S.C., App. 2401, et seq), as amended. Violation of these export laws is subject to severe criminal penalties. Dissemination of this document is controlled under DoD Directive 5230.25.

(SOFTWARE TITLE)

(PART NUMBERS)

(T.O. NUMBER)

CLAS C

NSA GENERAL REQUIREMENTS

All deliverables shall be submitted via CD-ROM unless otherwise pre-coordinated with the NSA Lead Service

Provider (LSP). All NSA documents require 0N number.

Delivery Address (classified and unclassified): (please validate prior to delivery to ensure has not changed)

ATTN: Y2233 (Al Alghali)

Applications/Format:

All deliverables, unless otherwise specified, shall be prepared using Microsoft Office that includes Power

Point, Excel, Access, and Word. Some Program Management Offices (PMOs) may have Project and Visio. The vendor and the LPO must work together to agree to a mutual distribution path and a mutual set of electronic media formats. Other acceptable formats, listed below:

Acrobat (pdf)

ASCII Format

Rich Text Format (RTF)

Media:

Delivery via CD-ROM. Other electronic means of delivery may be pre-coordinated, such as DoD PKI encrypted e-mail.

Miscellaneous:

Classified, restricted, or proprietary information shall be isolated, by category, and submitted on separate media.

Document Data

a. Include a title page that at least identifies the following:

Program Name and Nomenclature

Contract or Memorandum of Agreement Number

Contract Data Requirement List (CDRL) number

Revision and date

Program Manager’s name and telephone number

IACM’s name and telephone number

b. Include a Change/Revision Page.

c. Include a list of Reference Documents.

d. Include a Table of Contents.

e. Include a Table defining all abbreviations and acronyms.

f. Classification markings in accordance with DD-254 and Classification Guide.

2021-04-22T08:26:44-0600

ADAMSON.STEVEN.JOEL.1599119724

2021-04-22T08:30:20-0600

SMITH.GILES.K.1054935443

DD FORM 1423-1, FEB 2001 PREVIOUS EDITION MAY BE USED. Page 1 of 13 Pages

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the

A016

Product Drawings/Models and Associated Lists

DI-SESS-81000E/T

TSRD Para 2.14; SOW Para 4.1.3, 4.2.6, 4.3.1, 4.6, 4.6.10, 4.6.11

To include upgraded Encryption Digital End Cap and P5 SSU TCTO kit.

Requires 0N Numbers for NSA applicable drawings.

The Contractor shall submit drawings sufficient for manufacture and depot maintenance.

The Contractor shall include drawings sufficient for any local manufacture items/equipment.

Drawings shall include a top level drawing/schematic showing all external dimensions and connections and integration into P5CTS Ground Subsystem.

Include update of engineering drawings for compatibility with JEDMICS to include corrections of data right markings in accordance with DFARs 252.227-7013 and

252.227-7014 and distribution statements and identification of critical safety items shall apply as identified by the Government.

Drawings shall comply with ASME Y14.100 (including Appendices

B, C, D, E) ASME Y14.24, ASME Y14.3, ASME Y14.34, ASME Y14.35, and ASME

Y14.5. Contractor may select the type of drawings; however, the Contractor shall prepare

Source Control drawings and/or Vendor Item

Drawings for existing Commercial-off-the-Shelf items or Vendor developed items, with the exception of bulk items.

The Contractor shall not identify his own company as a source on control drawings, unless one additional source is also shown. Two or more sources shall be identified. Contract Number: All Drawings and

Associated lists shall have the contract number identified on sheet one of each document.

Include vendor item/ control drawing/specification.

Provide update to Ground Subsystem minimum specification requirements, as required, based on effort.

Provide drawings for local manufacture items.

The attached TDP Option Selection Worksheet (defined in MIL-STD-31000) shall apply.

All proprietary markings shall have Government approval prior to usage on drawings.

CAGE code used shall have Government approval prior to drawing usage.

The Contractor shall develop Item unique identification/label/identaplate drawings.

Government approval of label/identaplate layout is required prior to implementation.

NSA 2 2

Maryland Procurement

Office

Attn: C242 (Ziaur

Rahman)

9800 Savage Road, Suite 6755

Fort Meade, MD

20755-6733

15. TOTAL 4 0 4

Revision changes and additions from earlier versions shall be identified by a solid vertical bar, with additions identified by red text color. Deletions and formatting changes shall be indicated in the page margin. An appendix shall be used to track comments along with the appropriate response and/or changes. These responses shall reference corresponding locations in the body of the document which are marked by change bars. These comments and responses stay with the data item with each revision.

REF BLK 9: The Contractor shall coordinate the distribution statement with the Government prior to use to ensure other or special circumstances have not occurred that may warrant change in the distribution statement and that the most current information is applied. NSA 0N drawing numbers require specific distribution statement (Distribution F) approved by NSA (coordinate data markings prior to delivery). Coordinate all data markings with AFLCMC/HBZP prior to delivery for non-NSA documentation.

DISTRIBUTION STATEMENT B. Distribution authorized to U.S. Government Agencies only, Limited Rights Data, Export Controlled, 11 August

2010. Other requests for this document shall be referred to AFLCMC/HBZP, 6049 Wardleigh Ave, Bldg 1205, Hill AFB UT 84056-5116

DISTRIBUTION STATEMENT C. Distribution authorized to U.S. Government Agencies and their contractors, Critical Technology, Export

Controlled, 16 December 2002. Other requests for this document shall be referred to AFLCMC/HBZP, 6049 Wardleigh Ave, Bldg. 1205, Hill AFB

UT 84056-5116

DISTRIBUTION STATEMENT D. Distribution authorized to the Department of Defense and U.S. DoD contractors only, Critical Technology, Export

Controlled, 16 December 2002. Other requests for this document shall be referred to AFLCMC/HBZP, 6049 Wardleigh Ave, Bldg 1205, Hill AFB UT

84056-5116

DISTRIBUTION STATEMENT F: Further dissemination only as directed by AFLCMC/HBZP, 6049 Wardleigh Ave, Bldg 1205, Hill AFB UT

84056-5116, (16 December 2002) or higher DoD authority.

Apply Export Control Statement and Destruction Notice IAW DoDI 5230.24

WARNING - This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et seq.) or the Export Administration Act of 1979 (Title 50, U.S.C., App. 2401 et seq.), as amended. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.

DESTRUCTION NOTICE—Destroy by any method that will prevent disclosure of contents or reconstruction of the document.

• For classified STINFO

DESTRUCTION NOTICE—Follow the procedures in DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), section

5-705, or DoD 5200.01M, Information Security Program, Vol 3, Protection of Classified Information.

Drawings with Government Purpose Rights statements shall include the expiration date after which no restrictions apply.

BLKs 8, 10, 11, 12, 13: Government final approval action shall not occur until incorporation and/or resolution of Government comments, successful completion of FCA and PCA and delivery and review by NSA and AFLCMC/HBZP. Shipping list: A shipping list shall be provided with each shipment of engineering data delivery in alphanumeric order. Send directly to NSA, send to AFLCMC/HBZP

Preliminary Shipments: Contractor shall submit a set of full size first generation…