SOW_Attach(1)_Synopsis.pdf

NAVAIR Air Vehicle Department Support (CSS SOW)

1. Scope: This SOW defines the effort to be performed for the Structures Division of the Air

Vehicle Department, Air 4.3, Naval Air Warfare Center, Aircraft Division (NAWCAD). The

Contractor shall provide analyses, independent evaluations and recommendations along with associated data in support of aircraft structural life monitoring and air vehicle airworthiness certification. Tasks fall into three technical areas: Structural Appraisal of Fatigue Effects

(SAFE) Program, Strength Engineering, and Loads and Dynamics Engineering support.

The SAFE program monitors individual aircraft usage in order to quantify aircraft structural fatigue damage. It is necessary to accurately determine the fatigue life of each aircraft to ensure safety. An economic benefit may also be gained by operating aircraft for the maximum service period possible. During long-term service usage of aircraft, it is necessary to compare a given aircraft’s actual service loads history to the spectra for which it was designed. This is done in order to establish safe service lives for the aircraft in SAFE. By coupling usage data with fatigue life prediction methodology and comparing it with the aircraft’s life expectancy, SAFE engineers can determine the Fatigue Life Expended (FLE). SAFE is carried out on a continuing basis, with the issuance of quarterly reports and other aircraft service life information as needed. Present naval aviation structural integrity management is based on a safe-life approach correlated with results from a full scale fatigue test. Aircraft are tracked with respect to the accumulation of the damage index. Flight data from a flight loads data recorder (FLDR) are used to determine the flight stress and strain histories at the hot spots. In turn, flight-by-flight stress and strain histories are used to calculate the incremental damage accumulated per each flight. In the past, when the accumulated damage of an aircraft equaled the same damage experienced at half the

FSFT life, FLE equaling of 100%, it was removed from the inventory. Fatigue life status is published to fleet users and planners quarterly through a NAVAIR website.

The strength engineering branches are responsible activities related to structural design, stress analysis and fatigue for fixed and rotary wing aircraft. Branch responsibilities include controlling and directing structural tests, including: static, dynamic, fatigue and fracture tests; field and shipboard takeoff and landing tests; water landing, ground maneuver and tie-down tests. Responsibilities begin in the basic research and development stages and continue through acquisition and in-service fleet support until aircraft are retired from active service. Engineering activities include: providing the basis for design, testing validation and life certification including the processes to measure, assess, track and extend airframe/component life; defining safe operating envelopes for all United States Navy (USN) and USMC fixed and rotary wing aircraft vehicles; evaluating structural integrity of external stores and weapons during captive carriage and initial release/flight within the proximity of the air vehicle; developing structural design criteria; evaluating flight clearance requirements, reviewing flight test results and providing recommendations; developing structural inspection criteria and one time repair instructions.

The loads and dynamics branch is responsible for engineering activities related to flight and ground loads analysis, flutter, vibration, sonic fatigue, static aero-elastic, aero-servo-elastic and dynamic response characteristics for fixed and rotary wing aircraft. The branch controls and directs wind tunnel and ground testing for dynamics and loads; field and shipboard takeoff and landing, water landing, ground maneuvering and tie-down testing. These responsibilities begin at the basic research and development stages and continue through acquisition and in-service fleet support, until retirement from active service. Engineering activities include: providing basis for design, test validation and life certification; specifying the basis for static and dynamic loads, flutter, repeated loads and launch and recovery loads; defining safe operating envelopes for all USN and

USMC fixed and rotary wing air vehicles; evaluating dynamic response of external stores and weapons during captive carriage and initial release/flight within the proximity of the air vehicle; developing design criteria; defining and directing flight and ground loads testing; establishing flight clearance requirements, reviewing test analyses and providing recommendations.

2. Applicable documents:

2.1 Department of Defense specifications

2.1.1 DoD 5220.22-M, National Industrial Security Program Operating Manual, (NISPOM)

28 Feb 2006

2.1.2 SECNAV M-5510.36 Information Security Program, 30 Jun 2006

2.1.3 DoDM 5200.01 (DoD Information Security Program: Controlled Unclassified

Information (CUI)) Vol. 4 (enclosure 3 pages 11-18) 24 Feb 2012

2.1.4 DoD 5400.7-R, Freedom of Information Program Chapter 3 (pages 31-42) Sep 1998

2.1.5 DoDD 5230.24 Distribution Statements on Technical Documents, Change 1, Effective

28 Apr 2016

2.1.6 SECNAV M-5510.30 Personnel Security Program Jun 2006

2.1.7 OPNAVINST 3440.17A Navy Installation Emergency Management Program, 1 Aug

2.2 Department of Defense standards – Not Applicable

2.3 Other Government documents (e.g. NAVAIR Documents)

2.3.1 Office of Management and Budget Management of Federal Information Resources, OMB CIRCULAR NO. A-130 Revised.

http://www.whitehouse.gov/omb/circulars_a130_a130trans4

2.3.2 OMB Policies for Federal Agency Public Websites, OMB M-05-04.

http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-

04.pdf

2.3.3 Section 508 Amendment to the Rehabilitation Act of 1973.

https://www.section508.gov/content/learn/laws-and-policies

2.3.4 Department of Defense Web Policies and Guidelines.

http://dodcio.defense.gov/dodwebpolicy http://www.whitehouse.gov/omb/circulars_a130_a130trans4 http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-04.pdf http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-04.pdf https://www.section508.gov/content/learn/laws-and-policies http://dodcio.defense.gov/dodwebpolicy

2.3.5 Navy Information Operations Command (NIOC) Norfolk Web Risk Assessment

Team Website. http://www.public.navy.mil/fcc-c10f/niocnorfolk/Pages/AboutWRA.aspx

2.3.6 DON Policy for Content of Publicly Accessible World Wide Web Sites

SECNAVINST 5720.47B. http://www.navy.mil/navydata/internet/secnav5720-

47b.pdf

2.3.7 NAVAIR CIO Website (NAVAIR specific policy and guidelines). To request this policy contact the NAVAIR CIO office – 7.2.2 Applications Integration team –

Web Manager: Shane Malamphy at 301- 342-1825.

2.3.8 Defense Information Systems Agency (DISA) Hosting of All Navy Websites

(NAVADMIN 061/08). http://www.public.navy.mil/bupers-npc/reference/messages/Documents/NAVADMINS/NAV2008/NAV08061.txt

2.3.9 Consolidation of Navy Web Sites - Reduction of IM/IT Footprint NAVADMIN

145/07. http://www.public.navy.mil/bupers-npc/reference/messages/Documents/NAVADMINS/NAV2007/NAV07145.txt

2.3.10 DON Web Presence Policy: The Registration, Compliance of, and Investment in, All Unclassified Web Sites and Uniform Resource Locators.

http://www.doncio.navy.mil/ContentView.aspx?ID=577

2.3.11 Policy and Procedures for Web Risk Assessment (WRA) of Publicly Accessible

Navy Sites (ALCOM 129/09). www.public.navy.mil/fcc-c10f/niocnorfolk/Documents/NTD-08-09.txt

2.3.12 DoDI 8500.01 Cybersecurity, 14 March 2014

2.3.13 DoDI 8510.01, Risk Management Framework (RMF) for DoD Information

Technology (IT), 12 March 2014.

2.3.14 Committee on National Security Systems Instruction 1253, “Security

Categorization and Control Selection for National Security Systems,” March 15, 2012, as amended.

2.3.15 DoDD 8570.01 Information Assurance Training, Certification, and Workforce

Management, 15 August 2004, Certified Current as of 23 April 2007.

2.3.16 DoDI 8582.01, ASD (NII) Directive-Type Memorandum (DTM) 08-027 –

Security of Unclassified DoD Information on Non-DoD Information Systems, 06

June 2012.

2.3.17 Chairman of the Joint Chiefs of Staff Instruction CJCSI 3170.01H (series), Joint

Capabilities Integration and Development System, 10 January 2012.

c. CJCSI 6211.02D, Defense Information System Network (DISN): Policy and

Responsibilities, 24 Jan 2012.

2.3.18 CJCSI 6212.01F, Net Ready Key Performance Parameter (NR KPP), 21 March

2012.

2.3.19 CJCSI 6251.01D, Narrowband Satellite Communications Requirements, 30 Nov

2012.

2.3.20 CJCSI 6510.01F, Information Assurance (IA) and Support to Computer Network

Defense (CND), 09 Feb 2011, certified current 10 Oct 2013.

2.3.21 Chairman of the Joint Chiefs of Staff Manual CJCSM 6510.01B – Cyber Incident

Handling Program, 10 July 2012.

2.3.22 Navy Ports Protocols, and Services (NPPS) Manual, Version 1.5, 16 November

2010.

http://www.public.navy.mil/fcc-c10f/niocnorfolk/Pages/AboutWRA.aspx http://www.public.navy.mil/fcc-c10f/niocnorfolk/Pages/AboutWRA.aspx http://www.navy.mil/navydata/internet/secnav5720-47b.pdf http://www.navy.mil/navydata/internet/secnav5720-47b.pdf http://www.public.navy.mil/bupers-npc/reference/messages/Documents/NAVADMINS/NAV2008/NAV08061.txt http://www.public.navy.mil/bupers-npc/reference/messages/Documents/NAVADMINS/NAV2008/NAV08061.txt http://www.public.navy.mil/bupers-npc/reference/messages/Documents/NAVADMINS/NAV2007/NAV07145.txt http://www.public.navy.mil/bupers-npc/reference/messages/Documents/NAVADMINS/NAV2007/NAV07145.txt http://www.doncio.navy.mil/ContentView.aspx?ID=577 http://www.public.navy.mil/fcc-c10f/niocnorfolk/Documents/NTD-08-09.txt http://www.public.navy.mil/fcc-c10f/niocnorfolk/Documents/NTD-08-09.txt

2.3.23 Defense Acquisition Guidebook – Chapter 7, Acquiring Information Technology, Including National Security Systems, Section 7.5, Information Assurance (IA).

2.3.24 DoD 5220.22-M, National Industrial Security Program Operating Manual, February 28, 2006 (NISPOM).

2.3.25 DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19

Dec 2005, (Incorporating Change 3, 24 Jan 2012).

2.3.26 DoDD 8000.01, Management of the Department of Defense Information

Enterprise, 10 February 2009.

2.3.27 DoDD 8100.02, Use of Commercial Wireless Devices, Services, and

Technologies in the Department of Defense (DoD) Global Information Grid

(GIG), 14 April 2004, Certified Current, 23 April 2007.

2.3.28 DoDD 8570.01, Information Assurance Training, Certification, and Workforce

Management, 15 August 2004, Certified Current, 23 April 2007.

2.3.29 DoDI 8330.01, Procedures for Interoperability and Supportability of Information

Technology (IT) and National Security Systems (NSS), 21 May 2014.

2.3.30 DoDI8500.01, Cybersecurity, 14 March 2014.

2.3.31 DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, 01

April 2004.

2.3.32 DoDI 8551.01, Ports, Protocols, and Services Management (PPSM), 28 May 2014

2.3.33 DoDI 8581.01, Information Assurance (IA) Policy for Space Systems Used by the

Department of Defense, 8 June 2010.

2.3.34 DON CIO Memo 02-10, Department of the Navy Chief Information Officer

Memorandum 02-10 Information Assurance Policy Update for Platform

Information Technology, 26 April 2010.

2.3.35 DON letter 5239 NAVAIR 726/2322 of 18 Feb 09, NAVAIR Data at Rest Policy.

2.3.36 Federal Information Processing Standards Publications (FIPS PUB)-199, February 2004.

2.3.37 National Security Telecommunications and Information Systems Security Policy

NSTISSP

Source: IRM Office UPDATED: August 2015 Page 12.

No. 11, Revised Fact Sheet National Information Assurance Acquisition Policy, July 2003.

2.3.38 Office of the Chief of Naval Operations OPNAV INST 5239.1C, Navy

Information Assurance (IA) Program, 20 Aug 08.

2.3.39 SECNAV M-5239.1, Department of the Navy Information Assurance Program;

Information Assurance Manual, November 2005.

2.3.40 SECNAVINST 5230.15, Information Management/Information Technology

Policy for Fielding of Commercial Off the Shelf Software, 10 April 2009.

2.3.41 SECNAVINST 5239.3B, Department of the Navy Information Assurance Policy, 17 June 2009.

2.3.42 SECNAVINST 5239.19, Department of the Navy Computer Network Incident

Response and Reporting Requirements, 18 March 2008.

2.3.43 The National Security Act of 1947.

2.3.44 Title 40/Clinger-Cohen Act.

2.3.45 Title 44/ Federal Information Security Management Act.

2.3.46 National Institute of Standards and Technology Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and

Organizations, Revision 4, April 2013.

2.4 Industry documents - Reserved

2.5 Information Assurance Technical Privileged Access

2.5.1 DoDD 8500.01E, "Information Assurance (IA)," of 24 Oct 2002 (update 23 Apr 2007)

2.5.2 DoDI 8500.2, "IA Implementation," of 6 Feb 2003

2.5.3 DoDI 8510.01, "DoD IA Certification and Accreditation Process (DIACAP)," of 28

Nov 2007

2.5.4 DoD 8570.01, "IA Training, Certification and Workforce Management," of 15 Aug

2004 (update 23Apr 2007)

2.5.5 DoD 8570.01-M, "IA Workforce Improvement Program," of 19 Dec 2005 (Change 3, 24 Jan 2012)

2.5.6 OPNAVINST 5239.1C, "Navy IA Program," of 20 Aug 2008

2.5.7 SECNAVINST 5239.3B, "Department of the Navy Information Assurance Policy," of

17 Jun 2009

2.5.8 CJCSI 6510.01F, "Information Assurance (IA) and Support to Computer Network

Defense (CND)," of 9 Feb 2011

2.5.9 CJCSM 6510.01B, "Cyber Incident Handling Program" of 10 Jul 2012.

2.5.10 SECNAVINST 5239.19, "Department of the Navy Computer Network Incident

Response and Reporting Requirements," of 18 Mar 2008

2.5.11 Navy Telecommunications Directive (NTD) 11-08, “Electronic Spillage

Requirements,” of Nov 2008

2.5.12 DoD 5200.2-R, "Personnel Security Program," of 16 Jan 1987 (update 23 Feb 1996)

2.5.13 SECNAVINST 5510.30B, "DON Personnel Security Program," of 6 Oct 2006

2.5.14 SECNAV M-5510.30, "DON Personnel Security Program," of Jun 2006

2.5.15 Security Director, Naval Air Systems Command (AIR 7.4), Memorandum Ser AIR

7.4/7.2 Information Technology (IT) Position Requirements of 16 Oct 2008

2.5.16 Committee on National Security Systems (CNSS) Instruction 4013, "National

Information Assurance Training Standard for System Administrators," of Mar 2004.

3. Requirements

3.1 General Requirements

3.1.1 Compatibility - The Contractor shall maintain the capability to prepare documents and software packages compatible with the Government IT environment through the security classification of Controlled Unclassified. The current operating environment required for this contract includes:

Microsoft Windows 10

Microsoft Project 2010

Microsoft Office Professional Plus 2010

Adobe Acrobat XI (reader)

Internet access

Ability to operate in eDMZ, adherence to ATO

The Contractor shall maintain the ability to interface with and transfer data to and from requiring office software applications and their upgraded versions. The Contractor shall maintain state-of the-art virus software and ensure that all media are virus free when delivered. The Contractor shall be capable of Internet and LAN communications with the

Air 4.3.3. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with Air 4.3.3 during working hours whether at

Contractor work site or on travel.

The Government will provide all Navy Marine Corps Intranet (NMCI) services. The

Contractor shall coordinate with the Government for these services through the Contracting

Officer’s Representative (COR). The Government will provide an NMCI seat for each contractor supporting this contract unless the services provided by a contractor do not require a seat. For example, the contract’s Program Manager may not require a seat. An NMCI seat includes the NMCI asset and NMCI network access.

All Government Furnished Property (GFP) or derived information is the property of the U.S

Government and shall remain in contractor spaces. The contractor will not transfer any property or derived information to any individual or agency, public or private, without the express written approval of the Procuring Contracting Officer (PCO), except as required for the specific performance of tasks under this contract.

3.1.2 Work Location and Facilities: The Contractor shall perform services at contractor facilities located within 50 miles of the Naval Air Station, Patuxent River, MD except for occasional meetings to be held at NAS Patuxent River, MD.

3.1.2.1 Work location: 100 percent of work to be performed at Contractor site.

3.1.2.2 Meeting and conference room support: The Contractor shall have the capability to locate and secure conference room facilities for conducting meetings at the classification levels up to Unclassified. The conference room should hold a minimum of 50 persons and have VTC capability (non-GFE). The conference room shall contain sufficient equipment to conduct meetings with presentations. Therefore, the facility shall have projectors and/or

TV displays, computer(s) with compatible software as required in Paragraph 3.1.1 and telephone(s) are considered minimum requirements. This support shall be provided at

Lexington Park. MD.

3.1.3 Contract Status reporting. The contractor shall provide the following documentation.

3.1.3.1 Monthly Progress and Financial Status Report: The contractor shall provide a progress and financial status report in accordance with the Contract Data Requirement List

(CDRL A002. The report shall include work accomplished since submittal of the last report, both monthly and cumulative man-hour labor costs expended by labor category and material and travel costs.

The Contractor shall support risk reduction efforts and provide support in identifying and mitigating cost/schedule/technical risks of the product by attending monthly risk management meetings.

3.1.4 Work Schedule - Work Schedule. The contractor shall provide the required services and staffing coverage during Normal Working Hours (NWH). NWHs are usually 8.5 hours

(including a 30-minute lunch break), from 0730-1600 each Monday through Friday (except on Federal holidays). Some supported Government offices have flexibility to start as early as

0600/0630 and end as late as 1800 Monday - Friday. Services and staffing shall be provided for each office at least 8 hours per day.

3.1.4.1 Work schedule

3.1.4.1.1 Compressed Work Schedule (CWS): The contractor, with notification to the

COR, may allow its employees to work a CWS schedule. Any contractor that chooses to allow its employees to work a CWS schedule in support of this task order agrees that any additional costs associated with the implementation of the CWS schedule vice the standard schedule are unallowable costs under this contract including task order/s and will not be reimbursed by the Government. Furthermore, all contractors shall comply with the requirements of the Fair Labor Standards Act (FLSA) and particularly with

Section 7 regarding compensatory overtime.

3.1.4.1.2 Holidays: The following holidays are observed by the Government. The contractor is permitted to observe or not observe the holidays in accordance with its corporate policies:

New Year’s Day, January 1

Martin Luther King’s Birthday, the third Monday in January

President’s Birthday, the third Monday in February

Memorial Day, the last Monday in May

Independence Day, July 4

Labor Day, the first Monday in September

Columbus Day, the second Monday in October

Veteran’s Day, November 11

Thanksgiving Day, the fourth Thursday in November

Christmas Day, December 25

3.1.4.1.3 Installation closure: When Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other

Government facility related problem that prevents Federal personnel from working at the

Government facility, contractor personnel assigned to work at that facility performing non-mission essential work in support of such Federal employees shall follow the parent company’s policies

While generally contractor personnel may not perform work on-site at a Government facility without supervision from Federal personnel, in very limited circumstances, work being performed by contractor personnel may be deemed mission essential and performance of such mission essential work may be authorized to continue at the

Government facility despite the facility being otherwise closed for normal operations.

The circumstances permitting work being performed by contractor personnel to be deemed mission essential are extremely limited and generally only apply to performance of efforts related to public health, safety, or matters related to national security. The cognizant Contracting Officer must concur with any determination that work being performed by contractor personnel is mission essential.

3.1.4.1.4 Overtime: Overtime cannot be charged directly to the contract unless first approved in writing by the Chief of the Contracting Office.

3.1.5 Other Direct Costs (ODCs): The Contracting Officer’s Representative (COR) and/or

Alternate COR (ACOR) and Contracting Officer approval shall be obtained prior to the purchase of any material or travel expenses in accordance with NAVAIR Clause 5252.242-

9515 Restrictions on the Direct Charging of Material or travel expenses in accordance with

NAVAIR Clause 5252.232.9509 Travel Approval and Reimbursement Procedures.

3.1.5.1 Travel: Travel will be allowable only when it is essential to the performance of the tasks detailed in Section 3.3. Reimbursement for travel performed shall be in accordance with the Department of Defense Joint Travel Regulation http://www.defensetravel.dod.mil/site/travelreg.cfm). The COR shall concur and the

Procuring Contracting Officer (PCO) approve all travel performed in support of this contract prior to the commencement of the travel. COR approval for local travel expenses is required. Travel may include general and administrative expenses, but shall not include profit. Temporary travel to other locations in support of program tasking is required. If required, temporary travel locations include:

Atlanta, GA

Cherry Point, NC

El Segundo, CA

Fort Worth, TX

Jacksonville, FL

Philadelphia, PA

St. Louis, MO

San Diego, CA

Seattle, WA

St. Augustine, FL

Stratford, CT

West Palm Beach, FL

Whidbey Island, WA

This list is not all inclusive as locations may change over the life of the contract. Travel authorization request shall be prepared in accordance with the sample in Section J, Attachment (3), and submitted no less than 30 business days prior to travel for COR approval.

3.1.5.2 Material: Prior written approval of the COR shall be required for all purchases of materials over $3500. If the contractor’s proposal includes a list of materials with associated prices, then the (COR’s/ACO/PCO as applicable) acceptance of the contractor’s proposal shall constitute written approval of those purchases. Any material provided by the contractor is subject to the requirements of the Federal Acquisition Regulation (FAR), the Defense

Federal Acquisition Regulation Supplement (DFARS), and applicable Department of the

Navy regulations and instructions. All materials not depleted during the performance of this contract shall become Government property upon completion of this contract. The contractor shall transfer all materials not depleted to the COR by way of Material Inspection and

Receiving Report (DD Form 250). Other Direct Charges may include general and administrative expenses but shall not include profit.

The costs of general purpose business expenses required for the conduct of the contractor’s normal business operations are not an allowable direct cost in the performance of this contract. General purpose business expenses include, but are not limited to, the cost for items such as telephones and telephone charges, reproduction machines, word processing equipment, personal computers and other office equipment and office supplies.

3.1.6 Subcontractors: Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this contract. All provisions of this SOW shall flow down to subcontractors providing support under this contract

3.1.7 Management of Contractor Personnel: The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. The contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services

3.1.8 Transition Strategy

The overall strategy shall be built around maintaining the mission of the Structures Division with minimal impact, not only in terms of timeliness of performance but also to ensure that critical data and knowledge transfer occurs. Upon termination or expiration of the contract, the contractor shall ensure an orderly transition of responsibilities, while minimizing impact to the operation. The contractor shall submit a Transition Out Plan, to include the minimum elements listed below in accordance with Contract Data Requirements List (CDRL) A012.

- Work Turnover. The contractor shall provide a plan of action to effectively transfer tasked work that is in process at the expiration or termination of the contract to the successor company. Establish and maintain effective communication with the incoming contractor or Government personnel for the period of transition via weekly status meetings.

- Quality Assurance. The contractor shall provide a plan of action to ensure continuation of quality review processes during the transition period to the successor company.

- Risk Mitigation Strategies. The contractor shall provide a plan of action to mitigate contract performance risks (quality and schedule) encountered during the transition period.

- Data/Information Transfer. The contractor shall provide a plan of action for the efficient inventory and transfer of program data to the successor company.

3.1.9 Data Handling

In the performance of the contract, the Contractor may have access to non-public proprietary information. The contractor shall require that any employee performing services under the contract execute a Non-Disclosure Agreement (NDA) satisfactory to the Contracting Officer.

The NDA shall acknowledge the Contractor and employees duties with respect to non-public information and promise to comply with those obligations. A copy of the executed NDAs shall be provided to the Government. Further, the Contractor shall, within 15 days after the effective date of this contract, obtain and provide to the COR signed NDAs with each subcontractor and consultant (CDRL A007); and shall obtain and provide to the COR signed individual NDAs with all Contractor, subcontractor and consulting personnel that performs work under this contract (CDRL A008).

In addition to complying with the terms and conditions of NAVAIR 5252.209-9510(e)(5) with respect to proprietary data of third parties and DFARS 252.227-7025 with respect to technical data, the Contractor shall not use, modify, reproduce, release, perform, display, or disclose any non-public information provided to or obtained by the Contractor in the course of performing the contract only for Government purposes and shall not do so for any commercial or personal purpose. IMPORTANT: Executing the NDAs attached to this solicitation does not alleviate the contractual duties and obligations the contractor has, pursuant to NAVAIR Clause 5252.209-9510 (e) (5), including, but not limited to, agreeing to execute agreements with companies furnishing proprietary data in connection with work performed under this contract.

In the event that the Contractor knows of or identifies that it has a commercial interest in the subject matter of any proposed or on-going agreement with respect to which contracts services are to be performed; the Contractor shall consider such interest a potential conflict of interest under NAVAIR 5252.209-9510(g) and promptly disclose it to the Contracting

Officer.

3.1.10 Quality Standards

Standards for quality and data deliverables are contained in the Contract Surveillance Plan

(CSP), Attachment (1). The CSP establishes the methods by which the COR will observe, evaluate, and document Contractor performance in meeting critical quality standards identified in the contract. In accordance with the CSP the contractor, not the Government, is responsible for the management and quality control actions necessary to meet the quality standards set forth by the Task Orders.

3.1.10.1 Availability of Government Documents

The AIR-4.3.3 Division will assist the contractor in obtaining Government documentation not generally available to the Contractor to perform tasks specified in this SOW. Any instruction or document replaced or superseded throughout the life of the contract shall become applicable to the requirements defined in this SOW.

3.1.10.2 AVAILABILITY OF NON-GOVERNMENT STANDARDS AND OTHER

PUBLICATIONS

The Contractor shall obtain source documentation from original equipment manufacturers as required to perform the tasks specified in this SOW.

3.1.11 Information Technology Information

The Government will provide all necessary obsolete reference documents and those not generally available to the contractor as requested.

The Contractor shall not purchase any IT equipment on behalf of NAVAIR in support of this contract, which reports to PBIS-IT, without a Naval Air Systems Command (NAVAIR)

Command Information Officer (CIO) approved NAV-IDAS ITPR.

3.1.11.1 Clinger-Cohen Act

The Contractor shall conduct analysis of program/project needs, acquisition strategy and program artifacts to identify and capture specific factors required to satisfy the 11 elements of Clinger-Cohen Act (CCA) compliance listed in DODI 5000.02, Enclosure 1, Table 9. Using Microsoft Word, the contractor shall prepare a CCA compliance matrix following the organization and appearance of Table 11 with additional separate columns for the display of artifact: titles, date(s) of approval, page number(s), and paragraph or section number(s). The right-hand column shall include an embedded object permitting the reader to open unclassified artifacts. The column shall identify classified artifacts and shall describe approved classified channels for access of classified artifacts. The

Contractor shall support the program manager during CCA compliance review and assist in responding to reviewer comments if and when additional supporting information or revisions are required.

Updating approved CCA compliance packages: For updates of approved CCA compliance packages, the contractor shall conduct analysis of program/project needs, acquisition strategy and program artifacts to identify and to determine if each of the

Eleven Elements of CCA has changed and if no change has occurred, a notation stating

“no change” shall be entered in the CCA compliance matrix. If changes have been found, the Contractor shall update the CCA compliance matrix to reflect the changes.

The Contractor shall support the program manager during CCA compliance review and assist in responding to reviewer comments if and when additional supporting information or revisions are required.

3.1.11.2 System Software/Application Compliance

All Information Technology Systems or software/application development, modification or support shall be performed in accordance with Defense Business Transformation guidance (formerly Business Management Modernization Program (BMMP)), Department of the Navy (DON)/Naval Air Systems Command (NAVAIR) Functional

Area Manager (FAM) Policies and Guidance, Network and Server Registration, and Web

Enablement mandates.

3.1.11.3 Web Sites, Web Enablement and Application / System Development, Modification, and Maintenance Support Services

All Information Technology systems, software, and website development, modification or support shall be performed in accordance with all applicable Federal, DoD, DON, and

NAVAIR policy, guidance, standards, and strategies, and should be integrated within the

NAVAIR Enterprise portal and collaboration environment whenever possible. Any Web sites/servers hosted/located in contractor facilities, or outside NAVAIR enclave, will transition to NAVAIR architecture and infrastructure in accordance with Legacy

Shutdown guidance. Policies include, but are not limited to references 2.3.1 through

2.3.11.

3.1.11.4 Software Development/Server Procurement

Any tools developed that will be hosted by the NMCI or run on NMCI workstations will be certified for NMCI and comply with NMCI policy. Additionally, any servers supporting this effort will be transitioned to meet the requirements of the current

NAVAIR Server Consolidation effort.

3.1.11.5 Software Development/Server Procurement:

Any tools developed that will be hosted by the NMCI or run on NMCI workstations will be certified for NMCI and comply with NMCI policy. Additionally, any servers supporting this effort will be transitioned to meet the requirements of the current

NAVAIR Server Consolidation effort.

3.1.11.6 Cybersecurity

The Contractor shall conduct investigation and analysis of acquisition program artifacts such as but not limited to Initial Capabilities Document (ICD), Capability Description

Document (CDD), Capability Production Document (CPD), Navy urgent operational need (UON) and Marine Corps urgent universal need statement (UUNS), joint urgent operational needs (JUONs), threat assessments and acquisition strategies (AS).

Knowledge gained from this analysis shall be used when developing the Cybersecurity

Strategy (CS) needed to steer and inform the program’s development of a Security Plan

(SP) in accordance with DoDI 8510.01, of 12 March 2014.

As a minimum, hardware, firmware, software, documentation (data deliverables) and/or

IT services delivered by this contract shall be in compliance with the references 2.3.12 through 2.3.15.

The Contractor shall conduct investigation and perform analysis including; criticality analysis, threat assessment and vulnerability assessments. All findings and recommendations shall be reported to the Government in technical reviews and submitted as written reports or documents as listed in CDRLs. The Contractor shall support government efforts needed for Information systems (IS) (enclaves or major applications), Platform Information Technology (PIT) or PIT systems to successfully categorize the system, achieve favorable assessment for selection, implementation and testing of security controls and authorization (approval to operate) before use or interconnection in an operating environment in accordance with references (a), (b) and (c). This includes IT that is standalone and IT that is connected to other systems, networks or enclaves.

Information systems (IS) (enclaves or major applications), Platform Information

Technology (PIT) or PIT systems delivered prior to award of this contract but included in the performance of this contract may have been delivered in compliance with Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) and as such shall require transition to Risk Management Framework cybersecurity compliance. Transition planning proposed or performed under this contract shall be in compliance with reference (b) Enclosure 8, Figure 2 and all hardware, firmware and software deliverables shall be capable of receiving Authorization to Operate in accordance with reference (b).

Information technology services shall only be performed by personnel who are qualified and certified in accordance with reference (d). Personnel proposed and/or used in the performance of this contract as certified personnel shall be limited to those whose specifically assigned duties and responsibilities require certification.

All Cybersecurity shall be in compliance with the following listed instructions in references 2.3.16 through 2.3.46.

All IT procured on behalf of this contract shall meet all DoD/DON and NAVAIR cybersecurity polices. Failure to follow these policies will result in denied access to

NMCI, One Net, Integrated Shipboard Network System (ISNS) and other DON, DoD and

Joint Networks. These cybersecurity policies are standard across the Department and ensure cybersecurity compatibility and interoperability.

IT systems and or networks operated by contractors pursuant to a NAVAIR contract, regardless of the level of data processed, shall be operated in accordance with the

NISPOM. Approved contractor-owned equipment shall be permitted connections to

NAVAIR/DoD networks in order to carry out the performance of this contract. All

Contractor-owned hardware and/or software shall meet DoDI 8500.1 Cybersecurity (CS), is subject to validation scanning and must be approved by the NAVAIR site CS Manager prior to connection.

The following specific criteria must be met before the contractor can be connected to any

DoD or NAVAIR network in support of this contract. Requirements include:

a. Network Vulnerability Scanning. NAVAIR Deputy CIO for Information Assurance maintains authorized auditing tools and shall provide for firewall/port scans, device discovery scan, vulnerability assessment, and other requirements as required to ensure secure interoperability with DoD networks. The contractor shall be responsible for the remediation of any equipment that fails these audits prior to the connection of the system to the networks. Results of approvals shall be documented via Memorandum of

Agreement with the Facility Security officer and the Defense Security Service

Representative for that contractor.

b. Extent of Validation Scanning. To prevent scanning of corporate assets, all such networks, equipment and connections shall be physically segregated from any

Government/contractor corporate networks that are not in direct support of DoD contracts.

c. Circuit Provisioning. Any circuit or connection between NAVAIR and/or DoD site and the contractor site shall be provisioned via the Defense information Security Agency and comply with CJCSI 6211.02D, Defense Information System Network (DISN): Policy and Responsibilities, 24 Jan 2012.

d. Servicing Systems from a Remote Contractor Site. Remote Access Service connections that allow off-station operation and/or administration of contractor owned systems, located at any NAVAIR facility or site, shall not be permitted, with the exception of those systems connecting to the Command via the Outreach Services identified in Section 6, Enterprise Architecture.

e. Memorandum of Agreement and Inter-connection Agreements. A Cybersecurity

Memorandum of Agreement (MOA) between the contractor owning the equipment and

AIR-7.2.6 shall be developed and signed before the equipment can be connected to

NAVAIR networks. Failure to comply with the signed MOA shall be grounds for disconnection from the network.

3.1.11.7 Enterprise Architecture

a. Contractor Networks and Connections. Contractor-owned and operated networks are prohibited on any Naval Air Systems Command (NAVAIR) facility or site in support of this contract. The contractor may access non-Government, external IP space via the

NAVAIR-provided Virtual Private Network (VPN) Outreach service or NAVAIR CIO approved Internet Protocol (IP) service.

b. Architecture Compliance. The contractor shall ensure all IT solutions, including database solutions, comply with the appropriate NAE Enterprise Architecture, and are verified by the NAVAIR Enterprise Architect (AIR-7.2.3) prior to build out.

c. Disclosure of pre-existing networks, circuits or connections. Any and all networks, circuits or connections between the contractor and any NAVAIR site related to previous contracts shall be identified in the MOA. Failure to comply and subsequent discovery of an unregistered network, circuit or connection shall be grounds for immediate disconnection.

3.1.11.8 Software Process Improvement Initiative (SPII)

This link is to the SPII Policy, <http://www.secnav.navy.mil/rda/Policy/2007%20Policy%20Memoranda/13jul07spiicon tract language.pdf> which requires that standardized contract language be included in solicitations or contracts under which contractor(s) are required to perform “software development”. As defined in the Assistant Secretary of the Navy (ASN) Memorandum, Software Process Improvement Initiative (SPII) Guidance for Use of Software Process

Improvement Contract Language dated 13 July 2007, “Computer Software development” or “software development” means, as applicable developing or delivering new source code, modifying existing source code, coding computer instructions and data definitions, building databases schema, and performing other activities needed to implement the design of a noncommercial computer software product.

This definition recognized that even small changes to software code can result in significant changes to software system behavior and quality, and, consequently, that it is necessary for developers to define and follow disciplined and appropriate processes.”

Mandatory elements of the SPII policy language are:

a. The requirement that Offerors submit a proposed Software Development Plan (SDP) with their proposals, and, during contract performance, deliver a completed SDP (based on the proposed SDP) as a Contract Data Requirements List deliverable, subject to

Government review and approval. (CDRL A011)

b. The information content of the SDPs, which shall follow the framework of Institute of

Electrical & Electronics Engineers (IEEE)/Electronics Industries Association (EIA)

IEEE/EIA Std 12207 regarding subject content, level of detail, and completeness.

c. The requirement that the SDP serve during contract performance as the benchmark for the contractor’s software development effort.

d. The requirement that the SDP shall be periodically evaluated and updated, as a part of continuous process improvement subject to Government review and approval.

Discretionary elements of the SPII policy language are:

a. Where the language is incorporated in the solicitation and contract.

b. The format of the SDP (including whether it needs to be a single volume or may consist of multiple volumes.)

c. The other elements of IEE/EIA Std 12207 that must be included, as based on the needs of the system to be acquired and its associated work content.

3.1.11.9 NDA/OCI

3.1.11.9.1 In the performance of the Task Order/s, the Contractor may have access to non-public proprietary information. The Contractor shall require that any employee performing services under the task order execute a NDA satisfactory to the PCO. The

NDA shall acknowledge the Contractor and employee’s duties with respect to non-public information and promise to comply with those obligations.

3.1.11.9.1.1 The Contractor shall provide the Government an executed “Company” non-disclosure agreement (for prime subcontractor companies) in accordance with the attached statement found included with this CDRL shall be signed and accompany the CDRL upon submission. CDRL A007

3.1.11.9.1.2 The Contractor shall provide the Government an executed “Individual”

NDA for each employee in accordance with the CDRL. An attached statement found included with this CDRL shall be signed by each employee and accompany the submission. CDRL A008

3.1.11.9.2 Consistent with the terms and conditions of NAVAIR 5252.209-9510(e)(5)

OCI (Services), with respect to proprietary data of third parties, and DFARS 252.227-

7025 Limitations on the Use. Disclosure of Government-Furnished Information

Marked with Restrictive Legends, with respect to technical data, the Contractor shall not use, modify, reproduce, release, perform, display, and disclose any nonpublic information provided to or obtained by the Contractor in the course of performing the contract for other than Government purposes, and shall not do so for any commercial or personal purpose.

3.1.11.9.2.1 The Contractor shall be responsible to comply with the OCI Clause

5252.209-9510, to ensure that no unfair competitive advantage develops over other parties and that no biases occur because of its current or planned interests pertaining to the work under this contract. The Contractor shall ensure that each subcontractor performing work relative to this contract are also in compliance with Clause

5252.209-9510 and that its subcontracts affected by the provisions of the clause include the necessary language contained in it.

3.1.11.9.2.1.1 The Contractor and its subcontractor(s) shall comply with OCI

Clause 5252.209-9510 during all anticipated travel requirements of each individual Task Order.

3.1.11.9.2.2 In the event that the Contractor knows of or identifies that it has a commercial interest in the subject matter of any proposed or on-going agreement with regard to the services to be performed, the Contractor shall consider such interest a potential conflict of interest (Services), and promptly disclose it to the

Contracting Officer in accordance with NAVAIR Clause 5252.209-9510, Organization Conflict of Interest.

3.1.12 Deliverables

The following provides a summary of each CDRL:

Work Description SOW Para. CLIN (Appn)

CDRL(s) Task Area

Fatigue and Usage Studies 3.3.1, All A001 Technical Report/Studies

Contractor’s Progress, Status, and Management Report

3.1.3 All A002 Status Report

Track Monthly Aircraft and Fleet Usage Rates

3.3.1 OMN

WCF

FMS

A003 Structural Appraisal of Fatigue Effects Report

Aircraft Strength/Stress Studies

3.3.2 All A004 Aircraft

Strength/Stress Report

Aircraft Loads and Dynamics Studies

3.3.3 All A005 Aircraft Loads

and Dynamics Report

Structures Computer Tools 3.3.1, 3.3.2, 3.3.3

All A006 Structures Computer Software Product

Non-Disclosure (Company) 3.1.11 All A007 Non-Disclosure (Company)

Non-Disclosure Agreement (Individual)

3.1.11 All A008 Non-Disclosure

Agreement (Individual)

SOFTWARE PRODUCT

PACKAGE (SPP)

3.3.1, 3.3.2, 3.3.3, 3.1.9

All A009 Software User’s Manual

Individual Aircraft Tracking System Software

3.3.1, 3.1.9 All A010 Individual Aircraft Tracking Software

Software Development Plan 3.1.11 All A011 Software Development Plan (SDP)

Transition Strategy 3.1.8 All A012 Software Transition Plan

Figure 1. Cross Reference Matrix

3.2 Security

3.2.1 Citizenship Requirements: Only U.S. citizens may perform under this contract. If the

Contractor cannot find qualified U.S. citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office.

The waiver request should include:

a. The individual's name, date and place of birth, position title, and current citizenship.

b. A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements.

c. A statement of the unusual expertise possessed by the applicant.

d. A statement that access will be limited to a specific government contract (specify contract number).

e. A statement that the Contractor has obtained an export license for the information required to perform the contract.

3.2.2 Investigative Requirements:

Unclassified: All Contractor personnel must be eligible to perform Non-Critical Sensitive work as defined by SECNAV M-5510.30. All Contractor personnel are required to have a favorably adjudicated Tier-3 investigation from the Office of Personnel Management. The

Contractor shall submit a request for personnel security investigation to the Government

Security Office. The Government Security Office shall initiate the Contractor’s Electronic

Questionnaire for Investigations Processing (eQIP)), shall do a preliminary screening of the

Contractor’s eQIP for suitability and derogatory information. The Contractor employee shall provide all requested information pursuant to the Privacy Act of 1974. The Government

Security Office may deny the Contractor access to Government facilities and information and may prohibit the Contractor from performance of sensitive duties for failure to provide requested information or when derogatory or adverse information is present on the

Contractor’s eQIP. In such cases, the Contractor employee may not perform on the Contract.

3.2.3 Common Access Card (CAC)/Public Key Infrastructure (PKI), System Authorization

Access Request (SAAR-N).

3.2.3.1 SAAR-N: All Contractor personnel requiring access to Government IT systems shall have an approved SAAR-N Form OPNAV 5239/14 (Rev Sep 2011) on file, and complete required Annual Information Awareness Training. New employees must submit their SAAR forms within thirty (30) days of their first day of work. Instructions for processing the SAAR-N forms are available at:

http://www.cnrc.navy.mil/publications/Forms/OPNAV_5239_14_SAAR_N.pdf.

http://www.cnrc.navy.mil/publications/Forms/OPNAV_5239_14_SAAR_N.pdf

SAAR-N forms shall be submitted to the COR, Government Technical Point of Contact

(TPOC), or to the assigned Government Trusted Associate Sponsorship System (TASS)

Trusted Associate.

3.2.3.2 CAC/Local Badges: Contractor CACs and facility specific identification badges will be issued by the Government to on-site contractor personnel and shall be visible at all times while personnel are at the Government site. The contractor shall furnish all requested information required to facilitate issuance of identification badges. and shall conform to in

DoDM 1000.13. All CACs and identification badges issued to Contractor employees shall be returned to the Government Security Department at the Government site in accordance with in DoDM 1000.13 following completion of the contract, relocation or termination of an employee, or upon request from the COR. The Government will provide the Contractor access to Government facilities, as required, for performance of tasks under this contract.

Contractor personnel shall comply with (Put in instructions/guidance required by your facility)

3.2.3.3 Reserved

3.2.4 Information Security. If the work is performed at the Contractor’s facility, the

Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and controlled unclassified information

(CUI) and to control distribution of CUI in accordance with DoD 5220.22-M…