L16 DISC MEDDS Task Order PWS_12022020.docx

HQ0855-21-R-0004

Test Resources Directorate Instrumentation Support Contract

Mission Execution and Display Distribution System (MEDDS)

Performance Work Statement

MEDDS Year 1 Task Order PoP XX XXX XXX through XX XXX XXX

December 2, 2020 DRAFT v6

TABLE OF CONTENTS

i

1.0 SCOPE

This Test Resources Directorate (DTR) Instrumentation Support Contract (DISC) Mission Execution and Display Distribution (MEDDS) Performance Work Statement (PWS) covers specialized support services provided for the Missile Defense Agency (MDA). This supports Research, Development, Test & Evaluation (RDT&E) of Missile Defense System flight tests, ground tests and other related Department of Defense (DoD) activities.

MEDDS support requirements include three primary areas: 1) MEDDS Mission and Test Execution, 2) MEDDS Operation and Sustainment (O&S), and 3) MEDDS Program Management. The overarching goal of this PWS is to provide MEDDS support in accordance with (IAW) schedules and locations for missiles system tests in all phases of flight. This requirement is to develop, operate and, sustain a new instrumentation system (MEDDS) with the capabilities required to collect, record, generate, and distribute test execution products, displays, and data.

1.1 Background

Initial MEDDS operations shall include components of the MDA Test Support Systems (TSS) and the Missile Defense Agency Digital Display Distribution System (MD3S) currently deployed across the MDA test architecture and partner agencies.

1.2 Contract Work Environment

1.2.1 The contractor shall perform requirements primarily on Government-owned systems and equipment. Contractor performance will be at multiple sites located away from the contractor facility, such as geographically remote sites where the fixed or mobile flight test MEDDS systems are located, including ship-based. This includes DoD ranges, U.S. Government-owned facilities, commercial facilities, or other Government-designated test sites and installations in the U.S., U.S. Territories, or the Unified Combatant Commands such as United States Pacific Command and United States Central Command, and other locations as required.

2.0 APPLICABLE DOCUMENTATION

The following documents apply to the work under this contract, and will be provided by the Government. The Contracting Officer’s Representative (COR) may provide additional documentation over the course of the contract.

a) Security Classification Guides

b) Integrated Master Test Plan (IMTP) v21.1

c) MDA Instruction 4250.02 – Ballistic Missile Defense System Cost Estimates

d) DoD Instruction 5000.04-M-1, CSDR Manual

e) Department of Defense (DoD) Instruction 5000.64, Accountability and Management of DoD Equipment and Other Accountable Property

f) DoD Instruction 8500.01, Cybersecurity (dated March 14, 2014)

g) DoD Directive 8140, Cyberspace Workforce Management

h) DoD 8570.01-M, Information Assurance Workforce Improvement Program

i) MDA Software Assurance Overlay, MDA Policy Memorandum NO. 16 (dated September 22, 2020)

j) National Consensus Standard for Configuration Management (ANSI/EIA-649)

k) Military Handbook Configuration Management guide (MIL-HDBK-61A)

The period of performance for this effort is twenty-four months and will last from XX XXX XXXX through XX XXX XXXX.

3.1.1 MDA requires design, development, and maintenance of a new instrumentation system, MEDDS, which will satisfy data acquisition, display, and distribution system requirements. Previously, these requirements were met by legacy TSS and MD3S systems. The main objective is to improve performance, efficiency, and cybersecurity posture by providing standardized solutions for test display transport and products. MEDDS development and operation is a priority of the DISC program. MEDDS will ensure DTR has the capabilities to meet flight and ground test execution requirements, which consist of distributing real-time mission video, audio, data, and situational awareness information to MDA analysts, senior leaders, Combatant Commands (COCOMs), and industry partners.

The contractor shall design and implement MEDDS in an expedited phased approach with minimal impact and risk to MDA test support. The MEDDS asset shall be capable of operating on multiple secure MDA and DoD-provided and approved data networks to protect classified communication and processing.

3.1.1.1 During a portion of this ordering period, MDA requires test support, operation and sustainment of the capabilities provided by TSS and MD3S. The contractor shall retain the capabilities of these systems for the minimum time required to transfer test support requirements responsibilities to MEDDS.

3.1.2 The contractor shall provide personnel, resources, project management, operations, and sustainment to perform MDA mission and test execution. Contractor action or inaction shall not cause delay or missed tests or events. The contractor shall provide expedited support to documented requirements during Periods of Interest (POI), Periods of Heightened Activities (POHA), and at other times directed by MDA.

3.1.3 The contractor shall perform all RDT&E and O&S functions. This shall include in-progress customer tests, experiments, exercises, and other customer programs as well as upgrade and modernization tasks involving facility, hardware, software and legacy system efforts. The contractor shall perform equipment inventory management, small item and mission consumables purchasing, and logistics.

3.1.4 Reserved

3.1.5 Reserved

3.2.1.2 The contractor shall perform a wide variety of tasks (to be defined in individual Task Orders) and support the mission and functions of the MEDDS program as described in this PWS. The contractor’s efforts shall be under the direction of the Government Program Manager (PM). The contractor’s management team shall provide the overall management of program, personnel, planning, quality control, direction, coordination, and reviews to assure PWS compliant contract performance.

3.2.1.3 The contractor shall ensure that technical capability is available to provide responses to specific tasks. The contractor shall provide and sustain a trained workforce capable of providing the services specified in the MEDDS Task Orders. Ensuring completion of all MDA required training, continuing education, certification courses, and other similar events shall be the responsibility of the contractor. The contractor shall manage task priorities, short-notice suspenses and operational constraints to meet schedule requirements on all Task Orders.

3.2.1.4 The contractor shall utilize corporate best practices, program processes and procedures, standard operating procedures, and other directives.

3.2.1.5 The contractor shall improve performance, consolidate DISC program assets where practical, deliver training material, and develop and provide DISC program operator asset training.

3.2.1.6 The contractor shall manage program, cost, schedule, performance, risks, subcontracts, vendors, and data to deliver and sustain an effective, suitable and affordable DISC program.

3.2.1.7 The contractor shall understand the interdependencies between the test planning process and the MDA IMTP to align DISC Program processes, procedures and products.

3.2.1.8 The contractor shall plan, host, and conduct Program Management Reviews (PMRs) on a quarterly basis unless deferred by the government, participate in working groups and technical interchange meetings, and conduct planning with the Government and sub-contractors for strategic planning and support for other program activities.

3.2.1.9 The contractor shall support the MEDDS Program by publicizing and participating in various exhibits, symposiums, and conferences accessible to the MDA Community up to two times per year.

3.2.1.10 The contractor shall develop, deliver, update, improve, and sustain standard MEDDS Program operating procedures and work instructions.

3.2.1.11 The contractor shall provide an integrated and cross-trained personnel solution across the DISC Contract, as practical. The contractor shall conduct cross training for similar job activities across tasks respective to education and experience levels of the workforce.

3.2.1.12 The contractor shall provide and execute a procurement system that leverages efficiencies across the contract in the area of material purchases and management. These procurement activities include hardware, software, maintenance agreements, consumables, and other equipment as required per Task Order requirements.

3.2.1.13 The contractor shall implement, document and execute shipping and receiving processes/procedures for MEDDS Program operations and mission support activities.

3.2.2.2 The contractor shall develop and deliver a Task Order Management Plan (TOMP) (CDRL A001) that shall define the management system to plan and execute each specific Task Order. The contractor shall delineate the plans for each Task Order, to include a breakout of Direct Productive Labor Hours (DPLHs), travel, materials, a milestone schedule, and a schedule for the planned expenditure of funds.

3.2.2.3 The contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided via a secure data collection site. While inputs may be reported at any time during the FY, all data shall be reported no later than October 31 of each calendar year.

3.2.2.4 The contractor shall obtain authorization from the COR prior to the start of long distance travel. Approval shall be in the form of a Government-signed Travel Request stating the intended location, mode of travel, dates and supporting reason. Upon approval of the travel request, the contractor is authorized to vary the dates of the itinerary by two weeks, with notice to the COR.

3.2.2.5 The Contractor shall deliver and update a Data Accession List (DAL) (CDRL A002). The DAL shall identify all contractor and major subcontractor internal data, which has been generated by the contractor in compliance with the work effort described in this PWS.

3.2.2.6 The contractor shall deliver an Organizational Conflict of Interest (OCI) Management Plan (CDRL A003) describing:

a) The procedures the Contractor will utilize to identify and evaluate its contracts as well as those of its subcontractors for the existence of conflicts of interest.

b) A description of the approach (engagements, subcontract policies, provisions, penalties, etc. as appropriate) the Contractor will utilize to ensure its subcontractors proactively identify and report conflicts.

c) The procedures the Contractor will utilize to avoid, mitigate or terminate conflicts of interest.

d) The procedures for reporting actual or potential conflicts of interest to the Contracting Officer.

e) A description of the organizational unit and personnel responsible for implementing the Contractor’s OCI Management approach to include responsibility for overall management, oversight, and enforcement.

f) The procedures for protecting agency information that could lead to an unfair competitive advantage if disclosed, collecting disclosure agreements covering all individuals, subcontractors, and other entities with access to agency-sensitive information, and physical safeguards, if necessary.

g) The requirements and procedures for OCI training and education of employees.

h) The enforcement mechanisms or approaches used by the Contractor to ensure compliance with company OCI policy.

The contractor will identify any subcontractor at any tier with a subcontract that exceeds $20 million, by providing comments identifying the subcontractors, or, if the subcontractors have not been selected, the subcontracted effort in this category and provide to the Government. The Contractor shall require and flow down the requirement for CSDR reporting from subcontractors at any tier with a subcontract that exceeds $50 million or any subcontracts valued between $20 million and $49 million that are designated by the Government as being high risk, high value, or high technical interest. If, for subcontracts that exceed $50 million, the Contractor changes subcontractors or makes new subcontract awards, the Contractor shall notify the Government.

A conference will be held finalizing the contractor’s standard cost and software data reporting process to satisfy the guidelines contained in the DoD 5000.04-M-1, CSDR Manual, and the requirements in the Government-approved CSDR plan for the contract, DD Form 2794.

3.2.3.2 The contractor shall accept or propose changes to expand the Government-provided preliminary WBS as provided in the CSDR Plan DD2794 to represent how the contractor plans to accomplish the entire contract scope of work consistent with the contractor’s internal organizations and processes.

3.2.3.3 The Contractor shall support the Common Cost Methodology Working Group (CWG) as described in MDA Instruction 4250.02 – Ballistic Missile Defense System Cost Estimates. The Contractor (and major subcontractors) shall attend quarterly CWG meetings, perform cost estimating analysis in accordance with the MDA Cost Estimating and Analysis Handbook, and provide data to support the CWG. This support includes the provision of historical cost data on relevant programs, current executing/accounting data, and Parametric and Cost Estimating Relationships, including estimate results in base year and then year with point estimate and confidence level; the name, content, scope, and corresponding WBS element number as indicated on the CSDR plan; ground rules and assumptions including quantities, schedule, production rates, state of technology, program base year, inflation rates, hardware configuration, software configuration, and baselines used; methodology including applied learning and rate curve with first unit cost, slopes, type of curve (unit or cumulative average), analogies, basis of analogies, factors applied, basis for factors applied, rationale for manpower levels used in man-hour buildups; source information used to determine all methodology parameters; estimate calculations including formulas used to derive the estimate and identification of key parameters; the phasing methodology used to determine the allocation of costs across fiscal years; the means and standard deviation of the point estimate with an explanation of methodology/tools applied and source of risk parameters; a cost track identifying and explaining changes from prior estimates, including the deltas and reasons for change. The data provided must be consistent with cost report data. The Contractor shall be responsible for researching and explaining any discrepancies between common cost methodology and contractor cost data reports. The Contractor shall flow the above requirements to subcontractors. The Contractor shall ensure proper technical and cost expertise is available for focused analysis sessions as directed by the CWG chair. The CWG chair will be designated by the Government Program Office.

3.2.3.4 The contractor shall establish and maintain a management system for controlling cost, schedule, and performance. The contractor shall track and report at the Accounting Classification Reference Number (ACRN) and Sub-CLIN level. As coordinated with the COR, each DISC O&S task shall be accounted for separately (including the specific accounting number tied to each task). Funding provided for each DISC test support task shall be documented and maintained as a separate ACRN for each test in CDRL A006, Contract Funds Status Report (CFSR) and CDRL A007, Funds and Manpower Expenditure Report (FMER). In the event separate ACRNs are not provided, the contractor shall track and report individual test event cost in a manner acceptable to the COR.

3.2.3.5 The contractor shall provide a Monthly Status Report (CDRL A008) to report events and accomplishments of the previous month’s efforts, including a listing of travel taken during the reporting period and the results of that travel.

3.2.3.6 The contractor shall prepare, maintain and submit comprehensive reports detailing DISC Task Order activities by Government fiscal year funding (CDRLs A006, A007).

3.2.4 Small Business

In order to gather data and assess the Contractor’s small business utilization compliance with FAR 52.219-8 (Utilization of Small Business Concerns) and DoD Class Deviation 2020-O0008, Revision 1 - Limitations on Subcontracting for Small Business, the Contractor shall submit a report in accordance with Table 3.2.4-1 in this paragraph. If applicable, the Table included in the report shall identify the similarly situated entity (SSE) category(s) of small business concerns, and dollars and percentages of subcontracting to SSEs. “Similarly situated entity” means a first-tier Subcontractor, including an independent Contractor, that has the same small business program status as that which qualified the prime contractor for the award and that is considered small for the NAICS code the prime contractor assigned to the subcontract the Subcontractor will perform. The report shall be submitted annually, by October 30 of each year for the life of the contract; and a final report shall be submitted 30 days prior to the end of the contract year. The Contractor shall submit the reports using the table format below (CDRL A009).

Table 3.2.4-1 – Example Table – Small Business Utilization Dollars and Percentages Total Funded Contract Dollars: $000,000

SB Prime

Small Business

HUB Zone Small Business

Veteran Owned Small Business

Service-Disabled Veteran-Owned Small Business

Small Disadvantaged Business

Women-Owned Small Business

Note: Any work that a similarly situated entity further subcontracts will count toward the prime contractor’s 50 percent subcontract amount that cannot be exceeded.

3.2.5.2 The contractor shall perform a physical inventory of Government Property (i.e., GFP and CAP), regardless of unit acquisition cost, annually (at a minimum). When directed by the Contracting Officer, the contractor shall submit a Material Inspection and Receiving Report as required by DFARS 252.232-7003 for the delivery of CAP by using the Wide Area Workflow (WAWF) module in the Procurement Integrated Enterprise Environment (PIEE) e-Business Suite.

3.2.5.2.1 The contractor shall utilize a documentation and property management database to monitor and track changes to documentation and MDA property. A documentation and property management database residing on a government server is available for use by the contractor.

3.2.5.3 The contractor shall provide a unique item identifier (UII) for delivered items, to include CAP in accordance with DFARS 252.211-7003.

3.2.5.4 The contractor shall repair or replace items of Government Property that have not been deemed as excess to the contract when the repair or replacement costs does not exceed $500.00. The Contracting Officer's written authorization is required prior to the repair or replacement of Government Property items when the repair or replacement costs exceeds $500.00. If a Government Property Administrator is assigned to the contract, his or her approval/recommendation is required prior to the request being sent to the Contracting Officer. The contractor shall support the repair or replacement costs exceeding $500.00 with quotes from a minimum of three (3) sources.

3.2.5.5 Proceeds from the disposal of scrap shall be credited to overhead. Other proceeds received from the disposal of Government Property shall be applied as a credit against the next contract billing.

3.2.5.6 In preparation for the prompt completion of contract closeout actions, the contractor shall perform a final inventory at the end of the period of performance (CDRL A010). The contractor shall coordinate the final inventory with MDA to ensure that a Government representative is present. This final inventory requires the physical count of Government Property (both GFP and CAP) at all locations (to include subcontractor locations) and subsequent reconciliation against the contractor's and subcontractor's Property Management System records. Once Government Property close-out actions are complete, the Contractor shall submit a written certification stating that Government Property closeout actions have been completed and that no Government Property remains accountable against this contract. This certification includes subcontractor locations.

3.2.6.2 Contractors with Government-furnished computer equipment or other computers connected to the Government computer networks shall comply with DoD Instruction 8500.01 series and applicable future Government network requirements.

3.2.6.3 The contractor shall support the development, operation and accreditation of all facilities in which the DISC Program has oversight responsibility. This includes development of documentation required to demonstrate compliance with administrative security requirements to support MDA Test operations.

3.2.6.4 Off-site operation and sustainment in a contractor provided facility may be required if it is determined that the use of approved classified storage/space could be a benefit to the government. Contractor shall maintain a “TOP SECRET" facility clearance, with approved safeguarding at the “SECRET” level.

3.2.6.5 The contractor shall continuously demonstrate to MDA that it is properly staffed and capable of handling, processing, and protecting sensitive classified information and information systems IAW with DoD and MDA security requirements. Employees shall be citizens of the U.S. or lawful permanent residents. All XTR operators shall be required to obtain and maintain TOP SECRET security clearance. The number of personnel that require TOP SECRET security clearances to support PCRSS, MEDDS, and other DISC operations shall be maintained at the minimum level adequate to execute contract requirements.

3.2.6.6 The contractor shall maintain required sensitive and classified information required to support and execute program and mission support operations.

3.2.7.2 The contractor shall ensure that personnel who have access to MEDDS comply with DoDD 8140 and DOD 8570.01-M to maintain a certified cybersecurity workforce for the DISC Program. The training required to obtain/maintain the required certifications shall be the responsibility of the contractor. The training shall provide the employees with the information needed to keep abreast of the latest cybersecurity best practices and available technologies.

3.2.7.3 The contractor shall perform site surveys and identify infrastructure and cybersecurity equipment deficiencies to enable MDA to remediate any issues that arise. Also, the contractor shall support technical cybersecurity and physical security assessments.

3.2.7.4 The contractor shall prepare and maintain an Enterprise Mission Assurance Support Service (eMASS) instance for the system with required artifacts to ensure acceptance by the Authorizing Official (AO). Artifacts include providing vulnerability scans, a complete listing of Ports, Protocols, and Services (PPS) employed by each enclave, evidence of MDA required periodic cybersecurity exercises and reviews, and standard operating procedures (SOPs) for each system. RMF artifacts to be submitted monthly (CDRL A011) and annually (CDRL A012).

3.2.7.5 The contractor shall report all security incidents to MDA DTR ISSM Team and/or Local Security Manager as appropriate based on incident response policies and procedures. The contractor shall respond to and implement all Cybersecurity Tasking Orders (CTO) issued by the MDA Computer Emergency Response Team (CERT).

3.2.7.6 Safeguarding Covered Defense Information and Cyber Incident Reporting:

1. The Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting” (hereafter referred to as “DFARS 7012”) requires the contractor to provide adequate security on covered contractor information systems.

a. “Covered defense information” means unclassified controlled technical information or other information (as described in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html) that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government wide policies, and is—

i. Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract; or

ii. Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

b. Hereafter, Covered Defense Information (CDI), CUI, Technical Data, or Operationally Critical Support information is referred to as CUI.

c. Within five (5) business days after contract award the successful offeror shall meet with MDA to specifically identify programmatic information that will be categorized as CUI. The Government intends that all CUI will be identified and categorized NLT 30 days after award.

d. The Contracting Officer will determine final resolution of unresolved differences in the categorization of Covered Defense Information (CDI), CUI, Technical Data, Operationally Critical Support Information or other programmatic information.

2. Distribution and Accountability of CUI: The Contractor shall implement practices to restrict the unnecessary sharing and/or flow of CUI down the entire supply chain based on need-to-know; to include, but not limited to, minimizing the information provided on contracts/purchase orders for procurement of logistics and transportation services, systems, or critical components.

3. The Contractor shall develop and deliver via encrypted email or secure file transfer site at XXXXX@mail.com or https://XXXXX.mil an Information Management and Control Plan (IMCP) to its direct customer (i.e. the Government or the Contractor’s next-level up contractor). The IMCP is limited to five (5) pages (CDRL A013) that shall:

a. Identify practices the contractor implements to restrict the unnecessary sharing and/or flow of CUI down the entire supply chain based on need-to-know, to include, but not limited to, minimizing the information provided on contracts/purchase orders for procurement of logistics and transportation services, systems, or critical components (see #2).

b. Address procedures for reporting a cyber-incident as defined in DFARS 7012.

c. Document the process by which the contractor System Security Plans (SSPs) and Plan of Action and Milestones (POAMs) are developed and maintained to protect CUI within the contractor’s/subcontractor’s unclassified information technology systems.

d. Include a high-level summary of the Contractor’s SSP and POAM for their applicable network as Appendix A, SSP & POAM Summary, to the IMCP, to include each of the 14 NIST 800-171 control families (not at the individual control level). The SSP and POAM summary (Appendix A) are exempt from the five (5) page limitation of the IMCP.

e. Representation from the Contractor that Paragraph 4 has been completed.

4. IMCP Supplier Compliance Supplement (Appendix B): If the Contractor has suppliers that receive or generate CUI in performance of the contract, the Contractor shall document and maintain on file an IMCP Supplier Compliance Supplement (“Appendix B”). An Example IMCP Appendix B Template is provided in Table 3.2.7.6-1. The Supplement shall contain the following:

a. List the Contractor’s direct customer (i.e. the Government or the Contractor’s next-level up contractor), contract number, address and contract point of contact information.

b. List the Contractor’s first-tier suppliers that receive or generate CUI in performance of the contract. Company Name, DUNS, Address, Contract Number. If CUI is not passed to or generated by any next-tier supplier, follow instructions 1-6 in paragraph 4.i and state NA in the “Supplier Name” field of the Supplier Compliance Supplement (Appendix B). Other fields (instructions 7-11) of the Supplier Compliance Supplement (Appendix B) should remain blank.

c. Confirm Contractor has identified and flowed only CUI which is needed for their first-tier suppliers

d. Confirm the 7012 clause is flowed to their first-tier suppliers

e. Prime Contractor shall include the IMCP Supplier Compliance Supplement (Appendix B) with delivery of IMCP CDRL to its direct customer (i.e. the Government).

f. Non-Prime Contractors (within the extended supply chain) shall securely deliver the IMCP Supplier Compliance Supplement (Appendix B) via encrypted email or secure file transfer site at XXXXX@mail.com or https://XXXXX.mil directly to the Government within X business days after their subcontract is awarded. The prime contractor shall confirm with MDA when their 1st Tier Subcontracts are awarded.

g. All IMCP Supplier Compliance Supplements shall be updated semiannually at a minimum but no more than four (4) times per year.

h. Subcontractor information delivered under paragraph 4.e or 4.f shall be marked as “Company Name – Proprietary” and shall be protected accordingly.

i. Template Instructions:

1. Submitted by: Prime or Non-Prime contractor submitting the IMCP Compliance Supplement

2. Subcontracted by: State the Company Name, the submitting Non-Prime is supporting under this Government contract. If the Prime contractor to the Government state “Prime Contractor” in this field

3. Purpose: Identify Non-Prime contractors/Suppliers who collect, develop, receive, transmit, use or store CUI

4. Date: Date of submission

5. Government Contract Number: List the Government Contract number you are supporting

6. Supplier Name: List suppliers that collect, develop, receive, transmit, use or store CUI in support of this contract.

7. DUNS: Dun & Bradstreet number

8. Supplier Point of Contact: Name, email and phone number from each supplier.

9. Does the Subcontract contain DFARS 252.204-7012: Yes or no.

10. Has the supplier completed the Self-Assessment IAW NIST 800-171r: Yes or no.

11. Does the supplier have a System Security Plan and Plan of Action and Milestones IAW NIST 800-171r: Yes or no.

5. Flow Down to next-tier suppliers: The successful offeror (PRIME) shall flow down their accepted IMCP procedures and requirements, including the IMCP Supplement (Appendix B), to their next tier suppliers and require flow down iteratively to any next tier supplier.

6. The Government reserves the right to request, review and/or inspect the contractor/subcontractor IMCP (including appendices) to verify implementation of the Information Management and Control Plan and DFARS 7012. Further, the Government reserves the right to use the IMCPs to iteratively navigate through the tiered supply chain. A contractor will only have visibility to their next-tier supplier(s) IMCP’s – sections 3a-e. Government reserves the right to request delivery of the SSP and POAM from the prime contractors and applicable Non-Prime or subcontractors included in the supply chain. Delivered data provided as part of the IMCP will be handled and classified by the Government as source selection sensitive information and stored accordingly.

Table 3.2.4-1 – Example Table – IMCP Supplier Compliance Supplement

(email and phone)

3.2.8.2 The contractor shall support the DISC program objectives by developing, delivering, improving and sustaining software products for mission planning, mission operations, data collection, data distribution, data transfer, data compression, telemetry, visualization, and telemetry algorithm development, truth and metrics. These products and toolsets include, but are not limited to, DISC program government owned software, tools, and databases, data management software, test analysis software, situational awareness and real-time data transfer software, test resource planning and conflict/resolution software, and telemetry analysis software.

3.2.8.3 The contractor shall maintain in a useable format current and revised versions of government provided software and developed software and software tools used to support the DISC program.

3.2.8.4 The contractor shall ensure compliance with the MDA Software Assurance Overlay, Policy Memorandum NO. 16 (dated September 22, 2020) on DISC developed software under the cognizance of the MDA Authorizing Official (AO).

3.2.8.5 The contractor shall document threat analysis activities in a Software Threat Assessment Report (STAR) or equivalent document (CDRL A014)

3.2.8.6 The contractor shall document the results of software/firmware attack surface analysis and reviews in a Software Attack Surface Analysis Report (SASAR) (CDRL A015).

3.2.8.7 The contractor shall document the tools, techniques, and results of Non Developmental Item (NDI) software (e.g. Commercial/Government/and Open Source) supply chain vulnerability assessments, static source code assessments, dynamic scans and penetration testing assessments, and manual review and testing of cybersecurity functions in a Software Assurance Evaluation Report (SAER) (CDRL A016).

3.2.8.8 The contractor shall document the results of software assurance activities from; threat assessment, attack surface analysis, static, dynamic, manual testing, supply chain risk management, vulnerability and risk assessment and concludes with plans of action and milestones to mitigate risks to an acceptable level in a Software Vulnerability Assessment Report (SVAR) (CDRL A017).

3.2.8.9 All computer software developed during the performance of the contract shall be developed with Government funding, shall be characterized as Unlimited Rights computer software (see DFARS 252.227-7014), shall be delivered to the Contracting Officer having no restrictions to use and distribution by the Government, and shall be delivered to the Government as both source and executable code. The contractor shall request in writing to the Contracting Officer for approval and authorization for any commercial software proposed to be utilized and/or modified. The Contracting Officer will be responsible for approval and authorization for the commercial software to be used, and/or modified for use during the contract for operation of the DISC program. The contractor shall not incorporate prior developed computer software in computer software developed during the performance of the contract without prior written approval authorization from the Contracting Officer. Any modifications to prior developed computer software, and subsequent required delivery of the modified computer software, shall be considered a "Special Work" pursuant to DFARS 252.227-7020, Rights in Special Works, which requires grant to the Government of unlimited rights and/or grant to the Government of a royalty-free, world-wide, nonexclusive, irrevocable license to use and distribute the computer software.

3.2.8.10 No limited rights or restricted rights technical data, operating systems, and/or computer software, or proprietary commercial software shall be delivered during the performance of the contract, unless the contractor requests in writing and receives in writing from the Contracting Officer an authorization to incorporate limited rights and/or restricted rights information, and/or proprietary commercial software in operations of the DISC program and/or in deliverables under the contract.

3.2.9.2 The contractor shall identify and develop a system of metrics to track those processes that are critical to DISC Program operations. These processes include customer satisfaction, system and program performance, maintenance activities, and problem resolution statistics. Metrics reports shall be generated and submitted monthly as part of the monthly status report (CDRL A008) or upon request by the COR and Task Order Monitor.

3.2.9.3 The contractor shall support quarterly Quality Assurance Surveillance Plan (QASP) meetings and provide a self-assessment.

3.2.10 Environment, Safety, and Occupational Health

The contractor shall integrate applicable federal, state, and local ESH laws and regulations, Executive Orders, treaties, and policies into all phases of program execution. Applicable facilities, processes, and operations (including those of subcontractors) shall be compliant to ensure a safe work environment in accordance with FAR 23, “Environment, Energy and Water Efficiency, Renewable, Energy Technologies, Occupation Safety, and Drug-Free Workplace.”

3.2.11 Transition

The contractor shall manage and execute the transition of the current MDA-owned TSS and MD3S requirement for data acquisition, display, and distribution system capabilities into the MEDDS. The contractor shall implement this transition in an expedited phased approach designed for minimal impact and risk to MDA test support.

The contractor shall design, develop and execute a comprehensive Government approved transition plan from current TSS and MD3S systems to ensure an efficient process and orderly transition with minimal disruption to test operations. The transition plan shall include, but not limited to, technical approach, identification and mitigation of risks, hardware reuse, and temporary sustainment of legacy systems.

The priority of the MEDDS transition plan shall be to provide uninterrupted test support with minimal risk to all elements of ongoing and future test operations. For the period of transition, the contractor shall support sustainment of the legacy capabilities, associated facilities, and on-going missions.

The objective of this effort is to acquire MEDDS Mission and Test engineering support for described systems and capabilities for which MDA/DTR has responsibility. The mission and test support is defined as the activity necessary to develop requirements, plan, manage, procure, integrate, checkout, test, train, support test execution, and provide post test data products.

Mission-specific requirements will be provided to the contractor in Government provided documentation such as Universal Documentation Systems (UDS), Data Management Plans, Count-Down Checklists, Test Support Plans, Launch Constraint Documents, Security Classification Guides and Operations Security (OPSEC) documents, Asset Deployment Schedules, and Mission Execution calendars.

3.3.1.1 The contractor shall perform mission-planning support to meet test requirements, to include day-to-day mission coordination, implementation, documentation of mission requirements, analysis, development of deployment plans, mission countdown checklists, concept of operations (CONOPS), and provision planning.

3.3.1.2 The contractor shall coordinate, facilitate, and prepare responses to MDA mission planning requirements in the UDS format. The contractor shall attend and participate in UDS documentation reviews and other telecons and meetings. The contractor shall prepare presentations, as well as take, assemble, and distribute meeting minutes.

3.3.1.3 The contractor shall schedule and coordinate MDA mission testing requirements that require the deployment of MEDDS assets to test locations.

3.3.1.4 The contractor shall access MDA hosted electronic websites and portals via Government authorized access for download of technical documentation pertaining to the tests being scheduled and coordinated.

3.3.1.5 Reserved

3.3.1.6 Reserved

3.3.1.7 The contractor shall provide transport and movement of MEDDS components, spares, and associated equipment worldwide to include appropriate packaging, and crating for safe transport of the equipment. Transportation methods may include ground, air, rail, barge, FEDEX, UPS, and USPS to meet mission requirements. The contractor shall provide for temporary storage facilities at field or remote sites for MEDDS components or support equipment to meet mission requirements. The contractor shall obtain approval from the COR prior to shipping when cost is expected to exceed $1,000.

3.3.1.8 The contractor shall participate in planning, execution, and analysis for test events. Events include, but are not limited to, planning meetings/conferences, site surveys, requirements reviews, system setup, integration, troubleshooting, checkout, system operation, and post-test reviews.

3.3.1.9 The contractor shall package, ship, and transport classified materials for support of mission needs. Transporting materials may include hand carrying classified materials.

3.3.1.10 The contractor shall develop, produce, and deliver pre and post test data products in accordance with MDA requirements.

3.3.1.11 Upon the request of the Asset Manager, the contractor shall coordinate with the Office of the Chief Information Officer (CIO) to identify, define, and coordinate requirements to facilitate new MDA circuit procurement for test and data collection events.

3.3.1.12 The contractor shall prioritize support for network management, monitoring and evaluation of network segments for projected utilization with the CIO team for MDA CIO supported and managed test networks.

3.3.1.13 The contractor shall configure all DTR systems in their purview in accordance with published Security Technical Implementation Guides (STIGs), Security Requirements Guides (SRGs), and other security best practices found from vendors, industry, and other reputable sources.

3.3.1.14 The contractor shall perform all required vulnerability scans, system updates, and upgrades as documented in each system’s security plan, policy documents, in accordance with the system’s standard operating procedures, and DoD and MDA guidance.

3.3.1.15 The contractor shall ensure a current Authorization to Operate (ATO) is in place for each system for all missions. For each mission, the contractor shall identify any interconnections, new requirements, or other changes to the system baseline to support a test event and document the exception accordingly for proper approval for test execution.

3.3.4.1.1 The contractor shall provide MEDDS mission support functions for MDA, external organizations, and other events, as described below and specified for the test events contained in the PWS Exhibit, “DISC MEDDS Test Support Summary Task Order Year 1, 8 Nov 2020-7 Nov 2021 IMTP 21.1”.

3.3.4.2 The contractor shall provide support for MDA evaluations, demonstrations, interoperability tests/events, certification tests, simulations, flight tests, ground tests, and operational testing. The contractor shall manage system capacity, procedures, and configuration control to support multiple same day test events.

3.3.4.3 The contractor shall provide expertise in the areas of mission and test audio/video (situational awareness) and data (telemetry, radar, meta-data) distribution over local and wide area networks in a secure environment.

3.3.4.4 The contractor shall provide test support site preparation activities to include, but not limited to, surveys, installations, configuration management, logistics, and capability upgrades.

3.3.4.5 The contractor shall coordinate with data source providers to ensure that data transport systems are configured to receive and relay source data. The contractor shall modify formats as required; distribute resulting data streams across the MEDDS enterprise to execution nodes, acquisition sites, and remote mission monitoring nodes.

3.3.4.6 The contractor shall operate the Radio Frequency Telemetry Validation Unit (RFTVU) and Flight Termination System Test Set (FTSTS) for telemetry checkout and simulation recording activities required to support flight test vehicle Integration and Check Out (I&CO), and verification prior to the test execution phase of operations. These activities shall include Missile Assembly Building (MAB) RF checks, providing mission simulation test recordings, aircraft RF and FTSTS I&CO, and support of captive carry events of flight vehicles.

3.3.4.7 The contractor shall operate RF test sets to radiate multiple TM streams at assigned mission frequencies from multiple acquisition sites to support extended missile integration, testing, validation of TM ground station configurations, and conduct troubleshooting activities.

3.3.4.8 The contractor shall support flight test vehicle power-up events for on-site TM system checks and provide data to remotely located subject matter experts (SMEs) and analysts.

3.3.4.9 The contractor shall support Test Resource Manager (TRM) and Test Execution Team console training.

3.3.4.10 The contractor shall provide support of legacy MEDDS systems used to disseminate, record, relay, store, and forward real time Situational Awareness (SA) during MDA test events.

3.3.4.11 Reserved

3.3.4.12 The contractor shall provide assistance in the development and maintenance of mission and test schedules, reports, reviews and other test documentation.

3.3.4.13 The contractor shall provide coordination and liaison services between MEDDS and MDA CNet/MDA UNet representatives.

3.3.4.14 The contractor shall provide on-call network and computer systems engineering and architecture troubleshooting support for MEDDS during periods of heightened awareness or interest.

3.3.4.15 The contractor shall…