iMBP PWS FY26_draft for SS_DRAFT PWS.pdf

PERFORMANCE WORK STATEMENT

FOR

IMPROVED MARITIME BALLISTIC PLATE (IMBP)

1.0 SCOPE

The Special Mission Systems Division (S20) within Naval Surface Warfare Center’s Panama City Division has a requirement to outfit U.S. Naval personnel with the Improved Maritime Ballistic Plate (iMBP). This Performance Work Statement (PWS) specifies the requirements for the Contractor to produce and deliver the iMBP. The iMBP is a critical safety item. Qualification and eligibility for any production task orders under this contract is contingent upon the contractor’s successful completion of First Article Test (FAT) in accordance with the purchase description (PD) NQ/PD 26-01 Improved Maritime Ballistic Plate Purchase Description, Attachment J-1. In any partnership for this effort, a company can only have one role (i.e. a company can be either a prime contractor or a subcontractor, but not both).

1.1 Acronym List

Following is a list of acronyms used in this PWS.

CAR Corrective Actions Report CATEX Categorical Exclusion CI Configuration Item CM Configuration Management CoC Certificate of Conformance COTS Commercial Off-The-Shelf CSA Configuration Status Accounting DAC Days After Contract Award DAEO Days After Exercising Option DCMA Defense Contract Management Agency DoD Department of Defense DoN Department of the Navy EA Environmental Assessment ECP Engineering Change Proposal EIS Environmental Impact Statement EPA Environmental Protection Agency ESOH Environment, Safety, and Occupational Health FAT First Article Testing HHA Health Hazard Assessment HMMP Hazardous Materials Management Program iMBP Improved Maritime Ballistic Plate IPR In-Process Review LAT Lot Acceptance Testing MSDS Material Safety Data Sheet NAS National Aerospace Standard NCTRF Navy Clothing and Textile Research Facility

NDI Non-Developmental Item NEPA National Environmental Policy Act NOR Notice of Revision ODC Ozone Depleting Chemical ODS Ozone Depleting Substance PCA Physical Configuration Audit PCO Procuring Contracting Officer PD Purchase Description PMO Program Management Office PWS Performance Work Statement QA Quality Assurance QALI Quality Assurance Letter of Instruction QAR Quality Assurance Representative QASP Quality Assurance Surveillance Plan RFV Request for Variance SOW Statement of Work

2.0 APPLICABLE DOCUMENTS

The following documents, of the exact issue shown, form a part of this statement of work (SOW) to the extent specified herein. In the event of conflict between the documents referenced and the contents of this SOW, the SOW shall supersede. Second tier and lower references, (i.e., those referenced in the primary references) shall be used for guidance only.

2.1 Military Standards

MIL-STD 3027

30 Sep 2008

Department of Defense Test Method Standard for Performance Requirements and Testing of Body Armor

2.2 Military Specifications

None

2.3 Other Documents

a. ANSI/ASQ Z1.4-2003 (R2018)

Sampling Procedures and Tables for Inspection by Attributes

b. MIL-HDBK-61A 07 Feb 2001

Configuration Management Guidance

c. NQ/PD 26-01

DRAFT

Product Description, Body Armor, Improved Maritime Ballistic Plate, (Attachment J-1)

d. iMBP QALI Quality Assurance Letter of Instruction, (Attachment J-2)

Commented [DM1]: Do we need the QALI for sources sought?

3.0 REQUIREMENTS

3.1 Fabrication Support

3.1.1 Improved Maritime Ballistic Plate (iMBP)

The Contractor shall provide all facilities, materials, and labor to fabricate and deliver iMBP(s). The iMBP shall be manufactured in six (6) sizes: X-Small (XS), Small-Short (SS), Small (S), Medium (M), Large (L) and X-Large (XL) torso plates. The Contractor shall provide and deliver iMBPs in accordance with the form, fit, and functional requirements as described in this Performance Work Statement and Purchase Description NQ/PD 26-01 (Attachment J-1). Specific quantities of each item are specified in Section B of this contract.

3.1.2 Commercial Products/Standard Parts

In accordance with FAR 52.244-6 Subcontracts for Commercial Items, the

Contractor shall use commercial products, processes, and practices to reduce production and operation support costs unless a material or part is specified in NQ/PD 26-01 (Attachment J-1). In any case where not specified in the PD, and it is technically and economically feasible, a standard part will be used rather than a non-standard part. A standard part is one that is routinely available in the Government inventory, or commercial supply channels and is not sole source or proprietary in nature. Any non-standard part shall be identified to the Government for written approval to use that part.

3.1.3 Product Improvements

Future improvements in system design which provide improved durability and performance or reduce cost are encouraged during the contract term through the use of Engineering Change Proposals (ECP), Manufacturing Technology, and Operation Support Cost Reduction. Product improvements may be proposed by either the Contractor or the Government to eliminate operational shortcomings, improve operational effectiveness, accommodate fielding requirements, or provide savings to the Government. Product improvements will not be considered prior to contract award.

3.2 Test and Evaluation

3.2.1 First Article Test (FAT)/Performance Based Qualifications

3.2.1.1 The Government will conduct First Article Tests in accordance with FAR 52.209-4 First Article Approval- Government Testing. The Government will evaluate the First Articles in accordance with NQ/PD 26-01 paragraph 4.1.1.

3.2.1.2 The Contractor shall deliver production of iMBP for non-ballistic and ballistic requirements and verifications within sixty (60) days of contract award in accordance with NQ/PD 26-01. Delivery address is provided in the delivery section of this contract. The contractor shall provide all certification/compliance documentation with the iMBP. The specific items and quantities to be provided for first article testing are as follows:

ITEM TYPE QUANTITY DATE DUE

iMBP Size X-Small First Article 26 60 DAC iMBP Size Small-Short First Article 26 60 DAC iMBP Size Small First Article 26 60 DAC iMBP Size Medium First Article 42 60 DAC iMBP Size Large First Article 26 60 DAC iMBP Size X-Large First Article 26 60 DAC

3.2.1.3 The Government will pay for FAT test articles and conduct of the initial FAT. Should the contractor fail the initial FAT, the contractor shall pay for subsequent FAT test articles and the conduct of FAT prior to issuing any delivery orders.

3.2.1.4 The Government’s FAT may include verification of any or all of the requirements specified in NQ/PD 26-01 (Attachment J-1).

3.2.1.5 Any additional FAT test articles required to validate revised or new designs shall be approved by the Procuring Contracting Officer (PCO) via a contract modification.

3.2.1.6 The Contractor shall produce both the first article units and the production units at the same facility.

3.3 Configuration Management

3.3.1 Raw Materials

All production quantities submitted after approval of the FAT shall be produced using the same raw materials, suppliers, materials, processes, procedures, equipment and facilities that resulted in the manufacture of the acceptable FAT items. This includes all raw materials or sub-components. Prior to any change, and within thirty (30) days of identification of needed change in the production of the approved FAT test items, including a raw material supplier, production processes, and production locations, the contractor must notify the Contracting Officer in writing. The Contracting Officer will determine if a new FAT is required prior to that change.

3.3.2 Standard Samples

Upon approval of FAT, three (3) iMBPs from each size, shall be signed as standard samples and will be retained by the NAVSEA, DCMA, and Navy Clothing and Textile Research Facility (NCTRF) to be used as a guide for all future quality inspections. These items are to be fabricated where the items are going to be produced in production and all future lots. If prime contractor uses multiple subcontractors for production of the end item, each subcontractor shall submit a set of standard samples as well.

3.3.3 Configuration Process and Control

The Contractor shall maintain a configuration management (CM) process for the control of raw material utilized in the ballistic plate designs that are approved by the Government in accordance with FAT requirements. The Contractor shall furnish with each lot submitted to the Government, the associated ballistic plate raw material traceability matrix, to include raw material supplier Certificates of Compliance (CoC) and lots of raw material used in each lot presented to the Government. MIL-HDBK-61 may be used for guidance. The Contractor’s CM process shall consist of configuration identification and configuration control of all raw materials utilized in the production of ballistic plates. The CM process shall interface with other acquisition requirements such as design review, quality assurance, and other program related disciplines shall be addressed. (CDRL A001)

3.4 Lot Acceptance Test and Evaluation

3.4.1 Procedures

The Contractor shall provide measurements and Certificates of Conformance for all in-process material inspections needed to meet the minimum requirements of the performance specification. End item testing shall be conducted on all lots presented to the Government in accordance with NQ/PD 26-01 (Attachment J-1). Only the ballistic plates that have successfully completed FAT per NQ/PD 26-01 (Attachment J-1) shall be used. The Contractor shall assign lot and serial numbers to each ballistic plate produced and shall be able to track those serial numbers back to Lot Acceptance Testing and raw materials. Defense Contract Management Agency (DCMA) Quality Assurance Representative (QAR) and/or Technical Warrant Holder shall identify randomly selected serial number components to be pulled from production for purposes of Lot testing.

3.4.1.1 The Quality Assurance Letter of Instruction (QALI) (Attachment J-2) is intended to be implemented by the Defense Contract Management Agency (DCMA) at the contractors’ manufacturing facility. This document stipulates the requirements and expectations of the PMO for production process monitoring, in-process material inspection, sampling procedures and finished end item evaluations. DCMA will develop and submit a Quality Assurance Surveillance Plan (QASP) to be coordinated with the PMO.

3.4.2 Examination of Ballistic Fillers

The Contractor shall conduct 100 percent in-process visual examination of ballistic materials in accordance with NQ/PD 26-01 (Attachment J-1). Furthermore, the Contractor’s Configuration Management process shall maintain all CoCs stipulated in NQ/PD 26-01 (Attachment J-1), Table 2 associated with each lot submitted to the Government. CoCs shall be provided to the Government upon request.

3.4.2 Testing Submissions

Lot size inspection shall be in accordance with NQ/PD 26-01 (Attachment J-1), Appendix C and derived per OSD protocol and ANSI/ASQ Z1.4-2008 - Sampling Procedures and Tables for Inspection by Attributes.

3.4.3 Designated Authority

The Designated Authority (below) shall be placed in box 17 of all DD Form 1222

(Request for and Results of Tests), and the test lab shall provide the results of all testing directly to the designated authority. No lots shall be released from the Contractor’s facility prior to release of end item testing notification of acceptance from the Government (DCMA, contracting agency, or designated authority). The Designated Authority for this contract includes:

Mr. Martin Cvejanovich Naval Sea Systems Command (NAVSEA) 1333 Isaac Hull Avenue SE Washington Navy Yard, DC 20376-5149

TEL: 703-989-8579

Email: martin.r.cvejanovich.civ@us.navy.mil

3.4.4 Additional Testing

While the scope of QA testing is limited in requirements, threat, and conditions tested, it does not relieve the Contractor from full requirements of this contract and all associated specifications or the statement of work. Nor shall it permit the Contractor to present to the Government any items that are known or suspected to be substandard merely on the basis of acceptable lot test results or the possibility of acceptable results if tested. The Government reserves the right conduct varied or additional QA and/or verification tests against any or all requirements of the contract and/or its specifications at any time as a condition of acceptance.

3.5 Program Management

The Contractor shall designate a Program Manager. This individual shall serve as the primary point of contact between the Government and the Contractor, and shall be responsible for the coordination of all Contractor activities related to the contract.

3.6 Post Award Conference

A Post Award Conference will be held by the Government at the Contractor’s facility within 30 days of contract award. The purpose of the conference is to ensure mutual understanding of contract requirements, dispute resolution procedures, and identification of points of contact from contractor and government organizations.

3.7 In-Process Reviews (IPRS)

The Contractor shall host and participate in IPRs, as required. Initially, IPRs will be conducted on a quarterly basis at a minimum. The IPR reviews the progress of the iMBP program until production ramp-up is complete and monthly production is running consistently.

After reaching and sustaining full production, IPRs will be held when deemed appropriate by the Government. IPRs shall be conducted on dates mutually agreeable to the Contractor and the Government. The Contractor shall brief on the production status and schedule, and any issues related to contract execution.

3.8 Technical and Support Documentation

In support of the iMBP fabrication effort, the Contractor shall submit the following technical and support documentation as specified below.

3.8.1 Contract Status Report (CDRL A002)

During periods of fabrication of iMBP (First Articles or production), the contractor shall prepare a monthly status report that documents the status of contractor effort towards achieving contract objectives. The report shall identify accomplishments to date and difficulties encountered, and compare the status achieved to planned goals and the resources expended. The status report shall also include a detail listing of all material purchases, including the specific cost of each item procured.

3.8.2 System Safety and Environmental Information Report (SSEIR)

(CDRL A003)

3.8.2.1 System Safety (CDRL A003)

The Contractor shall identify and evaluate environmental, safety, and health hazards, define risk levels, and establish a program that manages the probability and severity of all hazards associated with development, use, and disposal of the system in accordance with MIL-STD-882. Residual risks will be evaluated by the Government in accordance with MIL-STD-882 and accepted as appropriate prior to exposing people, equipment, or the environment to known system related Environment, Safety, and Occupational Health (ESOH) risks. The Contractor must identify all explosive safety risks as such in the system safety documentation.

3.8.2.2 Health Hazard Assessment (CDRL A003)

The Contractor shall perform and document a Health Hazard Assessment (HHA) to identify health hazards, evaluate proposed hazardous materials, and propose protective measures to reduce the associated risk to a level acceptable by the Government. The HHA shall include the minimum hazard probability and severity reporting thresholds and any selected hazards, hazardous areas, hazardous materials, or other specific items to be examined or excluded.

3.8.2.3 Hazardous Materials Management Program & Pollution

Prevention

(CDRL A003)

The Contractor shall implement a Hazardous Materials Management

Program (HMMP) and Pollution Prevention (P2) in accordance with National Aerospace Standard (NAS) 411. The Contractor shall avoid the use of toxic chemicals, hazardous materials, and ozone depleting substances (ODS) in the design, operational support and disposal of the iMBP where possible. The HMMP shall establish a process to manage all requirements for asbestos, radioactive materials, cadmium, hexavalent chromium, and extremely toxic or hazardous materials in design, production, operation, and support. The use of Class I or Class II Ozone Depleting Chemicals (ODCs) is prohibited in the design or operational support of the system without specific written approval of the Contracting Officer. More information on chemicals and hazardous materials to be avoided can be obtained from the Environmental Protection Agency (EPA). The Contractor shall make this information available to the Government upon request.

3.8.2.4 Material Safety Data Sheets (CDRL A003)

The Contractor shall provide all Material Safety Data Sheets (MSDS) to the Government for review (a) at Post Award Conference and (b) anytime thereafter if their vest material in support of the vest product baseline changes. A copy of the MSDS is required in accordance with FED-STD-313D Change Notice 1.

3.8.2.5 Environmental Considerations (CDRL A004)

The Contractor shall provide information on the potential for any adverse environmental impacts from the manufacturing, operation, maintenance, and disposal of the vest.

This information will be used to assist the Government in making a preliminary National Environmental Policy Act (NEPA) decision and in the preparation of formal NEPA documents, which include Categorical Exclusion (CATEX), Environmental Assessment (EA), and Environmental Impact Statement (EIS). Such environmental impacts include air, soil, wetlands, water, flora, fauna, endangered species, emissions and toxic waste resulting from development, maintenance (coatings and primers), operation, disposal, etc.

3.8.3 Configuration Management

3.8.3.1 Configuration Management Process (CDRL A005)

The Contractor shall maintain a configuration management (CM) process for the control of all iMBP configuration documentation, media and parts representing or comprising the iMBP. The principles contained in EIA-649 and MIL-HDBK-61 may be used for guidance. The Contractor's CM process shall consist of configuration identification, configuration control, configuration status accounting, and configuration audits. Consideration for interfacing with other acquisition requirements such as design review, quality assurance, and other program related disciplines shall be addressed. The Contractor shall notify the Government of any changes at the Contractor's facility, which affect the Contractor's established

CM process.

3.8.3.2 Configuration Identification (CDRL A005)

At the Post Award Conference, the Contractor shall propose Configuration Items (CIs) to be managed by the Government and those to be managed by the Contractor at a lower level/tier. For those CIs that have been identified for Government control, the Contractor shall provide form, fit, function, and interface documentation necessary for configuration status accounting. The Contractor shall establish management practices for those lower level/tier CIs.

3.8.3.3 Configuration Status Accounting (CDRL A005)

The Contractor shall establish and maintain a Configuration Status

Accounting (CSA) database, which represents the configurations of the iMBP. All baselines and changes shall be documented in the Contractor’s CSA database. The Contractor's CSA database shall permit acceptance of commercial product information; however, if requirements to report data outside of the Contractor's CSA database or format exist, the information may be delivered as a supplement to prevent disruption to their existing system. The Contractor's CSA database shall reconcile any differences between the supplier information and Contractor practices to provide the Government with clear accountability of product information. Additionally, the CSA database shall provide a reliable source of configuration information to support test activities, including program management, systems engineering, logistics support, and modification/maintenance actions. The Government may request a report from the CSA database as needed.

3.8.4 Physical Configuration Audit Report (CDRL A006)

The Physical Configuration Audit (PCA) shall be performed to verify the iMBP and its configuration items (CIs) are accurate, complete, compatible, and that the CI has achieved the performance and functional characteristics defined in the functional configuration baseline.

The Government and the Contractor shall conduct the PCA jointly, at a time and place mutually agreed upon, with the Government chairing the audit. The PCA shall verify the drawings reflect the "as-built" configuration of all newly developed or modified portions of the system; accurate form, fit, function information is provided on control drawings for non-developmental/commercial off-the-shelf items; and confirm the drawings accurately represent the "as-built" production configuration. Whenever possible, the PCA shall be conducted incrementally, concurrent with hardware fabrication and assembly of the first production iMBP.

The Contractor shall provide an approach and proposed schedule for conducting the PCA and identification of the CIs to be audited at first article production. The Contractor shall participate and assist the Government in the development of the PCA, using the guidelines contained in MIL-HDBK-61A, section 8. The Contractor shall document the results of the PCA after each audit and shall correct all audit discrepancies documented in the configuration audit summary reports. In the event the Government finds evidence the drawings and/or documents do not adequately represent the equipment, the Government reserves the right to stop production until all discrepancies are corrected and the Government approves the configuration audit summary report. The product baseline will be established upon completion of the PCA and resolution of audit discrepancies.

3.8.5 Configuration Control

The Contractor shall implement configuration control methods and procedures which maintain the integrity and traceability of an established baseline. Changes to established baselines shall only be made after Government approval of Engineering Change Proposals (ECP) and Requests for Variance (RFV). Sufficient supporting data to evaluate the proposed change, such as drawings, supplemental drawings, sketches, specifications, or manufacturer's data sheets, shall be submitted with ECP's and RFV's. Changes shall be identified to the affected assembly serial number, or if not part of an assembly, to the affected equipment serial number. The Contractor's configuration control process shall be available for Government review. ECP, deviations, or revisions may require a new FAT. Nearly all changes to the iMBP shall require a new FAT. FAT determination will be made on a case-by-case basis.

3.8.5.1 Engineering Change Proposals (CDRL A007)

Engineering Change Proposals (ECP) shall be submitted by the Contractor, and shall be limited to those which are necessary or offer benefit to the Government.

MIL-HDBK-61A, Section 6.2, provides guidance concerning the classification of ECP’s. The Government will review each ECP upon receipt and notify the Contractor in writing of approval/disapproval. Major engineering changes prior to the establishment of the product baseline shall be approved by the Program Office and Contracting Officer at In-Process Reviews (IPR). Technologies that reduce the overall system weight (without degradation of other performance characteristics), and/or increases performance, durability, and service life are a priority.

3.8.5.2 Requests for Variance (CDRL A008)

The Contractor shall process Requests for Variance (RFV) from current approved configuration documentation. Authorized deviations are a temporary departure from the requirements and do not constitute a change in an approved baseline. Submission of recurring deviations is discouraged and shall be minimized. Where it is determined that a change should be permanent, the Contractor shall process an ECP. MIL-STD-3046 provides guidance concerning the classification of RFVs.

3.8.5.3 Notices of Revision (CDRL A009)

The Contractor shall generate and submit Notices of Revision (NOR) concurrently with ECPs when technical documentation controlled by another Contractor or Government agency requires changes following approval of an ECP.

3.8.6 Engineering Drawings (CDRL A010)

The Contractor shall develop a complete product drawing package and provide it to the Government at FAT or with any approved ECP after FAT. This process may require the revision and update of existing drawings, and/or development of new drawings to meet the requirements of product drawings/models and associated lists. Revised and newly created drawings shall be developed to document any design change and shall reflect all changes resulting from Government approved ECPs. Existing, revised, and new product drawings and associated lists shall be used as the engineering data for procuring, controlling, and using materials, parts, and assemblies whether produced in-house or supplied by the Contractor. The drawings shall be used for the assembly, provisioning, inspection, testing, and configuration management of the materials, parts, modules, subassemblies, and assemblies of the equipment covered under this contract. The product drawings shall also include control drawings for all commercial off the shelf (COTS) items that do not conform to recognized Government or industry specifications, non-developmental items (NDI) and items developed at private expense for which the Government had not acquired unlimited rights. These control drawings shall provide the applicable performance specification of form, fit, and function and provide interface information needed for competitive re-procurement of that item or an interchangeable item. New product drawings/models shall conform to ASME Y14.100 and ASME Y14.34.

3.8.7 Test and Evaluation (CDRL A011)

First Article Test approval remains in effect and production may continue unless:

The Contractor fails Lot Acceptance Testing (LAT) requirements on two (2) consecutive lots. Should this occur, the Contractor will immediately cease production (Stop Work) and conduct a Failure Analysis and provide such reports as required to facilitate the completion of a Corrective Actions Report (CAR) as directed by the Defense Contract Management Agency (DCMA) Quality Assurance Representative (QAR). The CAR will then be submitted to the QAR and the Contracting Officer for review no later than 15 calendar days after occurrence. The QAR and Contracting Officer will determine within five (5) working days after receipt of the CAR if production of the approved First Article Test configuration may resume or if the Contractor must conduct a new First Article Test for the issuance of a new First Article Test Approval Letter. If a new First Article Test is required, the Contractor will submit the number of samples required to conduct a new First Article Test (at the Contractor’s expense) as directed by the Contracting Officer, for the issuance of a new First Article Test Approval Letter.

All First Article Test Reports remain the property of the Government.

3.9 Warranty

The Contractor shall provide a five-year warranty for the iMBP for workmanship, materials, design, and compliance with the performance specifications as well as shelf life and service life requirements detailed in MIL-STD 3027.

4.0 GOVERNMENT FURNISHED INFORMATION

All GFI required to complete statement of work tasking will be provided with the Request for Proposal (RFP).

5.0 SECURITY

The Contractor shall require access to classified information up to the SECRET level.

The Contractor will NOT be required to generate or store classified data to meet the requirements of this Task Order. A separate classified annex will be provided to the Contractor upon an approved Limited Distribution Memorandum by NSWC PCD Industrial Security

(INDUSEC).

5.1 Release of Information

(a) Release of information shall be in accordance with Section I, DFARS Clause 252.204-7000, Disclosure of Information.

(b) All technical data provided to the contractor by the Government will be protected from public disclosure in accordance with the markings contained thereon. All other information relating to the items to be delivered or services to be performed under this contract may not be disclosed by any means without prior approval of the appropriate NSWC PCD authority. Dissemination or public disclosure includes, but is not limited to, permitting access to such information by foreign nationals or by any other person or entity; publication of technical or scientific papers;

advertising; or any other proposed public release. The contractor shall provide adequate physical protection to such information to preclude access by any person or entity not authorized such access by the Government.

5.2 Controlled Unclassified Information (CUI)

Controlled unclassified information (CUI) is official information that requires the application of controls and protective measures for a variety of reasons and has not been approved for public release, to include technical information, proprietary data, information requiring protection under the Privacy Act of 1974, and Government-developed privileged information involving the award of contracts. CUI is a categorical designation that refers to unclassified information that does not meet the standards for National Security Classification under Executive Order 13526, but is (a) pertinent to the national interest of the United States or to the important interests of entities outside the Federal Government, and (b) under law or policy requires protection from unauthorized disclosure, special handling safeguards, or prescribed limits on exchange or dissemination.

5.3 Minimum Requirements for Access to Controlled Unclassified Information

(CUI)

Access to CUI, user level access to DON or DoD networks and information systems, system security and network defense systems, and to system resources providing visual access and/or ability to input, delete or otherwise manipulate sensitive information without controls to identify and deny sensitive information, requires security clearance eligibility, based on a Tier 3 Background Investigation, and a favorable adjudication by the DCSA Trust Decision

(Adjudications) [TD(A)], or Interim/Temporary access to CUI based on a determination by the NSWC PCD Security Manager based on a favorable review of an individuals completed Electronic Questionnaire for Investigation Processing (SF86), and favorable FBI fingerprint results. Contact NSWC PCD Personnel Security (NSWCPCD_PERSEC@us.navy.mil) for initiation of the SF86 and FBI fingerprinting, the CUI determination, and validation that employees have the required eligibility, prior to providing access to CUI.

Security classification guides and unclassified limited documents (e.g., For CUI, Distribution Statement Controlled) are not authorized for public release and, therefore, cannot be posted on a publicly accessible webserver or transmitted over the Internet unless appropriately encrypted.

CUI

CUI is a document designation, not a classification. This designation is used by Department of Defense (DoD) and a number of other federal agencies to identify information or material, which although unclassified, disclosure to the public of the information would reasonably be expected to cause a foreseeable harm to an interest protected by one or more provisions of the Freedom of Information Act (FOIA). This includes information that qualifies for protection pursuant to the provisions of the Privacy Act of 1974, as amended. CUI must be marked, controlled and safeguarded in accordance with DoDM 5200.48, Controlled Unclassified Information (CUI).

5.6 Security of Unclassified DoD Information on Non-DoD Information Systems (DoDI 8582.01) DoD Policy

Adequate security shall be provided for all unclassified DoD information on non-DoD information systems. Appropriate requirements shall be incorporated into all contracts, grants, and other legal agreements with non-DoD entities.

Information Safeguards are applicable to unclassified DoD information in the possession or control of non- DoD entities on non-DoD information systems, to the extent provided by the applicable contract, grant, or other legal agreement with the DoD.

Unclassified DoD information that has not been cleared for public release may be disseminated by the contractor, grantee, or awardee to the extent required to further the contract, grant, or agreement objectives, provided that the information is disseminated within the scope of assigned duties and with a clear expectation that confidentiality will be preserved. Examples include:

a. Non-public information provided to a contractor (e.g., with a request for proposal).

b. Information developed during the course of a contract, grant, or other legal agreement

(e.g., draft documents, reports, or briefings and deliverables).

c. Privileged information contained in transactions (e.g., privileged contract information, program schedules, contract-related event tracking).

It is recognized that adequate security will vary depending on the nature and sensitivity of the information on any given non-DoD information system. However, all unclassified DoD information in the possession or control of non-DoD entities on non-DoD information systems will minimally be safeguarded as follows:

a. Do not process unclassified DoD information on publicly available computers (e.g., those available for use by the general public in kiosks or hotel business centers).

b. Protect unclassified DoD information by at least one physical or electronic barrier

(e.g., locked container or room, logical authentication or logon procedure) when not under direct individual control of an authorized user.

c. At a minimum, overwrite media that have been used to process unclassified DoD information before external release or disposal.

d. Encrypt all information that has been identified as CUI when it is stored on mobile computing devices such as laptops and personal digital assistants, compact disks, or authorized removable storage media such as thumb drives and compact disks, using the best encryption technology available to the contractor or teaming partner.

e. Limit transfer of unclassified DoD information to subcontractors or teaming partners with a need to know and obtain a commitment from them to protect the information they receive to at least the same level of protection as that specified in the contract or other written agreement.

f. Transmit e-mail and similar communications containing unclassified DoD information using technology and processes that provide the best level of privacy available, given facilities, conditions, and environment. Examples of recommended technologies or processes include closed networks, Virtual Private Networks (VPN), public key-enabled encryption, and Transport Layer Security (TLS).

g. Encrypt organizational wireless connections and use encrypted wireless connections where available when traveling. If encrypted wireless is not available, encrypt document files (e.g., spreadsheet and word processing files), using at least application-provided password protected level encryption.

h. Transmit voice and fax transmissions only when there is a reasonable assurance that access is limited to authorized recipients.

i. Do not post unclassified DoD information to website pages that are publicly available or have access limited only by domain or internet protocol restriction. Such information may be posted to website pages that control access by user identification and password, user certificates, or other technical means and provide protection via use of TLS or other equivalent technologies during transmission. Access control may be provided by the intranet (vice the website itself or the application it hosts).

j. Provide protection against computer network intrusions and data exfiltration, minimally including:

(1) Current and regularly updated malware protection services, (e.g., anti-virus, anti-spyware).

(2) Monitoring and control of both inbound and outbound network traffic (e.g., at the external boundary, sub-networks, individual hosts), including blocking unauthorized ingress, egress, and exfiltration through technologies such as firewalls and router policies, intrusion prevention or detection services, and host-based security services.

(3) Prompt application of security-relevant software patches, service packs, and hot fixes.

k. Comply with other current Federal and DoD information protection and reporting requirements for specified categories of information (e.g., medical, proprietary, Critical Program Information (CPI), Personally Identifiable Information (PII), export controlled) as specified in contracts, grants, and other legal agreements.

l. Report loss or unauthorized disclosure of unclassified DoD information in accordance with contract, grant, or other legal agreement requirements and mechanisms.

m. Do not use external IT services (e.g., e-mail, content hosting, database, document processing) unless they provide at least the same level of protection as that specified in the contract or other written agreement.

5.7 Operations Security

Operations Security (OPSEC) is concerned with the protection of critical information:

facts about intentions, capabilities, operations, or activities that are needed by adversaries or competitors to bring about failure or unacceptable consequences of mission accomplishment.

Critical information includes information regarding:

• Operations, missions, and exercises, test schedules or locations;

• Location/movement of sensitive information, equipment, or facilities;

• Force structure and readiness (e.g., recall rosters);

• Capabilities, vulnerabilities, limitations, security weaknesses;

• Intrusions/attacks of DoD networks or information systems;

• Network (and system) user identifications and passwords;

• Movements of key personnel or visitors (itineraries, agendas, etc.); and

• Security classification of equipment, systems, operations, etc.

The Contractor, subcontractors and their personnel shall employ the following countermeasures to mitigate the susceptibility of critical information to exploitation, when applicable:

• Practice OPSEC and facilitate OPSEC awareness;

• Immediately retrieve documents from printers assessable by the public;

• Shred sensitive and Controlled Unclassified Information (CUI) documents when no longer needed;

• Protect information from personnel without a need-to-know;

• When promulgating information, limit details to that essential for legitimacy;

• During testing and evaluation, practice OPSEC methodologies of staging out of sight, desensitization, or speed of execution, whenever possible.

6.0 DISTRIBUTION LIMITATION STATEMENT

Documentation generated under this order shall have the following Distribution Limitation Statement and Destruction Notice affixed to the front cover and title page (if any):

DISTRIBUTION STATEMENT D: DISTRIBUTION AUTHORIZED TO

DEPARTMENT OF DEFENSE AND DOD CONTRACTORS ONLY;

ADMINISTRATIVE/OPERATIONAL USE; (Date Statement Applied). OTHER

REQUESTS FOR THIS DOCUMENT MUST BE REFERRED TOPEO (PMS-408).

WARNING - THIS DOCUMENT CONTAINS TECHNICAL DATA WHOSE

EXPORT IS RESTRICTED BY THE ARMS EXPORT CONTROL ACT (TITLE 22,

U.S.C., SEC 2751, ET Q.) OR THE EXPORT ADMINISTRATION ACT OF 1979,

AS AMENDED, TITLE 50, U.S.C., APP. 2401 ET SEQ. VIOLATIONS OF THESE

EXPORT LAWS ARE SUBJECT TO SEVERE CRIMINAL PENALTIES.

DISSEMINATE IN ACCORDANCE WITH PROVISIONS OF DOD DIRECTIVE

5230.25. AND DoD INSTRUCTION 2040.02.

DESTRUCTION NOTICE - CLASSIFIED INFORMATION, DESTROY IN

ACCORDANCE WITH SECNAVINST 5510.36, (DON INFORMATION

SECURITY PROGRAM) OR NISPOM RULE. UNCLASSIFIED LIMITED

DOCUMENTS, (E.G., CUI, DISTRIBUTION STATEMENT CONTROL)

DESTROY PER DODI 5200.48.