ITSS_DRAFT_PWS__Seaport_N00024-16-R-3125.pdf

Information Technology Support Services (ITSS) 1 Performance Work Statement (PWS) 2

C.1. OVERALL TASK ORDER (TO) OBJECTIVE 4

The mission of the Naval Surface Warfare Center - Carderock Division (NSWCCD) is to provide 5 research, development, test and evaluation, analysis, acquisition support, in-service engineering, logistics 6 and integration of surface and undersea vehicles and associated systems as well as to develop and apply 7 science and technology associated with naval architecture and marine engineering, and provide support to 8 the maritime industry. The contractor shall support provision and management of the entire range of 9 information technology (IT) services, support, and infrastructure necessary for NSWCCD to meet its 10 mission and operational objectives. The required non-personal support services shall be provided as 11 described throughout this PWS; and may evolve as NSWCCD’s mission and operational objectives 12 evolve in response to strategic Department of the Navy (DoN) guidance and direction. The contractor 13 shall enable more efficient and effective operations and enterprise business solutions that support both 14 today’s and tomorrow’s IT needs. 15 The primary place of performance is West Bethesda, MD. 17

C.2. SCOPE OF REQUIRED SERVICES 19

The required support services are categorized in ten (10) broad performance areas that provide a 20 comprehensive outline of all life-cycle phases of the IT solutions NSWCCD anticipates will be pursued in 21 the prescribed level of effort (LOE) estimate (Table C.4.1). 22 Performance Area 1: Network Operation and Maintenance Services 24 Network operations support shall include planning, design, engineering, installation, configuration 25 management, documentation, maintenance, and monitoring of teleconferencing, network communication 26 devices, and associated elements that support core network functions and services; including, but not 27 limited to: Cisco routers, Cisco switches, Cisco Adaptive Security Appliance (ASA) firewalls, Cisco 28 Access Control Server (ACS), Cisco Identity Services Engine (ISE), Cisco Prime Infrastructure, Cisco 29 SourceFire Intrusion Prevention System (IPS), and Zebra Technologies’ AirDefense Wireless Intrusion 30 Detection and Prevention System. 31 Network operations support shall also include the following: 33

Configuration and management of VLANs, routing and failover mechanisms. 34 Configuration and management of firewall rules based on ports, protocols, and services. 35 Configuration and management of communication security (COMSEC) equipment such as 36

Tactical Local Area Network Encryption (TACLANE) devices. 37 Management of IPv4 and IPv6 network address schemes and allocations. 38 Management of network related STIG activities. 39 Provision of services for obtaining and troubleshooting various-capacity leased lines and 40 associated equipment used for interface into the RDT&E network and NSWCCD’s detachment 41 sites. The Contractor shall ensure all circuit information is current and no inadvertent 42 interruption of service occurs. The Contractor shall prepare circuit diagrams and update service 43 agreements, where needed. The Contractor shall coordinate discontinue action on circuits no 44 longer required by the Government and maintain inventory of circuits. 45

Support services shall be provided from 0600 to 1800 Eastern Time, Monday through Friday. Work 47 outside of these hours shall be coordinated and approved [in advance] with the COR. 48

Performance Area 2: Server/System Administration 51 Core server and system administration shall include planning, design, engineering, installation, 52 configuration, documentation, maintenance, data protection, data recovery, and monitoring of 53 workstations, servers, storage arrays and associated elements of systems that support core server functions 54 and services on a variety of networks, including but not limited to; the DMZ, Carderock Division Intranet 55 (CDI), Ship Engineering and Analysis Technology (SEATech) Center, and RDT&E core network. These 56 functions and services include but are not limited to Active Directory, Microsoft System Center, Public 57 Key Infrastructure (PKI), server virtualization infrastructure, backup and restore systems, SharePoint, 58 Lotus Domino/Lotus Notes, file servers, printers, Data At Rest Encryption, standardized desktop 59 deployment, SQL servers, Red Hat Linux, DNS, DHCP, and network monitoring and auditing services. 60 The contractor shall provide strategic security solutions to enhance the confidentiality, integrity, and 62 availability of the core server functions and services. This includes the developing and engineering a 63 COOP plan in order to maintain the availability of required services. 64 The contractor shall provide ongoing support for the operation and management of the core server 66 functions and services. Activities to be performed shall include monitoring and troubleshooting of the 67 core system, applying patches and updates, performing system upgrades, developing/documenting 68 Standard Operation Procedures (SOPs) for the system configuration and operations. 69 The contractor shall provide support for the system upgrades, application migration, and integration. This 71 includes the migration, documentation, and operational support of SharePoint, Lotus Domino/Lotus 72 Notes, client and server OS, and Active Directory. 73 The contractor shall support cybersecurity efforts; including the Certification and Accreditation (C&A) 75 process; and ensure core systems meet security requirements as directed by DoD Security Technical 76 Implementation Guides (STIGS) and Navy Communications Tasks Orders (CTO). 77 Support services shall be provided from 0600 to 1800 Eastern Time, Monday through Friday. Work 79 outside of these hours shall be coordinated and approved [in advance] with the COR. 80 Performance Area 3: High Performance Computing 82 High performance computing support services include 83

Server and system administration support; 84 Planning, design, installation, configuration, documentation, system remediation, operations and 85 maintenance, performance tuning, data protection, backup, and recovery; 86 Interfacing with vendors and service providers for analysis and troubleshooting; 87 User support, including but not limited to: hardware, software, and multimedia support services; 88 Security requirement implementation; and 89 Monitoring of high performance computing clusters, servers, storage arrays, high performance 90 workstations, and associated elements. 91 Support services shall be provided from 0600 to 1800 Eastern Time, Monday through Friday. Work 93 outside of these hours shall be coordinated and approved [in advance] with the COR. 94 Performance Area 4: Design/Installation of Network Infrastructure Extensions and Enhancements 96 The Contractor shall provide support services to include planning, design, engineering, installation, 97 configuration management, documentation, and maintenance of network infrastructure extensions or 98 modifications. 99

Design services shall include development of installation drawings of the proposed cable and equipment 101 closet locations as well as a list of materials required to complete the task. Designs shall be compatible 102 with the electrical, physical, and environmental limitations of the site. 103 Upon approval and direction to proceed, the Contractor shall provide the materials and technicians to 105 perform required installation services within an agreed upon time frame. 106 The Contractor shall conduct validation testing and review installer test reports after installation of a 108 network extension to determine compliance with the design/contract specifications and report any 109 discrepancies to the COR for further action. 110 Support services shall be provided from 0600 to 1800 Eastern Time, Monday through Friday. Work 112 outside of these hours shall be coordinated and approved [in advance] with the COR. 113 Performance Area 5: Help Desk / User Support 115 Help Desk / User Support, both telephone and desk-side, shall include desktop support through the use of 116 the Operations Service System (OPSS) Help Desk tracking application. The Contractor shall provide 117 support services to address issues with end-user computers, user accounts, ancillary devices, printers, and 118 office automation software to correct faults, improve performance, and adapt to a changing environment. 119 Additionally, helpdesk support services may include preventive maintenance. 120 Support services (desk-side and telephone) shall be provided from 0600 to 1800 Eastern Time, Monday 122 through Friday. Work outside of these hours shall be coordinated and approved [in advance] with the 123

COR. 124

Performance Area 6: Video Telecommunications (VTC) / Audio Visual (AV) 126 Support for VTC / AV activities shall include maintenance, troubleshooting, repair, installation and 127 configuration, setup, teardown, daily operations, training of Government personnel and scheduling of 128 associated resources. 129 Support services shall be provided from 0600 to 1700 Eastern Time, Monday through Friday. Work 131 outside of these hours shall be coordinated and approved [in advance] with the COR. 132 Performance Area 7: Media Transfer Support 134 Support services shall include the transfer of classified and/or unclassified data from a classified 135 computer via removable media. The Contractor shall ensure personnel performing this activity 136 have proper training and approval to perform Media Transfer Agent functions in accordance with 137 CARDEROCKDIVINST 5510.12. The Contractor shall ensure personnel designated as Media 138 Transfer Agents have an appropriate security clearance. 139 Performance Area 8: NMCI Support 141 The Contractor shall provide labor and material to support NMCI administration at the NSWCCD West 142 Bethesda and detachment sites. Requirements under Performance Area 8 include, but are not limited to: 143

Tracking of problem reporting and resolution. 145 Coordination of NMCI service delivery to remote site locations. 146 Gather and maintain NMCI documentation and signed agreements. 147 Generate reports for management analysis and gather metrics for status reporting. 148 Delivery of customer support services; including installation, troubleshooting, and customer 149 assistance, in response to customer requirements. 150

Processing of Administrative Requests. 151 Create / Delete / Deactivate / Disable / Modify NMCI (user) Accounts: NMCI NIPR, 152

Developer (S&T Accounts, SIPRNET, NNPI, and Classified NNPI. 153 Update User Profile Information in the Global Address List (GAL, Active Directory, etc.) 154

Install / Transfer / Upgrade NMCI-approved software on a seat that is not included on the NMCI 155 Core Build. 156

Provides end-user support for processing Move / Add / Change (MAC) requests and resolving 157 NMCI Help Desk Tickets issues. 158

Contact with NSWCCD customers to obtain and process requests, to provide status on requests 159 and to provide clarification on routine issues. 160

Support services shall be provided from 0630 to 1700 Eastern Time, Monday through Friday. Work 162 outside of these hours shall be coordinated and approved [in advance] with the COR. 163 Performance Area 9: Software Development/Code Support 165 The Contractor shall provide support for software applications and scripts. As necessary, the Contractor 166 shall migrate the functionality of existing in-house developed software applications to other platforms, 167 languages, or software architectures. 168 Performance Area 10: Programmatic Support 170 The Contractor shall assist in data analysis and management and the preparation of presentation materials 171 for Code 10. 172 Office management support shall include maintaining classified and unclassified libraries and inventory, 174 preparing and maintaining all security-related documentation, supporting budget planning and execution, 175 maintaining facility access roster, facility maintenance coordination and other general IT office support 176 services. 177 Cross-Area Support Services: 179 The Government anticipates a number of support services will be required that cross performance areas. 180 These support services include: 181

Administrative support services will vary based on the Government’s specific requirements and 183 may include word processing, copying and filing, managing supplies, facilitation of media 184 destruction; shipping / receiving of Government material; scheduling conference rooms; and 185 coordination / planning for meetings and conferences. 186

Procurement of miscellaneous material will be required, subject to approval by the Contracting 188

Officer’s Representative (COR). 189

Technical writing services will be required and will include, but not be limited to: user 191 manuals, reports, documentation, presentations, proposals, outlines, and summaries. The 192 specific requirements of each document shall be addressed as applicable. 193

Participation in meetings and program/project reviews of varying frequency and scope. 195 The Government anticipates weekly status meetings where the contractor will be 196 responsible for providing the following: 197

Status of currently assigned projects 199

Objectives achieved 200

Percentage completed 201 Issues encountered 202

Statuses of service tickets open during the preceding week 203 Total tickets entered 204 Total tickets closed 205 Total tickets pending 206 Tickets with response time greater than 1 hour 207 Tickets open more than one day 208 Average response time 209 Average time for ticket resolution 210

C.3. EXISTING INFRASTRUCTURE INFORMATION 212

Table C.3 – NSWCCD INFRASTRUCTURE 214 Equipment type Number of devices

High Performance Computing Systems 3

Windows workstations 1370-2000

Windows Servers 60-100

Linux workstations 30

Linux Servers 60-115

Switches 100-150

Routers 15-20

Firewalls 5-10

ACS and ISE Appliances 5-10

C.4. ESTIMATED LEVEL OF EFFORT REQUIRED 216

Table C.4.1 – Basic Hours 218

Labor Categories Reg

Hrs/Yr OT Hrs/Yr OY1 OY2 OY3 OY4

Program Manager** 192 N/A 192 192 192 192

Project Manager / Senior Operations Engineer**

1920 N/A 1920 1920 1920 1920

Senior Microsoft Systems Engineer** 2880 40 3840 3840 3840 3840

Senior Network Engineer** 2880 80 3840 3840 3840 3840

Network Engineer 1920 80 3840 3840 3840 3840

Microsoft System Analyst/Administrator 3840 80 5760 5760 5760 5760

Help Desk Representative 3840 N/A 3840 3840 3840 3840

Software Engineer 1920 N/A 1920 1920 1920 1920

Linux Engineer 4800 150 5760 7680 7680 7680

Workstation Technician 3840 N/A 7680 11520 11520 11520

Senior Installer 1920 150 1920 1920 1920 1920

Installer 3840 300 3840 3840 3840 3840

Senior Customer Service Representative 1920 120 1920 1920 1920 1920

Customer Service Representative 5760 360 5760 5760 5760 5760

Senior VTC Technician 3840 40 3840 3840 3840 3840

VTC Technician 1920 40 1920 1920 1920 1920

Program Analyst 3840 40 5760 5760 5760 5760

Total Estimated LOE 51072 1460 63552 69312 69312 69312

**Key Personnel 219

Table C.4.2 – Surge Hours 221 Labor Category Hrs/Yr

Installer 3840

Total Estimated LOE 3840

C.5. PERFORMANCE STANDARDS 223

Performance shall be in accordance with the most current version of all applicable National Institute of 224 Standards and Technology (NIST), Department of Defense (DoD), Department of the Navy (DoN), Naval 225 Sea Systems (NAVSEA), NSWC and NSWCCD policies, processes, and procedures and all applicable 226 commercial standards and regulations; whether they are explicitly listed in this PWS/TO or not. 227 The attached Quality Assurance Surveillance Plan (QASP), Attachment J-X, outlines specific 229 performance objectives and metrics (e.g. vacancies must be filled within 45 days), which are summarized 230 as follows: 231

PWS

Performance

Area

Performance Objective

Performance Standard Acceptable Quality Level

All Develop technical documentation such as user manuals, reports, documentation, presentations, proposals, outlines, and summaries.

Documents are technically accurate, grammatically correct and meet Professional standards.

Documentation requires no more than two (2) review/comment/approval cycles, to meet acceptance.

All Overall customer satisfaction based on technical performance, schedule adherence, staffing and overall management.

100% of end users satisfied with contractor overall performance

85% of end users satisfied with contractor overall performance based on customer feedback.

N/A Monthly Status Report

(MSR) IAW CDRL

submitted on or before required date

Received with first pass yield 100% of the time

Received with first pass yield 95% of the time.

N/A Invoices submitted 100% of the time with required information

95% of the time with required information.

5 Helpdesk calls are responded to within acceptable limits from 0600-1800

Provide responsive and technically proficient helpdesk support from 0600-1800.

80% of calls logged in the helpdesk ticket tracking system within the 1st hour 100% of calls logged in the helpdesk ticket tracking system within 2 hours

80% of calls resolved within 8 hours (Excluding workstation drop installations)

1 Provide infrastructure 1. Installation (with or 1. Within ten (10) days after the receipt of a change installation and maintenance for the network cable plant per the time frames outlined in the Performance Standard and Acceptable Quality Level sections related to this objective.

without) activation of network drops (0 to 20 drops).

2. Installation with or without activation of network drops (21 to 50 drops).

3. Installation with or without activation of network drops (51 plus drops).

4. Network activations only (0 to 25).

5. Network activations only (26 to 50).

6. Network activations only (51 plus).

7. Deactivation of existing network drops (less than 50).

8. Deactivation of existing network drops (51 plus).

9. Patch panel and cabling installations request

2. Within fifteen (15) days after the receipt of a change request

3. Within the timeframe negotiated with business unit and COR 85% of the time.

4. Within three (3) days after the receipt of a change request

5. Within seven (7) days after the receipt of a change request

6. Within the timeframe negotiated with business unit and COR 85% of the time.

7. Within five (5) days after receipt of change request

8. Within the timeframe negotiated with business unit and

9. Within the timeframe negotiated with business unit and

1, 2, 3, 9 Ensure networks and systems are consistently up and functioning.

Network and system interruptions / issues are addressed in a timely fashion from 0600-1800.

During the hours of 0600-1800:

80% of interruptions/issues are responded to by troubleshooting within 1 hour.

100% of interruptions/issues are responded to by troubleshooting within 2 hours.

1, 2, 3, 9 Complete assigned projects on a timely basis

95% of the time, projects will be completed within the scheduled time frame

85% of the time, projects will be completed within the scheduled time frame

1,2,3 Ensure servers, client computers, and network devices meet Cyber Security requirements

Apply vendor updates/patches as directed by Security Technical Implementation Guide (STIG) and Information Assurance Vulnerability Alerts (IAVA)

85% of the systems shall be patched according to the required timeframe given by the Navy in conjunction with the Cyber Security Branch and Information System Security Manger (ISSM) employees

C.6. STANDARD TIME AND OVERTIME 235

NSWCCD normal operating hours are Monday – Friday from 0600-1800. Work outside these hours must 236 be approved (in advance) by the COR. 237 If a particular timeframe is not specified in a Performance Area above, the contractor shall provide 239 support services Monday - Friday from 0730 – 1600; unless otherwise approved by the COR. 240 The Government anticipates overtime work under this TO in the amounts estimated in the LOE table 242 (Table C.4.1). However, no overtime shall be worked without prior written approval from the COR. 243 Written requests for overtime shall be submitted no later than 48 hours in advance of the proposed 244 overtime. 245

C.7. CYBER SECURITY / INFORMATION ASSURANCE WORKFORCE (IAWF) PROGRAM 247

C. 7.1 In accordance with DoD 8140.01-M, Information Assurance Workforce Improvement Program, 249 and SECNAV 5239.2, DON IAWF Management Manual to support the Cybersecurity/IAWF Program, 250 Contractors performing IA functions must be designated as a member of the Cybersecurity\ Information 251 Assurance (IA) Workforce and meet qualification requirements for their duties, which may include both 252 an IA baseline certification and operating system (OS)/Computing Environment (CE) certification 253 requirement per below instructions: 254

a. Contractors performing Cybersecurity/IA functions must meet the minimum IA baseline 256 certification prior to being performing services under this TO. 257 Baseline Certification – The baseline certification is a security certification and is required for 259 all cybersecurity members (all IAT and IAM levels) of the Cybersecurity Workforce/IA 260 Workforce. Contractors must have a baseline certification prior to performing any IA duties and 261 is a condition of hire. 262

b. The Contractor shall ensure the personnel possess or obtain within 30 calendar days of TO 264 issuance, and maintain the appropriate certifications and continuing professional education 265 requirements for their Cybersecurity/IAWF position. Time and costs related to obtaining the 266 required certifications and professional education requirements are not allowable costs under the 267

TO. 268

Continuing Professional Education (CPE) Requirements – As technology continuously 270 advances, nearly all certifications expire or have continuing professional education (CPE) 271 requirements. Both the baseline certifications and computing environment certifications may 272 require continuous education. The vendor requirements state whether the certifications require 273 continuous education. CPE requirements are not a direct Contractor cost to the Government. The 274 Contractor is responsible for meeting the qualification requirements for all positions on the 275 contract in the Cybersecurity/IAWF matrix and should not invoice the Government for training, 276 certification tests, or continuing profession education requirements. 277

c. Contractor personnel accessing information systems shall meet applicable training and 279 certification requirements set forth in DoD 8140.01M and SECNAV M‐5239.2. The Contractor 280 is responsible to ensure that personnel possess and maintain the proper and current IA 281 certifications in accordance with DoD 8140.01M and the Computing Environment/Operating 282 System (CE/OS) certifications in accordance with encl (1). 283

d. Upon hire all Contractor personnel assigned to the IAM/IAT Level I-III position (as appropriate) 285 shall sign the Information System Privileged Access Agreement and Acknowledgement of 286 Responsibilities statement. 287

C.7.2 Cybersecurity/IA Workforce positions and labor categories are identified in the Personnel 289 Qualifications attachment (J-XX). This contract includes IA functional services for DoD information 290 systems and requires appropriately certified Contractor personnel to access a DoD information system to 291 perform contract duties. The Contractor is responsible for providing to the Contracting Officer (KO): 292

a. The IA training certification, certification maintenance, and continuing education or sustainment 294 training required for the information assurance functional responsibilities. 295

b. After contract award, the Contractor is responsible for ensuring the certifications and certification 297 status of all Contractor personnel performing IA functions as described in DoD 8140.01-M, 298 Information Assurance Workforce Improvement Program, are in compliance with the manual and 299 are identified, documented, and tracked. 300

C.8. DELIVERABLES 302

All deliverables associated with this TO are unclassified unless specified otherwise. 303 C.8.1 Monthly Progress / Financial Report (CDRL 001) 305 The Contractor shall provide a monthly progress report in accordance with CDRL A001, which will 306 include the following: 307

a. Burn Rate Analysis 309 The Burn Rate Analysis Report is a summary report that captures the rate at which the funds are 310 expended. This report shall be attached in Wide Area Workflow Receipts and Acceptance 311 (WAWF-RA), with an email copy to the COR. 312

b. Incurred Cost Report 314 The Incurred Cost Report is a summary of all costs incurred to date. This report shall be attached 315 in Wide Area Workflow Receipts and Acceptance (WAWF-RA), with an email copy to the COR. 316

C.8.2 Project Planning Chart (CDRL 002) 318 The Contractor shall provide any Plan of Action / Milestones (POAMs) and other documentation as 319 required. 320 C.8.3 Briefing Material/Presentations (CDRL 003) 322 The Contractor shall provide presentations on the capabilities and functionality of the tools and web 323 environments developed under this contract as required. 324 C.8.4 System Documentation (CDRL 004) 326 The Contractor shall provide upon project completion a description of changes applied and updates to 327 System and Network documentation as required. 328

C.9. GOVERNMENT FURNISHED EQUIPMENT / MATERIALS 330

The Government will provide on-site office space and computer workstations to the Contractor in 331 performance of this task order as required. 332 Additionally, contractor personnel may be required to operate a low-speed utility cart; primarily for 334 transport of IT equipment. 335

C.10. PLACE OF PERFORMANCE / TRAVEL 337

The primary place of performance is NSWCCD in West Bethesda, MD. Occasional travel may 338 be required to support the NSWCCD mission; predominantly to NSWCCD detachments, 339 which currently include San Diego, CA; Silverdale, WA; Bayview, ID; Memphis, TN; Port 340 Canaveral, FL; Fort Lauderdale, FL; and Perryville, MD. The Government estimates 1-2 341 individuals may be required to travel up to nine (9) times per year. 342 Contractor personnel may also work at the Contractor’s location when deemed appropriate and 344 approved/directed by the COR. All travel under this effort must be requested and/or authorized 345 in writing by the COR; and must show the appropriate order number, the number of people 346 traveling, the number of days for the trip, the reason for the travel, and any high cost or unusual 347 costs expected. The contractor is not authorized to perform any travel that is not in conjunction 348 with this effort. Travel costs shall be in accordance with FAR 31.205-46 and the Joint Travel 349 Regulations. 350

C.11. SNOW DAYS AND HOLIDAYS 352

Unless notified otherwise [in advance] by the Contracting Officer’s Representative, support services 353 shall not be provided on the ten (10) Federally-recognized holidays. 354 If appropriate, Contractor personnel may be required to work at an alternate location during inclement 356 weather, other emergencies, or site closures. Contractor personnel shall adhere to the policy of the site 357 of performance and shall coordinate with the COR. 358

C.12. PERIOD OF PERFORMANCE 360

The potential period of performance is five years; one 12-month base period and four 12-month option 361 periods. 362

C.13. CONTRACTING OFFICER REPRESENTATIVE (COR) 364

The COR for this task order will be provided to the contractor at the time of TO issuance. 365

C.14. ENTERPRISE-WIDE CONTRACTOR MANPOWER REPORTING APPLICATION 367

(ECMRA) 368

The contractor shall report contractor labor hours (including subcontractor labor hours) required for 369 performance of services provided under this contract for the Naval Surface Warfare Center, 370 Carderock Division via a secure data collection site. The contractor is required to completely fill in all 371 required data fields using the following web address https://doncmra.nmci.navy.mil. 372

C.15. SECURITY AND SAFETY REQUIREMENTS 374

C.15.1 Due to the possible sensitive work and work areas in which work may be performed; contractor 376 personnel, with the exception of temporary installers, are required to have [at a minimum a] SECRET 377 security clearance. The Senior Systems Engineer, Senior Communications Engineer and Linux Engineer 378 require TOP SECRET security clearances. The Senior Communications Engineer also requires a 379 COMSEC assignment letter. All security requirements shall be met in accordance with the DD Form 380

254. 381 C.15.2 DFARs Section 252.239-7001 Information Assurance Contractor Training and Certification is 383 hereby invoked. 384 C.15.3 The Contractor shall comply with all NSWCCD Security and Occupational Safety 386 and Health regulations. 387 C.16. PORTABLE ELECTRONIC DEVICES (PEDs) 389 C.16.1 Non-government and/or personally owned portable electronic devices (PEDs) are prohibited 391 in all NSWCCD buildings with the exception of personally owned cell phones, which are authorized 392 for use in spaces up to and including Controlled Access Areas. The contractor shall ensure the 393 onsite personnel remain compliant with current PED policy. NSWCCD instruction defines PEDS as 394 the following: any electronic device designed to be easily transported, with the capability to store, 395 record, receive or transmit text, images, video, or audio data in any format via any transmission 396 medium. PEDS include, but are not limited to, pagers, laptops, radios, compact discs and cassette 397 players/recorders. In addition, this includes removable storage media such as flash memory, 398 memory sticks, multimedia cards and secure digital cards, micro-drive modules, ZIP drives, ZIP 399 disks, recordable CDs, DVDs, MP3 players, iPADs, digital picture frames, electronic book readers, 400 kindle, nook, cameras, external hard disk drives, and floppy diskettes. 401 C.16.2 PEDs belonging to an external organization shall not be connected to NSWCDD networks or 403 infrastructure without prior approval from the NSWCCD Information Assurance Branch. 404 C.16.3 Personally owned hardware or software shall not be connected or introduced to any 406 NSWCCD hardware, network or information system infrastructure. 407 C.17.0 Electronic Spillages 409 C.17.1 Electronic spillages (ES) are unacceptable and pose a risk to national security. An electronic 411 spillage is defined as classified data placed on an information system (IS), media or hardcopy 412 document possessing insufficient security controls to protect the data at the required classification 413 level, thus posing a risk to national security (e.g., sensitive compartmented information (SCI) onto 414 collateral, Secret onto Unclassified, etc). The contractor's performance as it relates to ES will be 415 evaluated by the Government. ES reflects on the overall security posture of the Government and a 416 lack of attention to detail with regard to the handling of classified information of IS security 417 discipline and will be reflected in the contractor's performance rating. In the event that a contractor 418 is determined to be responsible for an ES, all direct and indirect costs incurred by the Government 419 for ES remediation will be charged to the contractor. 420 C.17.2 NSWCCD command security will continue to be responsible for the corrective action plan in 422 accordance with the security guidance reflected on the DOD Contract Security Classification 423 Specification - DD254. Command security will identify the contractor facility and contract number 424 associated with all electronic spillages during the investigation that involve contractor 425 support. Command security will notify the contracts division with the contractor facility name and 426 contract number, incident specifics and associated costs for cleanup. The PCO will be responsible to 427 work with the contractor facility to capture the costs incurred during the spillage clean up. The 428 contractor is also responsible for taking Information Security Awareness training annually, via their 429 Facility Security Officer (FSO), as part of the mandatory training requirements. If a spillage occurs 430 additional training will be required to prevent recurrence. 431 C.18. Digital Delivery of Data 433 C.18.1 Delivery by the contractor to the Government of certain technical data and other information 435 is now frequently required to be made in digital form rather than in hardcopy form. The method of 436 delivery of such data and/or other information (i.e., in electronic, digital, paper hardcopy, or other 437 form) shall not be deemed to affect in any way either the identity of the information (i.e., as 438 “technical data” or “computer software”) or the Government’s and the contractor’s respective rights 439 therein. 440 C.18.2 Whenever technical data and/or computer software deliverables required by this contract are 442 to be delivered in digital form, any authorized, required, or permitted markings relating to the 443 Government’s rights in and to such technical data and/or computer software must also be digitally 444 included as part of the deliverable and on or in the same medium used to deliver the technical data 445 and/or software. Such markings must be clearly associated with the corresponding technical data 446 and/or computer software to which the markings relate and must be included in such a way that the 447 marking(s) appear in human-readable form when the technical data and/or software is accessed 448 and/or used. Such markings must also be applied in conspicuous human- readable form on a visible 449 portion of any physical medium used to effect delivery of the technical data and/or computer 450 software. Nothing in this paragraph shall replace or relieve the contractor’s obligations with respect 451 to requirements for marking technical data and/or computer software that are imposed by other 452 applicable clauses such as, where applicable and without limitation, DFARS 252.227-7013 and/or 453

DFARS 252.227-7014. 454

C.18.3 Digital delivery means (such as but not limited to Internet tools, websites, shared networks, 456 and the like) sometimes require, as a condition for access to and/or use of the means, an agreement 457 by a user to certain terms, agreements, or other restrictions such as but not limited to “Terms of 458 Use,” licenses, or other restrictions intended to be applicable to the information being delivered via 459 the digital delivery means. The contractor expressly acknowledges that, with respect to deliverables 460 made according to this contract, no such terms, agreements, or other restrictions shall be applicable 461 to or enforceable with respect to such deliverables unless such terms, agreements, or other 462 restrictions expressly have been accepted in writing by the PCO; otherwise, the Government’s rights 463 in and to such deliverables shall be governed exclusively by the terms of this task order. 464 C.19. Non-Personal Services/Inherently Governmental Functions 466 C.19.1 The Government will neither supervise contractor employees nor control the method by 468 which the contractor performs the required tasks. The Government will not direct the hiring, 469 dismissal or reassignment of contractor personnel. Under no circumstances shall the Government 470 assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the 471 responsibility of the contractor to manage its employees and to guard against any actions that are of 472 the nature of personal services or give the perception that personal services are being provided. If 473 the contractor feels that any actions constitute, or are perceived to constitute personal services, it is 474 the contractor's responsibility to notify the PCO immediately in accordance with FAR 52.243-7. 475 C.19.2 Inherently-Governmental functions are not within the scope of this task order. Decisions 477 relative to programs supported by the contractor shall be the sole responsibility of the Government. 478 The contractor may be required to attend technical meetings for the Government; however, they are 479 not, under any circumstances, authorized to represent the Government or give the appearance that 480 they are doing so. 481 C.20. Contractor Identification 483 The contractor shall be required to obtain identification badges from the Government for all 484 contractor personnel requiring regular access to Government property. The identification badge 485 shall be visible at all times while employees are on Government property. The contractor shall 486 furnish all requested information required to facilitate issuance of identification badges and shall 487 conform to applicable regulations concerning the use and possession of the badges. The contractor 488 shall be responsible for ensuring that all identification badges issued to contractor employees are 489 returned to the appropriate Security Office within 48 hours following completion of the task order, 490 relocation or termination of an employee, and upon request by the PCO. 491 All contractor personnel shall identify their company affiliation when answering or making 493 telephone calls and sending email and when attending meetings where Government personnel or 494 representatives from another contractor are present. 495 C.21. Control of Contractor Personnel 497 The contractor shall comply with the requirements of NAVSEA and NSWCCD instructions 498 regarding performance in Government facilities. All persons engaged in work while on Government 499 property shall be subject to search of their persons (no bodily search) and vehicles at any time by 500 the Government, and shall report any known or suspected security violations to the appropriate 501 Security Department. Assignment, transfer, and reassignment of contractor personnel shall be at the 502 discretion of the contractor. However, when the Government directs, the contractor shall remove 503 from contract performance any person who endangers life, property, or national security through 504 improper conduct. All contractor personnel engaged in work while on Government property shall 505 be subject to the Department of Defense Standards of Conduct. 506 C.22. Termination of Employees with NSWCCD Base Access 508

(a) The contractor shall ensure that all employees who have a NSWCCD badge turn in the badge 509 immediately upon termination of their employment under this order. The above requirement shall be 510 made a part of the standard employee facility clearance procedures for all separated personnel. The 511 contractor shall advise NSWCCD physical security of all changes in their personnel requiring 512 NSWCCD base access. 513

(b) For involuntarily separated personnel and those separated under adverse circumstances, the 515 contractor shall notify NSWCCD physical security in advance of the date, time, and location where 516 the NSWCCD representative may retrieve the NSWCCD badge prior to the employee departing the 517 contractor’s facility. In the event the employee is separated in his or her absence, the contractor 518 shall immediately notify NSWCCD Physical Security of the separation and make arrangements 519 between the former employee and NSWCCD physical security for the return of the badge and 520 removal of the sticker. 521

HQ C-2-0002 ACCESS TO PROPRIETARY DATA OR COMPUTER SOFTWARE (NAVSEA) 523

(JUN 1994) 524

(a) Performance under this contract may require that the Contractor have access to technical data, 525 computer software, or other sensitive data of another party who asserts that such data or software is 526 proprietary. If access to such data or software is required or to be provided, the Contractor shall enter into 527 a written agreement with such party prior to gaining access to such data or software. The agreement shall 528 address, at a minimum, (1) access to, and use of, the proprietary data or software exclusively for the 529 purposes of performance of the work required by this contract, and (2) safeguards to protect such data or 530 software from unauthorized use or disclosure for so long as the data or software remains proprietary. In 531 addition, the agreement shall not impose any limitation upon the Government or its employees with 532 respect to such data or software. A copy of the executed agreement shall be provided to the Task Order 533 Contracting Officer. The Government may unilaterally modify the contract to list those third parties with 534 which the Contractor has agreement(s). 535

(b) The Contractor agrees to: (1) indoctrinate its personnel who will have access to the data or software as 537 to the restrictions under which access is granted; (2) not disclose the data or software to another party or 538 other Contractor personnel except as authorized by the Task Order Contracting Officer; (3) not engage in 539 any other action, venture, or employment wherein this information will be used, other than under this 540 contract, in any manner inconsistent with the spirit and intent of this requirement; (4) not disclose the data 541 or software to any other party, including, but not limited to, joint venturer, affiliate, successor, or assign 542 of the Contractor; and (5) reproduce the restrictive stamp, marking, or legend on each use of the data or 543 software whether in whole or in part. 544

(c) The restrictions on use and disclosure of the data and software described above also apply to such 546 information received from the Government through any means to which the Contractor has access in the 547 performance of this contract that contains proprietary or other restrictive markings. 548

(d) The Contractor agrees that it will promptly notify the Task Order Contracting Officer of any attempt 550 by an individual, company, or Government representative not directly involved in the effort to be 551 performed under this contract to gain access to such proprietary information. Such notification shall 552 include the name and organization of the individual, company, or Government representative seeking 553 access to such information. 554

(e) The Contractor shall include this requirement in subcontracts of any tier which involve access to 556 information covered by paragraph (a), substituting "subcontractor" for "Contractor" where appropriate. 557

(f) Compliance with this requirement is a material requirement of this contract. 559

HQ C-2-0011 COMPUTER SOFTWARE AND/OR COMPUTER DATABASE(S) DELIVERED 561

TO AND/OR RECEIVED FROM THE GOVERNMENT (NAVSEA) (APR 2004) 562

(a) The Contractor agrees to test for viruses all computer software and/or computer databases, as 563 defined in the clause entitled "RIGHTS IN NONCOMMERCIAL COMPUTER SOFTWARE AND 564

NONCOMMERCIAL COMPUTER SOFTWARE DOCUMENTATION" (DFARS 252.227-7014), 565

before delivery of that computer software or computer database in whatever media and on whatever 566 system the software is delivered. The Contractor warrants that any such computer software and/or 567 computer database will be free of viruses when delivered. 568

(b) The Contractor agrees to test any computer software and/or computer database(s) received from 570 the Government for viruses prior to use under this contract. 571

(c) Unless otherwise agreed in writing, any license agreement governing the use of any computer 573 software to be delivered as a result of this contract must be paid-up and perpetual, or so nearly 574 perpetual as to allow the use of the computer software or computer data base with the equipment for 575 which it is obtained, or any replacement equipment, for so long as such equipment is used. 576 Otherwise the computer software or computer database does not meet the minimum functional 577 requirements of this contract. In the event that there is any routine to disable the computer software 578 or computer database after the software is developed for or delivered to the Government, that 579 routine shall not disable the computer software or computer database until at least twenty-five 580 calendar years after the delivery date of the affected computer software or computer database to the 581 Government. 582

(d) No copy protection devices or systems shall be used in any computer software or computer 584 database delivered under this contract to restrict or limit the Government from making copies. This 585 does not prohibit license agreements from specifying the maximum amount of copies that can be 586 made. 587

(e) Delivery by the Contractor to the Government of certain technical data and other data is now 589 frequently required in digital form rather than as hard copy. Such delivery may cause confusion 590 between data rights and computer software rights. It is agreed that, to the extent that any such data 591 is computer software by virtue of its delivery in digital form, the Government will be licensed to use 592 that digital-form data with exactly the same rights and limitations as if the data had been delivered 593 as hard copy. 594

(f) Any limited rights legends or other allowed legends placed by a Contractor on technical data or 596 other data delivered in digital form shall be digitally included on the same media as the digital-form 597 data and must be associated with the corresponding digital-form technical data to which the legends 598 apply to the extent possible. Such legends shall also be placed in human-readable form on a visible 599 surface of the media carrying the digital-form data as delivered, to the extent possible. 600