Attachment

Attachment 1

Appendix C

STATEMENT OF WORK

FOR THE

TRAINING DATA PRODUCTS CONTRACT (TDPC)

NAVAL AIR WARFARE CENTER

TRAINING SYSTEMS DIVISION

12350 RESEARCH PARKWAY

ORLANDO, FL 32826-3275

APPROVED BY: DATE:

APPROVED BY: DATE:

APPROVED BY: DATE:

ii Table of Contents

Table of Contents

Paragraph Title Page ii

APPENDICES

Table of Contents v Statement of Work For The Training Data Products Contract (TDPC)

SCOPE

This Statement of Work (SOW) defines the basic requirements to be performed under this TDPC Indefinite Delivery/Indefinite Quantity Contract (ID/IQC) multiple award contract. The Naval Air Warfare Center Training Systems Division (NAWCTSD) may procure a broad range of training systems and intermediate work products within the scope of this contract. The detailed requirements for the analysis, design, development, implementation, and evaluation of training systems and training system intermediate work products, will be defined in the SOW or the Statement of Objectives (SOO) for each specific Delivery Order (DO). Acronyms used throughout this SOW are defined in Appendix A.

The TDPC is divided into three distinct Functional Areas. Each Functional Area has a set of possible intermediate work products that lead to the production, delivery, test, and sustainment of a training system. The three Functional Areas included in the TDPC are:

a. Analysis, design, and evaluation

b. Development, production, and implementation

c. Sustainment Goals and Objectives The NAWCTSD goals and objectives are to acquire the capability to analyze; design; develop; produce; modify; test; deliver; and support training and simulation products and systems. The goal of the TDPC is to award to a pool of highly qualified contractors possessing excellent business practices and technical capabilities in order to increase responsiveness and flexibility in meeting customer needs.

Background NAWCTSD is tasked to procure a full range of analysis; design, development; production; modification; test; evaluation, delivery; refurbishment; and product support of training systems for various customers. Integral to the success of each project, is the ability to complete training system acquisitions in the most efficient and timely manner possible. This multiple award ID/IQC allows for competition of individual DOs and decreases acquisition Preparation and Lead-Time (PALT), while still ensuring delivery of high quality products at a reasonable price. ID/IQC multiple award contracts produce reasonably priced quality products through the continual application of competition and best value “trade-off” principles throughout the contract term. NAWCTSD anticipates that a majority of competitive requirements for new training systems, and sustainment of existing training systems, will be placed under this ID/IQC multiple award contract. The indefinite delivery/indefinite quantity aspect allows tasking organizations considerable leeway in utilizing this acquisition tool.

Method of Tasking Government requirements issued under the basic ID/IQC will be met through individual DOs. Individual DOs will be issued based on two different approaches: 1) the SOW approach, and 2) the SOO approach. These two approaches are described in 1.3.1 and 1.3.2 below. DOs may be issued during any phase of a training system's life cycle to support job performance training. Synchronous and asynchronous training systems within scope of the TDPC include, but are not limited to the following:

a. Self-paced training: Self-paced training uses a computer, as a training device, to provide individual instruction, motivation, and feedback in place of a live instructor. The self-paced instruction may be delivered from computers in a schoolhouse, at the work site, from home or from regional learning centers. Individual DOs may identify Advanced Distributed Learning (ADL), Computer-Based Instruction (CBI), Computer Based Learning (CBL), Computer Based Training (CBT), Interactive Courseware (ICW), Web Based Training (WBT), internet based learning, browser-based training, Mobile Learning (M-Learning), Intelligent Tutoring System (ITS), or correspondence training as self-paced training solutions.

b. Group-paced training: Group-paced training uses an instructor to provide instruction, motivation, and feedback to a group of students. The instructor will use a computer, as a training device, to support the instructional presentation. The instructor may be collocated or may be remote from the students. Individual DOs may identify group paced training systems as Computer-Assisted Instruction (CAI), Instructor Led Training (ILT), traditional instruction, Classroom Learning (C-Learning), teletraining, or teleconferencing.

c. Dual purpose training: This generic category of training solutions includes those technologies that may be used as either self- or group-paced training. Individual DOs may identify specific technologies as either a group-paced, self-paced, or blended solution. These training systems may include distance learning, real-time image generation, Personal Computer Simulation (PC SIM), simulation games, or Technology Based Training (TBT).

d. Blended training: Blended training solutions, include learning events that combine self-paced, group-paced, and dual purpose training solutions. Individual DOs may identify a blended training requirement as any combination of training products from paragraph “a” through “c” above, as well as Blended Learning, multi-modal training, and Electronic Learning (E-Learning) solutions.

e. Learner assessments: Learner Assessments are products required to systematically evaluate a learner's skill or knowledge level. Individual DOs may identify learner assessments as test packages, embedded questions, progress checks, self- checks, quizzes, end-of-lesson tests, end-of-phase exams, end-of-unit tests, course exam, and certification tests.

f. Performance Support Systems (PSSs): PSSs are any computer software program, or individual products that may be used by a worker to assist, support, or improve user performance. Individual DOs may identify performance support system solutions as Interactive Electronic Technical Manuals (IETM), technical publications, job aids, decision aids, checklists, Personal Digital Assistants (PDA), or Electronic Performance Support Systems (EPSS).

NOTE: The TDPC is designed to support a variety of customers, training environments, cultures, and training technology. Each customer has a defined set of terms that is common to their training environment. The TDPC basic SOW uses a generic set of terms to define the overall scope of the contract. Training terminology that is specific to a customer will be communicated at the individual DO level.

SOW Approach In instances where the Government objectives are limited and clearly defined, the Government may issue a DO based on the SOW approach. Under this approach, the Government will prepare a DO SOW containing training system product requirements. In addition to the DO SOW, the Government may include separate product performance requirements or a performance specification, when appropriate. The Government will also provide appropriate Contract Data Requirements List (CDRL) items (DD Forms 1423) and other required DO documentation to the contractor.

SOO Approach Under the SOO approach, the Request for Proposals (RFP) will include a Government-prepared SOO, instead of SOW. The SOO will describe the basic, top-level objectives of the individual DO. In addition to the SOO, the Government may include separate product performance requirements or a performance specification, when appropriate. The Government may also include a set of minimum data item requirements for the DO in the form of CDRL items (DD Forms 1423). The SOO approach provides the contractor with flexibility to propose innovative approaches to satisfy the Government's requirements. The contractor's response to the SOO also demonstrates the contractor's understanding of the effort to be performed. When the DO is awarded, contractor prepared-documentation will replace the Government-prepared SOO.

Guidelines for Defining Work Complexity The TDPC ID/IQ multiple award contract is divided into two LOTS. LOT I is the Non Set-Aside portion and consists of materialized requirements which are of greater complexity and will require an open competition of the offerors qualified in the LOT I Functional Area(s). The ID/IQC MAC LOT II will be set-aside for small businesses and work that require lesser complexity in their performance requirements.

The requirements for a Delivery Order will be analyzed to determine the size, complexity, risk, schedule, and the maturity level of defined requirements. To standardize the decision process, the Government will use the following guidelines to identify the complexity level of DO tasking. The output of this decision-making process will identify the scope of the work and recommend whether the work is best suited for LOT I (full and open competition) or LOT II (small business set-aside). Assignment of materialized requirements to LOT I or II is at the discretion of the DO Contracting Officer as noted in Section C.2 of the contract schedule. In making the determination as to which Functional Area under LOTS I or II the requirement may be solicited, the Government will consider a combination of, but not limited to, the following elements:

a. Functional Area 1 - Complex: Analysis, design, and evaluation for weapon system acquisition (pre-Milestone (MS) A through MS C) and other complex tasking that may include the following DO requirements:

(1) Functional Area 1 tasks for entire occupational structures, having multiple jobs, positions, systems, and equipment

(2) Analyses for weapon system acquisition (pre-MS A to MS C)

(3) Human engineering analyses

(4) Efforts where Subject Matter Experts (SMEs) do not exist

(5) Large scale - manpower intensive with short schedules

(6) More than one job or training site

(7) One job with multiple positions, multiple jobs with one position each, or multiple jobs with multiple positions

(8) Jobs and positions having multiple qualifications, certifications, or licenses (QCL)

(9) Multiple missions and/or courses of instruction

(10) Medium to high technical, cost and schedule risks

b. Functional Area 1 - Non Complex: Analysis, design, and evaluation for post-MS C and other non-complex tasking that may include the following DO requirements:

(1) Jobs that currently exist and are defined in the field

(2) One job, with one position

(3) One job, having one training site

(4) One level of QCL

(5) Single mission or single course of instruction

(6) Readily available SMEs in the field

(7) Small manpower requirements, with long lead times

(8) Low technical, cost and schedule risk

c. Functional Area 2 - Complex: Development, Production and Implementation of a training system that may include the following DO requirements:

(1) Weapon system acquisition (pre-MS A to MS C)

(2) Development of more than 80 hours of content

(3) Development of more than 40 hours of content having medium to high technical, cost, or schedule risk

(4) Use of proprietary or specialized software requiring special training

(5) Limited availability of personnel trained in the required software applications

(6) Data immature and not available

(7) Production of high levels of learning for knowledge (problem solving), skill (readiness, mechanism, adaptation and origination), and attitudes (receiving, responding, valuing, competence and innovation) (Reference definitions in MIL-HDBK-29612-2A)

(8) Medium to high degree of physical and functional fidelity

(9) Simulation and simulation gaming as a strategy

(10) Large scale, manpower intensive tasks having short schedules

(11) New development of IETMs, technical publications, and integrated training and technical documentation/publications (performance support systems)

d. Functional Area 2 - Non Complex: Development, production, and implementation of a training system that may include the following DO requirements:

(1) New development for already implemented training systems (DODI 5000.02 model post-MS C, Operation and Support Acquisition Phase)

(2) Development of less than 80 hours of content having low schedule risk

(3) Use of two-dimensional and three-dimensional (2D and 3D) animations and graphics only. Has no simulation or simulation gaming requirements

(4) Simulation with low degree of physical and functional fidelity

(5) Requires production of only lower levels of learning to include knowledge (fact, rule and discrimination) and skill (perception, gross motor skills, and continuous movement) (Reference definitions in MIL-HDBK-29612-2A)

(6) Commercial Item software and hardware

(7) Data available and mature

(8) Manpower requirements small with long lead times

(9) Low technical, cost and schedule risks

(10) Development of stand-alone job aid, checklist or decision aid

e. Functional Area 3 - Complex: Sustainment of training system that may include the following DO requirements:

(1) Requires rapid Instructional Systems Development (ISD) processes to identify, analyze, design, develop, implement, evaluate, manage, track, report, plan, resource, cost, recommend, and make changes

(2) Unknown, ill defined, or ever changing requirements

(3) Unknown, ill-defined, or ever changing requirements daily impacting production workforce

(4) Unknown changes greater than known changes (Method 3 - combined sustainment method – see 3.2.2.3.3)

(5) Medium to high performance/technical risk

(6) Medium to high cost risk

(7) Medium to high schedule risk

(8) Tasks requiring an Earned Value Management System (EVMS) (greater than $20M)

(9) Supporting technical data is immature and not readily available

(10) SMEs may not be readily available for emerging job/tactics/system changes

(11) Rapid tactics changes impacting currency of training content

(12) Problem solving, analysis, synthesis and evaluation of large amounts of technical data required to perform rapid ISD

(13) Sustaining training at multiple sites

(14) Sustaining multiple courses of instruction across a training continuum

(15) Upgrading hardware and software delivery systems to meet new policy, guidance or standards

(16) Support deployable training systems or training conducted at forward deployed/ embarked locations

(17) Update of existing IETMs, technical publications and performance support systems to meet Engineering Change Proposals (ECPs), technical directives, policy or standard operating procedure changes

f. Functional Area 3 - Non Complex: Sustainment of training systems that may include the following DO requirements:

(1) Documented list of required changes (known requirements)

(2) Production requirements fixed based on known list of changes

(3) Workforce fixed based on known list of changes

(4) Low performance/technical risks due to Government defined changes

(5) Low cost and schedule risks due to Government defined changes

(6) Technical data readily available

(7) SMEs readily available

(8) Requires defined changes to training at one site

(9) Required defined changes for one course of instruction or part of one course

APPLICABLE DOCUMENTS

The following documents shall be used as guidance for execution of the TDPC ID/IQC multiple award contract and the subsequent DOs. In the event of a conflict between documents referenced below and in DO SOWs, the contents of this SOW take precedence. Nothing in this SOW, however, supersedes applicable laws and regulations, unless a specific exemption has been obtained. Additional documents may be defined in each individual DO.

Government Documents The following documents form a part of this SOW to the extent specified herein.

Department of Defense (DOD)

Specifications and Handbooks

NOTE: Copies are also available from the DOD Single Stock Point or from the Acquisition Streamlining and Standardization Information System (ASSIST) Web Site. Electronic copies can be downloaded from the ASSIST Web Site located at: http://www.assistdocs.com/search/search_basic.cfm

Government Regulations

(United States Code is downloadable from http://uscode.house.gov/search/criteria.shtml)

Federal Acquisition Regulations (FAR)

(FAR Clauses are downloadable from http://farsite.hill.af.mil/vffara.htm)

DOD and Department of the Navy (DON) Security and Information Assurance (IA) Instructions, Manuals, Policy Memos, and Guidance Documents

(The above IA documents are available at http://nawctsd.navair.navy.mil/Resources/Library/IA/Index.cfm. The NISPOM is available at http://www.dtic.mil/whs/directives/corres/pub1.html

Code of Federal Regulations (CFR)

(The above regulation are available at http://www.access.gpo.gov/nara/cfr/waisidx_09/5cfr731_09.html)

(The above regulations are available at http://www.pmddtc.state.gov/official_itar_and_amendments.htm.)

(OSHA standards are downloadable from http://www.osha.gov)

Other Policy and Documents

(DOD Issuances are available at http://www.dtic.mil/whs/directives/. SECNAV and OPNAV Instructions are available at http://doni.daps.dla.mil/allinstructions.aspx) The DON XML NDR is available at http://www.doncio.navy.mil/Products.aspx?ID=604

Non-Government Documents The following documents form a part of this SOW to the extent specified herein.

Commercial Standards

American National Standards Institute (ANSI)/American Society for Quality (ASQ)

(Copies of the above documents are available from www.ansi.org or Global Engineering Documents, 15 Inverness Way, East Englewood, CO 80112.)

ANSI/Electronic Industries Alliance (EIA)

(Copies of the above document are available from www.ansi.org or Global Engineering Documents, 15 Inverness Way, East Englewood, CO 80112.)

International Organization for Standardization/International Electro-technical Commission (ISO/IEC)

(Copies of this document are available from http://www.ansi.org)

Institute of Electrical and Electronics Engineers (IEEE)/EIA

(Copies of this document are available from http://www.ieee.org/ or IEEE Service Center, 445 Hoes Lane, Piscataway, NJ 08854-1331.)

GENERAL REQUIREMENTS

General Requirements The requirements defined herein form the basis for all work performed for the Government as a part of this TDPC. The contractor shall be required to apply the Human Performance, Instructional Systems Development and Systems Engineering Models in performance of all tasks defined as within scope of the TDPC SOW. The tasks defined in this SOW blend the three models to ensure that defined and derived requirements are articulated in the form of a baseline and are capable of being traced throughout the design, development, production, test, and sustainment cycles.

Program Management When required in individual DOs, the contractor shall organize, coordinate, and control the program activities to ensure compliance with the contract requirements and the timely delivery of the required product and services. The contractor shall provide the necessary program management functions to include planning, controlling, leading, managing, resourcing, controlling, scheduling, and clerical support for the efforts as required and specified in the individual DO. The contractor shall measure, monitor, and assess the progress of the work performed and costs incurred under the contract. The contractor shall prepare the Contractor’s Progress, Status, and Management Report (CPSMR) as required and specified in the individual DO.

Program Planning When required in individual DOs, the contractor shall define, document, manage, and apply program planning processes IAW IEEE Std 12207-2008, sections 6.1.2.3.4.5, 6.3.1, and 7.1.1.3.1. The contractor shall prepare the System Engineering Management Plan (SEMP), the Life Cycle Sustainment Plan (LCSP), and Software Development Plan (SDP) as required and specified in the individual DO.

Life Cycle Model Management When required in individual DOs, the contractor shall define, document, manage, and apply life cycle model management, at the program level, IAW IEEE Std 12207-2008, section 6.2.1. References to the organizational implementation of infrastructure management within IEEE Std 12207-2008, section 6.2.1 shall not apply.

Infrastructure Management When required in individual DOs, the contractor shall define, document, manage, and apply infrastructure management, at the program level, IAW IEEE Std 12207-2008, section 6.2.2. References to the organizational implementation of infrastructure management within IEEE Std 12207-2008, section 6.2.2 shall not apply.

Program Assessment and Control When required in individual DOs, the contractor shall define, document, manage, and apply program assessment and control IAW IEEE Std 12207-2008, section 6.3.2.

Program Decision Management When required in individual DOs, the contractor shall define, document, manage, and apply a program decision management process IAW IEEE Std 12207-2008, section 6.3.3.

Development of a Contract Work Breakdown Structure (CWBS) When required in individual DOs, the contractor shall develop, document, manage, and apply a CWBS and CWBS dictionary that define the work structures required to perform the work required by the contract. The contractor shall use the CWBS as the framework for contract planning, budgeting, and reporting of cost, schedule, and performance. A baseline program WBS shall be provided as an attachment to individual DOs. The contractor shall extend the CWBS to lower levels that represent the plan to accomplish the entire contract work scope consistent with internal organizations and processes. The contractor shall define and describe each element of the CWBS in the CWBS dictionary. The contractor shall update the CWBS and CWBS dictionary as changes occur.

Work Planning and Scheduling When required in individual DOs, the contractor shall develop, document, manage, and apply a Resource Loaded Integrated Master Schedule (IMS) that presents the contractor’s and subcontractor’s plans and schedules to meet the requirements of the contract. The contractor shall develop and document a tiered scheduling system based on the CWBS elements showing the program milestones and prerequisite events, conferences, reviews, data submittals, deliveries, and resources. The contractor shall construct the IMS to ensure that the program milestones are met and to ensure that deliveries meet the requirements of the contract.

Integrated Product Teams (IPTs) When required in individual DOs, the contractor shall define, document, implement, and maintain an IPT structure for the duration of the contract. IPT membership may consist of multi-functional stakeholders working together with a product-oriented focus. Each IPT will be empowered to make critical life cycle decisions regarding each product or process within their purview. IPTs may be applied at various levels ranging from the overall structure of an organization to informal groups functioning across existing units. With Government input, the contractor shall define and document the composition, structure, roles, and responsibilities of each IPT. Each IPT will maintain a list of membership. Each IPT will consist of Government and contractor personnel and have Government and contractor co-chairs. Each IPT will publish an agenda before each meeting. Each IPT will record and maintain meeting minutes. IPT minutes will be shared among and between the other IPTs.

Risk Management When required in an individual DO, the contractor shall conduct risk management to systematically control the uncertainty in the project’s ability to meet cost, schedule, and performance requirements. The contractor shall provide the Government visibility into the contractor’s tools, assessment, mitigation, and control techniques. When required in an individual DO, the contractor shall define, document, manage, and apply a risk management process IAW IEEE Std 12207-2008, section 6.3.4. The contractor shall report risk information, data, and analysis in the CPSMR cited in 3.1.1 above, as required and specified in the individual DO.

Quality Management When required in an individual DO, the contractor shall define, document, manage, and apply a quality management process IAW IEEE Std 12207-2008, sections 6.2.5 and 7.2.3; and ANSI/ASQ Q9001-2008 (or equivalent quality management system) for the following activities:

a. Control of Government Furnished Property (GFP)

b. When required in an individual DO, the contractor shall perform the following tasks to control GFE as part of the quality management process:

(1) Ensure receipt of GFP

(2) Examine upon receipt, consistent with practicality, to detect damage

(3) Provide storage that precludes deterioration

(4) Examine prior to installation, consistent with practicality, to detect damage

(5) Identify and protect from improper use or disposition

(6) Verify and audit quantity periodically

(7) Report IAW the terms and conditions of the contract and the individual DO Use of Contractor’s Inspection Equipment When required in individual DOs, the contractor shall make measuring and testing devices available for use by the Government when required to determine conformance with contract requirements. The contractor shall provide the personnel needed to operate such devices and to verify calibration, accuracy, and condition.

Configuration Management (CM) When required in individual DOs, the contractor shall define, document, manage, and apply a CM process IAW IEEE Std 12207-2008, section 6.3.5 and 7.2.2; and ANSI/EIA 649-A 2004. The contractor shall place Government Furnished Software (GFS), Non Developmental Items (NDI), and Commercial Item software, and each item’s associated documentation under CM upon receipt. The contractor shall place Commercial Item software items under CM as “disk image” files of the physical media.

Change Management When required in individual DOs, the contractor shall define, document, manage, and apply a change management process. The contractor shall use Engineering Change Proposals (ECPs) and Request for Deviations (RFDs) to request changes to an approved baseline. The contractor shall prepare the ECP and RFD as required and specified in the individual DO.

Configuration Status Accounting When required in individual DOs, the contractor shall define, document, manage, and apply a process to accomplish configuration status accounting. The contractor shall identify and document all items incorporated into or deleted from the academic training system during development and modification. The contractor shall prepare the Training Change Request (TCR) as required and specified in the individual DO.

Configuration Audits When required in individual DOs, the contractor shall define, document, manage, and apply a process to accomplish configuration audits of the academic training system. The contractor shall conduct and participate in the Functional and Physical Configuration Audits (FCA and PCA), as specified in C.8.12.4.1 and C.8.12.4.2.

Data Library When required in individual DOs, the contractor shall establish and maintain a data library consisting of all DO documentation, data, and information. The contractor shall develop and maintain a master listing of all contract related documentation, data, and information developed for use in the planning, analysis, design, development, production, implementation, and evaluation tasks required in the individual DO. The Data Library shall be available on the Infoshare Website developed for the individual DO.

Information Management When required in individual DOs, the contractor shall define, document, manage, and apply an information management process IAW IEEE Std 12207-2008, section 6.3.6 and 7.2.1. The contractor shall include the status of technical data deliveries in the CPSMR cited above in 3.1.1 as required in the individual DO.

Infoshare Website When required in individual DOs, the contractor will be provided access to a secure NAWCTSD Infoshare Website to post and retrieve contract-related documents, data, and information. The NAWCTSD Infoshare Website meets current Federal Government, Navy, and NAWCTSD Information Assurance standards. The contractor shall request the Point of Contact for the NAWCTSD Infoshare from the Government Program Manager to coordinate access to the NAWCTSD Infoshare Website. The contractor shall notify the Government Program Manager and team members, via email, when new or changed contract-related documents, data, and information are posted in the NAWCTSD Infoshare Website. Only unclassified data shall be posted in the NAWCTSD Infoshare Website.

Government/Industry Data Exchange Program (GIDEP) When required in individual DOs, the contractor shall maintain procedures to enable participation in the GIDEP. If not a participant already, the contractor shall contact the GIDEP Help Desk by calling (951) 898-3207 or access the GIDEP Web site at http://www.gidep.org within 30 days after contract award to obtain the guidance necessary to become a GIDEP participant. The mailing address is GIDEP Operations Center, P.O. Box 8000, Corona CA 92878-8000. Compliance with this requirement shall not relieve the contractor from complying with other provisions of the contract. The contractor shall insert this requirement in subcontracts hereunder exceeding $550,000. When so inserted, the word “contractor” shall be changed to “subcontractor.”

Program Measurement When required in individual DOs, the contractor shall define, document, manage and apply a process to collect, analyze, track, and report a balanced and diverse set of measures and metrics IAW IEEE Std 12207-2008, section 6.3.7 and IEEE Std 15939-2008. Program related measures and metrics shall reflect schedule, cost, quality, staffing, product stability, requirements volatility, and complexity information. Software specific measures and metrics related to schedule, quality, staffing, build stability, size, requirements volatility, and resource utilization shall be incorporated into the overall measurement process. The contractor shall collect and analyze the measures and metrics as specified in individual DOs. Measures and metrics data shall be tracked and analyzed over time to report trends. The contractor shall define acceptable bounding criteria associated with each metric. The contractor shall have defined and implement a corrective action process when a metric deviates from the acceptable bounding criteria. Metrics data, analysis, and reporting shall be available via the NAWCTSD Infoshare Website (see 3.1.1.6.1) and presented at formal reviews and audits. The contractor shall report metrics data and analysis in the CPSMR cited above in 3.1.1 as required and specified in the individual DO.

Integrated Performance Management System When required in an individual DO, the contractor shall establish, control, maintain, and apply an integrated performance management system compliant with the industry guidelines for Earned Value Management Systems (EVMS) described in ANSI/EIA-748-B for cost type contracts. The application of the EVMS shall provide for indications of contract cost and schedule performance. Earned value assessments shall also correlate with technical performance. The contractor shall monitor the progress of the work performed and costs incurred under the contract and report the contract performance and the status of contract funds. The contractor shall prepare the Contract Performance Report (CPR) and the Contract Funds Status Report (CFSR) as required and specified in the individual DO.

Security Security Requirements for Classified Programs When required in an individual DO, the contractor shall safeguard classified information and meet the security requirements identified in the DD Form 254. The contractor shall enforce these safeguards throughout the life of the contract, including the transport and delivery phases.

Operations Security (OPSEC) When required in an individual DO, the contractor shall provide OPSEC protection for classified information and sensitive information. Security policy, procedures, and requirements for classified information are provided in DOD 5220.22-M. The contractor shall safeguard sensitive and critical program information IAW the OPSEC Plan. The contractor shall enforce these safeguards throughout the life of the contract from development through support as required and specified in the individual DO.

Personnel Security - Background Check (Physical Access to and Working on DOD Installations) The Common Access Card (CAC) shall be the principal identity credential for supporting interoperable access to DOD installations, facilities, buildings, controlled spaces, and access to U.S. Government information systems IAW FAR 52.204-9. A National Agency Check with Inquiries (NACI) or equivalent national security clearance (e.g. National Agency Check with Local Agency Checks including Credit Check (NACLC)) will be required for permanent issuance of the credential. The Government may issue the credential upon favorable return of the Federal Bureau of Investigations (FBI) fingerprint check, pending final favorable completion of the NACI or equivalent. There shall be no additional NACI or equivalent submission for an individual holding a valid national security clearance. Access to restricted areas, controlled unclassified information (sensitive information), or Government equipment by contractor personnel shall be limited to those individuals who have been determined trustworthy as a result of the favorable completion of a NACI (or equivalent) or who are under the escort of appropriately cleared personnel. Where escorting such persons is not feasible, a NACI (or equivalent) shall be conducted and favorably reviewed by the appropriate DOD component, agency, or activity prior to permitting such access. When required in an individual DO, the contractor shall use the Standard Form 85P (Questionnaire for Public Trust Positions) in order to obtain the CAC and access to controlled unclassified information.

Government-Issued Personal Identification Credentials When required in an individual DO, the contractor and subcontractor(s) (when applicable) shall account for all forms of U.S Government-provided identification credentials (CAC or U.S. Government-issued identification badges) issued to the contractor (or their employees in connection with performance) under the contract. The contractor shall return such identification credentials to the issuing agency at the earliest of any of the circumstances listed below, unless otherwise determined by the U.S. Government. The contracting officer may delay final payment under an individual DO if the contractor or subcontractor fails to comply with these requirements.

a. When no longer needed for contract performance

b. Upon completion of the contractor employee’s employment

c. Upon contract completion or termination Personnel Security – Background Checks (Contractor Facility) Contractor personnel working in the contractor’s own facilities shall undergo the company internal vetting process prior to gaining access to U.S. Government controlled unclassified information. To comply with immigration law, the contractor shall use the Employment Eligibility Verification Program (E-Verify) IAW FAR 52.222-54. When required in an individual DO, the contractor shall use the Standard Form 85P (Questionnaire for Public Trust Positions) in order to gain access to U.S. Government controlled unclassified information. When required in an individual DO, the contractor shall ensure that foreign persons, as defined under section 120.16 of the International Traffic and Arms Regulation (ITAR) (22 CFR, Parts 120 - 130), are not given access to U.S. Government controlled unclassified information, sensitive information, defense articles, defense services, or technical data.

Information Assurance and Personnel Security Requirements for Accessing Government Information Technology (IT) Systems - Suitability/Positions of Public Trust When required in an individual DO, the contractor shall comply with the IA and personnel security requirements for accessing U.S. Government IT systems specified in the contract. Contractors requiring access to U.S. Government IT systems will be subject to a background check. The contractor shall review and become familiar with the suitability factors presented in 5 CFR, 731.202 (b), to use as an aid in their employee selection process. The NAWCTSD Security Office will make final determinations of suitability for individual contractors.

Unclassified Contractor–Owned Network Security When required in an individual DO, the contractor shall take means (defense-in-depth measures) necessary to protect the confidentiality, integrity, and availability of Government controlled unclassified information in the same manner as the contractor would protect its own company proprietary information. The contractor shall manage and maintain contractor-owned unclassified IT network assets (including computer assets used for contractor Teleworkers) used to process U.S. Government controlled unclassified information (sensitive information) IAW commercial best practices, vendor-specific, or other nationally or internationally-recognized IT configuration and management standards (e.g., Center for Internet Security (CIS), Control Objectives for Information and related Technology (CobiT®), Common Criteria, National Information Assurance Program (NIAP), DOD, Defense Information Systems Agency (DISA), International Computer Security Association (ICSA), National Industrial Security Program (NISP), National Security Agency (NSA), System Administration, Networking, and Security Institute (SANS), and ISO/IEC 27002:2005) as required and specified for the individual DO. The contractor shall prevent U.S. Government controlled unclassified information from being placed or stored on peer-to-peer applications or social media applications on contractor owned networks, including Teleworker computer assets. The contractor shall manage and control networks (which contain U.S. Government controlled unclassified information) serving in a Continuity of Operations (COOP) capacity to meet the same personnel and security requirements identified in this SOW and the DD-Form-254.

Information Security Requirements for Protection of Unclassified DOD Information on Non-DOD Systems When required in an individual DO, the contractor shall safeguard unclassified DOD information stored on non-DOD information systems to prevent the loss, misuse, and unauthorized access to or modification of this information. The contractor shall:

a. Not process DOD information on public computers (e.g., those available for use by the general public in kiosks or hotel business centers) or computers that do not have access control.

b. Protect information by no less than one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.

c. Sanitize media (e.g., overwrite) before external release or disposal.

d. Encrypt the information that has been identified as Controlled Unclassified Information (CUI) when it is stored on mobile computing devices such as laptops and personal digital assistants, or removable storage media such as thumb drives and compact disks, using the best available encryption technology.

e. Limit information transfer to subcontractors or teaming partners with a need to know and a commitment to at least the same level of protection.

f. Transmit e-mail, text messages, and similar communications using technology and processes that provide the best level of privacy available, given facilities, conditions, and environment. Examples of recommended technologies or processes include closed networks, virtual private networks, public key-enabled encryption, and Transport Layer Security (TLS).

g. Encrypt organizational wireless connections and use encrypted wireless connection, where available, when traveling. When encrypted wireless is not available, encrypt application files (e.g., spreadsheet and word processing files), using no less than application-provided password protection level encryption.

h. Transmit voice and fax transmissions only when there is a reasonable assurance that access is limited to authorized recipients.

i. Not post DOD information to Web site pages that are publicly available or have access limited only by domain or Internet protocol restriction. Such information may be posted to Web site pages that control access by user identification or password, user certificates, or other technical means and provide protection via use of TLS or…