I.5 SOW MSWP 3.0 SUPER SAP.pdf

JANUARY 2022

PR NO.

STATEMENT OF WORK

(SOW)

Information Management Technology Configuration and Support Services for

Maintenance and Ship Work Planning (M&SWP) v 3.0 for Submarine Maintenance Engineering Planning and Procurement (SUBMEPP)

PR No. TBD

1.0 Background

Maintenance and Ship Work Planning (M&SWP) is the life cycle maintenance planning, scheduling and execution application that manages Intermediate (I) and Depot (D) level maintenance across the Navy Enterprise; Submarines, Carriers and Surface Ships, along with Submarine Trainers, Moored Training Ships (MTS), and other unique platforms.

M&SWP provides the three Navy Maintenance Planning Activities with the ability to prepare, issue, and maintain Work Packages for all D-level and I-Level availabilities. Objective Quality Evidence (OQE) and completions against scheduled maintenance requirements are collected, including completions brought in via an interface with the Navy Material Maintenance Management – Open Architecture Retrieval System application. The Last Maintenance Accomplished date, material condition code and cost data are in the data captured by M&SWP.

Maintenance history captured against component level maintenance requirements is used to determine future scheduling of maintenance requirements and future development of work packages.

M&SWP Version 3.0 is comprised of a suite of configured Commercial Off the Shelf (COTS) software applications. Siemens Teamcenter Product Lifecycle Management software is the main component application software of M&SWP 3.0, with eQ Technologic eQube-BI, eQube-MI, and Microsoft SharePoint software applications supporting.

M&SWP 3.0 is currently production capable but not in production use. Government data buildout and phased transition to production use will take place during the period of performance of this contract. Submarine Maintenance, Engineering, Planning and Procurement (SUBMEPP) requires Information Technology (IT) support services covering a full range of technical, functional and managerial expertise to support the SUBMEPP M&SWP 3.0 application. This program provides for a full range of technical and functional expertise to support the SUBMEPP M&SWP 3.0 Application.

The objective of this contract is to provide technical support for M&SWP 3.0 through the government’s data buildout and phased transition to production use. This includes providing system and database administration support to maintain cybersecurity compliance and M&SWP

3.0 authority to operate (ATO) along with system configuration work to correct deficiencies identified during system adoption.

1.1 Place of Performance:

1.1.1 Government project management and M&SWP 3.0 primary user base is located at Portsmouth Naval Shipyard in Kittery Maine and Norfolk Naval Shipyard in Portsmouth Virginia. M&SWP 3.0 resides in a government hosted datacenter and can be accessed remotely via government provided assets. The work within this contract can be accomplished remotely at vendor’s location including vendor telework. Vendor telework must be in accordance with a government approved vendor telework policy, which documents the requirements and captures OQE that all telework worksites are adequate to secure government provided assets and information including the safeguarding of Unclassified Naval Nuclear Propulsion Information (U-NNPI) information. Work must be performed satisfactorily while meeting contractually acceptable quality standards as if they were at the Government location.

1.1.2 Under no circumstances shall a contractor allow unauthorized personnel access to the government furnished equipment and information. The contractor shall be required to facilitate on-site inspections at the Government’s request.

1.1.3 The Government currently anticipates minimal travel associated with this contract.

Instances where travel may be required would be to participate in collaboration and testing events and is expected not to exceed 20 calendar days over the contracts period of performance.

The number of individuals required to support each travel event is at the discretion of the contractor. All travel costs incurred will be separately priced and executed in accordance with the Federal Acquisition Regulation (FAR) 31.205-46. A copy of this travel request shall be routed to the Contracting Officer Representative (COR). Upon validation of the travel requirement, the COR will forward the travel request to the contractor with COR approval. Any travel not directly related to this requirement, and that has not been validated by the COR, is not chargeable to the Government. Upon return from travel, the contractor shall prepare a Trip Report providing the accomplishments of the travel. Report shall be submitted within 5 business days of return from travel.

1.1.4. Work Schedule and Hours of Operation: The Government’s primary operations are conducted Monday through Friday between the hours of 6:00am Eastern Standard Time (EST) through 4:00pm EST, except Federal holidays. The eleven (11) Federal holidays include New Year’s Day, Martin Luther King Day, President’s Day, Memorial Day, Juneteenth National Independence Day, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving, and Christmas Day. The contractor shall be available for recurring and ad-hoc meetings, collaborative working sessions, and to receive and respond to communications (e.g. email, phone calls, virtual meetings, etc.) during the Government’s primary operational hours.

During certain operations the contractor shall be required to work outside of primary work hours to include but not limited to evenings and weekends. These operations include but are not limited to planned and unplanned service outages, planned and unplanned maintenance, and emergency operations.

1.1.5. Contingency Operations: SUBMEPP may be required to conduct business and operations from an alternate site as a result of severe weather conditions, emergency situations and as required by Continuity of Operation exercises. When required, the Contractors supporting this task order may be required to support the operation from an alternate location. The Government shall support the alternate site locations with Government Furnished Equipment as noted in section 1.1.5 as long as doing so does not conflict with the security requirements of the contract.

1.1.6. Government Furnished Property (GFP) and Government-Furnished Equipment (GFE)

1.1.6.1. The Government shall provide workstations and Government computers to the Contractor’s GFP manager, who will be responsible and accountable for all assets and distribution to contactor’s team. When required, the Government shall authorize resources to operate from alternate site locations. Primary and Alternate locations must meet requirements outlined in the Office of the Chief of Naval Operations Instructions (OPNAVINST) N9210.3, Dated Jun 7, 2010; SAFEGUARDING OF NAVAL NUCLEAR PROPULSION INFORMATION (NNPI). If personal, non-corporate controlled location are used (e.g. a home offices), the contractor must develop policy showing how spaces will be certified and maintained in accordance with (IAW) OPNAVINST N9210.3, and forward to the Government Information Systems Security Manager (ISSM) for review and approval. Additionally, any forms or documentation invoked by said policy must be forwarded to the ISSM for review and approval prior to allowing GFE into the space. The resources to support the alternate site location(s) shall include the minimum equipment required to support the operation, and are the responsibility of the contactor to furnish. The primary office responsible for identifying and issuing GFE shall be Department of Defense (DoD) SUBMEPP.

1.1.6.2. Contactor personnel shall be required to obtain a Common Access Card (CAC) for Navy/Marine Corps Intranet (NMCI) network usage. It is the responsibility of the Contactor to identify their local or nearest CAC issuing facility, and coordinate pick-up as required after government sponsorship.

1.1.6.2.1. Certain contract personnel will be required to obtain an Alt-token for separation of duties requirements. The contractor will coordinate with the Government Program Manager (PM) and Information System Security Manager (ISSM) for issuance of Alt-Tokens. Alt-Tokens and CACs are used for authentication into government systems and shall be secured the same.

Therefore, any and all security measures for CACs referenced throughout this document are required for Alt-Tokens as well.

1.1.6.3. Contactor Personnel may be issued Naval Sea Systems Command (NAVSEA) Badges if it is deemed necessary and regular visitation to the government site is expected. The badge shall be worn at all times on the upper part of the body so as to be clearly visible, and concealed on your person whenever the wearer leaves the Government Participants’ premises for any reason or any length of time.

1.1.6.4. Contactor personnel whose CAC and NAVSEA Badge (if issued) are lost or stolen shall present documentation to the SUBMEPP Office of Security (OSEC) confirming that the identification (ID) is missing and describing the circumstances under which the loss occurred.

Government and Contactor personnel shall not share CACs or passwords with anyone else. The COR shall report any violation or suspected violation to the Acquisition Specialist and SUBMEPP OSEC. Any violators shall be removed temporarily or permanently from the project.

If a Contactor employee has a CAC issued from a previous engagement with another agency that CAC shall be returned to that agency before issuance of a SUBMEPP sponsored CAC.

1.1.6.5. Contactor personnel shall be required to identify and coordinate with a local and nearby NMCI network access point for occasional direct network log-in (specifically for first time Government computer login, and as necessary to retain computer and network access).

1.1.6.6. Laptops shall follow the GFP process:

The GFP provided to the contractor shall include laptops to perform the services needed under this contract. The contractor shall manage GFP in accordance with FAR Part 45 and Defense FAR Supplement (DFARS) Part 245 and associated clauses incorporated in this contract. The contractor shall include a complete list of all GFP within the contractor's Monthly Status Report for verification by the COR and Property Administrator. The list shall include the following information as applicable; Item name, Item Description, National Stock Number, Cage, Part #, Model #, Serial #, Unique Item Identifier, quantity, Unit of Measure, Unit Cost, and indication of Use as Is. It is mandatory that the format be completed to the maximum extent possible.

1.2 Types of Funding:

The funding for this contract is Operation and Maintenance Navy (O&MN).

1.3 Contract Duration:

This contract is a 1 year contract.

2.0 Scope

The Contractor shall provide Program Management and Technical services support by performing the following tasks and completing the required deliverables identified in this SOW.

- Integrated Solutions Management

- Requirements Analysis

- Information and Knowledge Management

- Custom Application Configuration

- Product Integration

- Test and Evaluation (T&E)

- Cyber Security Assessment, Authorization, and Implementation

- Information Communication Technology

- Web Services

- Operations Support

- IT Support Services

3.0 Applicable Documents

3.1 DoD Issuances

3.1.1. DoDI I 8500.1 (latest series) “Cybersecurity”

3.1.2. DODINST 8510.01, (latest series) “Risk Management Framework (RMF) for DoD Information Technology (IT)”

3.1.3. DODD 8140.01, (latest series) “Cyberspace Workforce Management”

3.1.4. DoDM 8400.01-(latest series), “Accessibility of Information and Communications Technology (ICT)”

3.2 Navy Issuances

3.2.1. OPNAVINST 5239.1 (latest series) Navy Information Assurance (IA) Program

3.2.2. SECNAVINST 5239.3 (latest series) Department of The Navy Information Assurance (IA) Policy

3.2.3. SECNAVINST 5510.36 (latest series) Information Security Program. Manual

3.2.4. OPNAVINST N9210.3 (latest series) Safeguarding of Naval Nuclear Propulsion Information (NNPI)

3.3 SUBMEPP Issuances

3.3.1. SUBMEPP Work Procedure 1863-09 – Assessment and Authorization Overview and Support Information of SUBMEPP Systems and Applications

3.4. Industry Standards

3.4.1. FIPS 140-2 - Security Requirements for Cryptographic Modules

4.0 Technical Performance Requirements

4.1 Task 1: The contractor shall provide program management support to execute Task 1 subtask

1. This support is required throughout the entire contract period of performance and is independent from the number of configuration change requests issued.

4.1.1 Subtask 1– Project Management: The contractor shall provide project management support for the IT projects worked under this SOW. The contractor shall ensure project goals and constraints are met, and deliverables are complete. At a minimum the contractor shall be required to perform the following tasks in support of the objective:

4.1.1.1 Supports the operation of this SOW by providing daily oversight of the contracted personnel and providing other similar management responsibilities.

4.1.1.2 Maintains the project schedule, projecting and accounting for task work durations, implementation dates, and assigned personnel, ensuring that target task frequencies are being met.

4.1.1.3 Facilitates weekly project planning meetings with government; meeting should cover work accomplished, qualitative risk assessments, key issues, milestone status, contract funding execution, and the project schedule.

4.1.1.4 Conducts analytical studies and reports project metrics and status to include but not limited to using earned value calculations, cost benefit analysis, performance charts and quantitative risk assessments.

4.1.1.5 Provide a weekly contract execution report documenting current contract funding expenditures, forecasted funding expenditures through end of contract year, work items completed, forecasted work items for the next two week period, project risks, and project risk mitigation activities.

4.2 Task 2: The contractor shall provide system administration support and database administration support to execute Task 2 subtasks 1 and 2. This support is required throughout the entire contract period of performance and is independent from the number of configuration change requests issued.

4.2.1 Subtask 1: Application and Server Setup and Configuration.

4.2.1.1 Provide recommendation on server settings and server service settings to support M&SWP 3.0 application and to support any required upgrades to M&SWP 3.0 application versions.

4.2.1.1.1 Provide recommendations on settings of Operating Systems including but not limited to Windows Server 2012, Windows Server 2016 and Red Hat Enterprise Linux 7 and their replacement versions for implementation by Government or Government Data Center personnel

4.2.1.1.2 Provide recommendations on settings of middleware including web servers, application servers and content management servers to support M&SWP 3.0 applications and development of M&SWP 3.0 applications for implementation by Government or Government Data Center personnel.

4.2.1.1.2.1 Provide support for all current M&SWP 3.0 software or software components.

4.2.1.1.2.2 Provide support for deployment and configuration of future M&SWP 3.0 software and software components.

4.2.1.1.3 Provide recommendation on settings for M&SWP 3.0 Database servers and services including but not limited to Microsoft SQL Server and Oracle for implementation by Government or Government Data Center personnel

4.2.1.1.4 Provide recommendations on upgrading of Operating Systems and middleware supporting M&SWP 3.0.

4.2.1.2 Provide recommendations for the support of M&SWP 3.0 servers and services installed in government approved hosted datacenters (such as Defense Information Systems Agency (DISA), Naval Information Warfare Systems Command (NAVWAR), a Navy approved Cloud environment, and the Portsmouth Naval Shipyard (PNSY) datacenter) while maintaining adherence to datacenter policies.

4.2.2 Subtask 2: Information Assurance and Cyber Security Configuration.

4.2.2.1 Ensure system conforms to the published DISA released STIG requirements as applicable to M&SWP Applications.

4.2.2.1.1 Configure and maintain M&SWP 3.0 Applications to meet current DISA STIG Requirements that are current when the change is implemented.

4.2.2.1.2 Assist hosted data center and government admin staff in meeting DISA STIG requirements when data center policy precludes necessary permissions for direct contractor action to meet STIG requirements.

4.2.2.1.3 Implement STIG changes within forty-five (45) days of a new STIG being released or updated.

4.2.2.1.4 Evaluate all current STIGs to ensure continued compliance with the STIGs as changes are implemented within the system.

4.2.2.2 Review and configure system security complying with guidance, directives, and issuances from the United States Cyber Command (USCYBERCOM), including but not limited to; Communication Tasking Orders (CTOs), Task Order (TASKORD), Operational Orders (OPORD), Information Assurance Vulnerabilities (IAVs) and other security requirements tracked in the Vulnerability Remediation Asset Manager (VRAM) system.

4.2.2.3 Maintain security posture of IT systems by ensuring Navy, DoD, DISA and industry recommended security patches are installed.

4.2.2.3.1 Patch SUBMEPP M&SWP 3.0 IT systems to maintain their security posture.

4.2.2.3.2 Where hosted data center policy excludes permissions to perform patching, the contractor shall assist data center staff and government admins with ensuring that SUBMEPP systems maintain their security posture via patching.

4.2.2.4 Adhere to the National Institute of Standards and Technology (NIST) Risk Management Framework to maintain an Authority to Operate (ATO) for M&SWP.

4.2.2.5 Provide application, database, and system administration support to include but not be limited to;

• Creating application user accounts [Routine]

• Unlocking application user accounts [Routine]

• Modifying user permissions/roles [Routine]

• Identifying errors and performance issues and providing remediation support [Routine]

• Ensuring data is accessible and available from authorized sources and secure from unauthorized sources [Critical]

• Monitor system logs and automated systems daily for Operation Environment system outages and incidents and initiate incident response procedures and take corrective actions as necessary [Critical]

• Perform the manual installation of software, software patches, and security updates to client systems as required by NMCI and project initiatives for all Contractor held government furnished computers [Routine].

• Request, install and maintain DoD certificates on IT systems [Scheduled]

• Create and publish knowledge base articles as required for continued operation through the period of performance [Scheduled]

4.2.2.6 Staff need to be compliant with security, training and CSWF requirements. Execution of subtask 2 will require a combination of system administrator(s) and database administrator(s).

The navy requires separation of duties such that the system administrator cannot also be the database administrator. Specific requirements for system administrator(s) and database administrators(s) are documented in section 5.0.

4.2.2.7 The contractor shall ensure the DoD Architecture Framework (DoDAF) documentation for M&SWP 3.0 is updated and maintained current.

4.3 Task 3: The contractor shall provide Siemens Teamcenter development support tasked in accordance with Task 3 Subtask 1, eQ development support tasked in accordance with Task 3 Subtask 2 and Microsoft SharePoint development support tasked in accordance with Task 3 Subtask 5. The contractor shall be responsible for determining the appropriate split of development support per product type and maintaining an agile developer workforce capable of accommodating both routine development work along with surges in any one development area (i.e. Teamcenter, eQ, or SharePoint).

The contractor shall be provided system configuration changes in response to government issued configuration change requests which will be scoped by the program manager in accordance with Task 3 Subtask 3 and will be completed by the eQ, Microsoft SharePoint, and Siemens Teamcenter developers. The contractor shall be issued 60 work units over the contract period of performance. All work units issued within the first 9 months of the contract shall be required to be completed by the vendor. The contractor shall do their best to complete any work units issued after the first 9 months of the contract, but will not be negatively assessed for any work units not completed that were issued after the first 9 months of the contract.

For all development work accomplished the contractor shall develop and execute a test plan in accordance with Task 3 subtask 4.

The contractor shall develop or update and maintain SUBMEPP training documentation for applications configuration changes or enhanced performed under Task 3 Subtask 1, Task 3 Subtask 2, and Task 3 Subtask 5. Documentation shall be provided to the government for review, comment, and concurrence. The contractor must incorporate government comments prior to submitting documentation for final government approval.

The contractor shall develop, update and maintain the SUBMEPP system documentation identified in the approved SUBMEPP Application Configuration Change Request and performed under Task 3 Subtask 1, Task 3 Subtask 2, and Task 3 Subtask 5. Documentation shall be provided to the government for review, comment, and concurrence. The contractor must incorporate government comments prior to submitting documentation for final government approval.

The contractor shall develop, update, and maintain new and existing SUBMEPP system documentation associated with the application(s) developed or enhanced by the approved SUBMEPP Application Configuration Change Request and performed under Task 3 Subtask 1, Task 3 Subtask 2, and Task 3 Subtask 5.

The contractor shall deliver all signed and compiled code to the Government developed or modified through execution of Task 3 Subtask 1, Task 3 Subtask 2, and Task 3 Subtask 5. This includes but is not limited to compiled “C’ code for Team Center, and compiled Java code for eQ products. All source code developed under this contract shall be delivered to the government free of proprietary markings, and shall be delivered with either government purpose rights, or unlimited rights.

4.3.1 Subtask 1: TeamCenter Development and Configuration

4.3.1.1 Configure the M&SWP 3.0 TeamCenter (including but not limited to: Business Modeler Integrated Development Environment (BMIDE) configuration, TeamCenter Environment Manager (TEM) based updates, run time configuration, handler development and configuration (including C code handlers), data model changes, Workflow development, front end application configuration, TeamCenter application configuration at the server, Rich Access Client (RAC) configuration (including Jar files) and Navy/Marine Corps Intranet (NMCI) software packaging, thin client configuration (including Active workspace)) to meet the design intent and the accepted derived business requirements as defined in the SUBMEPP Application Configuration Change Request.

4.3.1.1.1 All developed code (eg. C++, JAVA) for the government and not part of the core TeamCenter application for release, will be submitted to and reviewed by the government ISSM

4.3..1.1.2 All developed code (eg. C++, JAVA) for the government and not part of the core TeamCenter application for general release will be stored at the government location for configuration control purposes.

4..3.1.2 Support current TeamCenter modules and applications (Including but not limited to:

Service Planner, Service Manager, Service Scheduler, TeamCenter Security Services, TC Business Logic, TeamCenter File Management Services) and the implementation of future TeamCenter modules and applications.

4.3.1.3 Support the current installed version of M&SWP 3.0 TeamCenter or higher versions.

4.3.1.4 Support upgrading of M&SWP 3.0 to a later version of TeamCenter without regression of any M&SWP 3.0 custom configuration or custom functionality. This includes packaging and providing a single click installation method which can be automatically deployed to government NMCI workstations via NMCI remote installation methods when the RAC requires to be updated. Additionally, a single click RAC uninstaller must be provided, such that the RAC may be removed from NMCI workstations via NMCI remote software management methods.

4.3.1.4.1 Deliver and install all M&SWP 3.0 Teamcenter software and configuration packages including signed and compiled code in support of M&SWP 3.0 Teamcenter software and configurations.

4.3.2 Subtask 2: eQ Product Development and Configuration

4.3.2.1 Configure the M&SWP 3.0 eQ-Technologic products (including but not limited to eQube MI, eQube BI TcRA, eQube GMP, eQube TM, M&SWP 3.0 eQube plugin jar’s, M&SWP 3.0 java code and eQube connectors) to other applications. Develop interfaces, reports, eQube Meta- Language Views (MLVs), eQ-MI processes, eQube BI cubes, and eQube scripts) to meet the design intent and the accepted derived business requirements as defined in the SUBMEPP Application Configuration Change Request.

4.3.2.1.1 All developed code (eg. C++, JAVA) for the government and not part of the core TeamCenter application for release, will be submitted to and reviewed by the government ISSM

4.3.2.1.2 All developed code (eg. C++, JAVA) for the government and not part of the core TeamCenter application for general release will be stored at the government location for configuration control purposes.

4.3.2.2 Integrate and configure other eQ-Technologic products or connectors into M&SWP 3.0 or other SUBMEPP applications to include SharePoint.

4.3.2.2.1 Configure eQ-Technologic products to provide system-to-system interfacing between SUBMEPP applications or between maintenance planning activity’s applications.

4.3.2.2.2 Configure eQ-Technologic products to provide ad-hoc, scheduled and canned reports to meet the accepted derived requirements and design intent of the SUBMEPP Application Configuration Change Request.

4.3.2.2.3 Configure eQ-Technologic products to provide repeatable processes for querying, updating, populating or transforming M&SWP 3.0 system data.

4.3.2.2.4 Deliver and install all M&SWP 3.0 eQ software and configuration packages including signed and compiled code in support of M&SWP 3.0 eQ software and configuration

4.3.3 Subtask 3: Configuration Change Request Scoping

4.3.3.1. Develop derived business requirements from higher level requirements identified in SUBMEPP Application Configuration Change Requests for government concurrence and acceptance. Derived requirements will specify what system changes and work is necessary to support the higher level requirement in the SUBMEPP Application Configuration Change Request. Tasking will be provided by configuration change request and accomplished by the available contract resources. Configuration change requests may be and are encouraged to be bundled, worked concurrently, and delivered via a single system update where determined to be practical and efficient.

4.3.3.1.1. The contractor shall receive SUBMEPP Application Configuration Change Requests, setup and support business process exploration and requirement clarification events with government subject-matter experts (SMEs), as necessary. Events may be in person or remote.

4.3.3.1.2. The contractor shall deliver set(s) of derived requirements from the SUBMEPP Application Configuration Change Request for government review and acceptance. If comments are received, the contractor shall address any government comments against derived requirements.

4.3.3.2. The contractor shall identify all IT systems impacted by or required to support the SUBMEPP Application Configuration Change Request and its derived requirements, including but not limited to any software, applications, application components, hardware, networks or network components. For accepted 4.3.3.1 derived business requirements the contractor shall identify each IT system, IT system component or software configuration that needs to be modified that is necessary to support the SUBMEPP Application Configuration Change Request.

This includes but is not limited to any software, applications, application components, hardware, networks or network components that need to be changed to support the 4.3.3.1 derived business requirements.

4.3.3.2.1. For each system and component the contractor shall identify any changes necessary to support Government accepted 4.3.3.1 derived requirements.

4.3.3.2.2. For each change the contractor shall:

4.3.3.2.2.1. Identify if the change can be accomplished Out of the Box (OOTB) by configuring inherent application functionality.

4.3.3.2.2.2. Identify any impacts to system functionality including but not limited to: impact to workflows and dataflows of the system the change resides in, and impacts to system inputs and outputs of other interfacing systems.

4.3.3.2.2.3. Gather, provide, and present required information on application configuration changes for approval to the SUBMEPP configuration control board to support SUBMEPP’s application configuration control process.

4.3.3.2.2.4. The contractor shall design all solutions with Cybersecurity, Information Assurance, System Security, and Security Technical Implementation Guides (STIGs); such that when changes are implemented those requirements are included. For any changes that affect the security posture of the system, the contractor shall obtain approval from the Government Information Systems Security Manager (ISSM).

4.3.3.2.2.5. Identify any updates or changes required to user groups and /roles and associated permissions.

4.3.3.2.3. The contractor shall present findings from 4.3.3.1 and 4.3.3.2 for initial government review and concurrence. The contractor shall address any government comments provided during the review and concurrence process. Government concurrence must be attained prior to any configuration work (Task 3 Subtask 1, Task 3 Subtask 2, and Task 3 Subtask 5).

4.3.3.2.4. Once concurrence is attained, contractor shall update the project schedule and gain government concurrence. The schedule update shall include periods for:

• Work duration

• Development, pre-production, and production environment implementation

• Contractor change and regression testing

• Government change and regression testing

• Defect resolution

4.3.3.3. The contractor shall develop a list of SUBMEPP documentation to be updated, developed, and maintained during the SUBMEPP Application Configuration Change Request based on the proposed design intent of system configuration. This list will be compiled from SUBMEPP’s document library (including but not limited to process tables, derived specification documentation, Department of Defense Architecture Framework (DoDAF), assessment and authorization (A&A) Artifacts) and as indicated in the SUBMEPP Application Configuration Change Request.

4.3.4 Subtask 4: Government Acceptance Testing and Validation

4.3.4.1 The Contractor shall maintain a Test Plan to test all system design and configuration and submit it for government approval.

4.3.4.1.1 The Test Plan shall ensure the complete traceability of each requirement and derived requirement, architecture element, and design specification to provide COTS/Configured functionality within the Application enhanced by or developed by the approved SUBMEPP Application Configuration Change Request.

4.3.4.1.2 The Test Plan shall include provisions for regular Testing Status Reports, a testing specific Project Management Plan, testing specific Project Schedules, and the development and maintenance of Test Cases that include the test steps necessary for a user to verify SUBMEPP Application Configuration Change Request requirements and derived requirements.

4.3.4.1.3 The Test Plan and Testing Project Schedule shall include full system testing including regression testing for functionality already present in the system.

4.3.4.1.4 The Test Plan shall include both contractor and government unit testing, integration testing, technical testing, user acceptance testing (including acceptable results), security and information assurance testing, software installation verification, and operational assessments.

4.3.4.1.5 The Test Plan and Test Project Schedule shall include defect identification and resolution (correct or revise system configuration and functionality).

4.3.4.2 The Contractor shall perform contractor testing (and provide testing documentation) in accordance with its approved Test Plan.

4.3.4.3 The Contractor shall deliver all deliverables in the accepted Test Plan in agreement with the timelines laid out in the Test Plan and Testing Project Schedule.

4.3.4.4 The contractor shall resolve (correct or revise system configuration and functionality) defects identified by government testing in accordance with the accepted Test Plan.

4.3.4 Subtask 5: Microsoft SharePoint Product Development and Configuration

4.3.4.1 Configure the M&SWP 3.0 SharePoint environment to meet the design intent and the accepted derived business requirements as defined in the SUBMEPP Application Configuration Change Request.

4.3.4.1.1 Integrate with current and future versions of TeamCenter and eQ-Technologic products and connectors.

4.3.4.1.2 Configure and maintain SharePoint products to provide data entry and transformation, document management, storage, system-to-system interfacing between SUBMEPP applications and maintenance planning activity’s applications and SharePoint, and reporting and extraction tools, or functionality as defined within the SUBMEPP Application Configuration Change Request.

4.3.4.2 Support current SharePoint environment and the implementation of future versions and applications.

4.3.4.3 Deliver and install all M&SWP 3.0 SharePoint software and configuration packages including signed and compiled code in support of M&SWP 3.0 SharePoint software and configuration

5.0 Personnel

5.1. CSWF Personnel Certification: Contract personnel supporting this effort shall possess and maintain baseline security certifications in accordance with DoD 8140.01 “Cyberspace Workforce Management”, SUBMEPP requirements, and their supporting issuances. Contractor staff shall have all baseline security certifications prior to onboarding. All other certifications including but not limited to computing environment and SUBMEPP required certifications shall be completed within one hundred eighty (180) calendar days. Each member of the CSWF shall have a vendor developed training plan to ensure on time completion of all CSWF training requirements.

5.2. Mandatory Training: In addition to any CSWF training and certification required by DoD Manual 8140.01 and its supporting issuances, all personnel supporting tasks under this contract shall complete training as required by federal, departmental, and SUBMEPP policy. Mandatory training requirements are subject to change at any point during the life of the contract. Contractor Training Requirements:

5.2.1. In accordance with Submarine Maintenance, Engineering, Planning and Procurement Instruction (SUBMEPPINST) 12410.3, Employee Training and Development Manual, the contractor shall complete required mandatory training for onsite and offsite contractor personnel.

5.2.2 Deliverable Product and Schedule: The Contractor shall create and maintain a training and certification program. The Contractor shall create and maintain a matrix detailing the specific training credentials of each employee.

5.2.3. In addition to CSWF, federal, departmental and SUBMEPP training, the contractor shall complete M&SWP 3.0 application specific training or have experience implementing and configuring core M&SWP 3.0 application software.

5.3 Security Requirements

5.3.1 Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic security training and briefings shall be provided by Government security personnel. Failure to comply with security requirements can be cause for removal of access to Government systems and Information, and remediation.

5.3.2 Personnel Security Requirements

3.3.2.1 Personnel Investigations: This effort involves the Contractor having access to Controlled Unclassified Information, and Privileged Information Technology (IT) System access. As such, it is requested, but not required, that the Contractor sponsor background investigations to the maximum practical extent. Where not possible or practical, the Government Participant shall sponsor Contractor investigations for Information and IT systems access. All Contractor personnel background investigations shall be verified by the SUBMEPP Security prior to performance.

5.3.2.2 The Contractor shall perform the following checks below to identify which users (employees or sub-participant employees) of DoD Information Systems (IS) are either privileged users (e.g., system administrators, system architects, or database administrators) or general users (e.g., non-IS associated system users).

5.3.2.2.1 For general users (non-privileged access) of information systems ensure they meet the following: Prior to being granted access to the Non-Classified Internet Protocol Router Network (NIPRNet), Contractor personnel shall minimally have a favorably completed National Agency

Check (NAC) and a Common Access Card (CAC) with Public Key Infrastructure (PKI) Certificates issued.

5.3.2.2.2 Individuals performing work in privileged information system roles (e.g., system administrators, system architects, or database administrators) shall also undergo successful Scope Background Information Tier 5 (T5) with 5-year reviews.

5.3.2.3The Contractor must submit the request for investigation, either directly or through coordination with SUBMEPP Security, as soon as a position offer is tendered to an employee, including all requisite forms (E-QIP or Word Fillable SF 86 and fingerprint cards).

5.3.2.4 Interim IT-I (privileged) or IT-II (general user) access may be granted pending the completion of the Tier 5 (T5) or Tier 3 (T3) background investigation respectively, however that decision and authority is the responsibility of the SUBMEPP Commanding Officer, and interim access is not guaranteed. The NAC portion of the T5 or a previous valid NAC with Local Agency Checks and Credit Check (NACLC), Defense National Agency Check with Inquiries(DNACI), Tier 3 Investigation or Entrance National Security Check (ENTNAC) must be completed and favorably adjudicated before interim IT-I access will be considered. If the employee is not able to obtain an interim IT level approval commensurate with their position and duties within ninety (90) days of being assigned, they will not be eligible to continue work on this contract.

5.3.2.5 Citizenship Requirements: The Contractor is responsible for ensuring that all persons working on the program are U. S. citizens, and furnish evidence such as a birth certificate, naturalization papers, or passport upon Government Request. Industry and sub-Contractor personnel who hold current foreign passports shall not be permitted to work on this program.

Only if there is reliable documentary evidence that the foreign passport has been destroyed, invalidated or surrendered, might an Industry or sub-Contractor employee be permitted to perform on this program as according to Defense Security Service (DSS) requirements (11/20/2009). Each dual citizenship case shall be reviewed on a case by case basis. There is no guarantee that the individual shall be permitted to perform on this program.

5.3.2.6 Security Reporting Requirements: Should the Industry or sub-Contractor receive information regarding an employee which may affect the access of that employee to a SUBMEPP facility, (e.g., knowledge of arrests, felony conviction, misdemeanor conviction, use of or addiction to drugs or chemicals or both, abuse of alcohol, indebtedness, a change in or treatment of mental health, or any behavior, activities, or associations which tend to show that the individual is not reliable or trustworthy) , the Contractor shall advise the SUBMEPP Security immediately

5.3.2.7 Personnel Cybersecurity Workforce Certifications and Credentials

5.3.2.7.1 Contractor personnel who perform cybersecurity and cyberspace work roles must meet and maintain the qualification requirements in accordance with DoDD 8140.01, SECNAV 5329.2, and their supporting issuances. Personnel requiring privileged access to accomplish tasks will have their CSWF baseline certification prior to working on said tasks. Additional CSWF

Operating System/ Computing Environment (OS/CE) requirements will be accomplished with in one hundred eighty (180) calendar days from assignment to SUBMEPP’s CSWF program.

5.3.2.7.2 Qualifications: Due to the nature of services to be provided, it is necessary that personnel be experienced and knowledgeable in the field of network management, software development and cybersecurity. At a minimum, the personnel shall possess the following education and certification and experience requirements:

Additional Baseline Certifications for COMPTIA A+ Certification:

Task/subtask Estimated Labor Category

Baseline Certification Required

Computing Environment

(CE)

Certifications

Minimum Experience Required

Task 1 Subtask 1 Program Manager

N/A N/A N/A

Task 2 Subtask 1 and Task 2 Subtask

2 (IAT-II)

Database Specialist II

COMP/TIA

Sec+ or equivalent

Oracle 19c or greater

3+ yrs

Task 2 Subtask 1 and Task 2 Subtask

2 (IAT-I)

Applications Administrator I

COMP/TIA

A+ or equivalent

0-3 yrs

Task 2 Subtask 1 and Task 2 Subtask

2 (IAT-II)

System Administrator

II

COMP/TIA

Sec+ or equivalent

Installing Teamcenter Fundamentals

(TRCT2430)

3+ yrs

Task 3 Subtask 5

(IAT-II)

SharePoint Administrator

COMP/TIA Sec+ or equivalent

Course 20339- 1A: Planning and Administering SharePoint

3+ yrs

Task 3 Subtask 1 and Task 3 Subtask

2 (IAT-II)

Lead developer

COMP/TIA

Sec+ or equivalent

Business Modeler Administration

(TRCT2455)

[Applicable to Task 3 Subtask 1 only]

Corporate eQ training in eQ- BI and eQ-MI [Applicable to Task 3 Subtask 2 only]

3+ yrs

a. COMPTIA Network+ Certification

b. COMPTIA Security+ Certification

c. System Security Certified Practitioner (SSCP)

d. Certified Information Systems Security (CISSP)

e. Certified Information Security Auditor (CISA)

f. GIAC Security Essentials Certification (GSEC)

g. Security Certified Network Professional (SCNP)

h. Security Certified Network Architect (SCNA)

i. GIAC Security Expert (GSE)

Additional Baseline Certifications for COMPTIA Security+

a. System Security Certified Practitioner (SSCP)

b. Certified Information Systems Security (CISSP)

c. Certified Information Security Auditor (CISA)

d. GIAC Security Essentials Certification (GSEC)

e. Security Certified Network Professional (SCNP)

f. Security Certified Network Architect (SCNA)

g. GIAC Security Expert (GSE)

5.3.3 Information Security requirements.

5.3.3.1 Contractor personnel must comply with local security requirements for entry and exit control for personnel and property at the government facility.

5.3.3.2 Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic security training and briefings shall be provided by Government security personnel. Failure to comply with security requirements can be cause for removal and the contractor shall not be able to provide service on this contract.

5.3.3.3 Sensitive, Proprietary Information and Data

In the course of performing this contract, contractor personnel may obtain certain sensitive, non-public information or data. Such information may be provided by the Navy for the purposes of contract performance. Other such information may be obtained (indirectly or informally) in the course of working in close proximity to Government personnel in the Government workplace.

Sensitive, non-public information includes, without limitation, information relating to the Navy’s research, development, products, trade secrets, know-how, contingency plans, budgeting, customers, finances, procurements (including, but not limited to source selection information), pre-deliberative information, personnel, personally identifiable information, and any other related information without regard for whether such information and/or data would otherwise be deemed secret or routine. Sensitive, non-public information can also include proprietary third party information including but not limited to the research, development, products, trade secrets, and know-how of other contractors. All such information and data shall be deemed to be “sensitive and proprietary,” whether or not designated or marked.

5.3.3.4 Planning, Programming, Budgeting, and Execution (PPBE) Documents and Data

PPBE documents and data as described in DoD Directive 7045.14, “The Planning, Programming, and Budgeting System,” May 22, 1984, Change 1, July 28, 1990 and Deputy Secretary of Defense Memorandum, “Control of Planning, Programming, Budgeting, and Execution (PPBE) Documents and Information,” 27 March 2004) obtained, received, or learned by the Contractor, and its personnel, and subcontractors as a result of performance of this contract shall be deemed to be “sensitive” and “proprietary” whether or not such data is so designated or marked. The Contractor and its personnel and subcontractors who obtain, receive, or learn of PPBE documents and data in the course of performance of this contract shall restrict its access to the minimum number of contractor personnel or subcontractors necessary for performance of this contract. No one who prepares offers, proposal, bids, and/or quotations for Government and/or non-Government procurements shall be provided access to PPBE documents or data. The Contractor shall ensure that each of its personnel and subcontractors who obtains, receives, or gains knowledge of such information and/or data as a result of performance of this contract understands and complies with this “Non-Disclosure and Non-Use of Information and/or Data” provision.

5.3.3.5 Non-Disclosure of Information and data

The Contractor and its personnel and subcontractors shall disclose sensitive and proprietary information and data obtained, received, or learned as a result of performance of this contract only to Contractor personnel directly performing under this contract and to United States DoD personnel to whom disclosure of such sensitive and proprietary information and data is required in performance of this contract. The Contractor and its personnel and subcontractors shall not disclose such information and data to anyone who prepares offers, proposals, bids, /or quotations for Government and/or non-Government procurements. The Contractor and its personnel and subcontractors shall take all steps necessary to prevent disclosure of such sensitive and proprietary information and data except as specifically permitted herein.

5.3.3.6 Non-Use of Information and/or Data

The Contractor and its personnel and subcontractors shall use sensitive and proprietary information and data obtained, received, or learned as a result of performance of this contract, whether in paper or electronic format or received orally, only in direct performance of this contract and for no other purpose. The Contractor and its personnel and subcontractors shall not use or consider such information and data in the preparation of any offer, proposal, bid, or quotation for any Government or non-Government procurement. The Contractor and its personnel and subcontractors shall take all steps necessary to prevent use of such information and data except as specifically permitted herein. Contractor employees shall not disclose such information and data to persons other than United States DoD personnel and to other contractor personnel on a need-to-know basis for performance of the contract, except as otherwise approved by the Contracting Officer in writing, and unless required by court order or applicable law, or unless necessary to conduct a judicial or administrative inquiry.

5.3.3.7 Non-Disclosure and Non-Use Agreements

Before any of the Contractor’s personnel or the personnel of any tier subcontractor becomes involved in performance of this contract, the Contractor shall obtain a non-disclosure and non-use agreement signed by that person. The contractor shall provide written notification to the government that it has collected and retained all Non-Disclosure Agreements (NDAs). The contractor shall inform the government whenever it collects and retains new NDAs. The non-disclosure and non-use agreement shall state that:

He/she shall disclose sensitive and/or proprietary information and data obtained, received, or learned by him/her as a result of performance of this contract only to contractor personnel directly performing under this contract and to United States DoD personnel to whom disclosure of such data is required in performance of this contract.

Contractor and Subcontractor Personnel shall not disclose sensitive and proprietary information and data obtained, received, or learned as a result of performance of this contract to anyone who prepares offers, proposals, bids, or quotations for Government or non-Government procurements.

Contractor and Subcontractor Personnel shall use sensitive and proprietary information and data obtained, received, or learned as a result of performance of this contract only in direct performance of this contract and for no other purpose.

Contractor and Subcontractor Personnel shall not use or consider sensitive and proprietary information and data obtained, received, or learned as a result of performance of this contract in the preparation of any offer, proposal, bid, or quotation for any Government or non-Government procurement.

Any access by contractor personnel or the personnel of any tier subcontractor to the Navy’s Program Budget Information System (PBIS) requires specific authorization.