RFP N0018922RR0120001.pdf

N0018922RR012

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment includes:

- Changed offer due date

- Added ODC CLINs

- Amended 52.212-1 Addendum and 52.212-2 and deleted 52.212-1(e)

- Revised PWS including added new Section 7 and revised new Section 8

- Revised Attachment 1 Pricing Spreadsheet and added new Attachment 3 Past Performance Report Form

- Amended contract ceiling amount

- Amended the follow ing NAVSUP local text: "Contractor Unclassif ied Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information"

1. CONTRACT ID CODE PAGE OF PAGES

J 1 41

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 18-Feb-2022

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street , County, State and Zip Code) X N0018922RR012

X 9B. DATED (SEE ITEM 11)

21-Jan-2022

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer X is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

18-Feb-2022

CODE

NAVSUP FLC NORFOLK CONTRACTING

MECHANICSBURG OFFICE

MARK STUMPO CODE 216

5450 CARLISLE PIKE, SUITE 407-WSD10

MECHANICSBURG PA 17050-2411

N00189 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

SOLICITATION/CONTRACT FORM

The required response date/time has changed from 23-Feb-2022 03:00 PM to 25-Feb-

2022 03:00 PM.

SUPPLIES OR SERVICES AND PRICES

CLIN 0002

The pricing detail quantity 667,299.86 has been added.

CLIN 1002

The pricing detail quantity 60,663.62 has been added.

CLIN 0003 is added as follows:

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0003 250,000 Lot Base Ordering Period ODCs

COST

FOB: Destination

PSC CD: DJ01

ESTIMATED COST

CLIN 1003 is added as follows:

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

1003 25,000 Lot OPTION FAR 52.217-8 ODCs

COST

FOB: Destination

PSC CD: DJ01

ESTIMATED COST

INSPECTION AND ACCEPTANCE

The following Acceptance/Inspection Schedule was added for CLIN 0003:

INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

N/A N/A N/A Government

The following Acceptance/Inspection Schedule was added for CLIN 1003:

INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

N/A N/A N/A Government

The following have been added by full text:

SUPTXT204-9400(3-19)

THE FOLLOWING NAVSUP LOCAL TEXT IS HEREBY MADE PART OF THE STATEMENT OF

WORK/PERFORMANCE WORK STATEMENT.

Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information

Executive Order 13467, Reforming Processes Related to Suitability for Government Employee, Fitness for Contractor Employees and Eligibility for Access to Classified National Security Information, Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 Part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense (OSD), the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy command under this contract is required to obtain a DoD CAC. Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager (CSM) upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

START-UP PERIOD

All contractor resource onboarding documents must be submitted via the prime contractor. The prime contractor shall make all necessary preparations to assume full responsibility for productive performance as of the performance start date.

Definition of “productive”:

a. Visit Authorization Request (VAR)

b. Contractor Information Sheet (CIS)

c. FD-258 Fingerprint Card

d. Completed Electronic Investigation (EQIP)

e. All contractor resource(s) must have an active Joint Personnel Adjudication System (JPAS) profile

f. Common Access Card(CAC)

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services and no reimbursement will be paid by the government for efforts expended during the start-up period.

Note (2): Foreign Nationals are not allowed access to the functional/system side of Enterprise Resource Planning (ERP).

ACCESS TO DOD INFORMATION TECHNOLOGY (IT) SYSTEM

In Accordance With (IAW) Secretary of the Navy (SECNAV) M-5510.30, contractor employees who require access to Department of the Navy (DoN) or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to sensitive information. Sensitive information includes information protected under the Privacy Act, to include PHI. All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity's Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check (NAC) with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance (IA) Technical Level 1, and must be trained and certified on the Operating System (OS) or Computing Environment (CE) they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy CSM and ISSM/IAM manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy IT resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the Contracting Officers Representative (COR) shall sign the SAAR-N as the supervisor.

The SAAR-N shall be forwarded to the CSM at least thirty (30) days prior to the individual's start date. Failure to provide the required documentation at least thirty (30) days prior to the individual's start date may result in delaying the individual's start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Cyber Awareness training, and maintain a current requisite background investigation. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

INTERIM ACCESS

The CSM may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the contractor's security representative. Within three (3) work days after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the contractor's security representative. The contractor's security representative shall be the primary point of contact on any security matter. The contractor's security representative shall not be replaced or removed without prior notice to the Contracting Officer and CSM.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR

CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE

DUTIES

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and PHI, provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

SF-86 Questionnaire for National Security Positions (or equivalent Office of Personnel Management (OPM) investigative product)

Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission

Original Signed Release Statements

Failure to provide the required documentation at least thirty (30) days prior to the individual's start date shall result in delaying the individual's start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than ten (10) years) throughout the contract performance period. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the CSM upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy command's ISSM/IAM. Completion and approval of a SAAR-N form is required for all individuals accessing Navy IT resources. The SAAR-N shall be forwarded to the Navy CSM at least thirty (30) days prior to the individual's start date. Failure to provide the required documentation at least thirty (30) days prior to the individual's start date shall result in delaying the individual's start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Cyber Awareness training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the CSM. The CSM will review the submitted documentation for completeness prior to submitting it to the OPM; Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The CSM will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a VAR via the JPAS or a hard copy VAR directly from the contractor's security representative.

Although the contractor will take JPAS owning role over the contractor employee, the Navy command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT position category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee's performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR

CONTRACTORS ASSIGNED TO OR PERFORMING NON-SENSITIVE DUTIES

Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc...) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

Must be either a U.S. citizen or a U.S. permanent resident with a minimum of 3 years of legal residency in the U.S. (as required by the Deputy Secretary of Defense DTM 08-006 or its subsequent DoD Instruction (INST)) and

Must have a favorably completed NACI or T1 investigation equivalent including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the CSR must submit for all employees each of the following:

SF-85 Questionnaire for Non-Sensitive Positions

Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably completed NACI or T1 equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM.

Failure to provide the required documentation at least thirty (30) days prior to the individual's start date may result in delaying the individual's start date.

* Consult with your CSM and ISSM/IAM for local policy when IT-III (non-sensitive) access is required for non-U.S. citizens outside the U.S..*

The following have been modified:

MINIMUM AND MAXIMUM QUANTITIES

MINIMUM AND MAXIMUM QUANTITIES (FFP, SINGLE AWARD IDIQ) (SEP 2015)

As referred to in paragraph (b) of the “Indefinite Quantity” clause of this contract, the total contract minimum quantity is a total of $25,000.00 worth of orders at the contract unit price(s). The contract maximum quantity is a total of $99,000,000.00.

ORDERING

Task Order Procedures:

The established ceiling for this IDIQ is $99,000,000.00. No single or combination of task orders can exceed the contract ceiling.

Oral Orders –Indefinite Delivery Contracts

Oral orders may be placed provided the following conditions are compiled with:

(a) No oral order will exceed $100,000 or such lesser amount as may be specified elsewhere in the schedule of this contract.

(b) The Contractor will furnish with each shipment a delivery ticket, in triplicate, showing: contract number, order number under the contract; date order was placed, name and title of person placing order; an itemized listing of supplies or services furnished; unit price and extension of each item; and, delivery of performance date.

(c) Invoices for supplies or services furnished in response to oral orders will be accompanied with a received copy of each related delivery ticket.

(d) The ordering activity shall designate in writing the names of individuals authorized to place oral orders and will furnish a copy thereof to the Contractor.

(e) Written confirmation of oral orders will be issued as a means of documenting the oral order within 10 working days or oral orders will be confirmed twice a month, in writing, when more than one oral order is consolidated for a single confirmation.

Ordering:

a. Ordering: Services to be furnished under this contract shall be furnished at such times as ordered by the issuance of Task Orders (TOs) on DD Form 1155 or SF1449 by the Ordering Officer. All orders issued hereunder are subject to the terms and conditions of this contract. This contract shall control in the event of conflict with any TO. When mailed, a TO shall be “issued” for purpose of this contract at the time the Government deposits the order in the mail, or, if transmitted by other means, when physically delivered to the Contractor.

b. Ordering Procedures:

(1) TOs issued shall include, but not be limited to the following information:

(a) date of order

(b) contract and order number

(c) appropriation and accounting data

(d) item number and description of the services to be performed, period of performance, quantity, and unit price

(e) DD Form 254 (contract Security Classification Spec), if applicable

(f) DD Form 1423 (Contract Data Requirements List), if applicable.

(g) exact place of performance.

(h) the inspecting and accepting codes (as applicable).

(i) the firm fixed price.

(j) list of Government Furnished Property and the estimated value thereof, if applicable.

(k) any other pertinent information

c. Unilateral Orders issued under an urgent requirement. TOs under this contract will ordinarily be issued after both parties agree on all terms. If the parties fail to agree, the Ordering Officer may require the Contractor to perform and any disagreement shall be deemed a dispute within the meaning of the Disputes clause.

d. Cautionary Note. Nothing stated in the TO, in a quote, or in discussions thereto, can modify the basic contract terms or regulations governing this contract.

e. Pricing. All labor categories and rates used to price task orders shall be in accordance with the Pricing Spreadsheet, Attachment 1, to the contract. Rates used to price task orders shall not exceed the ceiling rates included in the Pricing Spreadsheet, Attachment 1. The prices or labor rates that are in effect on the date any task order is issued by the Government shall apply for the full period of performance for the base period of the task order. If the Task Order also includes option periods, the rates that are in effect on the date the option period is exercisable shall apply for the full period of performance of the option period.

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT

METEOROLOGY AND OCEANOGRAPHY COMMAND

INFRASTRUCTURE AND CYBERSECURITY SUPPORT SERVICES

CONTRACT ORDERING PERIOD:

The resulting contract will be for a five (5) year ordering period The resultant contract will also contain FAR 52.217-8, thereby allowing a six (6) month extension if circumstances necessitate this option.

Period Dates

Year 1 01 May 2022 through 30 April 2023

Year 2 01 May 2023 through 30 April 2024

Year 3 01 May 2024 through 30 April 2025

Year 4 01 May 2025 through 30 April 2026

Year 5 01 May 2026 through 30 April 2027

FAR 52.217-8 01 May 2027 through 31 October 2027

1. INTRODUCTION

Work under this contract is to be accomplished for the Naval Information Forces (NAVIFOR) Suffolk, VA and the Naval Meteorology and Oceanography Command (NAVMETOCCOM), Stennis Space Center, MS, and its Echelon IV organizations: Naval Oceanographic Office (NAVOCEANO) and Naval Oceanography Operations Command (NAVOCEANOPSCOM), Stennis Space Center, MS; Fleet Numerical Meteorology and Oceanography Center (FLENUMMETOCCEN), Monterey, CA; U.S. Naval Observatory (USNAVOBSY), Washington DC;

USNAVOBSY, Flagstaff, AZ; USNAVOBSY Alternate Master Clock, Colorado Springs, CO; Fleet Weather Center (FLEWEACEN), San Diego, CA; Fleet Weather Center (FLEWEACEN), Norfolk, VA; and their respective Echelon V subordinate sites to include Naval Ice Center (NAVICECEN) Suitland, MD, Joint Typhoon Warning Center (JOINT TYPHOON WARCEN) Pearl Harbor, HI, Naval Oceanography AntiSubmarine Warfare Center (NAVOCEANASWCEN) Yokosuka, Japan, Naval Oceanography Mine Warfare CP Bahrain, Fleet Weather Center Detachment, Pentagon.

2. BACKGROUND

NAVMETOCCOM, with its subordinate organizations, is responsible for the direction of the Naval Oceanography Program (NOP), which provides operational oceanography; meteorology; precise time and astrometry; and Geospatial Information and Services (GI&S) to the operating forces of the Navy and (DoD). NAVMETOCCOM activities are responsible for compiling, processing, assessing, and analyzing oceanographic, atmospheric, and other types of environmental data, which have a critical impact on naval operations. Execution of the NOP mission requires highly specialized technical support personnel with significant and well versed experience in field support and the overall NAVMETOCCOM IT program. This contract will include approximately 32 systems; about six of these systems are application-only systems with each systems having its own accreditation package. The ACAT level is classified as a project as opposed to an ACAT program at a specific level. The network name, size and details, when put together, will be an OPSEC issue and not available for public release. Also, the sizes change over time.

2.1 APPLICABLE DOCUMENTS/STANDARDS:

DOD Operational Guidelines for Computer System and Network Administration, Policies and Procedures, DoD Web Site Administration Policies and Procedures, and Specifications, standards and handbooks, guidance documents-DODI instructions, OPNAVINST’s DISA Secure Technical Implementation Guides (STIGs). Reference:

DODI 8500.2, IA Control: ECSC-1, Subject: Security Configuration Compliance, Requirement: For Enclaves and AIS applications

CYBERSECURITY - The Contractor shall comply with all federal, DOD, and Department of the Navy (DON) Information Assurance (IA) policies. The contractor will be responsible for maintaining system IA accreditation, with government assistance where required.

SECNAVINST 5720.44C - Department of the Navy Policy for Content of Publically Accessible World Wide Web Sites, 21 February 2012 (incorporating Change 1, 14 October 2014)

SECNAV M-5239.3, Department of the Navy Cybersecurity Manual, July 2021 SECNAVINST 5239.3C, Department of the Navy Cybersecurity Policy, 2 May 2016 Chairman Joint Chiefs of Staff Instruction (CJCSI) 6211.02D, “Defense Information System U.S. Navy Risk Management Framework Process Guide, Version 3.3, 28 October 2021 DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology, 12 March 2014, Change 3, 29 December 2020 Network (DISN): Policy Responsibilities and Processes,” 24 January 2012 Chairman Joint Chiefs of Staff Manual (CJCSM) 6510.01 CH-3, “Defense in Depth: Information Assurance

(IA) and Computer Network Defense (CND)”, 25 Mar 2003 NCDSMO Doc ID: NCDSMO-R-00008-001_02, "Cross Domain Solution (CDS) Design and Implementation Requirements - 2018 Raise the Bar (RTB) Baseline Release", 4 Apr 2019 CJCS Notice 6510, Communications Security (COMSEC) Security Modernization Plan CJCSI 6510.01-fD, “Information Assurance and Support to Computer Network Defense, ”09 Feb 2011 CNO N614/HQMC C4--Navy-Marine Corps Unclassified Trusted Network Protection (UTNProtect) Policy, Version 1.0, 31 October 2002 CJCSI 6211.02C, Defense Information System network (IDSN): Policy and Responsibilities, 9 Jul 08 CNSS Instruction 4009, “National Information Assurance Glossary,” 24 April 2010 CNSS Policy No. 10, “National Policy Governing Use of Approved Security Containers in Information

System Security Applications,” 21 July 1999 CNSS Policy No. 15, “National Information Assurance Policy on the Use of Public Standards for the Secure

Sharing of Information among National Security System,” October 2012 DoD Directive (DODD) 8100.1, “Global Information Grid Overarching Policy,” 19 September 2002 DODD 3020.26, “Department of Defense Continuity Programs,” 14 Feb 2018 DODD 4630.5, “Interoperability and Supportability of Information Technology (IT) and National Security

Systems (NSS),” 05 May 2004 DODD 5000.1, “The Defense Acquisition System,” 12 May 2003 DODD 5160.54, “Critical Asset Assurance Protection,” 20 January 1998 DODD 5230.11, “Disclosure of Classified Military Information to Foreign Governments and International

Organizations,” 16 June 1992 DODD 8140.01, “Cyberspace Workforce Management,” October 2020 DODD 8190.3, “Smart Card Technology,” 31 Aug 2002 DODD 8320.2, “Data Sharing in a Net-Centric DOD,” 2 Dec 2004 DODD C-5200.5, “Communications Security (COMSEC),” 21 Apr 2000 DODD O-8530.1, “Computer Network Defense (CND),” 8 Jan 2001 DoD Instruction (DODI) 4630.8, “Procedures for Interoperability and Supportability of IT and NSS,” 30 Jun

DODI 5000.02, “Operation of the Defense Acquisition System,” 07 January 2015 DODI 5200.02, “DoD Personnel Security Program,” 11 May 2018 DODI 8100.02, “Use of Commercial Wireless Devices, Services, and Technologies in the DOD Global

Information Grid (GIG),” 23 April 2007 DODI 8100.3, “DoD Voice Networks,” 16 Jan 2004 DODI 8500.01, “Cybersecurity,” 14 Mar 2014, Change 1, 7 October 2019 DODI 8520.02, “Public Key Infrastructure (PKI) and Public Key (PK) Enabling,” 24 May 2011 DODI 8540.01, "Cross Domain (CD) Policy", May 8, 2015 DODI 8551.1, “Ports, Protocols, and Services Management (PPSM),” 13 Aug 2004 DODI 8580.1 “Information Assurance in the Defense Acquisition System, 9 Jul 2004 DODI O-8530.1, “Support to CND,” 08 January 2001 DON CIO Guidance on Information Management/IT Inherently Governmental Functions,” Nov 2001 DON IA Publication Series Executive Order 12333, “United States Intelligence Activities” Executive Order 12958, as amended, “Classified National Security Information” Federal Information Security Management Act of 2002, Title III of E-Government Act of 2002 (PL 107-347) Homeland Security Presidential Directive (HSPD-7), “Critical Infrastructure Identification, Prioritization, and

Protection, 17 Dec 2003 National Security Telecommunications and Information Systems Security Policy (NSTISSP) No.11, “National

Policy Governing the Acquisition of IA and IA-enabled IT Products,” Jan 2000 NAVSO 5239-03--Designated Approving Authority (DAA) Guidebook NAVSO 5239-1--Introduction to Information Systems Security Navy-Marine Corps Unclassified Trusted Network Protect (UTN-Protect) Policy, 4 Aug 2004 NSTISSAM TEMPEST/2-95, RED/BLACK Installation Guidelines, 12 Dec 95, with Amendment of 3 February

NSTISSD 500, Information Systems Security Education, Training and Awareness,” 25 Feb 1993 NSTISSI 4011, “National Training Standard for Information System Security Professionals,” 20 June 1994 NSTISSI No. 7003, Protected Distribution Systems (PDS), 13 Dec 1996 OMB Circular A-130, “Management of Federal Information Resources,” 28 Nov 2000 OMB Memo M-00-07, “Incorporating and Funding Security in Information Systems Investments,” 28 Feb 2000 OPNAVINST 2201.3, “Communications Security Monitoring of Navy Telecommunications and Information

Technology Systems”, 22 May 2020 OPNAVINST 5239.1D “U.S. Navy Cybersecurity Program,” 18 July 2019 OPNAVINST C5510.93F/MCO C5510.19 Navy Marine Corps Implementation of National Policy on the

Control of Compromising Emanations, 10 Jan 2002 Privacy Act of 1974 SECNAVINST 3501.1, “Department of the Navy (DON) Critical Infrastructure Protection (CIP),” 16 Jun 2002 SECNAVINST 5211.5F, “DON Privacy Act Program,” 20 May 2019

COMNAVMETOCCOM Infrastructure Architecture Resource Management NAVMETOCCOMINST 3030.5 COMNAVMETOCCOM Continuity of Operations Plan COMNAVEMTOCCOM Naval Oceanography Program Requirements Management Embedded REL User Enclave Technical Implementation Instructions v3.0, 20 Nov 07 Defense Information Systems Agency (DISA SIPRNET Global Information Grid (GIG) Interconnection

Approval Process (GIAP) Connection Requirements, Oct 06 COMNAVNETWARCOM ltr 5239 Ser ODAA/1705, Navy ODAA Guidance Memorandum 02-07;

Guidance for a Comprehensive Plan of Action and Milestones (POA&M), 14 Jun 07 DON CIO Washington DC 291600z Feb 08 DON Contingency Plans and Testing Guidance USN/USMC IA Pub 5239-22, Sep 08, Information Assurance Protected Distribution System (PDS)

Publication DON CIO Washington DC 181430Z May 09 Department of the Navy Privacy Impact Assessment (PIA)

Guidance DoD CIO Memo, Encryption of Sensitive Unclassified Data at Rest (DAR) ON Mobile Computing Devices and Removable Storage Medial, 3 Jul 07 o Department of Defense (DoD) 5220.22-M “National Industrial Security Program, Operating

Manual” Secretary of the Navy (SECNAV) Instruction 5510.30C “Personnel Security Program”, 24 January 2020 SECNAVINST 5510.36B “Department of the Navy (DoN) Information Security Program”, 12 July 2019

3. SCOPE

The purpose of this contract is to provide a full range of Information Technology (IT) support services and cybersecurity support to NAVIFOR & NAVMETOCCOM, Stennis Space Center, MS, and its Echelon IV organizations.

This shall include support to activities such as:

Infrastructure, IT System Administration, Network/Communications, and Cross Domain Solutions Cybersecurity IT Configuration Management (CM) IT Customer Interface Management (CIM) IT Requirements Managements IT Life Cycle Support IT Engineering Support IT Integration and Sustainment

4. OBJECTIVES

The Contractor shall support the NAVMETOCCOM & NAVIFOR enterprise by conducting operational and technical requirements analyses; preparing operational concepts; analyzing risk; and developing algorithms, processes, and recommendations on solutions to collect, process, manage, and transmit Meteorology, Oceanographic data, and Geospatial Information & Services (GI&S).

The Contractor shall provide credentialed personnel according to DoD Cyber Workforce requirements as specified in DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19 December 2005, Change 4, 10 November 2015.

The Contractor shall be able to staff qualified personnel in multiple CONUS and OCONUS geographic locations (including Japan and Bahrain) within a 30-day period.

The Contractor shall also provide technical support and systems engineering to facilitate migration of associated systems, within the guidelines of the DoD Corporate Information Management initiative to achieve interoperability and to establish the Defense Information Systems Agency (DISA) Technical Architecture Framework for Information Management compliant processing architecture. The Contractor shall ensure that software design, development, and maintenance activities comply with federal, DoD, DON, and Commander, Naval Meteorology and Oceanography Command (COMNAVMETOCCOM) policies including, Information Assurance and net centricity.

Deliverables must comply with applicable DISA Secure Technical Implementation Guides (STIGs) and DISA Application Security and Development STIGs (reference: DODI 8500.01, Cybersecurity). Control: ECSC-1, Subject: Security Configuration Compliance, Requirement: For Enclaves and AIS applications, all DoD security configuration or implementation guides have been applied.

The contractor shall provide technical support for the following IT Programs:

a) The Primary Oceanographic Prediction System (POPS) is an ACAT IA Program of Record (PoR), which now includes all former IT Programs within the NAVMETOCCOM Enterprise, including POPS-Meteorology (formerly just POPS), Oceanographic Information System (OIS), Meteorology and Oceanography Systems (METOCSYS), and the Precise Time and Astrometry (PTA) Systems work at the Naval Observatory.

b) The POPS for Oceanography (Oceans) is an operational information system within DoD providing automated support for oceanographic data collection, processing, analysis, product generation, and distribution.

POPS - Oceans products provide critical direct operational support to all mission areas of the fleet and other forces that operate on, under, over, or near the world’s oceans. Formerly known as the Oceanographic Information System (OIS), POPS-Oceans is the primary IT domain at NAVOCEANO and is the enabler for oceanographic information and predictions in support of Antisubmarine Warfare (ASW), Naval Special Warfare (NSW), Mine Warfare (MIW), and submarine/ship navigation. The POPS-Oceans program involves automated Information Resource / Information Management support for multi-disciplinary ocean surveys, assigned scientific and technical projects, and oceanographic product generation and distribution at NAVOCEANO and its subordinate commands, the Naval Ice Center (NAVICECEN) and Fleet Survey Team (FST). Also at NAVOCEANO is the Surf Eagle (SE) program tasked to produce and disseminate oceanographic/littoral and riverine environmental intelligence, analysis, and special products primarily in support of Intelligence, Surveillance, and Reconnaissance (ISR).

c) The POPS-Meteorology (Met), located at FLENUMMETOCCEN at Monterey, CA provides the key production engine enabling global METOC support of the fleet. POPS-Met operates within a 24/7 reach back operations center supporting global fleet operations with weather and ocean prediction products and war fighting applications that are critical to fleet safety and war fighting effectiveness. POPS-Met provides the technology and infrastructure to sustain global operations ashore and afloat by providing timely, relevant, 24/7 METOC data and products to the fleet, DoD, joint, allied, and coalition warfighters at all classification levels. POPS-Met acquires and sustains the operation of high-performance computing (HPC) environments to provide most of the assured METOC forecast products and services for Tier 1 of the Battlespace on Demand, which originate directly from the METOC models, satellite processing software, and applications. Tier 1 also provides input to many of the Battlespace on Demand Tier 2 and Tier 3 Products. Ongoing technology refreshment is required to meet the growing demand for these products, particularly in response to greater emphasis on preparation for and response to regional conflicts, and the greater data volume from the National Polar-orbiting Partnership (NPP) and future remotely sensed environmental data sources. The required technology refreshment includes enhancements of the POPS-Met hardware and software, models suite, observational data ingest capability, data distribution capability, and reach back customer support.

Together, these enhancements will provide the Fleet with more accurate and responsive environmental support across all three Tiers of Battlespace on Demand. POPS-Met supports DoD’s principle operational processing center for numerical METOC analysis and prediction.

d) The METOC Enterprise program/system –provides portfolio management and tactical communications and information processing capability to NAVMETOCCOM operational subordinate commands located at Stennis Space Center MS, Norfolk, VA, San Diego, CA, Pearl Harbor, HI, Yokosuka, Japan, and Manama, Bahrain, including subordinate detachments, components, and deployable teams operating worldwide. METOC Operational Mission Information Technology (MOMIT) provides Naval oceanographers and meteorologists with the capability to conduct on-scene sensing, ingest, processing, display, and dissemination of time critical environmental analysis products to support mission effectiveness and safety of personnel, platforms, installations, and operations. This includes design, installation, cybersecurity accreditation, and sustainment of METOC enterprise capabilities located at Stennis Space Center MS, and Integrated Unclassified Systems (IUS) and Integrated Classified System (ICS) located at Fleet Weather Center Norfolk, VA, Fleet Weather Center San Diego, CA, Joint Typhoon Warning Center Pearl Harbor, HI, and Naval Oceanography ASW Center Yokosuka, Japan. The METOC Enterprise program segment also manages Navy METOC-wide systems and applications including Cross-Domain Solutions, Flight Weather Briefer, METOC Chat, Remote Environmental Conditions Observation Network (RECON), and other POR and non-POR technology solutions.

e) Fleet Weather Center Norfolk, VA, IUS/ICS and Fleet Weather Center San Diego, CA, IUS/ICS Navy systems provides timely, comprehensive, and tactically relevant meteorological and oceanographic (METOC) products and services in direct support of Fleet training and readiness; deploying Carrier and Expeditionary Strike Groups and embarked units/staff, Combatant Commanders, Joint/Coalition forces, and other U.S. Government agencies as directed via Navy/Marine Corps Intranet (NMCI) transport.

f) Joint Typhoon Warning Center Pearl Harbor, HI, systems provide issuing of tropical cyclone warnings in the North West Pacific Ocean, South Pacific Ocean and Indian Ocean for United States Department of Defense interests, as well as U.S. and Micronesian civilian interests within the command's area of responsibility (AOR) via Navy/Marine Corps Intranet (NMCI) transport.

g) The combined programs maintain NAVIFOR, NAVMETOCCOM, USNAVOBSY, FLENUMMETOCCEN, NAVOCEANO, NAVICECEN, FST, NAVOCEANOPSCOM, and the echelon IV activities’ scientific IT systems in support of established METOC requirements and coordinates the modernization of these assets to ensure efficient operations and any infusion of new technology.

5. REQUIREMENTS

Work to be performed will primarily be divided into two functional areas. Detailed tasking will be provided and further defined at the task order level. The following tasking for each functional area is generalized below:

Functional Area #1: Infrastructure Support, IT System Administration, Communications, Cross Domain Solution (CDS) Solutions, DoD/DON Infrastructure Compliance Support activities include, but are not limited to the following:

a) Provide Infrastructure Architecture support for driving policy, integration and sustainment of IT, communications, and equipment.

b) Navy Enterprise Networks (NEN), the Navy/Marine Corps Intranet (NMCI), OCONUS Navy Enterprise Network (ONENET), and the Next Generation Enterprise Network (NGEN), in maintaining global enterprise-wide asset management and configuration controls using current Navy Enterprise Asset Management Tools such as NMCI Enterprise Tool (NET), Integrated Solution Framework (ISF)-Tools, eMarketPlace, Requirements Award Process Tool (RAPT), and Service Request eForm (SReF).

c) Develop network topology diagrams and perform network asset discovery and configuration management using Navy Enterprise asset management tools. Current tools include the DON Application and Database Management System (DADMS), Enterprise Architecture Framework (EAF), CMPRO, and Bel-Manage.

d) Analyze and provide reports on bandwidth usage on NAVMETOCCOM network segments and recommend strategies for optimization.

e) Develop systems engineering plans and recommendations for system consolidation initiatives and general system administration improvements.

f) Monitor network performance on operational IT systems and provide reports and recommend solutions for improving system performance.

g) Assist in Information System Security design, installation, monitoring, and testing to meet system and DoD/DON Cybersecurity requirements.

h) Provide reports that recommend hardware, software, and network security configurations to meet system and DoD/DON CS requirements.

i) Provide, implement, and support common configuration management practices and procedures necessary to ensure a high degree of configuration identification, status accounting, change control and auditing for NAVMETOCCOM Information Systems. Support will ensure that best practices for configuration management are implemented and current accurate records are maintained identifying the baselines for NAVMETOCCOM IT assets.

Current tools used to support this effort include the DON Application and Database Management System (DADMS) and the EAF.

j) Draft and maintain IT requirements documents and diagrams, support and manage IT requirements, elicitation, development, analysis, and validation of Enterprise Change Request (ECR), and provide Application Portfolio Management for the METOC Systems IT assets.

k) Elicit and document functional and user requirements for oceanographic and atmospheric modeling to generate artifacts including workflows, Concepts of Operations (CONOPS), System/Software Requirements Specification (SRS), Unified Modeling Language (UML) diagrams, use cases, and other documentation, as needed.

l) Provide technical services to users and maintenance technicians on operational system details to improve operational efficiencies.

m) Provide hardware, software, and system integration support for deployments of system and software modifications, including the development and execution of site surveys (environmental and technical), implementation plans and installation plans.

n) Conduct technical studies and design system for NAVMETOCCOM’s communications circuits leveraging current Navy Enterprise management tools such as Telecommunications Inventory and Billing Information (TIBI), DISA Direct Order Entry (DDOE), Telecommunication Certification Office Support System (TCOSS), and DISA’s World Wide On-Line System (WWOLS).

o) Provide project management, process improvement and quality management processes, support and guidance for business functions including project launches, post-mortems, metrics collection and analysis, and capacity management. Support will ensure standardization, consistency, and alignment of all work products and projects.

p) Conduct research and prepare responses for Navy enterprise data calls that relate to NAVMETOCCOM infrastructures and architectures and for Enterprise databases and systems, including DON Application and Database Management System (DADMS), DoD IT Repository – DON (DITPR-DON), Maintenance and Material Management (3M) and the Defense Priorities and Allocations System (DPAS).

q) Architect , design, implement, deploy, sustainment, maintain, configure, and transition applications to the Navy Enterprise Networks (NEN), including Navy Marine Corps Intranet (NMCI), Outside the Continental US (OCONUS) Navy Enterprise – Network (ONE-NET), Consolidated Afloat Networks Enterprise Services (CANES), Next Generation Enterprise Network (NGEN), and Joint Regional Security Stack (JRSS), cloud capabilities provisioned via the DoN Naval Digital Marketplace and other C4ISR or Community of Practice (CoP) systems or networks.

r) Provide system and software support to maintain and sustain the Cross Doman Solution (CDS) system. The contractor will provide support to maintain and sustain the scripts associated with data examination and transfer, the hardware, OS and will implement patches and upgrades, conducting CS activities, and network activities.

s) Provide Cyberspace IT/CSWF certified (Level II/III or equivalent) system administration support to Naval Oceanographic Enterprise (NOe) systems to include the configuration of operating systems and associated METOC application software to Defense Information System Agency (DISA)/DoD standards according to the latest STIG, Active Directory and Group Policy for Windows operating systems, and UNIX/LINUX computers to operate on DoD networks. The contractor will execute Security scans and mitigate issues across all operating systems, image systems to create baselines, and design/operate networks infrastructure (routers, switches, and other network devices) to current DoD and commercial standards. Work includes advanced administration of LINUX on supercomputers using large capacity file systems (i.e. GPFS), with complicated 24x7 operational runs; Government Off-the-Shelf (GOTS), Commercial Off-the-Shelf (COTS), and open source software; and petabytes of data.

t) Provide technical research and documentation support for engineering and IT solutions associated with Enterprise Change Requests (ECR), Customer Service Request (CSR), and centrally managed projects. The solutions must be compliant with DoD Navy Cyber Security standards. Documentation can include white papers, Functional Solutions Analysis (FSAs), Execution Plans, Executive Briefs and point papers that detail recommended IT solutions, or METOC applications required to address emergent requirements.

u) Perform Life Cycle Support (LCS) functions, which includes providing program and project management support of installed Navy and Marine Corps systems deployed worldwide. Contract support requirements include: support of the METOC Enterprise Casualty Process to include daily analysis of Customer Service Requests (CSRs) to determine appropriate corrective actions; support of handling and shipping of materials; monitoring activity and performance of the 24/7 helpdesk; support configuration, performance, and cost tracking for the 32 systems that comprise the NAVMETOC IT program.

v) Provide system engineering support for existing capability modernization. This support will include Linux, Microsoft windows, Geographic Information Systems (GIS) and scripting tasks. This support will also include providing distance support services for fielded METOC systems.

w) Provide Help Desk management capability for routine management of incident, trouble tickets, licensing and hardware/software inventory.

x) Provide Cyberspace IT/CSWF Level II/III or equivalent certified system administration support for the Naval Oceanographic Office (NAVOCEANO) DoDIN Node. This support will include installation, configuration and security of application servers, web servers, database servers and COTS software. This support will also include operating system administration, such as Red Hat Enterprise Linux, Microsoft Windows, and scripting tasks.

y) Conduct solution formulation efforts to analyze customer requirements to develop and present Analysis of Alternatives (AoA), conduct Cost Benefit…