Atch_13_Bomber_Armament_Tester_Statement_of_Work_Rev7.pdf

BAT Statement of Work (SOW), 04/14/16, Rev 7

Bomber Armament Tester (BAT)

Statement of Work (SOW)

04/14/16, Rev 7

Prepared by

AFLCMC/WNA

AUTOMATIC TEST SYSTEMS DIVISION

235 BYRON ST. STE 19A

ROBINS AFB GA 31098

DISTRIBUTION STATEMENT A. Approved for public release: Distribution is unlimited. (78 ABW/PA Certificate Number 15-04268).

Table of Contents

1.0 SCOPE

1.1 PROGRAM SYNOPSIS

1.2 OVERVIEW OF BAT PROGRAM

1.2.1 Increment 1

1.2.2 Increment 2

1.2.3 Increment 3

1.2.4 Government Data Rights

2.0 APPLICABLE DOCUMENTS

3.0 GENERAL REQUIREMENTS

3.1 PROGRAM CONFERENCES

3.1.1 Post-Award Conference (PAC)

3.1.2 Engineering Data Guidance Conference

3.1.3 Technical Order (TO) Guidance Conference

3.1.4 Provisioning Guidance Conference

3.2 GENERAL TECHNICAL REQUIREMENTS

3.2.1 General Design Requirements

3.2.2 Technical Approach

3.2.3 TPS General Design Requirements

3.2.4 BAT System Software Requirements

3.2.4.1 Software Requirements Specification (SRS)

3.2.4.2 Software Product Specification (SPS)

3.2.4.3 Software Version Description (SVD)

3.2.4.4 Computer Software Product – Software Delivery

3.2.4.5 Automated Computer Program Identification Number System (ACPINS) Data and Control Record

3.2.4.6 Development Environments

3.3 NUCLEAR CERTIFICATION

3.3.1 Nuclear Certification Impact Statement (NCIS)

3.3.2 Certification Requirements Plan (CRP)

3.3.3 Nuclear Safety Analysis Report (NSAR)

3.4 RELIABILITY

3.5 PROGRAM PROTECTION

3.5.1 Program Protection Implementation Plan (PPIP)

3.5.2 Inspection and Audit

3.5.3 Cybersecurity

3.5.3.1 Cybersecurity Controls

3.5.3.2 System Security Plan (SSP)

3.5.3.3 Cybersecurity Risk Management

3.5.3.4 Authorizations and System Level Plan of Action and Milestones (POA&M)

3.5.3.5 Cyber-Secure Development Environment

3.5.4 Anti-Tamper (AT)

3.5.5 Counterfeit Prevention

3.6 SAFETY

3.6.1 Hazard Analysis and Risk Mitigation

3.6.2 Environmental, Safety, and Occupational Health (ESOH)

3.7 SYSTEMS ENGINEERING TECHNICAL REVIEWS (SETRS)

3.8 PROGRAM MANAGER (PM)

3.8.1 Program Management Activities

3.8.2 Earned Value Management (EVM)

3.8.2.1 Integrated Program Management Reporting

3.8.3 Program Reviews and Conferences

3.8.3.1 Support of Reviews and Meetings

3.8.3.2 Meetings (Conferences)

3.8.3.3 Technical Interchange Meetings (TIMs)

3.9 LOGISTICS

3.9.1 Acquired or Furnished Property

3.9.1.1 Government Furnished Property (GFP)

3.9.1.2 Contractor Acquired Property (CAP)

3.9.1.3 Government Furnished Property (GFP) and Services

3.9.1.4 Government Property (GP) and Loss of GP Definition

3.9.1.5 Reporting Loss of Government Property

3.9.2 Technical Orders (TOs)

3.9.2.1 Development

3.9.2.1.1 Technical Order Library

3.9.2.2 Validation/Certification

3.9.2.3 Verification

3.9.3 Engineering Data

3.9.3.1 Engineering Data Guidance Conference

3.9.3.2 In-Process Review (IPR) of the Technical Data Package (TDP)

3.9.3.3 Relationship of Contractor with Subcontractors/Vendors

3.9.3.4 Engineering Data Updates and Revisions

3.9.4 Familiarization

3.9.5 Provisioning

3.9.6 Configuration Management (CM) and Control

3.9.6.1 Configuration Requirements

3.9.6.2 Configuration Items (CIs)

3.9.6.3 Engineering Change Proposal (ECP)/Notice of Revision (NOR)

3.9.6.4 Authorization

3.9.6.5 Request for Variance (RFV)

3.9.6.6 Item Unique Identification (IUID)

3.9.6.6.1 Marking

3.9.6.6.2 IUID Marking Plan

3.9.6.6.3 IUID Marking Activity and Verification Report

3.9.7 Diminishing Manufacturing Sources and Material Shortages (DMSMS)

3.9.8 Parts Control and Standardization Program

3.10 DATA ACCESSION LIST (DAL)

3.11 SECURITY

3.11.1 Security Information

3.11.2 Contractor Facilities

3.11.3 Communications Security (COMSEC)

4.0 INCREMENT 1

4.1 EMD

4.1.1 BAT System Requirements Review (SRR)

4.1.2 BAT System Functional Review (SFR)

4.1.3 BAT Preliminary Design Review (PDR)

4.1.4 BAT System Critical Design Review (CDR)

4.1.5 BAT System Verification Review (SVR)

4.1.5.1 Develop/Build Production Representative (Core Tester) Articles

BAT Calibration and Measurement Requirements Summary (CMRS)

4.1.5.2 Testing of the BAT Core Tester

Environmental Testing

4.1.5.2.2 Reliability Testing

4.1.5.2.3 Cybersecurity Testing

4.1.5.2.4 BAT Core Tester for Red Team Analysis

4.1.5.3 Develop/Build Production Representative Article TPSs

UUT Test Requirements Documents (TRDs)

4.1.5.4 Environmental Testing for UUT TPS Hardware

4.1.5.5 Reliability Testing For Increment 1 UUT TPSs

4.1.5.6 Test Readiness Review (TRR)

TPS Fault Detection/Fault Isolation (FD/FI)

4.1.5.7 Integrated TPS Configuration Item (CI) Developmental Testing & Evaluation

(DT&E)

TPS Final Integration Acceptance Test (FIAT)

4.1.5.8 Integrated System DT&E

4.1.6 Operational Test Readiness Review (OTRR)

4.1.7 Operational Test and Evaluation (OT&E) Support

4.1.8 Physical Configuration Audit (PCA)

4.1.9 BAT Core Tester Test Requirements Documents (TRDs)

4.1.10 Production Readiness Review (PRR)

4.2 PRODUCTION

4.2.1 BAT Core Tester Production for B-2A

4.2.2 BAT Core Tester Production Acceptance Procedures and Reports

4.2.3 B-2A TPS Production

4.2.4 Warranty

5.0 INCREMENT 2

5.1 EMD

5.1.1 PDR

5.1.2 CDR

5.1.3 SVR

5.1.3.1 Develop/Build Production Representative Article UUT TPSs

UUT Test Requirements Documents (TRDs)

5.1.3.2 Environmental Testing For UUT TPS Hardware

5.1.3.3 Reliability Testing For Increment 2 UUT TPSs

5.1.3.4 Cybersecurity Testing For Increment 2 TPSs

5.1.3.5 Test Readiness Review (TRR)

5.1.3.6 TPS Fault Detection/Fault Isolation (FD/FI)

5.1.3.7 Integrated TPS Configuration Item (CI) and Integrated System Developmental

Testing & Evaluation (DT&E) TPS Final Integration Acceptance Test (FIAT)/Integrated System DT&E

5.1.4 Operational Test Readiness Review (OTRR)

5.1.5 Operational Test and Evaluation (OT&E) Support

5.1.6 Physical Configuration Audit (PCA)

5.1.7 Production Readiness Review (PRR)

5.2 PRODUCTION

5.2.1 BAT Core Tester Production for B-1B

5.2.2 BAT Core Tester Production Acceptance Procedures and Reports

5.2.3 B-1B TPS Production

5.2.4 Warranty

6.0 INCREMENT 3

6.1 EMD

6.1.1 PDR

6.1.2 CDR

6.1.3 SVR

6.1.3.1 Develop/Build Production Representative Article UUT TPSs

6.1.3.1.1 UUT Test Requirements Documents (TRDs)

6.1.3.2 Environmental Testing For UUT TPS Hardware

6.1.3.3 Reliability Testing For Increment 3 UUT TPSs

6.1.3.4 Cybersecurity Testing For Increment 3 TPSs

6.1.3.5 Test Readiness Review (TRR)

6.1.3.6 TPS Fault Detection/Fault Isolation (FD/FI)

6.1.3.7 Integrated TPS Configuration Item (CI) and Integrated System Developmental

Testing & Evaluation (DT&E) TPS Final Integration Acceptance Test (FIAT)/Integrated System DT&E

6.1.4 Operational Test Readiness Review (OTRR)

6.1.5 Operational Test and Evaluation (OT&E) Support

6.1.6 Physical Configuration Audit (PCA)

6.1.7 Production Readiness Review (PRR)

6.2 PRODUCTION

6.2.1 BAT Core Tester Production for B-52H

6.2.2 BAT Core Tester Production Acceptance Procedures and Reports

6.2.3 B-52H TPS Production

6.2.4 Warranty

7.0 ICS MANAGEMENT

7.1 INTERIM CONTRACTOR SUPPORT (ICS)

8.0 OVER AND ABOVE

8.1 OVER AND ABOVE (O&A)

APPENDIX A: UUT AND TESTER LIST

APPENDIX B: APPLICABLE DOCUMENTS

B.1 GOVERNMENT DOCUMENTS

B.1.1 Specifications, standards, and handbooks B.1.1.1 Military Standards B.1.1.2 Military Handbooks B.1.2 Other Government documents, drawings, and publications

B.2 OTHER DOCUMENTS

APPENDIX C: CDRL CROSS REFERENCE

APPENDIX D: USER LOCATIONS

1.0 SCOPE

1.1 Program Synopsis

This Statement of Work (SOW) defines the tasks and deliverables for the procurement and sustainment of the Bomber Armament Tester (BAT) and associated Unit Under Test (UUT) Test Program Sets (TPSs), as described by the BAT System Performance Specification and all program data as documented and defined in support of this acquisition.

The purpose of the effort is to design, develop, integrate, test, manufacture, and sustain a common core tester for the armament systems on the B-2A, B-1B, and B-52H platforms, capable of testing on-aircraft Stores Management Systems, and capable of testing Line Replaceable Units (LRUs) both on-and off-aircraft. The BAT core tester shall be common to all three platforms, while TPSs shall be platform-specific. Aircraft-unique test requirements are provided in Section

3.4 (and sub-paragraphs) of the BAT System Performance Specification. A list of the applicable B-2A, B-1B, and B-52H UUTs is provided in Appendix A.

The “BAT System” is hereby defined as consisting of the core tester and supporting UUT TPSs required to support respective B-2A, B-1B, or B-52H weapon systems. The “Core Tester” includes hardware, operating system software, firmware, test executive software, power-on confidence test TPS, user-selectable self-test TPS, and a calibration TPS. A UUT TPS includes all cables, Interface Test Adapters (ITAs), software, and technical documentation needed to test a

UUT.

1.2 Overview of BAT Program

The BAT Program follows an incremental approach. Each increment includes Engineering and Manufacturing Development (EMD), followed by Production and Interim Contract Support (ICS). The three increments are Increment 1 for B-2A, Increment 2 for B-1B, and Increment 3 for B-52H.

1.2.1 Increment 1

Increment 1 shall include an initial EMD effort for requirements analysis, design, development, integration, and test of production representative articles of the BAT Core Tester (common to all platforms), all B-2A TPSs, the SUU-67 Pylon Wing Disconnects TPS for B-52H, and the Multi- Purpose Rotary Launcher (MPRL) TPS for B-1B. One of the BAT Core Tester production representative articles will be used for Red Team testing defined in Paragraph 4.1.5.2.4. EMD is followed by production of BAT Core Testers and TPSs to support the B-2A mission, and ICS to provide sustainment.

1.2.2 Increment 2

Increment 2 EMD covers TPS design, development, integration, and test for the remaining B-1B TPSs. This will include the integrated system testing of the MPRL TPS described in Paragraph

1.2.1. Increment 2 EMD is followed by production of BAT testers and TPSs to support the B-1B mission, and ICS to provide sustainment.

1.2.3 Increment 3

Increment 3 covers TPS design, development, integration, and test for the remaining B-52H TPSs. This will include the integrated system testing of the SUU-67 Pylon Wing Disconnects TPS described in Paragraph 1.2.1. Increment 3 EMD is followed by production of BAT testers and TPSs to support the B-52H mission, and ICS to provide sustainment.

1.2.4 Government Data Rights

All hardware, software, firmware, development environments, and technical data items delivered under this contract that are not Commercial Off the Shelf (COTS) shall be delivered with Government Purpose Rights, at a minimum, for the BAT System to be maintained, sustained, modified, re-used, or re-procured competitively at the discretion of the Government after the contract is concluded. This includes the rights to use, modify, reproduce, release, perform, display, or disclose technical data within the Government without restriction and to release or disclose technical data outside the Government and authorize persons to whom release or disclosure has been made to use, modify, reproduce, release, perform, display, or disclose that data for United States Government purposes.

All software executables and source code developed by the contractor for the BAT System shall be property of the Government for unlimited use. This includes BAT Core Tester software, TPS, and qualification software. BAT Core Tester software is defined as the operating system software, firmware, power-on confidence test software, self-test software, calibration software, test executive software, system recovery and/or security software required to meet cybersecurity requirements. The deliverables shall be addressed by Contract Data Requirements Lists (CDRLs).

All COTS hardware shall be delivered with Unlimited Rights to form, fit, function, interface, and maintenance data. COTS hardware data other than form, fit, function, interface, and maintenance data, shall be delivered in accordance with the respective license.

Freeware shall not be used in the design, development, or production of the BAT System, and shall not be incorporated into any of the software deliverables of the BAT System. Freeware is defined as free software which is copyrighted by its developer, who retains the rights to control its distribution, modify it and sell it in the future.

For any and all commercial software used on the BAT System that requires a license, the license “key” shall not be hardware based (i.e. USB-based dongle key). The ability to utilize any and all commercial software shall not require any additional hardware to verify possession of appropriate and corresponding license(s), nor require any recurring license fees for continued use of and reinstallation of the existing software configuration. All licenses shall be “royalty-free,” worldwide, irrevocable and non-exclusive.

The Contractor shall (and shall cause subcontractors and vendors to) not mark briefings, reports, drawings, technical data, non-commercial computer software and non-commercial computer software documentation, or other types of data, to include contract deliverables, with trade secret markings, proprietary markings, or any other markings that would violate DFARS 252.227- 7013(f), DFARS 252.227-7014(f), or DFARS 227.7103-9. Deliveries of data, documentation, computer software and computer software documentation with restrictive markings prohibited by this SOW will be rejected on delivery, and the delivery will be counted as not occurring.

2.0 APPLICABLE DOCUMENTS

See Appendix B.

3.0 GENERAL REQUIREMENTS

With the exception of Paragraphs 3.1 and 3.9.5 and their subparagraphs, all subparagraphs of 3.0 General Requirements apply to all Increments.

3.1 Program Conferences

3.1.1 Post-Award Conference (PAC)

The Contractor shall attend a PAC that shall be conducted no later than 45 calendar days after contract award. The conference shall be held at Robins AFB, GA or at the Contractor’s facility, at the discretion of the Government Contracting Officer. The Government Contracting Officer will conduct this meeting to review in detail all terms and conditions of the contract with the Contractor’s program team. Any technical issues that may need to be addressed can be highlighted at this event; however, such issues shall be expressly discussed in the Guidance Conferences governing Engineering Data, Technical Orders, and Provisioning, as defined further within this SOW.

(A001, DI-ADMN-81249A, Conference Agenda) (A002, DI-ADMN-81250A, Conference Minutes)

3.1.2 Engineering Data Guidance Conference

The Contractor shall support and co-chair a Government led Engineering Data Guidance Conference with AFLCMC/LZPEM, the Engineering Data Management Office, no later than 45 calendar days after contract award to be held at Robins AFB, GA.

3.1.3 Technical Order (TO) Guidance Conference

The Contractor shall support and co-chair a Government led TO Guidance Conference that shall be conducted no later than 45 calendar days after contract award. The conference shall be held at Robins AFB, GA. The conference shall be convened on a date agreed upon by the Government and the Contractor. The Contractor shall prepare an agenda and record the minutes of the Guidance Conference.

3.1.4 Provisioning Guidance Conference

The Contractor shall participate in a Provisioning Guidance Conference, initiated by the Government, which shall be conducted no later than 45 calendar days of contract award. The conference shall be held at Robins AFB, GA.

3.2 General Technical Requirements

3.2.1 General Design Requirements

The BAT System shall meet all requirements of the BAT System Performance Specification and this SOW. This includes the requirements in the System/Subsystem Specification and the UUT Test Requirements Analysis Report to be developed by the Contractor and approved by the Government IAW SOW Paragraph 4.1.1.

The Contractor shall develop a System Engineering Management Plan (SEMP) that contains the Contractor's approach to implementing this SOW’s provisions. The SEMP is the top-level technical document governing the implementation of basic system engineering activities.

Directives in this plan relate to the engineering management of all program activity.

(B002, DI-SESS-81785A, System Engineering Management Plan [SEMP])

3.2.2 Technical Approach

The Modular Open System Architecture approach described in the BAT System Performance Specification shall be utilized.

3.2.3 TPS General Design Requirements

Each TPS shall be independent and completely documented for stand-alone operation. The Contractor may recommend for a TPS to cover more than one UUT where advantageous to and approved by the Government.

ITAs shall be designed to be "passive" to the maximum extent practicable, in accordance with the BAT System Performance Specification. Government approval is required for the development of electronically active ITAs. Any active ITA candidates shall be identified in writing by the Contractor for approval no later than Preliminary Design Review (PDR), and Government approval shall be established prior to Critical Design Review (CDR).

To ensure standardization of all TPSs that will be executed on the BAT, the Contractor shall develop and utilize a TPS Style Guide for TPS Development.

(B00K, DI-IPSC-81633/T, Software Programmer’s Manual (Test Program Set Style Guide and

Application Program Interface))

3.2.4 BAT System Software Requirements

The BAT System software components include operating system software, firmware, power-on confidence test software, self-test software, calibration software, test executive software, and TPS software. The operating system software includes any system recovery and/or security software required to meet cybersecurity requirements. UTT TPS software is delivered separately and is not part of the BAT Core Tester configuration.

The Contractor shall utilize its overall systems engineering process to design, develop, and test the BAT System software. All BAT System software components, including each UUT TPS software package, shall be managed as separate Computer Software Configuration Items (CSCIs). Each CSCI and related documentation shall be identified with a Computer Program Identification Number (CPIN) that is distinct and separate from any other BAT software component.

The Contractor shall document via a Firmware Support Manual, any and all firmware that is used as a part of BAT. This applies to read only memories (ROMs), Programmable ROMs (PROMs), Erasable PROMs (EPROMs), and any other firmware devices (i.e. Electrically-Erasable Programmable Read-Only Memories [EEPROMs], Field-Programmable Gate Arrays [FPGAs], etc.).

(B00H, DI-IPSC-81448B, Firmware Support Manual)

3.2.4.1 Software Requirements Specification (SRS)

The Contractor shall develop and deliver a SRS for each CSCI of the BAT System software.

(B00G, DI-IPSC-81433A, Software Requirements Specification [SRS])

3.2.4.2 Software Product Specification (SPS)

The Contractor shall develop and deliver a SPS for each CSCI of the BAT System software.

(B00E, DI-IPSC-81441A, Software Product Specification)

3.2.4.3 Software Version Description (SVD)

The Contractor shall develop and deliver a SVD for each component CSCI of the BAT System software. The SVD shall include complete installation and checklists for all software used in, on, or in support of the BAT System or UUT TPSs. The Contractor shall ensure that all software installed is identified and the installation instructions and procedures are documented. The SVD shall include the Software Installation Procedures, Drive Imaging Procedures and the Drive Imaging Restoration Procedures.

(B00F, DI-IPSC-81442A, Software Version Description)

3.2.4.4 Computer Software Product – Software Delivery

The Contractor shall develop and deliver CD-ROM media containing software executable files and source code files for each BAT Core Tester and UUT TPS CSCI in accordance with the listed CDRL.

(B00J, DI-IPSC-81488, Computer Software Product)

3.2.4.5 Automated Computer Program Identification Number System (ACPINS) Data and Control Record The Contractor shall submit a request for CPIN assignment for each BAT Core Tester and UUT TPS CSCI, and any other software configuration entity to be delivered to the Government to support the BAT testing of the UUTs in Appendix A. CPIN assignment requests shall be accomplished by direct on-line data entry into ACPINS. The CPIN media label information shall match the information in ACPINS. Access to ACPINS is detailed in Technical Order 00-5- 16, Software Managers and Users’ Manual for the USAF Automated Computer Program Identification Number System (ACPINS).

(C004, DI-MISC-81454C/T, Automated Computer Program Identification Number Data and Control Record)

3.2.4.6 Development Environments

The Contractor shall develop and “ship in place” development environment(s) to be used for, as applicable, TPS development, Core Tester software development, firmware development, and firmware programming equipment. Additionally, for each development environment, the Contractor shall provide all supporting documentation to install, maintain, and operate the development environment. The development environment, delivered separately, is a standalone item, never to be installed on a fielded BAT Core Tester. The Contractor shall deliver two (2) quantities of each software development environment used to support the BAT Core Tester and six (6) quantities of each development environment used to support TPS development and maintenance. These development environments shall be delivered to the Government at conclusion of contract. All development environment shipping instructions shall be provided by the Government sixty (60) days prior to shipment. All development environments shall be treated as Contractor Acquired Property (CAP) IAW Paragraph 3.9.1.2.

3.3 Nuclear Certification

Nuclear certification for the BAT Core Tester and applicable nuclear platform TPSs shall be in accordance with AFI 63-125, Nuclear Certification Program.

3.3.1 Nuclear Certification Impact Statement (NCIS)

The Contractor shall develop and deliver a Detailed NCIS, in accordance with DI-NUOR- 81888A. The Detailed NCIS shall be delivered 45 calendar days prior to CDR for the BAT Core Tester and nuclear platform TPSs. The BAT Core Tester and TPS designs should be stabilized to prevent resubmittal of the NCIS due to significant architectural or component changes.

Updates to the detailed NCIS shall be developed and delivered as required and requested by the Government in order for the Government to develop a Basic Certification Requirements Plan (CRP). An NCIS shall also be generated for all Class I ECP, Class II ECP, and Request for Variance to the approved baseline unless waived by the Government.

(B012, DI-NUOR-81888A, Nuclear Certification Impact Statement [NCIS])

3.3.2 Certification Requirements Plan (CRP)

A Basic CRP will be provided by the Government within 60 calendar days after the NCIS is approved. The Contractor shall develop and deliver a Full CRP, in accordance with DI-NUOR- 81409A.

(B011, DI-NUOR-81409A, Certification Requirements Plan [CRP])

3.3.3 Nuclear Safety Analysis Report (NSAR)

The Contractor shall develop and deliver an NSAR for review and approval by the Government.

The NSAR shall document how the BAT System meets the nuclear safety design certification requirements for test equipment mandated in AFI 91-107, Design, Evaluation, Troubleshooting, and Maintenance Criteria for Nuclear Weapon Systems; AFMAN 91-118, Safety Design and Evaluation Criteria for Nuclear Weapon Systems; and AFMAN 91-119, Safety Design and Evaluation Criteria for Nuclear Weapon Systems Software.

(B010, DI-NUOR-81405B/T, Nuclear Safety Analysis Report)

3.4 Reliability

The Contractor shall develop a reliability strategy and program plan which describes and documents how the Contractor satisfies the reliability requirements of the BAT System Performance Specification and SOW; specifically how the Contractor will achieve the 1500 hour Mean Time Between Failure (MTBF) requirement prior to Test Readiness Review (TRR). The reliability program shall be an integral part of the systems engineering process and shall address:

a) Defining the reliability strategy and program, system-wide design decisions affecting reliability, reliability growth planning and tracking with growth curves, Built-In-Test (BIT) verification, and compliance with MIL-HDBK-189C.

b) Failure Modes Effects and Criticality Analysis (FMECA).

c) Failure Reporting and Corrective Action System (FRACAS).

d) Reliability verification to meet the MTBF requirement prior to TRR.

e) Design verification testing of safety critical failure modes.

f) Utilizing reliability prediction and modeling during planning, design and development to assess the design and identify risk.

(B009, DI-SESS-81613A, Reliability and Maintainability Program Plan)

(B008, DI-SESS-81497A, Reliability and Maintainability Predictions Report) (B00P, DI-TMSS-81586A, Reliability Test Report)

3.5 Program Protection

Program protection for the BAT System is required by Air Force Pamphlet 63-113, Program Protection Planning for Lifecycle Management; DoD Instruction 5200.39, Change 1, Critical Program Information (CPI) Protection Within the Department of Defense; and DoD Instruction 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and Networks.

3.5.1 Program Protection Implementation Plan (PPIP)

The Government will provide a Program Protection Plan (PPP) in draft version at Contract Award. This PPP will contain all known and defined Government identified CPI elements of the program. As the Contractor develops the BAT System design, the Contractor shall identify to the Government any additional CPI developed and not previously identified in the PPP. The Contractor shall develop a PPIP which shall outline and define the Contractor’s implementation of the Government-developed PPP. The PPIP shall provide identification of a program protection point of contact, identification of program protection schedule events, identification of measures being taken to protect CPI and identification of unique program protection costs.

Within the PPIP, the Contractor shall also address the following software assurance measures:

a) How software shall be designed and tested to assure protection of critical functionality.

b) How software architectures, environments, designs, and code shall be evaluated with respect to CVE (Common Vulnerabilities and Exposures), CAPEC (Common Attack Pattern Enumeration and Classification), and CWE (Common Weakness Enumeration).

c) How Commercial Off-the-Shelf (COTS) software and software of unknown pedigree (i.e., software from sources buried in the supply chain) shall be protected and tested/vetted.

d) How the critical functions shall be protected in the operational system.

(B001, DI-ADMN-81306, Program Protection Implementation Plan [PPIP])

3.5.2 Inspection and Audit

The Contractor shall support Government-led inspections and audits of cybersecurity and program protection areas of concern in all Contractor and subcontractor facilities as needed to ensure compliance with SOW Paragraph 3.5.3.5 and the PPP. The Contractor shall report to the Government Program Manager and Government Contracting Officer all incidents of computer malware or viruses that occur in Contractor facilities within 24 hours via email and telephone.

3.5.3 Cybersecurity

The Contractor shall implement cybersecurity for the BAT System in accordance with DoDI

8500.01 and DoDI 8510.01. Within DoDI 8510.01, cybersecurity is defined as the “Prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation.”

The Contractor shall identify, manage, and verify adherence to cybersecurity requirements in the same manner as all other system requirements. The Contractor shall identify security critical requirements and identify and establish corresponding process controls for those security critical requirements. The Contractor shall ensure and document bi-directional traceability between security controls and requirements in the Architecture Analysis Report CDRL.

All BAT System software, TPSs, and firmware created, delivered, and installed shall utilize non-repudiation techniques to guarantee the integrity and origin of the system software, TPSs and firmware throughout the entire system software, TPSs and firmware lifecycle.

The Contractor shall prepare a system level architecture report describing the Platform Information Technology (PIT) boundary, interconnections and data transfers in accordance with the Architecture Analysis Report Template.

(B016, DI-MISC-80508B/T, Technical Report Study/Services [Architecture Analysis Report])

3.5.3.1 Cybersecurity Controls

The Contractor shall identify and implement the applicable cybersecurity controls from Committee on National Security Systems Instruction (CNSSI) No. 1253 for the BAT System.

The implemented controls shall be documented and submitted in a Cybersecurity Controls report due as a draft at the System Requirements Review (SRR), with an updated version due at the PDR, and final version due at the CDR, with updates to the final as required.

(B014, DI-MISC-80508B/T, Technical Report Study/Services [Cybersecurity Controls Report])

3.5.3.2 System Security Plan (SSP)

The Contractor shall develop, deliver and update a SSP for review by the Government in accordance with the CDRL.

(B013, DI-MISC-80508B/T, Technical Report Study/Services (System Security Plan))

3.5.3.3 Cybersecurity Risk Management

The Contractor shall ensure that cybersecurity risks are identified and managed as a performance risk, as well as part of the overall program risk management process (consisting of cost/schedule/ performance risks). The status of cybersecurity risk management activities for the BAT program shall be reported each month in the monthly Status Report. The Contractor shall ensure that the cybersecurity risk management activity reexamines threats, exposure, and vulnerabilities, and assesses changes to all system architecture and design changes. The Contractor shall, as appropriate, recommend changes to cybersecurity controls for the system as part of all Systems Engineering Technical Reviews (SETRs).

The Contractor shall integrate Testing and Evaluation (T&E) of cybersecurity requirements into the overall T&E process, to include component-level testing performed by suppliers. Testing shall be integrated throughout the development and test of the BAT System.

The Contractor shall include cybersecurity risk management framework activities and events on the Integrated Master Schedule.

The Contractor shall ensure that familiarization materials, technical manuals, and other technical data developed for the program address any cybersecurity controls (e.g., administrative, procedural, inherited) or requirements that affect system operation, maintenance, repair, or other support activities.

The Contractor shall conduct analysis for any COTS and/or non-developmental items to ensure that they are appropriately configured, software/hardware/firmware is controlled, and any unique risks they pose are mitigated.

3.5.3.4 Authorizations and System Level Plan of Action and Milestones (POA&M) The Contractor shall support the Government in obtaining Interim Authorizations to Test (IATTs) and Authorizations To Operate (ATOs). The Contractor shall develop and maintain a milestone-based management plan to address all non-compliant cybersecurity requirements and vulnerabilities identified during the security control assessment.

(B017, DI-MISC-80508B/T, Technical Report-Study/Services [POA&M])

3.5.3.5 Cyber-Secure Development Environment

The Contractor shall maintain a cyber-secure development environment that reduces and manages risk by implementing, at minimum, the following select controls from CNSSI 1253 as defined in NIST SP 800-53r4: SA-10, SA-15, and AT-2.

3.5.4 Anti-Tamper (AT)

If CPI is identified at any time during this contract, a Technical Interchange Meeting (TIM) will be held to obtain Government approval of the CPI and, if applicable, determine AT requirements. The Contractor shall implement the Government approved AT requirements.

Verification and Validation (V&V) of the AT requirements shall occur during System DT&E.

The Contractor shall develop an AT Plan Annex to the PPIP, in accordance with the PPP AT Plan Annex Template. An initial AT Plan shall be delivered as an appendix included within the SRR version of the PPIP, while the final AT Plan shall be delivered as an appendix included within the CDR version of the PPIP. The final AT Plan shall incorporate an AT V&V plan.

3.5.5 Counterfeit Prevention

The Contractor shall establish policies and procedures to avoid, detect, mitigate and disposition counterfeit electronic parts to prevent such parts from entering the USAF/DoD supply chain.

The Contractor shall use Aerospace Standard (AS) 5553, Aerospace Standard, Fraudulent/Counterfeit Electronics Parts; Avoidance, Detection, Mitigation, and Disposition, as guidance. The contractor shall develop and implement a Counterfeit Prevention Plan (CPP) to describe how they will prevent procurement of counterfeit materials and parts, including mechanical piece/parts and electronics components procured for sustainment of those systems and assemblies. Counterfeit material is defined in DoDI 4140.67, DoD Counterfeit Prevention Policy. The contractor shall include in the plan a description of their processes for reviewing and approving supplier and subcontractor systems for the detection and avoidance of counterfeit electronic parts. The contractor shall also describe how they will flow down such requirements and processes to their subcontractors.

In accordance with DFARS 246.870(b)(5) and 252.246-7007(c)(5), the Contractor shall obtain parts directly from original equipment manufacturers (OEMs), original component manufacturers (OCMs), and authorized distributors, and provide rationale for any exceptions for parts not received from an OEM, OCM, or authorized distributor. The contractor shall utilize a Defense Microelectronics Activity (DMEA) or NSA-approved trusted foundry for acquisition or development of any complex information and communications technology (ICT) components (e.g., application-specific integrated circuits {ASICS}).

The Contractor shall conduct supply chain risk assessments of all vendors/sources-of-supply to determine the potential for obtaining counterfeit parts from these sources. The Contractor shall place supply chain risk analyses conducted to inform their own technical decisions, along with a vendor source list, on the Data Accession List (DAL). The Contractor shall establish testing and verification requirements for items not received from an OEM, OCM, or authorized distributor, based on the items’ identified risk for counterfeit potential. Submittal of Certificates of Conformance to the Government indicating that the parts are not counterfeit shall be acceptable for verification of testing.

The contractor shall notify the Government within 60 days of determining that any end item, component, part, or material contained in supplies purchased for the program contains counterfeit electronic parts or suspect counterfeit electronic parts. Within the same period, the Contractor shall ensure that all suspected or confirmed counterfeit items are entered into the Government-Industry Data Exchange Program (GIDEP) system, which will serve as the DoD central reporting repository. The Contractor shall ensure that no information that would identify the intended end use of the system is communicated to suppliers or made public with respect to any anti-tamper, security, and cybersecurity-related parts and products obtained for this project.

The contractor shall integrate supply chain risk management into their configuration management process. The Contractor shall report to the Government any case where configuration control of systems, assemblies, subassemblies and parts, and mechanisms in their own supply chain is not sufficient to allow traceability of parts to an OEM, OCM, or authorized distributor. In these cases, the Contractor shall either find alternative sources or use expanded acceptance testing processes and methods.

(B00X, DI-MISC-81832, Counterfeit Prevention Plan) (B00Y, DI-QCIC-80125B/T, Government Industry Data Exchange Program [GIDEP]

Alert/Safe-Alert Report) (B00Z, DI-QCIC-80126B/T, Government Industry Data Exchange Program [GIDEP]

Alert/Safe-Alert Response)

3.6 Safety

The Contractor shall implement a System Safety Program Plan and shall comply with practices established in MIL-STD-882E for conducting system safety.

(B00T, DI-SAFT-81626, System Safety Program Plan)

3.6.1 Hazard Analysis and Risk Mitigation

The Contractor shall perform all analyses necessary to identify hazardous conditions and develop strategies for eliminating or mitigating the associated risks in accordance with MIL-STD-882E.

These shall be documented in a System Safety Hazard Analysis Report and a Safety Assessment Report.

(B00R, DI-SAFT-80101C, System Safety Hazard Analysis Report) (B00S, DI-SAFT-80102C, Safety Assessment Report)

3.6.2 Environmental, Safety, and Occupational Health (ESOH)

The Contractor shall comply with all applicable ESOH laws and regulations. The Contractor shall identify ESOH hazards, evaluate the potential ESOH risks, and propose hazard controls and solutions to mitigate or eliminate risks. When a hazard cannot be eliminated, the associated risk shall be reduced to the lowest acceptable level per MIL-STD-882E. The Contractor shall implement a hazard tracking system based on MIL-STD-882E. The Contractor shall provide ESOH assessments and data requirements (such as system-related data and characterizations needed to support Hazardous Materials [HAZMAT], usage authorizations/waivers if needed, and data to support National Environmental Policy Act compliance) in a Hazardous Materials Management Program (HMMP) Plan.

(B00Q, DI-MGMT-81398C, Hazardous Materials Management Program [HMMP] Plan)

3.7 Systems Engineering Technical Reviews (SETRs)

The Contractor shall conduct SETRs during EMD to determine and ensure that the BAT System design has demonstrated sufficient maturity to proceed further into development, and to ensure the adequacy of ongoing activities relative to System Engineering, Program Protection, Program Management, Nuclear Certification, System Safety, Logistics, Test, and Configuration Management. System-level reviews address the BAT Core Tester and all TPSs. The Contractor shall strive to conduct all system-level reviews as a single event. With Government approval, or upon Government request, system-level reviews may be broken down into discrete events occurring at separately scheduled times. In the instance where multiple reviews are required for a system-level review, that particular system-level review shall not be considered complete until all discrete reviews are completed. The System Requirements Review (SRR) and Operational Test Readiness Review (OTRR) shall be held at Robins AFB, GA and all other reviews shall be held at the Contractor’s facility. SETRs required include:

a) System Requirements Review (SRR): System-level review (Increment 1 only)

b) System Functional Review (SFR): System-level review (Increment 1 only)

c) Preliminary Design Review (PDR): Separate reviews for BAT Core Tester and TPSs

d) Critical Design Review (CDR): Separate reviews for BAT Core Tester and TPSs

e) Test Readiness Review (TRR): System-level review

f) System Verification Review (SVR): System-level review for SVR and separate reviews for TPSs

g) Operational Test Readiness Review (OTRR): System-level review

h) Physical Configuration Audit (PCA): Separate reviews for BAT Core Tester and TPS

i) Production Readiness Review (PRR): System-level review

All successive SETRs shall be approved through Government Contracting Officer correspondence prior to the Contractor presenting any subsequent technical review. The Government determines successful completion of each successive SETR based on the following:

successful completion of the SETR briefing, high technical confidence in the design, and resolution of all associated action items documented during the review. Each of the SETRs is documented in detail in the sub-paragraphs of Section 4.1 (Increment 1 EMD), Section 5.1 (Increment 2 EMD), and Section 6.1 (Increment 3 EMD).

3.8 Program Manager (PM)

The Contractor shall identify to the Government and maintain a single point of contact (Program Manager) for all matters under this contract. The Contractor shall ensure all efforts on this contract are managed as one (1) integrated, common, standard, seamless, systems engineering and logistics programmatic effort. The Contractor shall provide accurate and real-time program status updates to the Government.

3.8.1 Program Management Activities

The Contractor shall accomplish all PM tasks necessary to execute this effort successfully. The Contractor shall designate a program manager and technical director responsible (who reports to the PM) for managing all Contractor and Subcontractor efforts on the BAT Program. The Contractor shall support the Government acquisition reviews, milestones, and associated documentation required by DoDI 5000.02.

The Contractor shall prepare a monthly status report. This report shall identify the status of all portions of the contract. The monthly status report shall include all events such as reviews, audits, tests, identification, delivery of the contract line items, and status of action items from reviews and meetings.

The Contractor shall track program progress and document in the status report any activity and/or deliverable which will not be achieved as scheduled, citing the cause, contributing factors, impacts, and resolutions to get back on schedule.

(A008, DI-MGMT-80368A, Status Report)

3.8.2 Earned Value Management (EVM)

The Contractor shall utilize its existing internal performance management system to plan, schedule, budget, monitor, manage, and report cost, schedule, and technical status applicable to the contract. The Contractor's system shall be validated in accordance with DFARS 252.234- 7002, the industry guidelines delineated in the ANSI/EIA-748, Earned Value Management System (EVMS), the general provisions of the contract, and this SOW. The duration from contract award to successful completion of review event for CDR, SVR, and PRR for Increment 1 and CDR and PRR for Increments 2 and 3 as part of the Request for Proposal (RFP) response shall be incorporated in the IMS in the Integrated Baseline Review (IBR).

The Contractor shall perform a two-phased IBR:

a) A preliminary review of the IMS and Contractor preparedness shall be completed no later than 1 month after the contract award. The Government and Contractor shall incrementally and collaboratively review IBR artifacts to include, but not be limited to, validating the translation of SOW to Control Account work scope definition; analyzing the IMS, Schedule Health Assessments and Schedule Risk Assessment; mapping of high and moderate risks to affected Control Accounts; etc.

b) The full IBR event shall be completed no later than 2 months after contract award. The Contractor shall also include the Government BAT Program Office as a participant in the prime contractor-led major subcontractor IBR(s).

3.8.2.1 Integrated Program Management Reporting

The Contractor shall report EVM data in the IPMR. The Contractor shall provide a reconciliation of reporting elements in the Contract Funds Status Report (CFSR) with the IPMR, and include as an addendum to the CFSR. Monthly billing vouchers will be available upon customer request. The Contractor shall format the deliverable data for electronic data interchange in accordance with the ANSI X12 Standard or XML equivalent. Subcontracts exceeding $20M in then-year dollars shall apply the requirements of DFARS 252.234-7002. For contracts valued at $50 million or more, the subcontractor must have an EVMS that has been validated in accordance with DFARS 252.234-7002. For contracts valued at or greater than $20 million but less than $50 million, DFARS 252.234-7002 applies. For contracts greater than $20 million but less than $50 million, the Contractor is required to have EVMS that complies with ANSI/EIA-748; however, the Government will not formally validate/accept the Contractor's management system (no formal review). EVMS flow down to contracts of less than $20M in then-year dollars or Firm-Fixed-Price contracts that exceed 12 months duration is a risk-based decision and shall be mutually agreed upon between the Contractor and the Government.

The Contractor shall track program progress and document in the IPMR, the status of all portions of the contract to include all events such as reviews, audits, tests, identification, and delivery of the contract line items. The Contractor shall document any activity and/or deliverable which will not be achieved as scheduled, citing the cause, contributing factors, impacts, and resolutions to get back on schedule.

(A005, DI-MGMT-81861A, Integrated Program Management Report [IPMR]) (A004, DI-MGMT-81468, Contract Fund Status Report [CFSR])

3.8.3 Program Reviews and Conferences

3.8.3.1 Support of Reviews and Meetings

The contractor shall participate in and support all reviews, audits, and meetings as identified in this SOW and/or requested by the Government Contracting Officer. The Contractor shall conduct Program Management Reviews (PMRs) every six (6) months. The PMRs can be conducted concurrently with other reviews. In the event PMRs are not concurrent with other reviews, they shall be conducted at Robins AFB, GA.

3.8.3.2 Meetings (Conferences)

The Contractor shall document all work performed, track the program’s progress, and complete all work related to this effort. Any non-critical administrative and technical issues that arise shall primarily be resolved through phone, e-mail, and/or teleconference, while more critical issues shall be addressed through formal reviews, meetings, and audits. The Contractor shall publish an agenda for all meetings and conferences specified in this SOW. The Contractor shall request from the Government any items or issues to be addressed or presented at the meetings, and shall include such items in the agenda. The Contractor shall provide Conference Minutes of the discussions, decisions, and action items identified at each meeting.

3.8.3.3 Technical Interchange Meetings (TIMs)

The Contractor or the Government may request TIMs to resolve any program issues and concerns during the performance of this contract. These meetings may be by telecom, video-teleconference (VTC), or in-person working sessions whose results and actions shall be documented in TIM minutes. The Contractor shall prepare the minutes, but the party who called the meeting shall prepare the agenda.

3.9 Logistics

3.9.1 Acquired or Furnished Property

3.9.1.1 Government Furnished Property (GFP)

All GFP is listed as an attachment on Section J of the contract and must be requested in writing to the Government Contracting Officer at least sixty (60) calendar days prior to the need date.

The Government will provide a Requisitioned Government Furnished Property (RGFP) list at contract award delineating the GFP available for requisition. Due to critically short asset availability and/or direct mission impact limitations, access to assets not defined on the RGFP list will be provided on a Scheduled Government-Furnished Property (SGFP) list. All items listed on Section J of the contract not deemed RGFP or SGFP will be considered “access available” GFP. Access available GFP must be coordinated through the ATS program office before access is granted at the applicable government installation. The Government will provide personnel to assist the Contractor for the 'access-available GFP'.

If the Contractor requires any GFP outside the items listed on the contract Section J, the Contractor shall make the request to the Government Contracting Officer in writing specifying what the additional GFP assets are no later than sixty (60) calendar days prior to the need date with justification for need. Upon approval and verification for any additionally defined GFP, the Government will determine at that time whether to either physically provide the GFP or to grant access-available to defined GFP assets.

The Contractor shall notify the PM/COR/Government Contracting Officer in the event a GFP asset fails during the period of performance. The Government COR will take appropriate action to replace the failed asset.

The Contractor shall maintain and provide the status of all GFE used in the execution of this contract. The Contractor shall return all GFE/GFP in the same condition in which the Government delivered it to the Contractor prior to the completion of this contract. The Contractor shall be responsible for shipping and handling of returning items.

(A00G, DI-MGMT-80377, Government Furnished Equipment Detail Transaction Status Data)

3.9.1.2 Contractor Acquired Property (CAP)

Equipment, property, data, or software acquired or developed by the contractor, using Government funds, shall become the property of the Government.

3.9.1.3 Government Furnished Property (GFP) and Services

The Contractor shall not alter or repair any Government Furnished Equipment (GFE) without prior Government approval. The Contractor shall be responsible for the repair cost, incurred by the Government, resulting from the contractor’s improper storage or abuse of GFP or GFE.

3.9.1.4 Government Property (GP) and Loss of GP Definition

“Government property” is defined in the clause at FAR 52.245-1, Government Property and “Loss of Government property” means unintended, unforeseen, or accidental loss, damage, or destruction of Government property that reduces the Government’s expected economic benefits of the property. Loss of Government property includes, but is not limited to the following:

1. Items that cannot be found after a…