Amendment_0002.pdf

N0002416NR63010

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

See Page 2.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 3

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 28-Jun-2017

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X N00024-17-R-4200

X 9B. DATED (SEE ITEM 11)

14-Jun-2017

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

28-Jun-2017

CODE

NAVAL SEA SYSTEMS COMMAND

1333 ISAAC HULL AVE SE - MAIL STOP 2030

WASHINGTON NAVY YARD DC 20376-2030

N00024 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

N00024-17-R-4200

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

The following items are applicable to this modification:

The following items are applicable to this Amendment 0002 to solicitation N00024-17-R-4200.

1. SECTION C - DESCRIPTIONS AND SPECIFICATIONS, paragraph 1.20.15 is modified as follows:

1.20.15 Cybersecurity - DOD Risk Management Framework (RMF) Deliverable Data

The contractor shall submit RFM data artifacts to the government. The Contractor shall complete the following information prior to submission of the data deliverables and the contractor shall submit RMF data artifacts to the Government associated with the bullets below.

The Contractor shall scan the system for vulnerabilities prior to delivery.

The Contractor shall scan the system using NESSUS or equivalent prior to system delivery.

The Contractor shall scan the system for vulnerabilities using the most recently released signatures.

The signatures used for scanning shall be less than 10 calendar days old at the time of scanning.

The date of signatures used for each scan shall be provided along with the scan results.

The name or reference number for the signatures used for each scan shall be provided along with the scan results.

The Contractor shall perform remediation on the system for any vulnerability discovered during scanning in accordance with National Security Agency Guidance for Addressing Malicious Code Risk dated 10

September 2007.

The Contractor shall perform remediation on the system for any vulnerability discovered during scanning before delivery.

The vulnerability scan report shall be encrypted and provided to the ISEA.

CDRL: C014

2. SECTION L - INSTRUCTIONS, CONDITIONS AND NOTICES TO BIDDERS Element 2.6 is modified as follows:

Element 2.6 – Demonstration of CMMI or Equivalent Experience: The Offeror also shall provide software development and CMMI, or equivalent experience, in accordance with the Section L clause Software Development and CMMI OR EQUIVALENT EXPERIENCE (NAVSEA) (DEC 2006). The software development and CMMI equivalent experience is subject to the page and foldout limitations stated within the clause.

In addition, the Offeror shall provide any evidence of experience with compliance with IEEE 12207.0 and

12207.1 standards and Capability Maturity Model Integrated (CMMI) Level 3 standards. At a minimum, evidence shall include official assessment reports as required by this solicitation. Assessment reports shall be provided as a separately tabbed section in the management proposal. This section shall not exceed 5 pages and does not count against the page limit established for the Management proposal.

3. SECTION J – LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS, EXHIBIT C – Contract

Data Requirements List, DD Form 1423 is replaced with the revised EXHIBIT C – Contract Data Requirements

List, DD Form 1423 provided as an attachment to this Amendment 0002.

N00024-17-R-4200

4. The following questions are answered:

Question #1 - ISO/IEC/IEEE 15289:2011 has been withdrawn and superseded by to be ISO/IEC/IEEE 15289:2017

(RFP page 54, Section C).

Answer #1 – The Navy agrees with this change and is taking action to update clause HQ C-2-0065 in our system.

This modified clause and reference will be issued in a future amendment.

Question #2 - Please clarify which Volume the Initial Software Development Plan (SDP), SDP Rationale and CMMI

Level 3 Experience are to be incorporated.

Answer #2 – The RFP Section L, “Physical Format” takes precedence over all. The table states that the SDP shall be “Included within the technical proposal page limit and not exceeding 15 pages” of the total 75 allowed for a technical proposal. The SDP is not required to be submitted as part of the management proposal. See changes in this Amendment 0002 to Section L, Element 2.6.

Questions #3 - No RMF Data Artifacts are specified, potentially leaving the artifact requirements unlimited and the process open ended.

Answer #3 - See changes in this Amendment 0002 to Section C, Paragraph 1.20.15.

Question #4 - Will the Government provide the Machinery Control System software/source code to the Contractor after contract award? (Attachment A - Performance Specification Rows 1311 – 1461 and Amendment 0001, Attachment G GFI and GFE)

Answer #4 - The Government will have to develop new Machinery Control System software/source code based on the proposed winning hardware design for this RFP. The Government cannot guarantee when this software/source code will be available. No RFP changes will be made as a result of this question and answer.

Question #5 - Will the Government remove references to DIACAP from Boxes #2 and #16 of CDRL C014, to be consistent with the rest of the RFP. The Government has removed all references to DIACAP elsewhere in the final

RFP, in favor of RMF, except within CDRL C014, which is thus inconsistent with the rest of the RFP. (Exhibit C

Cyber CDRLS, CDRL C014)

Answer #5 - The RFP has been modified and a revised Exhibit C is provided as an attachment to this Amendment

0002 which removes two references to the DOD Information Assurance Certification and Accreditation Process

(DIACAP) within CDRL C014. DIACAP does not apply to this RFP. The Risk Management Framework (RFM) process replaces DIACAP and RMF applies to this RFP.