Attachment 3 - SOW Rev 2 Amend 0005.docx

Attachment 3 – SOW M67854-21-R-2053

STATEMENT OF WORK

(Rev. 2 dated 22 January 2021)

1. Scope of Work This Statement of Work (SOW) defines the efforts required for the manufacture and delivery of the Wired in the Defense (WID) Marine Analog Tactical Telephone (MATT) system in accordance with Performance Specification (PSPEC) Version 1.2, as well as logistics information, manuals, and engineering drawings.

2. Background The WID MATT will provide a wired command and control (C2) communication capability. It will be able to operate in a point to point or point to multi-point configuration. It will be able to provide redundant C2 capability that can operate in an environment where radio frequency (RF) is denied or degraded and separate from all data/internet protocol (IP) networks.

3. Documents The following documents form a part of this SOW to the extent specified herein (i.e., “Mandatory Compliance” or “Guidance Only”). The most recent version of the referenced document at the time of contract award shall be used unless otherwise specified. In the event of conflict between the applicable documents and this SOW, the SOW shall take precedence. Nothing in this document, however, supersedes applicable laws and regulations unless a specific exemption has been obtained.

3.2.1. Military Standards (MIL-STD) and Specifications - Mandatory Compliance These latest versions of MIL-STDs and Specifications can be found online at the Acquisition Streamlining and Standardization Information System website at https://quicksearch.dla.mil/qsSearch.aspx or at –Every Spec http://www.everyspec.com/. If not available there, contact the Program Office.

MIL-STD-129 Military Marking for Shipment and Storage MIL-STD-130N Identification Marking Of U.S. Military Property MIL-STD-12 Abbreviations for use on Drawings and in Specifications, Standards and Technical Documents

3.2.2. Federal Standard (FED-STD) – Mandatory Compliance

GEIA-STD-0007 Logistics Product Data Handbook

3.2.3. Government Handbooks (HDBK) – Guidance Only

3.2.4. Other Government Documents – Guidance Only

Unless otherwise stated, the following documents may be obtained from the Document Automation and Production Service, Building 4/D, 700 Robbins Avenue, Philadelphia, PA 19111-5094 or visit http://dodssp.daps.mil:

DI-SESS-81000 Product Drawings/Models and Associated Lists

3.2.5. Non-Government Documents – Guidance Only

(Copies of ASTM documents are available from www.astm.org or American Society for Testing and Materials International, 100 Barr Harbor Drive, West Conshohocken, PA 19428-2959.)

3.2.6. Additional References:

4. REQUIREMENTS

The contractor shall deliver all items identified in Contract Data Requirements List (CDRLs) in accordance with each DD Form 1423 and the CDRL Submission Instructions. Deliverables are referenced by name and reference number after the paragraph containing the requirement for that deliverable.

The contractor shall perform all tasks required and delineated in this SOW to manufacture and test the WID MATT, prepare associated documentation, and deliver both to the Government. The contractor shall provide all materials, equipment, hard tooling, and personnel necessary to perform the tasks in this SOW and deliver the types and quantities of deliverables specified by the contract.

4.1. Wired In the Defense Marine Analog Tactical Telephone

4.1.1 System (Test Article). The items listed below constitute the operational system referenced in the PSPEC, including Section 3.1.2. The system consists of items delivered by the contractor (see section 4.1.2) and items procured by the government either through the contractor (see section 4.1.3 and 4.1.4) or through the Marine Corps supply system. The contractor shall deliver all items listed below as test articles (QTY 80). The items listed below are included in the total system weight for the purposes ofIAW PSPEC 3.1.2.

· WID MATT that meet the specifications listed in the Performance Specification (P-SPEC)

· Any adapters or holders required to meet battery requirements IAW PSPEC 3.2.1 and 3.2.2 (if required)

· External handset One handset per test article, with equal ratio of compatible handset options IAW with PSPEC 3.1.13. For example, if two different handset solutions are proposed, provide one of each solution.)

· Quick Reference Guide (QRG)

· Special tools (if required)

· Batteries (One battery set per test article, with equal ratio of compatible battery set options IAW with PSPEC 3.2.1 and 3.2.2. For example, if five different battery solutions are proposed, provide sixteen sets of each solution.)

4.1.2 System (Production). The contractor shall deliver the following items in production quantities (2,000 and 7,920):

· WID MATT that meet the specifications listed in the Performance Specification (P-SPEC)

· Any adapters or holders required to meet battery requirements IAW PSPEC 3.2.1 and 3.2.2 (if required)

· Quick Reference Guide

· Special tools (if required)

4.1.3 External Handset. The contractor shall deliver the external handset referenced in Section 4.1.1.

4.1.4 Batteries. The contractor shall deliver the compatible batteries referenced in Section 4.1.1. The batteries shall be packaged as a set, (i.e. if 4 batteries are required to operate the system, then (1) unit/set would equal (4) batteries).

4.2. Program and Data Management

4.2.1. Status Report

The contractor will deliver a monthly status report that identifies the agreed to production and delivery schedule and will track deliveries to date and highlight any deviations. This monthly report will be due on the last day of each month starting with the first full month after award.

(CDRL B001, Monthly Status Reports)

4.2.2. Post Award Conference (PAC)

The contractor shall host a Post Award Conference (PAC) at the contractor's facility or virtually within 30 days of Contract Award. The purpose of the PAC is for the contractor to review, and demonstrate to the Government, the management procedures it uses, deliver a progress assessment, review the status of technical and other specialty areas, and establish schedule dates for near term critical meetings/actions. The contractor shall present management, key personnel, and program implementation processes. As part of the PAC presentation materials, the contractor shall provide the production schedule and delivery timeline.

(CDRL B002, Presentation Material) (CDRL B003, Conference Minutes)

4.2.3. Security Requirements

The information provided to the contractor will be unclassified and/or Controlled Unclassified Information (CUI). The contractor is not required, nor expected, to have a Facility Clearance and contractor personnel supporting this effort are not required to possess Personnel Clearance Levels. However, any contractor personnel requiring access to U.S. Government CUI shall possess a completed background investigation (minimum of a T-1/NACI) for this Public Trust Position.

4.3. Systems Engineering

4.3.1. Systems Engineering Technical Review (SETR)

The contractor shall participate telephonically in the Government-led SETR events, to provide answers to specific questions from the SETR team, including a System Functional Review (SFR) / Non-developmental Item Integration Review (NIR) for the Marine Analog Tactical Telephone, to set the system’s initial Product Baseline. The NIR is a review that provides the Government with the confidence the device’s initial Product Baseline (iPBL) is known and documented. The Government will conduct a Test Readiness Review (TRR) to determine whether the device can proceed to demonstration and testing. The Government Technical Review Board will conduct a Functional Configuration Audit (FCA), to audit the results of the previously mentioned testing, and a System Verification Review (SVR), to assess the system’s functionality and determine if it meets the functional requirements. Lastly, a Physical Configuration Audit (PCA) will be conducted to set the system’s final Product Baseline (PBL).

4.3.2. Safety Assessment Report (SAR)

The contractor shall conduct a safety assessment in accordance with MIL-STD-882E and deliver a Safety Assessment Report (SAR) for the WID MATT. The SAR shall have a statement signed by the contractor Program Manager stating that all hazards have been identified, eliminated, or controlled.

(CDRL A001, Safety Assessment Report)

4.4. Integrated Logistics Support

4.4.1. Provisioning Guidance Conference (PGC)

The contractor shall attend a Provisioning Guidance Conference. The Marine Corps Systems Command (MCSC) Equipment Specialist shall chair this conference. The purpose of the meeting is to define requirements for Logistics Management Information Data Products including format and medium of delivery, addressing unique Government requirements, and discussing/resolving unclear provisioning/cataloging related areas. Other topics to be addressed may include the Reliability, Availability, and Maintainability of the material solution, Operator’s Manual and Quick Reference Guide, and safety efforts to be executed.

(CDRL B002, Presentation Material) (CDRL B003, Meeting Minutes)

4.4.2. Provisioning Conference

The contractor shall attend a Provisioning Conference. The contractor shall provide a minimum of one production grade system for use at the conference. Disassembly of system, by the contractor, may be required during the conference to verify all provisioning documentation, parts and assemblies are accurate. The Provisioning Conference shall be conducted concurrently with the PCA.

(CDRL B003, Meeting Minutes)

4.4.3. Logistics Product Data

The contractor must deliver Engineering Drawings sufficient for the Government’s use in conducting Logistics Provisioning. The required Logistics Product Data includes, at a minimum, Provisioning Technical Data, Provisioning Parts List and Index, Long Lead Time Item List, Common Bulk Item List, Design Change Notice, Support Equipment Recommendation Data and Indentured Bill of Materials.

The contractor shall deliver all necessary data for the Government to update or add National Stock Numbers (NSNs), and shall assign Source, Maintenance, and Recoverability (SM&R) codes to the WID MATT in accordance with the USMC two levels of maintenance concept (GEIA-STD-0007 Logistics Product Data Handbook).

(CDRL D001, Logistics Product Data) (CDRL D003, Engineering Data for Provisioning)

4.4.3.1. Provisioning Parts List (PPL)

The contractor shall develop and deliver a Provisioning Parts List (PPL) in LSA-36 format IAW GEIA-STD-0007. The contractor shall ensure that the PPL contains the end item, components or assemblies and all support items which can be disassembled, reassembled, or replaced, and which, when combined, constitute the end item, component or assembly, and shall include items such as parts, materials, consumables, connecting cabling, mounting, and fittings required for the operation and maintenance of the end item, component, or assembly. The PPL shall be used to determine the range and depth of support items required to maintain the end item. This includes all repairable and non-repairable NDI items. The PPL shall be structured in a Top-Down Breakdown sequence. Indenture Codes shall be in Alpha Character format. Provisioning List Item Sequence Number (PLISN) sequencing of the PPL shall begin with Alphanumeric Codes of A001 as the first “B” indenture PLISN, continue through A999, then B00l, and continue through B999. All repairable items will be identified by the contractor. The PPL shall contain repair kits and repair part sets required to maintain the end item, component, or assembly.

(CDRL D002, Provisioning Parts List)

4.4.4. Technical Manual Requirements

The contractor shall develop and deliver an Operator’s Manual in electronic form that includes Operator’s Maintenance Procedures with a Special Tools List (RPSTL) (-24P). The Government shall have unlimited rights in the Operator’s Manual.

(CDRL D004, Equipment Technical Manual (Sanitized) – (Operator’s Manual)

The contractor shall also deliver a Quick Reference Guide (QRG), one over-packed as part of each WID MATT system. The QRG is intended to be a compressed operator’s manual that a Marine can put in his or her pocket to take to the field and have quick reference instructions on how to operate and maintain the system. The Government shall have unlimited rights in the QRG.

(CDRL D005, Equipment Technical Manual (Sanitized) – (Quick Reference Guide (QRG)

4.4.4.1. Technical Manual Reviews

The contractor shall support four separate reviews of the Operator’s Manual at the following stages of its development: 30% review, 60% review, 90% review, and 100% review, as defined in the text below.

30% Review - The purpose of the 30% review is to ensure the contractor is developing the publication document to USMC requirements. It is an opportunity for the Government to review the contractor/editor’s approach to the publication development and to offer guidance and direction at an early stage.

Definition of 30% - A publication shall be at the 30 % completion stage when the following items are completed. Publication Control Number (PCN) has been obtained. The structure/outline and proper format of the publication have been defined. The hyper linking approach has been established. Front matter (including warnings and cautions), most introductory and equipment descriptions have been written and placed in the appropriate chapters. Known tables and figures are complete and placed in the appropriate chapters. At a minimum, all placeholders are defined and awaiting technical content to be written.

60% Review - The purpose of the 60% review is to ensure that the manual is meeting USMC format, and all warnings and cautions are in place. At this time, Government subject matter experts review the publication for any discrepancies or inconsistencies.

Definition of 60% - A publication shall be considered at 60% when the following is completed. All front matter (cover, title page, table of contents, warnings and cautions) is complete and placed in the appropriate places. The content of each chapter is written, including descriptions; step-by-step procedures; tables; figures; and warnings, cautions and notes. A minimal amount of technical data may still be missing, but placeholders have been created for that data. The content in the chapters must flow in a clear and logical sequence and be written in the proper format. A table of contents is complete and correctly links to the appropriate chapter, paragraph, table or figure, etc.

90% Review - The purpose of the 90% review is to ensure that the manual is nearly complete. At this time, Government subject matter experts review the publication for any discrepancies or inconsistencies in preparation for Validation and Verification Definition of 90% - A publication shall be considered at 90% when the following is completed. All front matter (cover, title page, table of contents, and warnings and cautions) is complete and placed in the appropriate places. The content of each chapter, including descriptions; step-by-step procedures; tables; figures; and warnings, cautions and notes, is written, with a minimal amount of error. Placeholders should have sufficient data in logical sequence and need only minimum corrections to be complete. The content in the chapters must flow in a clear and logical sequence and be written in the proper format. A table of contents is complete when it correctly links to the appropriate chapter, paragraph, table or figure, etc.

100% Review - The purpose of the 100% review is to ensure that the manual is complete. At this time, Government subject matter experts review the publication for any discrepancies or inconsistencies during 100% Verification.

Definition of 100% - A publication shall be considered at 100% when the following is completed. All front matter (cover, title page, table of contents, and warnings and cautions) is complete and placed in the appropriate places. The content of each chapter, including descriptions; step-by-step procedures; tables; figures; and warnings, cautions and notes, is written. The content in the chapters must flow in a clear and logical sequence and be written in the proper format. A table of contents is complete and correctly links to the appropriate chapter, paragraph, table or figure, etc. All chapter data is finalized and in place. Marines and the program office will conduct the Verification and those findings will be adjudicated and the Operator’s Manual in electronic form will be finalized and submitted for Government Program Office approval.

4.4.4.2. Validation and Verification (Val/Ver) Review

The purpose of the Val/Ver review is to ensure that the manual is complete. At this time, Government subject matter experts review the publication for any discrepancies or inconsistencies.

4.4.4.3. Definition of Val/Ver

A publication shall be considered validated and verified when the following is completed. All front matter (cover, title page, table of contents, and warnings and cautions) is complete and placed in the appropriate places. The content of each chapter, including descriptions; step-by-step procedures; tables; figures; and warnings, cautions and notes, is written, with a minimal amount of error.

The content in the chapters must flow in a clear and logical sequence and be written in the proper format. A table of contents is complete and correctly links to the appropriate chapter, paragraph, table or figure, etc. RPSTL (parts breakdown) data is finalized and in place. The Val/Ver review will consist of a paper review and the Operator’s Manual in electronic form on CD, to verify the linking. The contractor/editor will have received all the copyright releases at this time.

Marines will conduct the Val/Ver and those findings will be adjudicated and the Operator’s Manual in electronic form finalized and submitted for Government Program Office approval.

4.4.5. Warranty

The contractor shall provide a standard warranty. Warranty coverage will clearly identify limitations, exclusions, and restrictions upon the intended military application, use and environmental stress that may be imposed by the tactical employment of the equipment, systems or items being acquired. Warranty shall be tracked per DFARS 252.246-7006 Warranty Tracking of Serialized Items.

4.4.6. Copyright Release

Per DFARS 252.227-7013(d), the contractor shall provide copyright release specifically for the QRG and the Operator’s Manual and shall identify any third party copyrighted material that will be included in any deliverable technical data or software, if applicable, and provide the required license(s) for Government use, reproduction and distribution.

4.4.7. IUID Marking and Registration

The contractor shall develop and affix Unique Item Identifier labels in accordance with the provided references and the Item Unique Identification (IUID) Implementation Plan (IP) for WID MATT.

5. Security Requirement The information provided to the contractor will be unclassified and/or Controlled Unclassified Information (CUI). The contractor is not required or expected to have a Facility Clearance and contractor personnel supporting this effort are not required to possess Personnel Clearance Levels. Any contractor personnel requiring access to U.S. Government CUI shall possess a completed background investigation (minimum of a T-1/NACI) for this Public Trust Position. The Company must notify the MCSC AC/S G-2 Personnel Security Office (PERSEC Office) via encrypted e-mail to MCSC_Security@usmc.mil or 703-432-3374/3952, within 24 hours, of any adverse/derogatory information associated with the 13 Adjudicative Guidelines concerning any contractor performing on this contract, if they have been issued a CAC and/or a MCSC Building Badge.

5.1. Cyber Security

5.1.1 System Security Plan And Plans Of Action And Milestones (SSP/POAM) Reviews

a) Within thirty (30) days of contract award, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the contractor’s facility. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government s review of the SSPs at the Contractor’s facility.

b) If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

c) Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor s facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

d) The Government may, in its sole discretion, conduct subsequent reviews at the Contractor’s site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) day’s notice to the Contractor.

(CDRL A002, SSP with POAM)

5.1.2 Compliance With NIST 800-171

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

(1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

(4) Audit user privileges on at least an annual basis;

(5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

(6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

(7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

(CDRL A003, Record of Tier 1 Level Suppliers Receiving/Developing Covered Defense Information)

5.1.3 Cyber Incident Response:

a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

b) Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Me.... In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

c) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

(CDRL A004, Cyber Incident Reporting)

5.1.4 Naval Criminal Investigative Service (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies.

5.1.5 NCIS/Industry Monitoring

a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.