Exhibit A

CONTRACT DATA REQUIREMENTS LIST (CDRL)

(1 Data Item) Form Approved

OMB No. 0704-0188

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the Government Issuing Contracting Officer for the Contract/PR No. listed in Block E.

17. PRICE GROUP

18. ESTIMATED

TOTAL PRICE

NAVAIR CLAUSE 5252.242-9517

AIR-6.7 PJM

1. BLK 4: REPORT TO PROVIDE DETAILED PROJECT STATUS, SCHEDULE, AND COST FOR EACH ACTIVE TASK ORDER.

2. BLKs 11/12/13: SUBMISSIONS SHALL BE due nlt the 10th of the month, starting the second month, through the end of the contract.

3. BLK 14: sUBMISSIONs SHALL BE in microsoft office (word) 2007 or later. distribution shall be done electronically via email.

ADDITIONAL DISTRIBUTION ADDRESSEES MAY BE DEFINED IN INDIVIDUAL TASK ORDERS.

4. the government shall have 14 days for review and acceptance/rejection of each submission.

5. contractor incorporation of government comments shall be due within 7 days of receipt of comments.

COR

AIR-2.5.3.3.2 PCO

DD FORM 1423-1, FEB 2001

PREVIOUS EDITION MAY BE USED

Page 1 of 1 Pages

CONTRACT DATA REQUIREMENTS LIST (CDRL)

(1 Data Item) Form Approved

OMB No. 0704-0188

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the Government Issuing Contracting Officer for the Contract/PR No. listed in Block E.

17. PRICE GROUP

18. ESTIMATED

TOTAL PRICE

DI-MGMT-80934A

AIR-6.7 PJM

A

SEE BLK 16

1. BLK 12: FIRST SUBMISSION SHALL BE PROVIDED TWO (2) MONTHS AFTER CONTRACT AWARD.

2. BLK 13: SUBSEQUENT SUMISSIONS (REVISIONS) SHALL BE DUE THROUGH THE END OF THE CONTRACT IAW THE PBSOW.

3. BLK 14: SUBMISSION SHALL BE MADE IN MICROSOF OFFICE (WORD) 2003 OR LATER AND SHALL BE ON CD-ROM.

4. ANNEX TO EXHIBIT A002 APPLIES.

5. THE OPSEC PLAN SHALL BE IN CONTRACTOR FORMAT.

6. THE GOVERNMENT SHALL HAVE 30 DAYS FOR REVIEW AND ACCEPTANCE/REJECTION OF EACH SUBMISSION.

7. CONTRACTOR INCORPORATION OF GOVERNMENT COMMENTS SHALL BE DUE WITHIN 30 DAYS OF RECEIPT OF COMMENTS.

NAWCTSD SMGR

COR

DD FORM 1423-1, FEB 2001

PREVIOUS EDITION MAY BE USED

Page 1 of 1 Pages

ANNEX TO EXHIBIT A002

The Operations Security (OPSEC) Plan format and content shall be in accordance with the following:

a. The OPSEC Plan shall be marked “FOR OFFICIAL USE ONLY,” with “Exemption Category b(2)” specified in accordance with SECNAVINST 5720.42F, Enclosure (4), DoN Freedom of Information Act (FOIA) Program.

b. The OPSEC Plan shall specify control, destruction, transmission, dissemination, storage, and/or marking requirements for sensitive unclassified information, (as defined in the Computer Security Act of 1987, including “FOR OFFICIAL USE ONLY (FOUO)” information).

c. The OPSEC Plan shall specify how the transmission of privacy data, intellectual property, and acquisition related information, will meet the requirements of Federal Information Processing Standard (FIPS) 140-2 compliant protection.

d. The OPSEC Plan shall specify how public releases will be approved prior to release.

e. The OPSEC Plan shall define specific “Critical Information,” rather than Essential Elements of Friendly Information (EEFI), to determine what data requires protection. Care shall be taken when compiling a list of “Critical Information”, as this is much broader than an EEFI list. Also, a listing of EEFI, a subset of critical information that is limited to “counter, kill, or clone” data, may be classified.

f. The OPSEC Plan shall address the use of Distribution Statements on technical documents within the OPSEC Plan, as required by Exhibit 8A of SECNAVINST 5510.36.

g. The OPSEC Plan shall delineate graphic arts support for sensitive unclassified and/or FOUO program information. The OPSEC plan shall delineate how graphic arts support will be provided, and how graphics products are produced, handled, used, stored, and transmitted. (This requirement focuses on materials prepared by program personnel for conferences, briefings, trade shows, and/or expositions.)

h. If applicable, the OPSEC Plan shall specify how the approval for use of deception activities will be coordinated through AIR-7.4.4 to CNO.

i. The OPSEC Plan shall specify how foreign travel briefs required for employees traveling to foreign countries will be provided. The processes and procedures for foreign travel briefs and foreign national involvement in the program shall be clearly specified.

j. The OPSEC Plan shall contain an overview of all activities, operations, tests to be undertaken in performance of the contract; identify those in which classified/ critical program information will manifest itself; determine how, where, when the classified/critical program information is embodied in the hardware, software, or operations; determine what type access (visual, physical possession, audio, etc.) permits knowledge of the classified/critical program information.

k. The OPSEC Plan shall contain the threats deemed applicable to the specific contract activities.

l. The OPSEC Plan shall contain vulnerabilities derived by comparing threat to sensitive activities to determine which sensitive activities the adversary can exploit.

m. The OPSEC Plan shall include, for each vulnerability, the protective counter-measures deemed appropriate to mitigate the potential damage to the project.