Attachment_7_Statement_of_Work_20170330.pdf

N00024-16-R-6247

FOR OFFICIAL USE ONLY – SOURCE SELECTION SENSITIVE

ATTACHMENT 7 STATEMENT OF WORK

Statement of Work

For The

Acoustic Device Countermeasure (ADC) MK 5

October 20, 2016 updated on 30 March 2017

Distribution Statement D – Distribution authorized to Department of Defense and U.S. DoD Contractors. Administrative or Operational Use; August 2011. Other requests must be referred to the Program Executive Office, Submarines Code PMS415.

1 SCOPE

2 APPLICABLE DOCUMENTS

2.1 Department of Defense Specifications

2.2 Department of Defense Standards

2.3 Other Government Documents

2.4 Industry Documents

3 REQUIREMENTS

3.1 Program Management

3.1.1 Program Management Plan (PMP)

3.1.2 Integrated Program Management Report

3.1.2.1 Contract Work Breakdown Structure (WBS)

3.1.2.2 Integrated Master Schedule

3.1.2.3 Cost and Schedule Control

3.1.3 Risk Management Plan

3.1.4 Rough Orders of Magnitude (ROM) ................................................... Error! Bookmark not defined.

3.1.5 Reviews and Meetings

3.1.5.1 General Requirements

3.1.5.2 Program Reviews

3.1.5.3 Integrated Baseline Reviews

3.1.6 Data Management

3.1.6.1 Data Repository and Tracking

3.1.6.2 Digital Data Management

3.1.6.3 Internal Data and Data Access

3.1.6.4 Government-Furnished Information (GFI)

3.1.7 Security Requirements

3.1.8 Cybersecurity

3.1.9 Program Protection Implementation

3.2 Systems Engineering

3.2.1 System Engineering Management Plan (SEMP)

3.2.2 System Engineering and Design Analysis

3.2.2.1 Non-Development Items and Commercial Off-the-Shelf (NDI/COTS)

3.2.2.2 Non-Development Items/Commercial Off-The-Shelf (NDI/COTS) Licenses

3.2.3 Problem Trouble Report (PTR) System

3.2.4 Human Systems Integration (HSI)

3.2.5 Configuration Management

3.2.5.1 Configuration Audit Planning

3.2.5.2 Functional Configuration Audit (FCA)

3.2.5.3 Physical Configuration Audit (PCA)

3.2.6 System Engineering Technical Reviews

3.2.6.1 System Requirements Review/System Functional (SRR/SFR)and System Design Review

3.2.6.2 Software Specification Review (SSR)

3.2.6.3 Test Readiness Review (TRR)

3.2.6.4 Preliminary Design Review (PDR)

3.2.6.5 In-Process Review (IPR)

3.2.6.6 Critical Design Review (CDR)

3.2.6.7 Production Readiness Review (PRR)

3.2.6.8 Integrated Product Team (IPT)

3.2.7 Safety

3.2.7.1 Hazardous Materials Management Program (HMMP)

3.2.7.2 System Safety Program

3.2.7.3 Naval Lithium Battery Safety Program

3.2.7.4 Electrostatic Discharge Control Program

3.2.7.5 Environmental Safety and Occupational Health (ESOH) Program

3.2.8 System Software

3.2.8.1 Software and Firmware Requirements

3.2.8.2 Software Design Requirements and Process

3.2.8.3 Configuration Control Tool (CCT) Design

3.2.8.4 Software Transition

3.3 System Development, Test and Evaluation

3.3.1 Development Units

3.3.1.1 ADC MK 5 Special Test Unit (STU)

3.3.1.2 ADC MK 5 Special Test Unit Electronics (STU-E)

3.3.1.3 ADC MK 5 Engineering Development Model-1 (EDM-1)

3.3.1.4 ADC MK 5 Configuration Control Tool (CCT)

3.3.1.5 ADC MK 5 Engineering Development Model-2 (EDM-2)

3.3.1.6 ADC MK 5 Engineering Development Model-2 Inert (EDM-2I)

3.3.1.7 ADC MK 5 Engineering Development Model-2 HERO Test (EDM-2T)

3.3.1.8 ADC MK 5 Engineering Development Model-2 EQT (EDM-2EQT)

3.3.1.9 ADC MK 5 Low Rate Initial Production (LRIP)

3.3.2 External Interface

3.3.3 Support and Test Equipment (S&TE)

3.3.3.1 GFE Test Equipment

3.3.3.2 Contractor Derived Test Solution

3.3.4 Developmental Testing

3.3.4.1 Contractor Testing

3.3.4.2 Design Verification Testing

3.3.4.3 Production Screening

3.3.5 Factory Acceptance Testing (FAT)

3.3.5.1 Factory Acceptance Test (FAT) Plan

3.3.5.2 Factory Acceptance Test (FAT) Procedures

3.3.5.3 Factory Acceptance Test (FAT) Reporting

3.3.6 Pre-Production Testing

3.3.6.1 First Article Inspection and Testing

3.3.6.2 Contractor Support of Government EQT and EDM-2 Qualification

3.3.7 Failure Reporting, Analysis and Corrective Action (FRACA) System

3.3.7.1 Failure Analysis during Factory Acceptance Tests and Conditional Acceptance Period

3.4 Integrated Logistics Support (ILS) Program

3.4.1 Integrated Product Support Plan (IPSP)

3.4.2 Supportability Analysis (SA) Process

3.4.2.1 Supportability Analysis Plan (SAP)

3.4.3 Maintenance Planning Requirements

3.4.3.1 Maintenance Concepts

3.4.3.2 Packaging, Handling, Storage and Transportation (PHS&T)

3.4.4 Reliability

3.4.5 ADC MK 5 Technical Data Package (TDP)

3.4.5.1 LRIP TDP

3.4.5.2 CCT TDP

3.4.5.3 Software Documentation

3.4.5.4 CCT Software Documentation

3.4.5.5 Software Product

3.4.5.6 CCT Software Product

3.4.5.7 ADC MK 5 User Manuals

3.4.5.8 CCT User Manuals

3.4.6 Parts Management

3.4.7 Obsolescence Reporting Requirements

3.4.8 Minimum Sustaining Quantities

3.4.9 Unique Identification (UID) Program

3.4.9.1 Item Unique Identification (IUID) ............................................... Error! Bookmark not defined.

3.5 Quality

3.5.1 Quality Program Plan (QPP)

3.5.2 Quality Surveillance

3.6 Engineering Services

4 APPENDIX A: List of Acronyms

1 SCOPE

The Acoustic Device Countermeasure (ADC) MK 5 is a 3-inch diameter, 39.5-inch long expendable acoustic countermeasure that can be employed either as a hover or flight mobile device. It will be launched from both the Internal Countermeasure Launcher (ICL) and the Countermeasure Set, Acoustic (CSA) MK 3 countermeasure launch system including the External Countermeasure Launcher (ECL) system, installed on submarines. The ADC MK 5 will utilize adaptive countermeasure technology, developed under the Office of Naval Research (ONR) Future Naval Capability (FNC) program, to provide variable acoustic modes of operation including stationary broadband jamming, spot jamming, echo repeat, and flight capable acoustic decoy. The ADC MK 5 is designed to increase submarine probability of survival against threat acoustic-homing torpedoes. The ADC MK 5, along with a Tactical Decision Aid (TacDA), and a network-integrated countermeasure launcher (CSA MK 3) are components within a System of Systems (SoS), described in SN 751-87-08, Capability Development Document (CDD), for the Submarine Torpedo Defense System (SUB TDS) (Increment I) approved 19 May 08.

For the ICL operations, the ADC MK 5 is stowed in the submarine storage lockers for 3-inch diameter devices. The ADC MK 5 shall allow operators to turn the device on and select acoustic and deployment options manually prior to loading in the ICL.

The ADC MK 5 shall interface with the CSA MK 3 external launching system by use of a sabot.

The 6-inch External Countermeasure Launcher (ECL) sabot mechanism that will be used for launching the 3-inch device from the ECL will be developed by the Government and will be functionally verified and validated in incremental steps leading to an at-sea demonstration with the Engineering and Manufacturing Development (EMD) ADC MK 5 contract. The Sabot for the ECL is being developed based on early estimates of ADC MK 5’s physical and hydrodynamic characteristics. The Navy does not currently plan to release the sabot design information as Government-Furnished Information (GFI) as part of this Request for Proposal (RFP). The Government will work with the Contractor to support development of the device-to-sabot interface.

The scope of this contract is the hardware development, software development, test and evaluation, associated program management, data management, systems engineering, hardware reliability and maintainability, and integrated logistic support required to support the development and fabrication of the ADC MK 5 units.

This SOW covers the EMD portion of the ADC MK 5 acquisition lifecycle milestones and includes a one year Low Rate Initial Production (LRIP) option year. The EMD phase consists of the ADC MK 5 system development, integration and system capability demonstration. There will be eight primary variants of the ADC MK 5 developed during the EMD phase; these can be broken down as two variants of Special Test Units, (STU), five variants of the Engineering Developmental Model (EDM), and the Low Rate of Initial Production (LRIP) variant.

Additionally, there is support equipment, that is, three Configuration Control Tools (CCTs).

2 APPLICABLE DOCUMENTS

The following documents are applicable to this SOW to the extent specified herein. In case of conflict between the Contract Schedule, this SOW, and the PIPS, the order of precedence shall be in accordance with Federal Acquisition Regulation (FAR) 52.215-8.

2.1 Department of Defense Specifications

MIL-STD-31000A Technical Data Packages

MIL-PRF-38535K Integrated Circuits (Microcircuits) Manufacturing, General Specification For

SECNAV M-5510.36 Department of the Navy Information Security Program

DoD 5220.22-M National Industrial Security Program - Operating Manual

DoD 5400.7-R The DoD Freedom of Information Act (FOIA) Program

DoD 5230.24 Distribution Statements on Technical Documents

2.2 Department of Defense Standards

MIL-STD-129P(4) Military Marking for Shipment and Storage

MIL-STD-130N Identification Marking of U.S. Military Property

MIL-STD-881C Work Breakdown Structures for Defense Material Items

MIL-STD-882E System Safety

MIL-STD-1168C

Department of Defense Standard Practice Ammunition Lot Numbering and Ammunition Data Card

MIL-STD-3018 Department of Defense Standard Practice: Parts Management

2.3 Other Government Documents

MIL-HDBK-61A Configuration Management Guidance

MIL-HDBK-502A Acquisition Logistics

MIL-HDBK-2036 Preparation of Electronic Equipment Specifications

PMS415-NGCM-08-017 ADC MK 5 Prime Item Performance Specification (PIPS)

PMS415-ADC5-IS-11-140[A] CSA to ADC MK 5 Interface Requirements Specification (IRS)

PMS415-UDWS-IUID-10-069 PMS415 Unique Identification (UID) Implementation Plan

PMS415-CMP-08-030 PMS415 Configuration Management Plan (CMP)

SN 751-87-08 Capability Development Document (CDD) for the Submarine Torpedo Defense System (Sub TDS) (Increment I, May 19, 2008

SD-18 NOTICE 4 Defense Standardization Program Guide for Parts Requirements and Application

DoDI 8500.01 Cybersecurity, March 14, 2014

DoDI 8510.01 Risk Management Framework for DoD IT, March 12, 2014

CNSSI 1253

Security Categorization and Control Selection for National Security Systems, March 27, 2014

DoDI 8523.01 Communications Security (COMSEC), April 22, 2008

AIAS DON CIO Acquisition Information Assurance (Cybersecurity) Strategy Guidance, May 2016

DoDI 5200.39 DoDI 5200.39, Critical Program Information (CPI) Identification and Protection Within Research, Development, Test, and Evaluation (RDT&E), May 28, 2015

DoDD 8570.01 Information Assurance (Cybersecurity) Training, Certification, and Workforce Management, April 23, 2007

S0005-AA-PRO-010/TMMP

REVISION 3

NAVSEA Technical Manaual Management Program; Operations and Life Cycle Support Procedures

2.4 Industry Documents

ASME-Y14.100 Engineering Drawing Practices

SAE EIA 557 Statistical Process Control Systems

ISO9001 Quality Management System Requirements

IEEE/EIA 12207 Software Life Cycle Processes

SAE GEIA-STD-0007 Performance Specification Logistics Management Information

SWGD039 Software Development File Guide, 14 January 2015

IPC-2220 Family of Design Documents

2221B: Generic Standard on Printed Board Design ; 2222A: Sectional Design Standard for Rigid Organic Printed Boards; 2223C: Sectional Design Standard for Flexible Printed Boards; 2224: Sectional Standard of Design of PWBs for PC Cards;

2225: Sectional Design Standard for Organic Multichip Modules (MCM-L) and MCM-L Assemblies; 2226: Sectional Design Standard for High Density Interconnect (HDI) Boards

IPC-6010 Family of Board Performance Documents

6011: Generic Performance Specification for Printed Boards; 6012C:

Qualification and Performance Specification for Rigid Printed Boards;

6013C: Qualification and Performance Specification for Flexible Printed Boards; 6015: Qualification & Performance Specification for Organic Multichip Module (MCM-L) Mounting & Interconnecting Structures; 6016: Qualification & Performance Specification for High Density Interconnect (HDI) Layers or Boards; 6017: Qualification and Performance Specification for Printed Boards Containing Embedded Passive Devices; 6018B: Qualification and Performance Specification for High Frequency (Microwave) Printed Boards

IPC-A-600 Acceptability of Printed Boards Training and Certification Program

IPC-TM-650 Test Methods Manual

IPC-QL-653A Certification of Facilities that Inspect/Test Printed Boards, Components & Materials

IPC-MI-660 Incoming Inspection of Raw Materials Manual

Copies of listed Federal and Military Standards, Specifications and Handbooks are available through DOD single stock point, Commanding Officer, U.S. Naval Publications and Forms Center (Attn: NPFC 1032), 5801 Tabor Avenue, Philadelphia, PA 19120.

Copies of military specifications and standards and DoD adopted non-Government publications may be obtained in accordance with FAR 52.211-2, Availability of Specifications Listed in the Acquisition Streamlining and Standardization Information System (ASSIST). Copies of non- Government publications not listed in the ASSIST may be obtained from the respective industry association. Requests for documents not available from either source should be directed to the Government Contracting Officer’s Representative (COR).

3 REQUIREMENTS

3.1 Program Management

The Contractor shall organize, coordinate, control and report the status, of all program activities including those activities assigned to subcontractors, to ensure the correct and timely delivery of all supplies and services specified in this contract.

The Contractor shall designate a Program Manager (PM) who shall have responsibility for all aspects of this contract and the authority to commit the Contractor to specific actions within the scope of the contract.

3.1.1 Program Management Plan (PMP)

The Contractor shall develop, deliver, and maintain the Program Management Plan (PMP) (CDRL A001). The PMP shall contain sufficient detail to allow the Government to verify the Contractor's management and scheduling of all efforts necessary to meet the contract requirements to include program reviews and completion of associated deliverables. The PMP shall contain a structured review process which details the Contractor’s plan for conducting the major reviews. The plan shall address how these major reviews correspond to the project planning chart critical events and key program milestones. The Contractor shall also address implementation of technical risk management in the PMP.

3.1.2 Integrated Program Management Report

The Contractor shall generate and deliver a monthly Integrated Program Management Report (IPMR) (CDRL A002). The report shall cover all efforts under this contract including engineering services, obsolescence reviews, risk management, and work performed under the contract during the month of the report. The Contractor shall provide IPMR presentations to coincide with the Systems Engineering Management Plan (SEMP) milestone reviews.

3.1.2.1 Contract Work Breakdown Structure (WBS)

The Contractor shall develop and maintain a WBS per MIL-STD-881C. The WBS shall be maintained at the lowest level necessary to describe manageable units of functional tasks that reflect the way the work is being performed while ensuring the correlation of these lower levels to the specification, statement of work tasks, contract line items, delivery orders, orders, Configuration Items (CIs) and data items. The WBS shall be the key reference document for planning, controlling, and reporting progress.

3.1.2.2 Integrated Master Schedule

The Contractor shall develop, maintain and deliver an Integrated Master Schedule (IMS) as part of the IPMR (CDRL A002) for all contract efforts, planned events, milestones and activities related to technical deliverables.

The Contractor shall implement proposed changes to the program schedule only after approval by the Government.

The IMS shall support the needs of all functional areas and all Integrated Product Teams (IPTs) and reviews. Contractor schedule revisions shall NOT affect the contract delivery dates.

3.1.2.3 Cost and Schedule Control

The Contractor shall generate a Performance and Cost Report and submit as part of the IPMR (CDRL A002). The report shall provide visibility to WBS level 3 unless it is determined by the Government that certain risk or high cost elements require visibility to a lower level for all cost plus tasks. The Performance and Cost Report shall accomplish the following:

1. Relate time-phased budgets to specific tasks identified in the statement of work

2. Produce data that indicate work progress

3. Properly relate cost, schedule, and technical accomplishment

4. Produce data that is valid, timely, and auditable

3.1.3 Risk Management Plan

The Contractor shall develop, implement, and maintain a Risk Management Plan (RMP) (CDRL A006) as part of a risk management process and the PMP (CDRL A001) following the 2008 ADC MK 5 RMP Attachment 9 as guidance. The RMP shall identify, evaluate, and mitigate program risks from a technical, cost, and schedule perspective. Risk management activities shall encompass all aspects of the ADC MK 5 program including system design, system engineering, fabrication, integration, test & evaluation, support, and management. Risks shall be evaluated as to their impact on reliability, safety, supportability, readiness, affordability, schedule, cost, and technical performance objectives.

3.1.4 Reviews and Meetings

3.1.4.1 General Requirements

Government facilities may be used to support meetings described within this SOW.

3.1.4.1.1 Meeting Minutes

The Contractor shall record, generate, integrate and distribute the meeting minutes (CDRL A008) of all meetings and conferences.

The Contractor shall track all generated action items noted after the meetings. Progress and updated status on action items shall be included in the IPMR (CDRL A002).

3.1.4.1.2 Post Award Conference

The Contractor shall host the post-award review as requested by the Government within 30 days after award. The Contractor shall prepare a conference agenda (CDRL A009) for the Post- Award Kickoff Meeting which covers at a minimum the following topics:

1. Contract terms and conditions

2. Security requirements

3. Status and Cost Reporting

4. Inspection, acceptance, and invoicing procedures

5. Roles and responsibilities of all the Government Representatives

6. Introduction to Contractor Personnel, Internal Processes, and Tools

7. Contractor Cost Monitoring Techniques

8. Contractor Organization Chart with roles, names, email addresses, and phone numbers

The Contractor shall record and distribute Post Award Conference minutes (CDRL A008).

3.1.4.2 Program Reviews

The Contractor shall draft an agenda, prepare and conduct a formal Program Review (PR) of the status of all projects in conjunction with the system engineering technical reviews, or at a minimum every six (6) months at the Contractor’s facility, by video teleconference (VTC), or at a Government facility (location determined by the Navy). The first Program Review shall be held within ninety (90) days after the date of Post Award Conference and shall take place at the Contractor's facility.

The Contractor shall make available all necessary data and personnel so that the PRs are conducted in a timely and efficient manner. Subcontractor personnel shall be present at, and shall participate in, these reviews on an as-required basis by the Prime Contractor.

The Contractor shall provide proposed PR locations and dates 45 days prior to the proposed review. The location and date will be approved or disapproved by the Government at least 30 calendar days prior to the proposed review.

The Contractor shall prepare and distribute Meeting Agenda (CDRL A009) for all reviews.

Agenda topics may consist of the following as specified by the COR prior to the review.

(a) Cost and schedule performance

(b) Program critical path assessment

(c) Design and technical issues

(d) Hardware and computer software engineering

(e) Risk analysis and management activities

(f) Reliability and maintainability

(g) Quality program

(h) Test and evaluation activities, plans, results

(i) Development activities, completed and planned

(j) Logistics development and support efforts

(k) Safety program requirements

(l) Configuration management (CM) activities

(m) Government-Furnished Property (GFP) and GFI status

(n) Manpower utilization projection and actual

(o) Data items delivery schedule

(p) Program protection and anti-tamper (AT) efforts

(q) Hazardous material management efforts

(r) Status of action items from previous reviews

In addition, unresolved issues requiring the attention of senior Government and Contractor personnel shall be addressed in detail at an executive meeting held separately from the Program Review.

The Contractor shall record and distribute PR minutes (CDRL A008) after each review.

Unless otherwise noted herein or by the Government for the individual meeting events, the Contractor shall provide unclassified electronic and video or audio teleconference capability.

3.1.4.3 Integrated Baseline Reviews

The Contractor shall conduct an Integrated Baseline Review (IBR) within 180 days after contract (DAC). During the IBR, the Contractor shall present its PMP (CDRL A001) to the Government for approval. The IBR shall detail the Contractor's plan to ensure complete coverage of the work effort required by the contract, the Contractor’s logical scheduling of work activities, the Contractor’s adequate resourcing, the Contractor’s understanding of technical requirements, and the Contractor’s identification of inherent risks and risk mitigation plans. Completion of the IBR will result in establishment of a baseline for all elements of the ADC MK 5 and test schedules provided in the Program Management Plan. Incremental IBRs may be be required for major changes to the contract baseline. The initial IBR may be conducted in conjunction with the first

PR.

3.1.4.3.1 Entrance Criteria

1. PMP (CDRL A001) is established

2. Project schedule key milestones are identified and documented

3. Program risks and opportunities are identified

4. Resources such as budget, facilities, and personnel are planned for the program and are being measured for variances

5. Tasks are planned and can be measured objectively relative to the technical progress

6. The program schedule is updated

7. The program has an budget plan established and is being measured for variances

8. Management processes are documented in the PMP (CDRL A001) for execution of the project

3.1.4.3.2 Exit Criteria

1. Formal cost and schedule baselines established and approved

2. IBR Action Items completed and approved

3.1.5 Data Management

The Contractor shall manage the development and use of data under this contract so as to provide the Government visibility of all program data. DoD Directive DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM) applies to technical data developed by, maintained by, or provided to the Contractor. Unclassified limited documents, such as, For Official Use Only (FOUO) and Distribution Statement Controlled, shall be marked in accordance with DoD Regulation 5400.7-R – The DoD Freedom of Information Act Program and DoD Directive 5230.24 Distribution Statements on Technical Documents.

All classified deliverables and program documentation shall be appropriately marked in accordance with Secretary of the Navy (SECNAV) M-5510.36.

3.1.5.1 Data Repository and Tracking

The Contractor shall submit a Data Accession List (DAL) (CDRL A017). The DAL shall identify all contractor data that is not otherwise listed in the Contract Data Requirements Lists (CDRLs), but has been generated by the Contractor in compliance with the work efforts prescribed in the contract.

Unless otherwise indicated, all unclassified CDRLs shall be delivered electronically via the Integrated Product Data Management (iPDM) system. All electronic CDRLs shall be delivered as read only. Classified data shall be mailed in compliance with all applicable security regulations in the data format specified on its CDRL, normally CD ROM. The contractor shall establish an account and use the Government-developed iPDM for CDRL delivery. The Government will provide training for the Contractor on the use of iPDM.

3.1.5.2 Digital Data Management

The Contractor shall be responsible for the digital generation, reception and electronic delivery of data as required in this SOW. All data shall be developed, managed, used, and exchanged electronically to the greatest extent possible. The Contractor shall return to the Government all data at contract termination, completion, or upon the request of the Government.

3.1.5.3 Internal Data and Data Access

The Contractor shall maintain compatibility with the World Wide Web (WWW) browser, electronic mail (e-mail) and software used by PMS 415 throught the life of this contract. PMS 415 uses Microsoft Office products and Adobe Acrobat. Controlled Unlcassified Information (CUI) as defined in DD Form 254 Attachment 2, transmitted via email must be encrypted to the current Department of Defense (DOD)/Deparment of Navy (DON) standard employing PKI credentials.

The Contractor shall provide the Government access to and upload capability for unclassified electronic data to a Contractor-created and controlled electronic data repository. Authorized Government representatives and their support Contractors shall have the ability to upload, download, read, copy, comment, and print the unclassified program documentation, models, and data. Classified data will be managed as directed in the DD Form 254 for this contract.

The Contractor shall provide the Government with up to twenty (20) user accounts for accessing the Contractor-created and controlled website and data.

3.1.5.4 Government-Furnished Information (GFI)

The Contractor shall establish and implement internal procedures to manage and account for all GFI. The Contractor shall submit Government Furnished Information (GFI) Deficiency Reports if a deficiency is discovered (CDRL A018).

3.1.6 Security Requirements

The Contractor shall establish and maintain a facility clearance of at least SECRET as issued by the Defense Investigative Service. Specific contractor security access requirements are outlined in Section J, Attachment 2, Contract Security Classification Specification (DD Form 254).

The Contractor shall issue the proper classification markings and maintain security for all classified items, including documentation, hardware, firmware and software generated for this contract in accordance with OPNAVINST S5513.5C – Countermeasures Security Classification Guide (SCG) ID #05-156.1, dated June 14, 2010, Attachment 14.

The Contractor shall establish and maintain the necessary security clearances and processes required to ship and receive classified material.

The Contractor shall handle classified and sensitive unclassified information, such as Controlled Unclassified Information (CUI) (which includes For Official Use Only (FOUO) information) and Critical Program Information (CPI) including Critical Components (CC), Critical Systems (CS), and Critical Technologies (CT) as required by law and regulation.

The Contractor shall have adequate SECRET storage space to store up to 99 crated ready-to-ship

ADC MK 5 devices, with no impact to delivery schedules.

3.1.7 Cybersecurity

The Contractor shall ensure that the ADC MK 5 design as developed and produced in the ADC MK 5 incorporates DoD cybersecurity requirements (previously known as Information Assurance (IA)) as delineated in the technical reference documents DoDI 8500.01, “Cybersecurity”, March 14, 2014, and DoDI 8510.01, “Risk Management Framework for DoD IT”, March 12, 2014.

The Contractor shall designate a cybersecurity liason who will correspond with the Government Information System Security Manager (ISSM) to coordinate activities to ensure compliant implementation of security controls, to oversee all cybersecurity related issues, and cybersecurity test events.

The Contractor shall develop,deliver and maintain a DoDI 8510.01 System Security Plan (SSP) (CDRL A043) per the RMF Core Security Authorization Package Security Controls Template, Section J, Attachment 16 to support an Authorization Decision by the Authorizing Official (AO) for the ADC MK 5 system. The Implementation Status/Security Control Status section of the SSP shall be delivered and maintained within Attachment 18, the Security Controls Traceability Matrix (SCTM) which establishes the technical, administrative, and procedural security control baseline minimal requirements for the system. The Contractor shall use Attachment 18 to maintain and manage implementation of each planned security control, addressing each security control to determine the implementation status, and describing all tailoring guidance to more closely align the control for specific operating conditions. The initial SCTM shall become a finalized baseline set of security controls consistent with the approved RMF Categorization of the System IAW Step 1 of the RMF process.

Contractor shall implement vulnerability management tasks for cybersecurity compliancy to include patch maintenance, anti-virus and vulnerability scanning, and Security Technical Information Guides (STIGS) implementation.

The Contractor shall host cybersecurity test events IAW the Government’s Test and Evaluation Master Plan (TEMP) at the Contractor’s development or manufacturing facility, as appropriate, for an independent Security Control Assessor (SCA) to conduct security assessments of the ADC MK 5 system.

3.1.8 Program Protection Implementation

The Contractor shall adhere to the following policies and guidance for Program Protection Implementation for the ADC MK 5:

1. DoDI 5200.39 “Critical Program Information (CPI) Identification and Protection Within Research, Development, Test, and Evaluation (RDT&E)”, May 28, 2015

2. DoDI 5000.02 “Operation of the Defense Acquisition System”, January 07, 2015

3. Deputy Assistant Secretary of Defense, Systems Engineering Program Protection Plan (PPP) Outline and Guidance, July 2011

4. DoDI 5200.44, “Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN)”, November 5, 2012

5. Anti-Tamper (AT) Security Classification Guide (SCG), March 17, 2010

6. ADC MK 5 Program Protection Plan, Attachment 15

The Contractor shall develop its implemention of the requirements in Attachment 15 and document them in an ADC MK 5 Program Protection Implementation Plan (PPIP), (CDRL A004).

The PPIP shall contain the contractors plan for its implementation of the requirements in Appendix D of Attachment 15 and document the Anti-Tamper (AT) design in an AT Plan Annex as part of the PPIP deliverable (CDRL A004). The Contractor shall prepare and deliver an AT Verification and Validation (V&V) Test Procedure and Plan as an Appendix to the AT Plan for V&V of AT security features built into the EDM-2 devices delivered for First Article testing.

The Contractor shall host all AT test events held at the Contractor’s facility performed by AT TWH validators.

The Contractor shall prepare, deliver and maintain a Cybersecurity Strategy IAW the DON CIO Acquisition Cybersecurity Strategy Guidance as part of the PPIP deiverable (CDRL A004). The Cybersecurity Strategy shall be tailored to the specific system security features the Contractor is designing into the system to enable update to the Government plan.

3.2 Systems Engineering

The Contractor shall perform systems engineering tasks to meet all the requirements of PMS415- NGCM-08-017, herein refered to as the PIPS.

The Contractor shall implement a systems engineering process that translates ADC MK 5 requirements into an all-encompassing open system architecture solution that contains as a subset design completion, system fabrication, test and evaluation, and support processes and products.

The Contractor’s systems engineering process shall provide a proper balance between performance, risk, life-cycle cost, and schedule. The Contractor’s systems engineering process shall ensure the compatibility, interoperability and integration of all functional and physical interfaces, and ensure that the system definition and design reflect the requirements for all system elements: hardware, software, facilities, human resources, and data products.

3.2.1 System Engineering Management Plan (SEMP)

The Contractor shall implement and maintain the Systems Engineering Management Plan (SEMP) (CDRL A010), using the PMS 415 Systems Engineering Plan (SEP) Attachment 17 as guidance, for the technical management efforts of this contract. The SEMP shall provide a thorough description of the Contractor’s proposed systems engineering process, with specific details addressing how the plan will meet the requirements of the PIPS.

The Contractor shall provide systems engineering support consisting of system equipment development and interface integration; system level joint test activities; system certifications; technical reviews; IPT meetings; and major meeting events support. This effort shall also consist of engineering support for system interface problem and resolution activities.

3.2.2 System Engineering and Design Analysis

3.2.2.1 Non-Development Items and Commercial Off-the-Shelf (NDI/COTS)

The Contractor shall employ a Modular Open Systems Approach (MOSA) based architecture that is layered and modular and uses standards-based Commercial Off-the-Shelf and Non- Developmental Item (COTS/NDI) hardware, operating systems, and middleware wherever feasible.

The Contractor shall develop new hardware or software only when analysis indicates that requirements cannot otherwise be met with NDI/COTS, or when NDI/COTS do not provide a cost-effective solution.

The Contractor shall notify the Government COR if the use of proprietary and non-open interface standards as well as physical interfaces in their design. The Contractor shall use of MIL-HDBK-2036 for all Commercial-Off-the-Shelf (COTS) items as a guiding document.

In order to meet the Cybersecurity Standards for COTS, the acquisition of all Cybersecurity and Cybersecurity-Enabled, the Contractor shall utilize COTS hardware and software limited to products that have been evaluated or validated through the International Common Criteria (ICC), the National Information Assurance Partnership (NIAP) Evaluation and Validation Program, or Federal Processing Information Standards (FIPS) validation program.

3.2.2.2 Non-Development Items/Commercial Off-The-Shelf (NDI/COTS) Licenses

The Contractor shall procure all hardware and software licenses for non-Government-Furnished Equipment (GFE) NDI/COTS products delivered in this contract including both Contractor developed and third-party NDI/COTS.

If the Contractor needs to obtain a license for NDI/COTS incorporated into a deliverable under this contract, the Contractor shall notify the Government in writing. This notification shall specify whether the license(s) that need to be procured are transferable to the Government and all of its other contractors. These licenses shall be transferred to the Government in accordance with the technical data clauses in Section I of the contract and shall be of the appropriate scope to allow the Government to develop, maintain, use, release, disclose and support (including updates and modifications) the deliverable throughout the life cycle of the product in accordance with the

PIPS.

3.2.3 Problem Trouble Report (PTR) System

The Contractor shall establish a single system for the identification, tracking, and resolution of all ADC MK 5 hardware, software and documentation problems identified during system development, integration and testing. The contractor shall establish a process which will allow the government routine access to this system.

3.2.4 Human Systems Integration (HSI)

The Contractor shall use MIL-STD-1472G, Human Engineering for guidance. The contractor shall consider Human Systems Integration (HSI) costs and impacts and integrate with other engineering and logistics elements. All systems shall be designed and built to utilize the same personnel currently supporting the Internal Countermeasure Launcher (ICL) and CSA MK 3 System.

The Contractor shall produce ADC MK 5 EDMs to prevent the risk of personnel injuries, shipboard damage, and support equipment damage.

3.2.5 Configuration Management

The Contractor shall develop and deliver the Contractor’s Configuration Management Policies and Procedures (CDRL A019). The Contractor shall implement and maintain the Contractor’s Configuration Management Policies and Procedures throughout the duration of this contract using PMS415-CMP-08-030, Configuration Management Plan (CMP), Attachment 10; MIL- HDBK-61A; and ISO9001 as guidelines to establish and maintain a Product Baseline accordingly.

The Government will maintain control of the functional baseline as documented in the PIPS throughout the life of this contract. The Contractor shall establish the allocated baseline at PDR.

The Contractor shall establish the initial product baseline at CDR. The Government will approve and control the allocated baseline following successful FCA. The contractor shall control the allocated baseline for hardware and software until Government approval after FCA.

A Government designated representative will participate in Contractor internal configuration control meetings to assist the Contractor and ensure that product changes are consistent with the functional baseline requirements.

Changes to the ADC MK 5 and CCT shall be documented and submitted as Engineering Change Proposals (ECP) (CDRL A022) along with the related Notice of Revisions (NOR) (CDRL A021), detailing the proposed changes to the TDP, or as Request for Variance (RFV) (CDRL A023). All ECP, NOR, and/or RFV submissions shall provide rationale and justify that the affected items with the changes will be able to meet applicable TDP requirements, and provide sufficient details to convey the reasons of the technical changes or variations, risks of the implementation, and impacts of non-approval of the ECP or RFV. ECPs, RFVs, and Waivers must be incorporated into the Contract by the Contracting Officer via a contract modification prior to implementation of the change. ECPs, NORs, and RFVs shall be incorporated into the Contract by the Contracting Officer via a contract modification prior to the deliveries of the affected items. The Contractor shall generate a RFV on all departures from a specific requirement of a Government approved baseline.

Change Notices may be used for documenting changes to both the ADC MK 5 and the CCT until the product baseline is established after PCA.

3.2.5.1 Configuration Audit Planning

The Contractor shall host the following identified Government Configuration Audits at the Contractor’s manufacturing facility. The audits will be co-chaired by the Government and the Contractor. Audits will be performed to validate that the configuration has been developed in accordance with the functional and performance requirements of the specification, and that they accurately reflect the final configuration of design documentation.

The Contractor shall provide the necessary facilities, personnel, and documentation to conduct the audits.

A moratorium on changes to all audited CIs shall be imposed one week prior to each of the FCA and PCA and during all audits conducted. When the FCA and PCA are being conducted, a list of all approved and in-process changes against hardware, firmware, software, and documentation shall be presented to the audit teams as the listing of outstanding changes at the beginning of each audit.

3.2.5.2 Functional Configuration Audit (FCA)

The FCA verifies that the EDM-2 is in compliance with the PIPS, and will be accomplished prior to conducting the PCA. Satisfactory completion of all Government required testing and forwarding of Government signed test summary data sheets with the test reports are required to perform the FCA. Once these are submitted, all retesting shall require resubmission of new test summary data sheets signed by a Government representative. The FCA will be performed in accordance with the PMS415 CMP.

A Functional Configuration Audit (FCA) shall be held when the hardware and software development (LRIP TDP (CDRL A045) submission) is complete at the conclusion of EDM-2 unit testing.

3.2.5.3 Physical Configuration Audit (PCA)

The PCA verifies that the actual hardware and software of the final configuration, LRIP devices, are consistent with the design documentation. At the completion of the PCA, the system configuration is under the Government’s control. The PCA shall be performed in accordance with the PMS415-CMP-08-030, CMP.

A Physical Configuration Audit (PCA) shall be held when the hardware and software development (LRIP TDP (CDRLs A045 and A047) submission) is complete (see 3.2.5.1 above).

The audit shall be performed on a randomly selected final configuration LRIP unit against final technical documentation with all required changes incorporated.

3.2.6 System Engineering Technical Reviews

The Contractor shall host all Systems Engineering Technical Reviews (SETRs) for the overall system development. The SETRs listed below shall be held throughout the performance of this contract in order to demonstrate readiness to proceed in its hardware and software development efforts for the ADC MK 5. These SETRs shall be captured as program milestones in the Contractor’s System Engineering Management Plan (SEMP) and the plan to complete necessary SETR tasking shall be described. All SETRs are event driven activities and will be scheduled as appropriate and determined by entrance criteria. SETRs shall be combined with other events and reviews to the greatest extent possible.

The Contractor shall deliver the Design Review Information Package (DRIP) (CDRL A011).

The Contractor shall include all data referenced or needed to support the information presented in the DRIP delivery.

1. System Requirements Review (SRR)

2. System Functional Review (SFR)

3. Software Specification Review (SSR)

4. Hardware and Software Preliminary Design Review (PDR)

5. Critical Design Review (CDR):

a. Software Critical Design Review (SCDR)

b. Hardware Critical Design Review (HCDR)

6. Test Readiness Review (TRR)

7. Production Readiness Review (PRR)

The SRR, SFR, and SSR will not be subject to Government approval. For these Contractor approved reviews, the Contractor shall provide the Government with no less than 30 days’ notice before conducting Contractor Approved SETRs and provide physical and remote access to allow the Government to attend the reviews. The Government reserves the right to provide comments that shall be adjudicated by the Contractor for Contractor approved reviews. Government approval shall be required for the PDR, CDR, TRR, and PRR per the DRIP (CDRL A011).

3.2.6.1 System Requirements Review/System Functional (SRR/SFR)

The Contractor shall conduct a System Requirements Review and System Functional Review(SRR/SFR). The Contractor’s SRR/SFR presentation shall cover:

1. System architecture

2. Operational Requirements Development – The Operational Requirements should be delineated in enough detail to allow the review body to understand if the systems requirements will meet the requirements identified in the PIPS.

3. Allocation of functions to CIs

4. Functional flows

5. Cybersecurity AT – The Cybersecurity technical and certification specifics should be defined and specified to the level of detail associated with the systems development. AT techniques need required protection

6. ILS source material requirements

The Contractor shall provide a System and Subsystem Design Description (SSDD) (CDRL

A012) and a Interface Design Description (IDD) (CDRL A026). The design shall address the requirements of the PIPS.

3.2.6.1.1 Entrance Criteria

1. Preliminary agenda coordinated 30 days prior to SRR/SFR

2. Updated Risk Assessment Draft

3. Software Development Plan (SDP) Draft

4. Technical Performance Measures Defined

5. Program Protection Implementation Plan Draft

6. Contractors Risk Management Plan completed

7. Updated IMS

8. System Engineering Management Plan (SEMP)

9. System Requirements Verification Matrix (SRVM) (CDRL A027) completed to the system level

10. A system concept description developed that describes detailed information to satisy and verify requirements

11. SE&SW development processes are completely defined and plans for the next phase established

12. Technology readiness validation and demonstration plans completed

13. Total system approach to satisfying and verifying requirements (including interfaces) for the primary system functions identified (draft system and initial development specifications)

14. The system architecture (including OA requirements) defined

15. Preliminary functional baseline complete

16. Configuration Management Plan completed

17. Human Systems Integration Program Plan completed

3.2.6.1.2 Exit Criteria

1. System architecture products have been reviewed and meet all technical and cybersecurity/AT requirements

2. The system architecture and functional baseline updates have been reviewed and judged adequate to proceed to preliminary design

3. Software functionality in system specification is consistent with software sizing estimates and resource-loaded schedule

4. Integrated product support strategy defined and accepted

5. IMS has been updated

6. SEMP developed and implemented

7. Program schedule is executable within budget

8. Cost, schedule, and technical risk items known and manageable

9. System safety risk analysis and mitigation planning for at least the high, serious, and medium risks are reviewed

10. Actions designated as critical have been closed

11. Program is properly staffed

3.2.6.2 Software Specification Review (SSR)

The Contractor shall conduct a Software Specification Review (SSR). The SSR will be used to confirm that the total system detailed software design approach satisfies the functional baseline and system specification. The Contractor’s SSR presentation shall consist of:

1. Software architecture including control, signal processing, and signal processing allocations

2. High-risk development software modules list

3. A plan to mitigate their risk

3.2.6.2.1 Entrance Criteria

1. The Software Requirements Specifications (SRS) (CDRL A013)

2. Operational requirements are analyzed and translated into system-specific funcational and performance requirements

3. Cost, schedule, and performance risks identified, quantified, and prioritized.

3.2.6.2.2 Exit Criteria

1. Government approved SRS specifications

2. System software requirements traceable to operational requirements and software in system specification is consistent with software sizing estimates and proposed resources

3. All safety and mission-critical and security/IA requirements are identified

4. IA constraints (such as how IA requirements constrain component reuse)

3.2.6.3 Test Readiness Review (TRR)

The Contractor shall conduct a Test Readiness Review (TRR) prior to initiating formal acceptance testing of the prototype (STU and all EDM variants) hardware. The TRR will be used to determine if the product baseline and deliverable documentation is complete. The following documents shall be made available at the TRR for review:

1. Interface Design Description (IDD) (CDRL A026)

2. Software Requirement Specifications (SRS) (CDRL A013) for each Computer

Software Configuration Item (CSCI)

3. System and Subsystem Design Description (SSDD) (CDRL A012)

4. Factory Acceptance Test (FAT) Plan with Procedures (CDRL A014)

5. Software Test Plans (STP) (CDRL A015)

6. Software Test Descriptions (STD) (CDRL A029)

7. All required Security, Environmental, and Safety documentation

8. Test plans, procedures, and analysis/report plans

3.2.6.4 Preliminary Design Review (PDR)

The Contractor shall conduct a Preliminary Design Review (PDR) for both software and hardware. Contractor’s presentation coverage shall include:

1. System architecture

2. Security Plan

3. SCTM

4. SRVM

5. Anti-Tamper Plan

6. Cybersecurity Strategy

7. Software requirement allocations

8. Timing and sizing

9. Computer System Component (CSC) identification

The PDR is conducted to confirm the total system detailed design approach satisfies the functional baseline and system specification. The PDR shall be a formal technical review or a series of reviews of the basic design approach to:

1. Evaluate the process, technical adequacy, and risk resolution (on technical cost, and schedule basis) of the selected design approach

2. Determine its compatibility with performance and engineering specialty requirements of the PIPS

3. Establish the existence and compatibility of the physical and functional interfaces.

The PDR may be a combined hardware and software review or a separate review for hardware and software individually, depending on the complexity of the items to be reviewed

3.2.6.4.1 Entrance Criteria

The Contractor shall provide the following:

1. Preliminary agenda coordinated with the Government greater than 30 days prior to PDR

2. Technical Data Package artifacts for allocated baseline, test plans, and software processes and tools provided for review, including subsystem specifications and interface specifications

3. Previous Technical review completed and all RFA/RFI’s have been closed

4. Technical Performance Measure assessment

5. Software metrics has been collected and ready for presentation

6. Plans for next level system development established

7. Updated Risk Assessment available

8. Required Critical Item Testing complete

9. Product Support Analysis complete

3.2.6.4.2 Exit Criteria

1. The system architecture, allocated baseline and interface requirements have been reviewed and judged adequate to proceed to detailed design

2. Design analysis/definitions complete

3. Requirements mapped to test methods and test strategies fully defined and accepted

4. Development processes are fully defined and are adequate for detailed design accepted

5. Empirical data to measure human performance identified

6. Tools for detailed design phase in place and ready to use

7. Risks are known and manageable and Risk Database reflects that risks have mitigation plans in place and compatible with equipment and software development schedule

8. Product support analysis accepted

9. Program schedule executable within the cost…