Draft_COMET_PWS-SOW.docx

SECTION C DESCRIPTIONS AND SPECIFICATIONS

C4I OPERATIONAL MAINTENANCE & ENGINEERING TRAINING (COMET)

STATEMENT OF WORK / PERFORMANCE BASED STATEMENT OF WORK

1 BACKGROUND

NAWCAD 4.11.3, Patuxent River, MD, is engaged in the research, development, design, integration, test and evaluation, deployment, training, technical management, and maintenance support for integrated Command, Control, Communications, Computers, and Intelligence (C4I) life-cycle engineering systems supporting various DoD and U.S. Navy sponsors to include NAVAIR, NAVSEA, and other DoD and Federal organizations. NAWCAD 4.11.3 engineering leverages communications and information systems emerging technologies, advanced interfaces, and innovative information management architectures on a variety of C4I systems and platforms to provide engineering and interactive information products to these clients.

2 SCOPE

This contract will leverage NAWCAD 4.11.3’s core capabilities involving C4I engineering and information systems to provide innovative information management architectures relating to interactive information and learning products to support our warfighters. With the constant advancement of C4I warfighting technologies and the constant pressure placed not only on the reliability of the equipment, but also on the effectiveness of the warfighter in utilizing and maintaining this equipment, the contractor shall provide the engineering products, tools and support needed in responding to this environment. This Statement of Work (SOW) defines specific requirements relating to the in-service engineering and interactive products envisioned under this effort. As a general scope, the following statements encompass the Government’s intentions on this contract:

1. Analysis of Navy and DoD engineering data processes, policy implementation, and standards compliance requirements, including Maintenance Material Management (3M) processes.

1. In-service engineering on C4I equipment suites that are found on board U.S. Navy’s surface and subsurface warships involving various communication, weapon and operational mission systems throughout product design, development, deployment and life cycle support.

1. Design and development of standards-based operations and maintenance engineering data architectures for DoD based C4I equipment.

1. Design and development of safety improvement product tools using key concept and scenario-based approaches.

1. Design and development of decision support product tools for installation, operation, maintenance, and safety of technical systems.

1. Design and development of engineering performance aids and product tools using interactive multimedia.

1. Development of engineering technical content, including methods and tools for markup, delivery, transformation, and management.

1. Project estimation, planning, scheduling, and reporting.

2.1 Inherently Governmental Functions

No item in this SOW shall be interpreted to have the contractor performing services that are inherently governmental services or personal services as defined in FAR 2.101. If any provision of the SOW conflicts with this term, this prohibition shall take precedence.

3 APPLICABLE DOCUMENTS

The following specifications, standards, instructions, and directives are incorporated by reference; the list is not all inclusive. Compliance with the detail, standards, specifications or policy contained in these documents is essential in the performance of this contract. Unless otherwise specified, a reference to a military specification, standard, or handbook, or to an industry standard adopted by DoD, will be to the specific version listed in the DoD Index of Specifications and Standards in effect at the time task orders are awarded.

3.1 References:

1. Joint Fleet Maintenance Manual- Rev C Change 1 (COMFLTFORCOMINST 4790.3, 25 NOV 2013)

1. Planned Maintenance System: Development of Maintenance Requirement Cards, Maintenance Index Pages, and Associated Documentation (MIL-P-24534A, 21 MAR 1991)

1. Ship's Maintenance and Material Management (3M) Manual (NAVSEAINST 4790.8C, 14 MAR 2013)

1. Ship’s Maintenance and Material Management (3M) System Policy (OPNAVINST 4790.4E, 31 OCT 2007)

1. Department of Defense Standard Practice: Reliability-Centered Maintenance (RCM) Process (MIL-STD-3034A, 29 APR 2014)

1. Policy for Preparation and Standardization of NAVAIR S1000D IETMs (NAVAIRINST 4120.11A, 10 OCT 2012)

1. International Specification for Technical Publications utilizing a Common Source Database, (S1000D, Issues 3.0-4.1)

1. DoN S1000D Technical Manual Quality Assurance Guidance, (NSWCCD-20-TR-2010/01, MAR 2009)

1. Performance Specification: Manuals, Technical, Quality Assurance Program; Requirements For (MIL-PRF-85337B, 11 APR 2012)

1. Interactive Multimedia Instruction Developer’s Guide (CENNAVAVNTECHTRA INSTRUCTION 1554.1, 27 JAN 14)

1. Guidance for Acquisition of Training Data Products and Services (Part 1 of 5 Parts), (MIL-HDBK-29612/1A, 31 AUG 2001)

1. Instructional Systems Development/Systems Approach to Training and Education (Part 2 of 5 Parts), (MIL-HDBK-29612/2A, 31 AUG 2001)

1. Development of Interactive Multimedia Instruction, Part 3 of 5 Parts), (MIL-HDBK-29612/3A, 31 AUG 2001)

1. Glossary for Training (Part 4 of 5 Parts), (MIL-HDBK-29612/4A, 31 AUG 2001)

1. Advanced Distributed Learning (ADL) Products and Systems (Part 5 of 5 Parts),(MIL-HDBK-29612/5, 31 AUG 2001)

4 TECHNICAL REQUIREMENTS

The contractor shall provide engineering and analysis of complex DoD based C4I systems relating to and supporting innovative and interactive information and learning products. The contractor shall support in-service engineering approaches as it relates to planned maintenance and training covering both currently deployed C4I systems, as well as new and emerging C4I systems still under development. This effort will include the design, development, implementation and training utilizing electronically based engineering processes for maintenance and training techniques on sophisticated military systems. These engineering solutions and interactive products will support the various C4I equipment suites that are found on board U.S. Navy’s surface and subsurface warships, DoD based air platforms and ground systems involving various communication, weapon and operational mission systems. In providing the engineering and analysis for these innovative and interactive information and learning tool products, the contractor will also be required to interact with fleet personnel to ascertain not only inputs for the engineering design and development phases, but to also support fleet personnel in their daily duties of in-service engineering and maintenance support for the mission based electronic equipment.

The second work area to be covered by this SOW will require the contractor to produce quarterly logistics maintenance data packages and semi-annual tailored logistics packages for C4I equipment covering planned maintenance on systems found on Navy/DoD platforms. These data packages will directly support fleet personnel in their daily shipboard duties of planned maintenance activities covering a wide range of communication and weapon system based C4I systems.

ENGINEERING & ANALYSIS (NON-PERFORMANCE BASED)

4.1 Maintenance Management Development

The contractor shall support the NAVSEA Maintenance, Material, Management (3M) system. The system is used throughout the U.S. Navy Fleet as part of the in-service engineering, maintenance and reliability of installed C4I equipment by providing engineering management, readiness and reporting procedures for U.S. Navy equipment suites. This program includes in-service engineering processes and procedures for the Planned Maintenance System (PMS), database generation, user-interface development and modifications, development and reliability for 3M applications, and the development, distribution, and management of PMS technical documentation. The PMS system also provides procedures for scheduling and accounting for PMS tasks on board ships. NAVSEA04RM, Director of Maintenance Engineering holds the Technical Warrant for RCM policy covering all NAVSEA based efforts that requires all maintenance developers to utilize MIL-STD-3034A methodologies to be NAVSEA RCM certified. NAVSEA requires RCM Level I (Backfit) certification for all personnel who develop, review, or approve changes to currently published maintenance tasks. Classic RCM (Level II) is required for this contract and covers those who develop, review, or approve maintenance requirements on new systems or equipment, or existing systems or equipment being used in a different application or arrangement. Classic RCM analysis is required during ship acquisition and during ship modernization alterations.

4.1.2.2 Produce the following deliverables:

· Software requirements documentation (CDRL A004)

· Software design descriptions (CDRL A009)

· Database design descriptions (CDRL A005)

· Software test plans (CDRL A006)

· Software test reports (CDRL A007)

· Requirement traceability matrices (CDRL A001)

· Software user manuals (CDRL A008)

4.1.2.2.1 Current PMS applications developed and required to be maintained include: SKED Maintenance Management and Scheduling System. This is a Fleet-wide (surface and subsurface) system to automate all scheduling and administrative tasks associated with the Navy PMS. Supporting Fleet Type Commanders (TYCOMs) in Norfolk and San Diego, the contractor shall assist NAWCAD 4.11.3 in providing total development support, including installation, configuration management, implementation of Fleet training, user technical support, business process revisions, and deployment planning. The use of SKED is mandatory for all Navy PMS schedules, including all ships in the Fleet, shore facilities, and intermediate maintenance facilities. The SKED software has been approved for use in the IT-21 and COMPOSE operating environments, and for use in the NMCI infrastructure. As this maintenance and management software is utilized and maintained on all ship networks, the contractor shall be required to maintain the various versions of this GFE software. Key technologies include Visual Basic, Microsoft .NET, and SQL Server.

4.1.2.2.2 PMSViewer. This is a Fleet-wide GFE distributed software application to display and print all Navy PMS documentation. The software is distributed quarterly on CD/DVD configurations. NAWCAD 4.11.3 works closely with In-Service Engineering Agents (ISEAs) and Commodity Specialists at Atlantic and Pacific based NAVSEA Logistics Centers (NAVSEALOGCENs) to define PMS document style requirements conforming to OPNAV instruction 4790. The PMSViewer uses XSLT to transform and display MIPs and MRCs provided in XML format. The PMSViewer application has been approved for use in the IT-21 and COMPOSE operating environments, and for use in the NMCI infrastructure. The contractor shall maintain this software. Key technologies include Visual C++ and Microsoft XML parser.

4.1.2.2.3 Navy PMS Editor (NPE) Authoring System. This is a document authoring system for the PMS Program. The NPE Authoring System is the principal method used by Commodity Specialists and ISEAs to author PMS MRCs and MIPs. The software allows authors to create and edit complex technical documents stored as SGML in a simplified “What You See Is What You Get” (WYSIWYG) user interface. The system is designed to be NMCI-compliant. The contractor shall maintain this software. Key technologies include Visual C++ and Microsoft XML parser.

4.1.2.2.4 PMS Content Model. NAWCAD 4.11.3 is responsible for the maintenance of the PMS Document Type Definition (DTD). The PMS DTD is the authoritative data structure used for storing PMS documents and 3M data. NAWCAD 4.11.3 works with NAVSEA to ensure the integrity of the content model. The contractor shall maintain the PMS Content Model. Key technologies include the Microsoft XML parser.

4.1.3 As authorized by the Navy and as allowed by ship deployment schedules, the contractor shall conduct installation, training, and technical tasking of various 3M, technical manual, and other Navy logistics systems on board the Navy’s surface and subsurface fleet. Tasking can include:

4.1.3.1 The contractor shall install Navy maintenance applications on the Navy Information and Application Product Suite (NIAPS) and Consolidated Afloat Networks and Enterprise Services (CANES). This also involves maintaining certification requirements for installation on these networks.

4.1.3.2 The contractor shall provide and can anticipate annually up to a quantity of 100-125 on-site ship and shore installations, activations, configurations, and training of NAVSEA PMS Logistics applications. These activities must be coordinated with the appropriate fleet authorities and the current shipboard hosting agencies and be authorized by the Government. (CDRL A014)

4.1.3.3 Provide, and report on, troubleshooting support services for PMS applications to meet fleet requirements via phone, e-mail, message or on-site visit. Troubleshooting support can vary based on new product roll out, software upgrades, or by the class of ship supported, however for estimating purposes, the Government would expect to see no more than 12 on-site requests and approximately 150-250 phone and/or email requests annually. (CDRL A001)

Typical software engineering, development and integration tasks includes purchasing and evaluating new software and hardware technologies for innovative and enhanced interactive products and tools. Developing concept of operations, performing requirements analysis, system design, data conversion, development, quality assurance, deployment, and training to meet mission oriented requirements. Tasks can support Navy surface and subsurface vessels, as well as air and ground based platforms.

4.2.1 The contractor shall evaluate and report on emerging engineering and information technologies including innovative C4I engineering enhancements and technological pursuits, multimedia, user interfaces, technical data markup, and software development tools and techniques and recommend application of new technology for product improvement or cost reduction. In analyzing the benefits of these product improvements and cost reductions, the contractor will be required to maintain and report metrics that will support the benefit of these new tools and techniques. (CDRL A001)

4.2.2 The contractor shall recommend standards-based technical approaches that support Navy or DoD sponsored product development and develop technical specifications and CONOPS for automation of engineering processes based on the identified operational and functional performance requirements. (CDRL A001)

4.2.3 The contractor shall conduct detailed user requirements analyses to determine and document business processes, administrative, technical and software engineering support requirements (CDRL A003), and recommend deployment options and strategy. (CDRL A001)

4.2.4 The contractor shall design system architectures and products. Specifically, the contractor shall:

4.2.4.3.1 Object, module, or component reuse to enhance deployment flexibility and efficiency in stand-alone, network, and learning management system (LMS) applications. (CDRL A009)

4.2.4.3.2 Reusable content strategies implementing standard markup languages such as XML, S1000D, and SVG for storage in files, relational databases and content management repositories. Content shall be in conformance with NAVAIR policy and specification guidance or other standards required by NAWCAD 4.11.3 customers. (CDRL A009)

4.2.4.3.3 Transformation and rendering to enable the reuse of content with technologies such as eXtensible Stylesheet Language Transformations (XSLT) and eXtensible Stylesheet Language Formatting Objects (XSL-FO). (CDRL A009)

4.2.4.3.4 Adoption and adaptation of XML content models to accommodate data structures and documents for the storage, display, and print of data from content delivery and content management systems. (CDRL A009)

4.2.6.5 Development of executive decision support and knowledge management solutions.

The contractor shall support engineering documentation development, review, and distribution on a wide variety of technical and knowledge based documents covering operations, technical and repair manuals, commercial and military specifications, engineering drawings, alteration drawings and specifications, charts, maps, and diagrams. Document format can be paper or electronic.

Specifically, the contractor shall:

4.3.1 Analyze technical document architectures and standards, training, planning and policy documents. Assess interoperability and implementation across applicable information systems. (CDRL A001)

4.3.2 Interface with DoD policy activities by reviewing draft documents, participating in planning processes, and recommending language that is consistent with practical and efficient software development practices. (CDRL A001)

4.3.3 Provide test, evaluation and support for implementation or review of DoD, Navy, and international standards initiatives. (CDRL A001)

4.3.4 Analyze information processing requirements relating to automation of maintenance support systems including data collection, documentation, and analysis. (CDRL A001)

4.3.5 Support interactive publications development for NAWCAD 4.11.3 and DoD operational communities.

4.3.6 Integrate or develop software to support performance support content creation using SGML/XML/S1000D and other applicable standards. (CDRL A012)

4.4 Technical Management Support

The contractor shall provide technical management support services associated with the engineering and technical tasks to be accomplished under this statement of work. Program and project management tasks include:

4.4.1 Development and maintenance of schedules

4.4.2 Identification of manpower and skill requirements

4.4.3 Cost estimation and analysis

4.4.4 Financial analysis

4.4.5 Tracking and progress analysis

4.4.6 Process and procedure analysis

4.4.7 Risk assessments

4.4.8 Development of supporting databases, spreadsheets, documents, charts, graphics, and briefing materials

4.5 The contractor shall accomplish the following functions and tasks associated with technical management support:

4.5.1 Establish and maintain reliable methods of communication with NAWCAD 4.11.3 to effectively and efficiently transfer information necessary to support the conduct of project and contract-related operations.

4.5.2 Communicate and coordinate with internal and external stakeholders on technical and programmatic issues, and collect feedback. Support internal and external working-level technical conferences and status meetings and provide meeting reports and trip reports. Perform the daily activities and ad hoc administrative actions associated with the execution of project tasks. (CDRLs A001, A014)

4.5.3 Develop and maintain planning documentation and conduct planning efforts necessary to identify, schedule, execute and monitor project-related tasks. This shall include program management plans, plans of action and milestones, change control management, project close-out reports, staffing plans and the input and maintenance of data in external planning databases. (CDRLs A010, A016)

4.5.4 Provide representation and/or briefing materials to support meetings with peer groups or industry organizations such as Integrated Process Team (IPT) meetings, configuration control boards, other participating project entities, standards committees or commercial forums. (CDRL A018)

4.5.5 Collaborate with Government personnel to define the scope of assigned projects. Monitor the scope throughout the duration of the project to ensure effective and adequate methods are in place to proactively address and manage changes in project scope. This may require the development and maintenance of a change control database, scope management plans and work breakdown structures for specific projects.

4.5.6 Create, deliver, and manage project schedules for each project. This will include an initial project schedule within 30 days of project startup, an intermediate project schedule at the end of the requirements analysis, and a detailed project schedule prior to beginning any development or integration. Project schedules will be updated monthly. (CDRL A016)

4.5.7 Develop cost estimates and update, monitor and control budgets for assigned projects. This may require the implementation of change management techniques to accomplish the effective control of project cost and scope. (CDRL A010)

4.5.8 Establish, deliver, and execute processes and methods to effectively identify, communicate, and manage the risks associated with assigned projects. Ensure project risks are factored into decisions affecting other technical management areas such as cost and schedule. (CDRL A019)

4.5.9 Support process improvement initiatives for existing technical, management, and business processes to increase effectiveness, efficiency, quality and cost performance.

4.5.10 Provide organizational planning and development support to ensure that adequate organizational structures, processes, tools and skill sets are available to support assigned projects. Typical efforts include strategic planning, organizational evaluations and organizational-level training.

4.5.11 Prepare and update management and process documentation in support of NAWCAD 4.11.3 projects and in accordance with standard quality management processes. (CDRL A020)

5 LOGISTICS SUPPORT (PERFORMANCE BASED)

5.1 Develop 3M and Navy Logistics packages for distribution to Navy surface and subsurface ships, shore activities, and ships provided to international partners under the foreign military sales program, as tasking may require. The contractor shall support the design, production and quality review of approximately 400 quarterly DVD packages that could require distribution to each ship in the U.S. Navy. This includes logistics for approximately 2,000 activities, 15,000 work centers, and 40 different distribution titles. This package will consist of databases, spreadsheets, updated MIPs, updated MRCs, and reports. Force Revision packages are to be generated quarterly, and shall be provided to the fleet with updated PMS documentation. (CDRL A002)

5.2 Publish Quarterly Force Revisions

The contractor shall process PMS data to produce four quarterly PMS Force Revisions annually. Quarterly Force Revisions consist of 15 - 45 PMS CD/DVD titles, and will involve the following:

· Process 78,000 - 90,000 PMS documents.

· Create PMS Change Indicator documents for each updated PMS document.

· Manage distribution of titles to control which documents go to which activities.

· Manage activity applicability to PMS titles to determine which titles go to which ships.

5.2.1 The contractor shall produce 4,400 - 7,500 disc images per Force Revision, and will involve the following:

· Force Revision discs shall comply with distribution statement D: Distribution authorized to DoD components and DoD contractors only.

· Force Revision disc images shall be duplicated at DoD or DoD contractor site.

· The contractor shall coordinate with Government representative to determine label requirements such as layout, distribution statement, art and color.

5.2.2 The contractor shall develop processes to ensure quality and correctness of each PMS title.

5.2.3 The contractor shall compile data, processes, and produce PMS Force Revision discs to meet quarterly revision distribution schedule, due on the 1st Monday of March, June, September, and December. (CDRL A008)

5.3 Publish Semi-Annual Tailored Force Revisions (TFRs)

The contractor shall process PMS data to produce two semi-annual TFRs (in March and September). TFR production consists of 9 - 15 TFR titles, and will involve the following:

· Processing 75,000,000 - 80,000,000 MRC Active/Inactive Decisions

· Processing 4,500,000 - 5,500,000 equipment records

· Processing 32,000 - 35,000 distinct MRCs

· Processing 2,000 - 2,500 distinct MIPs

· Processing TFR data for 140 - 160 U.S. Navy ships covering CV, CG, DDG, FFG, L-Decks, LCS & MCM Class ships

5.3.1 The contractor shall produce 230 - 250 disc images per Tailored Force Revision, and will involve the following:

· Tailored Force Revision discs shall comply with distribution statement D: Distribution authorized to DoD components and DoD contractors only.

· Tailored Force Revision disc images shall be duplicated at DoD or DoD contractor site.

· The contractor shall provide processes to ensure quality and correctness of each TFR title.

· The contractor will coordinate with Government representative to determine label requirements such as layout, distribution statement, art and color.

5.3.2 Provide processes to ensure quality and correctness of each PMS title.

5.3.3 The contractor shall deliver TFR packages 30 days from receipt of PMS data. (CDRL A002)

5.4 Not attempting to restrict the infusion of innovation, technology and/or efficiency on these tasks, the contractor is expected to provide, and to have access to the necessary database servers capable of protecting, importing, and processing the volume of records with associated file storage as detailed above. In addition, the contractor shall have the resources to produce up to 7,500 DVDs that will be required in support of the Forced Revisions and the Tailored Force Revisions tasking.

6 QUALITY MANAGEMENT

The contractor shall develop, implement, document, and maintain a quality management system to ensure conformance with contractual requirements and the specific quality and performance requirements of specific task orders to be issued under this contract. The quality management system should meet the intent of the American National Standards Institute/American Society for Quality ANSI/ASQ ISO 9001:2008, and/or equivalent governing body. Regardless of the standards that are applied, the contractor’s quality approach should be clearly defined and recognize the need to focus on customer satisfaction, defect prevention over inspection, management responsibility and continuous improvement. (CDRL A020)

6.1 Inspection System Plan (ISP)

The contractor shall submit an Inspection System Plan (ISP) for approval not later than 15 days after contract and first task order award. The ISP may include generic contractor procedures, for the level of effort CLINs, however for the CPFF Performance Based Completion and Fixed Price Integration effort, the ISP shall be specific regarding the work requirements stated in the SOW. (CDRL A021)

6.2 Planning Review

A thorough review of quality requirements shall be conducted to identify the controls, processes, skills, fixtures, tools, and test equipment needed to ensure product quality. The planning review shall also update inspection and testing techniques, instrumentation, and manufacturing methods and processes. Standard program data (test results, defects/failures identified, calibration results, etc.) that may be required by the Government to compile trend evaluation shall be available upon request.

6.3 Quality Management Plan

A draft copy of the contractor’s Quality Management Plan, as approved by the contractor’s management and that demonstrates conformance to the selected quality standard, shall be submitted as an addendum to the Technical Volume as required in Section L of the solicitation. The contractor’s Quality Management Plan should address all areas of work to be performed under the contract resulting from this solicitation to include hardware and software systems engineering, integration and installation, configuration management, logistics and contractor’s method for monitoring and reporting on the identified metrics. As with the ISP, the Government, for the Performance based CLINs, is expecting a level of detail that indicates the contractor grasps the Integration scope and the metrics that will be used to evaluate performance. The contractor will be required to provide a final version of this plan after award. (CDRL A020)

6.4 Process Documentation

All processes used to fabricate, assemble, modify, install, deploy, and test products shall be documented and updated. These written procedures and work instructions shall be made available to the employees required to perform the specific task. All procedures and work instructions shall be consistent with the contractor’s quality management system. (CDRL A001)

7 FACILITIES

7.1 Contractor-Provided Industrial Facility

7.1.1 As the contract requires support of the U.S. Navy surface and subsurface fleet, the contractor is encouraged to have facilities that give it the ability to support both the east coast and the west coast fleets. With technology and the type of work envisioned on this contract, the close proximity to the NAVAIR customer at St. Inigoes is not as critical. Considering the ties to the fleet In Norfolk, Va., NAVSEA headquarters in D.C. and NAVAIR locations in Southern Maryland, the contractor shall have a facility space or spaces that would allow for travel to all of these locations within a 5 hour drive time window. The contractor shall provide details of spaces proposed, and they shall be of sufficient size and locations to cover personnel and equipment required by this SOW. Considering the IDIQ nature of this contract, the Government recognizes that the “indefinite quantity” aspects may require a contractor to propose a “phased in” approach to providing facilities under this effort.

The Government may allow space to accommodate no more than 6 contractor employees on site at St. Inigoes.

7.1.2 This contract tasking requires close coordination with activities listed below located in:

· Norfolk, VA

· San Diego, CA

· NAVSEA Logistics Center, Det. Norfolk, VA - Planned Maintenance System (PMS) and Reliability Centered Maintenance (RCM) coordinating activity

· NAVSEA Logistics Center, Det. San Diego, CA - Planned Maintenance System (PMS) coordinating activity

· U.S. Fleet Forces Command, Norfolk, VA

· Type Commanders (TYCOMS)

· SUBLANT - Norfolk, VA

· SUBPAC - San Diego, CA

· SURFLANT - Norfolk, VA

· SURFPAC - San Diego, CA

· AIRLANT - Norfolk, VA

· AIRPAC - San Diego, CA

8 INFORMATION TECHNOLOGY (IT)

The Government will provide all necessary reference documents not generally available to the Contractor as required. Throughout the life of the contract, if any instruction or document is replaced or superseded, the replacement or superseding instruction or document shall be applicable to the requirements defined in this SOW. The Contractor shall not purchase any IT equipment on behalf of NAVAIR in support of this Contract, which reports to PBIS-IT, without a Naval Air Systems Command (NAVAIR) Command Information Officer (CIO) approved NAV-IDAS ITPR.

All IT procured on behalf of this contract shall meet all DoD/DON and NAVAIR IA polices. Failure to follow these policies will result in denied access to NMCI, One Net, Integrated Shipboard Network System (ISNS) and other DON, DoD and Joint Networks. These IA policies are standard across the Department and ensure IA compatibility and interoperability.

IT systems and or networks operated by contractors pursuant to a NAVAIR contract, regardless of the level of data processed, shall be operated in accordance with the NISPOM.

Contractor-owned equipment shall be permitted connections to NAVAIR/DoD networks in order to carry out the performance of this contract. All Contractor-owned hardware and/or software shall meet DoDI 8500.2 Cybersecurity Controls, is subject to validation scanning and must be approved by the NAVAIR site IA Manager prior to connection.

The following specific criteria must be met before the contractor may be connected to any DoD or NAVAIR network in support of this contract. Requirements include:

a. Network Vulnerability Scanning. NAVAIR Deputy CIO for Information Assurance maintains authorized auditing tools and shall provide for firewall/port scans, device discovery scan, vulnerability assessment, and other requirements as required to ensure secure interoperability with DoD Contracts. The contractor shall be responsible for the remediation of any equipment that fails these audits prior to the connection the system to the networks; Results of approvals shall be documented via Memorandum of Agreement with the Facility Security officer and the Defense Security Service Representative for that contractor;

b. Extent of Validation Scanning. To prevent scanning of corporate assets, all such networks, equipment and connections shall be physically segregated from any government/contractor corporate networks that are not in direct support of DoD contracts;

c. Circuit Provisioning. Any circuit or connection between NAVAIR and/or DoD site and the contractor site shall be provisioned via the Defense information Security Agency and comply with CJCSI 6211.02C (series), Defense Information System Network (DISN): Policy and Responsibilities, 9 July 2008;

d. Servicing Systems from a Remote Contractor Site. Remote Access Service connections that allow off-station operation and/or administration of contractor owned systems, located at any NAVAIR facility or site, shall not be permitted, with the exception of those systems connecting to the Command via the Outreach Services identified in Section 7, Enterprise Architecture;

e. Memorandum of Agreement and Inter-connection Agreements. An Information Assurance Memorandum of Agreement (MOA) between the contractor owning the equipment and AIR-7.2.6 shall be developed and signed before the equipment can be connected to NAVAIR networks. Failure to comply with the signed MOA shall be grounds for disconnection from the network.

8.1 Clinger-Cohen Act

In 1996, Congress enacted the Clinger-Cohen Act (CCA) requiring agencies to use a disciplined capital planning and investment control process to acquire, use, maintain and dispose of information technology. In accordance with the following Department of Defense Directive (DoDD), Department of Defense Instruction (DoDI), Office of the Secretary of Defense (OSD) memo, and Secretary of the Navy Instruction (SECNAVINST), CCA compliance is required for all programs that contain IT, including National Security Systems (NSS). NSS are defined in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-59. Six factors are used to identify NSS, one of which is IT in weapons and weapons system programs. The law provides authority to the agency’s Chief Information Officer (CIO) to manage IT resources effectively and ensure cybersecurity and interoperability. The authority to grant compliance with CCA as a statutory milestone program document resides at either first echelon or second echelon. The level of the Acquisition Category (ACAT) or designation as an Abbreviate Acquisition Program (AAP) determines which echelon has this authority. ACAT III and below acquisition programs CCA compliance assertion confirmation approval authority is delegated to the second echelon Command Information Officers. ACAT I and ACAT II acquisition programs CCA compliance assertion confirmation approval resides at DON CIO (First echelon). Approval of interoperability standards compliance for all acquisition programs resides at DON CIO. Approval of the Cybersecurity Strategy (formerly Acquisition Information Assurance Strategy) is a component of CCA compliance however it is approved separately. Approval authority is divided among the DoD, and DON CIOs as well as the second echelon Command Information Officers. See Table 1 for allocation of approval authorities.

X

X

X

X

X

X

X

III

X

IV

X

AAP

X

Table 1: Allocation of Cybersecurity Strategy Approval Authorities

Cybersecurity Strategy approval process begins after the Program Manager signs the Cybersecurity Strategy and puts it forward to the Command Information Officer. The final approved Cybersecurity Strategy is an appendix to the Program Protection Plan (PPP) as well as an element of CCA compliance (Interim DoDI 50000.02, Tables 2 and 9).

a. Interim DoD Instruction 5000.02, “Operation of the Defense Acquisition System”,November 25, 2013

b. OSD Memo, Clinger-Cohen Act Compliance Policy, Mar 8 2002

c. SECNAVINST 5000.2E, Implementation and Operation of the Defense Acquisition

8.2 System Software/Application Compliance

All Information Technology Systems or software/application development, modification or support shall be performed in accordance with Defense Business Transformation guidance (formerly Business Management Modernization Program (BMMP)), Department of the Navy (DON)/Naval Air Systems Command (NAVAIR) Functional Area Manager (FAM) Policies and Guidance, Network and Server Registration, and Web Enablement mandates.

8.3 Web Sites, Web Enablement and Application / System Development, Modification, and Maintenance Support Services All Information Technology systems, software, and website development, modification or support shall be performed in accordance with all applicable Federal, DoD, DON, and NAVAIR policy, guidance, standards, and strategies, and should be integrated within the NAVAIR Enterprise portal and collaboration environment whenever possible. Any Web sites/servers hosted/located in contractor facilities, or outside NAVAIR enclave, will transition to NAVAIR architecture and infrastructure in accordance with Legacy Shutdown guidance. Policies include, but are not limited to:

a. Office of Management and Budget Management of Federal Information Resources, OMB CIRCULAR NO. A-130 Revised.

b. OMB Policies for Federal Agency Public Websites, OMB M-05-04 http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-04.pdf

c. Section 508 Amendment to the Rehabilitation Act of 1973 http://www.section508.gov/

d. Department of Defense Web Policies and Guidelines http://www.defense.gov/webmasters

e. Navy Information Operations Command (NIOC) Norfolk Web Risk Assessment Team Website http:www.public.navy.mil/fcc-c10f/nionorfolk/Pages/AboutWRA.aspx

f. DON Policy for Content of Publicly Accessible World Wide Web Sites SECNAVINST 5720.47B www.navy.mil/navydata/internet/secnav5720-47b.pdf

g. NAVAIR CIO Website (NAVAIR specific policy and guidelines). To request this policy contact the NAVAIR CIO office – 7.2.2 Applications Integration team – Web Manager: Shane Malamphy at 301- 342-1825

h. Defense Information Systems Agency (DISA) Hosting of All Navy Websites (NAVADMIN 061/08) http://www.public.navy.mil/bupersnpc/ reference/messages/Documents/NAVADMINS/NAV2008/NAV08061.txt

i. Consolidation of Navy Web Sites - Reduction of IM/IT Footprint NAVADMIN 145/07 http://www.public.navy.mil/bupersnpc/ reference/messages/Documents/NAVADMINS/NAV2007/NAV07145.txt

j. DON Web Presence Policy: The Registration, Compliance of, and Investment in, All Unclassified Web Sites and Uniform Resource Locators http://www.doncio.navy.mil/ContentView.aspx?ID=577

k. Policy and Procedures for Web Risk Assessment (WRA) of Publicly Accessible Navy Sites (ALCOM 129/09) http://www.public.navy.mil/fcc‐c10f/niocnorfolk/Documents/NTD‐08‐09.txt

8.4 Software Development / Server Procurement

Any tools developed that will be hosted by the Navy Marine Corps Intranet (NMCI) or run on NMCI workstations will be certified for NMCI and comply with NMCI policy. Additionally, any servers supporting this effort will be transitioned to meet the requirements of the current NAVAIR Server Consolidation effort.

8.5 Cyber Security

NAVAIR’s Cybersecurity Program is a unified approach to protect unclassified, sensitive or classified information, and is established to consolidate and focus efforts in securing that information, including its associated systems and resources. Cybersecurity is required operationally throughout the DON. The DON CIO is responsible for IT within the Navy, as mandated by the Clinger-Cohen Act, and is the lead for departmental compliance with the Federal Information Security Management Act of 2002.

All Cybersecurity shall be in compliance with the following listed instructions:

a. ASD (NII) Directive-Type Memorandum (DTM) 08-027 – Security of Unclassified DoD Information on Non-DoD Information Systems, 31 July 2009

b. Chairman of the Joint Chiefs of Staff Instruction CJCSI 3170.01H (series), Joint Capabilities Integration and Development System, 10 January 2012

c. CJCSI 6211.02D Defense Information System Network (DISN): Policy and Responsibilities, 24 Jan 2012

d. CJCSI 6212.01F Net Ready Key Performance Parameter (NR KPP), 21 March 2012

e. CJCSI 6251.01D Narrowband Satellite Communications Requirements, 30 Nov 2012

f. CJCSI 6510.01F, Information Assurance (IA) and Support to Computer Network Defense (CND), 09 Feb 2011, certified current 10 Oct 2013

g. Chairman of the Joint Chiefs of Staff Manual CJCSM 6510.01B – Incident Handling Program 10 July 2012

h. Chief of Naval…