LEXI_BAA Attachment 8_Vol3_Admin Policy and Security.docx

HR001120S0056 Lexi Program BAA Volume 3: Administrative, National Policy, and Security Requirements Document Template

The Administrative and National Policy Requirements document must be completed in full and included as part of the proposal submission. Do not delete any portion of this document.

All pages shall be formatted for printing on 8-1/2 by 11-inch paper with 1-inch margins and font size not smaller than 11 point. Font sizes of 8 or 10 point may be used for figures, tables, and charts.

The Administrative and National Policy Requirements document must be in .pdf, .odx, .doc, or .docx formats. Submissions must be written in English.

No page limit has been specified for the Administrative, National Policy, and Security Requirements document.

Source Selection Information – See FAR 2.101 and 3.104

DARPA-BAA-16-22 2

[PRIME ORGANIZATION LOGO]

HR001120S0056 Lexi Volume 3: Administrative, National Policy, and Security Requirements

Proposal Title

Proposer Organization

Technical Area(s)

Proposer Reference Number, if any

Address:

Telephone:

Email:

Address:

Telephone:

Email:

Place(s) of Performance

Period(s) of Performance

Months

Organization:

Organization Type:

Year 2: $ Year 3: $ Year 4: $ Total: $

Data Universal Numbering System (DUNS) number[endnoteRef:1] [1: The DUNS number is used as the contractor identification code for all Government procurement-related activities. Go to http://fedgov.dnb.com/webform/index.jsp to request a DUNS number (may take at least 1 business day). ]

Taxpayer identification number (TIN)[endnoteRef:2] [2: See https://www.irs.gov/individuals/international-taxpayers/taxpayer-identification-numbers-tin for information on requesting a TIN. Note, requests may take from 1 business day to 1 month depending on the method (online, fax, mail).]

Commercial and Government Entity (CAGE) code[endnoteRef:3] [3: A CAGE Code identifies companies doing or wishing to do business with the Federal Government. See BAA Section VI.B.2 for further information.]

Administration Office POC at Defense Contract Management Agency (DCMA)[endnoteRef:4] or Office of Naval Research (ONR)[endnoteRef:5], if known [4: https://pubapp.dcma.mil/CASD/CasdSearch.do.] [5: http://www.onr.navy.mil/Contracts-Grants/Regional-Contacts.aspx.]

Name:

Address:

Telephone:

Audit Office POC at Defense Contract Audit Agency (DCAA)[endnoteRef:6], if known [6: http://www.dcaa.mil/Home/Locator?title=Locator]

Name:

Address:

Telephone:

Date Proposal was Prepared

Proposal Validity Period (minimum 120 days)

Table of Contents

HR001120S0056 Volume 3 9 Team Member Identification [Provide a list of all team members including the prime, subawardee(s), and consultant(s), as applicable. Identify specifically whether any are a non-US organization or individual, FFRDC and/or Government entity. Use the following format for this list.]

Team Member Identification List

Prime

Subawardees/Consultants

Requirements for teams that include Government Entities and/or Federally Funded Research and Development Centers (FFRDCs) Are any of the team member organizations (prime or subawardee) a Government entity or FFRDC? No Yes [If yes, provide the information outlined below in accordance with BAA Section 3.1.1.]

a. Proof of Eligibility to Propose [Provide documentation citing the specific authority that establishes the applicable team member’s eligibility to propose to Government solicitations; include: (1) statutory authority; (2) contractual authority; (3) supporting regulatory guidance; and (4) evidence of agency approval for applicable team member participation. For FFRDCs, this documentation must be in the form of a letter on official letterhead from their sponsoring organization and must also include a statement of compliance with the terms and conditions of the associated FFRDC sponsor agreement, as applicable.]

b. Statement of Unique Capability [Provide a statement that demonstrates the work to be performed by the Government entity or FFRDC team member is not otherwise available from the private sector.]

Organizational Conflict of Interest Affirmations and Disclosure [In accordance with Section 3.2 of the BAA, provide the following information.]

a. Are any of the proposed individual team members or their respective organizations (whether prime or subawardee or consultant) currently providing SETA, A&AS or similar support to DARPA? No Yes

b. Did any of the proposed individual team members or their respective organizations (whether prime or subawardee or consultant) provide SETA, A&AS or similar support to DARPA within one calendar year of this proposal submission? No Yes

[If you answered “Yes” to 3.a OR 3.b, provide the following information for each applicable team member:

· The name of the DARPA office receiving the support;

· The prime contract number;

· Identification of proposed team member (subawardee, consultant) providing the support; and

· An OCI mitigation plan in accordance with FAR 9.5.]

c. Are there any other potential Organizational Conflicts of Interest involving any of the proposed individual team members or their respective organizations (whether prime or subawardee or consultant)? No Yes [If yes, provide the following information for each applicable team member:

· Identification of applicable team member; and

· An OCI mitigation plan in accordance with FAR 9.5.]

Intellectual Property (IP) In accordance with BAA Section 4.2.3 (pages 15-16), provide the following information, as applicable. Note: the Government will assume unlimited rights to all IP not explicitly identified as restricted in the proposal.

a. Technical Data and Computer Software Are you asserting any IP restrictions on any technical data or computer software that will be delivered to the Government?

No Yes [If yes, list all proprietary claims to results, prototypes, deliverables or systems supporting and/or necessary for the use of the proposed research, results, prototypes and/or deliverables. Provide a short summary for each item asserted with less than unlimited rights that describes the nature of the restriction and the intended use of the intellectual property in the conduct of the proposed research. Use the following format for these lists.]

NONCOMMERCIAL

Asserted Rights Category

Name of Person Asserting Restrictions

COMMERCIAL

Asserted Rights Category

Name of Person Asserting Restrictions

b. Patents Does the proposed effort involve using patented inventions that are owned by or assigned to the proposing organization or individual? No Yes [If yes, provide documentation proving ownership or possession of appropriate licensing rights to all patented inventions to be used for the proposed project. If a patent application has been filed for an invention, but it includes proprietary information and is not publicly available, provide documentation that includes: the patent number, inventor name(s), assignee names (if any), filing date, filing date of any related provisional application, and summary of the patent title, with either: (1) a representation of invention ownership; or (2) proof of possession of appropriate licensing rights in the invention (i.e., an agreement from the owner of the patent granting license to the proposer).]

Human Subjects Research (HSR) Does the proposed work involve HSR? No Yes [If yes, provide evidence of or a plan for review by an institutional review board (IRB). See BAA Section 4.2.3 (page 15) and http://www.darpa.mil/work-with-us/additional-baa for information on this subject.]

Animal Use Does the proposed work involve animal use? No Yes [If yes, provide a brief description of the plan for Institutional Animal Care and Use Committee (IACUC) review and approval. See BAA Section 4.2.3 (page 15) and http://www.darpa.mil/work-with-us/additional-baa for information on this subject.]

Controlled Unclassified Information (CUI) and Controlled Technical Information (CTI) Management Plan [See BAA Section 6.1.2 for additional information and definitions of CUI and CTI.]

[Describe how the proposing institution and subcontract organizations manage CUI and CTI, including details of access control for research designated as CUI and CTI, information systems security protocols, storage, communicating unclassified fundamental research with foreign nationals, and risk mitigation strategies for unclassified research that may ultimately become CUI and/or CTI as the research proceeds.]

Security Requirements

[Describe an in-depth security approach/architecture for protecting technical objectives, identify best-of-breed security and protection practices response addressing physical security, describe information systems security, multi-level security, and sub-contractor/vendor oversight.]

a. Program Protection Implementation Plan (PPIP) [The Government will provide a Program Protection Plan (PPP) to performers selected for award to guide program efforts to manage risk to Critical Program Information (CPI) and mission-critical functions and components. The PPP also addresses multi-discipline security requirements. Upon receipt of the PPP, selected performers will have 45 days to submit a PPIP from the date of award execution and the PPIP is a required deliverable during Phase 1. As such, the PPIP is not due with the proposal submission. The PPIP is a contractor-developed document describing how their organization will coordinate and integrate all protection efforts designed to protect CPI and prevent authorized disclosure or transfer of program information in accordance with requirements contained within the program PPP and SCG. The PPIP will describe protection planning specific to Lexi, and will be void of generic, padded verbiage. Selected proposers are encouraged, but not required, to leverage the DARPA-provided PPIP template to ensure all protection requirements are addressed. Transportation security plans are required when transporting classified information and material. Security test plans are required for all sensitive activities testing. All security plans are required 60 days prior to the event.]

[For all SOW tasks and subtasks approved to be completed at a lower classification level or unclassified, the selected performer will identify those tasks in the PPIP, assess risk(s) associated with those tasks being performed at lower classification or outside program channels (observables), and propose risk mitigation via management of data separation and need-to-know among the performer’s team not cleared/briefed to the full level of the program.]

b. Technical Team Security Information [Provide a list of all team participants (subcontractors, vendors). Identify the roles and responsibilities of each team member, the Facility Clearance (FCL) and highest level of classification being worked by each team participant, and known or possible sensitivities between primes and subcontractors/vendors, or between subcontractors and vendors.]

Technical Team Security Information List

Prime

Sensitivities:

Subawardees/Consultants

Sensitivities:

Sensitivities:

c. Security Personnel [Provide resumes for Facility Security Officers (FSOs) and Information Assurance (IA) personnel. Convey the availability, qualification, and commitment of cleared security personnel necessary to fulfill Lexi requirements for information, industrial, personnel, physical, and cyber security, and program protection at each organization (prime, subaward, consultant, or vendor).]

[Acceptable courses and certifications include those offered by DCSA, SPeD, as well as any security-relevant course offered by the DoD and Intelligence Community. FSOs that have not completed required training, Center for Development of Security Excellence (CDSE), FSO Program Management for Possessing Facilities (Course #IS030.CU), or FSO Orientation for Non-Possessing Facilities (Course #IS020.CU) are required to successfully complete within six months of contract award. Acceptable qualifications for IA personnel include certifications commensurate with IA roles and responsibilities, IAW DoD Directive 8140.01, Cyberspace Workforce Management, and DoD 8570.01-M, Information Assurance Workforce Improvement Program. IA personnel that have not completed required training are required to complete within six months of contract award.]

[Provide a list of all security positions, personnel, level of effort, security-related training and certifications received and the date completed.] Security Personnel List

Prime

Subawardees/Consultants

d. Program Protection Working Group (P2WG)

[Identify participants in the team’s P2WG, objectives and deliverables of the team’s P2WG, P2 best practices (if any) employed to protect classified program objectives. Examples of P2 best practices might include contracting, security, or finance practices tailored to secure program execution and protection of CPI (program nicknames, funds transfers, subcontract oversight, use of charge codes, procurements, unique countermeasures, etc).]

[Members of the P2WG ensure collaboration and implementation of protection across all aspects of the program (program management, contracts, finance, technical, etc). P2WG responsibilities include, at a minimum, establishment of P2 for the entire proposer team, development and maintenance of the PPIP, continuous monitoring of P2 implementation and quarterly reporting to DARPA security. Examples of continuous monitoring include quarterly P2 updates provided as quarterly progress reports, identification and proposed mitigation of observables and security risks, oversight of subcontractors and vendors, annual updates to the PPIP, etc. The composition of the P2WG is at the discretion of the proposer and can be updated through the life of the program. However, positions that may add value to the P2WG include: the program manager, contracts officer, finance officer, human resources, chief engineer, technical leads, CPSO, IAM, and subcontractor representatives.]

e. Facilities [Identify all known classified facilities and laboratories required for Lexi program execution, including address, building number (if applicable), and lab/room number. Facilities will be identified for all prime and subcontractor locations, and will identity the accreditation status (new buildout, accreditation pending, restricted area, closed area, etc.), along with identification of the accrediting authority.]

[Provide a list of classified facilities and laboratories.] Facilities List

Prime

Subawardees/Consultants

f. IT Requirements [Identify all classified information system and communication requirements necessary to effectively support Lexi program activities at the appropriate level of classification upon contract award. This includes identification of existing networks at specific locations, as well as identification of new networks and locations required to support the program.]

g. Subcontractor/Vendor Oversight [Provide in detail the adequacy and depth of security handling procedures and staff to administer oversight for all proposed and anticipated team members including subcontractors, vendors, and consultants. Security handling procedures shall address administrative security (DD254s, visit certifications), compliance inspections and staff assistance visits, personnel security (access management), OPSEC, and program protection. CPSOs for selected performers will conduct initial visits to subcontractor sites with classified facilities within 90 days of contract award, and annually thereafter.]

h. Subcontractor/Vendor Oversight [Performers shall comply with all applicable laws and regulations regarding export-controlled items. It is in the interest of both the Government and the performer to be aware of export controls as they apply to the performance of specific DoD contracts. As a result, proposers shall identify export-controlled items subject to Export Administration Regulations (EAR) or the International Traffic in Arms Regulations (ITAR).]

Representations Regarding Proposed Key Personnel

The National Defense Authorization Act (NDAA) for FY 2019, Section 1286, directs the Secretary of Defense to protect intellectual property, controlled information, key personnel, and information about critical technologies relevant to national security and limit undue influence, including foreign talent programs by countries that desire to exploit United States’ technology within the DoD research, science and technology, and innovation enterprise. This requirement is necessary for all research and research-related educational activities.

The following information is required for all senior/key personnel, including Project Director/Principal Investigator and Co-Project Director/Co-Principal Investigator, whether or not the individuals' efforts under the project are funded by the DoD. (Note – Proposers requesting a grant or cooperative agreement do not need to complete this section if they have completed Form 2 as part of their Grants.gov application):

· Degree Type and Degree Year.

· Current and Pending Support, including:

· A list of all current projects the individual is working on, in addition to any future support the individual has applied to receive, regardless of the source.

· Title and objectives of the other research projects.

· The percentage per year to be devoted to the other projects.

· The total amount of support the individual is receiving in connection to each of the other research projects or will receive if other proposals are awarded.

· Name and address of the agencies and/or other parties supporting the other research projects

· Period of performance for the other research projects.

If DARPA receives a proposal without the required information, DARPA may determine that the proposal is incomplete and, as a result, considered non-conforming. As noted in the BAA, a non-conforming submission may be rejected without further review. DARPA reserves the right to request further details from the applicant before making a final determination on funding the effort.