N0018921Q00150002 Modified Copy.pdf

N6339321RCCC004

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

The purpose for this amendment is to:

1. Attach questions and answ ers from interested vendors.

2. Add 1 CLIN for curriculam development

3. Provide OSRO values

4. Update PWS

1. CONTRACT ID CODE PAGE OF PAGES

J 1 54

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 10-Feb-2021

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X N0018921Q0015

X 9B. DATED (SEE ITEM 11)

15-Jan-2021

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

10-Feb-2021

CODE

NAVSUP FLC NORFOLK CONTRACTING

NORFOLK OFFICE

ATTN: A BARNES

1968 GILBERT STREET STE 600

NORFOLK VA 23511

N00189 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

N0018921Q0015

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

SOLICITATION/CONTRACT FORM

The required response date/time has changed from 17-Feb-2021 02:00 PM to 23-Feb-

2021 02:00 PM.

SUPPLIES OR SERVICES AND PRICES

CLIN 1003

The pricing detail quantity has increased by 5.00 from 35.00 to 40.00.

CLIN 1004

The CLIN description has changed from Oil and Hazard Subs TTX with OSRO Year 1 to OSRO Year 1.

The CLIN extended description has changed from:

One day Oil and Hazardous Substance Spill Tabletop Exercise course with Oil Spill Removal Organization (OSRO)

(A-493-2501) in accordance with the Performance Work Statement (PWS). Course instruction performance may be

"in-person" or "virtual" as required by NAVSAFENVTRACEN.

To:

In accordance with the Performance Work Statement (PWS). Offerors shall use the plug-in government number of

$15,450.00 in price quote.

CLIN 2003

CLIN 2004

The CLIN description has changed from Oil and Hazard Subs TTX with OSRO Year 2 to OSRO Year 2.

One day Oil and Hazardous Substance Spill Tabletop Exercise course with Oil Spill Removal Organization (OSRO)

(A-493-2501) in accordance with the Performance Work Statement (PWS). Course instruction performance may be

In accordance with the Performance Work Statement (PWS). Offerors shall use the plug-in government number of

$15,913.50 in price quote.

CLIN 3003

CLIN 3004

The CLIN description has changed from Oil and Hazard Subs TTX with OSRO Year 3 to OSRO Year 3.

One day Oil and Hazardous Substance Spill Tabletop Exercise course with Oil Spill Removal Organization (OSRO)

(A-493-2501) in accordance with the Performance Work Statement (PWS). Course instruction performance may be

In accordance with the Performance Work Statement (PWS). Offerors shall use the plug-in government number of

$16,390.95 in price quote.

CLIN 4003

CLIN 4004

The CLIN description has changed from Oil and Hazard Subs TTX with OSRO Year 4 to OSRO Year 4.

One day Oil and Hazardous Substance Spill Tabletop Exercise course with Oil Spill Removal Organization (OSRO)

(A-493-2501) in accordance with the Performance Work Statement (PWS). Course instruction performance may be

In accordance with the Performance Work Statement (PWS). Offerors shall use the plug-in government number of

$16,882.70 in price quote.

CLIN 5003

CLIN 5004

The CLIN description has changed from Oil and Hazard Subs TTX with OSRO Year 5 to OSRO Year 5.

One day Oil and Hazardous Substance Spill Tabletop Exercise course with Oil Spill Removal Organization (OSRO)

(A-493-2501) in accordance with the Performance Work Statement (PWS). Course instruction performance may be

In accordance with the Performance Work Statement (PWS). Offerors shall use the plug-in government number of

$17,389.15 in price quote.

CLIN 6004

The CLIN description has changed from Oil and Haz Subs TTX w/ OSRO -8 Opt Ext. to OSRO -8 Opt

Ext..

-8 Option to Extend -One day Oil and Hazardous Substance Spill Tabletop -8 Option to Extend - Exercise course with Oil Spill Removal Organization (OSRO) (A-493-2501) in accordance with the Performance Work Statement

(PWS). Course instruction performance may be "in-person" or "virtual" as required by NAVSAFENVTRACEN.

-8 Option to Extend - In accordance with the Performance Work Statement (PWS). Offerors shall use the plug-in government number of $10,746.48 in price quote.

CLIN 1007 is added as follows:

ITEM NO SUPPLIES/SERVICES MAX

QUANTITY

UNIT UNIT PRICE MAX AMOUNT

1007 1 Job Curriculum Development

FFP

In accordance with the Performance Work Statement (PWS).

FOB: Destination

MILSTRIP: N6339321RCCC004

SIGNAL CODE: J

PSC CD: U099

MAX

NET AMT

DELIVERIES AND PERFORMANCE

The following Delivery Schedule item for CLIN 1003 has been changed from:

DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

POP 03-MAY-2021 TO

02-MAY-2022

N/A NAVAL SAFETY CENTER

GOVERNMENT REPRESENTATIVE

9080 BREEZY POINT CRESCENT

NORFOLK VA 23511

757-445-8778 X347

FOB: Destination

N63393

N/A NAVAL SAFETY CENTER

GOVERNMENT REPRESENTATIVE

9080 BREEZY POINT CRESCENT

NORFOLK VA 23511

757-445-8778 X347

The following Delivery Schedule item for CLIN 1004 has been changed from:

N/A NAVAL SAFETY CENTER

GOVERNMENT REPRESENTATIVE

9080 BREEZY POINT CRESCENT

NORFOLK VA 23511

757-445-8778 X347

N/A NAVAL SAFETY CENTER

GOVERNMENT REPRESENTATIVE

9080 BREEZY POINT CRESCENT

NORFOLK VA 23511

757-445-8778 X347

The following Delivery Schedule for CLIN 1007 has been added:

N/A NAVAL SAFETY CENTER

GOVERNMENT REPRESENTATIVE

9080 BREEZY POINT CRESCENT

NORFOLK VA 23511

757-445-8778 X347

INSPECTION AND ACCEPTANCE

The following Acceptance/Inspection Schedule was added for CLIN 1007:

INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

Destination Government Destination Government

The following Technical Office was added for CLIN 1007:

NAVAL SAFETY CENTER

GOVERNMENT REPRESENTATIVE

9080 BREEZY POINT CRESCENT

NORFOLK VA 23511

The following have been added by full text:

QUESTIONS & ANSWERS

SOLICITATION N0018921Q0015

QUESTIONS & ANSWERS

1. Section 6.1 requires a student/instructor ratio of 30:1. While this may be appropriate in a standard class setting, lower student-to-instructor ratios are necessary for successful exercise/simulation-based training delivery. A maximum ratio of 15:1 would be more appropriate for Incident Command System courses, particularly in the delivery of virtual courses where an instructor is necessary in team breakout rooms to facilitate activities. Will an adjustment to the student/instructor ratio be considered?

ANSWER: The required student to instructor ratio is 30:1. Should the vendor utilize more instructors to reduce this ratio they may do so at their discretion.

2. Section 6.1 requires a student/instructor ratio of 30:1 while Section 12.0 lists a student/ratio of 30:1 for OHSA TTX. Per the Coast Guard’s Emergency & Disaster Management School, their ratio for exercises is 6:1. Will the government consider the addition of instructors/facilitators/coaches to better execute the tabletop exercises?

ANSWER: The required student to instructor ratio is 30:1. Should the vendor utilize more instructors to reduce this ratio they may do so at their discretion.

3. Section 5.1.10.1 requires the contractor to gather completed student critiques from all students. Will the contractor be permitted to withhold Course Completion Certificates until critiques are received to ensure this requirement is met?

ANSWER: Yes

4. Section 6.3 states that the government can exceed class size, on case-by-case basis, at no additional cost. How does the government propose to reimburse the contractor for required class materials (e.g., student guides, Incident Management Handbook, handouts) if students are to be added at no additional cost?

ANSWER: Limit to 30 students. Please see revised PWS removing the referenced language.

The class sizes will be limited to 30 students.

5. Section 12.0 C.1.0 lists ICS 300 as a 2 day course. The requirement to teach the US Coast

Guard’s ICS 300 conflicts with the duration of the current Coast Guard course, which is 4 days. Is the duration proposed an oversight or is there an expectation to remove 2 days’ worth of training from the ICS 300 course?

ANSWER: The expectation is to have the contractor provide a condensed version (2 day course) of the Coast Guard’s curriculum to meet the Navy’s need.

6. Section 12.0, under each course outline, requires the contractor to provide student guides/manuals to each student. Is this requirement for hard copy guides/manuals or would electronic versions be acceptable (e.g., Bring Your Own Device similar to FEMA courses)?

ANSWER: At this time, hard copies are required for resident courses due to connectivity issues at certain training locations. For online classes, the course materials can be provided as a download in the virtual classroom.

7. Section 12.0, under each course outline, requires the contractor to provide a Coast Guard

Incident Management Handbook to each student. Is this requirement for hard copies or would electronic versions be acceptable (e.g., web based IMH or iOS/Android app)?

ANSWER: At this time, hard copies are required for resident courses due to connectivity issues at certain training locations. For online classes, the course materials can be provided as a download in the virtual classroom.

8. Section 12.0 C.4.6 requires the contractor to “retain” the services of an OSRO for the TTX, as well as the deployment of at least 1000-ft of boom and recovery equipment. Can the government provide current copies of current contracts with all localities’ OSROs so we can include that cost basis in our proposal or will this be reimbursed under a separate CLIN (not currently accounted for under the RFQ’s contract line items)?

ANSWER: Each navy region will provide a list of OSRO companies that will be used.

OSRO CLIN’s 1004, 2004, 3004, 4004, 5004, and 6004 were updated to reference the government plug-in value.

9. Section 5.1.6 requires the contractor to use NSC’s training platform, Adobe Connect, for any virtual webinars offered in place of in person training. Will the contractor be given access to

Adobe Connect to build virtual training or will the contractor have to build it off the system then have NSC install it? If designed/built outside of NSC’s LMS, what format would be required for submission?

ANSWER: The navy will provide use of their Sakai/Adobe Learning Management System for online classes, both tools are username/password protected. No CAC is required to access the platforms. The Navy will provide ONE Adobe Connect username/password. The content presented in Adobe Connect can be pre-built using MS Power Point. If needed the contractor can use the Navy’s Learning Portal (Sakai) to support the webinar (Adobe Connect) portion of the course. The Learning Portal will allow the student to download resources, take assessments, and access a course certificate.

10. Section 5.1.6 requires the contractor to use NSC’s training platform, Adobe Connect, for any virtual webinars offered in place of in person training. Does this solicitation include development time to convert existing or new courses to virtual to meet any direction to provide virtual courses in lieu of classroom?

ANSWER: A CLIN was added to the solicitation for curriculum development. Reference

CLIN 1008.

11. In the event that a course is required to be delivered virtually, will the government allow and pay for the use of a technical expert to “drive” Adobe Connect in the background, thereby allowing instructors to focus on teaching?

ANSWER: The unit price for the virtual training is Firm Fixed Price and should be inclusive of all projected costs.

12. Section 6.2 allows the government to exceed each class size. Will the government compensate for additional instructors in the event that established student/instructor ratios are exceeded?

ANSWER: Limit to 30 students. Please see revised PWS removing the referenced language.

The class sizes will be limited to 30 students.

13. Section 7.1.4 refers to “established” instructors and the transition of new instructors. What are the criteria for defining “established” instructors?

ANSWER: An established instructor has attended the course, has been approved to teach independently, and is knowledgeable of all course material.

14. Section 7.4 requires two instructors per training event: one to teach and one on standby in case the instructor is unable to complete a course. Will the government pay for the standby instructor to account for lost opportunity costs employing them elsewhere?

ANSWER: The unit price for the virtual training is Firm Fixed Price and should be inclusive of all projected costs.

15. Section 9.3 requires training for instructors but is silent on whether the contractor will be compensated for this required training. Please advise whether compensated and approximately time required for this training. Is this training included in the Human Rights

Training outlined in 5.2.5?

ANSWER: The Contractor should include the cost of training in the overall fixed price of the courses. Training should take 1 hour or less to complete.

16. Course outlines in Section 12.0 recommend personnel be trained to certain ICS levels, but do not list prerequisites for courses. Are there any prerequisites (e.g., ICS100 and ICS200 for

ICS 300; ICS 100/200/300/700/800 for ICS400)? Understanding prerequisites will better enable contractors to maintain expectations of baseline student knowledge and develop course materials appropriately without repeating lower level courses instructional material.

ANSWER: Prerequisites can be found at the following website: https://www.fema.gov

17. Section 12.0 paragraph C.3.0 lists ICS 400 as an 8 hour course. FEMA’s version is 15 hours of instruction and the US Coast Guard’s version is 14 hours. Assuming that the contractor is to provide instruction on the US Coast Guard’s ICS 400, is the course length an error/oversight? C.3.6.1 does not advise the contractor to cut portions of the USCG course to meet time limitations.

ANSWER: The expectation is to have the contractor provide a condensed version (1 day course) of the Coast Guard’s curriculum to meet the Navy’s need.

18. C.1.4 – Will the materials furnished by the government be available in each classroom prior to the start of the training, or will the contractor personnel need to arrange for it to be delivered to the classroom?

ANSWER: Contractor will arrange with course manager prior to start of class.

19. C.1.6.2 – Is the “interactive spill response computer application” referred to in this section supplied by the contractor or the government? Which application is currently used or preferred by the government?

ANSWER: Supplied by Contractor, current contractor is using Pisces.

20. Addendum to FAR 52.212-1, Price Quote, c. “Unless completed in SAM, RFQ Section, Representations, Certifications and Other Statements of Contractors…” May contractor submit an affirmative statement within the proposal that they are registered and have completed the Reps & Certs in SAM?

ANSWER: Yes, however a Contractor is encouraged to ensure the representations within the

RFQ that may be more recent than the last SAMs update be completed in the RFQ (ie

52.204-24, 252.204-7018, 7019, 7020.)

21. Addendum to FAR 52.212-1, Price Quote, d. Wage Determination. Because the location of the course deliveries vary, should contractor us their main office location as their “primary location” to ensure submitted pricing is in compliance?

ANSWER: Yes, use quoter’s primary location.

22. Addendum to FAR 52.212-1, Price Quote, a. A completed Section B “Supplies or Services and Price” shall be inclusive of all costs. Can the government please identify what is included in Section B Supplies or Services and Price? Is the government referring to pages

33-51 of the RFQ?

ANSWER: Supplies/Services can be found on pages 32-50 of the solicitation

23. Will the government consider back-to-back delivery of training courses when possible? For example, conducting an ICS-300 followed immediately by an ICS-400 course when the delivery location and participants are unchanged?

ANSWER: Yes, when possible.

24. Will the government consider scheduling training by delivery locations to realize efficiencies and decrease travel expenses, when possible?

ANSWER: Yes, when possible.

25. Please confirm that the contractors’ background investigation requirements and security approval process under this solicitation is limited to Unclassified and Non-Sensitive Duties.

ANSWER: Contractors shall be required to undergo a T1 investigation.

26. Can the government provide an estimated timeframe for contractor personnel to complete the required online training outlined in 5.2.5?

ANSWER: Covered in the 30 day start-up period.

27. Please confirm that this contract will not be excluded based on Product Service Codes from the reporting requirements outlined in 11.0.

ANSWER: No, U099 is the Product Service Code for this requirement

28. Will the government consider extending the due date of proposals to allow Contractors sufficient time to analyze the government’s answers to all questions and incorporate them into our proposal?

ANSWER: Yes, we extended the due date for quotes. Please reference block 8 on the solicitation.

29. Page 60 of the RFP contains the following instruction for the Bid Submission:

Quotes shall include the following legend on each page:

Source Selection Information

FAR 2.101 and FAR 3.104

I am not sure what is meant by this and where to place it in the document

ANSWER: You may put this verbiage in a footer at the bottom of each page.

30. Previous Iterations of this contract (N00189-16-D-0029 and N00-189-11-T-0013) had a

CLIN for the Spanish Liability Insurance. There is not a specific item in this RFP. Is the

Spanish Liability Insurance Cost to be charge under Travel and Per Diem Expense

ANSWER: The solicitation will not contain a separate CLIN for Spanish Liability Insurance.

This is a FFP contract that should include all projected costs.

252.204-7019 NOTICE OF NIST SP 800-171 DOD ASSESSMENT REQUIREMENTS (NOV 2020)

(a) Definitions.

Basic Assessment, Medium Assessment, and High Assessment have the meaning given in the clause 252.204-7020, NIST SP 800-171 DoD Assessments.

Covered contractor information system has the meaning given in the clause 252.204-7012, Safeguarding Covered

Defense Information and Cyber Incident Reporting, of this solicitation.

(b) Requirement. In order to be considered for award, if the Offeror is required to implement NIST SP 800-171, the

Offeror shall have a current assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) (see 252.204-7020) for each covered contractor information system that is relevant to the offer, contract, task order, or delivery order. The Basic, Medium, and High NIST SP 800-171 DoD Assessments are described in the NIST SP 800-171 DoD Assessment Methodology located at https://www.acq.osd.mil/dpap/pdi/cyber/strategically_assessing_contractor_implementation_of_NIST_SP_800-

171.html.

(c) Procedures.

(1) The Offeror shall verify that summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) are posted in the Supplier Performance

Risk System (SPRS) (https://www.sprs.csd.disa.mil/) for all covered contractor information systems relevant to the offer.

(2) If the Offeror does not have summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) posted in SPRS, the Offeror may conduct and https://www.acq.osd.mil/dpap/pdi/cyber/strategically_assessing_contractor_implementation_of_NIST_SP_800-171.html https://www.acq.osd.mil/dpap/pdi/cyber/strategically_assessing_contractor_implementation_of_NIST_SP_800-171.html https://www.sprs.csd.disa.mil/ submit a Basic Assessment to webptsmh@navy.mil for posting to SPRS in the format identified in paragraph (d) of this provision.

(d) Summary level scores. Summary level scores for all assessments will be posted 30 days post-assessment in

SPRS to provide DoD Components visibility into the summary level scores of strategic assessments.

(1) Basic Assessments. An Offeror may follow the procedures in paragraph (c)(2) of this provision for posting Basic

Assessments to SPRS.

(i) The email shall include the following information:

(A) Cybersecurity standard assessed (e.g., NIST SP 800-171 Rev 1).

(B) Organization conducting the assessment (e.g., Contractor self-assessment).

(C) For each system security plan (security requirement 3.12.4) supporting the performance of a DoD contract--

(1) All industry Commercial and Government Entity (CAGE) code(s) associated with the information system(s) addressed by the system security plan; and

(2) A brief description of the system security plan architecture, if more than one plan exists.

(D) Date the assessment was completed.

(E) Summary level score (e.g., 95 out of 110, NOT the individual value for each requirement).

(F) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(ii) If multiple system security plans are addressed in the email described at paragraph (d)(1)(i) of this section, the

Offeror shall use the following format for the report:

Brief

CAGE codes description of Date of Total Date score of

System security plan supported by this the plan assessment score 110 will plan architecture achieved

(2) Medium and High Assessments. DoD will post the following Medium and/or High Assessment summary level scores to SPRS for each system assessed:

(i) The standard assessed (e.g., NIST SP 800-171 Rev 1).

(ii) Organization conducting the assessment, e.g., DCMA, or a specific organization (identified by Department of

Defense Activity Address Code (DoDAAC)).

(iii) All industry CAGE code(s) associated with the information system(s) addressed by the system security plan.

mailto:webptsmh@navy.mil

(iv) A brief description of the system security plan architecture, if more than one system security plan exists.

(v) Date and level of the assessment, i.e., medium or high.

(vi) Summary level score (e.g., 105 out of 110, not the individual value assigned for each requirement).

(vii) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(3) Accessibility.

(i) Assessment summary level scores posted in SPRS are available to DoD personnel, and are protected, in accordance with the standards set forth in DoD Instruction 5000.79, Defense-wide Sharing and Use of Supplier and

Product Performance Information (PI).

(ii) Authorized representatives of the Offeror for which the assessment was conducted may access SPRS to view their own summary level scores, in accordance with the SPRS Software User's Guide for Awardees/Contractors available at https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf.

(iii) A High NIST SP 800-171 DoD Assessment may result in documentation in addition to that listed in this section.

DoD will retain and protect any such documentation as "Controlled Unclassified Information (CUI)" and intended for internal DoD use only. The information will be protected against unauthorized use and release, including through the exercise of applicable exemptions under the Freedom of Information Act (e.g., Exemption 4 covers trade secrets and commercial or financial information obtained from a contractor that is privileged or confidential).

(End of provision)

252.204-7020 NIST SP 800-171 DOD ASSESSMENT REQUIREMENTS (NOV 2020)

(a) Definitions.

Basic Assessment means a contractor's self-assessment of the contractor's implementation of NIST SP 800-171 that-

(1) Is based on the Contractor's review of their system security plan(s) associated with covered contractor information system(s);

(2) Is conducted in accordance with the NIST SP 800-171 DoD Assessment Methodology; and

(3) Results in a confidence level of "Low" in the resulting score, because it is a self-generated score.

Covered contractor information system has the meaning given in the clause 252.204-7012, Safeguarding Covered

Defense Information and Cyber Incident Reporting, of this contract.

High Assessment means an assessment that is conducted by Government personnel using NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information that--

(1) Consists of--

(i) A review of a contractor's Basic Assessment;

(ii) A thorough document review;

https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf

(iii) Verification, examination, and demonstration of a Contractor's system security plan to validate that NIST SP

800-171 security requirements have been implemented as described in the contractor's system security plan; and

(iv) Discussions with the contractor to obtain additional information or clarification, as needed; and

(2) Results in a confidence level of "High" in the resulting score.

Medium Assessment means an assessment conducted by the Government that--

(1) Consists of--

(i) A review of a contractor's Basic Assessment;

(ii) A thorough document review; and

(iii) Discussions with the contractor to obtain additional information or clarification, as needed; and

(2) Results in a confidence level of "Medium" in the resulting score.

(b) Applicability. This clause applies to covered contractor information systems that are required to comply with the

National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, in accordance with

Defense Federal Acquisition Regulation System (DFARS) clause at 252.204-7012, Safeguarding Covered Defense

Information and Cyber Incident Reporting, of this contract.

(c) Requirements. The Contractor shall provide access to its facilities, systems, and personnel necessary for the

Government to conduct a Medium or High NIST SP 800-171 DoD Assessment, as described in NIST SP 800-171

DoD Assessment Methodology at https://www.acq.osd.mil/dpap/pdi/cyber/strategically_assessing_contractor_implementation_of_NIST_SP_800-

171.html, if necessary.

(d) Procedures. Summary level scores for all assessments will be posted in the Supplier Performance Risk System

(SPRS) (https://www.sprs.csd.disa.mil/) to provide DoD Components visibility into the summary level scores of strategic assessments.

(1) Basic Assessments. A contractor may submit, via encrypted email, summary level scores of Basic Assessments conducted in accordance with the NIST SP 800-171 DoD Assessment Methodology to webptsmh@navy.mil for posting to SPRS.

(i) The email shall include the following information:

(A) Version of NIST SP 800-171 against which the assessment was conducted.

(B) Organization conducting the assessment (e.g., Contractor self-assessment).

(C) For each system security plan (security requirement 3.12.4) supporting the performance of a DoD contract--

(1) All industry Commercial and Government Entity (CAGE) code(s) associated with the information system(s) addressed by the system security plan; and

(2) A brief description of the system security plan architecture, if more than one plan exists.

(D) Date the assessment was completed.

(E) Summary level score (e.g., 95 out of 110, NOT the individual value for each requirement).

https://www.acq.osd.mil/dpap/pdi/cyber/strategically_assessing_contractor_implementation_of_NIST_SP_800-171.html https://www.acq.osd.mil/dpap/pdi/cyber/strategically_assessing_contractor_implementation_of_NIST_SP_800-171.html https://www.sprs.csd.disa.mil/

(F) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(ii) If multiple system security plans are addressed in the email described at paragraph (b)(1)(i) of this section, the

Contractor shall use the following format for the report:

Brief

CAGE codes description of Date of Total Date score of

System security plan supported by this the plan assessment score 110 will plan architecture achieved

(2) Medium and High Assessments. DoD will post the following Medium and/or High Assessment summary level scores to SPRS for each system security plan assessed:

(i) The standard assessed (e.g., NIST SP 800-171 Rev 1).

(ii) Organization conducting the assessment, e.g., DCMA, or a specific organization (identified by Department of

Defense Activity Address Code (DoDAAC)).

(iii) All industry CAGE code(s) associated with the information system(s) addressed by the system security plan.

(iv) A brief description of the system security plan architecture, if more than one system security plan exists.

(v) Date and level of the assessment, i.e., medium or high.

(vi) Summary level score (e.g., 105 out of 110, not the individual value assigned for each requirement).

(vii) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(e) Rebuttals. (1) DoD will provide Medium and High Assessment summary level scores to the Contractor and offer the opportunity for rebuttal and adjudication of assessment summary level scores prior to posting the summary level scores to SPRS (see SPRS User's Guide https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf).

(2) Upon completion of each assessment, the contractor has 14 business days to provide additional information to demonstrate that they meet any security requirements not observed by the assessment team or to rebut the findings that may be of question.

(f) Accessibility.

(1) Assessment summary level scores posted in SPRS are available to DoD personnel, and are protected, in accordance with the standards set forth in DoD Instruction 5000.79, Defense-wide Sharing and Use of Supplier and

Product Performance Information (PI).

(2) Authorized representatives of the Contractor for which the assessment was conducted may access SPRS to view their own summary level scores, in accordance with the SPRS Software User's Guide for Awardees/Contractors available at https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf.

(3) A High NIST SP 800-171 DoD Assessment may result in documentation in addition to that listed in this clause.

DoD will retain and protect any such documentation as "Controlled Unclassified Information (CUI)" and intended for internal DoD use only. The information will be protected against unauthorized use and release, including through the exercise of applicable exemptions under the Freedom of Information Act (e.g., Exemption 4 covers trade secrets and commercial or financial information obtained from a contractor that is privileged or confidential).

(g) Subcontracts.

(1) The Contractor shall insert the substance of this clause, including this paragraph (g), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items (excluding COTS items).

(2) The Contractor shall not award a subcontract or other contractual instrument, that is subject to the implementation of NIST SP 800-171 security requirements, in accordance with DFARS clause 252.204-7012 of this contract, unless the subcontractor has completed, within the last 3 years, at least a Basic NIST SP 800-171

DoD Assessment, as described in https://www.acq.osd.mil/dpap/pdi/cyber/strategically_assessing_contractor_implementation_of_NIST_SP_800-

171.html, for all covered contractor information systems relevant to its offer that are not part of an information technology service or system operated on behalf of the Government.

(3) If a subcontractor does not have summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) posted in SPRS, the subcontractor may conduct and submit a Basic Assessment, in accordance with the NIST SP 800-171 DoD Assessment Methodology, to webptsmh@navy.mil for posting to SPRS along with the information required by paragraph (d) of this clause.

(End of clause)

The following have been modified:

PERFORMANCE WORK STATEMENT

The matrix below depicts the estimated number of convenings of each course that may be needed in each year of the contract:

Course

Base

Year

1st

Option

2nd

Option

3rd

Option

4th

Option

ICS 300 20 20 20 20 20

ICS 300 Refresher 35 35 35 35 35

OHSTTX 35 35 35 35 35

OHSTTX with OSRO 5 5 5 5 5

ICS 400 5 5 5 5 5

It is emphasized that the number of classes is only an estimate since the actual number of classes held is controlled by the need of students to receive this training and funding constraints.

Training schedules are planned on a year to year basis and the contractor will be notified at least thirty (30) days prior to the beginning of each fiscal year as to the number and locations where https://www.acq.osd.mil/dpap/pdi/cyber/strategically_assessing_contractor_implementation_of_NIST_SP_800-171.html https://www.acq.osd.mil/dpap/pdi/cyber/strategically_assessing_contractor_implementation_of_NIST_SP_800-171.html the training will be held. Classes may be held, for example, in the following locations:

CONUS:

ANNAPOLIS, MD KINGSBAY, GA

BANGOR, WA KINGSVILLE, TX

BREMERTON, WA MAYPORT, FL

CHARLESTON, SC MEMPHIS, TN

COLTS NECK, NJ MERIDIAN, MS

CORPUS CHRISTI, TX NEW ORLEANS, LA

CRANE, IN NEWPORT, RI

DAHLGREN, VA NORFOLK, VA

EARLE, NJ PANAMA CITY, FL

EVERETT, WA PATUXENT RIVER, MD

FALLON, NV PENSACOLA, FL

FORT WORTH, TX PHILADELPHIA, PA

GROTON, CT PORTSMOUTH, NH

GREAT LAKES, IL SAN DIEGO, CA

GULFPORT, MS VENTURA COUNTY, CA

INDIAN HEAD, MD WASHINGTON DC

JACKSONVILLE, FL WHIDBEY ISLAND, WA

KEY WEST, FL WHITING FIELD, FL

Enclosure (1)

OCONUS:

ATSUGI, JAPAN

BAHAMAS, ANDROS ISLAND NAPLES ITALY

BAHRAIN OKINAWA

CHINHAE, KOREA PEARL HARBOR, HAWAII

DIEGO GARCIA POLAND

DIJIBOUTI REPUBLIC OF SINGAPORE

GUAM ROTA, SPAIN

GUANTANAMO BAY, CUBA SASEBO, JAPAN

SIGONELLA, ITALY IWAKUNI, JAPAN

SOUDA BAY, GREECE YOKOSUKA, JAPAN

DEVESELU, ROMANIA

KEFLAVIC, ICELAND

1.0 Scope of Work

The contractor shall provide services for the Naval Safety and Environmental Training

Center, Norfolk, VA. These services shall provide instruction for the safety, occupational health, and environmental courses described below conducted by the Naval Safety and Environmental

Training Center (NAVSAFENVTRACEN) and student record keeping support typical for educational programs as set forth by NAVSAFENVTRACEN.

2.0 Mission

The mission of the NAVSAFENVTRACEN is to provide quality education and training for military and civilian Navy and Marine Corps personnel, both afloat and ashore, in the areas of occupational safety, environmental protection, and emergency management leading to:

• Enhanced operational readiness

• A safe and healthful workplace

• Stewardship through compliance with applicable regulations

3.0 Definitions

3.1 List of Commonly Used Acronyms

BOA Basic Ordering Agreement

CFR Code of Federal Regulations

CIH Certified Industrial Hygienist

CIN Course Identification Number

CDO Chief Duty Officer

CNO Chief of Naval Operations

CONUS Continental United States

COR Contracting Officer’s Representative

CP Contingency Plan

CSP Certified Safety Professional

DESC Defense Energy Support Center

DOD Department of Defense

DON Department of the Navy

DOT Department of Transportation

EOC Emergency Operations Center

EPA Environmental Protection Agency

FEMA Federal Emergency Management Agency

FGS Final Governing Standards

FIC Facility Incident Commander

FRP Facility Response Plan

GFE Government Furnished Equipment

GFI Government Furnished Items

HAZWOPER Hazardous Waste Operations and Emergency Response

HS Hazardous Substance

IAP Incident Action Plan

IC Incident Command

ICP Integrated Contingency Plan/Incident Command Post

ICS Incident Command System

ITO Installation Training Officer

NAVFAC Naval Facilities Engineering Command

NCP National Contingency Plan

NIMS National Incident Management System

NMETS Navy Mission Essential Tasks

NOAA National Oceanographic and Atmospheric Administration

NOSC Navy On-Scene Coordinator

NRCC Navy Regional Contracting Center

NRDA Natural Resources Damage Assessment

NRF National Response Framework

NRP National Response Plan

NRS National Response System

OCONUS Outside of Continental United States

OEBGD Overseas Environmental Baseline Guidance Document

OHS Oil and Hazardous Substance

OPA Oil Pollution Act

OSHA Occupational Safety and Health Administration

OSRO Oil Spill Removal Organization

PREP Preparedness for Response Exercise Program

QCP Quality Control Plan

RFP Request for Proposal

ROC Regional Operations Center

RFS Request for Support

SME Subject Matter Expert

SMT Spill Management Team

SOH Safety and Occupational Health

SOW Statement of Work

SPCR Spill Prevention Control and Reporting Plan

SUPSALV Supervisor of Salvage and Diving

TTX Tabletop Exercise

UC Unified Command

USCG United States Coast Guard

VCR Video Cassette Recorder

3.2 A demonstration is a method of instruction whereby the instructor(s) actually performs the procedures or tasks that are being reviewed.

3.3 A workshop is a method of instruction whereby the students are allowed to perform the procedures or tasks that have been demonstrated to them by the instructor(s).

Workshops must be accomplished under the supervision of the instructor(s).

3.4 Training equipment is material that Safety and Occupational Health (SOH) and environmental professionals may encounter in the performance of their duties, i.e., respirators, monitoring equipment, protective clothing, etc.

3.5 Formal teaching experience is defined as time spent by an instructor in front of a classroom of students conducting training from a lesson plan. The training may take the form of lectures, oversight of students working in groups, working with students in a one-on-one basis in the resolution of academic problems, using audiovisual hardware and software in the presentation of a topic, supervising students during field exercises, etc.

4.0 Deliverable Product

4.1 The contractor shall provide training for NAVSAFENVTRACEN using both contractor-owned/provided and government provided learning materials, equipment and methodologies to produce a graduate that satisfies the Center's mission and the learning objectives contained in the course outline.

5.0 General Conditions

5.1 General

5.1.1 All personnel employed by the contractor entering the government-furnished facilities shall conform to all safety, security, work conditions, regulations and procedures which may be in effect during the contract period and shall be subject to such checks as may be deemed necessary to assure that no violations occur. No employee will be permitted on the government-furnished facilities when such check reveals that the employee's presence would be detrimental to the security of the facilities or accomplishment of work.

5.1.2 Contractor personnel assigned to teach a course shall have expertise in the subject area and instructional experience. The personnel shall be familiar with all initial presentation and remediation procedures, training aids, devices and equipment associated with the course and shall be evaluated by both the contractor and government. Contractor instructors will be evaluated by government SMEs and by student critiques.

5.1.3 All contractor technical instructors and technical instructor supervisors shall abide by the rules and regulations concerning the maintenance of personal standards for instructor integrity, grooming, conduct, speech, and student fraternization. The motivation of student and instructional personnel must be maintained at a high level to ensure a favorable learning environment.

5.1.4 Contractors are to provide all training materials used in the course, including instructor lesson plans, student handouts, references, charts, manuals, tests, audiovisual aids, and training equipment unless otherwise specified in the PWS. Contractors may prepare materials or use their already existing course materials, modified as necessary, to conduct the training in accordance with the PWS. Materials produced or used by the contractor, with the exception of handouts provided for student retention, remain the property of the contractor and do not become property of the government unless they were provided to the contractor by the government.

5.1.5 There is no predetermined list of training equipment, handouts, audiovisual aids, references (other than those cited in the course outline), manuals, etc., to be used in the courses unless otherwise specified in the PWS. However, the use of computer-generated graphics (e. g., PowerPoint) to supplement lectures is required. The selection of these materials is at the discretion of the contractor. It is required, however, that the course will use training equipment (see definition of training equipment in paragraph 3.4), handouts (may be included as a part of the student guide/manual), and other audiovisual aids, e.g., digital video disk.

5.1.6 The government will provide classroom space, with chalk/dry marker boards and standard audiovisual equipment for the course when available. For classes taught in

Norfolk, the government will provide projection systems for computer-generated graphics.

However, for locations other than Norfolk, the contractor is responsible to provide a projection system and computer laptop unless the course supervisor indicates that this equipment is available at that location. Classes may be taught in webinar format when resident classroom training is not feasible due to pandemics, natural disasters or emergent situations. When virtual training is required, the contractor shall be expected to convert the residence course to a virtual/webinar format using the Navy Safety Center training platform, Adobe Connect, for virtual course delivery.

5.1.7 Contractors are to include all topics/discussion points contained in the course outlines. Deviation is allowed only as indicated in paragraph 11.0(c).

5.1.8 The awarding of Continuing Education Units (CEUs) and/or CIH/CSP

Certification Maintenance Points shall be the responsibility of NAVSAFENVTRACEN and not that of the contractor. However, the contractor may be requested to provide certain course data so that course certification may be obtained.

5.1.9 In all instances of disciplinary matters between contract employees and government personnel, the contractor shall prepare a written report to the COR which includes a summary of the events. A formal contractor investigation is not required.

5.1.10 The contractor shall submit to the COR a course completion report within thirty (30) days after the end of each class convening. The report shall include, as a minimum, a student attendance roster, student data records (if necessary), student critiques, drop/failure records (if applicable), and instructor comments/observations. The student attendance roster shall be faxed or emailed to the NAVSAFENVTRACEN at the conclusion of the last day of the course.

5.1.10.1 Contractor shall ensure student data records (if necessary), attendance roster and student critiques are completed by all students. The contractor shall fax or email the attendance roster to the NAVSAFENVTRACEN at the end of the last day of class.

5.1.10.2 Contractor shall complete a Drop/Failure Record (government provided) for each student who does not complete the course for other than academic reasons.

5.1.10.3 The contractor shall complete a Course Completion Certificate for each student who successfully completes the course. These certificates shall be filled out by the contractor at the end of each course and passed out to students who have successfully completed the course. In the event that certificates cannot be given to the students at the conclusion of the course, it is the responsibility of the contractor to make arrangements to ensure the students receive their certificates. Course completion certificates shall be kept under careful control by the contractor and only issued directly to the student successfully completing the course. Any unused certificates may either be retained by the contractor for future classes, or properly destroyed.

5.1.11 Attendance Policy

Any student missing more than 20% of a class will fail the course and not receive a graduation certificate. The contract instructor should contact the COR or course supervisor immediately to discuss the student's situation. The government retains the right to make the final decision on whether or not a student will be allowed to stay for the remainder of the course.

5.1.12 Submission of Invoices

All invoices for completed course of instruction shall be submitted to the

COR within five (5) working days after return from travel and then input to WAWF. Submitted invoices shall include the fixed price cost for the convenings taught, as well as any reimbursement for travel and per diem.

5.2 Security

5.2.1 The courses taught under this contract are unclassified.

5.2.2 Permits/Decals

Each contract instructor/manager shall obtain a permit/decal as required by the visited activity security office as necessary to enter the work sites.

5.2.3 Security Requirements

The contractor shall conform to all DOD, DON, and local security instructions.

5.2.4 Physical Security/Key Control

The contractor shall conform to all current and applicable DOD, DON, and local command instructions regarding physical security and key control. The contractor shall maintain key control over assigned keys.

5.2.5 Personal Security/Anti-Terrorist

After award of the contract, the contractor shall become knowledgeable of all current DOD, DON, State Department and local command instructions pertaining to personnel security, force protection, and anti-terrorism issues. This will require each instructor to complete required training and forms such as Level One Anti-Terrorism Training, Survival, Evasion, Resistance, and Escape (SERE) 100 Code of Conduct Level B Training, Human Rights

Training, Country Specific and Isolated Personnel Report (ISOPREP) also known as a PRO-file within the time frames required by the guiding regulations. Training will be accomplished either on-line or through other means as arranged by the contractor and the NAVSAFENVTRACEN.

The completion of such training shall be reported to the COR and course supervisor. The contractor shall not receive any compensation for this training. Periodic refresher training is required.

5.3 Safety

The contractor shall conform/comply with all referenced safety instructions. Any safety related problems shall be addressed immediately to the COR.

5.4 Accident Reports

The contractor shall conduct an investigation into all accidents occurring on government property involving contract employees and report the findings in writing of such an investigation to the COR within three (3) calendar days after the occurrence. When required, the contractor shall provide input for reporting accidents involving students.

5.5 Contract Work Hours

Classes typically begin at 0730 and end at 1600 on each day with a ten (10) minute break every hour and an hour for lunch. Occasional non-standard training days may be required by emergencies, and/or base operational commitments. In these cases, as much prior notification as possible will be provided to the contractor. However, the course is designed for whole days and shall not vary substantially from this format, e.g., ending after a half-day on the last day, two-hour lunches or ending class two hours early on days in the middle of the week.

Likewise, extending past the normal ending time can only be done with the student’s concurrence since many students may have off-hour commitments. Holidays shall be limited to those normally scheduled for the United States federal government employees. Legal holidays for the purpose of this contract are:

New Year's Day Labor Day

Martin Luther King Day…