N00024-25-R-5200 Draft Amendment 1.pdf

CODE

(Hour)

PAGE(S)

until local time

X

A

X B

X C X D

EX

X

G

F 76 - 85

86 - 108

X H 109 - 115

RATING PAGE OF PAGES

7. ISSUED BY

(Date)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

Previous Edition is Unusable 33-134 STANDARD FORM 33 (REV. 9-97)

Prescribed by GSA

FAR (48 CFR) 53.214(c)

1 115

(If other than Item 7)

15A. NAME 16. NAME AND TITLE OF PERSON AUTHORIZED TO

AND

ADDRESS

SIGN OFFER (Type or print)

OF

OFFEROR

AMENDMENT NO. DATE

15B. TELEPHONE NO (Include area code) 17. SIGNATURE15C. CHECK IF REMITTANCE ADDRESS

IS DIFFERENT FROM ABOVE - ENTER

SUCH ADDRESS IN SCHEDULE.

18. OFFER DATE

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

2. CONTRACT NO.

N00024 8. ADDRESS OFFER TO

See Item 7

9. Sealed offers in original and copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in

CAUTION - LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME (NO COLLECT CALLS)

11. TABLE OF CONTENTS

SOLICITATION/ CONTRACT FORM

SUPPLIES OR SERVICES AND PRICES/ COSTS

2 - 10

X I CONTRACT CLAUSES

DESCRIPTION/ SPECS./ WORK STATEMENT X

PACKAGING AND MARKING

11 - 52

53 - 54

J LIST OF ATTACHMENTS

INSPECTION AND ACCEPTANCE

DELIVERIES OR PERFORMANCE

55 - 57

58 - 59 X K

REPRESENTATIONS, CERTIFICATIONS AND

OTHER STATEMENTS OF OFFERORS

CONTRACT ADMINISTRATION DATA 60 - 67 X

SPECIAL CONTRACT REQUIREMENTS

OFFER (Must be fully completed by offeror) 68 - 69 X M

L INSTRS., CONDS., AND NOTICES TO OFFERORS

EVALUATION FACTORS FOR AWARD

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52.232-8)

14. ACKNOWLEDGMENT OF AMENDMENTS

(The offeror acknowledges receipt of amendments

AMENDMENT NO. DATE

to the SOLICITATION for offerors and related documents numbered and dated):

FACILITY

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period

SOLICITATION, OFFER AND AWARD

X

(X) SEC. DESCRIPTION (X) SEC. DESCRIPTION PAGE(S)

PART I - THE SCHEDULE

26. NAME OF CONTRACTING OFFICER (Type or print) 27. UNITED STATES OF AMERICA 28. AWARD DATE

EMAIL:TEL: (Signature of Contracting Officer)

CODE CODE

B. TELEPHONE (Include area code) C. E-MAIL ADDRESS

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT 21. ACCOUNTING AND APPROPRIATION

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

10 U.S.C. 2304(c)( ) 41 U.S.C. 253(c)( ) (4 copies unless otherwise specified)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN ITEM

24. ADMINISTERED BY (If other than Item 7) CODE 25. PAYMENT WILL BE MADE BY CODE

PART IV - REPRESENTATIO NS AND INSTRUCTIO NS

PART III - LIST O F DO CUMENTS, EXHIBITS AND O THER ATTACHMENTS

70 - 74

PART II - CO NTRACT CLAUSES

NAVAL SEA SYSTEMS COMMAND (HQ)

1333 ISAAC HULL AVE SE

WASHINGTON NAVY YARD DC 20376-2030

FAX:

TEL:

FAX:

TEL:

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

SOLICITATION

6. REQUISITION/PURCHASE NO.5. DATE ISSUED4. TYPE OF SOLICITATION

SEALED BID (IFB)

NEGOTIATED (RFP)

[ X ]

3. SOLICITATION NO.

N0002425R5200

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

CLIN

Number

Each

HW & Non/Commercial SW Catalog

FFP

Hardware and Commercial/Non-Commercial Software Catalog

FOB: Destination

NET AMT

CI Non/Commercial SW Procurement

FFP

Computing Infrastructure Commercial/Non-Commercial Software Procurement

Hours

CI SW Eng Labor for HW Optimization

FFP

Cloud Infrastructure Software Engineering Labor for Hardware Optimization

Hardware Component Procurement

FFP

Hardware Component Procurement

Months

Engineering and Support Services

FFP

Engineering and Support Services

OPTION CI SW Dep & HW/SW Install Support Option

FFP

Compute Infrastructure Software Deployment and Hardware/Software Install

Support

OPTION Product Support and Training Option

FFP

Product Support and Training

OPTION Development and Test Labs Option

FFP

Development and Test Labs

OPTION Warehousing and Storage Option

FFP

Warehousing and Storage

Project

OPTION Special Studies Option

FFP

Special Studies

Project

ODCs in Support of CLIN 0005

FFP

Incidental Material, Travel, and Subsistence Support for Engineering Services

(CLIN 0005)

Lot

OPTION Technical Data Rights Option

FFP

Technical Data Rights

Data

FFP

Electronic CDRL Delivery/Data for all years

Lot

Production Portal

FFP

Production Portal

CLAUSES INCORPORATED BY FULL TEXT

B-215-H002 REFUNDS (SPARES AND SUPPORT EQUIPMENT) (NAVSEA) (OCT 2018)

(a) In the event that the price of a spare part or item of support equipment delivered under this contract significantly exceeds its intrinsic value, the Contractor agrees to refund the difference. Refunds will not be made to recoup the amount of cost decreases that occur over time due to productivity gains (excluding economic purchase quantity considerations) or changes in market conditions.

(b) For purposes of this requirement, the intrinsic value of an item is defined as follows:

(1) If the item is one which is sold or is substantially similar or functionally equivalent to one that is sold in substantial quantities to the general public, intrinsic value is the established catalog or market price, plus the value of any unique requirements, including delivery terms, inspection, packaging, or labeling.

(2) If there is no comparable item sold in substantial quantities to the general public, intrinsic value is defined as the price an individual would expect to pay for the item based upon an economic purchase quantity as defined in FAR

52.207-4, plus the value of any unique requirements, including delivery terms, inspection, packaging or labeling.

(c) At any time up to two years after delivery of a spare part or item of support equipment, the Contracting Officer may notify the Contractor that based on all information available at the time of the notice, the price of the part or item apparently exceeds its intrinsic value.

(d) If notified in accordance with paragraph (c) above, the Contractor agrees to enter into good faith negotiations with the Government to determine if, and in what amount, the Government is entitled to a refund.

(e) If agreement pursuant to paragraph (d) above cannot be reached, and the Navy's return of the new or unused item to the Contractor is practical, the Navy, subject to the Contractor's agreement, may elect to return the item to the Contractor.

Upon return of the item to its original point of Government acceptance, the Contractor shall refund in full the price paid.

If no agreement pursuant to paragraph (d) above is reached, and return of the item by the Navy is impractical, the

Contracting Officer may, with the approval of the Head of the Contracting Activity, issue a Contracting Officer's final decision on the matter, subject to Contractor appeal as provided in the "Disputes" clause (FAR 52.233-1).

(f) The Contractor shall make refunds, as required under this requirement, in accordance with instructions from the

Contracting Officer.

(g) The Contractor shall not be liable for a refund if the Contractor advised the Contracting Officer in a timely manner that the price it would propose for a spare part or item of support equipment exceeded its intrinsic value, and with such advice, specified the estimated proposed price, the estimated intrinsic value and known alternative sources or item, if any, that can meet the requirement.

(h) This requirement does not apply to any spare parts or items of support equipment whose price is determined through adequate price competition. This requirement also does not apply to any spare part or item of support equipment if the

Contractor submitted, and certified the currency, accuracy and completeness of, cost or pricing data applicable to the item.

(End of text)

B-227-H001 PROVISIONING TECHNICAL DOCUMENTATION – WITHHOLDING OF PAYMENT

(NAVSEA) (OCT 2018)

(a) For the purpose of paragraph (c) of the "Progress Payments" clause of this contract, if included, the requirement that the Contractor develop and deliver Provisioning Technical Documentation (PTD) is considered to be a "material requirement of this contract," and Contractor failure to make adequate progress in the development of PTD, or to deliver acceptable PTD on a timely basis, may result in reduction or suspension of Progress Payments as provided in said paragraph.

(b) The PTD is considered to be a part of the "Technical Data" specified to be delivered under this contract for the purposes of the "Technical Data--Withholding of Payment" (DFARS 252.227-7030) clause. The terms and conditions of the clause entitled "Limitation On Withholding of Payments (FAR 52.232-9), if included in this contract, shall not apply to withholding of payment for failure to make timely delivery of the PTD or delivery of deficient PTD.

(End of text)

Section C - Descriptions and Specifications

SOW

STATEMENT OF WORK

For IDIQ N00024-25-R-5200

United States Navy Integrated Combat System

MK 6 MOD X (Foundry Hardware Factory)

1.0 SCOPE

This Statement of Work (SOW) will support continuous development and deployment of U.S. Navy Surface Fleet modern compute technology (i.e., network, processing, storage, and legacy data conversion). MK 6 MOD X is a scalable, modern computing infrastructure that will be proliferated across the Fleet. The Government has established a collaborative “hardware factory” to provide a government-furnished DevSecOps (Development, Security, Operations) ecosystem. The Foundry is the U.S. Navy Surface Force computing infrastructure continuous development, integration, and manufacturing activity. The Foundry's mission is to use DevSecOps development and

Agile management principals in order to rapidly and continuously provide cutting edge technology to the surface

Navy. The Foundry seeks to eliminate the current pain points for surface Navy infrastructure programs by eliminating the impacts of Diminishing Manufacturing Sources and Material Shortages (DMSMS), rapidly responding to new requirements/fleet feedback, and by developing and establishing new methods for logistical support while delivering systems that account for the unique installation challenges of the sailor end-user. This ecosystem provides a common physical collaboration space, digital development tools, digital development and testing pipeline, and cybersecurity controls that link development, security, and testing in an automated pipeline to enable rapid delivery of capabilities to the fleet.

The computing infrastructure delivered shall enable hardware abstraction from combat system software applications enabling life cycling hardware and combat system software application independently of each other. The U.S. Navy has a requirement for a scalable process to continuously deliver updates and upgrades to the hardware and software components in the shipboard combat system enclave at a speed commensurate with technology evolution. This process will mitigate current issues with obsolescence, and new technology incompatibility, due to lifetime buys extending beyond the serviceable life of components. The Contractor shall implement a process that will allow for expansion and upgrades to system components without architecting a new solution. The SOW defines the efforts required to maintain a robust continuous production process designed to ensure seamless operations and timely delivery of high-quality products. To mitigate DMSMS, the contractor will implement proactive strategies. This is not a build-to-print (design specification) contract but rather a dynamic and adaptive production contract. Unlike traditional build-to-print contracts, which follow rigid specifications and fixed designs, this approach allows for flexibility and innovation throughout the manufacturing process. The contract will require annual technology reviews and periodic negotiations to incorporate ongoing advancements in hardware and swiftly respond to changes in technology and evolving requirements. The Contractor shall be responsible for all costs associated with the preparation, submission, and negotiations of proposals for any Delivery Orders (DO) under this contract. The

Government will not reimburse the contractor for any expenses incurred in the development of proposals including but not limited to labor, materials, travel, or any other associated costs.

This SOW outlines the tasks and responsibilities for transitioning from low-rate initial production (LRIP) to full rate production (FRP). The intent is to continue to innovate and produce a scalable production system that consistently delivers high-quality products while optimizing costs and ensuring timely deliveries. The transition to FRP is critical for achieving the strategic goals of PEO to include the expansion of rapid hardware upgrades, deliver high quality products with advanced capabilities to the fleet, ensure compliance with all relevant standards and regulations are met, and maintain operational excellence.

Efforts hereunder include program management, systems engineering, software design and integration, product support and supportability engineering, configuration management, hardware and software integration (including material procurement or fabrication, and integration of Government-Furnished Material (GFM), as applicable), testing, evaluation, installation, and training. The MK 6 MOD X system is designated to deploy across the Surface

Force ship-classes and land-based sites including but not limited to: Cruiser Guided (CG), Carrier Volplane Nuclear

(CVN), Landing Helicopter Dock (LHD), Landing Platform Dock (LPD), Destroyer (DDG), Littoral Combat Ship

(LCS), Future Guided Missile Frigate (FFG(X)), Unmanned Surface Vessel (USV), Training Sites, U.S. Coast

Guard (USCG) Cutters, and Foreign Military partners.

The Contractor shall provide compute infrastructure solutions and production labor support utilizing Agile best practices. The Contractor shall work collaboratively with Government stakeholders, organizations, and other industry partner stakeholders and shall:

Design, develop, manufacture, test, and integrate MK 6 MOD X on new construction, and In-Service modernizations. Procure spares/repair parts, technology refresh/insertion kits, pre-production/production hardware, and engineering change kits.

Deliver computing infrastructure and software functionality and solutions that can be delivered in a continuous repeatable and iterative process. To the maximum extent practicable tactical applications software shall run agnostic to the underlying compute infrastructure and operate independently of the specific hardware or cloud environment it is deployed on without requiring modification or adaption.

Deviation to software running agnostic to the underlying infrastructure shall be on a case-by-case basis at the direction of the Government.

Build in cyber and system security for hardware and software at the beginning of the system design phase, and support certifications, safety tests, and authorizations. Include cybersecurity considerations in system design and engineering and correctly implement cybersecurity measures and design characteristics in the

MK 6 MOD X system, in accordance with PEOIWS INST 5239.1A, DoD Zero Trust Strategy, and NIST

800-160. Provide support to the Government for all tasks required to achieve cybersecurity certifications and support obtaining Authority to Operate (ATO) for all installed systems; to include implementing and proving compliance with NIST 800-53 Controls.

Provide system engineering design, development, integration, testing, environmental qualification, and life cycle support for the MK 6 MOD X compute infrastructure products and infrastructure software solutions.

Support the sustainment and maintenance of deployed systems, and proactively resolve all production and fleet issues, including observed failures and feedback from shore facilities and shipboard issues that impact overall supportability. This FRP contract will provide original equipment manufacturer (OEM) reach back to U.S. Navy, thereby eliminating the need for sustainment contracts.

Develop, maintain, and support a Configuration Management (CM) process for the Government approved

“hardware factory” (defined below) catalog of computing infrastructure products and software solutions.

Provide CM of all delivered products to include the configuration of each product.

Propose and transition new technologies and capabilities to production and integrate into the MK 6 MOD X design.

Deliver to the Government directed system (e.g., NSERC) all engineering documentation, product lists, logistics support products, curriculum, support materials, spares, and INCO (installation and checkout) as necessary to provide the “as developed” product support, including contractor provided training for each platform variant. This shall include source data which at a minimum shall include the data required for the installation, supportability, reliability, and maintainability for Government approved products and deployed systems. Source data is referenced in Section 4.7.1 Technical Data and Computer Software Data.

1.1. U.S. Navy Organization

Program Executive Office (PEO) Integrated Warfare Systems (IWS) is responsible for the delivery of the Integrated

Combat System (ICS) and its underlying infrastructure across the Surface Force portfolio.

1.2. Program Background

The ICS is the next step in the evolution of the Surface Force’s Combat System. The Navy will evolve AEGIS, SSDS, FMS into a Surface Combat System of Systems (CSoS) that integrates sensors, command and control nodes, weapons, and communication systems across the Naval Force to achieve decision superiority at machine speeds.

2.0. APPLICABLE DOCUMENTS

The Contractor shall use the following specifications, standard, handbooks, and reference documents if called out in any of the paragraphs. If a conflict exists between the stated and referenced requirements, the order of precedence shall be in accordance with FAR Clause 52.215-8. These documents may be updated periodically; therefore, the contractor shall comply with the latest versions unless instructed otherwise by the Government. In the case of conflicting requirements or guidance of the applicable documents, the contractor shall present the conflict to the

Contracting Officer Representative (COR) for resolution/guidance.

2.1. Incorporation by Reference

All specifications, exhibits, drawings, or other documents which are referenced in this contract, but are not attached hereto, are hereby incorporated by reference.

2.2. Issue of Documents

The following documents listed in the Department of Defense Index of Specification and Standards (DODISS) form a part of this SOW to the extent specified herein.

2.3. Government Documents

Military Standards

Document Number Document Title

MIL-STD-167-1A Mechanical Vibrations of Shipboard Equipment (Type I-Environmental and

Type II-Internally Excited)

MIL-STD-461G Department of Defense Interface Standard- Requirements for the Control of

Electromagnetic Interference Characteristics of Subsystems and Equipment

MIL-STD-810 H-1 Environmental Engineering Considerations and Laboratory Tests

MIL-DTL-901E Shock Tests, H.I. (High Impact) Shipboard Machinery, Equipment, and

Systems, Requirements for

MIL-STD-1310H Shipboard Bonding, Grounding, and other Techniques for Electromagnetic

Compatibility, Electromagnetic Pulse (EMP) Mitigation, and Safety

MIL-STD-1399C Interface Standard for Shipboard Systems

MIL-STD-1472H Department of Defense Design Criteria Standard - Human Engineering

MIL-STD-882E-1 System Safety Policy

MIL-STD-46855A Human Engineering Requirements for Military Systems, Equipment, and

Facilities

MIL-STD-740-1 Military Standard: Airborne Sound Measurements and Acceptance Criteria of

Shipboard Equipment

MIL-STD-740-1 Military Standard: Structure-Borne Vibratory Acceleration Measurements and

Acceptance Criteria of Shipboard Equipment

MIL-STD-1474E-1 Department Of Defense Design Criteria Standard: Noise Limits

MIL-STD-1686 C Military Standard: Electrostatic Discharge Control Program for Protection of

Electrical and Electronic Parts, Assemblies And Equipment (Excluding

Electrically Initiated Explosive Devices

MIL-STD-464 D Department Of Defense Interface Standard: Electromagnetic Environmental

Effects, Requirements for Systems

Department of Defense (DoD)/Department of the Navy (DoN) Regulations, Directives and Instructions

DoDI 4140.01 DoD Supply Chain Materiel Management Policy

DoDM 4140.01, Vol 1 through Vol

DoD Supply Chain Materiel Management Procedures

DoDM 4140.27-M Vol 1 DoD Shelf-Life Management Program

DoDM 4140.65 Issue, Use, and Disposal of Wood Packaging Material

DoD 4145.15 Diminishing Manufacturing Sources and Material Shortages Management

DoD 4145.19-R-1 Storage and Materials Handling

DoDI 5000.02 Operation of the Adaptive Acquisition Framework

DoDD 5000.01 CH1 The Defense Acquisition System

DoDM 5000.04 Cost and Software Data Reporting (CSDR) Manual

DoDI 5000.61 DoD Modeling and Simulation (M&S) Verification, Validation, and

Accreditation (VV&A)

DoDI 5000.73 COST ANALYSIS GUIDANCE AND PROCEDURES

DoDI 5200.44 Change 1 Protection of Mission Critical Functions to Achieve Trusted Systems and

Networks (TSN)

DoDD 5200.47E Anti-Tamper (AT)

DoDI 5200.48 Controlled Unclassified Information (CUI)

DoDI 5230.24 Distribution Statements on Technical Documents

DoDD 5230.25 Change 2 Withholding of Unclassified Technical Data from Public Disclosure

DoDI 8320.02 Sharing Data, Information, and Information Technology (IT) Services in the

Department of Defense

DoDD 8500.01E Cybersecurity

DoDI 8510.01 Risk Management Framework (RMF) for DoD IT

DoDI 8520.02 Public Key Infrastructure (PKI) and Public Key (PK) Enabling

DoD 8570.01-M Change 4 Information Assurance Workforce Improvement Program

DoD 5220.22M Defense Security Service (DSS) National Industrial Security Program

Operating manual (NISPOM)

28 February 2006

DoDI 5200.39

Critical Program Information (CPI) Protection within the Department of

Defense

16 July 2008

(DoDI) 4140.67 Department of Defense Counterfeit Prevention Policy

26 April 2013

(DoDI) 4160.21-M Defense Materiel Disposition Manual

August 1997

(DoDI) 4160.28 Department of Defense Demilitarization (DEMIL)

Program

07 April 2011

(DoDI) 8500.1 DoD Cyber Exchange

14 March 2014

DoDI 8582.01 Security of Non-DoD Information Systems Processing Unclassified

Nonpublic DoD Information

DoN CIO MEMO 02-10 Department of the Navy Chief Information Officer Memorandum, Information

Assurance Policy Update for Platform Information Technology

DoD IPPD Handbook DoD Integrated Product and Process Development Handbook

ASN (RDA) MEMO DoN Policy on Digital Product/Technical Data w/Attachment "Guidance on

Acquisition and Conversion of Product / Technical Data to Digital Form"

Revision 1

ASN (RDA) MEMO Software Process Improvement Initiative Contract Language

ASN (RDA) MEMO Software Process Improvement Initiative (SPII) Guidance for Use of Software

Process Improvement Initiative Contract Language

ASN(RDA) MEMO Supplement to Guidebook for Acquisition of Naval Software Intensive

Systems – “Software Criteria and Guidance for Systems Engineering

Technical Reviews (SETR)”

DOT&E MEMO Procedures for Operational Test and Evaluation of Cybersecurity in

Acquisition Programs

DFARS Defense Federal Acquisition Regulations (DFARS)

252.211-7000

DFARS Defense Federal Acquisition Regulations (DFARS)

252.245-7003 Contractor Property Management

System Administration June 16, 2024

Chairman of the Joint Chiefs of Staff (CJCS), Joint Requirements Oversight Committee (JROC) Instructions and Memoranda

Document Number Document Title

CJCSI 3170.01I Joint Capabilities Integration and Development System (JCIDS)

CJCSI 6212.01F Net Ready Key Performance Parameter (NR KPP)

CJCSI 6510.01F (Series) Information Assurance (IA) and Support to Computer Network Defense

(CND)

JROCM 236-03 Joint Requirements Oversight Committee Memorandum, Policy for Updating

Capabilities Documents to Incorporate the Net-Ready Key Performance

Parameter (NR-KPP)

Secretary of the Navy (SECNAV) and Office of the Chief of Naval Operations (OPNAV) Instructions

NAVSO P-7000

Department of Navy (DON) Counterfeit Material Process Guidebook

SECNAV 5200.46 DEPARTMENT OF THE NAVY MODELING, SIMULATION,

VERIFICATION, VALIDATION, AND ACCREDITATION

MANAGEMENT

OPNAVINST 1500.76D NAVAL TRAINING SYSTEM REQUIREMENTS, ACQUISITION, and

MANAGEMENT

OPNAVINST 5100.23 CH3 NAVY SAFETY AND OCCUPATIONAL HEALTH MANUAL

SECNAVINST 5510.34B DISCLOSURE OF CLASSIFIED MILITARY INFORMATION and

CONTROLLED UNCLASSIFIED INFORMATION to FOREIGN

GOVERNMENTS, INTERNATIONAL ORGANIZATIONS, and FOREIGN

REPRESENTATIVES

SECNAV M-5239.3 Cybersecurity Manual

SECNAV M-5239.2 Cyberspace Information Technology and Cybersecurity Workforce

Management and Qualification Manual

SECNAVINST 5239.3C Department of the Navy Cybersecurity

SECNAVINST 5239.22 Department of the Navy Cybersecurity Safety Program

SECNAVINST 5510.36B Department of the Navy Information Security Program

OPNAVINST 3000.12B Operational Availability of Equipment and Weapons System

OPNAVINST 4030.1B Packaging of Navy Material

Naval Sea Systems Command (NAVSEA) and Program Executive Office Integrated Warfare Systems (PEO

IWS) Regulations, Directives and Instructions

Document Number Document Title

ICS-TLR-0002-R5 Future Surface Navy's Integrated Combat System (ICS) Top-Level

Requirements (TLR) Document for Surface Ships

PEOIWSINST 5232.1 PEO IWS CONTINUOUS MONITORING REQUIREMENTS

PEOIWSINST 5239.1A PEO IWS Surface Navy Combat System Cybersecurity Memo With Encls: (1) PEO IWS Enclave Cybersecurity Requirements Version 1.0;

and (2) Acronyms

PEOIWSINST 5000.8 MEMO PEO IWS RISK MANAGEMENT POLICY MEMO

With (Enclosure 1: Instructions for Risk Reporting)

NAVSEAINST 5000.8 Naval SYSCOM Risk Management Policy

PEOIWSINST 3086.01 Automated Test and Analysis (ATA) Policy

PEOIWSINST 4130.1C Integrated Warfare Systems (IWS) Enterprise Configuration Control Process

(ECCP)

NAVSEAINST S9040: (AA-GTP-

010/SSCR, Revision 9

Shipboard Systems Certification Requirements for Surface Ship

NAVSEAINST S9095 AD-TRQ-

010/TSTP

Total Ship Test Program Manual

NAVSEAINST 4160.3B Technical Manual Management Program (TMMP)

S0005-AA-PRO-010 NAVSEA Technical Manual Management Program

Commander, Naval Sea Systems

Command, Ser 04L/002, dtd 17

Feb 2010

Use of S1000D Specification for Technical Manual Development and

Management

S0005-AA-GYD-070 Quality Assurance for NAVSEA TMs

NAVSEAINST 5230.12 Release of Information to the Public

SL720-AA-MAN-030 Navy Modernization Process Management and Operations Manual

SECNAV M-5210.1 Department of the Navy Records Management Program Records Management

Manual

Executive Order 13467 Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified

National Security Information

NSWCPHD INSTRUCTION

5239.4 Cyberspace Information Technology And Cybersecurity Workforce

Qualification Program

N/A Surface Navy Combat Systems Development Strategy Acquisition

Management Plan (AMP) Version 0.8

NAVSEAINST 8020.6E Department of the Navy Weapon System Explosives Safety Review Board

(WSESRB)

PEOIWSINST 4730.1B(Memo) Combat System Certification Policy

PEOIWSINST 4730.1B(Encl 1) Combat System Certification Process

PEOIWSINST 4732.1A Element Certification Policy Memo and Element Certification Process document

NAVSEAINST 9410.2 B Naval Warfare System Certification Policy

NAVSEAINST 9400.2A NAVSEA Platform Information Technology-Control Systems Cybersecurity

Governance and Guidance

NAVSEAINST 9400.2-M PIT-Control System Cybersecurity Implementation Manual – Version 5.0

9470-002-A-X-C PEO IWS Enterprise Configuration Control Process User Guide (this is Encl 2 PEO IWS INST 4130.1C)

NAVSEA Std 03-01 Common Presentation Layer Specification

PEOIWSINST 5200.3 Verification, Validation and Accreditation (VV&A) of Modeling and

Simulation (M&S)

NAVSEAINST 9093.6 COMBAT SYSTEM STRESS AND ENDURANCE TEST

REQUIREMENTS FOR SURFACE PROGRAMS

Military Handbooks and DoD Guidance

MIL-HDBK-61B Configuration Management Guidance

MIL-HDBK-502A Product Support Analysis

MIL-HDBK-539 Digital Engineering and Modeling Practices

MIL-STD-129 R(3) Military Marking for Shipment Storage

MIL-STD-130N(1) Identification marking U.S. Military

MIL-STD-881F Work Breakdown Structures For Defense Materiel Items

MIL-STD -1367 A Packaging, Handling, Storage and Transportation (PHS&T)

MIL-STD-1366 E Transportability Criteria

MIL-STD-2073-1 E(4) Standard Practice for Military Packaging

MIL-STD-31000B Technical Data Packages

MIL-STD-147 E(2) Palletized Unit Loads

MIL-STD-648 F Specialized Shipping Containers

DoDAF v2.0.2 Chg 1 - Vols. I, II, and III DoD Architecture Framework: Volumes I, II, and III

N/A Naval Open Architecture Contract Guide Book for Program Managers Version

2.0

N/A Joint Software Systems Safety Handbook, 2010

N/A Department of Defense Risk, Issue, and Opportunity (RIO) Management

Guide for Defense Acquisition Programs

N/A Department of Defense Guide to Uniquely Identifying Items

SD-22 Defense Standardization Program Office Standardization-Related Document

22, “Diminishing Manufacturing Sources and Material Shortages (DMSMS):

A Guidebook of Best Practices for Implementing a Robust DMSMS

Management Program”

NAVSUP 572 Joint Storage Manual

NAVSUPINST 4030.28D Packaging of Material

SPAWAR Memorandum Ser

5.0/1274 Qualification Standards and Registration Procedures for Navy Validators

PEO IWS/NAVSEA Manuals, Plans and Specifications

Document Type Document Title

Technical Manual Program Executive Officer, Integrated Warfare Systems Naval Systems

Engineering Directorate Integrated Warfare Systems Engineering Technical

Review Manual Version 3.0

NAVSEA Standard 03-01 Common Presentation Layer Specification - A Style Guide and Requirement

Specification for NAVSEA and Associated PEOs Human Computer

Interfaces

Availability of Documents Most unclassified Defense specifications and standards may be downloaded from the following ASSIST websites:

(1) ASSIST (https://assist.dla.mil/online/start/);

(2) Quick Search (http://quicksearch.dla.mil/);

Other document sources are as follows:

(1) DoD issuances https://www.esd.whs.mil/dd/dod-issuances/

(2) DoN issuances https://www.secnav.navy.mil/doni/default.aspx

(3) PEO IWS documents (Contact Agreement Officer Representative (AOR))

(4) Copies of non-Government publications not listed in the DoDISS may be obtained from the respective industry association.

2.4 Non-Government Documents

ASQC-Q9001-2008 Quality Systems - Model for Quality Assurance In-Depth, Development, Production, Installation, and Servicing

ANSI EIA-649-B National Consensus Standard for Configuration Management

ANSI EIA-649-1 Configuration Management Requirements for Defense Contracts

ANSI EIA-632 Processes for Engineering a System

IEEE 828-2012 Standard for Configuration Management in Systems and Software

Engineering

IEEE 1012a-2012 Standard for Software Verification and Validation

IEEE/ISO/IEC 16326-2009 Systems and Software Engineering--Life Cycle Processes--Project

Management

IEEE 1220-2005 Application and Management of The Systems Engineering Process, Standard for

IEEE/ISO/IEC 12207-2008 Systems and Software Engineering – Software Life Cycle Processes

ISO 9000:2015 Quality Management Systems - Fundamentals and Vocabulary

ISO 9001:2015 Quality Management Systems – Requirements

ISO 9004:2009 Managing for the sustained success of an organization - A quality management approach

ISO 10007:2003 Quality Management - Guidelines for Configuration Management

ISO 10013:2001 Guidelines for Quality Management System Documentation

ISO 10015:1999 Quality Management - Guidelines for Training

NIST Publication 500-220 National Institute of Standards and Technology; Special Guide on Open

System Environment (OSE) Procurements

NIST Special Publication 800-53

Revision 5 Security and Privacy Controls for Federal Information Systems and

Organizations

NIST Interagency Report 7622

(NISTIR 7622)

Notional Supply Chain Risk Management for Federal Information Systems

NIST SP 800-171 National Institute of Standards and Technology Special Publication Protecting

Controlled Unclassified Information in Nonfederal Systems and Organizations

NIST SP 800-60 Guide for Mapping Types of Information and Information Systems to Security

Categories

National Defense Industrial

Association System Assurance

Committee Guidebook - Version

1.0

Engineering for System Assurance

3.0 GENERAL PROGRAM REQUIREMENTS (applicable to all CLINs)

Unless stated otherwise, the work required by section 3.0 of the SOW is applicable to all requirements under this contract. Program information, deliveries, and data shall be handled in accordance with the Contract Security

Specification, (DD Form 254).

3.1 Security Clearance Requirements

This is DoD work effort involving access to and the safeguarding of classified information and/or material. The security policies, procedures and requirements stipulated in the National Industrial Security Program (NISP), National Industrial Security Program Operating Manual (NISPOM) and any supplements thereto are applicable, including applicable FAR and DFARS clauses. The Contractor shall also comply with DoD Manual 5200.1, Volume 1 through 3, Security Executive Agency Directive (SEAD) 3 reporting requirements, DoD Manual 5200.1

Information Security Program Volume 1 through 3, DoD 5200.48 Controlled Unclassified Information (CUI), and

Defense Counterintelligence & Security Agency (DCSA) Assessment and Authorization Process Manual

(DAAPM), Navy security regulations and guidance, and other security requirements as described below. All classified material shall be processed and protected in accordance with the terms and conditions of this contract and the attached DD Form 254.

3.2 Security Level

The Contractor shall possess and maintain a Defense Security Service SECRET facility clearance eligibility at the time of award in accordance with the National Industrial Security Program Operating Manual (NISPOM), 32 Code of Federal Regulation (CFR) Part 117, see DD Form 254 Items 1a and 1b (Attachment). The Contractor (and any subcontractors performing classified work) SHALL NOT BE:

Under foreign ownership or control unless the Contractor is operating under a special security agreement

(SSA) pursuant to the NISP and is a National Technology and Industrial Base (NTIB) covered entity with an "ultimate parent" located in a country that is part of the NTIB, defined by Title 10, U.S. Code, Chapter

381, Section 4801, as Canada, Australia, or the United Kingdom.

Restricted in access to Compartmented Information, Cryptographic Materials or Systems, Restricted Data, or Formerly Restricted Data.

The contract requires SECRET personnel clearances with access limited to another Contractor’s facility or a government activity. See DD Form 254 Item 8 and 11a.

The Contractor’s Security Officer shall (1) be responsible for all security aspects of the work performed under this procurement, (2) assure compliance with all DoD and Service regulations regarding security and (3) assure compliance with any written instructions from the Security Officers of each Government facility.

Any records and data or information the Contractor may have access to may be highly sensitive and confidential.

The contractor shall not divulge any information about files, data processing activities or functions, user IDs or passwords or any other knowledge that may be gained to anyone not authorized to have access to such information.

It is the Contractor’s responsibility to ensure that all required employees have proper authority. The Contractor shall protect critical information associated with this contract to prevent unauthorized disclosure and shall observe

OPSEC requirements. See DD Form 254 Item 11j.

3.3. Communication Security (COMSEC)

SIPRNET and classified equipment will be housed at a government or vendor site and provided to the Contractor.

See DD Form 254 Item 8.

3.4. Controlled Unclassified Information (CUI)

The contractor shall be required to have access to CUI with developers and integrators, see DD Form 254 Item 11l.

Security classification guides (OPNAVINST 5513 series) and controlled unclassified information (e.g., FOUO, distribution statement controlled) are not authorized for public release; therefore, they cannot be posted on a publicly accessible webserver or transmitted over the internet unless appropriately encrypted. Request for public release cannot be transmitted via the internet until the contractor receives final approval from the COR. CUI transmission shall be in accordance with DoD Manual 5200.01 Information Security Program Volume 1 through 3 and DoD

5200.48 Controlled Unclassified Information (CUI).

3.5. Facility

The contractor shall have the ability to receive, log, track, and store unclassified documents, in accordance with applicable regulations (e.g., NISPOM). The contractor shall have Controlled access to a Government site and personnel security mechanisms in place (e.g., facility has swipe access to control access to the area). The contractor shall require access to CUI for software development and interfacing with system engineering, software integration, and testing entities.

All facility security requirements shall be met at time of award and maintained thereafter. In general, all necessary facility clearances shall be at the expense of the contractor. The contractor shall comply with all security requirements.

The contractor shall require access to NATO information to support U.S, surface combatant support of NATO operations. The contractors’ development of new or augmenting existing technology must be compatible relevant to

NATO operations. See DD Form 254 Item 10g.

3.6. Personnel

The contractor shall ensure all personnel accessing classified information or material associated with and/or performing work relative to the resultant procurement shall be United States citizens. All contractor and subcontractor personnel shall possess and maintain a final clearance at the appropriate level for accessing classified materials. If any contracted personnel are unable to obtain a SECRET clearance within 30 calendar days of contract award, the contractor shall:

1. Notify the Government.

2. Terminate billing for the employee against the contract.

Furthermore, if any contracted personnel employed by the contractor fail to maintain the required security clearance or access, the contractor shall:

3. Notify the Government of this discrepancy.

4. Terminate billing for the employee against the contract effective the date of loss of clearance.

All contractor personnel and subcontractors requiring access to both a Government facility and a DoD enabled network shall obtain a government issued Common Access Card (CAC). The contractor shall work with the COR to submit the appropriate justification and coordinate the paperwork for obtaining a CAC. The approval of a CAC is at the discretion of the COR. If the COR determines that the Contractor is not approved to receive a CAC, the COR may authorize the procurement of a RAPIDGate pass to obtain access to the Government facility. All other contractor and subcontractor personnel requiring occasional access to a Government facility shall submit a visit request via the Joint Personnel Adjudication System (JPAS) and check in through the facilities’ visitor control center. The contractor has five (5) business days to return all Government issued identification badges to the COR upon Period of Performance (PoP) completion. In general, all necessary employee security clearances shall be at the expense of the contractor. The contractor shall comply with all security requirements Cybersecurity Compliance to

NIST 800-171.

The contractor shall implement the security requirements of DFARS 252.204-7012, Safeguarding Covered Defense

Information and Cyber Incident Reporting, and National Institute of Standards and Technology (NIST) Special

Publication 800-171 in addition to the following supplemental requirements. The contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST

Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST

800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

The contractor shall encrypt all data at rest as defined in NIST Special Publication 800-53 Security Controls SC-13 and SC-28(1). The contractor shall allow the NCIS to install network sensors, owned and maintained by NCIS, on the contractor’s information systems or information technology assets when Government Intelligence indicates a vulnerability or a potential vulnerability. The contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of DON critical programs and technologies.

The contractor shall implement the cyber incident reporting requirements in accordance with DFARS 252.204-7012

The contractor shall also formally notify the Government in writing of every cybersecurity incident including external intrusions detected on their corporate and developmental systems (Accident Incident Report (Cyber

Security Incident Notification) [A001]). If Navy data or information may have been compromised, the contractor shall provide details of each incident, and an enumeration of the Navy information potentially compromised. The contractor shall ensure the integrity of systems where the to-be-delivered software is kept and utilized. The contractor shall assist the Government in any investigation and take any remediation steps necessary to prevent future incidents. The contractor shall provide for the protection of CUI and/or Classified information in accordance with the standards set forth in DoD security policies.

Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

1. Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

2. Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

3. Implement Control 3.1.12 (monitoring and control remote access sessions) – Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

4. Audit user privileges on at least an annual basis;

5. Implement: Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

6. Implement Control 3 .13 .16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

7. Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

Deliverable Data Item:

A001, Accident Incident Report (Cyber Security Incident Notification)

3.7 System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews

The contractor shall deliver and implement a SSP that implements the security requirements in DFARS Clause

252.204-7012, 252.204-7019, 252.204-7020, 252.204-7021. SSP and its related POAM shall be delivered in accordance with the SSP and POAM, DI-MGMT-82247 (Contractor’s Systems Security Plan and Associated Plans of Action to Implement NISP SP 800-171 on a Contractor’s Internal Unclassified Information System [A002]).

Within thirty (30) days of award, the contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available and provide for review by the Government at the contractor's facility. The

SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this agreement. The contractor shall fully cooperate in the Government's review of the SSPs at the contractor’s facility.

If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause

252.204-7012 then the Government shall notify the contractor of each identified deficiency. The contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The contractor shall immediately notify the agreements officer of any failure or anticipated failure to meet a milestone in such a POAM.

Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the contractor's facilities. The Government may continue to conduct follow-on reviews until the Government determines that the contractor has corrected all identified deficiencies in the SSP(s).

The Government may, in its sole discretion, conduct subsequent reviews at the contractor's site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of award) and may conduct such reviews at any time upon thirty (30) days' notice to the contractor.

Deliverable Data Item:

A002, Contractor’s Systems Security Plan and Associated Plans of Action to Implement NISP SP 800-171 on a Contractor’s Internal Unclassified Information System

3.8 Program Management (Applicable to all CLINs)

The Contractor shall designate a Program Manager who shall have responsibility for all aspects of this contract and the authority to commit the Contractor to specific courses of action. The Contractor shall perform all administrative, technical, and financial management functions required to support this effort and shall maintain the status, including all technical activities, problems or deficiencies, and recommended solutions. The Contractor shall be responsible for those activities assigned to subcontractors, to ensure the delivery of all supplies and services specified in this contract. The deliverable for this work shall be the Contractor's Progress and Status Report [A003].

A003, Contractor's Progress and Status Report

3.8.1 Cost and Software Data Report (CSDR)

The Contractor shall use management procedures in accordance with DoDI 5000.73 that provide for generation of timely and reliable information for the Cost and Software Data Report (CSDR) data items of this agreement referenced in Attachment 9 and shall:

a. Use a documented standard CSDR process that satisfies the guidelines contained in the DoD 5000.04, CSDR Manual.

b. Provide access to all pertinent records, data, and plans as requested by representatives of the Government for the purpose of permitting Government surveillance and review of reporting compliance;

c. Use the Government-approved CSDR Plan, DD Form 2794, and the related Resource Distribution Table

(RDT) as the baseline for reporting provided as Attachment 9 and 10;

d. Prepare and deliver to the Government a Cost and Hour Report (FlexFile) for every indicated data element Functional Cost-Hour Report (Cost and Software Data Report (CSDR)) Report [A004] within the Government-approved CSDR Plan;

e. Provide a Work Breakdown Structure (WBS) Dictionary and Remarks as a part of the FlexFile format

Functional Cost-Hour Report (Cost and Software Data Report (CSDR)) Report [A004] for every data element identified within the approved Contract CSDR Plan;

f. Prepare and deliver to the Government a Quantity Data Report for every indicated data element Quantity

Data Report [A005] within the Government-approved Contract CSDR Plan;

g. Prepare and deliver to the Government Technical Data Report [A006];

h. Prepare and deliver to the Government Contractor Business Data Report DD Form 1921-3 Report

[A007];

i. Provide updates to the Government-approved CSDR Plan and related RDT for Government approval.

Updates include aligning reporting subcontractor effort to a single WBS element and updating the RDT as new Subcontracts are awarded;

j. Hold a post award meeting after contract award to include a discussion of the Contractor’s standard cost and software data reporting process that satisfies the guidelines contained in the DoD 5000.04 (CSDR

Manual) and the requirements in the Government-approved CSDR Plan and related RDT;

k. Identify each subcontractor at each tier for CSDR requirements apply to all Subcontracts valued over $50 million and any Subcontracts valued between $20 million and $50 million that are designated by the Cost

Working Integrated Product Team (CWIPT) as high risk, high value, high technical interest or a middle-tier acquisition (804);

l. Notify the Government of any subcontractor changes or new subcontracts awarded for subcontracts that exceeds $50 million;

m. Flow-down DD Form 1921-3 to…