Attachment 1 - CSRR_CandM_SOW__18Dec2017.pdf

Common Submarine Radio Room (CSRR) Control and Management (C&M) Statement of Work (SOW)

STATEMENT OF WORK (SOW)

FOR

COMMON SUBMARINE RADIO ROOM (CSRR)

CONTROL AND MANAGEMENT (C&M)

18 DECEMBER 2017

PROGRAM EXECUTIVE OFFICE COMMAND, CONTROL,

COMMUNICATIONS, COMPUTERS AND INTELLIGENCE (PEO C4I),

UNDERSEA INTEGRATION PROGRAM OFFICE (PMW 770)

DISTRIBUTION STATEMENT A:

Approved for public release, distribution is unlimited (6 FEBRUARY 2017).

Record of changes Version Date Changed by Description of Change

Table of Contents

1.0 SCOPE

2.0 REQUIREMENTS

2.1 PROGRAM AND DATA MANAGEMENT

2.1.1 Program Management

2.1.1.1 Contractor Integrated Performance Management

2.1.1.2 Integrated Subcontract Management and Reporting

2.1.1.3 Integrated Baseline Review (IBR)

2.1.1.4 Over Target Baseline (OTB)/Over Target Schedule (OTS)/Restructure . 8

2.1.1.5 Integrated Master Schedule (IMS)(IPMR Format 6)

2.1.1.6 Schedule Analysis/Schedule Risk Assessment (SRA)

2.1.1.7 Contract Work Breakdown Structure (CWBS)

2.1.1.8 Contract Fund Status Report (CFSR)

2.1.1.9 Manpower Reporting

2.1.1.10 Program Management Reviews (PMRs)

2.1.2 Design Reviews

2.1.2.1 Software Design Reviews

2.1.2.2 Software Requirements Review

2.1.2.3 Preliminary Design Review (PDR)

2.1.2.4 Critical Design Review (CDR)

2.1.2.5 Test Readiness Review (TRRs)

2.1.3 Automated Interchange of Technical Information Management

2.2 STUDIES AND ANALYSIS

2.3 GOVERNMENT PROPERTY

2.3.1 Government Furnished Property

2.3.2 Contractor Acquired Property

2.3.3 Item Unique Identification (IUID)

2.4 CONFIGURATION MANAGEMENT PROGRAM

2.4.1 Configuration Control

2.5 SOFTWARE ENGINEERING

2.5.1 Technical Approach

2.5.1.1 Software Engineering Approach

2.5.2 Software Integrated Process Teams

2.5.3 Software Development

2.5.3.1 PR Analysis

2.5.3.2 PR Resolution

2.5.3.3 New Development and Upgrades

2.5.3.4 Software Builds

2.5.3.5 Engineering Drops

2.5.3.6 Information Assurance Vulnerability Alert (IAVA) Updates and Patches

2.5.4 Software Documentation

2.5.5 Software Testing

2.5.5.1 Acceptance Testing in the Contractors Lab

2.5.5.2 Acceptance Testing at Government Facility

2.5.6 Software Interface

2.5.7 Software Quality Assurance

2.5.8 Software Configuration Management

2.6 ENGINEERING SUPPORT

2.6.1 Engineering Support

2.6.2 Field Engineering Support

2.7 SECURITY PROGRAM IMPLEMENTATION

3.0 APPLICABLE DOCUMENTS

3.1 CSRR DOCUMENTS

3.2 SECURITY DOCUMENTS

3.3 OTHER DOCUMENTS

1.0 SCOPE

This Statement of Work (SOW) sets forth the contractor’s requirements to act as the interim software design agent for the existing Common Submarine Radio Room (CSRR) Control and Management (C&M) software; perform development, integration and test of enhancements; correct deficiencies; control the C&M software requirements and configuration baseline; prepare engineering drops; and prepare and test of formal software builds for the existing C&M software currently installed as part of the CSRR and upcoming other platforms (i.e. surface ships). This common approach reduces the overall implementation, operational, system and hardware maintenance, training, and logistic costs to the Government.

All work to be performed under this SOW will be defined and implemented via the issuance of Technical Direction Letters (TDLs) that will specify the type of effort, the level of effort, data requirements, funding authorization, and the period of performance.

Any work done shall not be done in such a manner that performance of the existing system no longer conforms to its applicable performance specification.

2.0 REQUIREMENTS

The TDLs issued under this contract will require the contractor to control the software requirements database, control the CSRR C&M software baseline, provide platform-specific C&M software configurations, provide and prepare C&M software documentation, and implement software enhancements. The contractor shall assess the impacts of potential design changes to the CSRR C&M functional baselines and execute the changes. This tasking will help to ensure and enhance the quality of the C&M software product and will support the needs of the existing platforms as they evolve and other platforms (i.e. surface ships) in the future.

2.1 PROGRAM AND DATA MANAGEMENT

2.1.1 Program Management

The Contractor shall provide program management to ensure all work conducted under the contract is planned and executed in a manner that that will achieve all management, technical, logistics, cost, and schedule objectives. The Contractor shall manage and execute the program using an Integrated Product Team (IPT) structure with the Government participating in the IPTs.

The Contractor shall maintain management insight into all aspects of the CSRR program and ensure the Government management team has insight into all program activities. The Contractor shall document progress of work in a Contractor's progress, status and management report. This report shall include status of the program, and information of potential problem areas and all options exercised on this contract.

Reference:

CDRL A005 - Contractor’s Progress Status and Management Report

2.1.1.1 Contractor Integrated Performance Management

The Contractor shall establish, maintain, and use in the performance of this contract, an integrated performance management system. Central to this integrated system shall be the use of an Earned Value Management System (EVMS) compliant with EIA-748-B requirements, DFARS Clause 252.234-7002 Earned Value Management System (DEVIATION)(Sep 2015), and the Contractor’s own documented Earned Value Management System Description or Earned Value Management Plan. The Contractor shall report integrated Program Management performance information/data as applicable to this contract in accordance with the requirements stated herein and in applicable/associated CDRLS. The EVMS shall be linked to and supported by the Contractor’s existing internal performance management systems and processes used to plan, schedule, status, direct, budget, monitor, manage, and report cost, schedule, and technical progress applicable to the contract. Formal risk management should also be an integral part of the Contractor’s integrated performance management system and the formats contained in the Integrated Program Management Report (IPMR) CDRL deliverable. The correlation and integration of these internal systems and processes shall provide for early indication of cost and schedule problems, and their relation to technical achievement. Outputs of the integrated performance management system shall be used as the single basis for timely, reliable, and auditable reporting of performance information in CDRLs, Program Management Reviews (PMRs) and other status meetings.

Reference:

DFARS 252.234-7001 - Notice of Earned Value Management System DFARS 252.234-7002 - Earned Value Management System (DEVIATION) (SEP 2015) CDRL A002 - Integrated Program Management Report (DI-MGMT-81861)

2.1.1.2 Integrated Subcontract Management and Reporting

The Contractor shall flow down the requirements of DFARS clauses 252.234-7001 and 252.234-7002, and the Integrated Program Management Report (IPMR) (DI-MGMT- 81861), to subcontractors meeting the applicable thresholds (e.g. exceeding $20 million in then-year dollars). EVMS flow down to subcontractor cost or incentive contracts of less than $20 million in then-year dollars, or to Firm Fixed Price subcontracts is a risk-based decision to be mutually agreed on between the prime Contractor and the Government. Any subcontractor with a contractual flow down requirement for EVM should also be included in the Integrated Baseline Review (IBR) process. A separate IBR may be conducted at the subcontractor’s facility, in which case the prime Contractor shall take the lead in conducting the IBR, with active Government participation.

Alternatively, the subcontractor may participate as part of the prime contract IBR. On subcontracts where EVM and IMS requirements are not flowed down, subcontracted scope and performance information shall be incorporated/integrated into and reported via the Contractor's integrated performance management system. All subcontractors with EVMS requirements shall participate in the Joint Surveillance Plan process. It may also be necessary to conduct IBRs with subcontractors who do not meet the dollar value threshold based on the risk inherent in their work, criticality of their performance to the total program, or percent of the total work share. Exceptions will be mutually agreed upon by the Contractor and the Government.

Reference:

CDRL A002 - Integrated Program Management Report (DI-MGMT-81861)

2.1.1.3 Integrated Baseline Review (IBR)

The Contractor shall engage jointly with the Government’s program manager and technical staff in conducting Integrated Baseline Reviews (IBRs) focused on evaluating the realism and inherent risks in the Contractor's integrated Performance Measurement Baseline (PMB) plan. The Contractor shall present the contents and underlying/ supporting assumptions of its initial PMB for the first TDL to Government representatives via an IBR to be held at the Contractor’s facilities. The initial IBR shall be conducted as soon as feasible after the first TDL is awarded and the associated PMB is fully established and documented but not later than 180 days after contract award.

Subsequent IBRs will be conducted, as needed, throughout the life of the contract following initiation of TDLs, undefinitized contract actions, contract modifications, major milestone events, major changes to the baseline, or re-planning. The scope of the IBRs will be tailored to the nature of the work content and/or dollar value issued with each TDL, and the IBR will be conducted within a reasonable time after the issuance of the TDL. Each IBR will verify that the Contractor has established and is maintaining a reliable PMB that includes the entire contract scope of work; is consistent with contract cost targets and schedule requirements; has adequate resources assigned; and uses effective Earned Value (EV) techniques/methods to accurately reflect technical achievement/progress. Each IBR will also record any indications that effective EVM is not being used. IBR planning, preparation and conduct details will be discussed and finalized on a case-by-case basis with the issuance of each TDL.

Agreement will be reached on:

• The IBR scope and approach, i.e., Contract Line Item Number (CLIN)/Performance Work Schedule (PWS) scope coverage, dates, duration, depth of the event, and preliminary IBR agenda.

• IBR entrance and exit criteria. The PMW770 IBR Lead will take lead roles in assessing Contractor IBR readiness.

• If the scope of the TDL and dollar value warrant, pre-IBR support requirements include:

- Advance IBR artifacts (EVMS output) submittal requirements and IBR schedule.

- Contractor participation in Government pre-IBR Workshop activities (e.g., vendor may be asked to send 1-3 representatives (i.e., PM, System Engineering (SE) Lead, Scheduler) to a Government pre-IBR workshop to provide 2-4 hours of PMB, IMS, IBR artifact overview and data traces.

The Contractor shall flow-down IBR requirements to those subcontractors that meet the applicable thresholds for EVM reporting. The prime Contractor shall lead IBRs at subcontractors, with active participation from the Government. During contract performance, the Contractor will provide ongoing access to its records and data that underlie and support the Performance Measurement Baseline and cost and schedule data reported.

Reference:

DFARS 252.234-7002 - Earned Value Management System

2.1.1.4 Over Target Baseline (OTB)/Over Target Schedule (OTS)/Restructure

The Contractor may conclude the baseline no longer represents a realistic plan in terms of budget/schedule execution. In the event the Contractor determines an OTB/OTS/Restructuring action is necessary, the Contractor must obtain customer approval prior to implementing an OTB/OTS/Restructuring action. The request should also include detailed implementation procedures as well as an implementation timeframe. The Contractor will not implement the OTB/OTS/Restructuring prior to receiving written approval from the Contracting Officer.

2.1.1.5 Integrated Master Schedule (IMS) (IPMR Format 6)

The Contractor shall develop, maintain, and deliver a logically networked Integrated Master Schedule (IMS) in accordance with the DoD Integrated Master Plan and Integrated Master Schedule Preparation and User Guide, DI-MGMT-81861, Format 6, and tailoring instructions provided in CDRL A002, Integrated Program Management Report (IPMR). The IMS shall contain the planned events and milestones, all activities from contract award to contract completion, activity entrance and exit criteria, and risks/risk mitigation activities identified and documented in the Contractor’s Risk Management Plan (RMP). The IMS shall also reflect the tasks, dates (baseline, forecast, and actual), external and internal dependences and relationships necessary to support independent accurate forecasts of contract milestone delivery dates by both the Contractor and the Government. The IMS shall be developed, maintained and reported consistently and in conjunction with the Contract Work Breakdown Structure (CWBS) and the CPR. The Contractor shall support teleconferences, as needed, to discuss IMS progress and issues and shall be available for review at all Government meetings.

Reference:

CDRL A002 - Integrated Program Management Report (DI-MGMT-81861)

2.1.1.6 Schedule Analysis/Schedule Risk Assessment (SRA)

A Schedule Analysis section shall be included with the monthly IPMR deliverable as part of Format 5 of the IPMR. This section shall be in accordance with DI-MGMT-81861 and tailoring instructions provided in CDRL A002, Integrated Program Management Report (IPMR).

Schedule Risk Assessment shall be conducted quarterly as outlined in CDRL A002.

Reference:

CDRL A002 - Integrated Program Management Report (DI-MGMT-81861)

2.1.1.7 Contract Work Breakdown Structure (CWBS)

The Contractor shall develop an extended CWBS and CWBS dictionary in accordance with DI-MGMT-81334C. The Contractor’s organizational entity responsible for systems engineering shall analyze the system requirements specified in the Statement of work (SOW) and translate them into an extended Contract Work Breakdown Structure

(CWBS) representing the products and services that comprise the entire work effort commensurate with the contract requirements. The Contractor shall extend the MIL- STD-881-compliant CWBS provided by the Government as outlined in CDRL A001 down to appropriate levels required to provide adequate internal management, surveillance, and performance measurement. The Contractor shall use the CWBS as the primary framework for contract planning, budgeting and reporting of cost, schedule and technical performance status to the Government. The Contractor shall maintain, update and deliver the CWBS and the CWBS Dictionary during the execution of the contract in accordance with DI-MGMT-81334C and the tailoring instructions provided in CDRL A001, Contract Work Breakdown Structure. Changes to the CWBS and/or associated CWBS Dictionary definitions at any reporting level require approval of the Government.

Reference:

CDRL A001 - CWBS (DI-MGMT-81334C)

2.1.1.8 Contract Fund Status Report (CFSR)

The Contractor shall submit a quarterly CFSR in accordance with DI-MGMT-81468 and the tailoring instructions provided in CDRL A003, Contract Funds Status Report (CFSR). The CFSR will be used by the Contractor and the Government to update and forecast contract funds requirements; to plan and communicate funding changes; to develop funding requirements for approved efforts; to determine funds in excess of contract needs and available for de-obligation; and to obtain rough estimates of termination liability and open commitment costs on all cost reimbursable contract line items.

Reference:

CDRL A003 - CFSR (DI-MGMT-81468)

2.1.1.9 Manpower Reporting

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Space and Naval Warfare Systems Command (SPAWAR) via a secure data collection site.

The contractor is required to completely fill in all required data fields using the following web address https://doncmra.nmci.navy.mil.

Reporting inputs (from contractors) will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://doncmra.nmci.navy.mil.

Reference:

CDRL A004 – Labor Hours Reporting

2.1.1.10 Program Management Reviews (PMRs)

The contractor shall conduct PMRs as authorized by TDLs. These reviews shall be no more than two days duration and shall occur at the contractor’s facility unless specifically requested by the Government to occur elsewhere. These reviews shall address the status of all ongoing studies, which may include design, development, software changes, test and evaluation, and field engineering studies. The contractor shall provide selected view graphs and spreadsheets to support program office briefing requirements for documenting program activities. The contractor shall develop agendas and minutes for each program review. The Government reserves the right to modify the agenda and the minutes. The PMR content shall contain all aspects of each active TDL addressing cost, schedule, and performance, (e.g. schedule status, progress against major milestones, cost/funding status, risk management, manpower, configuration management, software engineering, and quality assurance). The contractor’s TDL lead managers shall report on their various tasks. The Government reserves the right to schedule additional reviews or working groups if critical issues arise or significant events or changes have occurred. The contractor shall specifically address known or anticipated impacts to systems and terminal performance.

Reference:

CDRL A006 - Conference Agenda CDRL A007 - Conference Minutes

2.1.2 Design Reviews

2.1.2.1 Software Design Reviews

The contractor shall conduct, as appropriate, a Software Design Review for each major software modification to be performed on the CSRR C&M as authorized by an individual TDL. The software design presentations shall include an overview of the proposed modification (e.g., modules, external interfaces, interfaces between modules) and a description of each module (e.g., allocated requirements, interfaces and processing, language, new/reused/modified/commercial item code). The presentations will include traceability of requirements to each software configuration item and shall clearly demonstrate how the design meets these requirements.

The software design reviews shall clearly show how the software can be expanded to incorporate future growth. The software design shall discuss coding standards, the extent of new/reused/modified/commercial item code, languages, and division of software. The software design shall provide a rationale for the use of new/reused/modified code considering factors such as the state of code being considered (e.g., extent of verification, extent of operational certification, extent of security accreditation/certification), current and future obsolescence and compatibility.

The software design shall provide rationale for the use of commercial item code considering factors such as suitability, ease of use, state of code being considered (extent of verification, extent of operational certification, extent of security accreditation/certification), and life-cycle support and obsolescence.

Reference:

CDRL A006 - Conference Agenda

CDRL A010 - Technical Report – Study/Services

2.1.2.2 Software Requirements Review

As authorized by individual TDLs, the Contractor shall conduct Software Requirement Reviews (SRRs) to finalize the C&M software requirements. These reviews shall demonstrate the basis for proceeding to a Software Critical Design Review (CDR). The Software Requirements Specification (SRS) shall be updated and delivered as the baseline following the SRRs.

Reference:

CDRL A006 - Conference Agenda

2.1.2.3 Preliminary Design Review (PDR)

As authorized by individual TDLs, the contractor shall provide input, as appropriate, to a PDR for each increment/version of the CSRR C&M. The PDR shall serve to:

a. Evaluate the progress, technical adequacy, and risk resolution of the selected design approach

b. Determine compatibility with performance and engineering requirements for the development specifications

c. Establish the existence and compatibility of the physical and functional interfaces among items of equipment, facilities, computer programs, and personnel

d. Identify the user system interface requirements definition

e. Present any changes to the modification since previous design reviews, as applicable.

Reference:

2.1.2.4 Critical Design Review (CDR)

As authorized by individual TDLs, the contractor shall provide input, as appropriate, to a CDR for each increment/version of the CSRR C&M software to baseline the software section of the SSDD and to insure the final software design satisfies the performance and engineering specifications listed in the CSRR System/Subsystem Specifications.

The Contractor shall establish detail design compatibility among system components, assess configuration item risk areas and review preliminary product specifications. The Contractors input shall focus on determination and acceptability of the design, risk mitigation, and testing strategy. During the CDRs, the Contractor shall present those items below as they relate to the new and modified C&M software:

a. Establish that the detailed design solutions, as reflected in the design documentation, satisfy the requirements established in the Government-provided specifications.

b. Demonstrate control of the overall technical program risks associated with technical, cost, and schedule aspects.

c. Present status of software languages and applications to be used in the overall CSRR C&M software.

d. Demonstrate the establishment of an effective human-machine interface.

e. Establish the adequacy of specific C&M software documentation that will be released for coding and testing.

f. Present the results of bread boarding and testing of critical subsystems.

g. Present the status of specifications and acceptance test plans.

2.1.2.5 Test Readiness Review (TRRs)

As authorized by individual TDLs, the Contractor shall conduct Test Readiness Reviews (TRRs) prior to formal testing of software releases. System deficiencies that may have an impact on the test results shall be presented for Government approval. The reviews shall address what testing the Contractor has already accomplished and the results of those tests, and a proposed approach to resolve outstanding deficiencies. Software Test Procedures to be used shall also be presented along with any recommended modifications. TRR criteria are defined in CSRR Software Development Plan (SDP).

Reference:

2.1.3 Automated Interchange of Technical Information Management

The contractor shall deliver unclassified documentation required by this statement of work via electronic medium (electronic mail or magnetic media) and shall post one electronic copy to a Government shared server as agreed upon as specified in the Contract Data Requirements List (CDRLs) (DD Form 1423). At the Government’s request in specific TDLs, the contractor shall submit unclassified CDRLs in hard copy format. CDRLs shall be scanned and debugged of computer viruses. Classified documents shall be delivered in hard copy form and magnetic media form only. Unless otherwise approved by the Government, the contractor shall use either Adobe Acrobat formatted files or Microsoft Office 2007(e.g. Microsoft Word 2007, Microsoft Excel 2007, Microsoft PowerPoint 2007) (or latest Government supported version) and Microsoft Project 2007 (or latest Government supported version) for the preparation of documents on a PC/Windows environment, which are to be electronically transferred to the Government. At the Government’s request, the contractor shall submit documents with write-to privileges, as opposed to read-only privileges, via electronic format.

The contractor shall develop technical information data exchange procedures that standardize the format, information structure, and transfer methods for exchanging CDRL items electronically. The contractor shall provide information via electronic mail or magnetic media and shall provide for a virus check prior to delivery. The contractor shall provide an outline of the procedures for providing soft copy distribution of data items, as specified in the contract CDRLs (DD Form 1423). This outline shall be developed and included in the first progress report.

2.2 STUDIES AND ANALYSIS

As authorized by individual TDLs, the contractor shall conduct studies and analyses as authorized by the Government in the areas of software engineering for new requirements, correction of test and evaluation deficiencies, operational enhancements, and technology improvements to the C&M software. The studies shall address Engineering Change Proposals (ECPs) and other related documents (See Section 3.0 of this SOW). In particular, the contractor shall provide technical reports assessing any potential performance, schedule, technical, logistic, or cost impacts to CSRR C&M software and provide a supporting analysis and a recommended course of action. As authorized by individual TDLs, the studies shall also include research into emerging CSRR requirements.

2.3 GOVERNMENT PROPERTY

2.3.1 Government Furnished Property (GFP)

The Contractor shall stand up a lab with the equipment provided by the Government and maintain this equipment. The Government furnished equipment will allow the Contractor capability to test interfaces using this equipment or simulators. The contractor shall provide GFP report.

CDRL A020 – Status of Government Furnished Property Report

2.3.2 Contractor Acquired Property

In support of engineering efforts and as authorized by TDLs, the contractor shall make the necessary equipment and material purchases to implement software design modifications to the CSRR system. The contractor shall provide pricing and delivery information for this material support as requested by the Government. The schedule for any material delivery shall be mutually agreed upon between the contractor and the Government.

2.3.3 Item Unique Identification (IUID)

The Contractor shall provide and report Unique Item Identifier (UII) on all equipment, spares, and storage containers provided and acquired to comply with DFARS 252.211- 7003 (Item Identification and Valuation) and 252.211-7007 (Reporting of Government- Furnished Equipment in the DoD Item Unique Identification (IUID) Registry).

CDRL A005 - Contractor’s Progress, Status and Management Report

2.4 CONFIGURATION MANAGEMENT PROGRAM

As authorized by individual TDLs, the contractor shall establish, implement and control a Configuration Management (CM) program

2.4.1 Configuration Control

The contractor shall maintain configuration baselines for engineering changes developed under this contract. The latest revisions of the configuration baseline documents shall serve as the configuration baseline from which engineering changes will be developed under this contract. The contractor shall not perform any changes to contract delivered software, unless authorized by the responsible production contract Contracting Officer’s Representative (COR), Alternate COR (ACOR), and/or Procuring Contracting Officer (PCO). All software changes shall be documented. The contractor shall also propose changes to the performance specifications for systems included in this SOW. Formal baseline changes under this contract will occur following CDR, successful testing of each engineering change, delivery of documentation supporting the changes, and approval by the Government.

The contractor shall use the latest documented revisions of the baselines updated under contract N00039-13-C-0039 as the baselines from which engineering changes will be developed under this contract. The contractor shall document proposed changes to the latest documented revision of the CSRR C&M baseline.

2.5 SOFTWARE ENGINEERING

2.5.1 Technical Approach

The technical approach to this effort is based on the concept of a CSRR that includes a common open systems architecture, common software, common technical documentation, and a single Software Support Activity (SSA). The common software configuration approach includes the structure of the code; the databases used to track requirements, software source files, baseline documentation, host equipments/ processors, and the verification and validation process/ procedures. The CSRR C&M is coded in Java with a Linux operating system and interfaces with an Oracle database.

The Government requires that the CSRR C&M software be maintained and further developed using the common configuration approach described above.

The approach shall focus on commonality and the convergence of unique elements into the CSRR. In this role, the Contractor shall control the software requirements database, control the CSRR C&M software baseline, provide platform-specific C&M software configurations, and provide and prepare C&M software documentation. The Contractor shall also provide system engineering design services and shall perform tasks as defined and requested by the Government. This tasking will help to ensure and enhance the quality of the CSRR product and will support the needs of the existing platforms as they evolve.

2.5.1.1 Software Engineering Approach

The contractor shall define a software development approach appropriate for the computer software effort to be performed under this solicitation. This approach shall be documented in a Software Development Plan (SDP). The contractor shall follow this SDP for all computer software to be developed or maintained under this effort.

The SDP shall define the offeror’s proposed life cycle model and the processes used as a part of that model. In this context, the term “life cycle model” is as defined in Institute of Electrical & Electronics Engineers/ Electronic Industries Alliance (IEEE/EIA) Standard

12207.0. The SDP shall describe the overall life cycle and shall include primary, supporting, and organizational processes based on the work content of this solicitation.

In accordance with the framework defined in IEEE/EIA Std. 12207.0, the SDP shall define the processes, the activities to be performed as a part of the processes, the tasks which support the activities, and the techniques and tools to be used to perform the tasks. Because IEEE/EIA Std. 12207 does not prescribe how to accomplish the task, the offeror must provide this detailed information so the Government can assess whether the offeror’s approach is viable.

The SDP shall contain the information defined by IEEE/EIA Std. 12207.1, section 5.2.1 (generic content) and the Plans or Procedures in Table 1 of IEEE/EIA Std. 12207.1. In all cases, the level of detail shall be sufficient to define all software development processes, activities, and tasks to be conducted. Information provided must include, as a minimum, specific standard, methods, tools, action, strategies, and responsibilities associated with development and qualification.”

In the SDP, the Contractor shall also disclose the C&M software version/control tracking system and how the code will be marked and tracked during software coding unit level test, system level test, and release. Regarding software version/control tracking system, the Contractor shall establish, and document in the SDP, a predictive software version numbering process that allows pre-assignment of submarine class C&M version numbers and, when necessary, hull number specific C&M version number within a given submarine class.

CDRL A008 - Software Development Plan

2.5.2 Software Integrated Process Teams

As authorized by individual TDLs, the contractor shall participate in the CSRR Integrated Process Teams (IPTs). These include the Design Build Management Team (DBMT), Data Processing Team (DPT), System Engineering Team (SET), and Security Working Group (SECWG).

2.5.3 Software Development

As authorized by individual TDLs, the contractor shall maintain and upgrade the CSRR C&M software originally developed under contract N00039-03-C-0026. Software updates shall be developed and tested in accordance with the specifications used in the latest software modification iteration. New design and development efforts shall be performed in accordance with Software Engineering Institute (SEI) Level 3 (minimum) practices. Design rules, and standards shall be in accordance with SEI Level 3 (minimum) practices for modifications and new developments. Library practices and procedures shall be subject to Government review. Software is defined to include micro code, firmware, off-the-shelf programs, or any series of instructions or statements in a form acceptable to a microprocessor to execute one or more operations. All software shall meet the requirements specified herein.

At no time shall the Contractor include any proprietary information in software developed without specific written concurrence from the Government.

2.5.3.1 PR Analysis

As authorized by individual TDLs, the Contractor shall perform analysis of all newly identified software PRs found during testing and operational use and provide scope and options for implementing resolution to the Government. The analysis shall be within one (1) week for severity 1 and 2 PR’s and four (4) weeks for all other PRs.

2.5.3.2 PR Resolution

As authorized by individual TDLs, the Contractor shall perform corrections of software deficiencies identified during testing and operational use. The Contractor shall provide detailed options for implementing resolutions, obtain Government approval for implementation via change process, implement correction as approved, and perform software PR verification.

2.5.3.3 New Development and Upgrades

As authorized by individual TDLs, the Contractor shall provide upgrades to the existing C&M baselines. The Contractor shall provide detailed options for implementing upgrades, obtain Government approval for implementation, implement upgrade as approved, and perform software verification. For major new developmental efforts detail design documents shall be developed as agreed upon between the Contractor and the Government.

2.5.3.4 Software Builds

As authorized by individual TDLs, the Contractor shall provide formal C&M software builds targeted for specified platforms to include any added functionality and resolved software PRs as identified and authorized by the Government.

CDRL A019 - Computer Software Product End Items

2.5.3.5 Engineering Drops

As authorized by individual TDLs, the contractor shall deliver engineering drops upon request of the Government. These engineering drops will be the latest integration build prepared for use at a government lab or facility.

2.5.3.6 Information Assurance Vulnerability Alert (IAVA) Updates and Patches

As authorized by individual TDLs, the Contractor shall maintain, and upgrade as required, a process to evaluate all patches and upgrades for security impacts in accordance with the Information Assurance Vulnerability Management (IAVM) Plan for the CSRR and IA Control Number DCCT-1 in DoD Instruction 8500.2.

1) Receive Information Assurance Vulnerability Alert (IAVAs) and Information Assurance Vulnerability Bulletin (IAVBs) from the CSRR IAVM Point of Contact

(POC).

2) Assess their applicability to the Equipment Communication Subsystem (ECSS) C&M, during the specified time period of the IAVA and IAVB.

3) Assess the applicability of software patches and upgrades to the ECSS C&M.

4) Assess impact on C&M software operation and performance. Provide recommended fixes to allow implementation of IAVA, IAVB, and software patches and upgrades, if system impacted, and document findings.

2.5.3.7 Navy Cybersecurity Safety (CYBERSAFE)

As authorized by individuals TDLs, the Contractor shall comply with Table 5 (Cybersafe Grade B Security Controls) in accordance with the Information Assurance Technical Authority (IA TA) Navy Cybersecurity Safety (CYBERSAFE) Grading Requirements Standard (STD-CSGR-012R0)" to the extent possible. Provide documentation for any deviations or shortfalls.

2.5.4 Software Documentation

For all newly developed software and modifications to existing software, as authorized by individual TDLs, the contractor shall update and develop in contractor format consistent with the quality standards established for SEI Level 3 (minimum) practices, the following documents:

At no time shall the Contractor include any proprietary information in documentation developed without specific concurrence from the Government.

a. Software Development Plan (SDP)

b. Software Requirements Specification (SRS)

c. System/Subsystem Design Description (SSDD)

d. Software Development File (SDF)

e. Software Version Description (SVD)

f. Software Installation Plan (SIP)

g. Software Test Plan (STP)

h. Software Test Procedures

i. Software Test Report (STR)

j. Software User’s Manual (SUM)

CDRL A008 - Software Development Plan CDRL A009 - Software Requirements Specification CDRL A011 - System/ Subsystem Design Description CDRL A012 - Software Development File CDRL A013 - Software Version Description CDRL A014 - Software Installation Plan CDRL A015 - Software Test Plan CDRL A016 - Software Test Procedures CDRL A017 - Software Test Report CDRL A018 - Software User’s Manual

2.5.5 Software Testing

For all software changes, the contractor shall review the applicable test documentation and update it as required. For new software development efforts, the contractor shall develop new test documentation. If the new development effort is not extensive enough to warrant new test documentation, the contractor and the Government shall mutually agree upon the test documentation approach and generation to occur. The contractor shall ensure that the test documentation meets all specified performance, technical, and operational requirements as listed in Section 3.0 of this SOW.

All software developed, unless otherwise mutually agreed upon by the contractor and the Government, shall consist of the following levels of-testing:

a. Software Unit Testing

b. Software Subcomponent Testing

c. Software Integration Testing

d. Software Acceptance Test

Reference:

CDRL A015 - Software Test Plan CDRL A016 - Software Test Procedures CDRL A017 - Software Test Report

2.5.5.1 Acceptance Testing in the Contractors Lab

As authorized by individual TDLs, the contractor shall support Government conducted acceptance testing in the Contractors lab prior to delivery of the software. Successful completion of Government testing will result in formal Government acceptance of the build.

2.5.5.2 Acceptance Testing at Government Facility

As authorized by individual TDLs, the contractor shall support Government conducted acceptance testing on actual hardware at a Government facility. Successful completion of Government testing will result in formal Government acceptance of the build.

2.5.6 Software Interface

As authorized by individual TDLs, the contractor shall support and participate in interface control working groups to ensure that maintenance changes and new development efforts do not change or conflict with the system performance requirements.

2.5.7 Software Quality Assurance

The Contractor shall perform CSRR software development under a certified Quality Program for the duration of this contract. The Quality program shall be applied to all areas of the project. Records of activities required by the Quality Program shall be retained for a minimum period of three years after the final payment to the Contractor.

The Government has the right to perform inspection in accordance with contract clause FAR 52.246-8 Inspection of Research and Development Cost Reimbursement.

FAR 52.246-8 - Inspection of Research and Development Cost Reimbursement

2.5.8 Software Configuration Management

The Contractor shall perform Configuration Management (CM) Planning and Administration, Configuration Identification, Control, Status Accounting and Audit activities while developing, integrating and testing the CSRR C&M software. The Contractor shall perform configuration management of all versions of the CSRR C&M software under integration, test, and certification as well as all deployed CSRR C&M software. This shall include identification of the configuration items, controlling the changes to the baselines, and accounting for all approved changes. The Contractor shall use the contractors standard configuration management standards established for SEI Level 3 (minimum) practices.

2.6 ENGINEERING SUPPORT

2.6.1 Engineering Support

As authorized by individual TDLs, the Contractor shall provide qualified engineers, and technicians for on-call technical advisory service to assist Government personnel.

Examples of activities where the Government would require assistance includes installation issues, design issues, and resolution of technical issues.

2.6.2 Field Engineering Support

As authorized by individual TDLs, the Contractor shall provide qualified engineers, and technicians for on-site technical advisory support to assist Government personnel at the Naval Undersea Warfare Center (NUWC) Newport. Examples of activities where the Government would require assistance includes system design, system checkout, engineering change request development and verification, and resolution of technical issues.

2.7 SECURITY PROGRAM IMPLEMENTATION

The Contractor will be required to maintain a TOP SECRET facility clearance for the duration of this effort. The engineers and technicians for field engineering support shall have a minimum TOP SECRET security clearance. Other engineers and technicians that provide support shall have a minimum of a SECRET security clearance. The facility and information/products produced shall be in accordance with the DD254.

3.0 APPLICABLE DOCUMENTS

The following documents form a part of this SOW to the extent specified herein.

It is recognized that in certain cases conflicts between some of the specifications and standards listed in the below may exist. The contractor should examine the applicable specifications and standards and make appropriate recommendations to resolve conflicts as approved by the Government. Where waivers of certain specifications and standards are required to resolve these conflicts, they shall be so stated and approval shall be requested from the Government in writing addressed to the Procuring Contracting Officer. Further, where waivers in these specifications and standards will lead to significant cost savings to the Government without operational performance degradation, the contractor shall make appropriate system recommendations.

3.1 CSRR DOCUMENTS

The following documents provide guidance for the CSRR C&M software including that guidance required to implement both the common and platform unique aspects. The versions for documents listed are current as of the date of this SOW and updated versions will be available at award of contract. NOTE: This list of documents will be updated for the final release of the SOW.

Document No Date Of Issue Document Title Revision 341-10-019-6

(SSGN

DRAFT)

19 August

Common Submarine Radio Room (CSRR) Increment 1 Version 3 System/Subsystem Specification (SSS)

Final

7418355 17 May 2016 Software Requirements Specification (SRS) - VA Block IV

7418356 17 May 2016 System Subsystem Design Description (SSDD)

- VA Block IV

7418345 17 August

Software Version Description (SVD) - VA Block

IV

D

7418347 12 August

Software Installation Plan (SIP) - SSBN Modernization

E

7418348 4 August 2016 Software User's Manual (SUM) - SSBN Modernization

D

7418339 25 March 2014 Software Test Plan (STP) -

7418321 24 July 2016 Software Test Procedures - SSBN Mod - Control and Management – Admin

J

7418322 24 July 2016 Software Test Procedures - SSBN Mod - Control and Management - Alerts and Logs

J

7418323 24 July 2016 Software Test Procedures - SSBN Mod - Control and Management – Help

J

7418324 24 July 2016 Software Test Procedures - SSBN Mod - Control and Management - Schedule Planning

J

7418325 24 July 2016 Software Test Procedures - SSBN Mod - Control and Management - System Initialization

J

Document No Date Of Issue Document Title Revision 7418326 24 July 2016 Software Test Procedures - SSBN Mod -

Control and Management – Failover J

7418327 24 July 2016 Software Test Procedures - SSBN Mod - Control and Management – Status

J

7418328 24 July 2016 Software Test Procedures - SSBN Mod - Control and Management - COMM Planning

J

7418329 24 July 2016 Software Test Procedures - SSBN Mod - Control and Management - RF Distribution

J

CDRL A012-

29 September

VA Block IV Software Development Files (SDF)

3.2 SECURITY DOCUMENTS

The following documents provide guidance for performance of tasks described in this

SOW.

Document No Date Of Issue Document Title Revision DoD 5200.1-M 16 March 1994 Acquisition Systems Protection Program DoDI 5200.39 28 May 2015 Critical Program Information (CPI) within the

Department of Defense Change 1, dated 28 December

DoDI 8510.01 12 March 2014 Risk Management Framework (RMF) for DoD Information Technology (IT)

SECNAVINST

5239.3C

20 December

Department of the Navy Information Assurance (IA) Policy

OPNAVINST

5239.1C

2 May 2016 Navy Cybersecurity Program

DoDD 8500.1E 24 October

Information Assurance (IA)

DoDI 8500.2 06 February

Information Assurance (IA) Implementation

27 June 2005 Multi-Level Security (MLS) Controller Security Policy

1.4

CCMB-2009-

07-001

July 2009 Common Criteria for Information Technology Security Evaluation; Part 1: Introduction and general model

3.1 Rev 3

CCMB-2007-

09-002

September

Common Criteria for Information Technology Security Evaluation; Part 2: Security functional components

3.1 Rev 2

CCMB-2009-

07-003

July 2009 Common Criteria for Information Technology Security Evaluation; Part 3: Security Assurance Components

3.1 Rev 3

8 October

Labeled Security Protection Profile 1.b

STD-CSGR-

012R0

20 October

Information Assurance Technical Authority (IA TA) Navy Cybersecurity Safety (CYBERSAFE) Grading Requirements Standard

3.3 OTHER DOCUMENTS

Document No Date Of Issue Document Title Revision DoD 5220.22- M

28 February

National Industrial Security Program Operating Manual (NISPOM), ISO 9001:2008 Quality Systems - Model for Quality Assurance in Design, Development, Production, Installation and Servicing

MIL-STD-

1686C

25 October

Electrostatic Discharge Control Program for Protection of Electrical and Electronic Parts, Assemblies and Equipment (Excluding Electrically Initiated Explosive Devices) (Metric)

28 Aug 2006

Information Assurance Vulnerability Management (IAVM) Plan For the Common Submarine Radio Room

(CSRR)

2.6

28 March 2006

UNIX Secure Technical Implementation Guide

Version 5, Revision 1, Red Hat 7 Secure Technical Implementation Guide

Version 1, Release 3

19 September

Database Security Technical Implementation Guide

Version 8, Release 1, 28 October

Application Security and Development Security Technical Implementation Guide

Version 3, release 4

DoDI 8552.01 23 October

Policy Guidance for Use of Mobile Code Technologies in Department of Defense Information Systems