N00024-25-R-5200 Draft.docx

N0002425R5200

Section B - Supplies or Services and Prices

CLIN Number 0001

Each

HW & Non/Commercial SW Catalog

FFP

Hardware and Commercial/Non-Commercial Software Catalog FOB: Destination

NET AMT

CLIN Number 0002

Each

CI Non/Commercial SW Procurement

Computing Infrastructure Commercial/Non-Commercial Software Procurement

NET AMT

CLIN Number 0003

Hours

CI SW Eng Labor for HW Optimization

Cloud Infrastructure Software Engineering Labor for Hardware Optimization

NET AMT

CLIN Number 0004

Each

Hardware Component Procurement

Hardware Component Procurement

NET AMT

CLIN Number 0005

Months

Engineering and Support Services

Engineering and Support Services

NET AMT

CLIN Number 0006

Months

FFP

Compute Infrastructure Software Deployment and Hardware/Software Install Support

NET AMT

CLIN Number 0007

Months

FFP

Product Support and Training

NET AMT

CLIN Number 0008

Each

FFP

Development and Test Labs

NET AMT

CLIN Number 0009

Each

FFP

Warehousing and Storage

NET AMT

CLIN Number 0010

Project

FFP

Special Studies

NET AMT

CLIN Number 0011

Project

ODCs in Support of CLIN 0005

Incidental Material, Travel, and Subsistence Support for Engineering Services (CLIN 0005)

NET AMT

CLIN Number 0012

Lot

FFP

Technical Data Rights

NET AMT

CLIN Number 0013

Data

Electronic CDRL Delivery/Data for all years

NET AMT

CLIN Number 0014

Lot

Production Portal

Production Portal

NET AMT

CLAUSES INCORPORATED BY FULL TEXT

B-215-H002 REFUNDS (SPARES AND SUPPORT EQUIPMENT) (NAVSEA) (OCT 2018)

(a) In the event that the price of a spare part or item of support equipment delivered under this contract significantly exceeds its intrinsic value, the Contractor agrees to refund the difference. Refunds will not be made to recoup the amount of cost decreases that occur over time due to productivity gains (excluding economic purchase quantity considerations) or changes in market conditions.

(b) For purposes of this requirement, the intrinsic value of an item is defined as follows:

(1) If the item is one which is sold or is substantially similar or functionally equivalent to one that is sold in substantial quantities to the general public, intrinsic value is the established catalog or market price, plus the value of any unique requirements, including delivery terms, inspection, packaging, or labeling.

(2) If there is no comparable item sold in substantial quantities to the general public, intrinsic value is defined as the price an individual would expect to pay for the item based upon an economic purchase quantity as defined in FAR 52.207-4, plus the value of any unique requirements, including delivery terms, inspection, packaging or labeling.

(c) At any time up to two years after delivery of a spare part or item of support equipment, the Contracting Officer may notify the Contractor that based on all information available at the time of the notice, the price of the part or item apparently exceeds its intrinsic value.

(d) If notified in accordance with paragraph (c) above, the Contractor agrees to enter into good faith negotiations with the Government to determine if, and in what amount, the Government is entitled to a refund.

(e) If agreement pursuant to paragraph (d) above cannot be reached, and the Navy's return of the new or unused item to the Contractor is practical, the Navy, subject to the Contractor's agreement, may elect to return the item to the Contractor. Upon return of the item to its original point of Government acceptance, the Contractor shall refund in full the price paid. If no agreement pursuant to paragraph (d) above is reached, and return of the item by the Navy is impractical, the Contracting Officer may, with the approval of the Head of the Contracting Activity, issue a Contracting Officer's final decision on the matter, subject to Contractor appeal as provided in the "Disputes" clause (FAR 52.233-1).

(f) The Contractor shall make refunds, as required under this requirement, in accordance with instructions from the Contracting Officer.

(g) The Contractor shall not be liable for a refund if the Contractor advised the Contracting Officer in a timely manner that the price it would propose for a spare part or item of support equipment exceeded its intrinsic value, and with such advice, specified the estimated proposed price, the estimated intrinsic value and known alternative sources or item, if any, that can meet the requirement.

(h) This requirement does not apply to any spare parts or items of support equipment whose price is determined through adequate price competition. This requirement also does not apply to any spare part or item of support equipment if the Contractor submitted, and certified the currency, accuracy and completeness of, cost or pricing data applicable to the item.

(End of text)

B-227-H001 PROVISIONING TECHNICAL DOCUMENTATION – WITHHOLDING OF PAYMENT (NAVSEA) (OCT 2018)

(a) For the purpose of paragraph (c) of the "Progress Payments" clause of this contract, if included, the requirement that the Contractor develop and deliver Provisioning Technical Documentation (PTD) is considered to be a "material requirement of this contract," and Contractor failure to make adequate progress in the development of PTD, or to deliver acceptable PTD on a timely basis, may result in reduction or suspension of Progress Payments as provided in said paragraph.

(b) The PTD is considered to be a part of the "Technical Data" specified to be delivered under this contract for the purposes of the "Technical Data--Withholding of Payment" (DFARS 252.227-7030) clause. The terms and conditions of the clause entitled "Limitation On Withholding of Payments (FAR 52.232-9), if included in this contract, shall not apply to withholding of payment for failure to make timely delivery of the PTD or delivery of deficient PTD.

(End of text)

Section C - Descriptions and Specifications

SOW

STATEMENT OF WORK

For IDIQ N00024-25-R-5200 United States Navy Integrated Combat System MK 6 MOD X (Foundry Hardware Factory)

1.0 SCOPE

This Statement of Work (SOW) will support continuous development and deployment of U.S. Navy Surface Fleet modern compute technology (i.e., network, processing, storage, and legacy data conversion). MK 6 MOD X is a scalable, modern computing infrastructure that will be proliferated across the Fleet. The Government has established a collaborative “hardware factory” to provide a government-furnished DevSecOps (Development, Security, Operations) ecosystem. The Foundry is the U.S. Navy Surface Force computing infrastructure continuous development, integration, and manufacturing activity. The Foundry's mission is to use DevSecOps development and Agile management principals in order to rapidly and continuously provide cutting edge technology to the surface Navy. The Foundry seeks to eliminate the current pain points for surface Navy infrastructure programs by eliminating the impacts of Diminishing Manufacturing Sources and Material Shortages (DMSMS), rapidly responding to new requirements/fleet feedback, and by developing and establishing new methods for logistical support while delivering systems that account for the unique installation challenges of the sailor end-user. This ecosystem provides a common physical collaboration space, digital development tools, digital development and testing pipeline, and cybersecurity controls that link development, security, and testing in an automated pipeline to enable rapid delivery of capabilities to the fleet.

The computing infrastructure delivered shall enable hardware abstraction from combat system software applications enabling life cycling hardware and combat system software application independently of each other. The U.S. Navy has a requirement for a scalable process to continuously deliver updates and upgrades to the hardware and software components in the shipboard combat system enclave at a speed commensurate with technology evolution. This process will mitigate current issues with obsolescence, and new technology incompatibility, due to lifetime buys extending beyond the serviceable life of components. The Contractor shall implement a process that will allow for expansion and upgrades to system components without architecting a new solution. The SOW defines the efforts required to maintain a robust continuous production process designed to ensure seamless operations and timely delivery of high-quality products. To mitigate DMSMS, the contractor will implement proactive strategies. This is not a build-to-print (design specification) contract but rather a dynamic and adaptive production contract. Unlike traditional build-to-print contracts, which follow rigid specifications and fixed designs, this approach allows for flexibility and innovation throughout the manufacturing process. The contract will require annual technology reviews and periodic negotiations to incorporate ongoing advancements in hardware and swiftly respond to changes in technology and evolving requirements. The Contractor shall be responsible for all costs associated with the preparation, submission, and negotiations of proposals for any Delivery Orders (DO) under this contract. The Government will not reimburse the contractor for any expenses incurred in the development of proposals including but not limited to labor, materials, travel, or any other associated costs.

This SOW outlines the tasks and responsibilities for transitioning from low-rate initial production (LRIP) to full rate production (FRP). The intent is to continue to innovate and produce a scalable production system that consistently delivers high-quality products while optimizing costs and ensuring timely deliveries. The transition to FRP is critical for achieving the strategic goals of PEO to include the expansion of rapid hardware upgrades, deliver high quality products with advanced capabilities to the fleet, ensure compliance with all relevant standards and regulations are met, and maintain operational excellence.

Efforts hereunder include program management, systems engineering, software design and integration, product support and supportability engineering, configuration management, hardware and software integration (including material procurement or fabrication, and integration of Government-Furnished Material (GFM), as applicable), testing, evaluation, installation, and training. The MK 6 MOD X system is designated to deploy across the Surface Force ship-classes and land-based sites including but not limited to: Cruiser Guided (CG), Carrier Volplane Nuclear (CVN), Landing Helicopter Dock (LHD), Landing Platform Dock (LPD), Destroyer (DDG), Littoral Combat Ship (LCS), Future Guided Missile Frigate (FFG(X)), Unmanned Surface Vessel (USV), Training Sites, U.S. Coast Guard (USCG) Cutters, and Foreign Military partners.

The Contractor shall provide compute infrastructure solutions and production labor support utilizing Agile best practices. The Contractor shall work collaboratively with Government stakeholders, organizations, and other industry partner stakeholders and shall:

· Design, develop, manufacture, test, and integrate MK 6 MOD X on new construction, and In-Service modernizations. Procure spares/repair parts, technology refresh/insertion kits, pre-production/production hardware, and engineering change kits.

· Deliver computing infrastructure and software functionality and solutions that can be delivered in a continuous repeatable and iterative process. To the maximum extent practicable tactical applications software shall run agnostic to the underlying compute infrastructure and operate independently of the specific hardware or cloud environment it is deployed on without requiring modification or adaption. Deviation to software running agnostic to the underlying infrastructure shall be on a case-by-case basis at the direction of the Government.

· Build in cyber and system security for hardware and software at the beginning of the system design phase, and support certifications, safety tests, and authorizations. Include cybersecurity considerations in system design and engineering and correctly implement cybersecurity measures and design characteristics in the MK 6 MOD X system, in accordance with PEOIWS INST 5239.1A, DoD Zero Trust Strategy, and NIST 800-160. Provide support to the Government for all tasks required to achieve cybersecurity certifications and support obtaining Authority to Operate (ATO) for all installed systems; to include implementing and proving compliance with NIST 800-53 Controls.

· Provide system engineering design, development, integration, testing, environmental qualification, and life cycle support for the MK 6 MOD X compute infrastructure products and infrastructure software solutions. Support the sustainment and maintenance of deployed systems, and proactively resolve all production and fleet issues, including observed failures and feedback from shore facilities and shipboard issues that impact overall supportability. This FRP contract will provide original equipment manufacturer (OEM) reach back to U.S. Navy, thereby eliminating the need for sustainment contracts.

· Develop, maintain, and support a Configuration Management (CM) process for the Government approved “hardware factory” (defined below) catalog of computing infrastructure products and software solutions. Provide CM of all delivered products to include the configuration of each product.

· Propose and transition new technologies and capabilities to production and integrate into the MK 6 MOD X design.

· Deliver to the Government directed system (e.g., NSERC) all engineering documentation, product lists, logistics support products, curriculum, support materials, spares, and INCO (installation and checkout) as necessary to provide the “as developed” product support, including contractor provided training for each platform variant. This shall include source data which at a minimum shall include the data required for the installation, supportability, reliability, and maintainability for Government approved products and deployed systems. Source data is referenced in Section 4.7.1 Technical Data and Computer Software Data.

1.1. U.S. Navy Organization

Program Executive Office (PEO) Integrated Warfare Systems (IWS) is responsible for the delivery of the Integrated Combat System (ICS) and its underlying infrastructure across the Surface Force portfolio.

1.2. Program Background

The ICS is the next step in the evolution of the Surface Force’s Combat System. The Navy will evolve AEGIS, SSDS, FMS into a Surface Combat System of Systems (CSoS) that integrates sensors, command and control nodes, weapons, and communication systems across the Naval Force to achieve decision superiority at machine speeds.

2.0. APPLICABLE DOCUMENTS

The Contractor shall use the following specifications, standard, handbooks, and reference documents if called out in any of the paragraphs. If a conflict exists between the stated and referenced requirements, the order of precedence shall be in accordance with FAR Clause 52.215-8. These documents may be updated periodically; therefore, the contractor shall comply with the latest versions unless instructed otherwise by the Government. In the case of conflicting requirements or guidance of the applicable documents, the contractor shall present the conflict to the Contracting Officer Representative (COR) for resolution/guidance.

2.1. Incorporation by Reference

All specifications, exhibits, drawings, or other documents which are referenced in this contract, but are not attached hereto, are hereby incorporated by reference.

2.2. Issue of Documents

The following documents listed in the Department of Defense Index of Specification and Standards (DODISS) form a part of this SOW to the extent specified herein.

2.3. Government Documents

Military Standards

Department of Defense (DoD)/Department of the Navy (DoN) Regulations, Directives and Instructions

28 February 2006

DoDI 5200.39

Critical Program Information (CPI) Protection within the Department of Defense 16 July 2008

26 April 2013

August 1997

Program 07 April 2011

14 March 2014

252.211-7000

252.245-7003 Contractor Property Management System Administration June 16, 2024

Chairman of the Joint Chiefs of Staff (CJCS), Joint Requirements Oversight Committee (JROC) Instructions and Memoranda

Secretary of the Navy (SECNAV) and Office of the Chief of Naval Operations (OPNAV) Instructions

NAVSO P-7000

Department of Navy (DON) Counterfeit Material Process Guidebook

Naval Sea Systems Command (NAVSEA) and Program Executive Office Integrated Warfare Systems (PEO IWS) Regulations, Directives and Instructions

With Encls: (1) PEO IWS Enclave Cybersecurity Requirements Version 1.0; and (2) Acronyms

With (Enclosure 1: Instructions for Risk Reporting)

(this is Encl 2 PEO IWS INST 4130.1C)

Military Handbooks and DoD Guidance

PEO IWS/NAVSEA Manuals, Plans and Specifications

Availability of Documents Most unclassified Defense specifications and standards may be downloaded from the following ASSIST websites:

(1) ASSIST (https://assist.dla.mil/online/start/);

(2) Quick Search (http://quicksearch.dla.mil/);

Other document sources are as follows:

(1) DoD issuances https://www.esd.whs.mil/dd/dod-issuances/

(2) DoN issuances https://www.secnav.navy.mil/doni/default.aspx

(3) PEO IWS documents (Contact Agreement Officer Representative (AOR))

(4) Copies of non-Government publications not listed in the DoDISS may be obtained from the respective industry association.

2.4 Non-Government Documents

3.0 GENERAL PROGRAM REQUIREMENTS (applicable to all CLINs)

Unless stated otherwise, the work required by section 3.0 of the SOW is applicable to all requirements under this contract. Program information, deliveries, and data shall be handled in accordance with the Contract Security Specification, (DD Form 254).

3.1 Security Clearance Requirements

This is DoD work effort involving access to and the safeguarding of classified information and/or material. The security policies, procedures and requirements stipulated in the National Industrial Security Program (NISP), National Industrial Security Program Operating Manual (NISPOM) and any supplements thereto are applicable, including applicable FAR and DFARS clauses. The Contractor shall also comply with DoD Manual 5200.1, Volume 1 through 3, Security Executive Agency Directive (SEAD) 3 reporting requirements, DoD Manual 5200.1 Information Security Program Volume 1 through 3, DoD 5200.48 Controlled Unclassified Information (CUI), and Defense Counterintelligence & Security Agency (DCSA) Assessment and Authorization Process Manual (DAAPM), Navy security regulations and guidance, and other security requirements as described below. All classified material shall be processed and protected in accordance with the terms and conditions of this contract and the attached DD Form 254.

3.2 Security Level

The Contractor shall possess and maintain a Defense Security Service SECRET facility clearance eligibility at the time of award in accordance with the National Industrial Security Program Operating Manual (NISPOM), 32 Code of Federal Regulation (CFR) Part 117, see DD Form 254 Items 1a and 1b (Attachment). The Contractor (and any subcontractors performing classified work) SHALL NOT BE:

· Under foreign ownership or control unless the Contractor is operating under a special security agreement (SSA) pursuant to the NISP and is a National Technology and Industrial Base (NTIB) covered entity with an "ultimate parent" located in a country that is part of the NTIB, defined by Title 10, U.S. Code, Chapter 381, Section 4801, as Canada, Australia, or the United Kingdom.

· Restricted in access to Compartmented Information, Cryptographic Materials or Systems, Restricted Data, or Formerly Restricted Data.

The contract requires SECRET personnel clearances with access limited to another Contractor’s facility or a government activity. See DD Form 254 Item 8 and 11a.

The Contractor’s Security Officer shall (1) be responsible for all security aspects of the work performed under this procurement, (2) assure compliance with all DoD and Service regulations regarding security and (3) assure compliance with any written instructions from the Security Officers of each Government facility.

Any records and data or information the Contractor may have access to may be highly sensitive and confidential. The contractor shall not divulge any information about files, data processing activities or functions, user IDs or passwords or any other knowledge that may be gained to anyone not authorized to have access to such information. It is the Contractor’s responsibility to ensure that all required employees have proper authority. The Contractor shall protect critical information associated with this contract to prevent unauthorized disclosure and shall observe OPSEC requirements. See DD Form 254 Item 11j.

3.3. Communication Security (COMSEC)

SIPRNET and classified equipment will be housed at a government or vendor site and provided to the Contractor. See DD Form 254 Item 8.

3.4. Controlled Unclassified Information (CUI)

The contractor shall be required to have access to CUI with developers and integrators, see DD Form 254 Item 11l.

Security classification guides (OPNAVINST 5513 series) and controlled unclassified information (e.g., FOUO, distribution statement controlled) are not authorized for public release; therefore, they cannot be posted on a publicly accessible webserver or transmitted over the internet unless appropriately encrypted. Request for public release cannot be transmitted via the internet until the contractor receives final approval from the COR. CUI transmission shall be in accordance with DoD Manual 5200.01 Information Security Program Volume 1 through 3 and DoD 5200.48 Controlled Unclassified Information (CUI).

3.5. Facility

The contractor shall have the ability to receive, log, track, and store unclassified documents, in accordance with applicable regulations (e.g., NISPOM). The contractor shall have Controlled access to a Government site and personnel security mechanisms in place (e.g., facility has swipe access to control access to the area). The contractor shall require access to CUI for software development and interfacing with system engineering, software integration, and testing entities.

All facility security requirements shall be met at time of award and maintained thereafter. In general, all necessary facility clearances shall be at the expense of the contractor. The contractor shall comply with all security requirements.

The contractor shall require access to NATO information to support U.S, surface combatant support of NATO operations. The contractors’ development of new or augmenting existing technology must be compatible relevant to NATO operations. See DD Form 254 Item 10g.

3.6. Personnel

The contractor shall ensure all personnel accessing classified information or material associated with and/or performing work relative to the resultant procurement shall be United States citizens. All contractor and subcontractor personnel shall possess and maintain a final clearance at the appropriate level for accessing classified materials. If any contracted personnel are unable to obtain a SECRET clearance within 30 calendar days of contract award, the contractor shall:

1. Notify the Government.

2. Terminate billing for the employee against the contract.

Furthermore, if any contracted personnel employed by the contractor fail to maintain the required security clearance or access, the contractor shall:

3. Notify the Government of this discrepancy.

4. Terminate billing for the employee against the contract effective the date of loss of clearance.

All contractor personnel and subcontractors requiring access to both a Government facility and a DoD enabled network shall obtain a government issued Common Access Card (CAC). The contractor shall work with the COR to submit the appropriate justification and coordinate the paperwork for obtaining a CAC. The approval of a CAC is at the discretion of the COR. If the COR determines that the Contractor is not approved to receive a CAC, the COR may authorize the procurement of a RAPIDGate pass to obtain access to the Government facility. All other contractor and subcontractor personnel requiring occasional access to a Government facility shall submit a visit request via the Joint Personnel Adjudication System (JPAS) and check in through the facilities’ visitor control center. The contractor has five (5) business days to return all Government issued identification badges to the COR upon Period of Performance (PoP) completion. In general, all necessary employee security clearances shall be at the expense of the contractor. The contractor shall comply with all security requirements Cybersecurity Compliance to NIST 800-171.

The contractor shall implement the security requirements of DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, and National Institute of Standards and Technology (NIST) Special Publication 800-171 in addition to the following supplemental requirements. The contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

The contractor shall encrypt all data at rest as defined in NIST Special Publication 800-53 Security Controls SC-13 and SC-28(1). The contractor shall allow the NCIS to install network sensors, owned and maintained by NCIS, on the contractor’s information systems or information technology assets when Government Intelligence indicates a vulnerability or a potential vulnerability. The contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of DON critical programs and technologies.

The contractor shall implement the cyber incident reporting requirements in accordance with DFARS 252.204-7012 The contractor shall also formally notify the Government in writing of every cybersecurity incident including external intrusions detected on their corporate and developmental systems (Accident Incident Report (Cyber Security Incident Notification) [A001]). If Navy data or information may have been compromised, the contractor shall provide details of each incident, and an enumeration of the Navy information potentially compromised. The contractor shall ensure the integrity of systems where the to-be-delivered software is kept and utilized. The contractor shall assist the Government in any investigation and take any remediation steps necessary to prevent future incidents. The contractor shall provide for the protection of CUI and/or Classified information in accordance with the standards set forth in DoD security policies.

Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

1. Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

2. Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

3. Implement Control 3.1.12 (monitoring and control remote access sessions) – Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

4. Audit user privileges on at least an annual basis;

5. Implement: Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

6. Implement Control 3 .13 .16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

7. Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

Deliverable Data Item:

A001, Accident Incident Report (Cyber Security Incident Notification)

3.7 System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews The contractor shall deliver and implement a SSP that implements the security requirements in DFARS Clause 252.204-7012, 252.204-7019, 252.204-7020, 252.204-7021. SSP and its related POAM shall be delivered in accordance with the SSP and POAM, DI-MGMT-82247 (Contractor’s Systems Security Plan and Associated Plans of Action to Implement NISP SP 800-171 on a Contractor’s Internal Unclassified Information System [A002]).

Within thirty (30) days of award, the contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available and provide for review by the Government at the contractor's facility. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this agreement. The contractor shall fully cooperate in the Government's review of the SSPs at the contractor’s facility.

If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the contractor of each identified deficiency. The contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The contractor shall immediately notify the agreements officer of any failure or anticipated failure to meet a milestone in such a POAM.

Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the contractor's facilities. The Government may continue to conduct follow-on reviews until the Government determines that the contractor has corrected all identified deficiencies in the SSP(s).

The Government may, in its sole discretion, conduct subsequent reviews at the contractor's site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of award) and may conduct such reviews at any time upon thirty (30) days' notice to the contractor.

Deliverable Data Item:

A002, Contractor’s Systems Security Plan and Associated Plans of Action to Implement NISP SP 800-171 on a Contractor’s Internal Unclassified Information System

3.8 Program Management (Applicable to all CLINs)

The Contractor shall designate a Program Manager who shall have responsibility for all aspects of this contract and the authority to commit the Contractor to specific courses of action. The Contractor shall perform all administrative, technical, and financial management functions required to support this effort and shall maintain the status, including all technical activities, problems or deficiencies, and recommended solutions. The Contractor shall be responsible for those activities assigned to subcontractors, to ensure the delivery of all supplies and services specified in this contract. The deliverable for this work shall be the Contractor's Progress and Status Report [A003].

Deliverable Data Item:

A003, Contractor's Progress and Status Report

3.8.1 Cost and Software Data Report (CSDR)

The Contractor shall use management procedures in accordance with DoDI 5000.73 that provide for generation of timely and reliable information for the Cost and Software Data Report (CSDR) data items of this agreement referenced in Attachment 9 and shall:

a. Use a documented standard CSDR process that satisfies the guidelines contained in the DoD 5000.04, CSDR Manual.

b. Provide access to all pertinent records, data, and plans as requested by representatives of the Government for the purpose of permitting Government surveillance and review of reporting compliance;

c. Use the Government-approved CSDR Plan, DD Form 2794, and the related Resource Distribution Table (RDT) as the baseline for reporting provided as Attachment 9 and 10;

d. Prepare and deliver to the Government a Cost and Hour Report (FlexFile) for every indicated data element Functional Cost-Hour Report (Cost and Software Data Report (CSDR)) Report [A004] within the Government-approved CSDR Plan;

e. Provide a Work Breakdown Structure (WBS) Dictionary and Remarks as a part of the FlexFile format Functional Cost-Hour Report (Cost and Software Data Report (CSDR)) Report [A004] for every data element identified within the approved Contract CSDR Plan;

f. Prepare and deliver to the Government a Quantity Data Report for every indicated data element Quantity Data Report [A005] within the Government-approved Contract CSDR Plan;

g. Prepare and deliver to the Government Technical Data Report [A006];

h. Prepare and deliver to the Government Contractor Business Data Report DD Form 1921-3 Report [A007];

i. Provide updates to the Government-approved CSDR Plan and related RDT for Government approval. Updates include aligning reporting subcontractor effort to a single WBS element and updating the RDT as new Subcontracts are awarded;

j. Hold a post award meeting after contract award to include a discussion of the Contractor’s standard cost and software data reporting process that satisfies the guidelines contained in the DoD 5000.04 (CSDR Manual) and the requirements in the Government-approved CSDR Plan and related RDT;

k. Identify each subcontractor at each tier for CSDR requirements apply to all Subcontracts valued over $50 million and any Subcontracts valued between $20 million and $50 million that are designated by the Cost Working Integrated Product Team (CWIPT) as high risk, high value, high technical interest or a middle-tier acquisition (804);

l. Notify the Government of any subcontractor changes or new subcontracts awarded for subcontracts that exceeds $50 million;

m. Flow-down DD Form 1921-3 to any Subcontractors required to submit Cost and Software Data Reporting.

Deliverable Data Item:

A004, Functional Cost-Hour Report (Cost and Software Data Report (CSDR)) Report A005, Quantity Data Report A006, Technical Data Report A007, Contractor Business Data Report DD Form 1921-3 Report

3.8.2 Integrated Master Schedule (IMS)

The Contractor shall develop and maintain an Integrated Master Schedule (IMS). The schedule shall align with U.S. Navy timelines, contain the planned events and milestones, accomplishments, exit criteria, and activities from contract award to the completion of the contract. The Contractor shall quantify risk in hours, days, or weeks of delay and provide optimistic, pessimistic, and most likely duration for each IMS activity and event. The IMS shall be included in the Integrated Program Management Data and Analysis Report [A008].

Deliverable Data Item:

A008, Integrated Program Management Data and Analysis Report (Integrated Master Schedule (IMS)

3.8.3 Post Award Conference (PAC)

The Contractor shall host and conduct a PAC with the Government within thirty (30) calendar days of contract award. The Contractor shall develop the PAC structure and agenda. Contractor shall make available read-ahead material and presentation material ten (10) at least calendar days prior to the PAC. The Contractor shall generate and record minutes, attendance list, and action items of the PAC, and produce copies of all information presented. The Conference shall be held at the Contractor’s facility. Representatives from each significant subcontractor on the Contractor's team shall attend. Minutes of the meetings shall be kept by the Contractor unless otherwise directed by the Government. Minutes shall include a summary of discussions, copies of handouts or graphics, and a listing of action items, and be distributed electronically Presentation Material [A011].

Deliverable Data Item:

A011, Presentation Material

3.8.4 Progress Reporting

The Contractor shall prepare and deliver monthly Progress, Status, and Management Reports to provide status of all assigned tasks, report progress against milestones, and identify technical or schedule problem areas or risks along with recommendations for resolution, Contractor's Progress, Status, and Management Report [A003]. The Contractor shall provide monthly Contract Funds Status Report (CFSR) [A009]. Reports shall be tailored to provide required Cost, Technical, and schedule information.