BMS_NOI 5_PWS_DRAFT.pdf

CUI

05 MARCH 2026

Battlespace Contract Performance Work Statement (PWS)

DRAFT

Controlled Unclassified Information

Controlled by: Department of the Navy NAVAIRSYSCOM;

Integrated Battlespace Simulation & Test Department (IBST)

CUI Category:

CTI, EXPT Distribution/Dissemination Control:

Distribution Statement D POC: Digital Analytics, infrastructure, and Technology Advancement (DAiTA) Group’s

Integrated Battlespace Simulation & Test Department (IBST)

DISTRIBUTION STATEMENT D: Distribution authorized to the Department of Defense and U.S. DoD Contractors only; Controlled Technical Information; 05 March 2026. Other requests shall be referred to the Battlespace Division, Integrated Battlespace Simulation & Test Department (IBST) Patuxent River, MD 20670.

WARNING -This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et seq.) or the Export Control Reform Act of 2018 (Title 50, U.S.C., Chapter 58, Sec. 4801-4852). Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.

1.0 Scope

The Integrated Battlespace Simulation and Test (IBST) Department, Naval Air Warfare Center (NAWCAD) – Battlespace Division, is the Naval Air Systems Command’s (NAVAIR) center of excellence for Modeling and Simulation (M&S) of the battlespace environment. The Battlespace Division is one of three divisions within IBST.

The Battlespace Division is responsible for providing specialized simulation expertise. Its principal mission is the development of advanced products and capabilities that model naval aviation systems and the complex, dynamic battlespace environment in which they operate. Distributed simulation, and Live-Virtual-Constructive (LVC) events are used throughout the acquisition lifecycle to reduce risk and improve the quality of naval aviation systems. The Battlespace Division researches, designs, develops, implements, deploys, and maintains software applications, advanced real-time simulations, real-time interfaces, and tools to support battlespace and distributed simulations. The division conducts requirements analysis, test and evaluation, and trainer/training application developments across the Department of Defense (DoD) and for Foreign Military Sales (FMS) customers.

The principal product developed and maintained by the Battlespace Division is the Next Generation Threat System (NGTS). NGTS is a synthetic warfare environment generator used to support training, testing, analysis, and research and development. NGTS models threat and friendly aircraft, ground and surface platforms, and their corresponding weapons and subsystems. NGTS is currently installed in multiple DoD training systems, distributed exercise centers, and international military training environments. Other distributed simulation products developed and maintained by the Battlespace Division include the Architecture Management Integration Environment (AMIE), Global Reusable Interface Domain (GRID), Weapons Server Common Environment (WSCE), Simulation Control Executive (SCE), Analysis and Reporting Tool (ART), Battlespace Environment Audio Video Event Recorder (BEAVER), and the Shared Package Manager (SPM). Furthermore, support is provided for standard protocols enabling battlespace simulation. These include Distributed Interactive Simulation (DIS), High Level Architecture (HLA), Test and Training Enabling Architecture (TENA), and the Joint Simulation Environment (JSE) Government Simulation Interface (GSI).

This Performance Work Statement outlines tasking for research, design, development, and associated engineering to meet battlespace and distributed simulation requirements. The Contractor shall provide support that includes the research, development, and maintenance of simulation tools; the application of these tools to specific customer requirements; the research and development of warfare scenarios; the development and integration of entity models and behaviors; and ongoing support for all products delivered by the Battlespace Division. While Sensitive Compartmented Information (SCI) is a component of each task area, it is stipulated that none of the deliverables shall contain SCI.

Typical tasking under this PWS includes:

• Develop a representative simulated battlespace environment and tools for test and evaluation and training for Department of the Navy (DoN) and DoD programs.

• Research, development, integration, and test of next generation M&S technologies.

• Develop high fidelity models and simulations to support major acquisition program analysis of requirements.

• Develop new models and simulations of existing red and blue force environments, weapons systems, and tactics.

• Provide physical security and access control for Battlespace Division and IBST Department spaces.

• Conduct configuration management for in-house developed applications.

• Develop training products for in-house developed applications.

• Create DevOps scripts/processes and SPM for customer installation of in-house developed applications.

• Generate technical documentation for in-house developed applications.

• Distribute/monitor licenses and in-house developed applications and documents.

• Provide business operations and office managerial tasks.

This PWS defines the overall scope required to support the contract. Individual Orders (i.e., Task Orders (TO) or Delivery Orders (DO)) shall specify tasking.

2.0 Applicable Documents

The Contractor shall conform to applicable DoD, DoN, and IBST procedures and standards in the performance of this contract. The Contractor shall comply with the most current version of all applicable security standards and procedures.

2.1 Federal / DoD / Military Documents

2.1.1 32 Code of Federal Regulation (CFR) Part 117

National Industrial Security Program Operating Manual

(NISPOM)

2.1.2 DoD Instruction (DoDI) 5200.48 Controlled Unclassified Information (CUI), 06 Mar 2020

2.1.3 DoDI 5230.24 Distribution Statements on DoD Technical Information, 10 Jan 2023

2.1.4 NIST SP 800-171 (Rev.3) Special Publication: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

2.1.5 DoDI 5200.01 DoD Information Security Program and Protection of Sensitive Compartmented Information (SCI), 01 Oct

2.1.6 DoDM 5200.01 DoD Information Security Program: Controlled Unclassified Information (CUI), vol. 4

2.1.7 DoDI 5220.22 National Industrial Security Program (NISP), Change 2, 4 Sep 2020

2.1.8 DoDI 8520.02 Public Key Infrastructure (PKI) and Public Key (PK), 24 May 2011

2.1.9 DoDI 8582.01 Security of Non-DoD Information Systems Processing Unclassified Nonpublic DoD Information, 9 Dec 2019

2.1.10 National Security Decision Directive

(NSDD) 298

National Operations Security Program, 22 Jan 1988

2.1.11 Intelligence Community Directive

(ICD) 704

Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information, 20 Jun 2018

2.1.12 DoDM 5105.21, Vol 1 Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Information and Information Systems Security, Volume 1, 06 Oct 2020

2.1.13 DoDM 5105.21, Vol 2 Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Information and Information Systems Security, Volume 2, 02 Nov 2020

2.1.14 DoDM 5105.21, Vol 3 Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Information and Information Systems Security, Volume 3, 14 Sep 2020

2.1.15 Joint Travel Regulations The Joint Travel Regulations (JTR), 01 Mar 2026

2.1.16 National Security Agency/Central

Security Service Manual 3-16 "Control of Communications Security (COMSEC) Material" August 5, 2005

National Security Agency/Central Security Service Manual 3-16 "Control of Communications Security (COMSEC) Material" August 5, 2005

2.2 DoN Documents

2.2.1 OPNAVINST 5239.1E US Navy Cybersecurity Program

2.2.2 SECNAVINST 5510.36B DoN Information Security Program 12 Jul 2019

2.2.3 NASPAXRIVINST 5510.15S Regulations Governing Admission to the Naval Air Station Patuxent River, Navy Outlying Field Webster, and Navy Recreation Center Solomon’s, Maryland, 29 Jan 2024

2.2.4 SECNAVINST 5510.30C DoN Personnel Security Program, 24 Jan 2020

2.2.5 OPNAV 3440.17A Navy Installation Emergency Management Program, 1 Aug 2014

2.2.6 OPNAV 5239/14 System Authorization Access Request Navy (SAAR-N), Sep 2011

2.2.7 NAVADMIN 259/23 Guidance for Navy System Authorization Access Request and Reciprocity, Nov 2023

2.2.8 NMCARS Annex 16 (Change 26-01) Annex 16 – Statement of Work Language Implementing “The DIB” Memo

3.0 Requirements

3.1 General Requirements

3.1.1 Compatibility

The Contractor shall maintain the capability to prepare documents and software packages compatible with the Government Information Technology (IT) environment through the security classification of Collateral SECRET. The Contractor shall supply approximately 15 contractor-owned computers for use during onboarding of new contractor personnel. These assets are to be used for initial training and familiarity and shall not be used for the performance of sensitive development under this PWS. The Contractor shall update software versions as required for security or maintenance. The Contractor shall maintain the ability to interface with and transfer data to and from office software applications and their upgraded versions. The Contractor shall maintain state of the art anti-virus software and ensure that all media are virus free when delivered. The Contractor shall be capable of Internet and email communications with the IBST Department. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with the IBST Department, during working hours whether at Contractor work site or an alternate work site.

3.1.2 Work Locations

3.1.2.1 Government Location

Approximately 30% of the work will be performed at the Government site located in Patuxent River, MD, 70% will be performed at the Contractor site(s) as defined in Section 3.1.2.2 for work at the SECRET or UNCLASSIFIED level.

The Government will provide access to workspaces, telephones, printers, facsimile machines, copy machines, shredders, computers, and network access including web servers and applicable databases or other applications necessary for contractors to carry out assigned tasks on-site. Exact definition of tasking locations between Government site, contractor facilities inclusive of subcontractors, and telework, will be mutually agreed to at the Order level.

3.1.2.2 Contractor Location

The Contractor shall provide at least one facility within 20 miles driving distance of NAS Patuxent River that includes a GENSER Secret level laboratory space with at least 3000 ft2 of space and a Government or Contractor owned Secret level network with a minimum of 30 workstations within 90 days of award. A listing of Government Furnished Property (GFP) to be made available to the Contractor at contractor facility(s) can be found in the Wide-Area Workflow GFP Module. The Government shall provide Unclassified and Classified Research, Development, Test, & Evaluation (RDT&E) computers and computer network connectivity for off-site contractors providing direct full-time technical support that require RDT&E network access. The contractor facility(s) shall support the prime contractor and associated subcontractors as well as provide temporary work locations for Government personnel and other Government CSS support specific program RDT&E requirements.

The Contractor shall have the capability to host and conduct meetings in support of the tasking outlined in this PWS at classification levels from unclassified up to the GENSER secret level with the capacity to support a minimum of 10 persons and have contractor furnished telephone and VTC capability as well as sufficient equipment to conduct meetings with presentations including compatible software as required in Paragraph 3.1.1. The Contractor shall provide this support at the Contractor’s location.

3.1.2.3 Alternate Work Site

The Contractor may allow employees to telework with approval from the COR, in writing, that a position’s tasking is eligible for telework. The Contractor may utilize alternate worksites/locations and telework to support continued performance of PWS tasks in accordance with company policy. When utilizing telework, the Contractor remains responsible for task order performance.

3.1.3 Contract Status Reports

The Contractor shall provide the following documentation:

3.1.3.1 Program Financial Summary Report

The Contractor shall provide a monthly contract financial status report in accordance with the Contract Data Requirement List (CDRL) A001.

3.1.3.2 Monthly Progress Report:

The Contractor shall provide a monthly progress report in accordance with CDRL A0002.

3.1.3.3 Contractor Personnel Locator Report:

The Contractor shall provide a monthly Contractor Personnel Locator Report in accordance with CDRL A003. Note:

This CDRL also satisfies the reporting requirements identified in CTXT.204-9502, Requirements for Local Security System (NAVAIR)

3.1.3.4 Government Property Report

The Contractor shall provide a monthly Government Property Report in accordance with CDRL A004.

3.1.3.5 Transition In Plan

The Contractor shall submit a Transition In Plan, to include the minimum elements listed in CDRL A005.

3.1.3.6 Transition Out Plan

The Contractor shall submit a Transition Out Plan, to include the minimum elements listed in CDRL A006.

3.1.4 Work Schedules

3.1.4.1 Primary Work Schedule

The Contractor shall provide the required services and staffing coverage during normal working hours. Normal working hours are usually 8.5 hours (including a 30-minute lunch break) encompassing the core hours of 0900-1500 each Monday through Friday (except on the legal holidays specified in paragraph 3.1.4.4).

3.1.4.2 Compressed Work Schedule (CWS)

CWS is an alternative work schedule to the traditional five 8.5 hour workdays (which includes a 30-minute lunch) worked per week. Under a CWS schedule, an employee completes the following schedule within a two-week period of time: Eight weekdays are worked at 9.5 hours each (which includes a 30-minute lunch), one weekday is alternately worked as 8.5 hours (which includes a 30-minute lunch) and one weekday is not worked by the employee. The result is 80 hours worked every two weeks, with 44 work hours one week and 36 work hours the other.

The Contractor may allow its employees to work a CWS schedule provided the requirements of this PWS are met. If the Contractor chooses to allow its employees to work a CWS schedule in support of this contract, any additional costs associated with the implementation of the CWS schedule vice the standard schedule are unallowable costs under this contract and will not be reimbursed by the Government. Additionally, the CWS schedule shall not prevent Contractor employees from providing necessary staffing and services coverage as required by the Government to the

ACOR/COR.

3.1.4.3 Shift Work Schedule

The Contractor must be prepared to conduct operations in shifts to accommodate specific mission requirements, emergency situations, or to minimize interference with other Government activities to meet the requirements of this PWS. The establishment or alteration of shift schedules requires prior written approval from the COR to ensure alignment with operational needs and to prevent disruption of Government functions.

3.1.4.4 Holidays

The Government observes the Federal holidays identified on the Office of Personnel Management (OPM) website:

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/. With the exception of the events in section

3.1.4.5 below, the Contractor is permitted to observe Federal holidays in accordance with its corporate policy.

3.1.4.5 Installation Closures

The Contractor shall follow their parent company’s policies when Federal facilities are closed by the Government, or when Federal employees are officially excused from work due to a holiday, special event, severe weather, security threat, or any other Government facility related event that prevents Federal personnel from working at the Government facility.

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/

Generally, contractor personnel may not perform work on-site at a Government facility without Federal personnel present. However, in limited circumstances, the work performed by contractor personnel is considered mission essential and the Contracting Officer may authorize the contractor to perform work at the Government facility when the facility is closed for normal operations. Mission essential work efforts typically include work efforts related to public health, safety, or matters related to national security. Mission essential services, if any, may be identified at the Order level.

3.1.4.6 Overtime

Overtime as defined in this contract refers to hours worked by a Contractor employee in excess of the employee’s normal workweek, which exceed the employee’s scheduled 80 hours for a two week time period. When support requirements outside normal working hours occur, the Contractor shall ensure qualified personnel are available to support the requirements. Overtime is authorized under this contract to the extent specified in individual task orders, provided COR approval is obtained in advance. The COR may provide concurrence for overtime on a task, event, program, project, or general function basis. The total cost for overtime over the life of the contract cannot exceed the amount specified in clause 52.222-2 Payment for Overtime Premiums unless first approved in writing by the Chief of the Contracting Office, in accordance with FAR 22.103-4 and NMCARS 5222.103-4.

3.1.5 Subcontractor

The contractor shall clearly and effectively communicate the requirements in this PWS to its subcontractors.

Additionally, consultants supporting the contractor are also considered subcontractors.

3.1.6 Management of Contractor Personnel

The contractor shall manage its employees’ tasking, performance, and work schedules. The Government will not supervise, assign tasks to contractor employees, or otherwise imply that the Government may direct contractor personnel.

3.1.7 Policies

In the performance of this contract, the Contractor shall utilize all appropriate IBST and Battlespace Division Standard Operating Procedures, policies, desk guides, etc. as defined by the TPOC and/or COR at the Order level.

3.1.8 Data Rights

The Government will retain ownership of all source data (including code, data, and other source files) for tasking performed under Task Orders under this PWS. The Government will remain the Configuration Management (CM) authority for all aforementioned source data. Data rights for Delivery Orders may be negotiated at the Delivery Order level.

3.1.9 Transition In Plan

The incoming Contractor’s overall transition-in strategy shall be focused on the complete and efficient assumption of program/division responsibilities with no degradation in mission performance. The primary objectives are to ensure that all critical data and institutional knowledge are successfully captured and to establish full operational capability by the end of the transition period. The incoming contractor will work in close partnership with the outgoing contractor and Government personnel to facilitate a transparent and orderly transfer of duties. The Contractor shall submit a Transition In Plan, to include the minimum elements listed below in accordance with CDRL A005.

• Work Assumption. The Contractor shall provide a plan to effectively receive and assume all tasked work that is in process from the outgoing contractor. This includes reviewing current work products and confirming the status of all deliverables. The Contractor shall actively participate in weekly status meetings to engage with the outgoing contractor, ask clarifying questions, and ensure a comprehensive understanding of all ongoing tasks.

• Quality Assurance Integration. The Contractor shall provide a plan of action to understand and integrate the existing quality review processes. The goal is to ensure the seamless continuation of these processes from day one of the new contract period. This plan will involve reviewing the outgoing contractor's quality assurance procedures and mapping them to the incoming contractor's internal standards to guarantee undiminished quality.

• Risk Mitigation Strategies. The Contractor shall provide a plan of action to identify and mitigate risks associated with the assumption of contract performance. This includes risks related to knowledge gaps, data integrity, and schedule alignment. The plan shall outline procedures for early identification of potential issues and pre-planned responses to ensure that quality and schedule are maintained throughout the transition period.

• Data/Information Reception. The Contractor shall provide a plan for the efficient receipt, inventory, and validation of all program data from the outgoing contractor. This includes creating a comprehensive checklist to ensure all specified data, documentation, and system access are successfully transferred and fully functional.

3.1.10 Transition Out Plan

The Contractor’s overall transition-out strategy shall be built around maintaining the mission of the program/division with minimal impact, not only in terms of timeliness of performance but also to ensure that critical data and knowledge transfer occurs. The contractor shall ensure an orderly transition of responsibilities, while minimizing impact on operations prior to the termination or expiration of the contract. The Contractor shall submit a Transition Out Plan, to include the minimum elements listed below in accordance with CDRL A006.

• Work Turnover. The Contractor shall provide a plan of action to effectively transfer tasked work that is in process at the expiration or termination of the contract to the successor company. The Contractor shall establish and maintain effective communication with the incoming contractor or Government personnel for the period of transition via weekly status meetings.

• Quality Assurance. The Contractor shall provide a plan of action to ensure continuation of quality review processes during the transition period to the successor company.

• Risk Mitigation Strategies. The Contractor shall provide a plan of action to mitigate contract performance risks (quality and schedule) encountered during the transition period.

• Data/Information Transfer. The Contractor shall provide a plan of action for the efficient inventory and transfer of program data to the successor company.

3.2 Security Requirements

3.2.1 Citizenship Requirements

Only U.S. citizens may perform work under the contract, unless waived. If the Contractor cannot find qualified U.S.

citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office. The waiver request should include:

a. The individual's name, date and place of birth, position title, and current citizenship.

b. A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements.

c. A statement of the unusual expertise possessed by the applicant.

d. A statement that access will be limited to a specific government contract (specify contract number).

e. A statement that the Contractor has obtained an export license for the information required to perform the contract.

3.2.2 Investigative Requirements

All Contractor personnel shall maintain security clearance eligibility commensurate with the level of classification of the work performed as annotated in the Contract's DD-254, Contract Security Classification Specification Form (Attachment X), unless granted a waiver due to citizenship as specified in Section 3.2.1.

To perform the requirements of this PWS, Contractor personnel shall require access to classified information up to and including TOP SECRET/Sensitive Compartmented Information with a safeguarding level of None. The Contractor shall ensure that its personnel receive the requisite investigation and are favorably adjudicated in accordance with National Industrial Security Program Operating Manual (NISPOM) codifying 32 CFR Part 117 and SECNAVINST 5510.30C before performing any tasking in this PWS. Contractor employees who fail to meet security clearance requirements are not eligible to perform any of the tasking in this PWS.

The Contractor shall comply with security requirements specified in the DD-254 attached to the contract. The Contractor shall handle all information or data that the Contractor access at the appropriate classification level.

Unclassified information shall be handled in accordance with the appropriate designation (Controlled Unclassified Information; Covered Defense Information). Distribution is authorized to the Requiring Office's Organization and supported Activity only. Other requests for deliverables under the contract shall be referred to the TPOC/COR of the contract for approval. Additional investigative requirements apply for all personnel supporting TS/SCI tasking;

reference Section 3.2.10.

3.2.3 Access Requirements

3.2.3.1 SAAR

Contractor personnel who require access to Government IT systems shall have an approved SAAR-N – System Authorization Access Request Navy form, OPNAV 5239/14, on file per CTXT.204-9505 SYSTEM

AUTHORIZATION ACCESS REQUEST NAVY (SAAR) REQUIREMENTS FOR INFORMATION

TECHNOLOGY (IT) (NAVAIR), and complete required Annual Information Awareness/Cyber Security Training before access is granted to operate IT systems and networks in accordance with NAVADMIN 259/23. New employees must submit their SAAR forms within thirty (30) days of their first day of work.

3.2.3.2 CAC/Local Badges/PKI Tokens

The Government will issue Contractor CACs and facility specific identification badges to on-site Contractor personnel who require base facility access. Contractor personnel shall ensure that identification badges are visible at all times while personnel are at the Government site. The Contractor shall furnish all requested information required to facilitate issuance of identification badges and shall comply with NASPAXRIVINST 5510.15 (series). The Contractor shall return CACs and identification badges issued to Contractor employees to the Government Security Department issuing the credential following completion of the contract, relocation, or termination of an employee, or upon request from the COR. The Government will provide the Contractor access to Government facilities, as required, for performance of tasks under this PWS. Contractor personnel shall comply with the applicable security procedures and regulations for assigned facilities. Public Key Infrastructure (PKI) tokens, such as Alternative Tokens and Secret Internet Protocol Router Network (SIPRNet) tokens, shall be handled in accordance with DoDI 8520.02.

3.2.3.3 DD-254 (Attachment X)

The Contractor shall comply with security requirements as specified in the DD-254, Attachment X to the contract.

The Contractor shall handle information or data that the Contractor accesses at the appropriate classification level.

The Contractor shall handle unclassified information as “Controlled Unclassified Information (CUI).” Distribution is authorized to the Requiring Office’s Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the COR of this contract for approval.

CUI information generated and/or provided under this contract shall be marked and safeguarded as specified in DODM

5200.01 – DoD Information Security Program: Controlled Unclassified Information (CUI) Vol. 4 (enclosure 3 pages 11-18) available at https://www.dodig.mil/Portals/48/Documents/Policy/520001_vol4.pdf.

https://www.dodig.mil/Portals/48/Documents/Policy/520001_vol4.pdf

3.2.4 Information Security (INFOSEC)

The Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and CUI and to control distribution of CUI in accordance with the National Industrial Security Program Operating Manual (NISPOM) codifying 32 CFR Part 117, SECNAVINST 5510.36B – DoN Information Security Program, and DoDI 8582.01. If the work is performed at the Government’s facility, the Contractor personnel shall comply with instructions/guidance provided during facility security training.

The Contractor shall protect information at the TS/SCI level in accordance with DoDI 5200.01 DoD Information Security Program and Protection of Sensitive Compartmented Information (SCI).

3.2.4.1 Marking

The Contractor shall properly mark information it generates. The Contractor shall mark and safeguard CUI, including Covered Defense Information (meeting the definition of 48 CFR 252.204–7012(a)), generated and/or provided under this contract as specified in DoDI 5200.48, Controlled Unclassified Information (CUI) available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/ 520048p.PDF. The Contractor shall also properly mark technical information with appropriate Distribution Statements and Export Control warnings in accordance with 32 CFR Part 117, SECNAVINST 5510.36B – DoN Information Security Program, and individual program security classification guidance as applicable. The Contractor shall assign a distribution statement (distribution statements B through F) to products that contain Covered Defense Information using the criteria set forth in DODI 5230.24 Distribution Statements on Technical Documents; and have this statement displayed per DODI 5230.24, Enclosure 3.

3.2.4.2 Public Release for Classified and Unclassified Information:

The Contractor shall not release information pertaining to this PWS or contract for public dissemination. Public dissemination includes posting to any social media, Contractor websites, trade publications etc., unless it has been approved for public release by the appropriate U.S. Government authority. The Contractor shall submit proposed public releases to the COR for initial approval and awareness. Upon COR approval, the Contractor shall submit its proposed public release through the NAWCAD Procuring Contracting Officer, and to the Public Affairs Office, NAWCAD, navairpao@us.navy.mil, 301-757-5136. The Contractor shall not publicly release the information until it receives PCO and PAO approval, in writing.

3.2.4.3 Loss, Compromise, and/or Electronic Spillage of Classified or Controlled Unclassified Information

The Contractor shall report instances of loss, compromise and electronic spillage of classified or controlled unclassified information to the COR, TPOC, and Government Security Office within 24 hours of the incident occurring under this IDIQ.

3.2.4.4 System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews In accordance with NMCARS Annex 16,

a. Within thirty (30) days of contract award, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the contractor’s facility. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government’s review of the SSPs at the Contractor’s facility.

b. If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government.

The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a Plan of Action and Milestones (POA&M) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF mailto:navairpao@us.navy.mil

c. Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor’s facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

d. The Government may, in its sole discretion, conduct subsequent reviews at the Contractor’s site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days’ notice to the Contractor.

3.2.4.5 Compliance to NIST 800-171

In accordance with NMCARS Annex 16,

a. The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev 3.) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered Contractor information systems affecting this contract.

b. Notwithstanding the allowance for such variation, the Contractor shall identify in the SSP and POA&M their plans to implement the following, at a minimum:

1. Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication.

For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

2. Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the Contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

3. Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods;

4. Audit user privileges on at least an annual basis;

5. Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

6. Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

7. Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

3.2.5 Operational Security (OPSEC)

The Contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the Contractor and any subcontractor during performance of the contract. The Contractor shall be responsible for the subcontractor’s implementation of the OPSEC requirements. This program may include Information Assurance and Communications Security (COMSEC).

The OPSEC program shall be in accordance with National Security Decision Directive (NSDD) 298, and at a minimum shall include:

a. Assignment of responsibility for OPSEC direction and implementation.

b. Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

c. Establishment of OPSEC education and awareness training.

d. Provisions for management, annual review, and evaluation of OPSEC programs.

e. Flow down of OPSEC requirements to subcontractors when applicable. The Contractor shall comply with facility OPSEC program instructions and contribute to organization-level OPSEC efforts while performing aboard NAVAIR or NAVAIR sites. The Contractor shall include OPSEC as part of its ongoing security awareness program and take all required Agency training. The Contractor shall be responsive to the Supporting OPSEC Manager on a non-interference basis. The Contractor shall protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the RO and Contractor in support of the mission.

f. The Contractor shall develop, implement, and maintain an OPSEC plan (CDRL A007) to protect classified and sensitive information to be used at a Contractor's and subcontractor's facilities during the performance of this contract. The Contractor is responsible for ensuring subcontractor implementation of the OPSEC program requirements for this contract.

3.2.6 Anti-Terrorism Force Protection and Emergency Management

Anti-Terrorism Force Protection and Emergency Management: It is not anticipated that the work performed on this contract will be Emergency Essential in accordance with OPNAV 3440.17A and Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans. Contractor personnel shall comply with all Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans and directives. Unless otherwise authorized in accordance with section 3.1.4.5, Contractor personnel shall not report for work at Government facilities upon declaration of Force Protection Condition CHARLIE or in any event or emergency where Government officials direct curtailment of operations to “Mission Essential Only”. All contractor personnel assigned to a Government facility shall complete annual Antiterrorism (Level One) and Active Shooter training.

3.2.7 Communications Security (COMSEC)

Contractor personnel may be required to access COMSEC material. The Contractor personnel shall follow National Security Agency/Central Security Service Manual 3-16 "Control of Communications Security (COMSEC) Material" August 5, 2005 in the control and protection of COMSEC material/information at their facilities. When access is required at Government facilities, contractor personnel will adhere to COMSEC rules and regulations as mandated by National Industrial Security Program Operating Manual (NISPOM) codifying 32 CFR Part 117, Department of the Navy Communications Materials System (CMS-1A) and Command policy and procedures.

3.2.8 Cyber Security

The Contractor, and all subcontractors, shall comply with the policies, procedures, and responsibilities outlined in the most current version of OPNAVINST 5239.1E, U.S. Navy Cybersecurity Program. The Contractor shall include specific provisions to ensure the safeguarding of all information and data residing on or passing through contractor-owned or operated systems.

3.2.9 Cyber Incident Response

In accordance with NMCARS Annex 16,

a. The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

b. Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

c. If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the Contracting Officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The Contracting Officer will approve or disapprove the request after coordination with DC3.

3.2.10 Naval Criminal Investigative Service (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies, in accordance with NMCARS Annex 16.

3.2.11 NCIS/Industry Monitoring

a. In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the Contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b. If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

c. In all cases, the collection or provision of data and any activities associated with this performance work statement shall be in accordance with federal, state, and non-US law.

3.2.12 Additional Security Requirements

3.2.12.1 TS/Sensitive Compartmented Information:

This contract includes Sensitive Compartmented Information performance requirements. These requirements include access to SCI materials and information and do not include SCI deliverables. The Contract shall require access to threat intelligence information and other SCI for the purpose of developing accurate simulated and stimulated battlespace environmental conditions and conducting of aircraft test and evaluation in relation to the environments and on aircraft systems operating at the SCI level.

All Contractor personnel supporting SCI requirements must obtain a TOP SECRET clearance with a fully adjudicated investigation in accordance with Intelligence Community Directive (ICD) 704 prior to starting any SCI level work.

As a further enhancement to security measures, for the protection of classified information, the Contractor agrees to permit necessary polygraph interviews on Contractor personnel having access to National Security Information (NSI) under this contract. The polygraph interview will be limited to counterintelligence (CI) and counterespionage (CE) issues.

Should TS/SCI information be approved for access at an accredited non-Governmental facility, it must be done in accordance with DoDM 5105.21, Volumes I-III.

All DoN contractors with SCI access must be briefed into North Atlantic Treaty Organization (NATO) Secret access, in accordance with Director of National Intelligence Memorandum 5 May 2017, Access to North Atlantic Treaty Organization (NATO) Information by Intelligence Community (IC) Personnel and Naval Intelligence Security Policy Directive 17-008 Revision, Mandate for North Atlantic Treaty Organization (NATO) information by Intelligence Community (IC) Personnel.

3.2.12.2 Special Access Programs

The Contractor may require Special Access Programs (SAP) access in accordance with the DD-254.

3.2.12.3 Special Network Access

The Contractor shall require access to special networks in the performance of this requirement in accordance with the

DD-254.

3.3 Detailed Support Requirements

IBST provides integrated testing of aircraft systems during the acquisition’s engineering / development phases. IBST’s simulated flight environments allow systems-of-systems to be thoroughly tested as they would during flight operations. Systems can be tested with “Hardware-In-The-Loop” (HWIL) allowing aircraft hardware or software to be fully integrated and electronically stimulated without ever leaving the ground. Any level of HWIL software or hardware ground testing can be performed through use of Live, Virtual, Constructive (LVC) M&S techniques. Models range in complexity from the simplistic to fully validated Digital Systems Models (DSM) of complex avionics systems and subsystems, including systems and circuitry for HWIL testing. The Contractor shall research, analyze, develop, integrate, test, and maintain avionic, aerodynamic, tactical and other mission capable simulation models, databases, and tools for IBST.

3.3.1 Development and Engineering Support

The Contractor shall:

3.3.1.1 Battlespace Environment Modeling

Perform research, design, development, modification, testing, and operation of simulated environment models. Tasks include, but are not limited to:

• Perform research, develop, interface, and operate warfare simulation environments.

• Develop Battlespace simulation environment models through independent research and analysis of data from sources such as the Electronic Warfare Integrated Reprogramming Database (EWIRDB).

• Virtual environmental database modeling, to include the construction and maintenance of complex virtual environments in multi-spectral display formats. These virtual environments shall be correlated with other complex software systems for the purpose of distributed missions and exercises of a similar nature.

• Develop simulated environments for use in operator-in-the-loop real-time test and/or training environments.

• Develop and integrate weather environment models and the effect of weather on entities, weapons, communications, and sensors.

• Develop Battlespace simulation operation and visualization graphical user interfaces.

• Support and operate multi-site mission level simulation exercises.

• Test, analyze, evaluate, and report on Battlespace simulation software, models, and test events.

• Integrate and interface with third party models, systems, and servers.

Battlespace Environment Modeling efforts contribute to the development of multiple products, including but not limited to:

• NGTS

• WSCE

• GRID

3.3.1.2 Multi-Domain Systems Modeling

Perform research, design, development, integration, and testing of simulation models of air platforms, surface platforms, ground platforms, subsurface platforms, sensor systems, communications systems, datalinks, identification systems, and weapons systems. Tasks include, but are not limited to:

• Develop Battlespace simulation entity models through independent research and analysis of data from sources such as the Electronic Warfare Integrated Reprogramming Database (EWIRDB).

• Research, develop, test, and evaluate mission system models for Electronic Warfare Systems, Sensor Fusion, Countermeasures Effectiveness, Software Validation, Interoperability of System/ Subsystem/Components, Workload Measurement, and Flight Test Refinement.

• Software modeling for models of remote sensing devices, such as Radar, Forward-Looking Infrared (FLIR), Electro-Optical (EO), Synthetic Aperture Radar (SAR), Inverse Synthetic Aperture Radar (ISAR), Radio Frequency (RF) sensors, and Infrared (IR) sensors.

• Software modeling for munitions models, such as missiles, bombs, bullets, and countermeasures. To include modeling of sub-components, such as seekers as applicable.

• Model development, modification, and integration into a battlespace environment.

• Integrate and interface with third party models, systems, and servers.

• Support interfacing, stimulating, and testing of aircraft avionics and mission systems.

• Model testing, evaluation, analysis, and reporting.

• Support of test events.

• Develop operator physical and graphical user interfaces.

Multi-Domain Systems Modeling efforts contribute to the development of multiple products, including but not limited to:

• NGTS

• WSCE

3.3.1.3 Simulation Systems Software Development

Perform design, development, modification, integration, interfacing, testing, operation, and maintenance of simulation systems. Tasks include, but are not limited to:

• Develop and integrate software interfaces for simulation systems, including distributed simulation interfaces such as DIS, HLA, and TENA.

• Develop software to establish connectivity and interoperability between Battlespace Division systems and facilities and other live, virtual, and constructive systems, labs, ranges, and facilities.

• Develop and maintain Battlespace simulation interfaces, including JSE GSI.

• Develop and maintain interfaces with simulation hardware systems including image generators, visual display systems, aural cueing systems, shared memory systems, operator stations, control executives, and runtime tools.

• Develop and maintain software to deploy, interface, operate, monitor, and test simulation and stimulation systems, such as simulation operator software, control executives, and runtime tools.

• Develop and maintain software and interfaces for…