N00421-15-R-0003_AMENDMENT_0003.docx

N00421-15-R-0003

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION A - SOLICITATION/CONTRACT FORM

The following have been modified:

POINT OF CONTACT

AMENDMENT 0003: All changes made to the solicitation under this amendment are highlighted in yellow to the extent practicable.

Offerors are directed to reference the Attachment labeled “RFP Questions Amendment 0003” that was posted to Fed Biz Ops along with this RFP amendment.

AMENDMENT 0002:

The purpose of this amendment is to extend the proposal due date.

AMENDMENT 0001:

1) Offerors are directed to reference the Attachment labeled “RFP Industry Questions and Government Responses” that was posted to Fed Biz Ops on 23 March 2016 listing most of the revisions made to this RFP.

2) In addition to the changes called out in the Attachment referenced in Item 1) above, additonal revisions to this solicitation were made as follows:

a. In Section C: PWS, Requirements Section 3.4. The Government has removed the following Sub-Tasks: b, f, g, and h. The Government has determined it no longer has a requirement for these sub-tasks; therefore, they have been removed from this solicitation in their entirety.

b. In Section L, L-1, Part B, Volume 2, Paragraph 2.1.1. The Government has removed Sub-Tasks b, f, and g from Paragraph labeled, “From PWS Section 3.4 RDT&E Executive/RDT&E Lab Consulting/Business Support” due to the revision referenced in item “2a” above. Accordingly, Offeror’s should not address these specific Sub-Tasks (b, f, and g) in the Technical Volume submission as directed in the original solicitation.

c. In Section C: PWS, 16.0, Program Manager labor category. The Government has removed the word “weapon” from the first sentence in the Experience section of the labor category.

d. Section J: Attachments. Please note that the only changes to this section are as follows:

ADDED: ATTACHMENT P001 Workforce Qualifications REPLACEMENT: AMENDED P006 Breakout Prime REPLACEMENT: AMENDED P007 Breakout Subcontractor The Government can no longer tailor the language in this table; therefore, it appears that all original Attachments were removed; This is not the case. All Attachments to the original solicitation remain in effect, except as other wise noted above.

EMAIL ADDRESS:

victoria.cordial@navy.mil

CONTRACTING OFFICER REPRESENTATIVE:

TO BE DETERMINED AT CONTRACT AWARD

(1) This acquisition is a small business set aside competition that will result in placement of a Single Award Indefinite Delivery/Indefinite Quantity (IDIQ) contract. Both completion and term task orders are anticipated to be issued under this single award task order contract. NAVAIR clause 5252.211-9503 LEVEL OF EFFORT (COST REIMBURSEMENT) (NAVAIR)(DEC 2012) will be included in Term Task Orders.

(2) The Product/Service Code (PSC) for this procurement is R425. The NAICS code is 541330, and the small business size standard is $38,500,000 ($38.5M).

(3) The resulting Single Award IDIQ contract will have an ordering period of five (5) years.

(4) This contract has cost-plus-fixed-fee (CPFF) and cost reimbursement (non-fee bearing) line items.

(5) Task Orders issued under this contract award will utilize CLINs delineated by funding type.

(6) The Contractor will be required to have a TOP SECRET Facility clearance. See the Performance Work Statement regarding specific clearance level requirements for contractor personnel including some positions requiring a clearance level of SECRET with Single Scope Background Investigation (SSBI). The contractor will not be permitted access to classified information until a final DD254 is incorporated as an attachment to the contract award.

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

STATEMENT OF WORK

Item 1000 - The contractor shall provide Services in accordance with (IAW) and within the scope of Section C - Performance Work Statement (PWS) of the basic contract and as detailed in the individual Task Order PWS.

Item 2000 - The contractor shall provide Travel IAW the NAVAIR clause 5252.237-9509 and within the scope of Section C - PWS of the basic contract and as detailed in the individual task order PWS.

Item 3000 - The contractor shall provide Material IAW the H-1 clause RESTRICTION ON THE DIRECT CHARGING OF MATERIAL and within the scope of Section C - PWS of the basic contract and as detailed in the individual Task Order PWS.

Item 4000 - The Data to be furnished hereunder shall be IAW the Exhibit A, DD Form 1423, Contract Data Requirements Lists (CDRLs) and within the scope of Section C - PWS of the basic contract and as detailed in the individual Task Order PWS.

PERFORMANCE WORK STATEMENT

Research, Development, Test and Evaluation (RDT&E) Laboratory (Lab) Information Technology (IT) Support/Navy RDT&E Executive

1.0 INTRODUCTION

The Research, Development, Test and Evaluation (RDT&E) Infrastructure Division is responsible for the Naval Air Systems Command (NAVAIR) RDT&E network infrastructure. Additionally, this division provides the support and serves as the Navy Functional Area Management (FAM)/ IT Portfolio Manager for the Navy’s RDT&E Labs. The RDT&E Infrastructure Division also provides information assurance support via the RDT&E Lab Information Assurance Support Team (RLIST) to our RDT&E Labs, providing assistance and technical expertise to ensure compliance with various IA mandates and supporting the Certification and Accreditation (C&A) process. This division also provides various other IT and consulting type functions in support of the Navy’s RDT&E Labs and the RDT&E Executive, which is a NAVAIR 5.4 function, including support of the Service Management Office (SMO) within 5.4.1.2.

The goal of the RDT&E Infrastructure Division is to provide NAVAIR and its Government and commercial partners and customer communities of interest with enterprise solutions and services to meet their Information Technology requirements, as well as providing consulting resources to help ensure the Navy’s RDT&E Labs stay in compliance with the large number of IA/security mandates.

The division’s support is national in scope, including RDT&E support for more than one hundred fifty (150) laboratories and facilities at Patuxent River, MD; China Lake, CA; St. Inigoes, MD; Point Mugu, CA; Jacksonville, FL; Lakehurst, NJ; Orlando, FL; Cherry Point, NC; and San Diego, CA; and additional NAVAIR locations/annexes as required.

2.0 SCOPE

This Performance Work Statement (PWS) defines the requirements for providing technical and management support services for the RDT&E Infrastructure Division. Requirements include:

· Navy level & NAVAIR RDT&E FAM support. This covers oversight, management and day to day Operations & Maintenance (O&M) of the largest of the Navy’s software portfolios.

· Information Assurance support via the RLIST Team to our RDT&E Labs, providing assistance and technical expertise to ensure compliance with various IA mandates and supporting the Certification and Accreditation (C&A) process.

· Support for the Division’s Service Management Office/Business office to include administrative duties, Information Technology Procurement Request ITPR submissions, NMCI POC functions, travel & visit requests, document management and meeting facilitation.

· RDT&E Executive Management support and consulting.

The tasking in this PWS may require physical location at all NAVAIR locations, including the Naval Air Depots (Jacksonville, FL; Cherry Point, NC; and North Island, WA), NAWCAD (Patuxent River, MD and Lakehurst, NJ), NAWCWD (China Lake, CA and Point Mugu, CA), NAWCTSD (Orlando, FL), and Naval Air Weapons Station (NAWS), China Lake, CA. Other locations may include attached activities such as Air Test and Evaluation Squadron Nine and any activity or location that directly supports the program mission of NAVAIR and subordinate activities. For the purposes of this document, "RDT&E customer" is defined as anyone opening a work order or acquiring RDT&E support services under this contract.

2.1 Inherently Governmental Functions

No item in this PWS shall be interpreted to have the contractor performing services that are inherently Governmental services or personal services as defined in FAR 2.101. If any provision of the PWS conflicts with this term, this prohibition shall take precedence.

3.0 REQUIREMENTS

The Contractor shall provide qualified personnel, material, facilities, equipment, and other services necessary to support the Navy in the execution of this PWS. The Contractor shall provide monthly status reports in accordance with the Contract Data Requirements List (CDRL), Item A001.

The Contractor shall work with Government personnel to develop cross-functional/-discipline teams based on Integrated Product Team (IPT) concepts. Additionally, the Contractor shall ensure that their personnel understand and follow statutory and regulatory restrictions and standards of conduct when close working relationships, such as IPTs, are required. All Contractor team members shall have the knowledge and expertise to participate in problem-solving, the decision-making process (contractors will not be required to make inherently Governmental decisions), and the implementation of team decisions.

The Contractor shall remain knowledgeable in the Department of Navy and NAVAIR FAM processes. The Contractor shall remain current in their functional areas of expertise and evolving technologies for RDT&E functional areas.

The Contractor may also be required to attend Government sponsored training. The Contractor may be required to provide training to, or for, Government personnel as required, or if new technologies dictate, training may need to be held at the Contractor’s facility or other agreed upon locations.

The Contractor shall produce and update documentation/presentation materials, in accordance with CDRL A002, such as PowerPoint presentations, brochures, documents for display booths and other briefing materials to support Division objectives and business development.

The Contractor shall accomplish work as specified in this PWS. Performance of this work shall be measured in accordance with the Quality Assurance Surveillance Plan.

Functional areas to be supported under this contract are described in the sections below.

Project objectives, requirements, and funding will be defined with the issue of Task Orders (TO). A TO will be issued for new, well-defined projects supported under this contract.

Task Order Funding and expenditures for specific requirements or projects within a TO shall be tracked separately, as required by the project and defined in the TO.

This is a general statement of work. Specific requirements will be identified at the task order level.

3.1 Functional Area Manager (FAM) Support (CLIN 1000)

The Functional Area Manager (FAM) team is responsible for overall portfolio management of the Navy’s RDT&E Labs.

Portfolio management includes the oversight of the development, management, reduction, and consolidation of IT applications and databases with the authority to direct migration, consolidation, and/or retirement.

The FAM team represents both the Navy and NAVAIR in each of these functional areas as the Echelon I and Echelon II FAM.

The contractor shall:

a. Register NAVAIR & Navy RDT&E software applications and databases in the DON Applications and Database Management System (DADMS)

b. Recommend disposition of registered software applications and databases in DADMS to the appropriate Navy level Echelon I FAM

c. Map RDT&E Lab software applications and databases to the T&E taxonomy in DADMS

d. Conduct Business Case Analyses of NAVAIR & Navy RDT&E applications in DADMS and provide technical reports in accordance with CDRL A003

e. As required, serve as a consultant to the FAM representative to DON CIO working groups as a subject matter expert supporting the development IT Portfolio Management policy, processes, procedures and documentation

f. Assist database owners and developers with the registration of databases, metadata, and the development of functional area data architectures

3.2 Service Management Office (SMO) and Strategic Planning Support (CLIN 1000)

The Contractor shall provide support for the Services Management Office (SMO) within 5.4.1.2 handling administrative tasking as assigned to include, but not limited to: document management, configuration management, action item tracking & reporting, generating division level communiques, RDT&E User Group meeting facilitation, facilitating Annual Lab customer Service Agreements, employee check-in/check-out, facilitate the “key custodian’ duties maintaining log of issued keys, process visit requests through BASICS, administer and process travel requests, and perform security clearance validation.

Additionally, the contractor shall provide the resources necessary to assist with processes associated with the numerous IT procurements the Government initiates to include development and submission of IT Approval request through NAVAIR CIO, ensuring DADMS compliance, creation, and the routing and tracking of procurement documents regardless of Government purchase methods.

The Contractor shall:

a) Update, review and track Information Assurance (IA) vulnerabilities in the Vulnerability Management System as mandated by DOD.

b) Oversee and execute the notification of computer system availability, news, alerts and time sensitive information as it relates to RDT&E network and its infrastructure.

c) Track & document all Firewall Configuration changes and ensure all approved rules are submitted to the Firewall administrator to be implemented.

d) Download Security Technical Implementation Guides (STIG) updates from DISA and update corresponding 5.4.1 spreadsheets created to track STIG findings and mitigations.

The Contractor shall provide a resource to act as the 5.4.1 NMCI POC. Responsibilities include requesting new NMCI accounts, NMCI seats, tracking of orders, help with coordination of tech-refresh, disabling accounts, and submitting Move/Add/Change (MAC) requests.

The Contractor shall support the SMO process improvement initiative, which includes documenting evolving SMO processes and ensuring they are updated accordingly. Tasking may include configuration management and providing a Subject Matter Expert (SME) in the Footprints software tool (or equivalent/similar) which will provide our division insight into processes and areas for improvement.

The Contractor shall support the RDT&E Infrastructure Division’s Service Management and Strategic Planning initiatives to maintain and improve management and delivery of RDT&E services and network infrastructure. Support entails strategic and business planning, change management and integration of business functions to include critical processes such as Request Management, Incident Management, Problem Management, Service Level Management, Service Asset and Configuration Management and Change Management. The Contractor shall participate in implementing best practice solutions that allows us to facilitate and improve operational efficiency, standardize operations, reduce costs, improve service levels, improve customer satisfaction, and improve decision making. Contractor personnel providing support to this area must have familiarity with emerging concepts and methodologies. They may be required to serve as technical experts, as well as interact with other technical experts. Tasks may require the Contractor to:

· Perform a variety of studies, analyses, research and evaluations.

· Identify, conceptualize, evaluate, document, and recommend opportunities for process, program and project improvements.

· Provide documentation of current conditions, recommendations for improvements, resulting capability deficiencies, etc. (e.g. technology roadmaps, process models).

· Develop implementation strategy and plans.

· Design, architect and implement solutions to support RDT&E Service Management.

· Support implementation of ITSM tool and lead process integration activities, providing functional and technical insight to the ITSM tool users.

· Research, plan, coordinate and recommend future ITSM application solutions for conceptual design requirements.

· Aid in translating business requirements into technical requirements and help implement new functionality. Develop recommendations, enhancements and support in implementation of improvements based on various stages of the ITIL lifecycle.

· Develop, implement and maintain Strategic Plans, Project Management Plan and Project Plans for RDT&E Infrastructure Division teams.

· Keep abreast of industry developments and trends to aid in ensuring alignment with industry best practices.

3.3 RDT&E Laboratory Information Assurance Support Team (RLIST) (CLIN 1000)

The RDT&E Laboratory Information Assurance Support Team (RLIST) provides support to various RDT&E Labs across NAVAIR as required. The RLIST team standardizes, streamlines, and assists lab managers with IA and IT compliance requirements. RLIST serves as a single point of contact to obtain information and guidance to help ensure RDT&E approved Labs are certified and accredited, operate securely, and are compliant with the appropriate IA controls. The team goal is to minimize the impact of IA mandates for RDT&E Labs and maximize their ability to meet mission requirements enabling the Labs to fully concentrate on Fleet-driven support and operational needs.

The Contractor shall provide assistance and technical expertise to the RLIST Government lead to ensure compliance with various IA mandates while supporting the Certification and Accreditation (C&A) process.

The Contractor shall:

a. Ensure Single Scope Background Investigation (Secret) clearances are obtained for the personnel appointed as Information Assurance Workforce.

b. Ensure required employees are compliant with latest version of DOD 8570.01-M “Information Assurance Training, Certification, and Workforce Management,” ensuring all required individuals are IAT Level II certified.

c. Assist with and/or generate the Customer Requirements Brief (CRB) Questionnaire for presentation to NAVAIR/NAWCAD 7.2.6. Attend the CRB with Customer to understand the Information Assurance (IA) Plan defined at the CRB and address any issues identified during the CRB.

d. Develop appropriate Certification and Accreditation (C&A) documents, as identified in the CRB, to include, but not limited to: Non-Global Information Grid (GIG) Stand-alone C&A Package(s), Non-GIG Closed Loop C&A Package(s), DoD Information Assurance Certification and Accreditation Process (DIACAP) package(s), and Plan of Actions & Milestones (POA&M).

e. Perform vulnerability scans on all applicable systems.

f. Perform analysis of all scans to determine state of compliance with Defense Information Security Agency (DISA) Security Technical Information Guide (STIG), Information Assurance Vulnerability Alert (IAVA) compliance and vulnerabilities (Risk assessment). Document and provide recommendations to ensure compliance with all applicable policies and directives.

g. Perform system hardening as required to ensure systems are configured to operate at an acceptable level of risk.

h. Perform post-hardening scans for review and verification of system risk posture.

i. Document overall IA efforts, and provide post hardened system risk posture data for review by NAWCAD 7.2.6.

j. Provide embedded System Administration support as required by customers.

3.4 RDT&E Executive/RDT&E Lab Consulting/Business Support (CLIN 1000)

The Contractor shall be required to provide various high-level consulting to, and as requested by, the Navy RDT&E Executive. This may include tasking & support in the areas of:

a. Virtual System Command (VSYSCOM) data calls & reporting

b. Consulting on, supporting and facilitating high-level Navy or NAVAIR RDT&E strategy meetings

c. Acquiring and tracking data associated to RDT&E Labs to include requirements, investment opportunities and portfolio overviews.

d. Developing and briefing high-level dashboard reports

3.5 RDT&E Virtual SYSCOM Support (CLIN 1000)

The Contractor shall assist the 5.4.1 Division and 5.4 Department by interpreting, advising and developing strategies to support DoN Initiatives for providing RDT&E services and network infrastructure. This work requires both technical and strategic planning and facilitation of data collection and requirements interpretation for the NAVAIR RDT&E laboratory infrastructure and capabilities. The Contractor shall advise senior department and division personnel on courses of action related to the above topics that are in conformance with DoN Directives yet do not hinder accomplishing IBST Department and Infrastructure Division missions. Contractor personnel providing support to this area must have familiarity with DON RDT&E policies and their application across a diverse set of NAVAIR RDT&E capabilities. They may be required to serve as technical experts, as well as interact with other technical experts. Tasks may require the Contractor to:

a) Perform a variety of studies, analyses, plans, strategies, research and evaluations relating to the NAVAIR RDT&E environment.

b) Identify, conceptualize, evaluate, document, and recommend options for compliance with emerging DoN directives governing RDT&E facilities and services

c) Provide documentation of current conditions, requirements, capabilities existing in the NAVAIR RDT&E lab portfolio.

d) Design, architect and implement solutions to support IBST and Infrastructure Division requirements.

e) Research, plan, coordinate and recommend future opportunities to enhance capabilities for NAVAIR RDT&E laboratory services.

f) Aid in translating DoN policy objectives into executable technical solutions to the NAVAIR RDT&E lab environment

g) Remain apprised of emerging trends in DoD and DoN RDT&E lab community and facilitate alignment with the NAVAIR RDT&E environment.

4.0 CONTRACTOR’S PROGRESS, STATUS AND MANAGEMENT REPORT

Contractor’s Progress, Status and Management reports shall be submitted monthly in two parts –Part A – Technical Progress Report (CDRL A001) and Part B – Financial Progress Report (CDRL A002)

5.0 INFORMATION TECHNOLOGY POLICIES

5.1 Information Assurance.

All Information Assurance (IA) tasking performed by the Contractor shall comply with the following listed instructions to include those referenced within the below listing: (and subsequent updated versions)

1. ASD (NII) Directive-Type Memorandum (DTM) 08-027 – “Security of Unclassified DoD Information on Non-DoD Information Systems,” 31 July 2009

1. (Chairman of the Joint Chiefs of Staff Instruction) CJCSI 3170.01G (series), “Joint Capabilities Integration and Development System,” 1 March 2009

1. CJCSI 6211.02C (series) – “Defense Information System Network (DISN): Policy and Responsibilities,” 9 July 2008

1. CJCSI 6212.01E (series) – “Interoperability and Supportability of Information Technology and National Security Systems,” 15 December 2008

1. CJCSI 6250.01C (series) – “Satellite Communications,” 30 April 2007

1. CJCSI 6510.01E, “Information Assurance (IA) and Computer Network Defense (CND),” 15 August 2007

1. (Chairman of the Joint Chiefs of Staff Manual) CJCSM 6510.01A – “Information Assurance (IA) and Computer Network Defense (CND) Volume I (Incident Handling Program),” 24 June 2009

1. [Chief of Naval Operations/Headquarters, United States Marine Corps] CNO N614/HQMC C4 – “Navy-Marine Corps Unclassified Trusted Network Protection (UTN-Protect) Policy, Version 1.0,” 31 October 2002

1. Defense Acquisition Guidebook – Chapter 7 “Acquiring Information Technology, Including National Security Systems,”; Section 7.5 “Information Assurance (IA)”

1. DoD 5220.22-M, “National Industrial Security Program Operating Manual,” 28 February 2006 (NISPOM)

1. DoD 8570.01-M, “Information Assurance Workforce Improvement Program,” 19 December 2005 (Incorporating Change 2, 25 February 2010)

1. DoDD Number 5000.01 “The Defense Acquisition System,” 12 May 2003, Certified Current as of 20 November 2007

1. DoDD 8000.01 “Management of the Department of Defense Information Enterprise,” 10 February 2009

1. DoDD 8100.02, “Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG),” 14 April 2004, Certified Current as of 23 April 2007

1. DoDD 8115.01 “Information Technology Portfolio Management,” 10 October 2005

1. DoDD 8500.01E (series), “Information Assurance (IA),” 24 October 2002, Certified Current as of 23 April 2007

1. DoDD 8570.01 “Information Assurance Training, Certification, and Workforce Management,” 15 August 2004, Certified Current as of 23 April 2007

1. DoDI 5000.02, “Operation of the Defense Acquisition System,” 8 December 2008

1. DoDI 4630.8, “Procedures for Interoperability and Supportability of Information Technology (IT) and National Security Systems (NSS),” 30 June 2004

1. DoDI 8115.02 “Information Technology Portfolio Management Implementation,” 30 October 2006

1. DoDI 8500.2, “Information Assurance Implementation,” 6 February 2003

1. DoDI 8510.01, “DoD Information Assurance Certification and Accreditation Process (DIACAP),” 28 November 2007

1. DoDI 8520.2, “Public Key Infrastructure (PKI) and Public Key (PK) Enabling,” 1 April 2004

1. DoDI 8551.1, “Ports, Protocols, and Services Management (PPSM),” 13 August 2004

1. DoDI 8580.1, “Information Assurance in the Defense Acquisition System,” 9 July 2004

1. DoDI 8581.01, “Information Assurance (IA) Policy for Space Systems Used by the Department of Defense,” 8 June 2010

1. DON CIO Memo 02-10, “Department of the Navy Chief Information Officer Memorandum 02-10 Information Assurance Policy Update for Platform Information Technology,” 26 April 2010

1. DON letter 5239 NAVAIR 726/2322, “NAVAIR Data at Rest Policy,” 18 February 2009

1. Federal Information Processing Standards Publications (FIPS PUB) [http://www.itl.nist.gov/fipspubs/by-num.htm]

1. (National Security Telecommunications and Information Systems Security Policy) NSTISSP No. 11, “Revised Fact Sheet National Information Assurance Acquisition Policy,” July 2003

1. (Office of the Chief of Naval Operations) OPNAV INST 5239.1C, “Navy Information Assurance (IA) Program,” 20 August 2008

1. SECNAVINST 5000.2D, “Implementation and Operation of the Defense Acquisition System and the Joint Capabilities Integration and Development System,” 16 October 2008

1. SECNAV M-5239.1, “Department of the Navy Information Assurance Program; Information Assurance Manual,” November 2005

1. SECNAVINST 5230.15, “Information Management/Information Technology Policy for Fielding of Commercial Off the Shelf Software,” 10 April 2009

1. SECNAVINST 5239.3B, “Department of the Navy Information Assurance Policy,” 17 June 2009

1. SECNAV Instruction 5000.36A, “Department of the Navy Information Technology Applications and Data Management,” 19 December 2005

1. SECNAVINST 5239.19, “Department of the Navy Computer Network Incident Response and Reporting Requirements,” 18 March 2008

1. SECNAV INST 5510.36 Information and Personnel Security Program Regulation

1. The National Security Act of 1947

1. U.S.C. Title 40/Clinger-Cohen Act

5.1.1 System Software/Application Compliance.

The Contractor shall perform all Information Technology Systems or software/application development, modification or support in accordance with Defense Business Transformation guidance (formerly Business Management Modernization Program (BMMP)), DON/NAVAIR Functional Area Manager (FAM) Policies and Guidance, Network and Server Registration, and Web Enablement mandates.

5.1.2 Web Sites, Web Enablement and Application / System Development, Modification, and Maintenance Support Services.

The Contractor shall perform all Information Technology systems, software, and website development, modification or support in accordance with all applicable Federal, DoD, DON, and NAVAIR policy, guidance, standards, and strategies, and should be integrated with MyNAVAIR (NAVAIR Corporate Portal) whenever possible. Policies include, but are not limited to:

a. OMB Guide for Managing U.S. Government Websites http://www.firstgov.gov/webcontent/

b. OMB Policies for Federal Public Websites, OMB M-05-04 http://www.firstgov.gov/webcontent/policies_and_implementation.shtml

c. Section 508 Standards, http://www.section508.gov/

d. DOD Web Policy and Guidelines, http://www.defenselink.mil/webmasters/

e. Navy Information Operations Command (NIOC) Norfolk Web Risk Assessment Team Website, https://www.niocnorfolk.navy.mil/operations/wra/wra.shtml

f. SECNAV 5720.47B DON Policy for Content of Publicly Accessible Web Sites (NIOC Norfolk routinely monitors publicly accessible Navy websites for policy compliance; Site has a downloadable "Website Self-Assessment Checklist" for Webmasters), http://www.chinfo.navy.mil/navpalib/internet/secnav5720-47b.pdf

g. NAVAIR CIO Website (NAVAIR specific policy and guidelines), https://cio.navair.navy.mil/

5.1.3 Software Development/Server Procurement.

The Contractor shall ensure that all Contractor-developed tools that will be hosted by the Navy Marine Corps Intranet (NMCI), or run on NMCI workstations, are certified for NMCI and comply with NMCI policy.

5.2 Enterprise Architecture.

5.2.1 Disclosure of existing networks, circuits or connections.

The Contractor shall identify any and all networks, circuits or connections between the contractor and any NAVAIR site/system/network. Failure to comply and subsequent discovery of an unregistered network, circuit or connection shall be grounds for immediate disconnection.

5.2.2 IT Approval.

The Contractor shall not purchase any Information Technology (IT) equipment in support of this contract without a NAVAIR Command Information Officer (CIO) signed IT approval if required. The IT Approval will be obtained in coordination with the COR / ACOR.

The Government will provide all necessary reference documents not otherwise available to the Contractor as required. Throughout the life of the contract, if any instruction or document is replaced or superseded, the replacement or superseding instruction or document shall be applicable to the requirements defined in this PWS.

6.0 IT REQUIREMENTS

Contactor personnel who will use an NMCI computer, or any follow-on Government directed computer system, or be required to access any DoD computer system or websites, shall obtain and utilize a DoD Common Access Card (CAC) and certified Public Key Infrastructure (PKI) certification and encryption. The Contractor shall provide CAC Readers to its personnel as needed.

7.0 FACILITIES

Government-Provided Support Facilities. The Government will provide onsite space for Contractor personnel. If there is no requirement for on-site support for a specific task, Government will coordinate with Contractor as needed. Most billets will be located at the Patuxent River location, but some billets will reside at other NAVAIR locations described in Section 2.0. The facilities may be jointly occupied by Government and Contractor personnel. The Contractor shall provide necessary office space for non-direct administrative and program management support personnel. The geographical location of the Contractor's facilities with respect to the Government's facilities is not restricted

8.0 GOVERNMENT FURNISHED PROPERTY/INFORMATION (GFP/GFI)

Navy Marine Corps Intranet (NMCI) The Government will provide all NMCI or RDT&E services needed for the Contractor to perform requirements under this contract, which may include IT-related hardware, software, and support. The Contractor shall coordinate these services through the COR.

Contractors performing on-site support will be provided access to workspaces, NMCI computers (or RDT&E machines as required) printers, facsimile machines, copy machines, shredders, and network access. The workspaces will normally be available from 0600 to 1800 Monday through Friday. Exceptions to these hours shall be coordinated with the COR.

9.0 TRAVEL & TRANSPORTATION

9.1 The Contractor shall be required to travel and/or work on-site at the Government's request, see Section H Clause 5252.232-9509 Travel Approval and Reimbursement Procedures for further instruction. The Government shall reimburse the Contractor for allowable travel costs, exclusive of fee, incurred by the Contractor in performance of the contract IAW FAR Subpart 31.2 and with rules set forth for temporary duty travel in the Department of Defense Joint Travel Regulations, Volume II, for civilian personnel. The Contractor is responsible for making all travel arrangements for its personnel. The Contractor shall not bill costs associated with obtaining passports for Contractor personnel as a direct charge to this contract.

Possible travel locations include U.S. Navy homeports and ports of call (CONUS and OCONUS), U.S. Coast Guard stations, U.S. Navy and Marine Corps air stations (CONUS and OCONUS), U.S. Navy supply and logistic centers, as well as deployed ships. Emergent technical support requirements will occasionally require immediate travel with no prior notification. Anticipated travel locations include, but are not limited to the following: China Lake, CA; Pt. Mugu, CA; Lakehurst, NJ; Orlando, FL; St. Inigoes, MD; Norfolk, VA; Cherry Point, NC; Washington, DC.

10.2 All material associated with this contract that is purchased by the Contractor and billed to the Government shall become the property of the Federal Government. Any material remaining after the completion of a task order, the cost of which has been reimbursed by the Government, will remain Government property and will be transferred to the Government by way of Material Inspection and Receiving Report (DD Form 250).

11.0 SECURITY/OPERATIONS SECURITY (OPSEC)

11.1 Only U.S. citizens may perform under this contract.

11.2 All employees require a Secret clearance. Additional security requirements are identified in minimum labor qualifications.

11.3 The Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of controlled unclassified and classified information and to control distribution of controlled unclassified and classified information in accordance with the National Industrial Security Program Operating Manual (NISPOM) and the DoD Information Security Program Manual (DoD 5200.01). The attached DoD Contract Security Classification Specification and DD Form 254 defines program specific security requirements. All controlled unclassified information shall be appropriately identified and marked as For Official Use Only (FOUO) in accordance with DoD 5200.01, Information Security Program: Controlled Unclassified Information (CUI) Volume 4 (enclosure 3) and DoD 5400.7-R (Freedom of Information Act Regulation) (Chapter 3). All Contractor facilities shall provide an appropriate means of storage for controlled unclassified and classified documents, equipment and materials in accordance with OPSEC requirements.

11.4 For Official Use Only (FOUO) information generated and/or provided under this contract shall be marked and safeguarded as specified in DoD 5200.01 (DoD Information Security Program: Controlled Unclassified Information (CUI)) Vol. 4 (enclosure 3 pages 11-17) available at http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf and DoD 5400.7-R, Freedom of Information Program Chapter 3 (pages 31-42) available at http://www.dtic.mil/whs/directives/corres/pdf/540007r.pdf.

11.5 All controlled unclassified technical information shall be appropriately identified and marked with the distribution statement identified on the source document or as directed by the COR.

11.6 The Contractor shall develop, implement and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment and material used or developed by the Contractor and any subcontractor during performance of the contract. The Contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. The OPSEC program shall be in accordance with National Security Decision Directive (NSDD) 298, and at a minimum shall include:

a. Assignment of responsibility for OPSEC direction and implementation.

b. Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

c. Establishment of OPSEC education and awareness training.

d. Provisions for management, annual review and evaluation of OPSEC programs.

e. Flow down of OPSEC requirements to subcontractors when applicable.

The Contractor shall prepare an Operations Security Plan for Government review in accordance with Exhibit A, CDRL A004.

12.0 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

The Government will conduct quality surveillance via various methods including formal and informal meetings, review of technical reports, review of monthly progress reports, and review of deliverables as provided in the QASP (Attachment 004).

13.0 NON-DISCLOSURE AGREEMENTS

13.1 In the performance of this contract, the Contractor may have access to non-public proprietary information. The Contractor shall require that any employee performing services under this contract execute a non-disclosure agreement satisfactory to the Task Order Contracting Officer. The non-disclosure agreement shall acknowledge the Contractor and employee's duties with respect to non-public information and promise to comply with those obligations. Copies of the executed non-disclosure agreements shall be provided to the Government.

13.2 In accordance with OCI Clause 5252.209-9510(e)(5) and as appropriate, this contract provides for the contractor to provide technical evaluation and/or advisory and assistance services in support of acquisition planning and execution of NAVAIR programs. The contractor will have access to system performance, program/business sensitive, company proprietary and pre-decisional material/data, which shall not be disclosed to any entity, Government or otherwise, outside of the Air Vehicle Department unless specifically indicated by a designated Government point of contact or authorized in writing by the Contracting Officer. The Contractor shall not use for purposes other than performance under this contract; nor shall the contractor release, reproduce, distribute, or publish any data or analysis that is provided as GFI or produced in the performance of this contract; nor shall the contractor authorize others to do so, without written permission of the Contracting Officer. Further, the contractor shall, within 15 days after the effective date of this contract, obtain and provide to the COR signed Non-Disclosure Agreements (NDAs) signed by a duly authorized representative of the prime contractor, each subcontractor, and each consultant (provided as Contract Data Requirement List, Exhibit A CDRL A005) and shall obtain and provide to the COR signed individual NDAs with all contractor, subcontractor, and consulting personnel that performs work under this contract. Additionally, the contractor agrees to place in each subcontract affected by these provisions the necessary language to bind the subcontractor by these terms and conditions. IMPORTANT: Executing these non-disclosure agreements attached to this solicitation does not alleviate the contractual duties and obligations the Contractor has pursuant to NAVAIR Clause 5252.209-9510(e)(5) including but not limited to agreeing to execute agreements with companies furnishing proprietary data in connection with work performed under this contract.

13.3 In the event that the Contractor knows of or identifies that it has a commercial interest in the subject matter of any proposed or on-going agreement related to the services to be performed herein, the Contractor shall consider such interest a potential conflict of interest under paragraph (g) of NAVAIR 5252.209-9510, and promptly disclose it to the Contracting Officer.

14.0 IDENTIFICATION BADGES

The Contractor shall furnish all requested information required to facilitate issuance of identification badges, as required, and shall conform to all applicable regulations concerning their use and possession. ID media is U.S. Government property and shall be surrendered to the Pass and ID Office upon expiration or termination of employment or of the Contract. The Government will not check out Contractor personnel unless all media, including Common Access Cards (CACs), are returned in accordance with NASPAXRIV Instruction 5510.15, “Regulations Governing Admission to Naval Air Station, Patuxent River, Webster Field, and Navy Recreation Center Solomon’s” or other similar policies/procedures, as dictated by site of performance.

15.0 IDENTIFICATION OF CONTRACTOR PERSONNEL

Corporation affiliation shall be referenced on all written documentation that refers to Contractor personnel. This is required for internal and external communications. Similarly, Contractor affiliation shall be identified when answering phone calls and at the beginning of any meeting or conference where Contractor personnel are in attendance.

16.0 LABOR CATEGORY MINIMUM QUALIFICATIONS

Labor category positions and qualification are listed and described below. Contractor personnel shall meet and maintain all labor category requirements throughout contract performance. Personnel must have the identified security clearance level identified below one the first day of performance, or no later than thirty (30) days after contract award.

Computer Operator I

Duties: The Computer Operator I works under close personal supervision and is provided detailed written or oral guidance before and during assignments. As instructed, this worker resolves common operating problems and may serve as an assistant operator working under close supervision or performing a portion of a more senior operator's work.

Education: High School diploma or GED.

Experience: A minimum of one (1) year experience performing duties related to Information Technology, Information Assurance, CyberSecurity, or other IT based office duties.

Security Clearance: Secret.

Computer Systems Analyst I

Duties: Carries out fact finding and analyses as assigned, (usually of a single activity or a routine problem); applies established procedures where the nature of the system, feasibility, computer equipment and programming language have already been decided; may assist a higher level systems analyst by preparing the detailed specifications required by computer programmers from information developed by the higher level analyst, and may research routine user problems and solve them by modifying the existing system when the solutions follow clear precedents. When cost and deadline estimates are required, results shall receive closer review by senior contractor personnel.

The Contractor supervisor defines objectives, priorities, and deadlines. Computer Systems Analysts I work independently; adapt guides to specific situations; resolve problems and deviations according to established practices; and obtain advice where precedents are unclear or not available. Completed work shall be reviewed by senior contractor personnel for conformance to requirements, timeliness, and efficiency. Performs duties related to NMCI, ordering to include Move/Add/Change (MAC) requests and new accounts. Additionally, Analysts may be required to process employee check-in, ensuring entry into the base access system (BASICS II). Performs tasks under supervision.

Education: High school diploma/GED with minimum 2 years of experience or Bachelor’s degree.

Experience: Relevant experience performing the duties of the labor category as described in the Department of Labor functional description.

Security Clearance: Secret with SSBI (Single Scope Background Investigation).

Computer Systems Analyst II

Duties: Applies systems analysis and design skills in an area such as a record keeping or configuration management. The Computer Systems Analyst II reviews requirements, which consist of objectives, scope, and user expectations; gathers facts, analyzes data, and prepares a project synopsis which compares alternatives in terms of cost, time, availability of equipment and personnel, and recommends a course of action; upon approval of synopsis, prepares specifications for development of computer programs. Duties also include the ability to determine and resolve data processing problems and coordinate the work with program, users, etc. This worker orients user personnel on new or changed procedures, may conduct special projects such as data element and code standardization throughout a broad system, working under specific objectives and bringing to the attention of the supervisor any unusual problems or controversies.

In this position, the Analyst II works independently under overall project objectives and requirements, and apprises supervisor about progress and unusual complications. Guidelines usually include existing systems and the constraints imposed by related systems with which the incumbent's work must be meshed. This analyst may provide functional direction to lower level assistants on assigned work.

Education: High School diploma/GED with minimum 4 years’ experience or Bachelor’s degree with (2) years of experience. All but Three (3) FTE's will require IAT Level II certification in accordance with DoD 8570.01-M.

Experience: Relevant experience performing the duties of the labor category as described in the Department of Labor functional description.

Security Clearance: Secret with SSBI.

Computer Systems Analyst III

Duties: Applies systems analysis and design skills in an area such as a record keeping or configuration management. The Computer Systems Analyst III reviews requirements, which consist of objectives, scope, and user expectations; gathers facts, analyzes data, and prepares a project synopsis which compares alternatives in terms of cost, time, availability of equipment and personnel, and recommends a course of action; upon approval of synopsis, prepares specifications for development of computer programs. Duties also require the ability to determine and resolve data processing problems and coordinate the work with program, users, etc. This worker orients user personnel on new or changed procedures, may conduct special projects such as data element and code standardization throughout a broad system, working under specific objectives and bringing to the attention of the supervisor any unusual problems or controversies.

In this position, the analyst works independently under overall project objectives and requirements, and apprises supervisor about progress and unusual complications. Guidelines usually include existing systems and the constraints imposed by related systems with which the incumbent's work must be meshed. This analyst may provide functional direction to lower level assistants on assigned work.

Education: High School diploma or GED; with minimum 6 years’ experience or Bachelor’s Degree in an IT field with (3) years’ experience. All but Three (3) FTE's will require IAT Level II certification in accordance with DoD 8570.01-M.

Experience: Relevant experience performing the duties of the labor category as described in the Department of Labor functional description.

Security Clearance: Secret with SSBI.

Information Assurance Analyst

Duties: Provides technical support involving evaluation, integration, fielding, maintenance, testing, and operation of CEAT networks, systems and subsystems. Assist with the development of system IA documentation to support certification of compliance to applicable standards including DIACAP and DCID 6/9.

Education: High school diploma/GED with minimum 4 years of experience or Bachelor’s degree in Computer Science or related field. Requires at least an IAT II level certification in accordance with DoD 8570.01-M

Experience: At least four (4) years of practical CEAT computer security experience in secure network and system design, analysis, procedure/test generation, test execution and implementation of computer/network security mechanisms

Security Clearance: Secret with SSBI.

Management Analyst I

Duties: Provides financial and/or accounting support and other organization support elements and other activities. Assists in a variety of administrative, business and financial management activities, including, but not limited to cost and financial data analysis, workload forecasting and planning, reengineering initiatives, statistics and metrics, impact analysis of financial, acquisition and other regulatory changes, coordination and review of command-wide activities and preparation of budget and financial reports. May be required to use Navy ERP to extract data necessary in performing management and financial analysis and report preparation.

Education: High school diploma/GED with minimum 6 years of experience or Bachelor’s degree.

Experience: At least two (2) years of experience with Department of Navy administrative and business processes including activities related to financial data analysis, planning, and budgeting.

Security Clearance: Secret.

Management Analyst II

Duties: Provides financial and/or accounting support to the activity Accounting Department, Budget Department, Financial Systems Department or Business Operations Department, and other organization support elements and other activities. Applies knowledge of management functions, processes, and analytical methods or techniques to gather, analyze, and evaluate information required by program or project managers and customers. Draws conclusions and devises solutions to problems relating to improvement of management effectiveness, organizational structures, work methods and procedure efficiency, and resource requirements, utilization or control.