Attachment 1 - NBO DRAFT SOW.pdf

DRAFT Statement of Work For

NAVAIR Navy Enterprise Resource Planning Business Office

1.0 Scope.

Navy Enterprise Resource Planning (ERP) is the Department of the Navy (DON) financial and supply chain system of record. Navy ERP streamlines the Navy's financial and supply chain functions and provides critical information which enables the Naval Air Systems Command (NAVAIR) programs to support budgets, milestone reviews and supply chain functionality.

Navy ERP supports both General Fund and Working Capital Fund activities, ensures statutory and regulatory policy compliance and enables mandatory external reporting. NAVAIR Navy ERP Business Office (NBO) is the primary location for NAVAIR Navy ERP expertise. The NBO provides a central point for resolution of NAVAIR Navy ERP requirements and serves as the Center of Excellence (COE) for issue resolution. Support provided by this contract includes other Commands, such as the General Fund Business Office (GFBO) and the Marine Depot Maintenance Command (MDMC)/Marine Corps Logistics Command (LOGCOM).

The NBO organization is comprised of the following areas: Business Solutions Management Support (functional expertise); Data Management (reporting and analytics); Customer Liaison Support (User Management and Training); and NBO Operational Support (internal business operations). The Business Process Management (BPM) Team provides technical and functional expertise to ensure the Navy ERP solution supports Acquisition and Property Management, Financial Accounting, Inventory and Asset Management, and Workforce Management business operations requirements. The Data Management Team supports all aspects of business intelligence, to include reporting, analytics, data management and warehousing. The team supports the planning, analysis, transformation, and migration of data into and out of Navy ERP and associated systems. The Customer Liaison Team (CLT) provides technical and functional expertise to ensure Navy ERP end-users have the appropriate access to Navy ERP systems. The CLT works collaboratively with BPM team members, stakeholders and end-users to manage Navy ERP system compliance requirements, to resolve issues and provide knowledge sharing for issues, workarounds and instruction and facilitates Robotics Process Automation (RPA) requirements. The NBO Operations Team provides strategic planning and execution, resource management and technical program support to ensure NBO business operations are secure, effective, timely, efficient and in compliance with overarching policies. The Operations Team is designed to execute management-directed activities and complement and enhance work performed by the other NBO teams.

The purpose of this Statement of Work (SOW) is to procure Contractor Support Services (CSS) to perform tasks within the scope established in this statement of work. This contract requires the Contractor tol provide support to the NBO and other Commands to include Navy ERP deployment, sustainment and major upgrades. Services and products shall include, but are not limited to: Business Solutions Management, Reporting and Analysis, User Management and NBO Operational Support.

2.0 Applicable Documents.

2.1 Department of Defense specifications

2.1.1 DoD National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulations Part 117, NISPOM Rule.

2.1.2 SECNAV M-5510.36B, Department of the Navy, Information Security Program, 12 Jul 2019.

2.1.3 DoDI 5200.48, Controlled Unclassified Information (CUI), 6 Mar 2020.

2.1.4 DoDD 5400.07, DoD Freedom of Information Act (FOIA) Program, 5 Apr 2019.

2.1.5 DoDI 5230.24, Distribution Statements on Technical Documents, Change 3, 15 Oct 201

2.1.6 SECNAV M-5510.30C, Department of the Navy, Personnel Security Program, 24 Jan 2020.

2.1.7 OPNAVINST 3440.17A, Navy Installation Emergency Management Program, 1 Aug 2014

2.1.8 DODI 8582.01 - Security of NON-DOD Information Systems Processing Unclassified Non-Public DOD Information

2.1.9 NIST SP 800-171 – Special Publication: Protecting Controlled Unclassified Information in Nonfederal Systems and Organization

2.2 Department of Defense Standards -Reserved

2.3 Other Government Documents (e.g. NAVAIR Documents)

2.3.1 Federal Travel Regulation (FTR), Implements statutory requirements and Executive branch policies for travel by federal civilian employees and others authorized to travel at Government expense. The FTR is contained in 41 Code of Federal Regulations (CFR), Chapters 300 through 304.

2.2.1 NASPAXRIVINST 5510.15Q, Regulations Governing Admission to the Naval Air Station Patuxent River (NAS PAX RIVER), Webster Field Annex, and Navy Recreation Center (NRC) Solomons

2.2.2 NASPAXRIVINST 12610.7H, PERSONNEL REPORTING PROCEDURES DURING

EMERGENCY CONDITIONS

2.2.3 NAVAIRINST 5230, Official and Personal Use of Government Property – Voice, Video and Data Systems and Equipment, 13 AUG 2018

2.2.4 NAVAIRINST 12620.1 CH-1, Compressed Work Schedule, 23 OCT 2012

2.2.5 NAVAIRINST 5211.5A, Naval Air Systems Command Privacy Act Program, 12 Jun 2018

2.2.6 NAVAIRINST 5239.2B, CYBERSECURITY PROGRAM, 04 Apr 2022

2.4 Industry Documents – Reserved

3.0 Requirements.

3.1 General Requirements

3.1.1 Compatibility: The Contractor shall maintain the capability to prepare documents and software packages compatible with the Government IT environment through the security classification of secret. The current operating environment required for this contract includes:

Microsoft Windows 10 Microsoft Project 2016 Microsoft 365 Microsoft Office Professional Plus 2016 Adobe Acrobat XI (reader) Internet access

The Contractor shall maintain the ability to interface with and transfer data to and from requiring office software applications and their upgraded versions. The Contractor shall ensure that all media are virus free when delivered. The Contractor shall be capable of Internet and LAN communications with the NAVAIR Navy ERP Business Office. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with the NAVAIR Navy ERP Business Office during working hours whether at Contractor work site or on travel.

3.1.2 Work Location, Facilities and Telework

3.1.2.1 Work location: Approximately one-hundred percent (100%) of work will be performed at Government site. Government site(s) include Naval Air Station (NAS) Patuxent River, MD and Webster Outlying Field (WOLF) at St. Inigoes, MD.

3.1.2.1.1 Government Site Requirements: Contractors performing on-site support will be provided access to: workspaces, telephones, printers, facsimile machines, copy machines, shredders, computers, and network access including web servers and applicable databases or other applications necessary to carry out assigned tasks.

3.1.2.1.2 Contractor Site Requirements: There are no requirements to perform tasking at the Contractor Site.

3.1.2.3 Telework: The Contractor, upon notification to, and concurrence from, the Contracting Officer's Representative (COR) that a position’s tasking is eligible for telework, may utilize alternate worksites/locations and telework to support continued performance of SOW tasks IAW company policy. Contractor discretion is required when making alternate worksite and telework decisions based upon the nature of support being provided by the employees. When using telework, the Contractor remains responsible for contract performance and compliance with any applicable cost accounting standards and contract cost principles / procedures.

3.1.3 Contract Status Reporting. The Contractor shall provide the following documentation:

3.1.3.1 Monthly Progress/Cost and Tasking Hours Report (A001) - The Contractor shall provide, electronically, a monthly labor, material and other direct cost matrix detailing reporting period, team/product sub-team (following Section 3.3 Detailed Support Requirements) and, in order, within each team/product sub team: contract line item number (if applicable); labor categories; employee names; awarded, current, cumulative and remaining labor hours; and awarded, current, cumulative and remaining labor dollars for each labor category. Footnotes are to be used to indicate reporting period of performance for subcontractor labor hours, roll off dates for named employees leaving, and start dates and names for new hires. The Contractor shall also receive prior approval from the TPOC/ATPOC for excess hours, following the NBO Contractor Support Personnel Authorization process. The Contractor shall provide electronically, a Monthly Material Report detailing materials billed during the period. The report shall reflect the item(s) or service(s) procured, description, cost (unit and total), source, date of procurement, date of TPOC/ATPOC concurrence for procurement, and purpose of material/service. Copies of receipts must be provided with invoices.

3.1.3.2 - Monthly Progress/Status Report (A002) - The Contractor shall provide, electronically, a monthly narrative progress report detailing: 1) Work Performed (following Section 3.3 Detailed Support Requirements) and Significant Meetings; 2) Problems Encountered and Recommended Solutions; 3) Issues Requiring Government Action and 4) Recommendations for Process Improvements. The narrative should also include: data calls; status of efforts;

progress made since the prior report; and milestones reached. If training is applicable to any delivery order the Contractor and the COR shall agree on a Plan of Action and Milestone (POA&M) to establish scheduled time frame. If reports and analysis is applicable to any delivery order the Contractor and the COR shall agree on a POA&M for all testing to establish scheduled time frame. The Contractor shall also provide an updated Production Interface Schedule Contact List quarterly.

3.1.3.3 - Trip Report (A003) - The Contractor shall provide a Trip Report for each trip performed during the reporting period to include: traveler’s name; departure and return dates;

purpose of travel; destination (city, state) from and to; destination POC (name, phone number);

airfare, hotel, car rental, per diem, mileage, gas, other and total cost estimates; and trip findings.

The Contractor shall receive prior approval from the TPOC/ATPOC for travel to be performed, following the NBO Contractor Support Personnel Authorization process. The NBO Approved Travel Tracking Number issued during the approval process shall also be identified on the Trip Report.

3.1.3.4 - Standard Operating Procedures (SOPs) and Desk Guides for NAVAIR NBO (A004) - The Contractor shall create/review and maintain, electronically on an annual basis, SOPs and Desk Guides and store to the appropriate NBO collaboration site. The Government shall be given an opportunity to review and provide input to each SOP/Desk Guide on an annual basis at a minimum. The Contractor shall support documentation of NBO processes as required.

The Government will provide a listing of required documents and delivery dates for each identified SOP/Desk Guide. All required documents should be posted to the appropriate NBO collaboration site on or before the deliverable due date and in accordance with established processes.

3.1.3.5 Non-Disclosure Forms (A005) - The Contractor will provide the TPOC/ATPOC and/or

COR with a signed non-disclosure agreement from each individual Contractor employee within two (2) business days of performance start.

3.1.3.6 - Contractor Employee Work Schedule (A006) - The Contractor will provide the TPOC/ATPOC and/or COR with a consolidated work schedule for personnel within 30 days of contract start and annually thereafter.

3.1.3.7 – Exit Transition Plan (A007) - The Contractor shall document the activities and roles and responsibilities, as well as the timetable, documentation and data, required for completing an orderly transition to the Government Organization and/or Contractor, following termination or expiration of the Contract regardless of the cause.

3.1.4 Work Schedule to include Compressed Work Schedule (CWS), holidays, and installation closure.

3.1.4.1 Work schedule: The Contractor shall provide the required services and staffing coverage during normal working hours. Normal working hours are usually 8.5 hours (including a 30-minute lunch break), from 0730-1600 each Monday through Friday (except on the legal holidays specified in paragraph 3.1.4.1.2). Some supported Government offices have flexibility to start as early as 0600/0630 and end as late as 1800, Monday –Friday to support users at other locations.

Limited periods of time may require 24/7 operations, seven days a week. This period is usually at the end of one Fiscal Year and beginning of the next Fiscal Year (September/October) with a timeframe lasting as long as two or more weeks, dependent upon Navy closing schedules, Navy ERP processing times, and during the implementation of new Navy ERP releases. Additional extended hours may also be required during Navy ERP deployment and upgrade events. The TPOC/ATPOC will attempt to notify the Contractor in advance of the requirement.

3.1.4.1.1 Compressed Work Schedule (CWS): CWS is an alternative work schedule to the traditional five 8.5 hour workdays (which includes a 30-minute lunch) worked per week. Under a CWS schedule, an employee completes the following schedule within a two-week period of time: Eight weekdays are worked at 9.5 hours each (which includes a 30-minute lunch), one weekday is alternately worked as 8.5 hours (which includes a 30-minute lunch) and one weekday is not worked by the employee. The result is 80 hours worked every two weeks, with 44 work hours one week and 36 work hours the other.

The Contractor may allow its employees to work a CWS schedule provided the requirements of this SOW are met. If the Contractor chooses to allow its employees to work a CWS schedule in support of this contract, any additional costs associated with the implementation of the CWS schedule vice the standard schedule are unallowable costs under this contract and will not be reimbursed by the Government. Additionally, the CWS schedule shall not prevent Contractor employees from providing necessary staffing and services coverage as required by the Government to the COR/ACOR.

3.1.4.1.2 Holidays: The Government observes the Federal holidays identified on the Office of Personnel Management (OPM) website: https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview.

The Contractor is permitted to observe the above Federal Holidays in accordance with its corporate policy.

3.1.4.1.3 Installation closure: When Federal facilities are closed by the Government, or when Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility related problem that prevents Federal personnel from working at the Government facility, Contractor personnel assigned to work at that facility in support of such Federal employees shall follow their parent company’s policies.

While generally Contractor personnel may not perform work on-site at a Government facility without oversight from Federal personnel, in very limited circumstances, work being performed by Contractor personnel may be deemed mission essential and performance of such mission essential work may be authorized to continue at the Government facility despite the facility being otherwise closed for normal operations. The circumstances permitting work being performed by Contractor personnel to be deemed mission essential are extremely limited and generally only apply to performance of efforts related to public health, safety, or matters related to national security. The cognizant Contracting Officer must concur with any determination that work being performed by Contractor personnel is mission essential.

3.1.4.1.4 Overtime: Overtime as defined in this contract refers to hours worked by a Contractor employee in excess of the employee’s normal workweek. Overtime cannot be charged directly to the contract unless first approved in writing by the Contracting Officer.

3.1.5 Other Direct Costs:

3.1.5.1 Travel: Travel may include general and administrative expenses, but shall not include profit. Temporary travel to other locations in support of program tasking is required. If required, temporary travel locations include Washington D.C., Mechanicsburg, PA, China Lake, CA, Orlando, FL, Cherry Point, FL, Jacksonville, FL, and San Diego, CA. This list is not all inclusive as locations may change over the life of the contract.

3.1.5.2 Material: Incidental material will be required in the performance of this Contact, and all incidental material purchases shall be IAW C-TXT-242.95XX Procedures and Approvals Required Prior to Incurring Direct Material Costs (Sep 2021).All materials not depleted during the performance of this contract shall become Government property upon completion of this contract. The Contractor shall transfer all materials not depleted to the COR by way of Material Inspection and Receiving Report (DD Form 250). Material costs may include general and administrative expenses but shall not include profit/fee.

3.1.6 Subcontractors: Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this contract. All provisions of this SOW shall flow down to subcontractors providing support under this contract.

3.1.7 Management of Contractor Personnel: The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual Contractor employees. The Contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services.

3.1.8 Transition Out Strategy

The Contractor’s overall transition out strategy shall be built around maintaining the mission of the NAVAIR Navy ERP Business Office with minimal impact, not only in terms of timeliness of performance but also to ensure that critical data and knowledge transfer occurs. Prior to the termination or expiration of the contract, the Contractor shall ensure an orderly transition of responsibilities, while minimizing impact to the operation. The Contractor shall submit a Transition Out Plan, to include the minimum elements listed below in accordance with CDRL A007.

- Work Turnover. The Contractor shall provide a plan of action to effectively transfer tasked work that is in process at the expiration or termination of the contract to the successor company. Establish and maintain effective communication with the incoming Contractor or Government personnel for the period of transition via weekly status meetings.

- Quality Assurance. The Contractor shall provide a plan of action to ensure continuation of quality review processes during the transition period to the successor company.

- Risk Mitigation Strategies. The Contractor shall provide a plan of action to mitigate contract performance risks (quality and schedule) encountered during the transition period.

- Data/Information Transfer. The Contractor shall provide a plan of action for the efficient inventory and transfer of program data to the successor company.

3.1.9 Program Unique Requirements

3.1.9.1 Government Provided Resources

The Government will provide required access to corporate computer systems and other computer systems including authorizations, account numbers, and passwords as necessary for performance.

The NMCI/NGEN contract provides device and network connectivity for software, hardware and applications. Software and applications must be tested and certified for execution within the NMCI/NGEN environment prior to installation. The Contractor will be required to coordinate with NMCI/NGEN prior to installation of devices or software.

Performance under this contract will require IT resources including desktop computers, software, and peripherals that are included under the NMCI/NGEN 'seat management' concept. The Government will provide these resources for Contractor personnel who are seated in Government provided spaces.

The Government will provide other IT and telecommunications equipment and supplies (excluding general office supplies) required for job performance.

3.2 Security

3.2.1 Citizenship Requirements: Only U.S. citizens may perform under this contract, unless waived by the Government. If the Contractor cannot find qualified U.S. citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office. The waiver request should include:

a. The individual's name, date and place of birth, position title, and current citizenship.

b. A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements.

c. A statement of the unusual expertise possessed by the applicant.

d. A statement that access will be limited to a specific government contract (specify contract number).

e. A statement that the Contractor has obtained an export license for the information required to perform the contract.

3.2.2 Investigative Requirements:

Classified: All Contractor personnel shall maintain security clearance eligibility commensurate with the level of classification of the work performed as annotated in the Contract's DD-254, Contract Security Classification Specification Form. Contractor personnel shall require access to classified information in performance of this Contract up to and including Secret facility level, with a safeguarding level of Secret. The Contractor is responsible for ensuring that all personnel receive the requisite investigation and are favorably adjudicated IAW National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulation Part 117, NISPOM Rule. Contractor employees who fail to meet security clearance requirements may not access classified information or perform sensitive duties. In such cases, the Offeror employee may not perform on the Contract.

3.2.2.1 All personnel shall have, at a minimum, interim Secret clearances within sixty (60) calendar days of award with the exceptions noted in the table below.

LABOR CATEGORY

DoD SECURITY

CLEARANCE LEVEL

(INTERIM

CLEARANCE

ACCEPTABLE)

NUMBER OF

CLEARED

EMPLOYEES

REQUIRED

REQUIRED

DAYS AFTER

ISSUANCE OF

CONTRACT

Will be filled in at time of Draft RFP

3.2.3 Common Access Card (CAC)/Public Key Infrastructure (PKI), System Authorization Access Request (SAAR).

3.2.3.1 SAAR: All Contractor personnel requiring access to Government IT systems shall access and operate IT systems and networks IAW NAVADMIN 259/23 and CTXT.204-9505

SYSTEM AUTHORIZATION ACCESS REQUEST NAVY (SAAR) REQUIREMENTS FOR

INFORMATION TECHNOLOGY (IT) (NAVAIR) (JAN 2024) have an approved SAAR – System Authorization Access Request form on file, and complete required Annual Information Awareness/Cyber Security Training. New employees must submit their SAAR forms within thirty (30) days of their first day of work.

3.2.3.2 Command Access Cards (CAC) / Local Badges: Contractor CACs and facility specific identification badges will be issued by the Government to on-site Offeror personnel and shall be visible at all times while personnel are at the Government site. The Contractor shall furnish all requested information required to facilitate issuance of identification badges and shall conform to local installation policies and guidance as appropriate. All CACs and identification badges issued to Contractor employees shall be returned to the Government Security Department following completion of the contract, relocation or termination of an employee, or upon request from the COR/PCO. The Government will provide the Contractor access to Government facilities, as required, for performance of tasks under this contract. Contractor personnel shall comply with local CAC requirements.

3.2.3.3 DD-254: The Contractor shall comply with security requirements specified in the DD- 254 attached to this contract, unclassified information shall be handled as “Controlled Unclassified Information (CUI). Information or data that the Contractor accesses shall be handled at the appropriate classification level.

3.2.3.3.1 The Contractor will require access to:

‒ (List out any items marked with an “X” in block 10 of the DD-254)

3.2.3.3.2 In performing this Contract, the Contractor will:

‒ (List out any items marked with an “X” in block 11 of the DD-254)

3.2.4 Information Security. If the work is performed at the Contractor's facility, the Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and CUI and to control distribution of CUI IAW the National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulations Part 117, NISPOM Rule and SECNAV M-5510.36B, Department of the Navy, Information Security Program. If the work is performed at the Government's facility, the Contractor shall comply with instructions/guidance required by that facility.

All Contractor facilities shall provide an appropriate means of storage for CUI and materials. All CUI including legacy FOUO information and Covered Defense Information (CDI) (meeting the definition DFARS Clause 252.204–7012, Safeguarding Covered Defense Information and Cyber Incident Reporting) generated and/or provided under this Contract shall be marked and safeguarded as specified in DoD Instruction 5200.48, Controlled Unclassified Information (CUI) available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF.

Any product containing CDI shall be assigned a distribution statement (distribution statements B through F) using the criteria set forth in DoDI 5230.24, Distribution Statements on Technical Documents and have this statement displayed per DoDI 5230.24, Enclosures 3 and 4.

Distribution is authorized to the Requiring Office's Organization and supported Activity only.

Other requests for deliverables under this Contract shall be referred to the TPOC/COR of this Contract for approval.

All controlled unclassified technical information shall be appropriately identified and marked with the appropriate distribution statement(s).

3.2.4.1 Marking. All information generated by the Contractor shall be properly marked.

Classified information shall be marked IAW DoDM 5200.01, Vol 2, Marking of Classified Information. CUI, including Legacy FOUO information generated and/or provided under this Contract shall be marked IAW DoDI 5200.48. Technical information shall also be marked with appropriate Distribution Statements and Export Control warnings IAW DoDI 5230.24 and program Security Classification Guidance.

3.2.4.2 Public Release. Any CUI pertaining to this Contract shall not be released for public dissemination, including posting to any social media sites such as Facebook or X (formerly known as Twitter), unless it has been approved for public release by appropriate U.S.

Government authority. Proposed public releases shall be submitted for approval prior to release through Program Executive Office (PEO)(T), Public Affairs Office, 47123 Buse Road, RADM William A. Moffett Building, Patuxent River, MD 20670-1547. Proposed public releases shall be submitted to the COR for initial approval and awareness.

Upon initial approval, the Contractor shall submit proposed public releases for approval prior to release through the NAWCAD Procuring Contracting Officer, and through;

Public Affairs Office

NAWCAD

navairpao@us.navy.mil 301-757-5136

3.2.4.3 Loss, Compromise and/or Electronic Spillage of Classified or Controlled Unclassified Information: All instances of loss, compromise and electronic spillage of classified or controlled unclassified information shall be reported to the COR, TPOC and Government Security Office within 72 hours of the incident occurring.

3.2.4.4 Compliance to NIST 800-171:

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800- 171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and Plan of Action and Milestones (POA&Ms) that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered Contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the Contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

(1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the Contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

(4) Audit user privileges on at least an annual basis;

(5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

(6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

(7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

In accordance with DOD INSTRUCTION 8582.01 SECURITY OF NON-DOD

INFORMATION SYSTEMS PROCESSING UNCLASSIFIED NONPUBLIC DOD

INFORMATION, the Contractor shall implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a System Security Plans (SSP) and Plans of Action and Milestones (POAM) that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

The Contractor shall, at a minimum, meet the Basic Safeguarding Requirements as follows to meet the comparable security requirements of the NIST SP 800-171 as indicated.

The Government may, in its sole discretion, conduct reviews at the Contractor’s site to verify compliance. The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days’ notice to the Contractor.

If the Government determines that the security controls do not adequately implement the requirements of NIST 800-171, then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

Upon the conclusion of the correction period, the Government may conduct a follow-on review at the Contractor’s facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies.

3.2.5 Operations Security (OPSEC): The Contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the Contractor and any subcontractor during performance of the contract. The Contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. This program may include Information Assurance and Communications Security (COMSEC). The OPSEC program shall be in accordance with National Security Decision Directive (NSDD) 298, and at a minimum shall include:

(1) Assignment of responsibility for OPSEC direction and implementation.

(2) Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

(3) Establishment of OPSEC education and awareness training.

(4) Provisions for management, annual review, and evaluation of OPSEC programs.

(5) Flow down of OPSEC requirements to subcontractors when applicable.

While performing aboard NAVAIR or NAVAIR sites, the Contractor shall comply with facility OPSEC program instructions and contribute to organization-level OPSEC efforts. Include OPSEC as part of its ongoing security awareness program and take all required Agency training.

Be responsive to the Supporting OPSEC Manager on a non-interference basis. Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the RO and Contractor in support of the mission.

3.2.6 Anti-Terrorism Force Protection and Emergency Management: The work performed on this contract is not Emergency Essential in accordance with OPNAVINST 3440.17A and Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans.

Contractor personnel shall comply with all Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans and directives. Contractor personnel shall not report for work at Government facilities upon declaration of Force Protection Condition CHARLIE or in any event or emergency where Government officials direct curtailment of operations to “Mission Essential Only”. All Contractor personnel assigned to a Government facility shall complete annual Antiterrorism (Level One) and Active Shooter training.

3.2.7 Cybersecurity:

3.2.7.1 Reserved

3.2.7.2 Reserved

3.2.7.3 Reserved

3.2.7.4 Cyber Incident Response

The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period, reference https://dibnet.dod.mil/portal/intranet/), deliver all data used in performance of the contract that the Offeror determines is impacted by the incident and begin assessment of potential warfighter/program impact.

Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3). Reference https://www.dc3.mil/Organizations/DIB-Cybersecurity/DIB- Cybersecurity-DCISE/

In delivery of the incident data, the Contractor shall, to the extent practical, remove Contractor-owned information from Government covered defense information.

If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

3.2.7.5 NCIS/Industry Monitoring

In the event of a cyber-incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service (NCIS) and associated law enforcement agencies, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, or vendor logs that show network activity, including any additional logs the Contractor, subcontractor, or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor shall cooperate with the NCIS to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets.

The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.

3.2.8 Additional Program Unique Requirements.

3.2.8.1 Control of Contractor Personnel: To ensure Contractor employees supporting this contract are vetted and processed in compliance with Government security and safety policies, the Contractor shall perform the following:

3.2.8.1.1 Contract Start - No later than five (5) business days prior to contract start, the Contractor will provide the TPOC with the following electronic information:

Comprehensive list of all employees supporting the contract, and their start date Consolidated work schedule listing of all employees supporting the contract

(CWS/Non-CWS, Start/End Times) Competed BASICS request form for access to the Government site Contractor Verification System (CVS) request form for Common Access Card

(CAC) issuance SAAR form Signed Non-Disclosure form Information Awareness (IA)/Cyber Awareness Challenge training certificate for each employee

3.2.7.1.2 During Contract Execution - After contract start and throughout the duration of the contract, the Contractor will provide the Government TPOC and ATPOC written notification (email is acceptable) of new hires no later than five (5) business days prior to the employee start date. The Contractor will provide the following information in the notification:

Employee Name Employee Start Date Company (include subcontractor) Proposed work schedule (CWS/Non-CWS, Start/End Times) Competed BASICS request form for access to the Government site Contractor Verification System (CVS) request form for Common Access Card

(CAC) issuance A non-disclosure agreement must be signed by the employee on or before his/her start date and a copy shall be provided to the TPOC/ATPOC within two (2) business days of employee performance start.

Completed SAAR forms and IA/Cyber Awareness Challenge training certificates shall be provided to the COR by the Contractor no later than five (5) business days prior to the employee start date for access to Government networks, systems and applications.

3.2.7.1.3 The Contractor will provide written notification (email is acceptable) to the COR, ACOR, and TPOC of departing employees as soon as possible. A minimum of two weeks’ notice is acceptable; longer may be more applicable in some cases to ensure adequate time for pass-down/knowledge transfer.

3.3 Detailed Support Requirements: This section provides the detailed support to be provided by the Contractor.

3.3.1 Program or Mission Requiring Support: Technical and functional Support expertise to ensure the Navy ERP solution supports Acquisition and Property Management, Financial Accounting, Inventory and Warehouse Management, Asset Management, Workforce Management and business operations requirements. Functional areas supported include, but are not limited to, the following:

Team Functional Areas Supported

(list is not all encompassing and not prioritized) Acquisition and Property Management

Program and Project Management; Purchase Card Procurement; Funding Documents; Contract Procurement; MILSTRIP Procurement; Foreign Military Sales funds execution; Reorganization Packages; Workflow Configuration; and Material Management to include Inventory Management, Warehouse Management, Operating Materials and Supplies (OM&S), and Material Management Master Data.

Financial Accounting Cash and Daily Defense Expenditure File (DDEF) Processing; Internal and External Entitlements; Labor Processing; Defense Travel System (DTS)/Travel /Electronic Procurement System (ePS); Other Customer Funds/Billing; Funds Availability/Funds Management; Funds Allocation;

Asset Accounting and Management; Reorganizations; Period Close (Month End and Annual); General Ledger Account Reconciliation; Project Systems; Financial Statement Compilation and Reporting.

Workforce Management

Defense Civilian Payroll System (DCPS); Labor/Timekeeping Analysis and Reporting; Structural Authorization Management; Organizational and UIC Structure Management; Reorganization Packages; Personnel Management and Administration (Pay, Awards, Leave, Training, etc.);

Defense Civilian Personnel Data System (DCPDS); Bureau of Naval Personnel (BUPERS); Navy Enlisted System (NES); Officer Personnel Information System (OPINS) Interface Reporting and Validation.

In support of the functional areas identified above, the Contractor shall monitor and resolve user trouble calls, support data calls, develop and maintain process documentation, training materials and knowledge management articles, and develop, collect, and analyze business metrics. Support includes participation in Command and Navy ERP working groups and requires coordination and communication with principle command stakeholders, end users, and external stakeholders.

Following are specific tasks required in support of Business Solutions Management:

3.3.1.1 Business Solutions Sustainment Support

3.3.1.1.1 Perform analysis and provide recommendations for resolution, and/or workarounds, for system deficiencies

3.3.1.1.2 Support the analysis and coordination of Command business needs and develop white papers, justification, and/or system engineering documents for new/enhanced functional capabilities

3.3.1.1.3 Evaluate Navy ERP requirements to determine impacts to Command business operations

3.3.1.1.4 Assess outstanding Navy ERP work items for relevance and impact to Command business operations to provide work prioritization recommendations in support of Navy ERP monthly/quarterly release planning

3.3.1.1.5 Perform and coordinate review with key Command stakeholders of Navy ERP functional design change documentation to ensure accurate and complete business requirements definition;

consolidate Command feedback to Navy ERP functional team

3.3.1.1.6 Evaluate Navy ERP releases and coordinate activities to identify and minimize impacts of system changes on Command business operations

3.3.1.1.7 Coordinate quality assurance and test activities in support of changes to Navy ERP software, Command or Navy business process changes, and/or Navy ERP Software Upgrades to assess impacts to the Commands and recommend corrective actions

3.3.1.1.8 Identify test candidates to the NBO Test Manager via the provided tools, and ensure testing methods, test dates and test plans are in place for testing. Track status and record progress and results in the NBO provided tools or other format as necessary.

3.3.1.1.9 Validate items released to production in support of changes to Navy ERP software, Command or Navy business process changes, and/or Navy ERP Software Upgrades to ensure items work as designed and recommend corrective actions

3.3.1.1.10 Perform analysis and provide recommendations for resolution or mitigation of risks related to Segregation of Duties conflicts

3.3.1.1.11 Support the development/maintenance of end user training documentation and activities to update/maintain the Navy ERP training environment (e.g., master data build and troubleshoot functional issues) for Command end user training

3.3.1.1.12 Maintain Command Business Process Rules

3.3.1.2 Production Operations Support

3.3.1.2.1 Support development and implementation of interface processes

3.3.1.2.2 Support research and resolution of issues discovered during interface processing.

3.3.1.2.3 Inform command stakeholders of batch or interface processing issues, resolution actions, and status

3.3.1.2.4 Work with command stakeholders to integrate and maintain the

Navy ERP solution into Business Contingency Plans that can be invoked as needed in the event of production system downtime

3.3.1.2.5 Monitor the Navy ERP production schedule for job failures and deviations

3.3.1.3 Business Initiatives Support

3.3.1.3.1 Perform analysis to evaluate impacts of current and emerging internal and external business initiatives affecting Command business operations within the Navy ERP solution (e.g., Business Process Standardization, Audit Readiness, Cost Management, Material Acquisition and Management)

3.3.1.3.2 Support the implementation of process changes and/or Navy ERP capabilities in support of current and emerging internal and external business initiatives

3.3.1.3.3 Evaluate opportunities for Command utilization of Navy ERP capabilities to support continual process improvement activities

3.3.1.3.4 Perform assessment of future functionality deployments usability/applicability to Commands (e.g., asset management, inventory management, warehouse management, material management, supply deployments)

3.3.1.3.5 Participate in Command and Navy level working groups and facilitate collaboration among key stakeholders, other Navy Commands and Navy Process Owners to address business requirements supported by the Navy ERP system and modernization efforts.

3.3.1.3.6 Participate with the implementation and sustainment of processes to ensure full financial statement audibility

3.3.1.3.7 Support Navy ERP Technical Upgrades and the subsequent move from SAP ECC 6.0 and SCM to SAP S/4 HANA Business Suite to include the development of test scenarios, execution of test scripts, and identification and resolution of issues or defects encountered during testing

3.3.1.3.8 Support the development, implementation and sustainment of business processes focused on capturing labor actuals (i.e., hours and cost execution) in Navy ERP

3.3.1.3.9 Support the integration of the Command’s property and inventory portfolios and functions into the Navy ERP solution

3.3.1.4 Navy ERP Deployment Support

3.3.1.4.1 Provide implementation and post implementation support for Navy

ERP deployments

3.3.2 Reporting and Analysis Support to include reporting/analytics/dashboards, data warehousing, data integration, data mapping, data management, data governance, data archiving, security, and metadata management. The Contractor shall also support the planning, analysis, transformation, and migration of reporting from systems (such as the Navy Data Platform (NDP), NAVAIR Warehouse Analytical Reporting System (WARS), Advana/Jupiter, etc.). The Contractor shall develop and maintain process documentation. The following are specific tasks required in support of Reporting and Analysis:

3.3.2.1 Business Intelligence Support

3.3.2.1.1 Analyze reports (Navy ERP delivered and local) to ensure data integrity and verify with appropriate Command representatives, that mandatory reporting is functioning and accurate

3.3.2.1.2 Perform data retrieval as requested by Command customers; data retrieval may be in the form of standard Navy ERP provided reports or those arising from custom query development for data extraction and report generation from Navy ERP and other data sources

3.3.2.1.3 Participate in the creation of enterprise level reporting requirements and identify alternative reporting methods

3.3.2.1.4 Perform data reconciliation and data cleansing activities and recommend corrective actions for data integrity issues

3.3.2.1.5 Support the analysis and coordinate the use of Business Intelligence tools and data to enable data mining and reporting for Command users

3.3.2.1.6 Consult on the design and development of a data warehousing environment to provide reporting flexibility utilizing both ERP and non-ERP data sources

3.3.2.1.7 Support data calls using Navy ERP and other data sources

3.3.2.1.8 Support Navy ERP Business Intelligence Community of

Excellence (BI CoE) activities

3.3.2.1.9 Support the consolidation and migration of legacy data warehouses and business intelligence reporting environments to a Self Service Business Intelligence (SSBI) solution on SAP HANA.

3.3.2.2 Data Management Support

3.3.2.2.1 Support Commands in the management of Navy ERP master data to include entry of master data in coordination withmission aligned personnel

3.3.2.2.2 Support review of data archiving strategies and develop recommendations for an enterprise approach

3.3.2.2.3 Analyze data extracts provided by Navy ERP, NDP, Jupiter, and other data sources to ensure data accuracy and completeness

3.3.2.2.4 Support the development of procedures that govern the use and release of Navy ERP data, NDP data, Jupiter data and other data sources

3.3.3 User Management Support to include technical and functional expertise to ensure Command end-users have the correct access to Navy ERP systems to perform their job duties.

The Contractor shall monitor and resolve user access trouble calls, support data calls and audit related activity, develop and maintain…