SOW_FINAL.pdf

CUI

Attachment (1)

THIS PAGE INTENTIONALLY LEFT BLANK

Contract # N00019-22-G-0007

PID # N00019-XX-RFPREQ-APM299-XXXX

Contents

1.0 SCOPE

2.0 APPLICABLE DOCUMENTS

3.0 REQUIREMENTS

3.1 PROGRAM MANAGEMENT

3.1.1 Principal Point of Contact

3.1.2 Program Planning and Control

3.2 CONFIGURATION MANAGEMENT

3.2.1 Configuration Management Program (CMP)

3.3 Software Design Requirements

3.3.1 Software Project Management and Control

3.3.2 Software Configuration Management (SCM)

3.3.3 Software Quality Assurance (SQA)

3.3.4 Software Inspections

3.4 JOINT MISSION PLANNING SYSTEM

3.5 SECURITY

3.5.1 Information Security (INFOSEC)

3.5.2 Operations Security (OPSEC)

3.5.3 Public Release

3.5.4 International Trade Compliance - Export Control

3.6 Bug Fix (Option)

1.0 Scope

This Statement of Work (SOW) defines development of the MH-60 Post Mission Playback (PMP) Software for compatibility with Microsoft Windows 11 Long-Term Servicing Channel (Win11 LTSC) and modifications for Java 8/Java 11 co-existence on a JMPS software environment for System Configuration 26 (SC26).

In this effort, the Strike Planning and Execution Systems Program (PMA-281) office issues the ECP for the final Joint Mission Planning System (JMPS) configuration. There is no Contractor ECP submission required.

2.0 Applicable Documents

The documents listed in Table 1, Table 2, and Table 3 form a part of this SOW to the extent cited herein. All reference documents are mandatory unless otherwise specified within the body of this SOW.

Guidance documents may be used as an aid in identifying applicable topics to be addressed consistent with meeting the requirements of the program. The Contractor is not required to use any document cited "for guidance" or "as guidance." The Contractor shall propose alternatives to the specifications and standards cited herein if it would enhance system performance or cost effectiveness as necessary. Unless otherwise specified, the issues of Government documents are those listed in the current issue of the Department of Defense Index of Specifications and Standards on the date of this SOW. The issues of non-Government standards are those in effect on the date of contract award.

Table 1: Government Specifications, Standards, and Handbooks

Document Number Date Document Title Required/Guidance

JTR 5.2 23 Mar 2016 JMPS Technical Rules (JTR) Required

02-235.5 04 June 2020 MH-60R Multi-Mission Helicopter (MMH) Security Classification Guide

Required

MIL-HDBK-61B 07 Apr 2020 Military Handbook, Configuration Management Guidance

Guidance

MH-60R/ARPDD –

PPP

14 Jun 2010 MH-60R Multi-Mission Helicopter Program ACAT 1C Program Protection Plan

Required

OPNAVINST 3432.1 04 Aug 11 Operations Security Required

NAVAIRINST

5720.10

02 Sept 10 Public Release Authorization Process for Clearing Unclassified Information

Required changes to create software that is compatible with the Win11 LTSC OS. The Contractor shall test the new PMP design to validate that the PMP software is compatible with the new OS. The Contractor shall also test to validate that the performance of the software is not degraded.

2. The Contractor shall investigate a method of maintaining the Java 8 version of the current fleet released version of PMP co-existent with Java 11 software which will be standard on the JMPS laptop for SC26. Based on PMA-281 Cybersecurity Rules, Java will be updated on a quarterly basis to mitigate possible CAT I findings. Therefore, as a long-term solution, the Contractor shall modify the current fleet released version of PMP to find the Java home and Java 8 registry keys to maintain PMP operation within the MPE as updates to Java are implemented by PMA281. Based on the Contractor’s findings, the Contractor shall develop and implement changes to create a new version of PMP software that is compatible with the SC26 JMPS Java software environment. The Contractor shall test the new PMP design to validate that the PMP software is compatible with the SC26 software environment. The Contractor shall also test to validate that the performance of the software is not degraded.

3. The Contractor shall update any PMP associated documentation that is affected by the software changes. The Contractor shall informally submit updated documents only when:

a. Installation steps are required to change

b. The operator experience is changed

Informal submissions shall be delivered via email to the Technical Point of Contact for this contract and the PMA-299 JMPS Integrated Product Team Lead.

4. Upon successful completion of validation testing for items 1 and 2 above, the Contractor shall informally submit the updated unclassified PMP software version to:

NAWCWD (CODE E0AH120)

575 I AVE, SUITE 1

BLDG 36, RM 1204

ATTN : DATA MANAGER

POINT MUGU, CA 93042-5049

TEL (805) 989-9401

5. The Contractor shall submit a technical report for this effort in accordance with CDRL E001.

3.1 PROGRAM MANAGEMENT

3.1.1 Principal Point of Contact

The Contractor shall identify a Principal Point of Contact with the responsibility, accountability and authority for ensuring this effort meets contract cost, schedule, and performance.

3.1.2 Program Planning and Control

The Contractor shall provide for the planning, direction, coordination and control of all activities within the Contractor organization, team members, and all subcontractors. The Contractor shall include a comprehensive program management and systems engineering approach for all elements of this project.

The Contractor shall address all issues related to risk management and contractual execution including critical path items, program engineering, and milestones as an ongoing process.

3.2 CONFIGURATION MANAGEMENT

3.2.1 Configuration Management Program (CMP)

The Contractor shall maintain a Configuration Management (CM) Program to control products, processes, and related documentation to ensure the integrity of design and supportability for software configuration items in accordance with Electronic Industries Alliance (EIA)-649-1A, EIA-649C, MIL- HDBK-61B, the Contractor's Government-approved Configuration Plan and the PMA-299 Configuration Management Plan. The CM effort shall include identification and control of all system functional, allocated, and product baselines; establishment of a configuration status accounting system to provide an audit trail of all configuration changes; and identification, documentation, and verification of the functional and physical characteristics of each Configuration Item (CI). For this effort CT will follow the same Configuration Management processes and procedures they have used in supporting the MH-60R AP software development efforts for the last 15 years and the previous PMP software development efforts for the last 8 years.

3.3 Software Design Requirements

Commercial-off-the-shelf (COTS) software that has not been modified or customized shall be excluded from the Software Engineering requirements in this SOW with the exception of delivering software licenses required to operate the software. Any software licenses required to operate the software for PMP shall be identified in the Software Product Specification (SPS). In the event that any COTS software requires modification, the Contractor is required to obtain Government approval, and if approved, then Software Engineering requirements shall apply.

3.3.1 Software Project Management and Control

The Contractor shall follow its SDP for the development of all software as defined in this SOW.

3.3.2 Software Configuration Management (SCM)

The Contractor shall maintain the integrity of the software product (i.e., software and software documentation). The Contractor shall identify the software configuration at each software release, control changes to the configuration, and maintain the integrity and traceability of the configurations.

Software shall be under strict configuration control.

3.3.3 Software Quality Assurance (SQA)

The Contractor shall maintain an SQA Program. The Contractor shall ensure software updates performed under this SOW adhere to the SQA processes and procedures.

3.3.4 Software Inspections

The Contractor shall follow its SDP while performing inspections for the development of all software as defined in this SOW.

3.4 JOINT MISSION PLANNING SYSTEM

The Contractor shall develop the PMP software changes for the Joint Mission Planning System (JMPS) in accordance with the JMPS Technical Rules (JTR) 5.2.

3.5 SECURITY

All Contractor personnel shall maintain security clearance eligibility commensurate with the level of classification of the work performed as annotated in the Contract Security Classification Specification Form (DD-254).

Contractor personnel shall require access to classified information in performance of this contract up to and including SECRET, with a safeguarding level of SECRET. The Contractor is responsible for ensuring that all personnel receive the requisite investigation and are favorably adjudicated in accordance with Department of Defense Manual (DoDM) 5220.22, National Industrial Security Program Operating Manual. Contractor employees who fail to meet security clearance requirements may not access classified information or perform sensitive duties. In such cases, the Contractor employee may not perform on the contract.

The contractor shall comply with security requirements specified in the N00019-22-G-0007 DD-254.

Information or data that the Contractor accesses shall be handled at the appropriate classification level.

Unclassified information shall be handled in accordance with the appropriate designation (Controlled Unclassified Information; For Official Use Only; Covered Defense Information). Distribution is authorized to the Requiring Office's Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the TPOC of this contract for approval.

Controlled Unclassified Information including Covered Defense Information (meeting the definition of 48 CFR 252.204–7012(a)) generated and/or provided under this contract shall be marked and safeguarded as specified in DoD Instruction 5200.48, Controlled Unclassified Information (CUI) available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF. Any product containing Covered Defense Information shall be assigned a distribution statement (distribution statements B through F) using the criteria set forth in DoDI 5230.24 (Distribution Statements on Technical Documents); and have this statement displayed per DoDI 5230.24, Enclosure 3.

3.5.1 Information Security (INFOSEC)

The Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and CUI and to control distribution of CUI in accordance with 32 CFR Part 117 NISPOM Rule and SECNAVINST 5510.36B. If the work is performed at the Government's facility, the Contractor shall comply with the relevant Command Security Standard Operating Procedures.

a. The Contractor shall derivatively classify and appropriately mark classified documents developed for this effort in accordance with guidance outlined in Security Classification Guide (SCG) ID# 02-235.5, MH-60R Multi-Mission Helicopter (MMH).

b. The Contractor shall ensure all CUI data at rest, that has not been approved for public release and is stored on mobile computing devises, shall be treated as sensitive data and encrypted using commercially available encryption technology in accordance with DoDM 5200.01-V3. All CUI sent via email, shall be encrypted, and marked accordingly. CUI can be transmitted via FAX (coordinate with receiver prior to sending).

c. The Contractor shall immediately report any unauthorized, inadvertent, or illegal release or disclosure of CUI to the COR/TPOC or the Program Security Manager. Contractor personnel shall coordinate this effort through their Facility Security Officer (FSO).

1) In accordance with the Defense Federal Acquisition Regulation Supplement (DFARS), Subpart 204.73, Contractors must report to DoD certain cyber incidents that affect unclassified controlled technical information resident on or transiting contractor unclassified information systems within 72-hours of occurrence via (http://dibnet.dod.mil/). DFARS, Subpart 204.73, clause 252.204- 7012, Paragraph (d)(2).

2) Additionally, minimum security controls for safeguarding shall be in accordance with National Institute of Standards and Technology document number, NIST SP 800-53 (http://csrc.nist.gov/publications/PubsSPs.html).

d. Appropriate management action shall be taken to determine responsibility for the unauthorized disclosure of CUI whenever feasible or required by other guidance, and appropriate disciplinary action shall be taken against those responsible. Unauthorized disclosure of some CUI (e.g., information protected by The Privacy Act of 1974, as amended or export-controlled technical data) may also result in civil and criminal sanctions against responsible persons. The designating authority that originated the CUI shall be informed of its unauthorized disclosure.

3.5.2 Operations Security (OPSEC)

The Contractor shall maintain an OPSEC Plan to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the Contractor and any subcontractor during performance of the contract. The Contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. This program may include Information Assurance and Communications Security (COMSEC). The OPSEC program shall be in accordance with NSDD 298, and at a minimum shall include:

1) Assignment of responsibility for OPSEC direction and implementation.

2) Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

3) Establishment of OPSEC education and awareness training.

4) Provisions for management, annual review, and evaluation of OPSEC programs.

5) Flow down of OPSEC requirements to subcontractors when applicable.

While performing aboard NAVAIR or NAVAIR sites, the contractor shall comply with facility OPSEC program instructions and contribute to organization-level OPSEC efforts. Include OPSEC as part of its ongoing security awareness program and take all required Agency training. Be responsive to the Supporting OPSEC Manager on a non-interference basis. Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the RO and contractor in support of the mission.”

3.5.3 Public Release

Any controlled unclassified information pertaining to this contract shall not be released for public dissemination, including posting to any social media sites such as Facebook or Twitter, unless it has been approved for public release by appropriate U.S. government authority. Proposed public releases shall be submitted for approval prior to release through PEO (A), Public Affairs Office, 47123 Buse Road, RADM William A. Moffett Building, Patuxent River, MD 20670-1547.

3.5.4 International Trade Compliance - Export Control

The Contractor shall comply with all U.S. export control laws and regulations. The contract performance and information may be subject to the provisions of the Export Administration Act of 1979 and the Export Administration Regulations promulgated thereunder, the Arms Export Control Act, and the International Traffic in Arms Regulations, and the economic sanctions laws and regulations administered by the Treasury Department’s Office of Foreign Assets Control. The Contractor and the U.S. Government (USG) acknowledge that (1) these statutes and regulations impose restrictions on the import, export, and transfer of certain items (including access to such data); (2) that licenses from the U.S. Department of State and/or the U.S. Department of Commerce may be required before such items/data can be imported, exported, transferred, or made accessible by the Contractor to any foreign third parties; and (3) that such licenses may impose further restrictions on use and disclosure of such data. The USG will advise the Contractor of any international involvement requiring third party access.

Contractor performance may be subject to export licenses, and the Contractor shall make every reasonable effort to ensure required authorizations are in place in advance of requirements and shall keep the USG Program Office advised of information requirements from USG and foreign partner(s) that remain outstanding. These export approvals shall be continual throughout the entire contract period of performance unless otherwise revoked by the authorizing agency.

Information, systems, and components associated with H-60 requirements may be exported to Australia under the auspices of the Cooperative Development Program for the H-60 Helicopter Program between the United States (U.S.) and the Commonwealth of Australia. The Contractor shall not re-transfer or otherwise use export-controlled information furnished by either Participant of the MH-60R Maritime Combat Helicopter Capability Assurance Program (CAP) Project Arrangement (PA) (ADOD and U.S.

DOD) for purposes outside the scope of the Project Arrangement. This includes transfer to another Contractor or subcontractor unless that Contractor or subcontractor has also been legally bound to limit use of the information to within the scope of the MH-60R CAP-PA.

3.6 Bug Fix (Option)

Within the delivery order period of performance and available funding, the Contractor shall correct mutually agreed upon software bugs identified in the pre-existing released PMP software. The Contractor shall provide the Government Technical Point of Contact (TPOC) with estimated hours and informal cost estimate for all impacts, for all software bugs recommended by the Government Integrated Product Team (IPT) lead for action. The Contractor shall notify the TPOC if costs are going to exceed the initial estimate. The Contractor shall deliver the estimates by email to TPOC. The Contractor shall obtain Government authorization from the TPOC before proceeding and correcting software bugs.

Contract Data Requirements List (CDRL) E001 Technical Report