IDIQ DRAFT Performance Work Statement.docx

DRAFT

Office of Naval Research N00014-26-R-0001 IDIQ Performance Work Statement for ONR STEM Internships, Website, and Outreach Programs

1.0 General Requirements

The mission of the Office of Naval Research (ONR) is to shape the future Naval force, anticipate capability requirements, and to provide the Science and Technology (S&T) foundation needed for our Navy and Marine Corps to maintain a decisive technological advantage. Its vision is to be the preeminent S&T organization, recognized both inside and outside the Department of the Navy (DON), as the place to go with good ideas and innovative concepts. ONR inspires and guides breakthrough innovations and transitions state-of-the-art technology solutions to the Navy and Marine Corps.

ONR is responsible for cross-disciplinary research programs as well as education and career development programs that increase the supply and capabilities of scientists and engineers (S&Es) engaged in activities that improve Navy and Marine Corps capabilities. These programs include Science, Technology, Engineering, and Mathematics (STEM) Communication and Coordination, Outreach, and Internship Opportunities for students to participate in both virtual and onsite research and mentoring with DON S&Es during the summer months, as well as the fall and spring semesters. Additionally, ONR is responsible for DON STEM outreach, coordination, and awareness across the Department of the Navy, Department of Defense (DoD), and public communities.

The goal of these programs is to strengthen our national security by encouraging students to pursue STEM careers, further their education via mentoring by laboratory personnel, and allow participation in DON relevant S&T research, which can lead to employment within the DON.

The following are key STEM internship programs under this IDIQ:

1.1 Science and Engineering Internship Program (SEAP). The goal of SEAP is to provide high school students to participate in internship opportunities with DON scientists and engineers.

1.2 The Naval Research Enterprise Internship Program (NREIP). The goal of NREIP is to provide ungraduated and graduate college and university students to participate in internship opportunities with DON scientists and engineers. Details of NREIP can be found on the ONR website at https://www.onr.navy.mil/education-outreach/undergraduate-graduate/nreip-naval-internship.

1.3 Naval Horizons. The goal of Naval Horizons is to encourage participating students to pursue science, technology, engineering, and mathematics (STEM) careers, to further their education and their participation in research, and to make them aware of DON research and technology efforts.

1.4 Short-Term Internship Program. The goal of the Short-Term Internship Program is to provide participating students with the knowledge, skills and abilities to make them more competitive for NREIP or other Long-Term Internships, and future employment within the DON and naval-related organizations. One such program is the NREIP Fall Engagement (NFE) where a limited number of applicants to NREIP who did not receive an offer can participate in a short-term virtual internship to strengthen their skills for future naval internship opportunities.

1.5 Naval STEM Website. Naval STEM supports the Department of the Navy (DoN)’s Navy and Marine Corps education and outreach programs. Naval STEM programs are deliberate investments in the current and future DoN workforce, which enhances the Navy and Marine Corps’ ability to meet present and future war-fighting challenges. Communicating these programs to all eligible students is essential and the Naval STEM Website is a critical component of this communication to a broader audience. The goal of which is to:

· To inspire, engage, and educate the next generation of scientists and engineers, technology professionals, and medical professionals.

· To employ, retain, and develop civilian and military technical workforce.

· To collaborate across the Naval STEM communities and with other agencies to maximize benefits to the DoN.

1.6 Naval STEM Outreach. Engagement between DON activities, DoD, other federal entities, academia, industry, and the public is critical to the future US industrial base for scientists and engineers, as well as the skilled technical workforce (STW) for machinist, welders, and other STW positions critical to naval S&T from seabed to space. Outreach activities under this program would include contractor participation and/or support of STEM competitions, career fairs, job fairs, expos, workshops, teacher/career counselor events, and family STEM enrichment (e.g., Navy air shows). Other STEM Outreach would include emailers, newsletters, alumni portals, advertisements, flyers, handouts, and enrichment activities.

2.0 Scope

2.1 Summary

The STEM efforts covered by this IDIQ have a range of historical participation that is key to the continued success of these programs. Maintaining these baseline numbers is instrumental in measuring the relative impact on the Navy and Marine Corps. Therefore, the following provides a general scope on anticipated number of interns, duration of internships, and outreach opportunities.

2.1.1 The Science and Engineering Apprenticeship Program (SEAP) SEAP provides competitive research internships for high school students each year. Participating students spend eight weeks during the summer conducting research virtually or onsite with DON laboratories. SEAP interns are selected by the participating DON laboratories. SEAP participants receive a stipend distributed by the Contractor. The stipend is an allowance paid to interns for their participation in the research efforts

2.1.2 The Naval Research Enterprise Internship Program (NREIP) NREIP provides competitive research internships to college students each year. Participating students spend ten weeks during the summer conducting research virtually or onsite with DON laboratories. To participate, a student must be enrolled at a 2-year or 4-year U.S. accredited college/university (final eligibility is determined by ONR) and have completed some college credits after graduating high school and before beginning the internship. NREIP interns are selected by participating DON laboratories. NREIP participants receive a stipend distributed by the Contractor. The stipend is an allowance paid to interns for their participation in the research efforts.

2.1.3 The Naval Horizons (NH) Program

Naval Horizons provides an opportunity for college students (community college, undergraduate and graduate students), high school students to survey cutting-edge Naval Science & Technology (S&T) topics. Participating students typically are expected to spend 20 hours surveying DON S&T topics and writing a report on the state of the art in one of the DON S&T technology areas, as well as a futurist vision (2040 timeframe) of technology in the Navy. The students may write an optional statement of interest. The first 5,000 students to complete the task will receive a stipend for their participation in this activity

2.1.4 The Short-Term Internship Programs

The Short-Term Internship Program provides an opportunity for college students (community college, undergraduate and graduate students) to introduce them to cutting-edge Naval S&T research and establish a mentorship with a Naval STEM professional. Participating students are expected to spend 40 hours or more engaged virtually and onsite with DON STEM professionals (over the course of several weeks). Participants will receive a stipend for their participation in the research efforts.

2.5 The Naval STEM Website

The Naval STEM Coordination Office (NSCO) serves as the central coordination and information resource for STEM efforts across the Department of Navy (DON) and resides within ONR. One of the goals of the Naval STEM Website is to centrally consolidate all Navy and Marine Corps STEM related opportunities and information. NSCO is the primary point of contact for providing website content through its stakeholders. For example, various DON and DoD STEM programs operate unique websites for student applications (e.g. Science and Engineering Apprenticeship Program, Naval Research Enterprise Internship Program, Science, Mathematics, and Research for Transformation (SMART) Scholarship for-Service Program, National Defense Science and Engineering Graduate (NDSEG) Fellowship Program). The goal of the Naval STEM Website is to provide a clearinghouse of relevant and up-to-date information regarding Naval STEM opportunities, internships, fellowships, scholarships, competitions, job fairs, and other events. Additionally, 22 Naval STEM Stakeholder Organizations execute STEM education and outreach efforts at various facilities across the nation where these efforts would be captured on the website.

2.6 Naval STEM Outreach

Participation in STEM conferences, career fairs, student competitions, and family-related STEM events (e.g. navy air shows, etc.) are main aspects of Naval STEM Outreach. The contractor would also serve as the point-of-contact to communicate DON STEM opportunities (e.g., SEAP, NREIP, SMART, NDSEG, etc.) and other relevant opportunities to students and their families to help promote the STEM future force relevant to the future US STEM industrial base.

Event planning around STEM event and coordination with naval sites across DON are key components and ensuring outreach materials are ordered and delivered in a timely manner. Outreach material includes program flyers, promotional material, banners, student learning and engagement supplies.

2.7 Website Vulnerability

The Contractor shall be responsible for the timely remediation of any vulnerability identified and reported through the Department of Defense Vulnerability Disclosure Program (DoD VDP) that affects the Contractor's managed DoD public-facing website(s). The ONR Command Information Office (CIO) will serve as the primary point of contact and will promptly forward vulnerability reports received from the DoD VDP to the Contractor. These reports will include details necessary for remediation, such as vulnerability descriptions, affected assets, potential impact, and recommended mitigation steps. Upon receipt of a vulnerability report from the ONR CIO, the Contractor shall acknowledge receipt of the report to the ONR CIO within 3 business days. The Contractor shall then assess and prioritize the vulnerability based on severity, exploitability, and potential impact to the website and the DoD. The Contractor shall develop and implement a remediation plan to address the vulnerability, including a timeline for completion. Regular status updates must be provided to the ONR CIO on the progress of the remediation efforts, including any challenges encountered. The Contractor shall remediate the vulnerability within 30 calendar days of the initial report or provide a detailed justification for any delays and a revised remediation timeline. Vulnerabilities deemed critical shall be addressed within 7 calendar days. The Contractor shall also validate the remediation to ensure the vulnerability is effectively resolved and provide a final report to the ONR CIO documenting the remediation activities, validation results, and any lessons learned. The DoD VDP is a program that identifies, and reports vulnerabilities detected on DoD public-facing websites and all publicly accessible information systems throughout the DOD. The VDP initiative protects the DoD attack surface and offers a safe harbor for researchers, enhancing the security of DoD assets and technologies by leveraging external expertise. The Contractor's cooperation and prompt action in addressing vulnerabilities reported through the VDP are essential for maintaining the security and integrity of DoD's online presence.

3.0 STEM Internship Eligibility

3.1 Eligibility Criteria and Security Clearance Requirements

The eligibility criteria vary across the internship opportunities. This ensures participants meet the program requirements where often interns are required to have a security clearance to access the most challenging science and technology projects across the warfare centers and laboratories. The security clearance obtained by the students during their internships will further help increase the US STEM industrial base for the next generation of scientists and engineers.

3.1.2 Eligibility to participate in SEAP- a student must be a U.S. Citizen or Permanent Resident Alien enrolled in a U.S. high school. Participation by Permanent Resident Aliens may be limited by security considerations. Individuals with dual citizenship may be eligible to participate at designated naval sites. SEAP participants must be enrolled in high school or recent high school graduate (final eligibility is determined by the COR). A SEAP student who reaches the age of 18 by the start of the internship may require a security clearance.

3.1.2 Eligibility to participate in NREIP- a student must be a U.S. Citizen or Permanent Resident Alien enrolled in an accredited U.S. college or university. Participation by Permanent Resident Aliens may be limited by security considerations. Individuals with dual citizenship may be eligible to participate at designated naval sites. NREIP participants must be a STEM major and enrolled at a U.S. accredited college/university (final eligibility is determined by the COR). Most NREIP interns will require a security clearance due to the nature of the work.

3.1.3 Eligibility to participate in Naval Horizons- a student must be a U.S. Citizen, a STEM major, and enrolled at a U.S. accredited college/university or U.S. high school, (final eligibility is determined by the COR). Individuals with dual citizenship are eligible to participate.

3.1.4 Eligibility to participate in the Short-Term Internship Program- a student must be a U.S. Citizen, a STEM major, and enrolled at an accredited college/university (final eligibility is determined by the COR). Individuals with dual citizenships or Permanent Residents are eligible to participate at a limited number of naval commands.

4.0 Security

4.1 Security requirements and DD254 will be identified at the task order level. Work at the Task Order level may involve access to, handling of, and generation of classified material. When applicable, a DD Form 254 will be prepared by the ordering activity and issued with the Task Order. If the work being performed under the task order would require access to Government Information Technology Systems, then an applicable clause will be included at the task order level.

4.2 This effort involves work with classified and sensitive information and a SECRET clearance is required for most interns 18 years old and older. See individual internship programs for security requirements.

4.3 Each SEAP and NREIP intern will require, at a minimum, a National Agency Check with Inquiries (NACI) to support Common Access Card (CAC) issuance and access to information technology (IT) systems. Depending on the requirements of each facility and the work assigned, some individuals may require access to classified information. In those cases, the Contractor will receive a DD254 to cover those positions that require access to classified information. The Contractor will work with each facility to coordinate submission of the required investigations to the Office of Personnel Management (OPM).

5.0 Safeguarding Covered Defense Information and Cyber Incident Reporting Supplement

1. System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews

a) Within thirty (30) days of contract award, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the contractor's facility. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government's review of the SSPs at the Contractor's facility.

b) If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

c) Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor's facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

d) The Government may, in its sole discretion, conduct subsequent reviews at the Contractor's site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days' notice to the Contractor.

6.0 Compliance to NIST 800-171

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

(1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protection acceptable to the Government may be substituted;

(2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

(4) Audit user privileges at minimum on an annual basis.

(5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm validation-program);

(6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

(7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

7.0 Cyber Incident Response:

a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

b) Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

c) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

8.0 Naval Criminal Investigative Service (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies.

9.0 NCIS/Industry Monitoring

a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.

10.0 ONR- Acknowledgement of Sponsorship

(a) As used in DFARS 252.235-7010, 'Acknowledgement of Support and Disclaimer,' "material" also includes but is not limited to, news releases, letters to the editor, articles, abstracts, manuscripts, brochures, advertisements, photos, films, videos, slides, charts, graphs, drawings, speeches, trade association meetings, symposia, etc.

(b) Nothing in the foregoing shall affect compliance with the requirements of the clauses of this contract entitled "Disclosure of Information" (252.204-7000) and "Security Requirements" (FAR 52.204-2 and Alternate I) if such clause is a part of the contract

(c) The Contractor further agrees to include this provision in any subcontract awarded as a result of this contract.

11.0 Reports, Data and Other Deliverables

See to DD 1423, Section J – List of Attachments for reference.

12.0 Task Order Process

One or more Task Orders (TOs) may be issued during the performance period of this contract. The Contractor agrees to accept and perform orders issued by the Task Order Contracting Officer within the scope of this agreement.

It is understood and agreed that the Government has no obligation to issue any orders except the minimum order. The minimum value of a task order value is $5,000 and the maximum value of a task order is $5,000,000 and shall be placed at time of award of this IDIQ contract vehicle.

In the event of any inconsistency between any TO and the contract, the contract shall control.

13.0 Task Orders

Each individual TO may be cost reimbursable or fixed price (FP). All Task Orders shall be issued using the electronic Procurement System (ePS).

14.0 Unauthorized Work

The Contractor is not authorized to commence task performance prior to issuance of a signed Task Order (TO) that has been funded.

15.0 Task Funding Restrictions

TOs shall either be funded at the time of award or awarded under the authority provided within Section I Clauses 52.232-18 Availability of Funds and 52.232-22 Limitation of Fund.

If a funding issue is identified in a task order, contractor is required to contact Contracting Officer Representative (COR) and Procurement Contracting Officer (PCO) via email within 7 calendar days to discuss and address discrepancy. The Contractor shall not invoice under a new task order for performance completed under an expired task order.

16.0 Payment/Invoice

Contractor is responsible for tracking and administering expenses under task orders including stipend and labor expenses in accordance with PWS/SOW. Vendor is required to submit invoice(s) within 30 calendar days after performance under a TO is completed and reviewed/accepted by assigned COR to prevent delays and payment issues.

Invoice must include specific information such as program, number of hours, website, type of stipend, number of students, period of performance covered in voucher.

For ONR task orders, Contractor shall provide copy of voucher to COR and PCO for review before submitting an invoice.

17.0 Ordering Period

Orders may be issued by any Contracting Officer from the Department of Navy from contract award date through the end of the ordering period, specified in Section F.

18.0 Ordering Authority

The Office of Naval Research, as well as Authorized Ordering Officers at other Navy Commands, may issue orders under this contract. Orders shall be placed unilaterally or bilaterally by the cognizant Ordering Officer by issuance via DD Form 1155, Order For Services using the electronic Procurement System (ePS).

DRAFT