Automated Shot Counter System SOW DRAFT_6 Feb 2024.docx

ATTACHMENT (1)

STATEMENT OF WORK (SOW)

FOR

AUTOMATED SHOT COUNTER SYSTEM

FOR

NAVAIR AIRBORNE GUN SYSTEMS

06 February 2024

DOCUMENT CHANGE LOG AS OF:

SUPERSEDING:

DOCUMENT TITLE: Attachment (1), Statement of Work (SOW) for Automated Shot Counter Procurement

TABLE OF CONTENTS

i

STATEMENT OF WORK

FOR THE PROCUREMENT AND SUPPORT OF THE

AUTOMATED SHOT COUNTER SYSTEM

SCOPE

Under this Statement of Work (SOW), the Contractor shall provide a commercial Automated Shot Counter System that complies with by the United States Government specifications compatible for use on GAU-21, GAU-17/A, M240D, M61A1/A2 and M197. Additionally, the Contractor shall support, within the scope of the material procurement, program administration, engineering, and initial integration on the aviation gun systems.

APPLICABLE DOCUMENTS

The Contractor shall comply with the documents listed in Table 2.0, below, in effect on the date listed in the table or on the date of contract award whichever is later in time:

Table 2.0 Applicable Documents

GEIA-HB-649A

REQUIREMENTS

3.1 Performance Requirements

The Contractor shall be responsible for the delivery of an automated shot counter system that meets the performance requirements outlined in Performance Specification Automated Shot Counter, PMA-242-23-001, Attachment (2), as well as all applicable documents listed in Table 2.0.

3.2 Contractor Data Collection

The Government will provide access to testing facilities, and the required weapon systems, for approximately one (1) week for each system, noted in Table 5.0, for required contractor data collection, to ensure each system meets the requirements outlined in Performance Specification Automated Shot Counter, PMA-242-23-001, Attachment (2).

3.3 Government Integration Testing

The Contractor shall provide hardware/software support, whether in person or remotely as needed, for the Automated Shot Counter System throughout the government integration and fielding efforts as outlined in Table 5.0.

3.4 Configuration Management (CM)

The Contractor shall maintain a CM program to control products, processes, and related documentation to ensure the integrity of design and supportability for both hardware and software Configuration Items in accordance with (IAW) EIA-649C, EIA-649-1, GEIA-HB-649A, MIL-HDBK-61B, and the PMA-242 CM/DM Plan.

3.5 Cybersecurity

3.5.1 Cyber Requirements

The Contractor’s system shall meet the cybersecurity requirements defined in the PMA-242 Automated Shot Counter Specification, PMA-242-23-001, Attachment (2). The Contractor shall support Government cyber testing and meetings leading up to and after the cyber testing, including Independent Verification & Validation (i.e., ACAS, STIG, SCAP scans), Penetration Testing on the Automated Shot Counter system, and Cyber Assessment Round Top (CART) meetings as noted in Table 5.1. As part of the validation of this system for the Government, the Contractor shall:

a. Ensure all cybersecurity requirements are being met in accordance with the Performance Specification Automated Shot Counter, PMA-242-23-001, Attachment (2).

b. Ensure that cybersecurity boundaries (e.g., crypto boundary, certification boundary, classification boundary) are clearly and consistently identified in program documents and drawings.

c. Provide support for the generation of artifacts needed for Risk Management Framework activities (i.e. System Security Plan (SSP), Plan of Action and Milestone (POAM), Risk Assessment Report (RAR), etc.).

d. Provide any vulnerability scanning (i.e. NESSUS), source code analysis reports and STIG checklists associated with the testing of the hardware configuration, if applicable, as determined by the Information System Security Manager.

e. Ensure that there are processes in which to support Supply Chain Risk Management (SCRM) activities by attesting to the traceability of all processors & digital electronics to an approved source.

All items listed within paragraphs 3.5.1 (b) through (e) will be delivered IAW with CDRL A00B.

3.5.2 Cyber Requirements Verification

The Contractor shall verify requirements based on the following use cases:

a. Access by non-privileged personnel

b. Unauthorized use by privileged personnel

c. Malicious use by privileged personnel

d. External attack with no other access during

e. Maintenance

3.6 Logistics

3.6.1 Marking Requirements

The contractor shall mark the Automated Shot Counter Hardware IAW Performance Specification Automated Shot Counter, PMA-242-23-001, Attachment (2).

DELIVERABLES

4.1 Hardware (CLINs 0001, 0002, 0101, 0102, 0201, 0202, 0301, 0302, 0401 and 0402)

The Contractor shall provide an initial delivery of 12 automated shot counters, including two (2) automated shot counters per weapon system with two (2) additional automated shot counters as backup: GAU-21, GAU-17/A, M240D, M61A1/A2 and M197 (listed in paragraph 5.1). Additionally, the Contractor shall provide an initial delivery of five (5) handheld devices.

The Contractor shall deliver all hardware, with applicable software, to facilitate Government integration testing IAW all requirements outlined in the Performance Specification Automated Shot Counter, PMA-242-23-001, Attachment (2).

The Contractor shall provide technical support for integration of the automated shot counter on each individual weapon system.

4.2 Software/Firmware Delivery and Updates (CLINs 0003, 0103, 0203, 0303, and 0403)

The Contractor shall deliver the applicable software/firmware for (5) handheld devices to facilitate Government integration testing IAW all requirements outlined in the Performance Specification Automated Shot Counter, PMA-242-23-001, Attachment (2). Additionally, all software/firmware updates will be delivered, as required, throughout the period of performance of this contract.

4.4 Data (CLINs 0004, 0104, 0204, 0304, and 0404)

4.4.1 Test Data

The Contractor shall provide the data collection requirements related to the system as required by the Performance Specification Automated Shot Counter, PMA-242-23-001, Attachment (2) IAW CDRL A001.

4.4.2 Obsolescence Management

The Contractor shall make available to the Government its obsolescence management plan and submit notice to the Government of any changes IAW CDRL A002. The Contractor shall notify the Government after the determination of the obsolescence case IAW CDRL A003.

4.4.3 Publication Source Data

The Contractor shall deliver all publication source data for the Automated Shot Counter System IAW CDRL A004.

4.4.4 Quality Management Plan

The Contractor shall provide the Government with its Quality Management Plan IAW CDRL A005.

If the Contractor is already certified to the AS9100D or ISO9001, submission of the written plan is not required.

4.4.5 Configuration Change Management

The Contractor shall document and notify the Government of design and documentation changes through Engineering Change Proposals (ECPs) IAW CDRL A006, Notices of Revision (NORs) IAW CDRL A007, Requests for Variance (RFVs) IAW CDRL A008, or Proposed Specification Change Notices (PSCNs) IAW CDRL A009 as required in the PMA-242 CM/DM Plan.

4.4.6 Technical Data Package (TDP)

The Contractor shall deliver a TDP, to include System Specification and User Publication IAW CDRL A00A, including both hardware and software, Software Design Description IAW CDRL A00B, Software Product Specification IAW CDRL A00C, Interface Control Document IAW CDRL A00D, and at a minimum 2D Drawings/Illustrations IAW CDRL A00E for the Automated Shot Counter System.

4.4.7 Cybersecurity Testing

As part of overall Automated Shot Counter testing, defined in the Performance Specification Automated Shot Counter, PMA-242-23-001, Attachment (2), the Contractor shall support verification of cybersecurity controls as described below and shall submit the verification results IAW CDRL A00F.

4.4.8 Physical Configuration Audit

The Contractor shall conduct a Physical Configuration Audit (PCA) of the Automated Shot Counter System IAW CDRL A00G, the approved Configuration Audit Plan. The Government will Co-Chair the PCA.

The Contractor shall create and deliver a Configuration Audit Plan IAW CDRL A00G for accomplishing PCAs IAW EIA-649-1A and the PMA-242 CM/DM Plan. The Contractor shall document the composition, responsibilities, and authority of the PCA Technical Review Board (TRB) as part of CDRL A00G, Configuration Audit Plan.

a. The Contractor shall successfully conduct a PCA at the supplier production facility for the Automated Shot Counter System.

b. The Contractor shall notify the Government CM/DM and Lead Production Engineer 30 calendar days prior to conducting the PCA so the Government may be represented.

c. The Contractor shall conduct a Pre-Audit meeting with the Government 15 calendar days prior to the PCA.

d. The Contractor shall create and deliver a Configuration Audit Summary Report and Certification IAW CDRL A00H after the PCA is completed.

e. The Contractor shall correct all audit discrepancies documented in the Configuration Audit Summary Reports IAW CDRL A00H.

5 MEETINGS/REVIEWS/TESTING REQUIREMENTS (CLINs 0001, 0002, 0003, 0004; 0101, 0102, 0103, 0104; 0201, 0202, 0203, 0204; 0301, 0302, 0303, 0304; 0401, 0402, 0403, and 0404)

TABLE 5.0 MEETING

5.1 Program Management Reviews

The Contractor shall host and conduct an initial Program Management Review. The meeting should be scheduled at least four (4) weeks in advance to allow for maximum participation and preparation. The PMR shall be conducted no later than 60 days after the contract is awarded.

5.2 Integrated Product Team Meetings/Technical Interchange Meetings Throughout the period of integration and testing, the Contractor shall provide program management, engineering, test, and cyber security personnel to support, but not limited to, monthly Automated Shot Counter IPT Management meetings NLT 30 days post contract award.