1.05 - PWS.pdf

UNCLASSIFIED

Performance Work Statement Title: Global Force Management/Navy Readiness Reporting Enterprise Program Management Office

System Engineering and Technical Assistance

1.0 SCOPE

This is a service acquisition task to provide System Engineering and Technical Assistance (SETA) to Global Force Management (GFM)/Navy Readiness Reporting Enterprise (NRRE) Program Management Office (PMO) at U. S. Fleet Forces Command (USFF). The GFM/NRRE PMO requires highly specialized SETA services as defined in FAR 9.505- 1 that include a combination of substantially all of the following activities: determining specifications, identifying and resolving interface problems, developing test requirements, evaluating test data, supervising design. These services also include providing technical direction through a combination of substantially all of the following activities: developing work statements, determining parameters, directing other contractors’ operations, and resolving technical controversies.

These services are required for the GFM/NRRE PMO to efficiently and effectively execute operations and sustainment, systems engineering, software design/development, integration, testing, evaluation, installation, training, life cycle maintenance, program management, and acquisition management of the GFM/NRRE Program of Record (POR) as the Chief of Naval Operations’ Executive Agent.

2.0 BACKGROUND

The GFM/NRRE POR is principally governed by DoD Directive (DoDD) 7730.65 and DoD Instruction 8260.03 and implemented in accordance with the body of direction established by the standards of Section 2.1. These directives mandate that the Services:

• Develop Mission Essential Task Lists (METLs) to support capabilities-based readiness reporting in DRRS

• Require unit identification and readiness reporting in DRRS be accomplished at an organizational level, at, or below, the level at which forces are employed in support of GFM, day-to-day operations, and wartime planning.

• Develop and implement standardized enterprise force structure data, and make it available electronically in a joint hierarchical way for integration and use throughout the DoD

The majority of the GFM/NRRE applications are designated as Mission Assurance Category I (MAC I) and categorized as Risk Management Framework (RMF) "High" classified systems subject to RMF "High" requirements for confidentiality, integrity, and availability. As a result, the systems are predominantly hosted together and managed as an enterprise to MAC I and RMF "High/High/High" requirements.

The GFM/NRRE POR provides the authoritative systems used by the Navy to comply with the statutory requirements of United States Code 10, Title 10, §117- Readiness Reporting System, and the only means for Navy compliance with requirements of DoDI 8260.03- Global Force Management Data Initiative. Unit and group Commanders depend on these systems to assess and report readiness, and conduct mission essential force planning. The systems provide the primary tools used to support the readiness decisions of commanders for operations and contingency planning at all levels of the Navy and Joint command structures. The principal GFM/NRRE systems process information determined to be vital to the operational readiness or mission effectiveness of deployed and contingency. Consequently, the loss of integrity or availability of the GFM/NRRE systems is unacceptable and could cause the immediate and sustained loss of mission effectiveness.

2.1 Applicable Standards and Documents

2.2 Standards and Documents

The documents listed below are applicable to this task as of May 2026. The contractor is required to update and maintain this list current after award:

10 United States Code (USC) §117, Readiness Reporting System: Establishment; Reporting to Congressional Committees

10 United States Code (USC) §118a, Materiel Readiness Metrics and Objectives for Major Weapon Systems

10 United States Code (USC) §482, Readiness Reports

44 USC §3551 Federal Information Security Modernization Act (FISMA) of 2014 (replaced FISMA 2002)

National Security Decision Directive Number 298, 22 January 1988, National Operations Security Program

DOD Instruction (DODI) Instruction 5000.88, 18 November 2020, Engineering of Defense Systems

Department of Defense Directive (DODD) 5000.01, 09 September 2020, Incorporating Change 1, dated 28 July

2022, The Defense Acquisition System

Department of Defense Instruction (DODI) 5000.02 23 January 2020, Incorporating Change 1, 8 June 2022, Operation of the Adaptive Acquisition Framework

DoD 5000 Series Acquisition Policy Transformation Handbook, 22 July 2022

Department of Defense Instruction (DoDI) 5000.87, 2 October 2020, Operation Of The Software Acquisition Pathway

Department of Defense Instruction (DoDI) 5000.75, 2 February 2017, Incorporating Change 2, 24 January 2020, Business Systems Requirements and Acquisition

Department of Defense Instruction (DoDI) 5000.74, 10 January 2020, Incorporating Change 1, 24 June 2021, Defense Acquisition of Services

Department of Defense Directive (DODD) 5124.02, 23 June 2008, Incorporating Change 2, 25 July 2025, Under Secretary of Defense for Personnel and Readiness (USD(P&R))

Department of Defense Directive (DODD) 5205.02E, 20 June 2012, Incorporating Change 2, 20 August 2020, DoD Operations Security (OPSEC) Program

Department of Defense Directive (DODD) 7730.65, 31 May 2023, DOD Readiness Reporting System

Department of Defense Directive (DODD) 8000.01, 17 March 2016, Incorporating Change 1, 27 July 2017, Management of the Department of Defense Information Enterprise (DoD IE)

Department of Defense Directive (DODD) 8140.01, 05 October 2020, Cyberspace Workforce Management

Department of Defense Instruction (DoDI) 5200.02, 21 March 2014, Incorporating Change 3, 24 September 2020, DoD Personnel Security Program (PSP)

Department of Defense Instruction (DoDI) 5220.31, 09 May 2023, National Industrial Security Program

DoD Instruction (DoDI) 7730.66, 10 December 2024, Readiness Reporting Guidance for the Defense Readiness Reporting System

Department of Defense Instruction (DoDI) 8260.03, 19 February 2014, Incorporating Change 1, 19 March 2018, The Global Force Management Data Initiative (GFM DI)

Department of Defense Instruction (DoDI) 8320.02, 5 August 2013, Incorporating Change 1, 24 June 2020, Sharing Data, Information, and Information Technology (IT) Services in the Department of Defense

Department of Defense Instruction (DoDI) 8330.01, Interoperability Of Information Technology, Including National Security Systems, 27 September 2022

Department of Defense Instruction (DoDI) 8500.01, 14 March 2014, Incorporating Change 1, 7 October 2019, Cybersecurity

DOD Instruction (DoDI) 8510.01, 19 July 2022, Risk Management Framework For DOD Systems

Department of Defense Instruction (DoDI) 5230.24, 10 January 2023, Distribution Statements on DoD Technical Information

DoD Manual 5010.12-M, 21 November 2025, Acquisition and Management Of Contractor-Prepared Data

Department of Defense Manual (DoDM) 5200.01-V1, Volume 1, 24 February 2012, Incorporating Change 3, 17 January 2025, DoD Information Security Program: Overview, Classification, and Declassification

Department of Defense Manual (DoDM) 5200.01-V2, Volume 2, 24 February 2012, Incorporating Change 4, 28 July 2020, DoD Information Security Program: Marking of Information

Department of Defense Manual (DoDM) 5200.01-V3, Volume 3, 24 February 2012, Incorporating Change 4, 17 January 2025, DoD Information Security Program: Protection of Classified Information

DOD Instruction (DoDI) 5200.48, 06 March 2020, Controlled Unclassified Information (CUI)

Department of Defense Manual (DoDM) 5205.02-M, 03 November 2008, Incorporating Change 2, 29 October 2020, DoD Operations Security (OPSEC) Program Manual

Department of Defense Manual (DoD) 5220.22-M, 28 February 2006, Incorporating Change 2, 18 May 2016, National Industrial Security Program Operating Manual (now Part 117 of Title 32, Code of Federal Regulations)

Department of Defense Manual (DoDM) 8140.03, 15 February 2023, Cyberspace Workforce Qualification and Management Program

Secretary of Defense Memorandum, Adoption of the National Information Exchange Model within the Department of Defense, 28 March 2013

DoD Architecture Framework, Version 2.02, August 2010

DOD Manual 8260.03 Volume 1 (DoDM 8260.03-V1), 1 July 2022, Global Force Management Data Initiative Implementation: Unique Identification For Enterprise Force Structure Data

Department of Defense Manual 8260.03 Volume 2 (DoDM 8260.03-V2), 14 June 2011, Global Force Management Data Initiative (GFM DI) Implementation: The Organizational And Force Structure Construct

(OFSC)

DOD Instruction 5000.88, 18 November 2020, Engineering of Defense Systems

DoD Systems Engineering Guidebook

DoD Systems Engineering Guide for Systems of Systems

DoD Manual (DoDM) 5110.04 Volume 1, 16 June 2020, DoD Manual for Written Material: Correspondence Management

Department of Defense Manual (DoDM) 5110.04, Volume 2, 09 July 2020, DoD Manual for Written Material:

Examples and Reference Material

DoD Enterprise DevSecOps Strategy Guide Version 2.0, March 2021

DoD Enterprise DevSecOps Fundamentals Version 2.0, March 2021

DoD Systems Engineering Guidebook, February 2022

Capability Development Document For Global Force Management Data Initiative (Increment I), 20 August 2007

Chairman of the Joint Chiefs of Staff Manual (CJCSM) 3150.02B, 25 March 2011, Current as of 25 March 2014, Global Status of Resources and Training System (GSORTS)

Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 5123.01J, 15 January 2026, Charter of the Joint Requirements Oversight Council and the Joint Force Requirements Process

Joint Capabilities Integration and Development System Wiki page

Chairman of the Joint Chiefs of Staff Manual (CJCSM) 5123.01, 15 January 2026, Manual for the Joint Requirements Oversight Council and the Joint Force Requirements Process

Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 3401.02B, 31 May 2011, Current as of 17 July 2014, Force Readiness Reporting

Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 3401.01E, 13 April 2010, Joint Combat Capability Assessment

Secretary of the Navy Instruction (SECNAVINST) 4440.34, 22 December 2009, Implementation of Item Unique Identification Within the Department of Navy

Secretary of the Navy Instruction (SECNAVINST) 5000.36A, 19 December 2005, Department of the Navy Information Technology Applications and Data Management

Secretary of the Navy Instruction (SECNAVINST) 5230.14, 09 November 2009, Information Technology Portfolio Management Implementation

Secretary of the Navy Instruction (SECNAVINST) 5239.19A, 04 September 2019, Department of the Navy Computer Network Incident Response and Reporting Requirements

Secretary of the Navy Instruction (SECNAVINST) 5239.3C, 02 May 2016, Department of the Navy Cybersecurity Policy

Secretary of the Navy Instruction (SECNAVINST) 5510.30C, 24 January 2020, Department of the Navy Personnel Security Program

Secretary of the Navy Instruction (SECNAVINST) 5510.36B, 12 July 2019, Department of the Navy Information Security Program

Secretary of the Navy (SECNAV) Manual M-5239.2, 27 June 2016, Department of the Navy Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual

Secretary of the Navy (SECNAV) Manual M-5239.3, 22 April 2022, Department of the Navy Cybersecurity Manual

Secretary of the Navy (SECNAV) Manual, 16 May 2018, Department of the Navy Correspondence Manual

Assistant Secretary of the Navy Research Development and Acquisition (ASN(RDA)) Memorandum, 23 October 2004, DoN Policy on Digital Product/Technical Data

Chief of Naval Operations Instruction (OPNAVINST) 3000.16, 15 February 2019, Navy Integrated Readiness

Chief of Naval Operations Instruction (OPNAVINST) F3300.53D, 2 Aug 2021, Navy Antiterrorism Program

Chief of Naval Operations Instruction (OPNAVINST) 3432.1A, 04 August 2011, Operations Security

OPNAV Instruction (OPNAVINST) 3501.360B, 09 December 2024, Defense Readiness Reporting System - Strategic

Chief of Naval Operations Instruction (OPNAVINST) 3501.383A, 30 January 2024, Fleet Readiness Reporting Guidance

Chief of Naval Operations letter Ser N4/14U129002 of 28 February 2014, Mission Assurance Category Designation for Systems in the Navy Readiness Reporting Enterprise

Chief of Naval Operations message, NAVADMIN 342/20, 291942ZDEC2020, Navy Development Security Operations (DevSecOps) Guidance

United States Navy Risk Management Framework Process Guide Version 4.1, 13 December 2024

Joint Memorandum Rapid Assess and Incorporate Software Engineering 2.0 dated 01 November 2022

Rapid Assess and Incorporate Software Engineering (RAISE) 2.0 Implementation Guide Version 1.0 (dated 04 October 2022)

Department of Navy Chief Information Officer Memorandum, 12 February 2016, Acceptable Use of Department of the Navy (DON) Information Technology (IT)

Department of the Navy Deputy Chief Information Officer memorandum, Cloud Brokerage Policy, 19 December

Director, Department of the Navy, Deputy Chief Information Officer memorandum, Navy Cloud First Policy, 01 February 2017

Commander, U.S. Fleet Forces Command / Commander, U.S. Pacific Fleet Command Instruction (COMUSFLTFORCOM/COMPACFLTINST) 6320.3B, 07 Apr 2014, Change Transmittal 1, 27 October 2017, Medical Screening For US Government Civilian Employees, Contractor Employees, Guests and Visitors Prior to Embarking Fleet Units

Commander, U.S. Fleet Forces Command Instruction (COMUSFLTFORCOMINST) 3501.6, 14 June 2020, Navy Readiness Reporting

12207-2026 - ISO/IEC/IEEE Approved Draft International standard - Systems and software engineering -- Software life cycle processes

15289-2019 - ISO/IEC/IEEE International Standard -- Systems and software engineering - Content of life-cycle information items (documentation)

ISO/IEC/IEEE 14764:2022 Software engineering — Software life cycle processes — Maintenance

3.0 TECHNICAL REQUIREMENTS

This effort includes comprehensive support for the GFM/NRRE PMO processes that are integrally related to development, implementation, sustainment, and operations of the GFM/NRRE systems and execution of the duties as Chief of Naval Operations Executive Agent (CNO EA) for development of readiness reporting and GFM-DI policy, procedures, and systems. This includes but is not limited to all the activities of sections 3.2 through 3.6.

3.1 Supported Systems

This effort provides the aforementioned services necessary for the GFM/NRRE PMO to develop, operate, sustain, refine, and acquire all components of the GFM/NRRE POR and execute the associated duties of CNO EA. This includes delivering comprehensive lifecycle management support of the GFM/NRRE components and their successors, including but not limited to:

Global Force Management (GFM), Navy Organizational Server and Enterprise Translation Services (GFM NOS and GFM ETS)

DRRS Afloat and associated components hosted ashore

Afloat Readiness Report System (ARRS)

Innovative Readiness Reporting Initiative (IRRI)

Enterprise Secure Token Service/ Single Sign-On

Navy Readiness Analysis Suite (NRAS)

Navy Readiness Reporting Enterprise-Business Intelligence (NRRE-BI)

Navy Readiness Reporting Interoperability Framework (NRRIF)

Navy Training Information Management System (NTIMS)

Personnel, Equipment, Supply, Training, Ordnance, and Facility (PESTOF) Pillars

Commander, Navy Installations Shore Pillar Feed II (CNI-SPF II)

Navy Reserve Readiness Module (NRRM)

GFM/NRRE configuration management, code repository, and software build environment

3.2 Software and System Lifecycle Management Support

This includes, but is not limited to, the following essential tasks:

Serve as the Program Lead Systems Engineer (LSE) for the GFM/NRRE PMO to include directing other contractors’ operations and identifying then resolving technical controversies specifically in support of the GFM/NRRE Operations and Sustainment (O&S) contract.

Serve as the Program Information System Security Engineer (ISSE) for the GFM/NRRE PMO to include directing other contractors’ operations and identifying then resolving technical controversies specifically in support of the GFM/NRRE Operations and Sustainment (O&S) contract.

Lead the GFM/NRRE stakeholder requirement generation processes including the development of software and system specifications. Review specifications that have been provided by O&S contractors to the PMO for approval and provide recommendations supported by technical rationale.

Perform independent engineering analyses of specifications and supervise the design of software and systems proposed to the PMO as technical solutions. Report results, and provide recommendations supported by technical rationale.

Perform technical review of, and when necessary, direct software and system quality assurance and testing, integration testing, static and dynamic code analysis, dynamic application analysis, and interoperability testing.

Evaluate test plans and results that have been provided to the PMO for approval and provide recommendations supported by technical rationale.

Lead the test and evaluation (T&E) of GFM/NRRE systems including the execution of Independent Verification and Validation (IV&V) of solutions that have been delivered to the PMO for acceptance and provide recommendations supported by technical rationale.

Lead the analysis and resolution of programmatic and technical issues associated with integration of internal and external systems. Evaluate analyses and resolution proposals that have been provided to the PMO for approval and provide recommendations supported by technical and policy rationale.

Evaluate the cyber security processes and posture of the GFM/NRRE components. Develop actions to sustain existing security posture and implement improved security measures.

Review emergent military and commercial security actions, reports of cyber-attacks/firewall intrusions, and Operations Plans (OPLANS), Contingency Plans (CONPLANS), and Task Orders then develop recommendations for the cybersecurity posture of the GFM/NRRE systems and direct PMO-approved implementations.

Provide cybersecurity planning and maintenance services including update of security documentation to reflect new or changed physical configurations and security requirements.

Analyze the cyber security products submitted to the PMO, reports results, and provide recommendations supported by technical rationale.

Lead the PMO’s DoD Risk Management Framework processes including evaluating the products provide to the PMO and representing the PMO in collaborations with the Package Submitting Office (PSO), Security Control Assessor (SCA), and Navy Authorizing Official (NAO).

Lead the transition of POR systems from enterprise data centers to cloud-based hosting by analyzing proposed technical solutions reporting results, and providing recommendations supported by technical rationale.

Lead the development of advanced strategies and methodologies for enhanced Continuity of Operations, Disaster Recovery, and cloud-based architectures.

Lead the development of advanced data analysis, analytics and modelling processes for the PMO.

Develop GFM/NRRE enterprise DevSecOps policy, processes, and procedures and guide the O&S contractors in the execution of these.

Lead the integration of GFM/NRRE POR technical and software development lifecycle processes and procedures with all external agencies. When required train external agencies on POR processes and collaborate as needed to effectively integrate efforts with external agencies.

Lead the development and sustainment of the program’s configuration management processes and systems.

3.3 Technical Services Acquisition and Execution Support

This includes, but is not limited to, the following essential tasks:

Develop statements of work, contract performance specifications, contract-specific Contract Data Requirements Lists (CDRL), Quality Assurance Surveillance Plans, and all other GFM/NRRE PMO products necessary to solicit technical services acquisition contracts.

Develop independent GFM/NRRE PMO contract cost estimates for services and products to be acquired by the POR. Analyze contractor estimates provided to the Government to validate their currency, accuracy and completeness including adequate supporting rationale. Report results to the PMO with recommendations and supporting rationale.

Develop contract performance metrics and policy for the GFM/NRRE O&S contract and associated acquisitions.

Coordinate with the O&S contractors for the collection of performance data, conduct performance analysis, collect/produce objective quality evidence, and present the results of analysis to the PMO with recommendations and supporting rationale.

Monitor O&S contract execution, establish contract milestones, develop enterprise objectives to support milestone accomplishment, brief the PMO on issues or concerns providing recommendations with supporting rationale.

Develop the POR contract transition plan and associated transition timeline accounting for relevant factors that may affect continuity of operations during an O&S contract transition. Monitor execution of the plan and revise in concert with changes in POR priorities, objectives, and resources.

Serve as a technical advisors to source selection boards or as a nonvoting members of a source selection evaluation board when so appointed.

Monitor and analyze contractor task performance and progress and develop QASP inputs for the COR and objective quality artifacts for the COR file.

Monitor and analyze current technical program management business processes and develop improved process and workflows. Train PMO stakeholders on revised processes and guide implementation.

Develop internal and external program communications in support of the PMO, USFF, and OPNAV sponsor.

3.4 GFM/Readiness Policy and Process Development, and Execution Support

Lead the GFM/NRRE PMO’s collaborative effort for the development and execution of all processes related to discharging the duties and responsibilities of the Chief of Naval Operations Executive Agent for development of policy, procedures and systems for implementing and sustaining the USN readiness reporting enterprise.

Act as the POR/CNO EA’s leading subject matter expert for the development of Navy Readiness Reporting and GFM-DI Policy. Analyze related Navy policy and directives for compliance with higher headquarters requirements then develop or revise Navy policy directives to achieve effective compliance. Present results and rationale to senior leaders for approval.

Develop operational directives, procedures, and constructs necessary to implement the policies described above including but not limited to Operational Readiness Concepts; Training Requirements and Objectives; Mission Essential Task Lists (METLs); new or revised DoD mission descriptions; Navy Force Organizational Structures and Elements; GFM assignment, allocation, and apportionment processes; Dynamic Force Employment Construct effectiveness measurements.

Lead the PMO’s collaboration with external Subject Matter Experts (SMEs) and readiness stakeholders to analyze readiness processes and independently develop improved processes for Navy readiness reporting and GFM -DI execution.

Develop, coordinate, and lead the approval process for revising and implementing Navy-wide readiness policy and procedures.

Develop readiness reporting processes and procedures at the force, fleet, headquarters staff, operational group, and unit levels.

Independently develop portions of the Navy Joint Force Readiness Report (JFRR), Semi-Annual Report to Congress (SRRC), and staff readiness assessments.

Analyze Joint and Service operational plans and develop METLs for units at all Echelons of command from Echelon 1 to the lowest employable entities. Train stakeholders in METL development processes and lead METL development workshops with Navy stakeholders.

Develop training materials and train readiness reporting and GFM-DI stakeholders as directed by the GFM/NRRE

PMO.

3.5 Planning, Programming, Budgeting, and Execution (PPBE) Process Support

Draft the GFM/NRRE POR budget submission and present to PMO and OPNAV sponsor.

Prepare the annual GFM/NRRE Program Objective Memorandum (POM) decision support materials and present to the PMO and OPNAV sponsor.

Develop the POR annual spend plans for the current and two future years, track expenditures and requirements, and frequently revise the plan throughout the fiscal year.

Develop the annual POR certification of obligations.

Develop, support and the track the approval of the annual Information Technology Information Procurement Review (ITPR) documents and update frequently throughout the fiscal year.

Draft, enter, and maintain GFM/NRRE POR records in the DoD Information Technology Portfolio Repository Department of the Navy (DITPR-DON) on behalf of the PMO.

Draft, enter, and maintain all GFM/NRRE records in the Department of the Navy Application and Database Management System (DADMS) on behalf of the PMO.

Monitor current fiscal year budget execution, develop forecasts of financial obligations and make recommendations for revision to budget, POM, and financial management plans.

3.6 General Management Support

The contractor shall develop presentations and staff action packages, coordinate meetings, and execute other administrative and management tasks as need to support the PMO operations. This includes, but is not limited to, the following essential tasks:

Independently research and identify external technical requirements then interpret them to produce deliverables that comply with all such requirements as they apply to the POR systems and processes.

Perform technical analysis, assessments, research, special studies, and monitoring.

Develop presentations, reports, point papers, and other documents.

Conduct technical exchange and status review meetings.

Coordinate and schedule meetings as specified by the Government.

The contractor shall use e-mail for administrative coordination issues. Information that is classified up to SECRET, shall be transmitted via SIPRNET e-mail. All deliverables shall comply with the requirements of the specified CDRL Data Item subject to additional direction provided by the COR.

4.0 DELIVERABLES

The contractor shall provide the following deliverables. All deliverables shall be submitted to the PMO and COR in a timely manner. Data deliverables will comply the requirements of DoD Manual 5010.12-M, Procedures for the Acquisition and Management of Technical Data, the DD Form 1423-1 for the item, and DoN Policy on Digital Product/Technical Data, ASN(RDA) memorandum of 23 October 2004.

4.1 Contract Data Requirement List (CDRL)

CDRL # Title of Data Item PWS Frequency

A001 Contractor's Progress, Status and Management Report 4.2- 4.3 MTHLY A002 Report, Record of Meeting / Minutes 3.0 - 3.6 ASREQ A003 Trip Report 5.0 ASREQ A004 Technical Report -Study / Services 3.0 - 3.6 ASREQ A005 Presentation, Briefing and Training Material 3.0 - 3.6 ASREQ

4.2 Deliverable Submission

The contractor shall submit deliverables at the frequencies listed in paragraph 4.1 and as detailed on the applicable DD

Form 1423-1. The contractor shall use e-mail for administrative coordination issues and CDRL items designated by the PMO. Information classified up to Secret can be transmitted via SIPRNET e-mail.

4.3 Management Reports

Report format and contents shall be determined by the COR. The contractor shall brief the contents of these reports to designated Government representatives as requested by the COR or PMO.

5.0 TRAVEL AND OTHER DIRECT COSTS

5.1 Travel Requirements

Contractor may be required to travel during the performance of this PWS. The requirements for prior approval, including theater clearance and force protection preparation, and reimbursement of travel are as specified in the base contract.

The contractor shall coordinate with GFM/NRRE stakeholders to identify training, support, and installation requirements for each period of performance (POP). The contractor shall develop a travel and other direct cost (ODC) plan that ensures continuity of operations and support while maximizing the operational value obtained using the travel and ODC funds allocated to each period of performance. During the execution of each POP, the contractor shall update the plan after each expenditure or projected change in requirements and brief the COR and PMO on the updates.

The contractor shall submit trip reports to the COR within 5 business of trip completion.

5.2 Material Costs

The contractor shall forecast estimated material costs below the DoD micro-purchase threshold (e.g. references materials, technical standards, administrative supplies, etc.) for each POP and include these in the travel and ODC plan described above.

5.3 Prior Approval

Costs associated with travel shall be billed as direct cost. Contractor shall receive approval by the Technical Representative prior to contractor’s departure. Such requests for approval shall be made as soon as practical after the need for travel is identified. Contractor shall receive approval by the COR for the purchase of any direct cost items prior to acquisition of the product or service.

6.0 SECURITY REQUIREMENTS

This section supplements Block 13 of the Government provided DD Form 254, Contract Security Classification Specification. The following security requirements shall apply to this effort.

Work performed under this contract/order is up to the SECRET level. Therefore, the company must have an interim or final SECRET Facility Clearance from the Defense Counterintelligence and Security Agency Facility Clearance Branch.

6.1 Security Clearance

All personnel performing on or supporting a USFF contract/order in any way shall be U.S. citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below.

Contractor personnel must possess the interim or final security clearance eligibility delineated in the table below when performance starts.

PWS Task / Subtask

Clearance Level

Level of Classified Access

Justification for Access to Classified

PWS Section 3 and all subsections

SECRET SIPRNet The work performed by the Contractor will include access to unclassified and up to SECRET data, information, and spaces. The Contractor will be required to attend meetings classified up to SECRET level and provide technical documentation/reports up to the SECRET level.

6.2 Visit Authorization Letters (VAL)

Visit requests shall be processed and verified through the Defense Information System for Security (DISS) to USFF SMO 000604. Include other DISS SMO codes as applicable. DISS visits for contracts/orders are identified as “Other” or “TAD/TDY” and will include the Contract/Order Number of the contract/order in the Additional Information section.

If DISS is not available, the VAL must contain the following information on company letterhead:

Company name, address, telephone number, facility security clearance

CAGE CODE

Contract/Order Number

Name, SSN, date and place of birth, and citizenship of the employee intending to visit

Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date and adjudication date & agency)

Name of COR/Alt COR

Dates or period the VAL is to be valid

6.3 Security Contacts

USFF Security Personnel can be contacted for Industrial or Personnel Security related issues via email at:

USFF_NFLT_N02C_SEC_STAFF@navy.mil.

U.S. Fleet Forces Command U.S. Fleet Forces Command ATTN: N02CSEC, Industrial Security Manager ATTN: N02CSEC, Personnel Security Manager 1562 Mitscher Ave., Suite 250 1562 Mitscher Ave., Suite 250 Norfolk, VA 23551-2487 Norfolk, VA 23551-2487

For USFF-specific security matters, contact the USFF Security Manager at:

Name: Mr. Walt King Phone: (757) 836-3581 E-mail: walter.l.king.civ@us.navy.mil

6.4 Operations Security

All work is to be performed in accordance with DoD and Navy Operations Security (OPSEC) requirements including the provisions of OPNAVINST 5510.1 (series) and Department of the Navy Information and Personnel Security Program regulations.

The nature of this task requires access to SECRET information. The work performed by the Contractor will include access to unclassified and up to SECRET data, information, and spaces. The Contractor will be required to attend meetings classified up to SECRET level. The contractor shall follow mandated procedures to ensure information access is limited to individual classification level (e.g. unclassified for any individual without a SECRET clearance).

Contractors are required to take Operation Security training. SECNAVINST 3070.2A, OPERATIONS SECURITY, directs that all personnel requesting access to any DON networks must receive formal OPSEC training prior to approval for access to any DON networks, and at least annually thereafter.

6.5 Cyberspace Workforce

The contractor shall meet the Cyberspace Workforce (CSWF) standards in accordance with DoDD 8140.01, DoD 8570.01-M, SECNAV M-5239.2, SECNAVINST 5239.20A and associated directives that revise or supersede these.

Contractors who perform information assurance duties or functions, whether primary or additional/embedded, on DoD computer systems (stand alone or networked) shall meet and maintain the certification requirements for each category, level, and operation environment as required.

The contractor shall identify, document, track, and report CSWF certification status and shall report change in contractor personnel or tasks that are subject to CSWF requirements. (CDRL A001)

6.6 Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information

Technology (IT) Systems or Protected Health Information Executive Order 13467, Reforming Processes Related to Suitability for Government Employee, Fitness for Contractor Employees and Eligibility for Access to Classified National Security Information, Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 Part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense (OSD), the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy command under this contract is required to obtain a DoD CAC.

Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager (CSM) upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

START-UP PERIOD

All contractor resource onboarding documents must be submitted via the prime contractor. The prime contractor shall make all necessary preparations to assume full responsibility for productive performance as of the performance start date.

Definition of "productive":

a. Visit Authorization Request (VAR)

b. Contractor Information Sheet (CIS)

c. FD-258 Fingerprint Card

d. Completed Electronic Investigation (EQIP)

e. All contractor resource(s) must have an active Defense Information System for Security (DISS) profile

f. Common Access Card (CAC)

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services and no reimbursement will be paid by the government for efforts expended during the start-up period.

Note (2): Foreign Nationals are not allowed access to the functional/system side of Enterprise Resource Planning

(ERP).

ACCESS TO DOD INFORMATION TECHNOLOGY (IT) SYSTEM

In Accordance With (IAW) Secretary of the Navy (SECNAV) M-5510.30, contractor employees who require access to Department of the Navy (DoN) or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to sensitive information. Sensitive information includes information protected under the Privacy Act, to include PHI. All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity's Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

INVESTIGATION REQUIREMENTS

All personnel requiring SECRET access under this contract/order shall undergo a favorably adjudicated Tier 3 (T3) Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. The Tier 3 Investigation will be maintained current within 10-years and requests for Secret Periodic Reinvestigations will be initiated by submitting a Tier 3R investigation prior to the 10-year anniversary date of the previous Tier 3 Investigation.

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check (NAC) with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance (IA) Technical Level 1, and must be trained and certified on the Operating System (OS) or Computing Environment (CE) they are required to maintain.

The contractor is required to have personnel cleared with an interim or final SECRET (as specified in the table located in section 6.1) at contract start date. If contractor personnel are replaced during performance of the contract, replacement personnel should also have interim or final clearance Secret (as specified in the table located in PWS Section 6.1).

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy CSM and ISSM/IAM manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy IT resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the Contracting Officers Representative (COR) shall sign the SAAR-N as the supervisor.

The SAAR-N shall be forwarded to the CSM at least thirty (30) days prior to the individual's start date. Failure to provide the required documentation at least thirty (30) days prior to the individual's start date may result in delaying the individual's start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Cyber Awareness training, and maintain a current requisite background investigation.

The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

INTERIM ACCESS

The CSM may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the contractor's security representative. Within three (3) work days after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the contractor's security representative. The contractor's security representative shall be the primary point of contact on any security matter. The contractor's security representative shall not be replaced or removed without prior notice to the Contracting Officer and CSM.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR

CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE DUTIES Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and PHI, provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check.

Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

SF-86 Questionnaire for National Security Positions (or equivalent Office of Personnel Management (OPM) investigative product)

Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission) Original Signed Release Statements

Failure to provide the required documentation at least thirty (30) days prior to the individual's start date shall result in delaying the individual's start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than ten (10) years) throughout the contract performance period. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements, ALL contractor employees shall in-process with the CSM upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy command's ISSM/IAM. Completion and approval of a SAAR-N form is required for all individuals accessing Navy IT resources.

The SAAR-N shall be forwarded to the Navy CSM at least thirty (30) days prior to the individual's start date. Failure to provide the required documentation at least thirty (30) days prior to the individual's start date shall result in delaying the individual's start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Cyber Awareness training and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the CSM. The CSM will review the submitted documentation for completeness prior to submitting it to the OPM. Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The CSM will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a VAR via the DISS or a hard copy VAR directly from the contractor's security representative. Although the contractor will take DISS owning role over the contractor employee, the Navy command will take DISS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT position category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee's performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR

CONTRACTORS ASSIGNED TO OR PERFORMING NON-SENSITIVE DUTIES

Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc.) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

Must be either a U.S. citizen or a U.S. permanent resident with a minimum of 3 years of legal residency in the U.S. (as required by the Deputy Secretary of Defense DTM 08-006 or its subsequent DoD Instruction) and

Must have a favorably completed NACI or T1 investigation equivalent including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the CSR must submit for all employees each of the following:

SF-85 Questionnaire for Non-Sensitive Positions Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission) Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably completed NACI or T1 equivalent investigation or ensure successful FBI fingerprint results have been gained and investigation has been processed with

OPM.

Failure to provide the required documentation at least thirty (30) days prior to the individual's start date may result in delaying the individual's start date.

* Consult with your CSM and ISSM/IAM for local policy when IT-III (non-sensitive) access is required for non-U.S.

citizens outside the U.S.*

6.7 Information Security and Other Miscellaneous Requirements Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the government facility. Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract/order.

Contractor employees with an incident report in DISS who have had their access to classified suspended will not be permitted to fill positions requiring access to classified information on a USFF contract/order.

The Contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

USFF retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

Contractor personnel will generate or handle documents that contain Controlled Unclassified Information or similarly designated information at the Contractor…