Attachment 1_N0003925R9510_ADNS MAC SOW_11 JUN 2025.pdf

STATEMENT OF WORK

FOR

AUTOMATED DIGITAL NETWORK SYSTEM (ADNS)

MULTIPLE AWARD CONTRACT (MAC)

N0003925R9510

11 June 2025

Department of the Navy (DoN) Program Executive Office (PEO)

Command, Control, Communications, Computers and Intelligence (C4I)

Program Management, Warfare Tactical Networks (PMW 160)

4301 Pacific Highway San Diego, CA 92110-3127

DISTRIBUTION STATEMENT A:

Approved for public release, distribution is unlimited (11 June 2025)

1 SCOPE

1.1 Introduction

1.2 Background

1.3 Scope

2 APPLICABLE DOCUMENTS

3 REQUIREMENTS

3.1 Program Management and Administration (OPN / SCN / OCF)

3.1.1 Post Award Conference

3.1.2 Delivery Order Post Award Planning Meeting

3.1.3 Program Management Review (PMR)

3.1.4 Data Deliverables

3.1.5 Technical Interchange Meeting (TIM) Support

3.1.6 Status Reporting

3.1.7 Small Business Utilization

3.1.8 Quality Assurance Program

3.1.9 Product Validation and Supply Chain Risk Management (SCRM)

3.1.10 Environmental, Safety, and Occupational Health (ESOH)

3.1.11 Hazardous Material Management

3.1.12 Diminishing Manufacturing Sources and Material Shortages

3.1.13 Configuration Management (CM)

3.1.14 End of Life/End of Sale/Support/Service (EOL/EOS)

3.1.15 Failure Reporting System

3.1.16 Warranty Performance System

3.1.17 Item Unique Identification (IUID) Compliance Plan

3.1.18 Information System Security Management

3.2 ADNS MAC Production (OPN / RDT&E / OM&N / SCN / OCF)

3.2.1 Production Manufacturing

3.2.2 Factory Acceptance Test (FAT)

3.2.3 Quality Assurance

3.2.4 As-Built Configuration List

3.2.5 License Keys

3.2.6 Government Furnished Property (GFP) Tracking

3.2.7 Product Validation and Supply Chain Risk Management (SCRM)

3.2.8 Warranty

3.2.9 Packaging, Handling, Storage, and Transportability

3.2.10 Reliability Documentation

3.2.11 Item Unique Identification (IUID)

4 ADNS MAC SECURITY MANAGEMENT

4.1 Systems Security Plan and Associated Plans of Action

4.1.1 System Security Plan and Plans of Action and Milestones (SSP/POA&M) Reviews

4.1.2 Compliance to National Institute of Standards and Technology (NIST) 800-171

4.1.3 Cyber Incident Response

4.1.4 Naval Criminal Investigative Service (NCIS) Outreach

4.1.5 NCIS/Industry Monitoring

1 SCOPE

1.1 Introduction

The purpose of this Statement of Work (SOW) is to outline the requirements for the procurement and production of the Automated Digital Network System (ADNS) on behalf of the Program Executive Office for Command, Control, Communications, Computers and Intelligence (PEO C4I) and the Program Manager for Tactical Networks, Program Management Warfare Wide Area Networks (PMW 160 WAN). The Department of the Navy (DON), PEO C4I, and PMW 160 are responsible for the acquisition, development, integration, delivery, and support of network infrastructure and basic network information distribution services in support of force-wide tactical information and combat support systems.

ADNS supplies the tactical Wide Area Network (WAN) capabilities of Naval communications systems, providing surface ship, submarine, airborne, tactical shore and shore-based WAN gateway services management. ADNS includes the Communications-as-a-Service (CaaS) capability which is an integrated software-defined network designed to provide provisions delivery of mission data and provide control-based, traffic-engineered networking which supports tactical data delivery requirements.

1.2 Background

ADNS is an Acquisition Category (ACAT) II multi-increment program that adapts a variety of Commercial Off-the-Shelf (COTS) and Government Off-the-Shelf (GOTS) hardware and software. ADNS INC III Low Rate Initial Production (LRIP) procurement was approved by a Milestone (MS) C Acquisition Decision Memorandum (ADM) on 24 July 2008. In July 2010, a second LRIP phase authorized by the Milestone Decision Authority (MDA) supported an Operational Test (OT). In December 2010, the MDA authorized Full Rate Production (FRP) for Surface and Shore. A Submarine OT was conducted in November 2012, and in March 2013, the MDA authorized FRP for Submarine and Broadcast Control Authorities (BCAs). In May 2021, ADNS INC III began to develop a new hardware design that is currently scheduled to complete Developmental Test/Operational Test (DT/OT) by end of 2025.

Per direction from the Assistant Secretary of the Navy for Research, Development and Acquisition (ASN (RD&A)), the CaaS program was transitioned from PEO IWS 6.0 to PMW 160 on 01 March 2022. PMW 160 transitioned the CaaS program to the ADNS POR in February 2023.

1.3 Scope

The ADNS MAC is an Indefinite Delivery – Indefinite Quantity (IDIQ) MAC for the purpose of the production and deployment of Build to Print ADNS units, components, COTS software, spares, lab material, future Cyber Threat Upgrades (CTU) and Mission Focused Upgrades to support required Target Inventory Objectives (TIOs) for Shore and Afloat platforms and Airborne routing systems. The manufacturing effort will consist of sourcing, assembling, integrating, testing, and delivering ADNS production units in accordance with the Government Production Baselines provided under Government Technical Data Packages (TDPs). This contract also encompasses the functions to support the production activities to include, but not limited to, Integrated Logistics Support (ILS), Configuration Management (CM), Test and Evaluation, Quality Assurance, and Installation Support. Specific requirements will be defined in individual Delivery Orders (DOs). Individual DOs will be firm-fixed price (FFP).

ADNS is pursuing a Software Defined Network (SDN) routing solution that enables hardware-agnostic implementation of software containers, virtual machines, and any other emerging software-based technologies. In support of hardware-agnostic software implementation, ADNS is pursuing varied hardware solutions that support increased computing and storage requirements while also reducing Space, Weight, and Power (SWAP) to enable modular and faster upgrade and installation timelines.

2 APPLICABLE DOCUMENTS

Documents referenced herein are listed in Table 1. The Contractor shall comply with the following documents as applicable and as directed by the SOW. In the event of a conflict between the text of this document and the applicable documents cited herein, the text of this document takes precedence. Military Standards (MIL-STD) can be located on the Defense Logistics Agency (DLA) Assist website at https://quicksearch.dla.mil/. DFARS clauses can be located at https://acquisition.gov. PMW 160, ADNS, and PEO references will be provided as Government Furnished Information (GFI).

TABLE 1 – APPLICABLE DOCUMENTS

ID Reference ID Reference Name SOW Reference

1 DoD IMS GUIDE DoD Integrated Master Plan and Integrated Master Schedule Preparation and Use Guide Version 9 (MAY 2023) https://www.dau.edu/cop/se/documents/IMS%20and%20IMP%20Preparation% 20and%20User%20Guide

3.1.2

2 ISO 9001:2015 International Standards Organization (ISO) 9001:2015, Edition 2024 https://www.iso.org/standard/62085.html#amendment

3.1.8

3 NIST SP 800-161 Rev.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (May 2022 (includes updates as of 11-01-2024)) https://csrc.nist.gov/pubs/sp/800/161/r1/final

3.1.9

4 SAE AS5553D Counterfeit Electrical, Electronic, and Electromechanical (EEE) Parts;

Avoidance, Detection, Mitigation, and Disposition (14 APR 2022) https://www.sae.org/standards/content/as5553d/

3.1.9

5 DODINST 4140.67 DOD Counterfeit Detection Policy (FEB 2024) https://www.esd.whs.mil/portals/54/documents/dd/issuances/dodi/414067p.pdf

3.1.9

6 Title 29, Code of Federal Regulations 1910.1200

Hazard Communication Standard and National Aerospace Standard (NAS) 411, Hazardous Material Management Program (APR 2025) https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XVII/part-1910/subpart- Z/section-1910.1200

3.1.11

7 NAS 411 HMMP National Aerospace Standard (NAS) 411, Hazardous Material Management Program 3.1.11

8 PMW 160 DMSMS

Plan

Diminishing Manufacturing Sources and Material Shortages (DMSMS) Plan, Revision 1 (OCT 2015) 3.1.12

9 PEO C4I Document Configuration and Data Management Plan

Configuration and Data Management Plan (CDMP) 3.1.13

10 SAE GEIA-HB-649A Configuration Management Standard Implementation Guide https://www.sae.org/standards/content/geiahb649a/

3.1.13

11 SAE ANSI/EIA-649C Configuration Management Standard (01 MAR 2016) https://www.sae.org/standards/content/eia649c/

3.1.13

12 DI-SESS-81639D Warranty Performance Reports 3.1.16 13 PMW 160 IUID Plan PMW 160 IUID Implementation Plan, Revision 1 (AUG 2012) 3.1.17 14 MIL-STD-130N(1) Identification Marking of U.S. Military Property, 26 August 2019 https://quicksearch.dla.mil/qsDocDetails.aspx?ident_number=35521 3.1.17

15 DoDI 8320.04, Change

Item Unique Identification (IUID) Standards for Tangible Personal Property, 29 November 2024 https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/832004p.pdf

3.1.17

16 DoN Information Assurance Manual

SECNAV M-5239.3 Department of Navy Cybersecurity Manual (April 2022) https://www.secnav.navy.mil/doni/SECNAV%20Manuals1/5239.3.pdf

3.1.18

17 ASTM-D3951-18R23

Standard Practice for Commercial Packaging

ASTM, International (04 OCT 2023) www.astm.org/Standards/D3951.htm 3.2.9

18 MIL-STD-129R

(Change 3)

Military Marking for Shipment and Storage MIL-STD-129R Revision R Change 3 (25 FEB 2023) https://quicksearch.dla.mil/qsdocdetails.aspx?ident_number=35520

3.2.9

19 MIL-STD-2073-1E

(Notice 1)

Standard Practice for Military Packaging MIL-STD-2073 Revision E Change 4 (27 JUN 2024) https://quicksearch.dla.mil/qsDocDetails.aspx?ident_number=37232

3.2.9

20 ADNS and CaaS TPDs ADNS and CaaS Production Baseline and associated artifacts 3.2.1.1 21 DoN ELA Mandatory Use of DoN Enterprise Licensing Agreements (ELA) (22 FEB 2012) https://www.esi.mil/contentview.aspx?id=576 3.2.1.5

22 NAVWAR 5510.1 NAVWAR Security Instruction 4 23 NIST Special

Publication 800-171, Rev 3

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (May 2024) https://csrc.nist.gov/pubs/sp/800/171/r3/final

4.1.2

24 FIPS 140-3 Security Requirements for Cryptographic Modules (22 MAR 2019) https://csrc.nist.gov/pubs/fips/140-3/final

4.1.2

3 REQUIREMENTS

3.1 Program Management and Administration (OPN / SCN / OCF)

The Contractor shall designate a Program Manager (PM) who shall have responsibility for all aspects of this contract and the authority to commit the Contractor to specific actions within the scope of the contract. For each individually awarded DO and for the contract as a whole, the Contractor shall organize, coordinate, control, and report the status of all program activities including those activities assigned to subcontractors, to ensure the correct and timely delivery of all supplies and services specified in this contract. The Contractor shall ensure coordination and integration of all supporting production disciplines. The Contractor shall document and deliver risks, issues, concerns, and lessons learned concerning all aspects of the program, such as cost, schedule, quality, production, delivery, etc.

3.1.1 Post Award Conference

The Contractor shall host a Post Award Conference (PAC) with the PMW 160 ADNS team. The PAC will be scheduled by mutual agreement between the PMW 160 ADNS Contracting Officer’s Representative (COR) and the Contractor within thirty (30) calendar days after contract award. The Contractor shall provide video teleconferencing capability for the PAC as requested by the Government. The PAC shall be held at Headquarters, Naval Information Warfare Systems Command, 4301 Pacific Highway, San Diego, CA or virtually via teleconference capabilities. At the PAC, the Contractor shall demonstrate management procedures and processes, plans and processes for production, schedule dates for production activities occurring within six months of award, and mutual understanding of contractual requirements. The Contractor shall present management, essential personnel, the POA&M submitted with the proposal, and program implementation processes. The Contractor shall document and perform action item follow-up and resolution activities. (CDRLs A001, A002)

3.1.2 Delivery Order Post Award Planning Meeting

As directed by individual DO, the Contractor shall conduct a post award planning meeting with audio teleconferencing capability within thirty (30) calendar days after DO award. The Contractor shall provide a Quality Assurance (QA) Plan and a Production Plan to address executing this DO, in addition to any ongoing DO(s). The Contractor shall deliver an Integrated Master Schedule (IMS) in accordance with the DoD Integrated Master Plan and Integrated Master Schedule Preparation and Use Guide Version 9 of May 2023. All Contractor schedule information delivered and presented to the Government during performance of this DO shall originate from the IMS. The Contractor shall document and perform action item follow-up and resolution activities. (CDRLs A004, A009, A00Q)

3.1.3 Program Management Review (PMR)

As directed by individual DO, the Contractor shall conduct Program Management Reviews (PMRs). The Contractor shall provide overall comprehensive status of the program in the PMR.

The PMR content shall contain all aspects of the contract addressing cost, schedule, and performance for all DOs (e.g. schedule status, progress against major milestones, status of, cost/funding status, risk management, manpower, configuration management, Supply Chain Risk Management (SCRM), systems and software engineering, logistics, quality assurance, safety status, identification and status of technical issues, and lower tier supplier accomplishments and issues).

The Contractor shall document significant events, outcomes, and action items resulting from the PMR. The Contractor shall perform action item follow-up and resolution activities. The Contractor shall provide teleconferencing or video teleconferencing capability for the PMR, as requested by the Government. The Contractor's functional leads shall report on the status of their respective tasks. The Government reserves the right to schedule additional reviews or working groups if issues arise or significant events or changes occur. (CDRLs A001, A002)

3.1.4 Data Deliverables

The Contractor shall provide SOW deliverables in accordance with the associated Contact Data Requirements List (CDRL). All deliverables, transmittal documents, and media shall clearly identify the contract number and deliverable number. All deliverables in which Government-approved Contractor format is specified shall be submitted to the Contracting Officer's Representative (COR) for format approval. Submissions for the purpose of format approval shall occur sufficiently in advance to allow the COR time to review and approve format without impact to timely delivery of CDRL items in accordance with this SOW and CDRLs.

TABLE 2 – CONTRACT DATA REQUIREMENTS LIST

CDRL # CDRL Title Data Item Description

(DID)

A001 Presentation Materials DI-ADMN-81373

A002 Report, Record of Meeting / Minutes DI-MISC-81250C

A003 Contractor’s Progress, Status, and Management Report

DI-MGMT-81928

A004 Integrated Master Schedule (IMS) DI-MGMT-81861C

A005 Government Furnished Property Reporting DI-MGMT-80269

A006 CADE Cost and Hour Report (FlexFile) DI-FNCL-82162

A007 CADE Quantity Data Report (QDR) DI-MGMT-82164

A008 CADE Technical Data Report DI-MGMT-82165C

A009 Quality Assurance (QA) Program Plan DI-QCIC-81794A

A00A Quality Assurance (QA) Checklist Report DI-MISC-80508B

A00B Test/Inspection Report – Factory Acceptance Test

DI-NDTI-80809B

A00C Failure Reporting, Analysis, and Correction Action (FRACAS) Item Report

DI-SESS-80255B

A00D As-Built Configuration List (ABCL) DI-SESS-81903

A00E Unique Identification (UI) Data for Embedded Components

DI-MGMT-81804A

A00F Item Unique Identification (IUID) Marking Plan DI-MISC-81803A

A00G Hazardous Materials Management Program (HMMP) Report

DI-MISC-81397D

A00H

Source Data for Forecasting Diminishing Manufacturing Sources and Material Shortages (DMSMS)

DI-PSSS-81656B

A00J License Keys DI-MISC-80508B

A00K Warranty Performance Report DI-SESS-81639

A00L Certification of Component Authenticity SAE-AS6174

A00M Competitive Subcontracts Report DI-MGMT-81642

A00N

Material Safety Data, Transportation Data, and Disposal Data for Hazardous Materials Furnished to Government Activities

FED-STD-313F

A00P Packaging, Handling, Storage, and Transportability (PHS&T) Requirements

MIL-STD-129R, MIL-

STD-2073-Revision E

A00Q Production Plan DI-MISC-80508B

A00R Product Validation Report DI-MISC-80508B

A00S Supply Chain Risk Management (SCRM) Plan

DI-MGMT-82256A

3.1.5 Technical Interchange Meeting (TIM) Support

As directed by individual DO, the Contractor shall host a monthly Technical Interchange Meeting (TIM) with the PMW 160 representatives and production stakeholders to discuss and resolve production and engineering activities, issues, etc. arising from all active orders under the ADNS Production Contract. The Government reserves the right to require an additional TIM per month to discuss risks, issues, concerns and challenges. Each TIM will address all aspects of production, quality, schedule, obsolescence, Contractor capacity, life cycle support, risks and problems related to production and associated mitigation schemes for all active DOs. The Contractor shall provide audio teleconferencing capability for the TIM as requested by the

Government. The Contractor shall provide teleconference numbers. The Government reserves the right to visit the Contractor’s Production Facility at any time during the performance of a

DO. (CDRL A001, A002, A004)

3.1.6 Status Reporting

As directed by individual DO, the Contractor shall provide a Progress, Status, and Management Report. The report shall contain all aspects of the contract addressing cost, schedule, and performance for all DOs. The report shall specifically identify the following items: schedule status, progress against major milestones, cost/funding status, risk management, manpower, configuration management, Supply Chain Risk Management, systems and software engineering, logistics, quality assurance, safety status, identification and status of technical issues, lower tier supplier accomplishments and issues, action item status, and DO questions. The contractor shall systematically collect and report actual costs in accordance with the Contractor Cost Data Reporting (CCDR) requirements of DoD 5000.04-M-1. (CDRL A003, A004, A006, A007, A008)

3.1.7 Small Business Utilization

As directed by individual DO, the Contractor shall track Small and Small Disadvantaged Business subcontracting activities. The Contractor shall provide status of small business utilization and subcontracting activities. The Contractor shall deliver a Competitive Subcontracts Report. The Contractor shall report on:

Performance status Subcontracting progress, status, and management

(CDRL A00M)

3.1.8 Quality Assurance Program

The Contractor shall establish, implement and maintain a Quality Assurance (QA) Program that meets the certification requirements of the International Organization for Standardization (ISO) 9001-2015, or an equivalent QA system. Through its QA Program, the Contractor shall ensure that (a) processes and those of Subcontractors consistently produce end items that conform to contractual requirements and (b) opportunities for process and product improvements are identified and implemented through analysis and audit of process measurement data and process controls.

As directed by individual DOs, the Contractor shall document and deliver the procedures, plans, and other data necessary to ensure an efficient and effective QA Program in a QA Plan. The QA Plan shall detail procedures, plans, and other data necessary to ensure an efficient and effective quality system. The Contractor shall develop, and include within the QA Plan, a quality assurance checklist for all systems. In addition to the QA Plan, the Contractor shall make available for review and retention all records associated with the establishment, implementation, and operation of the QA Program. (CDRL A009, A00A)

3.1.9 Product Validation and Supply Chain Risk Management (SCRM) As directed by individual DO, the Contractor shall maintain a SCRM Plan that details the company processes and procedures for implementing and sustaining an SCRM program for the ADNS contract and DOs. The Contractor shall include requirements flowed down to vendors, suppliers, and Subcontractors. Reference NIST SP 800-161 as supplemented by NIST 800-53 SA-12 and counterfeit detection and avoidance policies. As directed by individual DO, the

Contractor shall deliver a Product Validation Report, provide certificates of component authenticity, conduct SCRM activities, and as required provide Post Notification alerts. (CDRLs A00L, A00R, A00S)

3.1.10 Environmental, Safety, and Occupational Health (ESOH)

As directed by individual DO, the contractor shall document and deliver Safety Data Sheet (SDS) for each identified hazardous material. SDS shall be completed using Occupational Safety and Health Administration (OSHA) Form 174 and in compliance with 29 CFR 1910.1200. In the event the contractor identifies any real or potential problems, the contractor shall notify the PCO and COR in writing of the specific concerns and recommended course of action within fifteen

(15) calendar days of discovering the problem. The contractor shall include all potential or real impacts resulting from the identified problem in the SDS. An SDS shall accompany each Hazardous Material Usage List (HMUL) item shipped. The contractor shall forward an electronic copy of the SDS to Naval Supply System Command, Weapon Systems Support, N261 Afloat Hazardous Material & Pollution Prevention (NAVSUP WSS N261 Afloat Hazmat) at afloathazmat.wss.fct@us.navy.mil. (CDRL A00N)

3.1.11 Hazardous Material Management

As directed by individual DO, the Contractor shall ensure all Contractor personnel and facilities used in performance of this SOW and individual DO SOWs (including those of subcontractors) satisfy federal, state, and local environmental regulations and statutes. The Contractor shall fully comply with Title 29, Code of Federal Regulations 1910.1200, Hazard Communication Standard and National Aerospace Standard (NAS) 411, Hazardous Material Management Program.

The Contractor shall make every attempt to minimize and restrict the use of hazardous materials and toxic or corrosive substances in the manufacture, operation, and maintenance of the system.

The Contractor shall assess applicable processes, methods, and procedures used in the design, production, inspection, testing, operations, maintenance, and repair of platforms under the ADNS MAC and components to ensure all hazardous materials and hazardous wastes have been identified. The Contractor shall ensure all materials and their use fall within prescribed federal, state, and local limits and procedures for usage and disposal. The Contractor shall give special attention to any known or potential heavy metals and Ozone Depleting Substances (ODS), as well as any substances or materials posing health or safety hazards. The Contractor shall deliver the initial Hazardous Materials Management Program (HMMP) Report/Hazardous Materials Usage List (HMUL) and the associated Material Safety Data Sheets (MSDS) to the Government in accordance with individual DOs. In the event the Contractor identifies any real or potential problem, the Contractor shall notify the Procuring Contracting Officer (PCO) and technical representative in writing of the specific concerns and recommended course of action. (CDRLs A00G, A00N)

3.1.12 Diminishing Manufacturing Sources and Material Shortages As directed by individual DO, the Contractor shall implement a Diminishing Manufacturing Sources and Material Shortages (DMSMS) Program (CDRL A00H). The Contractor shall establish and implement a process to identify and immediately notify the Government of pending and emergent obsolescence issues and emergent vendor implemented changes associated with any hardware or software that is part of any system or component procured under the ADNS MAC at all indentured levels. The data may be obtained progressively during any program life cycle phase using sources such as the preferred parts list, Bill of Materials (BOM), vendor surveys, inspections, etc. The information documented at the part level shall be updated as the design progresses or changes and be sufficient to enable forecasting and management of any associated DMSMS issues.

The Contractor shall establish and implement a process to notify the government of any/all ADNS MAC related vendor product recall announcements from suppliers of materials, modules, and/or products within 24 hours of receiving notification from the OEM/Vendor/Subcontractor.

As directed by individual DO, the Contractor shall deliver report(s) listing all hardware products used in system production and identifies product End of Product and End of Support dates.

The Contractor shall maintain identical configuration for near-term production and make recommendations for life cycle support (e.g. lifetime buy, etc.). Changes implemented by component suppliers without prior knowledge of the Contractor shall be managed in accordance with the Configuration Change Control process. (CDRL A00H)

3.1.13 Configuration Management (CM)

As directed by individual DO, the Contractor shall maintain and manage a Configuration Management (CM) Program. The Contractor’s CM efforts shall include configuration identification, configuration change control, configuration status accounting, configuration verification and audits, and configuration data management. The Contractor shall maintain a CM process capable of processing configuration changes from identification through Government approval and implementation, without impact to production schedules.

3.1.14 End of Life/End of Sale/Support/Service (EOL/EOS)

The Contractor shall notify the Program Office through the PCO and COR that the Contractor knows or has been advised of projected End of Life/ End of Sale/Support/Service (EOL/EOS) timelines for products in the platforms under the ADNS MAC. The notification shall be included in the Contractor’s Progress, Status, and Management (CPSMR) CDRL. The CPSMR shall include the following information: EOL or EOS component name, part number, ADNS drawing number, and impact on production. If there is a stop work due to the EOL/EOS item, the Contractor shall notify the PCO and COR in an email format stating the EOL or EOS component name, part number, and impact on production. In each case, the Contractor shall include the notification as part of the subsequent scheduled TIM presentation materials in accordance with SOW Section 3.1.8. The Government will evaluate the notification for further action. The Government will retain configuration management and decision authority over the PBL. (CDRL A003)

3.1.15 Failure Reporting System

As directed by individual DO, the Contractor shall execute and maintain a single, closed loop Failure Reporting and Corrective Action System (FRACAS) database to track failure history (failures during the testing of production units) procedures for analysis of failures to determine the root cause, and documentation for recording corrective actions taken. The FRACAS database shall be transferred to the Government upon completion of contract. All failures shall be categorized as in-factory (production, assembly, testing) or in-field (post-production, warranty, depot repair) failures. (CDRL A00C)

In the event a failed item is returned subject to a Product Quality Deficiency Report (PQDR), traceability of the PQDR shall be integrated into the FRACAS. The Government reserves the right to conduct an annual Failure Review Board (FRB) to review the data provided per applicable CDRL(s) as directed by individual DOs.

3.1.16 Warranty Performance System

As directed by individual DO, the Contractor shall establish and maintain a commercial warranty performance system that identifies and lists all items warranted under this Contract. Warranty reports shall be provided to the Government concurrently with the final CLIN on each DO and encompass complete warranty data for all applicable CLINs. Each item warranted shall be indexed and identified by item description, serial number, model or part number, and date of acceptance by the Government. The Contractor shall maintain all data required for the Government to pursue warranty provisions, remedy, and relief for each item. The Contractor shall provide data to the Government via Warranty Reports for the duration of the warranty period through the end of the contract lifecycle. The Contractor shall document all warranty claims and transactions and make available for Government review quarterly. The Contractor shall provide flow-through OEM warranties from originating vendors for hardware and software.

(CDRL A00K)

3.1.17 Item Unique Identification (IUID) Compliance Plan

As directed by individual DO, the Contractor shall comply with DoD requirements for Item Unique Identification (IUID). The Contractor shall apply IUID to end items in accordance with the PMW 160 IUID Implementation Plan. The Contractor shall provide DoD Unique Item Identification (UID) in accordance with DFARS clause 252.211-7003. The Contractor shall comply with MIL-STD-130N(1) for IUID of platforms under the ADNS MAC. The Contractor shall label all Configuration Items (CIs) in accordance with the TDPs and IRDs. The Contractor shall generate and deliver a list of all IUID marked parts for platforms under the ADNS MAC.

(CDRLs A00E, A00F)

3.1.18 Information System Security Management

The Contractor shall provide information system security as part of the overall production effort to ensure that Federal, DoD, and Navy security regulations and policies are met; ensure and maintain confidentiality, integrity, and availability of ADNS service domains, information, data, systems, interfaces, and facilities; and to prevent fraudulent use or abuse of the same. The Contractor shall ensure the system complies with the DoN Information Assurance Manual (April 2022).

3.2 ADNS MAC Production (OPN / RDT&E / OM&N / SCN / OCF)

The ADNS MAC provides for the procurement of ADNS end items, to include production units, ancillary kits, sub-systems, assemblies, sub-assemblies, modules, spares and COTS software. All end items shall be sourced, assembled, factory acceptance tested, and delivered in accordance with the Production Baseline, as directed by individual DOs. Production units shall be those ADNS and Airborne routing systems that are a full system intended for an Afloat platform, Shore site, other maritime or aircraft operational unit. Ancillary Kits shall be those ADNS end items requiring assembly but are not full production units. System modules and spares shall be those ADNS end items and Airborne routing systems that do not require assembly. System modules shall include, but are not limited to, ADNS end items, and Airborne routing systems such as COTS software, software licenses, servers, peripherals, switches, routers, and power distribution.

3.2.1 Production Manufacturing

3.2.1.1 Production Units, Sub-Assemblies, Kits, Modules, Components (OPN / RDT&E /

OM&N / SCN / OCF)

As directed by individual DO, the Contractor shall source, assemble, load and configure COTS software, factory acceptance test, and deliver ADNS production units by configuring, fabricating, and installing modules and wire harnesses in accordance with TDPs and other GFI, to include First Articles and Ancillary Kits.

3.2.1.2 Spares (OPN)

As directed by individual DO, the Contractor shall source and deliver ADNS production and installation spares.

3.2.1.3 Lab Equipment (OPN / SCN / OCF / RDT&E)

As directed by individual DO, the Contractor shall source and deliver ADNS lab equipment to include hardware and/or COTS software.

3.2.1.4 Inspection and Acceptance

As directed by individual DO, ADNS production units shall be inspected by DCMA at the Contractor facility. Final inspection and acceptance shall occur at Destination. Acceptance shall occur after the successful passing of a Government-conducted Government Acceptance Test (GAT) to verify that the system produced by the Contractor is sourced, assembled, and delivered in accordance with the ADNS Production Baselines (PBL). Acceptance shall be no later than 30 calendar days after delivery and is contingent upon successful conduct and issue resolution of acceptance activities.

3.2.1.5 COTS Software – Initial (OPN / SCN / RDT&E)

As directed by individual DO, the Contractor shall source and deliver initial COTS software for platforms under the ADNS MAC. Pursuant to the Department of the Navy (DoN) Memorandum:

“Mandatory Use of DoN Enterprise Licensing Agreements (ELA)” dated 22 February 2012, ADNS MAC Contractors are authorized to use Government supply sources in accordance with FAR 52.251-1. As directed by individual DO, the Contractor shall verify if the product is attainable through DoN ELAs and, if so, procure that item in accordance with the appropriate DoN ELA procedures. If a particular item is not attainable through the DoN ELA supply source, the Contractor shall then utilize the Department of Defense (DoD) Enterprise Software Initiative (ESI) program in accordance with DFARS 208.74 and the Government-wide SmartBuy program in accordance with DoD memorandum dated 22 December 2005. If a particular software item is not attainable through a DON ELA or DoD ESI, the Contractor shall propose a means of attaining the particular item(s) to satisfy requirements at the discretion of the Government.

(CDRL A00J)

3.2.1.6 COTS Software – Renewals and Maintenance (OMN / SCN)

As directed by individual DO, the Contractor shall source and deliver COTS software renewals and maintenance for platforms under the ADNS MAC in accordance with the ADNS Initial Software requirements as defined in SOW 3.2.1.5. (CDRL A00J)

3.2.2 Factory Acceptance Test (FAT)

As directed by individual DO, the Contractor shall configure and test the system in accordance with applicable Factory Acceptance Test documents provided with the TDP. (CDRLs A00B, A00C)

3.2.3 Quality Assurance

As part of the initial inspection and to ascertain operational status, the contractor shall allow access to the contractor’s facility and production units by Government appointed representatives.

3.2.4 As-Built Configuration List

As directed by individual DO, the Contractor shall provide a completed As-Built Configuration List (ABCL) indicating all serial numbers of assemblies and subassemblies by populating the As-Built Template in accordance with the instructions provided therein. (CDRL A00D)

3.2.5 License Keys

As directed by individual DO, the Contractor shall compile and deliver all information required to obtain license keys for each ADNS production unit. (CDRL A00J)

3.2.6 Government Furnished Property (GFP) Tracking

As directed by individual DO, the Contractor shall compile and deliver all information required to track Government Furnished Property. (CDRL A005)

3.2.7 Product Validation and Supply Chain Risk Management (SCRM) As directed by individual DO, the contractor shall deliver a Product Validation Report, conduct SCRM activities, and as required provide Post Notification alerts.

3.2.8 Warranty

As directed by individual DO, the contractor shall provide flow-through OEM warranties from originating vendors for hardware and software. (CDRL A00K)

3.2.9 Packaging, Handling, Storage, and Transportability

As directed by individual DO, the Contractor shall perform Packaging, Handling, Storage, and Transportability (PHS&T) activities. (CDRL A00P)

3.2.10 Reliability Documentation

As directed by individual DO, the contractor shall maintain and provide Failure Reporting, Analysis, and Corrective Action System (FRACAS) data to track and report on failure history and the associated corrective actions, in accordance with the FRACAS database described in 3.1.18.

3.2.11 Item Unique Identification (IUID)

As directed by individual DO, the contractor shall comply with DoD requirements for Item Unique Identification (IUID). The contractor shall apply IUID to end items in accordance with the PMW 160 IUID Implementation Plan. The Contractor shall provide DoD unique item identification (UID) in accordance with DFARS clause 252.211-7003. The contractor shall comply with MIL-STD-130N(1) for IUID of ADNS production units. The contractor shall label all Configuration Items (CIs) in accordance with the ADNS TDPs. The contractor shall generate and deliver a list of all IUID marked parts for ADNS production units.

4 ADNS MAC SECURITY MANAGEMENT

The Contractor shall ensure that Federal, DoD, and Navy security regulations and policies are met; ensure and maintain the confidentiality, integrity, and availability of service domains, information, data, systems, interfaces, and facilities; and to prevent the fraudulent use or abuse of the same. All work shall be performed in accordance with DoD and Navy Operations Security (OPSEC) requirements and in accordance with NAVWAR Instruction 5510.1 and the OPSEC attachment to the DD254.

The nature of this task requires access up to SECRET. The work performed by the Contractor will include access up to SECRET data, information and spaces. The Contractor will be required to attend meetings classified up to the SECRET level.

If foreign travel is required, all outgoing Country/Theater clearance message requests shall be submitted to NIWC_PAC_FORTRAV@us.navy.mil for action. A Request for Foreign Travel form shall be submitted for each traveler, in advance of the travel to initiate the release of a clearance message at least 30 days in advance of departure. Each traveler must also submit a Foreign Travel Request and have a Level 1 Antiterrorism/Force Protection briefing within one year of departure and a country specific briefing within 90 days of departure, along with any other required training. The Contractor shall receive Government authorization in advance of any foreign travel.

4.1 Systems Security Plan and Associated Plans of Action

4.1.1 System Security Plan and Plans of Action and Milestones (SSP/POA&M) Reviews

Within thirty (30) days of contract award, the Contractor shall make its System Security Plan(s) (SSPs) for its covered Contractor information system(s) available for review by the Government at the Contractor's facility. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government's review of the SSPs at the Contractor's facility.

If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a Plan of Action and Milestones (POA&M) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POA&M.

Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor's facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

The Government may, in its sole discretion, conduct subsequent reviews at the Contractor's site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of the contract award) and may conduct such reviews at any time upon thirty (30) days’ notice to the Contractor.

4.1.2 Compliance to National Institute of Standards and Technology (NIST) 800-171 The Contractor shall fully implement the CUI Security Requirements and associated Relevant Security Controls in NIST Special Publication 800-171 (Rev. 3) (Reference #23) or establish an SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered Contractor information systems affecting this contract.

Notwithstanding the allowance for such variation, the Contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum (per Reference #24):

1. Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

2. Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the Contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

3. Implement Control 3.1.12 (monitoring and control remote access sessions)

a. Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

4. Audit user privileges on at least an annual basis;

5. Implement:

a. Control 3.13.11 (FIPS 140-3 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-3 Annex A: AES or Triple DES, Reference #28) or compensating controls as documented in a SSP and POAM); and,

b. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

6. Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

7. Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

4.1.3 Cyber Incident Response

The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at https://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx

In delivery of the incident data, the Contractor shall, to the extent practical, remove Contractor-owned information from Government covered defense information.

If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

4.1.4 Naval Criminal Investigative Service (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered Contractor information systems affecting DON programs and technologies.

4.1.5 NCIS/Industry Monitoring

In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the Contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets.

The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.