Attachment 1 - Platform Security Sources Sought SOW - DRAFT.pdf

PLATFORM SECURITY SUPPORT SERVICES

STATEMENT OF WORK - DRAFT

STATEMENT OF WORK

1. Background/Scope

1.1 Background: This Statement of Work (SOW) supports the mission(s) of the Naval Air Systems Commands (NAVAIR), Naval Air

Warfare Centers (NAWC) and Commander, Fleet Readiness Centers (COMFRC) Platform Security and related support services initiatives. The

NAWC Security Team is responsible for providing all Navy program offices with the people, skills, knowledge, and expertise required to provide control measures for protecting classified and controlled unclassified information. Platform Security can be defined as security of a

Warfighter platform (including the subsystems and support equipment) against foreign intelligence collection and exploitation against all attack surfaces; collection attacks against the program and associated contractors; cyber- attack against program and contractor networks; cyber-attack against the platform during system operation; supply chain attack; collection via international programs; and reverse engineering attack in case of loss on the battlefield or foreign sale. All of these attacks can yield information, which will allow adversaries to understand U.S. capabilities, understand U.S. sources and methods, develop countermeasures (material or non-material) against the weapon system, transfer technology for their own weapon system development, or utilize knowledge gained to mount a kinetic or cyber-attack against the platform. Additionally, knowledge gained from each type of attack can inform future attacks in the same or other types of attacks. Those protections are based on the application of traditional security disciplines which include Acquisition Security, Information Security, International Programs Security (Foreign

Disclosure and foreign national visits), Personnel Security, Industrial Security; Operations Security (OPSEC), Physical Security/Force

Protection/Anti-Terrorism/Emergency Management, Communications Security (COMSEC), as well as risks associated with Research

Technology Protection.

Platform Security requires the close integration of multiple security disciplines, and the translation of multiple U.S. Government, Department of

Defense (DoD) and Department of the Navy (DON) security-related policies into requirements, specifications, design, development, test, production and sustainment of appropriately secured systems. Over time, each security discipline has evolved mostly independently at the DoD, DON, and SYSCOM levels, each the responsibility of a different office, often under different regulatory authority, utilizing different processes, different terminologies, and producing different products. Within a program, facets of platform security are often the responsibility of multiple

Integrated Product Teams (IPTs).

1.2 Scope: The scope of this effort is to provide a full range of Platform Security for NAVAIR, NAWC and COMFRC.

The contractor shall perform all activities related to platform security to include the following:

1. Acquisition Security (ACQSEC) Support

2. Security Modeling

3. Program Security Management - Physical Security, Personnel Security, Information Security, Industrial Security, Communications

Security (COMSEC), Operations Security (OPSEC), Security Classifications Guides, Program Protection Plan (PPP), and Incident

Response.

4. International Programs Security Support (Foreign Disclosure and Foreign Visits) - Technology Transfer Policy, Foreign

Disclosure, Export Control, Foreign Visits, Foreign Partner security assessments, and End Use Monitoring.

5. Administrative Assistant Platform Security Support

2. Applicable documents:

2.1 Department of Defense specifications

2.1.1 DoD National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulations Part 117, NISPOM

Rule.

2.1.2 SECNAV M-5510.36B - Department of the Navy, Information Security Program

2.1.3 DoDI 5200.48 - Controlled Unclassified Information (CUI)

2.1.4 DoDD 5400.07 - DoD Freedom of Information Act (FOIA) Program

2.1.5 DoDI 5230.24, Distribution Statements on Technical Documents

2.1.6 SECNAV M-5510.30C - Department of the Navy, Personnel Security Program

2.1.7 OPNAVINST 3440.17A - Navy Installation Emergency Management Program

2.1.8 DODI 8582.01 - Security of NON-DOD Information Systems Processing Unclassified Non-Public DOD Information

2.1.9 NIST SP 800-171 - Special Publication: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

2.1.10 OPNAVINST 3440.17A - Navy Installation Emergency Management Program

2.1.11 SECNAVINST 5100.13F - Navy Tobacco Policy

2.1.13 SECNAV M-5510.30C - Personnel Security Program

2.1.14 SECNAVINST 5510.36 - DoN Information Security Program (ISP) Regulation

2.1.15 OPNAVINST 5530.14E - Navy Physical Security and Law Enforcement Program

2.1.16 DoDD 5148.13 - Intelligence Oversight

2.2 Department of Defense standards

A comprehensive list of Navy regulatory documents can be found at the DON Chief Information Officer (CIO) website http://www.doncio.navy.mil/.

The Contractor shall be responsible for researching and complying with any additional regulations applicable to the task areas in which they are involved.

2.2.3 Continue to cover all referenced standards

2.3 Other Government documents (e.g. NAVAIR Documents)

2.3.1 NAVAIRHQ 5520.1B - Access Control Security Policy for the RADM William A. Moffett Building

2.3.2 NAVAIRHQ 5510.38 - Naval Air Systems Command National Security Program

2.3.3 NAWCAD 5510.1B - Naval Air Warfare Center Aircraft Division personnel, information, and industrial security program

2.3.4 NAWCAD 3432.1C - OPERATIONS SECURITY

2.3.5 NASPAXRIVINST 5510.15Q - Regulations Governing Admissions to the Naval Air Station, Patuxent River and Webster Field, Maryland

2.3.6 NASPAXRIVINST 5100.35D - Safety and Occupational Health Manual

2.3.7 NASPAXRIVINST 12610.7H - Employee Reporting Procedures During Emergencies

2.3.13 NASPAXRIVINST 3440.17A- Installation Emergency Management Program

3. Requirements

3.1 General Requirements

3.1.1 Compatibility - The Contractor shall maintain the capability to prepare documents and software packages compatible with the Government

IT environment. The current operating environment required for this contract includes:

Microsoft Windows 10

Microsoft Project 2016 Microsoft Office Professional Plus 2016 Adobe Acrobat XI (reader)

Internet access

The Contractor shall maintain the ability to interface with and transfer data to and from requiring office software applications and their upgraded versions. The Contractor shall ensure that all media are virus free when delivered. The Contractor shall be capable of Internet and LAN communications with the government costumers. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with the government costumers during working hours whether at Contractor work site or on travel.

3.1.2 Work Location, Facilities and Telework

3.1.2.1 Work location: Approximately 75 percent of work will be performed at Government site and 25 percent of work to be performed at

Contractor site. Government site(s) primarily include NAVAIR/NAWCAD/COMFRC Patuxent River, MD. Other site locations include St

Inigoes, MD; Lakehurst, NJ; Orlando, FL; China Lake, CA; Point Mugu, CA; North Island, CA; Cherry Point, NC; and, Jacksonville, FL.

Contractors performing on-site support will be provided access to workspaces, telephones, printers, facsimile machines, copy machines, shredders, computers, and network access including web servers and applicable databases or other applications necessary to carry out assigned tasks.

3.1.2.2 Meeting support: In support of the tasking outlined in this SOW, the Contractor shall have the capability to host and conduct meetings at the classification levels up to Secret level, with the capacity to support a minimum of 15 persons and have contractor furnished telephone and

VTC capability (up to Secret level) as well as sufficient equipment to conduct meetings with presentations including compatible software as required in Paragraph 3.1.1 within six months of contract award. The Contractor shall provide simultaneously connection computer-networking capability to allow meeting attendees access to NAVAIR’s NMCI work environment, if applicable. This support shall be provided within a ten

(10) mile driving vicinity of NAVAIR/NAWCAD/COMFRC Patuxent River, MD.

3.1.2.3 Telework: The Contractor may allow employees to telework with approval from the COR in writing, that a positions tasking is eligible for telework. The Contractor may utilize alternate worksites/locations and telework to support continued performance of SOW tasks in accordance with company policy. When using telework, the Contractor remains responsible for contract performance and compliance with any applicable cost accounting standards and contract cost principles / procedures.

3.1.3 Contract Status reporting. The Contractor shall provide the following documentation:

CDRL A001 Monthly Progress and Financial Status Report

CDRL A002 Transition Out Plan

CDRL A003 Operations Security (OPSEC) Plan

CDRL A004 Cybersecurity Implementation Plan

CDRL A005 Technical and Management Work Plan

CDRL A006 Training Data Products

CDRL A007 Security Classification Guide

CDRL A008 Supply Chain Risk Management

CDRL A009 Operations Security (OPSEC) Plan

CDRL A010 Cybersecurity Documentation

3.1.3.1 Monthly Progress and Financial Status Report: The Contractor shall provide a progress and financial status report in accordance with the

Contract Data Requirement List (CDRL A001). The report shall include work accomplished since submittal of the last report, both monthly and cumulative man-hour labor costs expended by labor category and material and travel costs.

CDRL A001 Monthly Progress and Financial Status Report

3.1.4 Work Schedule to include Compressed Work Schedule (CWS), holidays, installation closure, and overtime.

3.1.4.1 Work schedule: The Contractor shall provide the required services and staffing coverage during normal working hours. Normal working hours are usually 8.5 hours (including a 30-minute lunch break), from 0800 to 1630 each Monday through Friday (except on the legal holidays specified in paragraph 3.1.4.1.2). Some supported Government offices have flexibility to start as early as 0600/0630 and end as late as

1800, Monday through Friday.

3.1.4.1.1 Compressed Work Schedule (CWS): CWS is an alternative work schedule to the traditional five 8.5 hour workdays (which includes a 30-minute lunch) worked per week. Under a CWS schedule, an employee completes the following schedule within a two-week period of time:

Eight weekdays are worked at 9.5 hours each (which includes a 30-minute lunch), one weekday is alternately worked as 8.5 hours (which includes a 30-minute lunch) and one weekday is not worked by the employee. The result is 80 hours worked every two weeks, with 44 work hours one week and 36 work hours the other.

The Contractor may allow its employees to work a CWS schedule provided the requirements of this SOW are met. If the Contractor chooses to allow its employees to work a CWS schedule in support of this contract, any additional costs associated with the implementation of the CWS schedule vice the standard schedule are unallowable costs under this contract and will not be reimbursed by the Government. Additionally, the

CWS schedule shall not prevent Contractor employees from providing necessary staffing and services coverage as required by the Government to the ACOR/COR.

3.1.4.1.2 Holidays: The Government observes the Federal holidays identified on the Office of Personnel Management (OPM) website:

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview.

The Contractor is permitted to observe the above Federal Holidays in accordance with its corporate policy.

3.1.4.1.3 Installation closure: When Federal facilities are closed by the Government, or when Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility related problem that prevents Federal personnel from working at the Government facility, contractor personnel assigned to work at that facility in support of such Federal employees shall follow their parent company’s policies.

While generally contractor personnel may not perform work on-site at a Government facility without oversight from Federal personnel, in very limited circumstances, work being performed by contractor personnel may be deemed mission essential and performance of such mission essential work may be authorized to continue at the Government facility despite the facility being otherwise closed for normal operations. The circumstances permitting work being performed by contractor personnel to be deemed mission essential are extremely limited and generally only apply to performance of efforts related to public health, safety, or matters related to national security. The cognizant Contracting Officer must concur with any determination that work being performed by contractor personnel is mission essential.

NASPAXRIVINST 12610.7H – Employee Reporting Procedures During Emergencies identifies procedures Government employees are to follow when an emergency condition is identified. The Contractors shall follow the procedures as defined with the exception of being granted administrative leave. Contractors that are at work when a delay or restricted access is announced shall cease work and exit the base as soon as it is safe to do so.

3.1.4.1.4 Overtime: Overtime as defined in this contract refers to hours worked by a Contractor employee in excess of the employee’s normal workweek. When support requirements outside of normal working hours occur, the Contractor shall ensure qualified personnel are available to support the requirements through the use of overtime. Overtime is authorized under this contract to the extent specified in individual task orders, provided COR approval is obtained in advance. The COR may provide concurrence for overtime on a task, event, program, project, or general function basis. The total cost for overtime over the life of the contract cannot exceed the amount specified in clause 52.222-2 Payment for Overtime Premiums unless first approved in writing by the Procuring Contracting Officer (PCO).

3.1.5 Other Direct Costs:

3.1.5.1 Travel: Travel may include general and administrative expenses, but shall not include profit. Temporary travel to other locations in support of program tasking may be required. If required, temporary travel locations include Lakehurst, NJ; Orlando, FL; China Lake, CA; Point

Mugu, CA; North Island, CA; Cherry Point, NC; Jacksonville, FL; Australia, United Kingdom, and Japan. This list is not all inclusive as locations may change over the life of the contract. (Utilizing the Travel Authorization Request form that will be attached to applicable Task

Orders)

3.1.5.2 Material: Incidental material may be required in the performance of this Contact, and all incidental material purchases shall be IAW

CTXT.242-9520 Procedures and Approvals Required Prior to Incurring Direct Material Costs (APR 2022). All materials not depleted during the performance of this contract shall become Government property upon completion of this contract. The contractor shall transfer all materials not depleted to the COR by way of Material Inspection and Receiving Report (DD Form 250). Material costs may include general and administrative expenses but shall not include profit/fee.

3.1.6 Subcontractors: Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this contract. All provisions of this SOW shall flow down to subcontractors providing support under this contract.

3.1.7 Management of Contractor Personnel: The Government will neither supervise contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual contractor employees. The Contractor shall manage its employees and guard against any actions that are of the nature of personal services or give the perception of personal services.

3.1.8 Transition Out Strategy

The Contractor’s overall transition out strategy shall be built around maintaining the mission of the Naval Air Systems command (NAVAIR), Naval Air Warfare Centers (NAWC) and COMFRC Platform Security with minimal impact, not only in terms of timeliness of performance but also to ensure that critical data and knowledge transfer occurs. Prior to the termination or expiration of the contract, the Contractor shall ensure an orderly transition of responsibilities, while minimizing impact to the operation. The Contractor shall submit a Transition Out Plan, to include the minimum elements listed below in accordance with CDRL A002 – Transition Out Plan.

-Work Turnover. The Contractor shall provide a plan of action to effectively transfer tasked work that is in process at the expiration or termination of the contract to the successor company. Establish and maintain effective communication with the incoming contractor or Government personnel for the period of transition via weekly status meetings.

-Quality Assurance. The Contractor shall provide a plan of action to ensure continuation of quality review processes during the transition period to the successor company.

-Risk Mitigation Strategies. The Contractor shall provide a plan of action to mitigate contract performance risks (quality and schedule) encountered during the transition period.

-Data/Information Transfer. The Contractor shall provide a plan of action for the efficient inventory and transfer of program data to the successor company.

CDRL A002 Transition Out Plan

3.1.9 Program Unique Requirements:

3.1.9.1 Quality Control:

The Contractor shall maintain an effective quality control program to ensure services are performed in accordance with the SOW and the

Contract Surveillance Plan (CSP). The Contractor shall implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Government shall evaluate the Contractor’s performance under this contract in accordance with the CSP, which is included as an attachment to the contract in Section J.

3.2 Security

3.2.1 Citizenship Requirements: Only U.S. citizens may perform under this contract, unless waived by the Government. If the Contractor cannot find qualified U.S. citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the

Government Security Office. The waiver request should include:

a. The individual's name, date and place of birth, position title, and current citizenship.

b. A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements.

c. A statement of the unusual expertise possessed by the applicant.

d. A statement that access will be limited to a specific government contract (specify contract number).

e. A statement that the Contractor has obtained an export license for the information required to perform the contract.

3.2.2 Investigative Requirements:(Choose one or both based on classification of work performed):

All Contractor personnel executing tasking under this contract shall maintain security clearance eligibility commensurate with the level of classification of the work performed as annotated in the Contract's DD-254, Contract Security Classification Specification Form.

Contractor personnel shall require access to classified information in performance of this contract up to and including Top Secret. Classified information will be accessed via the SIPRNet or standalone network in government facilities and at the contractor’s facility within six months of contract award. The Contractor is responsible for ensuring that all personnel receive the requisite investigation and are favorably adjudicated in accordance with National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulation Part 117.

Contractor employees who fail to meet security clearance requirements may not access classified information or perform sensitive duties. In such cases, the Contractor employee may not perform on the contract.

The contractor shall comply with security requirements specified in the DD-254 attached to this contract. Information or data that the contractor accesses shall be handled at the appropriate classification level. Unclassified information shall be handled in accordance with the appropriate designation (Controlled Unclassified Information; For Official Use Only; Covered Defense Information). Distribution is authorized to the

Requiring Office's

Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the TPOC/COR of this contract for approval.

Controlled Unclassified Information including For Official Use Only and Covered Defense Information (meeting the definition of 48 CFR

252.204[7012(a)) generated and/or provided under this contract shall be marked and safeguarded as specified in DoDM 5200.01 (DoD

Information Security Program: Controlled Unclassified Information (CUI)) Vol. 4 (enclosure 3 pages 11-18) available at http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf. Any product containing Covered Defense Information shall be assigned a distribution statement (distribution statements B through F) using the criteria set forth in DoDI 5230.24 (Distribution Statements on Technical

Documents); and have this statement displayed per DoDI 5230.24, Enclosure 3.

3.2.3 Common Access Card (CAC)/Public Key Infrastructure (PKI), System Authorization Access Request (SAAR).

3.2.3.1 SAAR

All Contractor personnel requiring access to Government IT systems shall access and operate IT systems and networks

IAW NAVADMIN 259/23 and CTXT.204-9505 SYSTEM AUTHORIZATION ACCESS REQUEST NAVY (SAAR) REQUIREMENTS

FOR INFORMATION TECHNOLOGY (IT) (NAVAIR) (JAN 2024) have an approved SAAR – System Authorization Access Request form on file, and complete required Annual Information Awareness/Cyber Security Training. New employees must submit their SAAR forms within thirty (30) days of their first day of work.

3.2.3.2 Command Access Cards (CAC) / Local Badges: Contractor CACs and facility specific identification badges will be issued by the

Government to on-site Offeror personnel and shall be visible above the waist at all times while personnel are at the Government site. The

Contractor shall furnish all requested information required to facilitate issuance of identification badges. All CACs and identification badges issued to Contractor employees shall be returned to the TA following completion of the contract, relocation or termination of an employee, or upon request from the Contracting Officer’s Representative/PCO. The Government will provide the Contractor access to Government facilities, as required, for performance of tasks under this contract.

3.2.3.3 DD-254: The Contractor shall comply with security requirements specified in the DD-254 attached to this contract. Information or data that the contractor accesses shall be handled at the appropriate classification level, unclassified information shall be handled as “Controlled

Unclassified Information (CUI).” Distribution is authorized to the Requiring Office’s Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the TPOC/COR of this contract for approval.

3.2.4 Information Security. All work shall adhere to the Information Security Requirements as detailed in paragraph L of Attachment 1 CS

Plan. If the work is performed at the Contractor's facility, the Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and controlled unclassified information (CUI) and to control distribution of CUI in accordance with the National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulation Part 117, NIPSOM Rule, and SECNAV M-5510.36B – Information Security Program. If the work is performed at the Government’s facility, the

Contractor shall comply with instructions/guidance required by that facility.

All contractor facilities shall provide an appropriate means of storage for CUI and materials. All CUI including legacy FOUO information and

Covered Defense Information (CDI) (meeting the definition DFARS Clause 252.204-7012, Safeguarding Covered Defense Information and

Cyber Incident Reporting) generated and/or provided under this Contract shall be marked and safeguarded as specified in DoD Instruction

5200.48, Controlled Unclassified Information (CUI) available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF.

Any product containing CTI shall be assigned a distribution statement (distribution statements B through F) using the criteria set forth in DoDI

5230.24, Distribution Statements on Technical Documents and have this statement displayed per DoDI 5230.24, Distribution is authorized to the

Requiring Office's Organization and supported Activity only. Other requests for deliverables under this Contract shall be referred to the

TPOC/COR of this Contract for approval.

All controlled unclassified technical information (CTI) shall be appropriately identified and marked with the following distribution statement(s):

Distribution Statement (Insert Appropriate Letter and Authorization Title), (Insert

Appropriate Reason Category) (dated – (Date of Distribution Authorization). Other requests shall be referred to: Commander, Naval

Air Systems Command, Attn: Program/User Agency mailing address

3.2.4.1 Marking. All information generated by the Contractor shall be properly marked. Classified information shall be marked IAW DoDM

5200.01, Vol 2, Marking of Classified Information. CUI, including Legacy FOUO information generated and/or provided under this Contract shall be marked IAW DoDI 5200.48. Technical information shall also be marked with appropriate Distribution Statements and Export Control warnings IAW DoDI 5230.24 and program Security Classification Guidance.

3.2.4.2 Public Release. Any CUI pertaining to this Contract shall not be released for public dissemination, including posting to any social media sites such as Facebook or Twitter, unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release through:

Public Affairs Office

NAVAIR

navairpao@us.navy.mil

301-757-1487

3.2.4.3 Loss, Compromise and/or Electronic Spillage of Classified or Controlled Unclassified Information: All instances of loss, compromise and electronic spillage of classified or controlled unclassified information shall be reported to the COR, TPOC and Government

Security Office within 72 hours of the incident occurring.

3.2.4.4 Compliance to NIST 800-171

a)The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls

(Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

(1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

(4) Audit user privileges on at least an annual basis;

(5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e.

FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

(6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

(7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

In accordance with DOD INSTRUCTION 8582.01 SECURITY OF NON-DOD INFORMATION SYSTEMS PROCESSING UNCLASSIFIED

NONPUBLIC DOD INFORMATION, the Contractor shall implement the CUI Security Requirements (Requirements) and associated Relevant

Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a System Security Plans (SSP) and

Plans of Action and Milestones (POAM) that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

The Contractor shall, at a minimum, meet the Basic Safeguarding Requirements as follows to meet the comparable security requirements of the

NIST SP 800-171 as indicated.

The Government may, in its sole discretion, conduct reviews at the Contractor’s site to verify compliance. The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days’ notice to the Contractor.

If the Government determines that the security controls do not adequately implement the requirements of NIST 800-171, then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

Upon the conclusion of the correction period, the Government may conduct a follow-on review at the Contractor’s facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies.

3.2.5 Operations Security (OPSEC): The Contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the Contractor and any subcontractor during performance of the contract. The Contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. This program may include Information Assurance and Communications Security (COMSEC). The OPSEC program shall be in accordance with National

Security Decision Directive (NSDD) 298, and at a minimum shall include:

1) Assignment of responsibility for OPSEC direction and implementation.

2) Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

3) Establishment of OPSEC education and awareness training.

4) Provisions for management, annual review, and evaluation of OPSEC programs.

5) Flow down of OPSEC requirements to subcontractors when applicable.

While performing aboard NAVAIR, NAWC, or COMFRC sites, the Contractor shall comply with facility OPSEC program instructions and contribute to organization-level OPSEC efforts. Include OPSEC as part of its ongoing security awareness program and take all required Agency training. Be responsive to the Supporting OPSEC Manager on a non-interference basis. Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the RO and

Contractor in support of the mission.

CDRL A003 Operations Security (OPSEC) Plan

3.2.6 Anti-Terrorism Force Protection and Emergency Management: The work performed on this contract is Emergency Essential in accordance with OPNAVINST 3440.17A and Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans.

Contractor personnel shall comply with all Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans and directives. Contractor personnel shall report for work at Government facilities upon declaration of Force Protection Condition CHARLIE or in any event or emergency where Government officials’ direct curtailment of operations to “Mission Essential Only”. All Contractor personnel assigned to a Government facility shall complete annual Antiterrorism (Level One) and Active Shooter training.

3.2.7 Cybersecurity

3.2.7.1 Cybersecurity Plan (CS Plan)

For Cybersecurity (CS) requirements see the CS Plan, Attachment 1. Specific mentioned policies in the CS Plan can be accessed via the

Cybersecurity Policy Chart at the following link: http://iac.dtic.mil/csiac/ia_policychart.html.

The Contractor shall be required to deliver a Program Cybersecurity Implementation Plan (CSIP) or Annex CSIP to address each of the sections of the CS Plan. The contractor shall demonstrate its understanding of the CS Plan and describe how the requirement of each of the sections of the

CS Plan will be achieved by the contractor.

The final Program CSIP shall be in Adobe Acrobat format with a digital signature from the contractor cognizant authority.

If no approved Program CSIP currently exists between the contractor and the Government, then one must be created and submitted. If an approved Program CSIP already exists and sufficiently satisfies the CS Plan requirements for the contract, then no new CSIP delivery is required.

In such cases, the Contractor in consultation with the Government shall only submit a Contract Letter to the Government stating that all CS Plan requirements are satisfied by the existing Program CSIP.

If CS Plan requirements are NOT adequately addressed by the existing Program CSIP, then an update to the Program CSIP or a supplemental

CSIP document referred to as an “Annex CSIP” shall be created to satisfy the CS Plan requirements. An Annex CSIP shall address unique CS

Plan Section "G" Assessment and Authorization requirements if a system is being delivered under the contract and unique Section "Q" Software requirements if software is being delivered. These Program CSIP updates or Annex CSIPs shall be submitted on a semi-annual (twice per year) basis in accordance with CDRL A004 Cybersecurity Implementation Plan.

CDRL A004 Cybersecurity Implementation Plan

3.2.7.2 Cyber Incident Response

The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period, reference https://dibnet.dod.mil/portal/intranet/), deliver all data used in performance of the contract that the Offeror determines is impacted by the incident and begin assessment of potential warfighter/program impact.

Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3). Reference https://www.dc3.mil/Organizations/DIB-Cybersecurity/DIB-Cybersecurity-DCISE/

In delivery of the incident data, the Contractor shall, to the extent practical, remove Contractor-owned information from Government covered defense information.

If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

3.2.7.3 NCIS/Industry Monitoring

In the event of a cyber-incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service (NCIS) and associated law enforcement agencies, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, or vendor logs that show network activity, including any additional logs the Contractor, subcontractor, or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor shall cooperate with the

NCIS to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.

3.2.8 Program Unique Requirements

3.2.8.1 Physical Security: The Contractor shall be responsible for safeguarding all Government property provided for their use. At the end of each work period, all Government facilities, equipment, and materials shall be secured.

3.2.8.2 Government Furnished Property, Equipment, and Information: The Government reserves the right to provide Government

Furnished Property, Equipment, and Information on an as needed basis at the task order level.

3.2.8.3 Non-Disclosure Agreements: In the performance of the contract, the Contractor may have access to non-public proprietary information. If the Government determines that the Contractor will have access to non-public proprietary information at a task order level, then the Contractor shall require that any employee performing services under that task order sign a Non-Disclosure Agreement (NDA). The

NDA shall acknowledge the Contractor and employees’ duties and promise to comply with those obligations. A copy of the executed NDA shall be provided to the PCO and Government COR for every person on the contract.

3.2.8.4 Disclosure of Information: Contractor employees shall not discuss nor disclose any information to which they are exposed during the execution of tasks to parties other than the originator of the information, authorized Government investigative personnel, the Contracting

Officer, or COR personnel. Improper disclosure of sensitive information may be grounds for removal of contractor personnel.

3.2.8.5 Training. Training for contractor personnel shall be at the contractor’s expense. In the event the Contractor must attend training, the

Contractor must coordinate training dates with the Government to ensure continuity of operations.

3.2.8.6 Intelligence Oversight Policy. As per DoDD 5148.13 contractor personnel involved in intelligence and intelligence-related activities are required to report any significant, highly sensitive matter (S/HSM) or questionable intelligence activities (QIA) to appropriate

Government officials. An activity or conduct that qualifies as either a QIA or S/HSM is reportable without waiting for substantiation, completion of an investigation, formal adjudication or final resolution of the issue.

3.3 Program Support Requirements: Appropriation types are Research, Development, Test & Evaluation (RDT&E), Working Capital

Fund (WCF), Operations & Maintenance (O&M), Aircraft Procurement (AP), Other Procurement (OP), Weapons Procurement (WP), Foreign

Military Sales (FMS) and Cooperative Program Funds. This section provides the detailed support to be provided by the contractor.

3.3.1 Acquisition Security (ACQSEC) Support: The contractor shall provide ACQSEC support, which includes a holistic approach to technology protection using one, some, or all of the traditional security disciplines. Also known as Program Protection Planning, the contract will facilitate development support and ensure compliance with Acquisition Security regulations, as well as all other security guidance, as applicable.

The contractor shall support NAVAIR ACAT programs and clients with facilitating the identification and protection of CPI.

The contractor shall facilitate the development, coordination, and staffing of Program Protection Plans (PPPs), including all appendices, to support acquisition milestone decisions. The contractor shall coordinate with prime contractors, Milestone Decision Authorities (MDAs), other

U.S. Government agencies, and NAVAIR/NAWC Security as required in the development and staffing actions.

The contractor shall update, coordinate, and staff Technology Assessment and Control Plans (TA/CPs) to support acquisition milestone decisions.

The contractor shall attend designated acquisition program meetings, technical interchanges, planning conferences, procurement planning conferences, and various acquisition program protection planning working group meetings with Government personnel. The contractor shall subsequently update reports, which shall include an agenda, significant discussion, action item assignments, and recommendations.

The contractor shall provide program management support for ACQSEC requirements, such as PPP reviews, process development, and short and long-term development of ACQSEC goals and objectives. Specifics of ACQSEC program management support will be provided in individual task orders.

CDRL A005 Technical and Management Work Plan

CDRL A006 Training Data Products

CDRL A007 Security Classification Guide

CDRL A008 Supply Chain Risk Management

CDRL A009 Operations Security (OPSEC) Plan

3.3.2 SharePoint Site Collection: The contractor shall manage all aspects of the NAVAIR, NAWC, and COMFRC Security SharePoint site environment, including site and content design, site architecture, site performance, monitoring and user access and security of the portal.

The contractor shall provide technical and administrative support to Physical Security in maintaining the physical security database, the Base

Access Security Information Control System (BASICS II) application.

The contractor shall provide technical support to the Command-wide Electronic Fingerprint Process.

3.3.3 International Programs Security Support (Foreign Disclosure and Foreign Visits): The contractor shall provide comprehensive planning, technical, and management solutions for FMS, International Cooperative Programs, Hybrid FMS/Cooperative Cases, and foreign national IT access. The contractor shall analyze and review program documentation prior to submission to the Government for release to foreign governments and contractors. The contractor will update draft documentation for U.S. Government technology transfer policy, monitor U.S.

Government compliance with existing U.S. Government policy and regulations for current programs and draft required documentation for future phases of NAVAIR international programs.

The contractor shall provide support in developing and implementing DoD disclosure and release ability requirements. The contractor shall apply logical analysis and evaluation of programs and policies to provide recommendations for release to a Designated Disclosure Authority (DDA).

The contractor shall coordinate with all required stakeholders for appropriate technical review of data for release to foreign nationals and coordinate release requests. The contractor shall assist in resolving releasability questions and issues.

The contractor shall oversee tracking and ensure quality of data reviewed for release to foreign nationals. The contractor shall provide support for management of foreign national visits.

The contractor shall provide assistance and support in the management of Export Licenses, Technical Assistance Agreements (TAAs) and

Committee on Foreign Investment in the United States (CFIUS) cases.

The contractor shall support in the development and presentation of International Programs Security training and awareness.

3.3.4 Information Security/Lab Manager/Department (Competency) Security Manager: The contractor shall provide the technical capabilities to support implementation of the NAVAIR Information Security Program in accordance with SECNAVISNT-5510.36B, “DoN

Information Security Program.” The Contractor shall safeguard all classified and controlled unclassified information, using appropriate equipment to include storage, handling, marking, transmission, transportation, reproduction, dissemination and destruction. Maintain Secure

Area/Lab Standard Operating Procedures (SOP) and ensure currency in accordance with the latest directives, regulations, and guidance. The contractor shall develop, coordinate and staff Security Classification Guidance (SCGs) and updates, to ensure compliance with appropriate regulations and policy. The contractor shall conduct classification reviews of program material in accordance with the appropriate SCG and make recommendations regarding the sensitivity or classification of the material. The contractor shall perform reviews of material requested for public release, as well as Freedom of Information Act (FOIA) requests, and make recommendations regarding the release of the information. The contractor shall support NAVAIR Headquarters, major programs and field activities with the appropriate safeguarding, marking and handling of classified and controlled unclassified information. The contractor shall participate in preliminary inquiries resulting from security incidents. The contractor shall conduct physical inventories of classified material when requested. The contractor shall provide support to NAVAIR artificial intelligence security risk reduction activities and programs.

The contractor shall support in the development and presentation of Information Security training and awareness.

CDRL A007 Security Classification Guide

3.3.5 Personnel Security: The contractor shall provide the technical capabilities to support implementation of the NAVAIR Personnel

Security Program in accordance with SECNAVINST 5510.30C. The contractor shall assist NAVAIR programs and field activities on the determination of the required position sensitivity categories for specific duties. The contractor shall support the management of personnel clearance tracking systems and verification of security clearances. The contractor shall support the management of NAVAIR insider threat prevention programs.

The contractor shall support in the development and presentation of Personnel Security training and awareness.

person

3.3.6 Industrial Security: The contractor shall provide the technical capabilities to support the management and implementation of the

Industrial Security Program for NAVAIR, major programs, and field activities. The contractor shall comply with DoD National Industrial

Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulations Part 117.

The contractor shall support in the development and presentation of Industrial Security awareness and training.

3.3.7 Operations Security (OPSEC): The contractor shall provide the technical capabilities to support the management and implementation of the OPSEC Program for NAVAIR, major programs and field activities. The contractor shall comply with OPNAVINST 3432.1C.

The contractor shall develop OPSEC Survey/Assessment Plans, as well as conduct and produce findings of surveys/assessments.

The contractor shall support in the development and presentation of OPSEC awareness and training.

CDRL A009 Operations Security Plan

3.3.8 Physical Security/Force Protection/Anti-Terrorism/Emergency Management: The contractor shall provide the technical capabilities to support the management and implementation of the Physical Security Program for NAVAIR, major programs and field activities.

The contractor shall ensure compliance with OPNAVINST 5530.14E. The contractor shall conduct Physical Security surveys, and report findings.

The contractor shall develop, participate in and/or provide Physical Security/Force Protection/Anti- Terrorism/Emergency Management awareness and training.

3.3.9 Communications Security (COMSEC): The contractor shall facilitate and support in the program management of COMSEC.

The contractor shall support in the development and presentation of COMSEC awareness and training.

CDRL A005 Technical and Management Work Plan.

3.3.10 Security Project/Program Management Support: The contractor shall provide administrative and project/program management support for NAVAIR, major programs, and field activity security initiatives.