TES_-_SOW_Draft.docx

STATEMENT OF WORK

FOR

TECHNICAL AND ENGINEERING SERVICES

1.0 BACKGROUND

The Ship & Air Integration Warfare (SAIW) Division, NAWCAD 4.11.3, provides engineering and technical services to support the advanced research and development, systems engineering, and life-cycle support of electronics, communications, and information systems. These services are provided in response to tasking from Department of Defense, and other U.S. Government organizations. Efforts span the entire systems and equipment life cycle from initial needs assessment to sustainment and disposal.

2.0 SCOPE

SAIW is the lead design agent, system integrator, and product manager for the integration, test, production, and support of all systems involved with this effort. Many of these systems involve operational development due to the war-fighter’s rapid response requirements. SAIW Division is integrally involved in the design, production, and support of the end items. The contractor shall apply best commercial practices in support of SAIW Division’s tasks under this contract. This includes advanced research and development support, engineering and technical support, quality management support and technical management support of final end item products. The scope of the contract encompasses rapidly developed engineering designs for end products intended for immediate war fighter operation use, and may include strategic and tactical airborne, land-based, and mobile, sea-based surface and sub-surface, and space-based platforms, systems, subsystems and components. The following are representative of the programs, systems, and technology areas to which the requested engineering and technical services may be applied:

· Military and commercial radio communication systems

· Information and computer network systems

· Command and control systems

· Automatic identification technology systems

· Geographical information systems

· Integrated document management systems

· Multimedia systems

· Embedded and stand-alone sensors

· Unmanned Aerial Systems

It is anticipated that some of the work defined in this SOW will require personnel who will either have or be able to obtain security clearances which can lead to them being granted Sensitive Compartmented Information (SCI) access in order that they might perform tasks in an appropriately cleared facility. Tasking may potentially involve Contractor staff having to perform work within a SCI cleared facility where communications circuits and systems will be operating although the personnel involved will not actually be working with SCI material. They will rather be working on adjacent equipment in an SCI cleared facility where SCI data is being processed.

3.0 REQUIREMENTS

The following subparagraphs describe the advanced research and development support, engineering support, and technical tasks and functions to be accomplished under the contract. Unless otherwise specified, throughout this statement of work the reference to systems, solutions, capabilities, components, etc., applies to software as well as hardware whenever the required task or function can reasonably be applied to both. Physical security, information assurance policies, and the overarching guidance necessary to protect and safeguard hardware and information associated with the tasks performed under the contract, along with specific physical and information security requirements associated with the systems and equipment being provided, shall be strictly adhered to when applicable.

Efforts accomplished under the contract will ensure the hardware and software components composing communication and information systems developed and fielded by NAWCAD 4.11.3 will satisfy the operational and technical performance requirements of the sponsors and end users, and that life-cycle engineering, technical and logistics support is provided to fielded systems. The contractor shall not perform any inherently governmental functions as defined in FAR 2.101.

3.1 Concept and Technology Development

The contractor shall provide support for advanced research and development support, engineering support, and technical support to identify system needs and operational requirements, evaluate possible solutions, establish performance requirements, and develop system architectures and concepts necessary to satisfy customers’ requirements. The contractor shall accomplish the following functions and tasks associated with system concept and technology development:

3.1.1 Operational Requirements

Analyze the needs and assist in defining the operational requirements for new systems and/or capabilities to address deficiencies with existing systems, new mission requirements, or opportunities for improvements afforded by new technologies. Considerations shall include the existing system being replaced, operational processes and procedures, possible constraints and limitations, operational environment, reliability, maintainability, availability, and legacy and proposed systems with which the new system shall operate. (CDRL A002)

3.1.2 Operational Research and Evaluation

Provide technical support for the research and evaluation necessary to transform operational needs and requirements into defined operational objectives and system technical performance objectives, to guide the development of new or improved system capabilities. (CDRLs A001, A032)

3.1.3 Functional Research and Evaluation

Provide technical support for functional research and evaluation; assist in the development of baselines and conceptual architectures and designs necessary to satisfy the operational objectives and technical features of a proposed system. Provide assistance with addressing external as well as internal interoperability and interface issues. (CDRL A020)

3.1.4 Compare Attributes

Research, identify, provide, evaluate, and document competing alternative systems, concepts and technologies to provide information necessary to objectively compare their attributes (such as technical capability, risk, and cost) and, when all factors are considered, select and recommend the most appropriate solution. Consider Government off-the-shelf (GOTS), contractor off-the-shelf (COTS) and non-developmental item (NDI) solutions whenever feasible, and include issues specific to these solutions, such as data rights, supportability, licensing agreements, and copyrights as part of the evaluation. (CDRL A032)

3.1.5 System Requirements

Ensure traceability between a system’s operational requirements and its hardware and software implementation by documenting and providing information in a format that clearly demonstrates a logical flow, and validates the system’s components are necessary and sufficient to meet the system’s requirements. (CDRL A032)

3.1.6 Systems Engineering Test and Evaluation

Provide technical support for engineering and technical tests and evaluations to support and/or validate systems engineering and programmatic decisions. This shall include assisting with feasibility studies, trade studies, manpower studies, cost-benefit analysis, and system total-operating-cost analysis. (CDRL A020)

3.2 System Development and Design

The contractor shall provide the engineering and technical support necessary to convert system concepts into hardware and software components, integrate these components into a complete system, validate the associated operational capabilities, and verify the technical performance of prototype and developmental systems and models. Typical products for these efforts include engineering drawings and technical documentation, prototype and initial production systems, and evaluation test reports. Where appropriate, provide assistance with engineering and design practices that enhance development, modernization, compatibility, and cost efficiency, such as the use of open architectures and software reusability. The contractor shall accomplish the following functions and tasks associated with system development and design:

3.2.1 Proposed Design Solutions

Evaluate the feasibility and suitability of proposed design solutions. Provide support for appropriate risk mitigation efforts, such as modeling and simulation, when unproven technologies, unique concepts, or high-risk approaches are proposed. (CDRLs A001, A021, A032)

3.2.2 System Design

Provide recommendations on defining the subsystems and components composing a system design. Provide assistance with identifying and recommending assignment of functions as appropriate, and document and maintain an allocated baseline. Provide assistance with identifying and recommending assignment of the specific hardware and software items required to accomplish system functions, and document and maintain a product baseline. (CDRL A032)

3.2.3 Technical Documentation Research and Evaluation

Research and evaluate system-related technical documentation, such as technical manuals, interface control drawings, and design specifications, for completeness and accuracy. Identify deficiencies and provide recommendations for corrections or modifications. (CDRLs A014, A015, A016, A017, A018, A025, A026, A032).

3.2.4 Proposed Systems

Provide research, design, test, and evaluation support for the overall design of proposed systems. Develop, update, and maintain detailed engineering drawings and documentation associated with the design of hardware and software systems. Drawings and documentation shall address all aspects of the system and provide the details necessary to integrate, install, and maintain the subject system. (CDRLs A019, A020, A021, A022, A025, A032)

3.2.5 Computer Software Solutions

Provide research, design, test, and evaluation support for the design, development, and integration of computer software solutions. Provide support for the development and maintenance of documentation associated with the software development process. Utilize accepted best practices, techniques, and approaches to ensure effective and efficient software development and integration. Develop software in accordance with the guidelines and methodologies of Capability Maturity Model (CMM) Level III. Source code developed in support of the contract becomes the property of the U.S. Government. (CDRLs A004, A005, A007, A008, A009, A010, A011, A012, A013)

3.2.6 Software Interfaces

Provide research, design, test, and evaluation support for the design, development, integration, testing, and documenting of software interfaces with legacy and migration databases. Typical databases encountered perform various functions, including inventory control, maintenance commodity-specific information, in-transit visibility and asset visibility. (CDRLs A014, A015, A016, A017, A018, A019)

3.2.7 Software Technical Evaluation

Provide engineering, technical, and administrative support for formal and ad hoc engineering and software technical evaluations, such as preliminary design reviews, critical design reviews, and test readiness reviews. (CDRLs A001, A002, A016, A020, A031, A032)

3.2.8 Non-Standard Equipment

Provide research, design, test, and evaluation support for the development and testing of non-standard equipment, hardware, software, interface units or test fixtures not available from other sources. Assist in the development of installation drawings, procurement drawings, and technical documentation for such items. (CDRLs A007, A014, A015, A016, A021, A022, A025, A026, A029)

3.2.9 Operational and Technical parameters of a system

Provide technical support for the development of test and evaluation documentation necessary to validate and verify the operational and technical parameters of a system. Provide technical support for test planning and coordination by performing functions such as participating in planning meetings, identifying and coordinating required test resources and facilities, and developing test schedules. (CDRL A003, A014, A015, A016, A020, A021, A022)

3.2.10 Test and Evaluations

Provide technical support for the performance of developmental and operational system tests and evaluations. Assist with data collection, data reduction, and test result analyses. Efforts may also involve providing assistance with specialized testing such as shock, vibration, and electromagnetic interference. (CDRLs A017, A018, A021 A022, A026, A028, A029)

3.3 System Integration and Life-Cycle Support

The contractor shall provide the engineering and technical support services necessary to integrate the hardware and software components and subsystems composing communications or information systems into complete systems that satisfy sponsor and end-user operational and technical requirements. Provide technical support services for the life-cycle support of fielded systems and equipment to ensure their operational viability throughout their planned system life. Life-cycle support includes technical documentation, training, logistics support, system maintenance, system upgrades, and field support services. The contractor shall accomplish the following functions and tasks associated with system integration and life-cycle support:

3.3.1 System Integration

Provided technical support for the integration of the subsystems, components, and equipment comprising production communication and information systems. System integration shall include any required software. Provide technical support for production planning, including developing production schedules, coordinating the availability of required material and software, and developing and applying production work instructions as appropriate. The integration effort shall also include assisting with the implementation of quality/verification approaches to ensure the integrated system meets design specifications. (CDRLs A019, A020, A021, A025, A028)

3.3.2 Plans and Procedures

Provide technical support for the development of test plans and procedures necessary to evaluate the operational and technical parameters of integrated or installed systems. Both hardware and software shall be included in this testing. Assist with test planning activities, such as support for the development of test schedules, identifying and coordinating required test resources and facilities, and coordinating those activities with external support organizations. (CDRLs A004, A010, A012, A014, A015, A016, A030, A031, A032)

3.3.3 Integrated Production Systems Testing

Provide technical support for the testing of integrated production systems. Assist with data collection, data reduction, and test result analyses. Assist with identifying and documenting discrepancies as well as the actions taken to resolve those discrepancies, and provide feedback to engineering or production personnel as appropriate. (CDRLs A014, A015, A016, A020, A026, A028, A029, A031, A032)

3.3.4 Installation

Provide technical support for the installation, or coordination of installation, of completed systems at sponsor or end-user sites as directed. Provide technical support for the development of system installation plans that encompass all aspects of the installation, including required support services, such as material handling and electrical trades, while minimizing the impact on the receiving activity. Assist with system testing following installation, and customer acceptance testing to demonstrate proper system operation. (CDRLs A014, A015, A016, A017, A018, A019, A021, A028, A029)

3.3.5 Procurement

Analyze, and assist with defining, required material, equipment, technical data, and logistics support items (hardware and software), identify sources for the required items, prepare procurement documentation, and initiate procurements. These procurement efforts apply to developmental as well as production systems. (CDRLs A021, A022, A023, A024, A025, A026)

3.3.6 Equipment Accountability

Provided assistance with the receipt, tracking, inventory, issue, and monitoring of all material, equipment, technical data, and logistic support items throughout the entire acquisition process. Support the planning and coordination of the procurement and delivery of equipment with vendors to ensure deliveries meet required schedules. Assist with monitoring the status of the orders and the projected delivery dates of ordered material and equipment. Assist with ensuring all spare and interim repair parts necessary to support system integration/installation, and those required at the end-user’s site, are available to meet defined schedules. (CDRLs A021, A022, A023, A024)

3.3.7 Software Configuration

Provide technical support for system physical and software configuration audits and validate configuration data and documentation for fielded systems. Maintain and provide configuration status accounting reports; reports shall take into account all system hardware and software configuration items. (CDRLs A017, A018, A021, A024, A025, A026, A028)

3.3.8 Control Processes

Research, develop, and technical support for system configuration-control processes, including the development, revision, and updating of configuration-control documentation. Configuration management/control activities shall be applied to systems hardware, software, and associated technical documentation. (CDRLs A017, A018, A020, A021)

3.3.9 Operational Requirements

Research, develop, and provide technical support for the maintenance of technical documentation such as operations, technical, and maintenance manuals for designated systems, subsystems, and equipment. For COTS items, the contractor shall assist with obtaining commercially available technical manuals, and assist with the review and evaluation of such manuals for technical accuracy and adequacy. The contractor shall assist with adapting these manuals, when possible, to meet end-user operational requirements and/or maintenance specifications. Technical documentation shall be made available in electronic formats. (CDRLs A019, A025, A026, A027, A031)

3.3.10 Training Material

Develop, test, evaluate, and assist with maintaining training material to support user training on designated systems, subsystems, and/or equipment. Training material may include training plans, course outlines, presentations, or other training aids; the format and medium in which training material is provided shall be appropriate for the training delivery method. Training may include maintenance as well as operator training. (CDRLs A018, A022, A027)

3.3.11 Subsystems Training

Provide technical support for operator and/or maintenance training on designated systems, subsystems, and/or equipment. Training may be provided at NAVAIR facilities, at user sites, or at other locations as required. Training may include formal classroom training or on-the-job/hands-on training, or other training delivery methods. (CDRLs A021, A027)

3.3.12 Technical Problems

Research, evaluate, and provide technical support for the response to technical, maintenance, and training support requests from end-users and sponsors for supported systems, subsystems, and/or equipment. Assess and troubleshoot technical problems and determine required corrective actions. Correct problems when possible, or work with the end-users to facilitate problem resolution. Ensure feedback reports are provided to appropriate support organizations. (CDRLs A022, A026, A032)

3.3.13 Operational Performance

Research and evaluate the operational performance and effectiveness of supported systems, subsystems, and equipment. Provide recommendations for engineering, maintenance, or logistics changes required to correct or mitigate identified deficiencies. (CDRLs A022, A028)

3.3.14 System Changes

Provide technical support for the upgrade or replacement of supported systems, subsystems, and/or equipment in response to operational deficiencies, new requirements, and obsolescence. Research and evaluate new and emerging technologies to identify the potential to improve the operational performance of existing systems, and recommend system changes. (CDRL A032)

3.4 Technical Management Support

The contractor shall provide technical support for management efforts associated with the engineering, technical, and logistics tasks to be accomplished under this statement of work. The extent to which technical management processes and methodologies (and associated CDRLs) are applied shall be commensurate with the criticality and complexity of the assigned projects. The contractor shall accomplish the following functions and tasks associated with technical management support:

3.4.1 Communication Methods

Establish and maintain reliable methods of communication, such as e-mail, between its places of business and NAWCAD to effectively and efficiently transfer information necessary to support the conduct of project and contract-related operations.

3.4.2 Communication with Internal and External Stakeholders

Provide assistance with communicating and coordinating with internal and external stakeholders on technical and programmatic issues. The contractor shall support internal and external working-level technical conferences and status meetings and provide minutes or report of formal and/or informal meetings as required. The contractor shall perform the daily activities and ad hoc administrative actions associated with the execution of project tasks and provide progress reports. (CDRLs A002, A003, A028)

3.4.3 Project Planning Efforts

Develop and maintain planning documentation and support planning efforts necessary to identify, schedule, execute and monitor project-related tasks. This may include Program Management Plans, Plans of Action and Milestones, Project Close-Out Reports, Staffing Plans and the input and maintenance of data in external planning databases. (CDRLs A021, A035, A038, A041, A042)

3.4.4 Support for Meetings

Provide information and/or briefing materials to support meetings with peer groups or industry organizations, such as Integrated Process Team (IPT) meetings, configuration control boards, other participating project entities, standards committees, or commercial forums. (CDRLs A003, A032)

3.4.5 Scope and Requirements Definition

Collaborate with Government personnel and the SAIW Project Management Office (PMO) to research and define the scope, requirements, risks and deliverables of assigned projects. The contractor shall monitor the scope throughout the duration of the project to ensure effective and adequate methods are in place to proactively address and manage changes in project scope, schedule, and costs. This may require the development and maintenance of a project tracking database, change control database, scope management plans, and work breakdown structures for specific projects. (CDRLs A014, A022, A032, A035, A038, A040, A041, A042)

3.4.6 Develop and Monitor Cost Estimates and Budgets

Provide assistance to Government personnel and the SAIW PMO to support the development of cost estimates and to update, monitor and control budgets for assigned projects. This may require the implementation of earned value management or other similar techniques to accomplish effective control and management of project cost and tasks. (CDRLs A032, A034, A039)

3.4.7 Research, Evaluate, Identify, Communicate, and Manage Risks Analyze, and provide assistance with, the execution of processes and methods to effectively research, evaluate, identify, communicate, and manage the risks associated with assigned projects. The contractor shall ensure that project risks are factored into decisions affecting other technical management areas such as cost, scope and schedule. (CDRLs A002, A032, A035, A036)

3.4.8 Support for SAIW Processes, Initiatives, Business Rules and Tools Support and sustain SAIW PMO and ISO processes, initiatives, business rules and tools throughout the duration of all projects from initialization to closure. This includes improvement initiatives for existing technical, technical management and business processes to increase their effectiveness, efficiency, quality and cost performance. (CDRL A033)

3.4.9 Provide Organizational and Staff Planning

Provide recommendations on organizational planning to ensure adequate staffing and skill sets of the contractor team are available to support assigned projects. (CDRLs A043)

4.0 QUALITY MANAGEMENT

The contractor shall develop, implement, document, and maintain a quality management system to ensure conformance with contractual requirements and the specific quality and performance requirements of specific Task Orders to be issued under this contract. The quality management system should meet the intent of the American National Standards Institute/American Society for Quality ANSI/ASQ ISO 9001:2008, and/or equivalent governing body. Regardless of the standards that are applied, the contractor’s quality approach should be clearly defined and recognize the need to focus on customer satisfaction, defect prevention over inspection, management responsibility and continuous improvement. (CDRL A037)

4.1 Inspection System Plan (ISP)

The contractor shall submit an Inspection System Plan (ISP) for approval not later than 15 days after contract and first Task Order award. (CDRL A0XX)

4.2 Planning Review

A thorough review of quality requirements shall be conducted to identify the controls, processes, skills, fixtures, tools, and test equipment needed to ensure product quality. The planning review shall also update inspection and testing techniques, instrumentation, and manufacturing methods and processes. Standard program data (test results, defects/failures identified, calibration results, etc.) that may be required by the Government to compile trend evaluation shall be available upon request.

4.3 Quality Management Plan

A draft copy of the contractor’s Quality Management Plan, as approved by the contractor’s management and that demonstrates conformance to the selected quality standard, shall be submitted as an addendum to the Technical Volume as required in Section L of the solicitation. The contractor’s Quality Management Plan should address all areas of work to be performed under the contract resulting from this solicitation to include hardware and software systems engineering, integration and installation, configuration management, logistics and contractor’s method for monitoring and reporting on the identified metrics. (CDRL A0XX)

4.4 Process Documentation

All processes used to fabricate, assemble, modify, install, deploy, and test products shall be documented and updated. These written procedures and work instructions shall be made available to the employees required to perform the specific task. All procedures and work instructions shall be consistent with the contractor’s quality management system and provided to the Government as a deliverable. (CDRL A0XX)

5.0 FACILITIES

The contractor shall provide off-base support facilities for the performance of the contract. There will be no Government-provided facilities for exclusive use by the contractor. Government-provided facilities may be shared with other contractors. The contractor may require access to Government installations and facilities to carry out specific tasking, but facilities for day-to-day execution of this statement of work are the responsibility of the contractor. For the purposes of this section, facilities are defined as the physical structure, as well as the support required to occupy, utilize, and maintain the structure (such as janitorial services, trash collection and utilities). The geographic location of the contractor’s primary facility with respect to NAVAIR St. Inigoes is not dictated, but a forty-five mile target driving distance to the Government Program Office location at NAVAIR St. Inigoes is mandatory. If permanent facilities are not available to an offeror at time of contract award, a plan of interim facilities availability shall be provided as part of the proposal. The contractor’s permanent support facilities shall be in place no later than 120 days after contract award. All facilities shall meet the standards for access prescribed by the Americans with Disabilities Act of 1965.

5.1 Administrative Support Facilities

The contractor shall provide a conference room on an ad hoc/temporary basis to facilitate productivity and is not permanent seating. The contractor shall furnish and equip the facility to occupancy status and shall provide all equipment and material required for use in the facility.

5.2 Industrial Support Facilities

The contractor shall provide sufficient industrial space, 15,000 sq. ft. is considered the minimum, for the storage, integration, and testing of electronic equipment and systems associated with assigned projects. The space shall be configured to provide distinct and securable areas for receiving, material receipt inspection, equipment testing, storage awaiting buildup, a buildup area (including foundation, cabinet, and cable buildup), a machine shop for fabrication of pieces and parts, storage awaiting integration and testing, and storage of completed systems. The space shall be equipped with heating, ventilation and air conditioning (HVAC) systems capable of sustaining a controlled environment consistent with the storage, assembly, and operation of electronic equipment. The facility shall be protected by burglar and fire alarms, and a fire protection system. The contractor shall furnish and equip the facility to occupancy status and shall provide all equipment and material required for use in the facility.

6.0 IT CLAUSES

The Government will provide all necessary reference documents not generally available to the Contractor as required. Throughout the life of the contract, if any instruction or document is replaced or superseded, the replacement or superseding instruction or document shall be applicable to the requirements defined in this SOW. The Contractor shall not purchase any IT equipment on behalf of NAVAIR in support of this Contract, which reports to PBIS-IT, without a Naval Air Systems Command (NAVAIR) Command Information Officer (CIO) approved NAV-IDAS ITPR.

All IT procured on behalf of this contract shall meet all DoD/DoN and NAVAIR IA polices. Failure to follow these policies will result in denied access to NMCI, One Net, Integrated Shipboard Network System (ISNS) and other DoN, DoD and Joint Networks. These IA policies are standard across the Department and ensure IA compatibility and interoperability.

IT systems and or networks operated by contractors pursuant to a NAVAIR contract, regardless of the level of data processed, shall be operated in accordance with the NISPOM.

Contractor-owned equipment shall be permitted connections to NAVAIR/DoD networks in order to carry out the performance of this contract. All Contractor-owned hardware and/or software shall meet DoDI 8500.2 Cybersecurity Controls, is subject to validation scanning and must be approved by the NAVAIR site IA Manager prior to connection.

The following specific criteria must be met before the contractor may be connected to any DoD or NAVAIR network in support of this contract. Requirements include:

a. Network Vulnerability Scanning. NAVAIR Deputy CIO for Information Assurance maintains authorized auditing tools and shall provide for firewall/port scans, device discovery scan, vulnerability assessment, and other requirements as required to ensure secure interoperability with DoD Contracts. The contractor shall be responsible for the remediation of any equipment that fails these audits prior to the connection the system to the networks; Results of approvals shall be documented via Memorandum of Agreement with the Facility Security Officer (FSO) and the Defense Security Service Representative for that contractor;

b. Extent of Validation Scanning. To prevent scanning of corporate assets, all such networks, equipment and connections shall be physically segregated from any government/contractor corporate networks that are not in direct support of DoD contracts;

c. Circuit Provisioning. Any circuit or connection between NAVAIR and/or DoD site and the contractor site shall be provisioned via the Defense information Security Agency and comply with CJCSI 6211.02C (series), Defense Information System Network (DISN): Policy and Responsibilities, 9 July 2008;

d. Servicing Systems from a Remote Contractor Site. Remote Access Service connections that allow off-station operation and/or administration of contractor owned systems, located at any NAVAIR facility or site, shall not be permitted, with the exception of those systems connecting to the Command via the Outreach Services identified in Section 7, Enterprise Architecture;

e. Memorandum of Agreement and Inter-connection Agreements. An Information Assurance Memorandum of Agreement (MOA) between the contractor owning the equipment and AIR-7.2.6 shall be developed and signed before the equipment can be connected to NAVAIR networks. Failure to comply with the signed MOA shall be grounds for disconnection from the network.

6.1 Clinger-Cohen Act

In 1996, Congress enacted the Clinger-Cohen Act (CCA) requiring agencies to use a disciplined capital planning and investment control process to acquire, use, maintain and dispose of information technology. In accordance with the following Department of Defense Directive (DoDD), Department of Defense Instruction (DoDI), Office of the Secretary of Defense (OSD) memo, and Secretary of the Navy Instruction (SECNAVINST), CCA compliance is required for all programs that contain IT, including National Security Systems (NSS). NSS are defined in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-59. Six factors are used to identify NSS, one of which is IT in weapons and weapons system programs. The law provides authority to the agency’s Chief Information Officer (CIO) to manage IT resources effectively and ensure cybersecurity and interoperability. The authority to grant compliance with CCA as a statutory milestone program document resides at either first echelon or second echelon. The level of the Acquisition Category (ACAT) or designation as an Abbreviate Acquisition Program (AAP) determines which echelon has this authority. ACAT III and below acquisition programs CCA compliance assertion confirmation approval authority is delegated to the second echelon Command Information Officers. ACAT I and ACAT II acquisition programs CCA compliance assertion confirmation approval resides at DoN CIO (First echelon). Approval of interoperability standards compliance for all acquisition programs resides at DoN CIO. Approval of the Cybersecurity Strategy (formerly Acquisition Information Assurance Strategy) is a component of CCA compliance however it is approved separately. Approval authority is divided among the DoD, and DoN CIOs as well as the second echelon Command Information Officers. See Table 1 for allocation of approval authorities.

X

X

X

X

X

X

X

III

X

IV

X

AAP

X

Table 1: Allocation of Cybersecurity Strategy Approval Authorities

Cybersecurity Strategy approval process begins after the Program Manager signs the Cybersecurity Strategy and puts it forward to the Command Information Officer. The final approved Cybersecurity Strategy is an appendix to the Program Protection Plan (PPP) as well as an element of CCA compliance (Interim DoDI 50000.02, Tables 2 and 9).

a. Interim DoD Instruction 5000.02, “Operation of the Defense Acquisition System”, November 25, 2013

b. OSD Memo, Clinger-Cohen Act Compliance Policy, Mar 8 2002

c. SECNAVINST 5000.2E, Implementation and Operation of the Defense Acquisition

6.2 System Software/Application Compliance

All Information Technology Systems or software/application development, modification or support shall be performed in accordance with Defense Business Transformation guidance (formerly Business Management Modernization Program (BMMP)), Department of the Navy (DoN)/Naval Air Systems Command (NAVAIR) Functional Area Manager (FAM) Policies and Guidance, Network and Server Registration, and Web Enablement mandates.

6.3 Web Sites, Web Enablement and Application / System Development, Modification, and Maintenance Support Services All Information Technology systems, software, and website development, modification or support shall be performed in accordance with all applicable Federal, DoD, DoN, and NAVAIR policy, guidance, standards, and strategies, and should be integrated within the NAVAIR Enterprise portal and collaboration environment whenever possible. Any Web sites/servers hosted/located in contractor facilities, or outside NAVAIR enclave, will transition to NAVAIR architecture and infrastructure in accordance with Legacy Shutdown guidance. Policies include, but are not limited to:

a. Office of Management and Budget Management of Federal Information Resources, OMB CIRCULAR NO. A-130 Revised.

b. OMB Policies for Federal Agency Public Websites, OMB M-05-04 http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-04.pdf

c. Section 508 Amendment to the Rehabilitation Act of 1973 http://www.section508.gov/

d. Department of Defense Web Policies and Guidelines http://www.defense.gov/webmasters

e. Navy Information Operations Command (NIOC) Norfolk Web Risk Assessment Team Website http:www.public.navy.mil/fcc-c10f/nionorfolk/Pages/AboutWRA.aspx

f. DoN Policy for Content of Publicly Accessible World Wide Web Sites SECNAVINST 5720.47B www.navy.mil/navydata/internet/secnav5720-47b.pdf

g. NAVAIR CIO Website (NAVAIR specific policy and guidelines). To request this policy contact the NAVAIR CIO office – 7.2.2 Applications Integration team – Web Manager: Shane Malamphy at 301- 342-1825

h. Defense Information Systems Agency (DISA) Hosting of All Navy Websites (NAVADMIN 061/08) http://www.public.navy.mil/bupersnpc/ reference/messages/Documents/NAVADMINS/NAV2008/NAV08061.txt

i. Consolidation of Navy Web Sites - Reduction of IM/IT Footprint NAVADMIN 145/07 http://www.public.navy.mil/bupersnpc/ reference/messages/Documents/NAVADMINS/NAV2007/NAV07145.txt

j. DoN Web Presence Policy: The Registration, Compliance of, and Investment in, All Unclassified Web Sites and Uniform Resource Locators http://www.doncio.navy.mil/ContentView.aspx?ID=577

k. Policy and Procedures for Web Risk Assessment (WRA) of Publicly Accessible Navy Sites (ALCOM 129/09) http://www.public.navy.mil/fcc‐c10f/niocnorfolk/Documents/NTD‐08‐09.txt

6.4 Software Development / Server Procurement

Any tools developed that will be hosted by the NMCI or run on NMCI workstations will be certified for NMCI and comply with NMCI policy. Additionally, any servers supporting this effort will be transitioned to meet the requirements of the current NAVAIR Server Consolidation effort.

6.5 Cyber Security

NAVAIR’s Cybersecurity Program is a unified approach to protect unclassified, sensitive or classified information, and is established to consolidate and focus efforts in securing that information, including its associated systems and resources. Cybersecurity is required operationally throughout the DoN. The DoN CIO is responsible for IT within the Navy, as mandated by the Clinger-Cohen Act, and is the lead for departmental compliance with the Federal Information Security Management Act of 2002.

All Cybersecurity shall be in compliance with the following listed instructions:

a. ASD (NII) Directive-Type Memorandum (DTM) 08-027 – Security of Unclassified DoD Information on Non-DoD Information Systems, 31 July 2009

b. Chairman of the Joint Chiefs of Staff Instruction CJCSI 3170.01H (series), Joint Capabilities Integration and Development System, 10 January 2012

c. CJCSI 6211.02D Defense Information System Network (DISN): Policy and Responsibilities, 24 Jan 2012

d. CJCSI 6212.01F Net Ready Key Performance Parameter (NR KPP), 21 March 2012

e. CJCSI 6251.01D Narrowband Satellite Communications Requirements, 30 Nov 2012

f. CJCSI 6510.01F, Information Assurance (IA) and Support to Computer Network Defense (CND), 09 Feb 2011, certified current 10 Oct 2013

g. Chairman of the Joint Chiefs of Staff Manual CJCSM 6510.01B – Incident Handling Program 10 July 2012

h. Chief of Naval Operations/Headquarters, United States Marine Corps CNO N614/HQMC C4 – Navy-Marine Corps Unclassified Trusted Network Protection (UTNProtect) Policy, Version 1.0, 31 October 2002

i. Defense Acquisition Guidebook – Chapter 7, Acquiring Information Technology, Including National Security Systems, Section 7.5 Information Assurance (IA)

j. DoD 5220.22-M, National Industrial Security Program Operating Manual, February 28, 2006 (NISPOM)

k. DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19 Dec 2005 (Incorporating Change 3, 24 Jan 2012)

l. DoDD 8000.01 Management of the Department of Defense Information Enterprise, 10 February 2009

m. DoDD 8100.02, Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense (DoD) Global Information Grid (GIG), 14 April 2004, Certified Current as of 23 April 2007

n. DoDD 8570.01 Information Assurance Training, Certification, and Workforce Management, 15 August 2004, Certified Current as of 23 April 2007

o. DoDI 4630.8, Procedures for Interoperability and Supportability of Information Technology (IT) and National Security Systems (NSS), 30 June 2004

p. DoDI 8500.1, Cybersecurity, 14 March 2014

q. DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), 12 March 2014

r. DoDI 8520.2, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, 01 April 2004

s. DoDI 8551.1, Ports, Protocols, and Services Management (PPSM), 13 August 2004

t. DoDI 8580.1, Information Assurance in the Defense Acquisition System, 9 July 2004

u. DoDI 8581.01, Information Assurance (IA) Policy for Space Systems Used by the Department of Defense, 8 June 2010

v. DoN CIO Memo 02-10, Department of the Navy Chief Information Officer Memorandum 02-10 Information Assurance Policy Update for Platform Information Technology, 26 April 2010

w. DoN letter 5239 NAVAIR 726/2322 of 18 Feb 09, NAVAIR Data at Rest Policy

x. Federal Information Processing Standards Publications (FIPS PUB) http://www.nist.gov/itl/fips.cfm

y. National Security Telecommunications and Information Systems Security Policy NSTISSP No. 11, Revised Fact Sheet National Information Assurance Acquisition Policy, July 2003.

z. Office of the Chief of Naval Operations OPNAV INST 5239.1C, Navy Information Assurance (IA) Program, 20 Aug 08

aa. SECNAV M-5239.1, Department of the Navy Information Assurance Program; Information Assurance Manual, November 2005

ab. SECNAVINST 5230.15, Information Management/Information Technology Policy for Fielding of Commercial Off the Shelf Software, 10 April 2009

ac. SECNAVINST 5239.3B, Department of the Navy Information Assurance Policy, 17 June 2009

ad. SECNAVINST 5239.19, Department of the Navy Computer Network Incident Response and Reporting Requirements, 18 March 2008

ae. The National Security Act of 1947

af. Title 40/Clinger-Cohen Act

ag. Title 44/ Federal Information Security Management Act

6.6 Enterprise Architecture

a. Contractor Networks and Connections. Contractor-owned and operated networks are prohibited on any NAVAIR facility or site in support of this contract. The contractor may access non-government, external IP space via the NAVAIR-provided Virtual Private Network (VPN) Outreach service or NAVAIR CIO approved Internet Protocol (IP) service.

b. Architecture Compliance. The contractor shall ensure all IT solutions, including database solutions, comply with the appropriate NAE Enterprise Architecture, and are verified by the NAVAIR Enterprise Architect (AIR-7.2.3) prior to build out.

c. Disclosure of pre-existing networks, circuits or connections. Any and all networks, circuits or connections between the contractor and any NAVAIR site related to previous contracts shall be identified in the MOA. Failure to comply and subsequent discovery of an unregistered network, circuit or connection shall be grounds for immediate disconnection.

6.7 Software Process Improvement Initiative (SPII)

As defined in the Assistant Secretary of the Navy (ASN) Memorandum, Software Process Improvement Initiative (SPII) Guidance for Use of Software Process Improvement Contract Language dated 13 July 2007, “Computer Software development” or “software development” means, as applicable developing or delivering new source code, modifying existing source code, coding computer instructions and data definitions, building databases schema, and performing other activities needed to implement the design of a noncommercial computer software product. This definition recognized that even small changes to software code can result in significant changes to software system behavior and quality, and, consequently, that it is necessary for developers to define and follow disciplined and appropriate processes.

Mandatory elements of the SPII policy language are:

a. The requirement that Offerors submit a proposed Software Development Plan (SDP) with their proposals, and, during contract performance, deliver a completed SDP (based on the proposed SDP) as a Contract Data Requirements List (CDRL) deliverable, subject to Government review and approval. (CDRL A041)

b. The information content of the SDPs, which shall follow the framework of Institute of Electrical & Electronics Engineers (IEEE)/Electronics Industries Association (EIA) IEEE/EIA Std 12207 regarding subject content, level of detail, and completeness.

c. The requirement that the SDP serve during contract performance as the benchmark for the contractor’s software development effort.

d. The requirement that the SDP shall be periodically evaluated and updated, as a part of continuous process improvement subject to Government review and approval.

Discretionary elements of the SPII policy language are:

a. Where the language is incorporated in the solicitation and contract.

b. The format of the SDP (including whether it needs to be a single volume or may consist of multiple volumes.)

c. The other elements of IEE/EIA Std 12207 that must be included, as based on the needs of the system to be acquired and its associated work content.

The policy and additional information can be found at http://acquisition.navy.mil/content/view/full/5144

6.8 Access to Government IT Systems

Contractor personnel assigned to perform work under this contract may require access to Government IT Systems. Contractor personnel requiring access to Government IT Systems shall comply with AIR-7.2/7.4 Policy Memo 5510, “Information Technology (IT) Position Requirements” dtd 16 Oct 2008 or latest version thereof, available as attached or through the Procuring Contracting Officer (PCO). Prior to accessing any Government IT System, contractor personnel shall submit a completed Systems Authorization Access Request Navy (SAAR-N) OPNAV 5239/14 (JUL 2008), Annual Information Assurance (IA) training certificate, and initiate the requisite background investigation (or provide proof of a current background investigation) to the Contracting Officer’s Representative (COR). For purposes of this clause, reference to the COR shall mean the PCO for contracts that do not have a designated COR. In order to maintain access to required systems, the contractor shall ensure completion of annual IA training, monitor expiration of requisite background investigations, and initiate re-investigations as required. (CDRL A0XX, A0XX)

6.8.1 Contractor personnel shall complete, sign and date Part I of the SAAR-N form and coordinate with the COR to designate in Part III, block 33c, the appropriate IT level designation (IT-1, IT-2, or IT-3). The completed SAAR-N and proof of a current background investigation is to be provided to the COR. The COR will review the SAAR-N submitted by the contractor, and if the COR concurs that the contractor requires the IT access designated, the COR will complete and sign Part II. When a background investigation is required, contractor personnel shall coordinate with Command Personnel Security, AIR-7.4. (CDRL A0XX, A0XX)

6.8.2 The contractor shall provide separate Information Technology Personnel Security Reports to the COR and to NAVAIR Security. The report submitted to the COR shall not contain Social Security information that is required in the report submitted to NAVAIR Security. Both reports shall show that all contractor personnel meet the requirements for obtaining access to Government IT Systems, and that all requirements are verified and validated thereafter on an annual basis. All prime, subcontractor, consultants, and temporary employees shall be included in the reports. Revised reports shall be submitted when gains and/or losses of employees occur to ensure that all employees comply with these requirements prior to accessing Government IT Systems. (CDRL A0XX, A0XX)

6.9 Necessary Servers and Computers

As this effort requires extensive database and record keeping analysis, the contractor is expected to provide all the necessary industry housed servers and/or computers necessary to execute the SOW requirements. Contractor shall detail the contractor owned equipment that may require access to NAVAIR/DoD networks.

7.0 TECHNICAL DIRECTION LETTERS (TDLs)

When necessary, technical direction or clarification concerning the details of specific tasks set forth in the contract shall be given through issuance of Technical Direction Letters (TDLs). TDLs will not, in any manner, alter the scope of the contract. Each TDL issued will include a description of the work to be performed, a list of deliverables, data item descriptions, and a delivery schedule. For further direction see Clause 5252.242-9502 TECHNICAL DIRECTION in section H.

8.0 PROGRESS REPORTS

8.1 Technical Progress Reports

The contractor shall prepare and deliver a technical progress report as a supplement to each Standard Form 1034 presented for payment (CDRL A028)

8.2 Financial Progress Reports

The contractor shall prepare and deliver financial progress reports. In order to reduce the administrative burden presented by creating a unique reporting requirement and to allow these reports to piggyback on the contractor’s…