Attachment 2_CAC SOW dated 30 Jan 2020.pdf

ATTACHMENT 2

STATEMENT OF WORK

FOR THE

COMMON ACOUSTIC CABINET (CAC)

DEVELOPMENT, PRODUCTION, AND ENGINEERING SERVICES

DEPARTMENT OF THE NAVY

PROGRAM EXECUTIVE OFFICER, SUBMARINES (PMS401)

614 SICARD STREET SE

WASHINGTON, NAVY YARD

WASHINGTON, DC 20376

30 Jan 2020 ii

TABLE OF CONTENTS

1.0 SCOPE

1.1.1 Navy Organization

1.1.2 The Collaborative Development Environment

2.0 REFERENCED DOCUMENTS

2.1 GOVERNMENT DOCUMENTS

2.2 NON-GOVERNMENT DOCUMENTS

3.0 REQUIREMENTS

3.1 GENERAL REQUIREMENTS

3.1.1 Program Management

3.1.1.1 Contract Work Breakdown Structure (CWBS)

3.1.1.2 Integrated Program Management Report (IPMR)

3.1.1.3 Subcontract Management and Control

3.1.1.4 Program Risk Analysis

3.1.1.5 Program Management Reviews

3.1.1.6 Technical Reviews

3.1.1.7 Integrated Product Team (IPT)

3.1.1.8 Coordination

3.1.1.9 Data Management

3.1.1.9.1 Digital Data Management

3.1.1.9.2 Internal Data / Data Access

3.1.1.10 Government Furnished Information (GFI)

3.1.1.11 Government Furnished Property/Equipment/Material (GFP/E/M)

3.1.2 Systems Engineering

3.1.2.1 Systems Engineering Management

3.1.2.2 Open Systems Architecture Approach

3.1.2.3 Specification Requirement Verification Matrix (SRVM)

3.1.2.4 System Engineering and Design Analyses

3.1.2.5 Design Analysis

3.1.2.5.1 Failure Modes, Effects, and Criticality Analyses (FMECA)

3.1.2.5.2 Failure Reporting Analysis and Corrective Action System (FRACAS)

3.1.2.6 Hardware Engineering

3.1.2.6.1 COTS and NDI Requirements

3.1.2.6.2 COTS / NDI License and Modification

3.1.2.6.3 Technology Refreshment

3.1.2.6.4 Engineering Drawings

3.1.2.7 Cybersecurity

3.1.2.7.1 System Security Plan and Plan of Action and Milestone (SSP/POAM) Review..……………….. 11

3.1.2.7.2 Compliance to NIST 800-171……………………………………………………………………. 12

3.1.2.7.3 Cyber Incident Response………………………………………………………………………… 13

3.1.2.7.4 Naval Criminal Investigative Service (NCIS) Outreach……………………………………….. 13

3.1.2.7.5 NCIS/Industry Monitoring……………………………………………………………………… 13

3.1.2.8 Safety Program

3.1.2.9 Test and Evaluation Program Plan (TEPP)

3.1.2.10 Environmental Compliance

3.1.2.11 Integrated Logistics Support (ILS)

3.1.2.11.1 Parts Management Program

3.1.2.11.2 Reliability Centered Maintenance (RCM) Analysis and Products

3.1.2.11.3 Supportability Analysis

3.1.2.11.4 Failure Reporting

3.1.2.11.5 Supply Support

3.1.2.11.6 Provisioning Data

iii

3.1.2.11.7 Interactive Electronic Technical Manual (IETM)

3.1.2.11.8 Unique Identification (UID) Requirements

3.1.2.11.9 Radio Frequency Identification (RFID)

3.1.2.11.10 Packaging, Handling, Storage, and Transportation

3.1.2.11.11 Nomenclature

3.1.2.12 Configuration Management and Documentation

3.1.2.12.1 Product Baseline Identification

3.1.2.12.2 Configuration Control

3.1.2.12.3 Configuration Audits

3.1.2.12.4 Configuration Status Accounting

3.1.2.13 Problem Reporting System

3.1.2.14 Engineering Change Documentation

3.1.2.14.1 Engineering Change Proposal (ECP)

3.1.2.14.2 Class II ECPs, Minor RFVs

3.1.2.14.3 Request for Variation (RFV)

3.1.2.14.4 Revision to ECPs/RFVs

3.1.2.14.5 Classified Data

3.1.2.14.6 Requests for Waivers

3.1.2.14.7 Specification Change Notices (SCNs)

3.1.2.14.8 Notice of Revision (NOR)

3.1.2.14.9 Engineering Change Instruction

3.1.2.15 Quality Assurance (QA)

3.1.2.16 Installation

3.1.2.16.1 Installation Aids

3.1.2.16.2 Installation and Checkout Kits (INCO)

3.1.2.17 Special Study/Analysis

3.1.2.18 Technical Data Package (TDP)

3.2 ENGINEERING DEVELOPMENT MODEL (EDM)

3.2.1 Software Engineering: Interface Management and Documentation

3.2.2 Integration and Test Engineering

3.2.3 Production Readiness

3.2.3.1 Production Planning

3.2.3.2 Production Readiness Review (PRR)

3.2.4 First Article Test

3.3 PRODUCTION REQUIREMENT

3.3.1 Factory Acceptance Test

3.4 ENGINEERING SERVICES

STATEMENT OF WORK

FOR THE

COMMON ACOUSTIC CABINET (CAC)

DEVELOPMENT, PRODUCTION, AND ENGINEERING SERVICES

1.0 SCOPE

This Statement of Work (SOW) defines the efforts required for the program management, engineering, development, logistics, configuration management, hardware integration (including material procurement or fabrication and integration of Government-Furnished Material), test and evaluation, and Cybersecurity, of the Common Acoustic Cabinet (CAC) units. The efforts are defined herein, including fabrication of TI-22, TI-24, and TI-26 Engineering Development Model (EDM) and production of CAC units applicable to LOS ANGELES, and SSGN 726 Class Submarines.

The Contractor shall build, test, and deliver operational CAC units to meet all requirements specified in the

“Common Acoustic Cabinet Performance Specification” (PMS401-CACSPEC-01, REV A). The delivery and acceptance of each production CAC unit shall be contingent on successful completion of qualification and acceptance testing.

Engineering Services will be subject to specific information identified in Technical Instructions issued in accordance with the Special Contract Requirement entitled “TECHNICAL INSTRUCTIONS.”

TI-22, TI-24, and TI-26 CAC material shall be delivered and packaged as a kit to support shipboard kit installation. All TI-22, TI-24, and TI-26 upgrade platforms have existing enclosure Multi-Purpose Processor (MPP) or CAC cabinet designs that incorporate the ability to remove the cabling Input/Output (I/O) panels from the inside of the cabinet doghouse, precluding the need to move or relocate the cabinet. Shipboard CAC installations shall re-use cabinet parts identified below. All other CAC material is the responsibility of the contractor.

The following shipboard unit 4011 cabinet items shall be re-used as installed onboard the upgrade platform:

• Unit 4011, Cabinet, Front Half

• Unit 4011, Cabinet, Rear Half

• Unit 4011, Cabinet Front and Rear Half attachment hardware

• Unit 4011, Doghouse and attachment hardware minus the I/O panels

• Unit 4011, Stabilizer plate and attachment hardware

• Unit 4011, Deck Mount Plate and Isolators

• Unit 4011, Upper Stabilizers

• Unit 4011, Cooling water supply and return union fittings and sealing washers

The contractor shall design and build CAC Test and Sell-off Structures (TSS) to support kit sell-off and prime integrator testing. The TSS shall be representative of a shipboard cabinet to include power and cooling water necessary to test the kitted material as an integrated cabinet. The number of TSS required will be determined by the contractor, incorporating the quantity required to support subcontractor production requirements and one TSS to support AN/BQQ-10 sonar prime integrator cabinet testing.

1.1.1 NAVY ORGANIZATION

Program Executive Officer, Submarines (PEO SUB) is the acquisition executive for this procurement. The PMS401 Submarine Acoustic Systems Program Office is responsible for the acquisition, development, production, fleet introduction, and support of the Submarine Acoustic Systems for all classes of Submarines and appropriate Foreign Military Sales efforts. The collaborative development environment consisting of the Navy, Academia, and other industry partners is required to support the scope identified herein and has applicability to all Navy Combat Systems processing environments for all host platforms and classes of ships both US and allied forces for those common processing elements.

1.1.2 COLLABORATIVE DEVELOPMENT ENVIRONMENT

This Contractor is required to deliver CAC Systems TI-22, TI-24, and TI-26 as GFE to Acoustic Rapid

Commercial-off-the-shelf Insertion (A-RCI) System Integrator for system integration and shipboard installation.

There are also other industry partners whom provide engineering services and support of the A-RCI Sonar System.

The Contractor shall work in a collaborative environment with a consortium of Navy, Navy laboratories, Academia, A-RCI Prime System Integrator, and other industry partners to ensure continued success of the program. The Contractor shall identify his approach to be used to support the “Open Source Initiative” to enable third party applications and allow for the efficient integration of improvements with the Submarine Acoustic Systems. The Contractor shall leverage past experience involved in similar efforts and indicate the approach that will be used in delivering this effort.

2.0 REFERENCED DOCUMENTS

The following documents are to be used as guidance in the performance of the requirements identified herein.

2.1 GOVERNMENT DOCUMENTS

PMS401-CACSpec-01 Rev B 31 October 2019

Common Acoustic Cabinet Performance Specification

SUB-SONAR-SPEC-17

Rev (-) 11 March 2019

Submarine Sonar Specification for Advanced Processing Build 2017 (and later) Volume 1, Volume 2 and Secret Appendices

MIL-HDBK-217F

thru Notice 2 28 February 1995

Reliability Prediction of Electronic Equipment

MIL-HDBK-251

19 Jan 78

Reliability/Design Thermal Applications

MIL-HDBK-470A

thru Notice 2 31 May 2012

Designing and Developing Maintainable Products and Systems, Volume I

MIL-HDBK-502A

thru Notice 1 06 Mar 2018

Product Support Analysis

MIL-STD-3034A

thru Notice 1 15 Apr 2019

Reliability-Centered Maintenance (RCM) Process

MIL-PRF-29612B

thru Notice 3 31 Mar 2016

Training Data Products

MIL-S-901E

20 Jun 2017

Military Specification: Shock Tests, H.I (High-Impact) Shipboard Machinery, Equipment, and Systems, Requirements For

MIL-STD-461G

11 Dec 2015

Requirements for the Control of Electromagnetic Interference Characteristics of Subsystems and Equipment

MIL-STD-881C

3 Oct 2011

Department of Defense Standard Practice: Work Breakdown Structures for Defense Materiel Items

MIL-STD-882E

11 May 2012

Department of Defense Standard Practice: System Safety

MIL-STD-1472G

w/ Change 1 17 Jan 2019

Department of Defense Standard Practice: Human Engineering

MIL-STD-3018

w/ Change 2 02 June 2015

Department of Defense Standard Practice: Parts Management

MIL-STD-31000B

31 Oct 2018

Department of Defense Standard Practice: Technical Data Packages

NAVSEA 0924-062-0010

Rev C 25 Jan 2012

Submarine Safety (SUBSAFE) Requirements Manual

NAVSEA-ST00-AA-IDX-010-TEI

Rev 17

Test Equipment Index

NDMS-100001-000

05 Oct 2009

Technical Manual Contract Requirement (TMCR), Interactive Electronic Technical Manual (IETM) for the A-RCI Program

NAVSEA ltr 5510, Ser/TSUB- 24 June 2005

Team Submarine Information Security Policy

NAVSEA PMS401 IUID Plan 03 May 2012

PMS401 Submarine Acoustic Program Office AN/BQQ-10(V) SONAR Set Item Unique Identification Execution Plan

PEO IWS / NAVSEA Technical Review Manual (TRM) Version 2.0 18 December 2009

Technical Review Manual (TRM) Program Executive Officer Integrated Warfare Systems (PEO IWS). Naval Sea Systems Command, Research & System Engineering, Warfare Systems Engineering, and Human System Integration Directorate (NAVSEA 05H).

PMS401 UID Plan 17 May 2012

PMS401 Submarine Acoustic Systems Program Office AN/BQQ-10(V) SONAR Set Item Unique Identification (UID) Execution Plan

3 April 2017 Acceptance Test Plan for Submarine Sonar, Revision H

2.2 NON-GOVERNMENT DOCUMENTS

ANSI/AIAA-R-100A

Recommended Practice for Parts Management

ANSI/EIA-632-1999 Processes for Engineering a System

ANSI/EIA-649-B

17 Jun 2011

Configuration Management Standard

ANSI/EIA-748-B

June 2007

Earned Value Management Systems

ANSI/EIA-STD-0007

August 2007

Logistics Product Data, Version 1.0

GEIA-STD-0007

15 October 2008

Logistics Product Data

IEEE/EIA 12207.0/1/2

March 1998 April 1998

Software Life Cycle Processes; Life Cycle Data; Implementation Considerations

NAS411 thru Rev. 2 29 April 94

Hazardous Materials Management Program

3.0 REQUIREMENTS

The work required by this Section 3.0 of the Statement of Work is applicable to all requirements under this contract.

The contractor shall possess and maintain a SECRET facility security clearance.

Personnel accessing classified information in the performance of this contract shall possess and maintain a

SECRET security clearance. Some data and associated information which may be provided by the Government as part of this contract will be subject to need-to-know validation and approval by designated Naval Sea Systems Command classification authorities. Supplemental air-gapped segregation requirements will be enforced for electronic (computer) data and networks. Hard copy (paper) data will be subject to approved physical storage segregation. Such access and approvals will be provided as appropriate upon contract award and codified by modification of Form DD254.

3.1 GENERAL REQUIREMENT

The work required by this Section 3.1 of the Statement of Work (SOW) is applicable to development, production and engineering services requirements under this SOW.

In performing this work, the Contractor will require a SECRET security clearance level for access to classified information, and Communications Security (COMSEC) for data sharing and information safeguarding.

The contractor shall be responsible for receiving, storing, and generating classified information during the modernization of the classified equipment. Techniques to modernize and test this equipment, and overall system performance could be classified and subject to email and written reports.

The contractor shall fabricate and modify classified component/hardware in support of this contract and store the component/hardware until completion of all requirements. In order to use the current contract specifications and applicable documentation, the contractor is required to use the Defense Technical Information Center (DTIC). Contractor requires a COMSEC account to accommodate the use of secure communications. The contractor shall require use of the Defense Courier Service for the transfer of classified material.

3.1.1 Program Management

The Contractor shall designate a Program Manager who shall have responsibility for all aspects of this contract and the authority to commit the Contractor to specific courses of action. The Contractor shall perform all administrative, technical, and financial management functions required to support this effort and shall maintain the status, including all technical activities, problems or deficiencies, and recommended solutions. The Contractor shall organize, coordinate, report the status [Exhibit Line Item Number (ELIN) A001, DI-MGMT-81928) of all contract activities related to the contract, and be responsible for those activities assigned to subcontractors, to ensure the delivery of all supplies and services specified in this contract.

3.1.1.1 Contract Work Breakdown Structure (CWBS)

The Contractor shall develop and maintain the CWBS and CWBS dictionary using MIL-STD-881C for guidance. The CWBS shall be to the lowest level necessary to reach manageable units of functional tasks that reflect the work being performed while ensuring the correlation of these lower levels to the specification, contract line items, data items, and work statement tasks. The Contractor shall use the CWBS as the primary framework for contract planning, budgeting, and reporting of the cost, schedule and technical performance status to the Government. The Contractor shall analyze the system requirements specified in the SOW and system specification and translate them into a structure representing the products and services that comprise the entire work effort under the contract. The Contractor, if necessary, shall update the CWBS during the execution of the contract. Changes to the CWBS or associated definitions, at any reporting level, require Government approval. [ELIN A002, DI-

MGMT-81334D]

3.1.1.2 Integrated Program Management Report (IPMR)

The Contractor shall apply Earned Value Management (EVM) principles, create and maintain an IPMR.

The Contractor shall report progress on all technical performance, cost, schedule, and data delivery requirements for development and production of CAC systems. The Contractor shall provide access to all pertinent records, data and plans, as requested by the Government or their representatives. Integrated Master Schedule (IMS) activities shall be reported in the IPMR. [ELIN A003, DI-MGMT-81861A]

EVM reporting requirements do not apply to the TI-22 CAC Engineering Development Model (EDM)

(CLIN 0007) or to Engineering and Technical Services CLINs 0001, 0002, 0101, 0102, 0201, 0202, 0301, 0302, 0401, 0402, 0501, 0502, 0601, 0602, 0701, 0702, 0801, and 0802.

The Contractor shall conduct an Integrated Baseline Review (IBR) within six (6) months of award to assess the Contractor’s Performance Measurement Baseline (PMB). [ELIN A004, DI-ADMN-81249B], [ELIN A005, DI- ADMN-81250B] The Contractor shall conduct an IBR for any major change to the contract, as determined by the Contracting Officer’s Representative (COR). As part of the EVM requirements for this contract, the Contractor shall generate the Contract Funds Status Report (CFSR). [ELIN A006, DI-MGMT-81468]

3.1.1.3 Subcontract Management and Control

The Contractor shall identify and monitor subcontractor technical, quality, schedule, and milestone achievement on a continuing basis, according to the Contractor’s own established subcontract management techniques.

3.1.1.4 Program Risk Analysis

The Contractor shall identify significant program issues and raise them to the Program Office so that they can be monitored and resolved. The Contractor shall perform a continuing analysis of program, technical, performance, cost, and schedule risks. The analysis shall identify the risks associated with each area, identify the impact of each risk on the overall program, and propose approaches for reducing identified risks. Risk analysis status shall be reported in the Contractor’s Progress, Status and Management Report and presented during Program Reviews. [ELIN A001, DI-MGMT-81928]

3.1.1.5 Program Management Reviews

On a quarterly basis, the Contractor shall host a one-day Program Management Review (PMR) or participate in the PMS4012 Assistant Program Manager (APM) Review. [ELIN A004, DI-ADMN-81249B], [ELIN

A005, DI-ADMN-81250B]

The Contractor shall host the PMR at the Contractor’s facility or via Contractor-hosted video teleconferencing (VTC). The APM Review will be held in Washington, DC area. Technical issues will be discussed in terms of performance goals, exit criteria, schedule progress, and cost impact. At each review, the Contractor shall, at a minimum, report the status of the following:

a. cost/schedule performance

b. design and technical issues

c. hardware and software engineering

d. risk analysis and mitigation activities

e. reliability and maintainability

f. test and integration activities, plans, results

g. development activities -- completed and planned

h. logistics development and support efforts

i. safety program requirements

j. quality program

k. configuration management activities

l. Government-Furnished Property (GFP) and Government-Furnished Information (GFI) status

m. production readiness

n. efforts authorized under technical instructions

o. manpower utilization (actual) for preceding three-month period

p. manpower utilization (projection) for next nine months

q. data-deliverable schedule and status

r. hazardous material management efforts

s. status of action items from previous reviews.

3.1.1.6 Technical Reviews

The Contractor shall host a one-day orientation meeting within 30 calendar days after initial contract award. The Contractor shall host additional one-day orientation meetings for TI-24, and TI-26 and these meetings shall be defined in the Integrated Master Schedule (IMS) or the Contractor’s Program Plan. The orientation meetings will ensure that all requirements are clearly and mutually understood. Orientation meetings shall be held at the Contractor’s facility.

Technical reviews shall be held at the Contractor’s facility to discuss and evaluate design status. Technical reviews shall be conducted on a periodic basis to determine progress and resolve issues. The structure and intervals will be defined in the Integrated Master Schedule (IMS) or the Contractor’s Program Plan. The Contractor shall demonstrate how the requirements associated with the events or milestones will be achieved for these reviews. As scheduled in the IMS, the Contractor shall conduct the following reviews for TI-22, TI-24, and TI-26 using ANSI/EIA-632 and/or PEO IWS / NAVSEA Technical Review Manual (TRM) as guidance.

a. System Requirements Review (SRR) / System Design Review (SDR). The objective of the review is to ensure that the operational requirements have been successfully represented by the system requirements, that the system design has the potential of meeting these system requirements when acceptably balanced with cost, schedule, and technical risk, and that the plans for moving ahead with system development are reasonable and of acceptable risk.

b. Preliminary Design Review (PDR). The objective of the review is to review the architectural design of the configuration item (CI) to verify its compliance to its allocated requirements, the planned test approaches, and the overall progress being made in developing the CI, as it fits into the total system.

The review is considered complete when Government has determined that progress has been sufficient for continued development.

c. Critical Design Review (CDR) / Final Design Review (FDR). The objective of the review is to provide the opportunity to assess the completeness of the detailed design and how it supports the performance requirements as well as overall progress being made in developing the system.

d. If required, Production Readiness Review (PRR). See Section 3.2.3.2 for more information.

e. Test Readiness Review (TRR). The objective of the review is for the Government to determine whether the contractor and all associated activities are mature enough and sufficient progress has been made in development and test planning to begin formal product testing with an acceptable likelihood of successfully passing formal testing.

f. Integration Readiness Review (IRR). The objective of the review is for the Government to determine whether the contractor is in fact ready to begin system integration testing with the A-RCI Sonar System at the A-RCI Prime System Integrator facility.

For each review, the Contractor shall generate and provide design review information package to the Program Office. [ELIN A00A, DI-SESS-81757A]

For each review, the Contractor shall transcribe meeting minutes and include action items assigned. [ELIN

A004, DI-ADMN-81249B], [ELIN A005, DI-ADMN-81250B]

3.1.1.7 Integrated Product Team (IPT)

The objective of the IPT concept is to assemble all stakeholders with a particular problem or issue who will expand the principal of concurrent engineering, utilizing a systematic approach to make team decisions based on timely input from the entire team, including customers and suppliers, and third party developers. The desired expectation is to move away from a pattern of hierarchical decision-making to a process where decisions are made across organizational structures by IPTs. These IPTs will integrate cost, schedule and performance data to provide a global perspective with detailed insight into the managerial and technical aspects impacting Government and industry.

IPTs are generally made up of representatives from the Government, the Contractor, subcontractors, vendors, and other industry partners and are chaired by the Government or Government representative. The Contractor (including subcontractors and vendors as necessary) shall attend, present as necessary, and participate in IPT meetings. During Government fiscal year, a minimum of 12 and a maximum of 26 IPT meetings shall be held at either the Contractor’s facility or via the Contractor-hosted telephone conference.

As part of the IPTs, the Contractor shall have responsibility for the following functions:

a. Monitoring and reporting of Subsystem status and progress;

b. Joint identification, evaluation, management, and reporting of risk mitigation and cost reduction initiative efforts;

c. Identification, collection, analysis, and reporting of appropriate metrics for measurement of cost/schedule control, engineering and production progress;

d. Joint evaluation and management resolution of major issues associated with hardware and software engineering, production, integration, test, and INCO activities;

e. Verification that the Contractor’s ‘early and often’ design disclosure process is providing data that is current, complete and accurate to third party developers;

f. Joint evaluation and management of the ILS effort; and

g. Joint recommended approval of data items requiring approval under this contract.

3.1.1.8 Coordination

The Contractor has responsibility for the CAC performance. Accordingly, the Contractor shall:

a. Participate in meetings (including coordination thereof) for efforts relating to the equipment.

b. Attend other contractor’s technical reviews and invite outside activities to its reviews when appropriate.

c. Provide, receive, and/or analyze information for others, which relates to the equipment.

3.1.1.9 Data Management

The Contractor shall manage the development and use of data under this contract so as to afford the

Government visibility of all data.

The Contractor shall maintain Contract Data Status for recording, planning, scheduling, and reporting the status of program data requirements including electronic mail transmittals; and maintain a list of all contractor and subcontractor data generated in support of this contract. Data management shall adhere to the NAVSEA Security Program Instruction Number provided as Government Furnished Information (GFI).

3.1.1.9.1 Digital Data Management

All data shall be developed, managed, used, and delivered/exchanged electronically to the greatest extent practical. Communication via electronic mail (E-Mail) shall not relieve the Contractor of the responsibility to meet the contract requirements or change the contract requirements until a contract modification is issued by the Contracting Officer.

3.1.1.9.2 Internal Data / Data Access

The Contractor shall establish and maintain E-Mail capability, compatible with NAVSEA PMS401 (transmit and receive). A list of files transmitted and/or to be transmitted electronically, along with any procedures necessary for accessing them, shall be included in the Contractor’s Progress, Status and Management Reports.

[ELIN A001, DI-MGMT-81928]

The Contractor shall provide program related data to the Government upon request. Data stored electronically shall be made available to the Government via practical electronic means (e.g. Internet, remote dial-in, local login, etc.). When hard copy delivery is necessary, the Contractor shall deliver data no later than (NLT) 15 calendar days following the written request. The Contractor shall identify accessible data.

3.1.1.10 Government Furnished Information (GFI)

GFI, identified in Attachment 5, shall be managed in accordance with DFARS 252.227-7025. Email verification of receipt of GFI shall be provided per the Contract Data Requirement List (CDRLs) and specified distribution lists. GFI related issues (e.g., substandard quality, tardy submission) that have or may have an adverse effect on the performance will be referred to the COR for resolution. [ELIN A007, DI-MGMT-80596]

3.1.1.11 Government Furnished Property/Equipment/Material (GFP/E/M)

GFP/E/M, identified in Attachment 6, shall be managed in accordance with FAR 52.245-2. Email verification of receipt of GFP/E/M shall be provided per the Contract Data Requirement Lists (CDRLs) and specified distribution lists. GFP/E/M related issues (e.g., substandard quality, tardy submission) that have or may have an adverse effect on the performance will be referred to the COR for resolution. [ELIN A008, DI-QCIC- 80736]

3.1.2 Systems Engineering

3.1.2.1 Systems Engineering Management

In compliance with ANSI/EIA-632, the Contractor shall establish an engineering process to support the tasks listed in this SOW. The engineering process must balance performance, risk, cost, and schedule. Further, it shall employ iterative processes for requirement analysis, functional analysis and allocation, design synthesis and verification, and system analysis and control. [ELIN A00B, DI-SESS-81785A]

The engineering process shall ensure:

a. The compatibility, interoperability and integration of all functional and physical interfaces

b. That system definition and design reflect the requirements for hardware, software, facilities, people, and data

c. Technical risks are identified and managed.

3.1.2.2 Open Systems Architecture Approach

The Government intends to procure system(s) having an Open System Architecture and corresponding components. As part of this contract, the Contractor shall define, document, and follow an open systems approach for using modular design, standards-based interfaces, and widely-supported consensus-based standards. The Contractor shall demonstrate compliance with open systems architecture during all technical reviews.

As part of an open system architecture approach, the Contractor shall identify to the Government all Commercial-Off-the-Shelf/Non-Developmental Item (COTS/NDI) components, their functionality and proposed use in the system, and provide copies of license agreements related to the use of these components for Government approval prior to use.

In satisfying the Government’s requirements, the following system architecture approach characteristics shall be utilized:

a. Open Architecture - The Contractor shall develop and maintain an architecture that incorporates appropriate considerations for re-configurability, portability, maintainability, technology insertion, vendor independence, reusability, scalability, interoperability, upgradeability, and long-term supportability.

b. Modular, Open Design – The Contractor shall develop an architecture that is layered and modular and uses COTS/NDI hardware, operating systems, and middleware that utilize non-proprietary or non-vendor-unique, key Application Programming Interfaces (APIs). The Contractor’s design approach shall be applied to all subsystems and components. The Contractor shall provide the Government (and/or Government support contractors) electronic access to its integrated development environment throughout the term of the contract.

c. Modular Open Systems Approach (MOSA) –The Contractor’s design approach shall produce a system that consists of hierarchical collections of hardware configuration items (components). These components shall be of a size that supports competitive acquisition as well as reuse. The Contractor’s design approach shall emphasize the selection of components that are available commercially or within the Department of Defense (DOD), to avoid the need to redevelop products that already exist and that can be re-used.

As part of technical reviews (refer to Paragraph 3.1.1.6), the Contractor shall, at a minimum:

a. Describe how the proposed system architecture meets the modular, open design goals, including the steps taken to use non-proprietary or non-vendor unique COTS or reusable NDI components wherever practicable.

b. Describe its rationale for the modularization choices made to generate the design.

c. Provide rationale that explicitly address any tradeoffs performed, particularly those that compromise the modular and open nature of the system.

d. Provide rationale for maintaining continued access to cutting edge technologies and products from multiple suppliers.

e. Describe how it will mitigate the risks associated with technology obsolescence.

f. Describe how it will avoid being locked into proprietary or vendor-unique technology and reliance on a single source of supply over the life of the system.

3.1.2.3 Specification Requirement Verification Matrix (SRVM)

The Contractor shall develop the SRVM to ensure traceability between the test requirements and the performance specification. [ELIN A00C, DI-MISC-81283]

3.1.2.4 System Engineering and Design Analyses

The Contractor shall develop System/Subsystem Design Descriptions (SSDDs) [ELIN A015, DI-IPSC- 81432A] in accordance with EIA-632. In addition, the requirements outlined in section 3.1.2.5 (Design Analysis) shall be included in the SSDD.

3.1.2.5 Design Analysis

The Contractor shall conduct detailed system engineering, design, interface, and requirement analyses of the proposed hardware system. Materials and components to be incorporated into the cabinet design shall be specified including a listing of any hazardous materials or processes incorporated or used in the fabrication. The design analysis shall consist of detailed examinations of the design techniques and materials that the Contractor plans to use to meet the requirements of the specifications. The Contractor shall not require any critical manufacturing processes, special inspections/tools or calibrations in its design unless approved by the Government.

The design analysis shall be specific on both the system and component levels. Stress levels and safety factors, as appropriate, shall be identified for all mechanical and electrical parts. In addition to the system hardware physical considerations, the design analyses shall evaluate the system concept in terms of operability, reliability, producibility, maintainability, and supportability objectives using MIL-STD-1472G and MIL-HDBK-470A as guidance. The Contractor shall examine the design details and modify them, as necessary, to ensure that the system design will conform to established Navy precepts for minimum practical personnel and training requirements.

3.1.2.5.1 Failure Modes, Effects, and Criticality Analyses (FMECA)

The Contractor shall perform FMECA to the Lowest Replaceable Unit (LRU) level. The FMECA includes hardware failures. All potential hardware failure modes shall be postulated at the LRU level. Results of FMECAs shall be documented in the Failure Modes and Effects Analysis (FMEA) Report. [ELIN A00V, DI-PSSS-80980B]

3.1.2.5.2 Failure Reporting Analysis and Corrective Action System (FRACAS)

The Contractor shall analyze failure data, address historical operating time and data; determination of the cause of each failure down to the LRU and component level; identify LRUs and components that have had more than one failure; planned corrective actions; and implementation and results of corrective actions including resultant reliability. The Contractor shall analyze the root cause for all pattern failures (more than one) and shall submit a failed item report (Failure Summary and Analysis Report (FSAR)) for Government approval. [A00W, DI-SESS- 80255A]. If corrective actions are required, the Contractor shall include that data in the monthly Contractor’s management report. [A001, DI-MGMT-81928]. If deemed necessary by the Government, the Government will examine at the Contractor’s facility, the data from all failure and corrective action analyses.

Upon Government approval, if required, the Contractor shall be responsible for correcting deficiencies discovered during the reliability test and for incorporating engineering change orders into the production baseline within 30 days after the approval, accordingly. Throughout the Test, Analyze and Fix, and FRACAS processes, the Contractor shall plot failure data on a Reliability Growth Curve to assess system reliability. The Contractor may recommend additional specific testing to assess unique system characteristics.

3.1.2.6 Hardware Engineering

The Contractor shall develop, update and maintain a hardware functional, performance and interface requirements baseline and generate program-unique specifications for the CAC hardware.

3.1.2.6.1 COTS and NDI Requirements

The Contractor shall use NDI and COTS items to meet CAC system requirements. It is the Government's intent to use COTS and NDI documentation when available to reduce developmental costs. Design documentation for COTS and NDI is not required; however, the Contractor shall include the definition of the COTS/NDI physical and functional characteristics, including interfaces, for the application in the CAC design documentation. [ELIN

A016, DI-IPSC-81436A], [ELIN A017, DI-SESS-81003F]

3.1.2.6.2 COTS / NDI License and Modification

The Contractor shall be responsible for the procurement of all licenses for COTS/NDI components delivered in this contract including both contractor-developed and third party COTS/NDI. If the Contractor needs to obtain a license for any COTS/NDI incorporated into a deliverable under this contract, the Contractor shall notify the Government immediately in writing. NDI License requirements shall be in accordance with the Basic Contract.

This notification shall specify whether the license(s) that needs to be procured are transferable to the Government and/or any of its other contractors. The Contractor shall obtain Government approval prior to use of these components.

The Contractor shall provide copies of license agreements for Government approval prior to modification of any COTS/NDI. If approved, the Contractor shall document any modified COTS/NDI components and provide the document to the Government. [ELIN A00D, DI-MISC-80508B]

3.1.2.6.3 Technology Refreshment

The Contractor shall implement a technology refreshment program to ensure the Contractor-furnished components/units are not technologically obsolete at final acceptance of each CAC EDM and production unit.

3.1.2.6.4 Engineering Drawings

The Contractor shall develop and update engineering and drawing documentation to support all requirements of the system performance specification and the contract. Documentation and drawings shall be comprised of an Interface Control Document (ICD), Interface Design Description (IDD), product drawings, commercial drawings, and installation control drawings. [ELIN A018, DI-SESS-81248B], [ELIN A016, DI-IPSC-

81436A], [ELIN A017, DI-SESS-81003F], [ELIN A01A, DI-DRPR-81242]

The Contractor shall prepare and update final production (level three) drawings for the CAC unit. [ELIN

A019, DI-SESS-81000F]

3.1.2.7 Cybersecurity

The Contractor shall establish and maintain a Cybersecurity program to support the customer's system security certification and accreditation of Submarine Acoustic Systems to the DOD and NAVSEA Cyber requirements. The Contractor shall work with the Navy Cybersecurity representative to ensure that the ARCI program is compliant with any proposed Cybersecurity solution set and that interface requirements are correctly implemented.

The Contractor shall implement and apply safeguards such that information and resources maintain the appropriate level of confidentiality, integrity, availability, authentication, and non-repudiation based upon mission criticality, level of required Cybersecurity and classification or sensitivity level of information entered, processed, stored, or transmitted for Submarine Acoustic Systems. The Contractor shall safeguard information and information systems through the use of multi-disciplined defensive layers, as well as sound administrative and operational practices. The Contractor shall document its security engineering process in the System Engineering Management Plan (SEMP). [ELIN A00B, DI-SESS-81785A]

The Contractor shall analyze system security requirements and provide data inputs to support the Program

Office in the development of the System Security Authorization Agreement (SSAA) and shall collaborate with other system and subsystem contractors. To ensure traceability and completeness of system security requirements, references to system performance specification requirements shall be included in the Specification Requirements Verification Matrix (SRVM). [ELIN A00C, DI-MISC-81283]

3.1.2.7.1 System Security Plan and Plan of Action and Milestone (SSP/POAM) Reviews

The contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor’s information system(s) available for review by the Government at the Contractor’s facility within thirty (30) days of contract award. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government’s review of the SSP at the Contractor’s facility.

If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies with thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestone (POAM) for the correction of the identified deficiencies. The

Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

Upon the conclusion of the correction period, the Government may conduct a follow-on review of the

SSP(s) at the Contractor’s facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

The Government may, in its sole discretion, conduct subsequent reviews at the Contractor’s site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days’ notice to the Contractor.

3.1.2.7.2 Compliance to NIST 800-171

The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS 252.204- 7012(b)(2), for all covered contractor’s information systems affecting this contract.

Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at minimum:

a. Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is requirement for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptance multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as

CNC, equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

b. Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

c. Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

c. Audit user privileges on at least an annual basis;

d. Implement:

1. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

11. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

e. Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation, which shall be evaluated by the Navy for risk acceptance.

f. Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

3.1.2.7.3 Cyber Incident Response

The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact. [ELIN A001, DI-MGMT-81928]

Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3)

Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions

_for_Submitting_Media.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification.

The contracting officer will approve or disapprove the request after coordination with DC3.

3.1.2.7.4 Naval Criminal Investigative Service (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies.

3.1.2.7.5 NCIS/Industry Monitoring

In the event of a cyber-incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor sl1all cooperate with the Naval Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor1s information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law

3.1.2.8 Safety Program

The Contractor shall establish and maintain a system safety program in accordance with MIL-STD-882E.

The Contractor shall develop a System Safety Program Plan (SSPP). The SSPP shall describe tasks and activities of system safety management and system safety engineering. If tasked via Technical Instruction, the Contractor’s description shall include any information required to identify, evaluate and eliminate/control hazards, or reduce the associated risk to an acceptable level. The SUBSAFE requirements are not applicable to the CAC equipment.

[ELIN A00E, DI-SAFT-81626]

3.1.2.9 Test and Evaluation Program Plan (TEPP)

The Contractor shall develop, maintain and update a Test and Evaluation Program Plan (TEPP) to describe all testing planned for the CAC systems and interfaces, including the EDM. The TEPP shall define the process for integration and testing of equipment. The TEPP shall also address recent advances in Automated Test tools and techniques that can be accommodated during integration, build check out, and certification testing. [ELIN A00F, DI-NDTI-81284], [ELIN A00G, DI-NDTI-80603A]

3.1.2.10 Environmental Compliance

The Contractor shall ensure that work performed under the contract complies with National Aerospace Standard (NAS) 411. The Contractor shall eliminate, or minimize as much as possible, the usage of:

a. Hazardous materials, including those on the Environmental Protection Agency (EPA) listing of 17 toxics

b. Class I or II Stratospheric Ozone depleting substances

c. Any of DOD’s top-ten Toxics Release Inventory (TRI) Chemicals.

3.1.2.11 Integrated Logistics Support (ILS)

The Contractor shall establish an ILS program for the equipment for the system development, production, and deployment. The Contractor shall generate and deliver a logistics package, in a consistent, common format. The Contractor shall designate an ILS manager to serve as the point of contact on ILS matters as well as participate in the various IPTs. [ELIN A00X, DI-ILSS-80095]

3.1.2.11.1 Parts Management Program

The Contractor shall maintain a Parts Management Program that ensures:

a. use of parts that meet contractual requirements

b. reduced proliferation of parts through standardization, enhancement, equipment reliability and supportability

c. proactive management of obsolescence.

Processes and procedures for identifying common hardware consistent with the overall technology insertion baseline and accepting parts at the Contractor’s facility or vendor locations shall be established prior to Preliminary Design Review (PDR). The Contractor’s Parts Management Program shall follow the guidelines described in MIL-STD-3018 w/Change 1.

3.1.2.11.2 Reliability Centered Maintenance (RCM) Analysis and Products

The Contractor shall develop, maintain, and update RCM Products. The Contractor shall establish a thorough RMA program for the equipment at the beginning of the design phase that influences design for reliability and maintainability.

The Contractor shall develop reliability predictions for equipment and software per MIL-HDBK-217F and provide maintainability predictions to the Program Office. The Contractor shall conduct reliability and maintainability analyses at LRU level throughout design, development, and production to support availability predictions. The Contractor shall use the 12 Phase RCM process in accordance with MIL-STD-3034.