N61331-14-T-5501_Attachment_4_PWS_amend082214.docx

N61331-14-T-5501 Attachment 4

PERFORMANCE WORK STATEMENT

FOR

DEFENSE COMPRESSED AIR TESTING (DCAT) PROGRAM SUPPORT

1.0 SCOPE

The Naval Surface Warfare Center, Panama City Division (NSWC-PCD) requires non-personal services to analyze breathing air for divers, damage control personnel and aviators worldwide. This Performance Work Statement (PWS) identifies the equipment and non-personal services required for analyzing breathing air in support of the Defense Compressed Air Testing (DCAT) Program. The Contractor shall furnish the manpower, facilities, equipment, transportation, and support necessary to complete the requirements of the PWS.

2.0 APPLICABLE DOCUMENTS

The following documents, of the exact issue shown, form a part of this PWS to the extent cited herein. In the event of conflict between the documents referenced and the contents of this PWS, the contents of this PWS shall take precedence. Second tier and lower reference documents (i.e., those referenced in the primary references) shall be for guidance only.

2.1 Military Standards

(a) MIL-STD-1622B(1) Cleaning of Shipboard Compressed Air Systems 15 Nov 2006

2.2 Other Documents

(a) SN NS-EN ISO 9001:2008- Quality Management Systems-Requirements (ISO 9001:2008) 01 Dec 2008 or latest revision

(b) CGA G7.1 Commodity Specification for Air 13 Oct 2011

(c) TECHAMERICA EIA -649-B- 2011 Configuration Management Standard latest revision

(d) ISO/IEC 17025- International Standards Organization-- General Requirements for the Competence of Testing and Calibration Laboratories 15 May 2005

(e) Code of Federal Regulations (CFR), 29 CFR Part 1910, Subpart I Personal Protective Equipment, Section 134 Respiratory Protection latest revision

(f) NFPA 1989- National Fire Protection Association (NFPA) Standard on Breathing Air Quality for Emergency Services Respiratory Protection, 2008

(g) NAVSEA SS521-AG-PRO-010 US Navy Diving Manual, 11 October 2008 or latest revision

(h) DOT regulations 49 CFR chapter 1, Subpart D, 173.115 class 2, Divisions 2.2 through 2.3- Definitions latest revision

3.0 REQUIREMENTS

3.1 Definitions

3.1.1 High-Pressure High Flow: System operating pressure of 250-5000 psi, with flow rates of 40-90 standard cubic feet per minute (scfm).

3.1.2 High-Pressure Low Flow: System operating pressure 400-5000 psi, with a flow rate less than 40 scfm.

3.1.3 Low-Pressure High Flow: System Operating pressure to 400 psi flow sampled at 0 to 150 scfm.

3.1.4 Sampling Kit: All equipment necessary for the field activity to obtain valid gas sample, oil mist/particulate sample, and moisture sample, for analysis at Contractor’s facility. The Sampling Kit consists of the Sampling Device and Sampling Media as well as necessary fittings, instructions, shipping labels, and transportable protective case and any other equipment necessary to obtain valid samples for analysis.

3.1.5 Sampling Device: The equipment that connects to the field activity’s source and enables gas sample, oil mist/particulate sample, and moisture sample to be obtained.

3.1.6 Sampling Media: The components which collect and hold the gas sample, oil mist/particulate sample, and moisture sample.

3.2 General

The Contractor shall coordinate with the NSWC PCD Contract Specialist to conduct a kick-off meeting within ten (10) working days after award of the contract. The Contractor shall assume responsibility for providing DCAT Program support within 14 days of contract award with no interruption and reduction in the quality and timeliness of the required breathing air analysis services.

3.2.1 The Contractor shall provide transportable Sampling Kits for collecting gas samples, oil mist/particulate samples, and moisture samples (including condensed water when applicable) from high pressure and low pressure sources as defined in Section 3.1 of this Performance Work Statement (PWS). The Sampling Kit will be used by military field activities within the continental United States (CONUS), Alaska, and Hawaii and outside the continental United States (OCONUS) to obtain mandatory samples from breathing air sources.

3.2.2 The Contractor shall provide all services for analyzing gas samples, oil mist/particulate samples, and moisture samples (including condensed water when applicable) collected by the field activity as indicated below in Section 3.4.

3.2.3 On the average, 100 individual orders from field activities are received each month, requiring 130 samples per month. One order may consist of one sample (high pressure or low pressure) or may consist of up to twenty (20) samples (combination of high pressure and low pressure). The Contractor shall plan for each Sampling Kit to be in transit for an average period of thirty (30) days, and shall maintain a sufficient supply of sampling components to allow for equipment to be in a transit state and still meet the demand of daily orders.

3.2.4 Technical effort management will be performed by the NSWC-PCD Contracting Officer's Representative or Alternate Contracting Officer’s Representative (if appointed) (COR). The COR shall schedule all air sample shipments per military field activity. Equipment shall not be shipped by the Contractor unless scheduled by the COR. The Contractor shall notify the COR in accordance with paragraph 3.5.5 below to confirm shipment of scheduled air samples.

3.2.5 The Contractor shall insure rapid response to Government needs. A Contractor primary point-of-contact (POC) shall be designated by the Contractor.

3.2.6 The Contractor shall establish approved procedures to ship or analyze a Sampling Kit during non-working hours and/or on an emergency basis. (CDRL A017)

3.3 Task 1 - Sampling Kit

3.3.1 The Contractor shall provide all equipment for collecting samples for analysis to the Government in kit form. The Sampling Kit shall be self-contained with a unique number for identification.

3.3.2 A complete sample consists of any combination of the following: (1) the gas sample, (2) an oil mist and particulate sample, (3) a moisture sample (dew point), and (4) when required, a separate condensed water test. The COR will designate which combination is required for the individual orders.

3.3.3 The Sampling Media shall be permanently integrated into the Sampling Device or shall be removable from the Sampling Device once samples are collected.

3.3.4 Each Sampling Device/Sampling Media shall be capable of taking ambient or positive pressure air samples from high-pressure and low-pressure life support air compressor stations and air storage facilities presently in use at military field activities.

3.3.5 As a minimum, ten (10) Sampling Kits shall be designed that allow for connecting and sampling within Self-Contained Breathing Apparatus (SCBA) cylinder filling containment units, where the only control devices are a filling pressure gauge and flow valve. The kits shall have a means of collecting and/or measuring gaseous components, oil mist/particulate, and moisture with the compressor system approximating normal SCBA filling rates.

3.3.6 Each Sampling Device shall be designed so that while performing sample collection, there is a positive method for the operator to know that air is passing through the sampling equipment.

3.3.7 For the oil mist/particulate sample, the air sources to be sampled have no means with which to measure volume of air pumped. The Sampling Device itself shall contain a volume measuring device/technique, and shall collect oil mist/particulate at system maximum flow and pressure. There shall be no reducer, filter, or screens upstream of the oil mist/particulate sampling device.

3.3.8 The Sampling Device shall be capable of connecting to:

(a) Standard United States manufactured SCUBA yoke, 5000 psi service.

(b) Male 9/16-18 UNF-3 threads (commonly known as oxygen fitting).

(c) 1/4 Swagelok hex nut.

(d) Male 3/8" NPT.

(e) 1/2" CPV-type, face-seal valve. Adapter fitting should be made of the following components:

(1) CPV reducing tailpiece, 1/2", O-ring face seal to 1/4-18 FNPT, P/N 53R-3-l.

(2) CPV union nut, 1 3/4-12 UN threads PN 50N-3.

(3) Adapter fitting, 1/4-18 MNPT to 1/4" JIC 37 flare, male.

(4) CGA 346 separate Adapter outlet (universal not allowed)

(5) CGA 347 separate adapter outlet (universal not allowed)

(6) reducing connector 1/2" x 1/4"

3.3.9 The Sampling Device, Sampling Media, and all other components of the Sampling Kit shall be designed with a safety factor of no less than three to one (3:1). Pressure relief mechanisms shall be incorporated in the sampling equipment design.

3.3.10 The Sampling Device and all components of the Sampling Media shall be individually marked with a part name, identification label and serial number. The Contractor shall ensure cleanliness of sampling equipment is maintained and that sampling equipment is not damaged during shipment to or from the field activity.

3.3.11 Sampling Kit design shall incorporate a tamper-proof method for positively indicating whether Sampling Media has been used or not.

3.3.12 Each Sampling Kit shall contain an easy to read, one page, wipe-off plastic, pictogram sampling instruction. The Contractor shall submit all instructions when they are created or modified for COR approval. Each Sampling Kit shall contain a data sheet for the field activity to record pertinent test/contact data such as sampling component identification, air source identity, flow rates, flow times, and POC information to enable the sample to be fully identified and analyzed. The Contractor shall submit the data sheet to the COR for approval. (CDRL A016, A018)

3.3.13 Each Sampling Kit shall contain an inventory list of all equipment. Discrepancies between shipped and received inventories shall be immediately brought to the COR’s attention.

3.3.14 Each Sampling Kit transport case shall be marked as part of the “Defense Compressed Air Testing (DCAT)” Program. The marking shall be permanent or temporary. The marking shall include the DCAT website address.

3.3.15 After the analysis is completed, the Contractor shall clean the Sampling Device, Sampling Media and other kit surfaces which come into contact with the sampling air stream, using a Government-approved cleaning procedure conforming to MIL-STD-1622B(1). (CDRL A013)

3.3.16 The Sampling Kit and all components thereof shall remain the property of the Contractor, except as stated below in paragraphs 3.3.17, 3.9, and 3.10.

3.3.17 The Government reserves the right to procure the Sampling Device and other components, to be kept on station at the field activity. The Contractor shall provide only the Sampling Media for Sampling Devices that have been procured by the Government. .

3.4 Task 2 - Analysis and Laboratory Capability

3.4.1 The laboratory performing the analysis shall be accredited in accordance with ISO/IEC 17025-International Standards Organization – General Requirements for the Competence of Testing and Calibration Laboratories dated 15 May 2005. Accreditation shall be maintained throughout the contract performance period.

3.4.2 The Contractor shall provide chemical analysis of air samples for all required testing.

3.4.3 The air sample analysis shall be conducted in accordance with the approved process procedures and work instructions which includes identity, type, make and model of equipment used to conduct said analysis. No equipment substitutions are permitted, unless approved in writing by the COR. (CDRL A010)

3.4.4 The Contractor shall provide calibration information in accordance with ISO/IEC 17025 (or equivalent standard acceptable to the Government) for all analysis equipment to be used on this contract. (CDRL A011)

3.4.5 The Contractor shall complete air sample analysis within two (2) working days of receipt of the Sampling Kit (or Sampling Media).

3.4.6 Sampling Kit in Emergency Status Condition: A Sampling Kit received by the Contractor in emergency status condition (paragraph 3.6.6), shall have all samples analyzed within two hours if the weight gain of the oil mist and particulate filter(s) is less than twice the detectable limits per the provisions of sections 6.4.8, 6.4.9, and 6.4.11 of NFPA 1989. If it is necessary to dry the filter(s) in a desiccant, all samples shall be analyzed within nine hours. The COR shall be notified of the results by telephone. The final report(s) shall be emailed or faxed to the COR when the analysis is complete. (CDRL A005)

3.4.7 Analysis Standards

3.4.7.1 The Contractor shall establish a method to determine if the Sampling Media returning from the field activity has been used. The Contractor shall also establish a method to determine if used Media has had an adequate exchange of air to yield valid results.

3.4.7.2 Gas samples, oil mist/particulate samples, moisture samples, and when required, condensed water tests from each Sampling Kit shall be analyzed in accordance with either of the below for the air purity standards, and compared with the acceptable specification limits:

(1) Air Purity Standards for Compressed Breathing Air, Chapter 4, NAVSEA SS521-AG-PRO-010 US Navy Diving Manual(15 April 2008 or latest revision)

(2) NFPA 1989

(3) CGA G7.1, Grade D with moisture (dew point -50° F)

(4) CGA G7.1, Grade E with modified moisture (dew point -50° F)

(5) CGA G7.1, Grade L with moisture (dew point -65° F) These standards exhibit the representative constituents and reporting limits that will be required by this PWS. In some cases, the specification limit may be modified by the COR for reporting purposes. The COR shall specify which standard/specification limits apply for each Sampling Kit.

3.4.7.3 The requirements for 3.4.7.2(1) are currently in revision and the proposed constituents and specification limits for the Proposed Revision Table 4-1 of the NAVSEA SS521-AG-PRO-010 US Navy Diving Manual are provided below for information purposes. When these revised standards go into effect, the Contracting Officer will notify the Contractor and the Contractor shall analyze samples in accordance with the latest revised standards.

PROPOSED REVISION Table 4- 1. U.S. Navy Diving Breathing Air Standard

Water, by dew point (°F at 1 ATM ABS) or by moisture content (ppm or mg/L)

- 65°F 24 ppm or .019 mg/L

NOTE 1: Specification is 25 ppm in methane equivalents when measured by a laboratory-based flame ionization detector (FID) calibrated with methane and methane excluded.

NOTE 2: Specification is 5 ppm in n-hexane equivalents when measured by a laboratory-based (FID) calibrated with n-hexane and methane excluded.

3.5 Task 3 - Reporting

3.5.1 The Contractor shall not place any corporate logos on any test or supporting documentation in the execution of contract requirements. Only DCAT program logos, where appropriate, shall be placed on documentation (test, reporting, etc.) during the contract period of performance.

3.5.2 For each analysis report, the Contractor shall provide the actual readings obtained during analysis along with the allowable limits for all tests conducted. The reports shall be posted to the DCAT website, and the Contractor shall supply a complete analysis report electronically when requested by the COR. (CDRL A005)

3.5.3 Failed/Incomplete Sample.

3.5.3.1 Any sample constituent that exceeds the maximum allowable limits for which it is being analyzed in accordance with the standards in paragraph 3.4.7 is deemed to have failed. Any sample taken but which resulted in inadequate exchange of air to produce valid results is deemed an incomplete sample. The Contractor shall immediately notify the COR by telephone of any failed sample or any incomplete sample constituent.

3.5.3.2 If the COR cannot be reached within two hours, the Contractor shall notify the field activity by telephone of the failed or incomplete sample.

3.5.3.3 A Notification Contact Form shall be developed by the Contractor to record direct field activity contact, to include action taken, POC information of the person contacted, date, etc. This Form shall be approved by the COR (CDRL A014). All notifications to field activities shall be documented using the approved Form.

3.5.3.4 Each analysis report of failed samples shall be marked to indicate the constituent of the sample that failed. Each analysis report shall provide an explanation of the failure. For a sample that fails the oil mist and particulate test the report shall specify the percentage content for both oil mist and particulates. Each analysis report of incomplete samples shall be marked to indicate which part of the sample was incomplete. (CDRL A005)

3.5.3.5 The final analysis report of a failed sample or incomplete sample shall be emailed to the COR immediately upon completion. (CDRL A005)

3.5.4 The Contractor shall provide and maintain a computer database of laboratory results and tracking data for trends. The Contractor shall provide computer data on electronic media quarterly to include identification of command Activity Code, make, model, and serial number of equipment sampled and actual test results. Failure of analysis shall be noted on report. Data shall be maintained for the duration of the contract. (CDRL A012)

3.5.5 The Contractor shall provide the COR with daily reports of Sampling Kits shipped and received. The Contractor shall provide the COR with monthly and end of year reports of individual field unit activity, including number of kits shipped, received, lost, with a breakdown of dollar amount per line item. The Contractor shall provide the COR a monthly accounting of all charges to Delivery Orders. Monthly accounting shall include the Delivery Order and invoice number, exact charges and balance remaining. (CDRL A001, A002, A003, A004)

3.5.6 The Contractor shall provide a list of outstanding Sampling Kits by the 15th of each month. The outstanding list shall include Sampling Kit identification number, ordering field activity, date shipped and number of days out. (CDRL A006)

3.6 Task 4 - Shipping and Transportation

3.6.1 The Contractor shall be responsible for shipment of the Sampling Kit (or Sampling Media) to various military field activities as specified in paragraph 3.2.1 of this PWS. In addition, the Contractor shall make provisions for the Sampling Kit (or Sampling Media) to be shipped back to the Contractor’s facility for analysis.

3.6.2 In accordance with the Department of Transportation (DOT) regulations in 49 CFR Chapter 1, Subpart D, section 173.115, class 2, Divisions 2.2 through 2.3 which defines “compressed gas,” the Contractor’s samples pressure shall be less than 26 psig. This requirement shall be maintained for the duration of the contract when transporting by domestic and international airlines, as well as by courier delivery service providers.

3.6.3 For routine shipping of Sampling Kits, the Contractor shall ship Kits to addresses within the CONUS, Alaska, and Hawaii via lowest cost traceable means that can guarantee no more than five (5) days delivery. CONUS, Alaska, and Hawaii shipments make up approximately 80% of the shipments. Return shipping from the field activity shall be via lowest cost traceable means that can guarantee no later than third (3rd) day delivery.

3.6.4 For routine shipping, Sampling Kits shipped to OCONUS addresses shall be shipped via lowest cost traceable, fastest delivery possible, through the Fleet Post Office (FPO) or through the Army Post Office (APO). Return shipping from OCONUS field activity shall be via the same method.

3.6.5 The Contractor will be reimbursed for actual transportation costs and handlings incurred for shipping to and return from authorized Government users. Copies of invoices or other proof of transportation costs shall be provided as back up when billing the Government for reimbursement.

3.6.6 In certain instances as identified by the COR, a Sampling Kit shall be shipped by the Contractor immediately upon notification by the COR. This Sampling Kit is considered in emergency status condition. The requested kit shall be delivered to the field activity within twenty-four (24) hours of the COR’s authorization to ship (CONUS, Alaska and Hawaii) and the fastest delivery possible OCONUS.

3.7 Task 5 - Dedicated DCAT Website

3.7.1 The Contractor shall establish, maintain and update an interactive DCAT website. As a minimum, the website shall: (1) have the capability for field activities to log in securely, place sampling kit orders, maintain a current list of all testable equipment at the field activity, and maintain all analysis reports for their activity, (2) have the capability to allow group sponsors, as identified by the COR, to log in securely to view air sampling status of their group, and (3) have a dedicated page for the COR to log in securely to authorize shipment of Sampling Kit orders. (CDRL A015)

3.7.2 All changes to the DCAT website shall be approved by the COR. The Contractor is required to maintain the security of the DCAT website. Only the DCAT program logo and program information shall be placed on the website. The Contractor shall not place any corporate logos or business information / literature on the DCAT website.

3.7.3 As analysis reports are completed, the Contractor shall be responsible for updating the DCAT website with analytical reports twice daily, NLT noon and NLT 1800 CST. (A005)

3.7.4 The Contractor shall be responsible for maintaining and monitoring the DCAT website daily to insure access is maintained. If the website goes offline, the Contractor shall restore the website to online service within 24 hours.

3.8 Task 6 - Unused Samples

A Sampling Kit is considered ‘Unused’ if no component in the Kit has been used. Unused Sampling Kits returned to the Contractor shall not be analyzed. The Contractor shall bill the Government for only the costs associated with the handling and transportation of the Sampling Kit.

3.9 Task 7 - Breakage and Loss

The Contractor shall be reimbursed for the replacement of the Contractor’s identified equipment/components due to breakage or loss. The Contractor’s List of Components for Breakage and Loss Charges Price Sheet identifies the amount the Contractor shall be reimbursed for each identified equipment/component. If the Contractor is reimbursed for lost components and those components are subsequently found and returned to the Contractor, those components shall become Government Material/Property. The Contractor shall maintain an inventory of all Government Material/Property. The Contractor shall, with the concurrence of the COR, replace any broken, missing, or lost components with Government Material/Property of equal value. The Contractor shall document each part replacement within the Contractor’s inventory database.

3.10 Task 8 - Rental Charges

The sampling kits shall be provided at no cost to the Government for a period of sixty (60) days for kits mailed to a CONUS, Alaska, or Hawaii address and ninety (90) days for kits mailed to an OCONUS address. The loan period (60 or 90 days) is computed from the day the kit is received by the Government to the day the kit is delivered to the Contractor's designated carrier for return. In the event kits are held in excess of the 60- or 90- day loan period and the Contractor bills a rental charge, the Contractor shall bill at the daily rental charge rate included in the schedule. In the event the rental charge exceeds the replacement cost of the Sampling Kit, the Government's liability will be limited to the replacement cost of the kit, and the kit shall become Government Material/Property. The Contractor shall maintain an inventory of all Government Material/Property.

4.0 QUALITY ASSURANCE REQUIREMENTS (CDRL A007)

4.1 The Contractor shall maintain an approved quality system in accordance with ISO (9001:2008) or an equivalent quality standard acceptable to the Government. The quality system shall govern processes that affect quality of hardware and associated software or manuals. A Laboratory Quality Management System accreditation approach (see Paragraph 3.4.1) equivalent to ISO/IEC 17025 shall be used to supplement the quality system documentation governing analysis methods, equipment, and standards used to execute the requirements of this statement of work. Annual performance reviews or audits will be conducted on site or through transmission of documentation at the discretion of and by the COR, in conjunction with the NSWC PCD Maritime Mission Systems Division Quality Assurance Manager. The Contractor shall submit updates to the Quality Assurance documentation at least bi-annually or more (if program requirements dictate).

4.2 The Contractor shall provide documentation as required to support periodic Government audits. The Contractor shall be notified at least 72 hours in advance for all audits. The audits shall include, but are not limited to calibration inspection, quality assurance, lab procedures, and personnel qualifications. The Contractor shall provide services for analysis of a Government control sample during the Government audits. The analysis of the control sample shall be completed within two (2) hours. Analysis of the control samples will be acceptable if the Contractor identifies all compounds within the levels required in paragraph 3.4.7.2(1) for Divers Air Purity. (CDRL A009)

4.3 The Contractor shall submit to periodic blind control samples not to exceed two (2) per year. The Government will provide blind samples that will be certified test samples from an accredited laboratory. In the event the contractor fails to accurately detect contaminants, the Contractor will be notified by the COR. Failure to detect two (2) consecutive blind samples within the requirements of paragraph 3.4.7 of the known values shall be cause for corrective action.

4.4 The Contractor shall maintain configuration control over the approved Sampling Kits. The configuration management system shall be developed in accordance with the requirements of EIA Standard 649 and submitted to the Government for review and approval to the requirements of EIA Standard 649. The Contractor shall notify the Government whenever the Contractor proposes a change in design to the approved configuration management baseline. (CDRL A008)

5.0 GOVERNMENT FURNISHED INFORMATION

Within 10 calendar days after the award of the contract, NSWC-PCD will provide the Contractor with the NAVSEA SS521-AG-PRO-010 US Navy Diving Manual, Table 4-1 and the DCAT logo to perform the contract tasking during the contract period of performance. The Contractor shall return all Government furnished information (GFI) to NSWC PCD upon completion of the task order.

6.0 Security

This requirement is UNCLASSIFIED. The Contractor will not require access to nor be required to generate or store classified information to perform this requirement.

6.1 Minimum Requirements for Access to Controlled Unclassified Information (CUI)

Prior to access, contractor personnel requiring access to DON controlled unclassified information (CUI) or "user level access to DON or DoD networks and information systems, system security and network defense systems, or to system resources providing visual access and/or ability to input, delete or otherwise manipulate sensitive information without controls to identify and deny sensitive information" Contractors must have clearance eligibility, or submit an Electronic Questionnaire for Investigation Processing (SF 86) to NSWC PCD Security for processing and subsequent adjudication by the DON Central Adjudication Facility.

6.2 Minimum Protection Requirements for Controlled Unclassified Information

Security classification guides (OPNAVINST 5513 series) and unclassified limited documents (e.g., FOUO, Distribution Statement Controlled) are not authorized for public release and, therefore, cannot be posted on a publicly accessible webserver or transmitted over the Internet unless appropriately encrypted.

6.3 Controlled Unclassified Information (CUI)

Controlled unclassified information (CUI) is official information that requires the application of controls and protective measures for a variety of reasons and has not been approved for public release, to include technical information, proprietary data, information requiring protection under the Privacy Act of 1974, and Government-developed privileged information involving the award of contracts. CUI is a categorical designation that refers to unclassified information that does not meet the standards for National Security Classification under Executive Order 13526, but is (a) pertinent to the national interest of the United States or to the important interests of entities outside the Federal Government, and (b) under law or policy requires protection from unauthorized disclosure, special handling safeguards, or prescribed limits on exchange or dissemination.

6.4 For Official Use Only (FOUO)

FOUO is a document designation, not a classification. This designation is used by Department of Defense (DoD) and a number of other federal agencies to identify information or material, which although unclassified, disclosure to the public of the information would reasonably be expected to cause a foreseeable harm to an interest protected by one or more provisions of the FOIA. This includes information that qualifies for protection pursuant to the provisions of the Privacy Act of 1974, as amended. FOUO must be marked, controlled and safeguarded in accordance with DoD 5200.01, Vol. 4, DoD Information Security Program: Controlled Unclassified Information (CUI), February 24, 2012

6.5 Security of Unclassified DoD Information on Non-DoD Information Systems (DoD 8582.01)

DoD policy: adequate security be provided for all unclassified DoD information on non-DoD information systems. Appropriate requirements shall be incorporated into all contracts, grants, and other legal agreements with non-DoD entities.

Information Safeguards are applicable to unclassified DoD information in the possession or control of non-DoD entities on non-DoD information systems, to the extent provided by the applicable contract, grant, or other legal agreement with the DoD.

Information Safeguards

Unclassified DoD information that has not been cleared for public release may be disseminated by the Contractor, grantee, or awardee to the extent required to further the contract, grant, or agreement objectives, provided that the information is disseminated within the scope of assigned duties and with a clear expectation that confidentiality will be preserved. Examples include:

a. Non-public information provided to a Contractor (e.g., with a request for proposal).

b. Information developed during the course of a contract, grant, or other legal agreement (e.g., draft documents, reports, or briefings and deliverables).

c. Privileged information contained in transactions (e.g., privileged contract information, program schedules, contract-related event tracking).

It is recognized that adequate security will vary depending on the nature and sensitivity of the information on any given non-DoD information system. However, all unclassified DoD information in the possession or control of non-DoD entities on non-DoD information systems shall minimally be safeguarded as follows:

a. Do not process unclassified DoD information on publically available computers (e.g., those available for use by the general public in kiosks or hotel business centers).

b. Protect unclassified DoD information by at least one physical or electronic barrier (e.g., locked container or room, logical authentication or logon procedure) when not under direct individual control of an authorized user.

c. At a minimum, overwrite media that have been used to process unclassified DoD information before external release or disposal.

d. Encrypt all information that has been identified as CUI when it is stored on mobile computing devices such as laptops and personal digital assistants, compact disks, or authorized removable storage media such as thumb drives and compact disks, using the best encryption technology available to the Contractor or teaming partner.

e. Limit transfer of unclassified DoD information to subcontractors or teaming partners with a need to know and obtain a commitment from them to protect the information they receive to at least the same level of protection as that specified in the contract or other written agreement.

f. Transmit e-mail, text messages, and similar communications containing unclassified DoD information using technology and processes that provide the best level of privacy available, given facilities, conditions, and environment. Examples of recommended technologies or processes include closed networks, virtual private networks, public key-enabled encryption, and transport layer security (TLS).

g. Encrypt organizational wireless connections and use encrypted wireless connections where available when traveling. If encrypted wireless is not available, encrypt document files (e.g., spreadsheet and word processing files), using at least application-provided password protected level encryption.

h. Transmit voice and fax transmissions only when there is a reasonable assurance that access is limited to authorized recipients.

i. Do not post unclassified DoD information to website pages that are publicly available or have access limited only by domain or Internet protocol restriction. Such information may be posted to website pages that control access by user identification and password, user certificates, or other technical means and provide protection via use of TLS or other equivalent technologies during transmission. Access control may be provided by the intranet (vice the website itself or the application it hosts).

j. Provide protection against computer network intrusions and data exfiltration, minimally including:

(1) Current and regularly updated malware protection services, e.g., anti-virus, anti-spyware.

(2) Monitoring and control of both inbound and outbound network traffic (e.g., at the external boundary, sub-networks, individual hosts), including blocking unauthorized ingress, egress, and exfiltration through technologies such as firewalls and router policies, intrusion prevention or detection services, and host-based security services.

(3) Prompt application of security-relevant software patches, service packs, and hot fixes.

k. Comply with other current Federal and DoD information protection and reporting requirements for specified categories of information (e.g., medical, proprietary, critical program information (CPI), personally identifiable information, export controlled) as specified in contracts, grants, and other legal agreements.

l. Report loss or unauthorized disclosure of unclassified DoD information in accordance with contract, grant, or other legal agreement requirements and mechanisms.

m. Do not use external IT services (e.g., e-mail, content hosting, database, document processing) unless they provide at least the same level of protection as that specified in the contract or other written agreement.

6.6 Operations Security

Operations Security (OPSEC) is concerned with the protection of critical information: facts about intentions, capabilities, operations, or activities that are needed by adversaries or competitors to bring about failure or unacceptable consequences of mission accomplishment.

Critical information includes information regarding:

- Operations, missions, and exercises, test schedules or locations;

- Location/movement of sensitive information, equipment, or facilities;

- Force structure and readiness (e.g., recall rosters);

- Capabilities, vulnerabilities, limitations, security weaknesses;

- Intrusions/attacks of DoD networks or information systems;

- Network (and system) user IDs and passwords;

- Movements of key personnel or visitors (itineraries, agendas, etc.); and

- Security classification of equipment, systems, operations, etc.

The Contractor, subcontractors and their personnel shall employ the following countermeasures to mitigate the susceptibility of critical information to exploitation, when applicable:

- Practice OPSEC and facilitate OPSEC awareness;

- Immediately retrieve documents from printers assessable by the public;

- Shred sensitive and Controlled Unclassified Information (CUI) documents when no longer needed;

- Protect information from personnel without a need-to-know;

- When promulgating information, limit details to that essential for legitimacy;

- During testing and evaluation, practice OPSEC methodologies of staging out of sight, desensitization, or speed of execution, whenever possible.

7.0 GOVERNMENT AND CONTRACTOR RELATIONSHIP

(a) The services to be delivered under this Task Order are non-personal services and the parties recognize and agree that no employer-employee relationship exists or will exist under the Task Order between the Government and the Contractor's personnel. It is, therefore, in the best interest of the Government to afford both parties a full understanding of their respective obligations.

(b) All Contractor, Subcontractor, and consultant personnel shall wear prominently displayed identification badges at all times when performing work on NSWC PCD property or attending meetings in the performance of this Task Order. The badge shall contain the individual's name, the company name and logo. When participating in such meetings (e.g., as a speaker, panel member), those individuals in Contractor employ must supplement physical identification (e.g., badges, place markers) with verbal announcements so that it is clear to the assembled group that they are employees of the Contractor, not NSWC PCD employees. In addition, when working on NSWC PCD property, all Contractor, Subcontractor, and consultant personnel shall have signs visible on their desks or at their work sites that clearly state that they are not NSWC PCD employees.

(c) The Contractor is responsible for supervision of all Contractor personnel assigned to this Task Order. The Contractor shall exercise ultimate control over all aspects of Contractor personnel day-to-day work under this Task Order including the assignment of work, means and manner of Contractor employee performance and the amount of Contractor supervision provided. The Contractor shall be ultimately responsible for all aspects of performance under this Task Order including the work of its Contractor personnel.

Contractor personnel under this Task Order shall not:

(1) Be placed in a position where they are under the supervision, direction, or evaluation of a Government employee.

(2) Be placed in a position of command, supervision, administration or control over Government personnel, or over personnel of other Contractors under other NSWC PCD contracts, or become a part of the Government organization.

(3) Be used in administration or supervision of Government procurement activities.

(4) Have access to proprietary information belonging to another without the express written permission of the owner of that proprietary information.

(d) Employee Relationship:

(1) The services to be performed under this Task Order do not require the Contractor or its personnel to exercise personal judgment and discretion on behalf of the Government. Rather the Contractor's personnel will act and exercise personal judgment and discretion on behalf of the Contractor.

(2) Rules, regulations, directives and requirements that are issued by the U.S. Navy and NSWC PCD under its responsibility for good order, administration, and security are applicable to all personnel who enter the Government installation or who travel on Government transportation. This is not to be construed or interpreted to establish any degree of Government control that is inconsistent with a non-personal services Task Order.

(e) Inapplicability of Employee Benefits: This Task Order does not create an employer-employee relationship. Accordingly, entitlements and benefits applicable to such relationships do not apply.

(1) Payments by the Government under this Task Order are not subject to the Federal income tax withholdings.

(2) Payments by the Government under this Task Order are not subject to the Federal Insurance Contributions Act.

(3) The Contractor is not entitled to unemployment compensation benefits under the Social Security Act, as amended, by virtue of performance of this Task Order.

(4) The Contractor is not entitled to workman's compensation benefits by virtue of this Task Order.

(5) The entire consideration and benefits to the Contractor for performance of this Task Order are contained in the provisions for payment under this Task Order.

(f) Notice. It is the Contractor's, as well as, the Government's responsibility to monitor Task Order activities and notify the Contracting Officer if the Contractor believes that the intent of this clause has been or may be violated.

(1) The Contractor should notify the Contracting Officer in writing promptly, within three (3) calendar days from the date of any incident that the Contractor considers to constitute a violation of this clause. The notice should include the date, nature, and circumstances of the conduct, the name, function and activity of each Government employee or Contractor official or employee involved or knowledgeable about such conduct, identify any documents or substance of any oral communication involved in the conduct, and the estimate in time by which the Government must respond to this notice to minimize cost, delay or disruption of performance.

(2) The Contracting Officer will promptly, within five (5) calendar days after receipt of notice, respond to the notice in writing. In responding, the Contracting Officer will either:

(i) confirm the conduct is in violation and when necessary direct the mode of further performance,

(ii) countermand any communication regarded as a violation

(iii) deny that the conduct constitutes a violation and when necessary direct the mode of further performance; or

(iv) in the event the notice is inadequate to make a decision, advise the Contractor what additional information is required, and establish the date by which it should be furnished by the Contractor and the date.

8.0 ENTERPRISE-WIDE CONTRACTOR MANPOWER REPORTING APPLICATION (ECMRA)

The Contractor shall report ALL Contractor labor hours (including Subcontractor labor hours) required for performance of services provided under this contract for NSWC PCD via a secure data collection site. The Contractor is required to completely fill in all required data fields using the following web address https://doncmra.nmci.navy.mil. Reporting inputs will be for the labor executed during the period of performance during each Government Fiscal Year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://doncmra.nmci.navy.mil.