Attachment

Attachment 1

SOW 110023

4 February 2011 ii

Table of Contents

Paragraph Title Page

1. SCOPE

1.1 Goals and Objectives

1.2 Background

1.3 Method of Tasking

1.3.1 SOW Approach

1.3.2 SOO Approach

1.4 Guidelines for Defining Work Complexity

2. APPLICABLE DOCUMENTS

2.1 Government Documents

2.2 Non-Government Documents

3. GENERAL REQUIREMENTS

3.1 General Requirements

3.1.1 Program Management

3.1.1.1 Program Planning

3.1.1.1.1 Life Cycle Model Management

3.1.1.1.2 Infrastructure Management

3.1.1.1.3 Program Assessment and Control

3.1.1.1.4 Program Decision Management

3.1.1.1.5 Development of a Contract Work Breakdown Structure (CWBS)

3.1.1.1.6 Work Planning and Scheduling

3.1.1.2 Integrated Product Teams (IPTs)

3.1.1.3 Risk Management

3.1.1.4 Quality Management

3.1.1.4.1 Use of Contractor’s Inspection Equipment

3.1.1.5 Configuration Management (CM)

3.1.1.5.1 Change Management

3.1.1.5.2 Configuration Status Accounting

3.1.1.5.3 Configuration Audits

3.1.1.5.4 Data Library

3.1.1.6 Information Management

3.1.1.6.1 Infoshare Website

3.1.1.6.2 Government/Industry Data Exchange Program (GIDEP)

3.1.1.7 Program Measurement

3.1.1.7.1 Integrated Performance Management System

3.1.2 Security

3.1.2.1 Security Requirements for Classified Programs

3.1.2.1.1 Operations Security (OPSEC)

3.1.2.1.2 Personnel Security - Background Check (Physical Access to and

Working on DOD Installations)

3.1.2.1.2.1 Government-Issued Personal Identification Credentials

Paragraph Title Page iii

3.1.2.1.3 Personnel Security – Background Checks (Contractor Facility)

3.1.2.1.4 Information Assurance and Personnel Security Requirements for

Accessing Government Information Technology (IT) Systems - Suitability/Positions of Public Trust

3.1.2.1.5 Unclassified Contractor–Owned Network Security

3.1.2.1.6 Information Security Requirements for Protection of Unclassified

DOD Information on Non-DOD Systems

3.1.2.2 Security Requirements for Unclassified Programs

3.1.2.2.1 Personnel Security - Background Check (Physical Access to and

Working with DOD Installations)

3.1.2.2.2 Government-Issued Personal Identification Credentials

3.1.2.2.3 Personnel Security – Background Checks (Contractor Facility)

3.1.2.2.4 Information Assurance and Personnel Security Requirements for

Accessing Government Information Technology (IT) Systems - Suitability/Positions of Public Trust

3.1.2.2.5 Unclassified Contractor-Owned Network Security

3.1.2.2.6 Information Security Requirements for Protection of Unclassified

DOD Information On Non-DOD Systems

3.1.3 Information Assurance Requirements for Navy Programs

3.1.3.1 IA Certification and Accreditation (C&A) Support

3.1.3.1.1 Platform Information Technology (PIT)

3.1.3.1.2 Non-Platform Information Technology (PIT)

3.1.3.2 Software Integrity Testing and Certification

3.1.3.3 IA Compliance

3.1.3.4 IA Vulnerability Management Program (IAVMP)

3.1.3.5 IA On-site Training

3.1.4 Information Assurance Requirements for Marine Corps Programs

3.1.4.1 Initial Defense IA Certification and Accreditation Process

(DIACAP) Meeting

3.1.4.2 IA Certification and Accreditation Support, Marine Corps

Programs

3.1.4.3 Software Integrity Testing and Certification, Marine Corps

Programs

3.1.4.4 IA Compliance, Marine Corps Programs

3.1.4.5 IA Vulnerability Management Program, Marine Corps Programs

3.1.4.6 IA On-site Training, Marine Corps Programs

3.1.5 Data Preparation and Management

3.2 Detailed Capabilities

3.2.1 Systems Engineering

3.2.2 Instructional System Development (ISD) Requirements

Paragraph Title Page iv

3.2.2.1 Functional Area 1: Analysis, Design, and Evaluation

3.2.2.1.1 Front End Analysis

3.2.2.1.2 Training Systems Requirements Analysis

3.2.2.1.3 Training System Evaluation

3.2.2.1.4 Functional Area 1 Intermediate Products

3.2.2.2 Instructional System Development (ISD) Requirements Functional

Area 2: Development, Production, and Implementation

3.2.2.2.1 Functional Area 2 Standards

3.2.2.2.2 Functional Area 2 Development, Production, and Implementation

Training Products

3.2.2.2.3 Functional Area 2 Development, Fabrication, Integration, Testing, Delivery, and Supportability of Academic Training Delivery System/Equipment

3.2.2.2.4 Functional Area 2 Academic Training System Development, Delivery and Management Software Applications

3.2.2.2.5 Functional Area 2 Learning / Training Management System Integration

3.2.2.2.6 Functional Area 2 Training System Test and Evaluation (T&E) Requirement

3.2.2.2.7 Functional Area 2 Implementation of Training Systems

3.2.2.3 Instructional System Development (ISD) Requirements Functional

Area 3: Sustainment

3.2.2.3.1 Functional Area 3 Sustainment Activities

3.2.2.3.2 Functional Area 3 Sustainment Integrated Product Teams

3.2.2.3.3 Functional Area 3 Sustainment Delivery Orders

3.2.2.3.4 Functional Area 3 Levels of Change for Sustainment

3.2.2.3.4.1 CAT 1 - Text Based Intermediate Products

3.2.2.3.4.2 CAT 2 – Digital Arts: Graphics and Text

3.2.2.3.4.3 CAT 3 – Digital Arts: Video, Audio, and Photography

3.2.2.3.4.4 CAT 4 – Design Changes

3.2.2.3.4.5 CAT 5 – Content Insertion

3.2.2.3.4.6 CAT 6 – Software and Architecture

3.2.2.3.5 Sustainment Services

v

APPENDICES

A Acronym List Appendix Title Page

B Data Items List C Academic Training Delivery System Design, Development, Fabrication, Integration, Testing, Delivery, and Support Requirements

Statement of Work For The

Training Data Products Contract (TDPC)

1.

This Statement of Work (SOW) defines the basic requirements to be performed under this TDPC Indefinite Delivery/Indefinite Quantity Contract (ID/IQC) multiple award contract. The Naval Air Warfare Center Training Systems Division (NAWCTSD) may procure a broad range of training systems and intermediate work products within the scope of this contract. The detailed requirements for the analysis, design, development, implementation, and evaluation of training systems and training system intermediate work products, will be defined in the SOW or the Statement of Objectives (SOO) for each specific Delivery Order (DO). Acronyms used throughout this SOW are defined in

SCOPE

Appendix A.

The TDPC is divided into three distinct Functional Areas. Each Functional Area has a set of possible intermediate work products that lead to the production, delivery, test, and sustainment of a training system. The three Functional Areas included in the TDPC are:

a. Analysis, design, and evaluation

b. Development, production, and implementation

c. Sustainment

1.1 The NAWCTSD goals and objectives are to acquire the capability to analyze; design; develop;

produce; modify; test; deliver; and support training and simulation products and systems. The goal of the TDPC is to award to a pool of highly qualified contractors possessing excellent business practices and technical capabilities in order to increase responsiveness and flexibility in meeting customer needs.

Goals and Objectives

1.2 NAWCTSD is tasked to procure a full range of analysis; design, development; production;

modification; test; evaluation, delivery; refurbishment; and product support of training systems for various customers. Integral to the success of each project, is the ability to complete training system acquisitions in the most efficient and timely manner possible. This multiple award ID/IQC allows for competition of individual DOs and decreases acquisition Preparation and Lead-Time (PALT), while still ensuring delivery of high quality products at a reasonable price.

ID/IQC multiple award contracts produce reasonably priced quality products through the continual application of competition and best value “trade-off” principles throughout the contract term. NAWCTSD anticipates that a majority of competitive requirements for new training systems, and sustainment of existing training systems, will be placed under this ID/IQC multiple award contract. The indefinite delivery/indefinite quantity aspect allows tasking organizations considerable leeway in utilizing this acquisition tool.

Background

1.3 Government requirements issued under the basic ID/IQC will be met through individual DOs.

Individual DOs will be issued based on two different approaches: 1) the SOW approach, and 2) the SOO approach. These two approaches are described in

Method of Tasking

1.3.1 and 1.3.2 below. DOs may be issued during any phase of a training system's life cycle to support job performance training.

Synchronous and asynchronous training systems within scope of the TDPC include, but are not limited to the following:

a. Self-paced training: Self-paced training uses a computer, as a training device, to provide individual instruction, motivation, and feedback in place of a live instructor. The self-paced instruction may be delivered from computers in a schoolhouse, at the work site, from home or from regional learning centers. Individual DOs may identify Advanced Distributed Learning (ADL), Computer-Based Instruction (CBI), Computer Based Learning (CBL), Computer Based Training (CBT), Interactive Courseware (ICW), Web Based Training (WBT), internet based learning, browser-based training, Mobile Learning (M-Learning), Intelligent Tutoring System (ITS), or correspondence training as self-paced training solutions.

b. Group-paced training: Group-paced training uses an instructor to provide instruction, motivation, and feedback to a group of students. The instructor will use a computer, as a training device, to support the instructional presentation. The instructor may be collocated or may be remote from the students. Individual DOs may identify group paced training systems as Computer-Assisted Instruction (CAI), Instructor Led Training (ILT), traditional instruction, Classroom Learning (C-Learning), teletraining, or teleconferencing.

c. Dual purpose training: This generic category of training solutions includes those technologies that may be used as either self- or group-paced training. Individual DOs may identify specific technologies as either a group-paced, self-paced, or blended solution. These training systems may include distance learning, real-time image generation, Personal Computer Simulation (PC SIM), simulation games, or Technology Based Training (TBT).

d. Blended training: Blended training solutions, include learning events that combine self-paced, group-paced, and dual purpose training solutions. Individual DOs may identify a blended training requirement as any combination of training products from paragraph “a” through “c” above, as well as Blended Learning, multi-modal training, and Electronic Learning (E-Learning) solutions.

e. Learner assessments: Learner Assessments are products required to systematically evaluate a learner's skill or knowledge level. Individual DOs may identify learner assessments as test packages, embedded questions, progress checks, self- checks, quizzes, end-of-lesson tests, end-of-phase exams, end-of-unit tests, course exam, and certification tests.

f. Performance Support Systems (PSSs): PSSs are any computer software program, or individual products that may be used by a worker to assist, support, or improve user performance. Individual DOs may identify performance support system solutions as Interactive Electronic Technical Manuals (IETM), technical publications, job aids, decision aids, checklists, Personal Digital Assistants (PDA), or Electronic Performance Support Systems (EPSS).

NOTE: The TDPC is designed to support a variety of customers, training environments, cultures, and training technology. Each customer has a defined set of terms that is common to their training environment. The TDPC basic SOW uses a generic set of terms to define the overall scope of the contract. Training terminology that is specific to a customer will be communicated at the individual DO level.

1.3.1 In instances where the Government objectives are limited and clearly defined, the Government may issue a DO based on the SOW approach. Under this approach, the Government will prepare a DO SOW containing training system product requirements. In addition to the DO SOW, the Government may include separate product performance requirements or a performance specification, when appropriate. The Government will also provide appropriate Contract Data Requirements List (CDRL) items (DD Forms 1423) and other required DO documentation to the contractor.

SOW Approach

1.3.2 Under the SOO approach, the Request for Proposals (RFP) will include a Government-prepared SOO, instead of SOW. The SOO will describe the basic, top-level objectives of the individual DO. In addition to the SOO, the Government may include separate product performance requirements or a performance specification, when appropriate. The Government may also include a set of minimum data item requirements for the DO in the form of CDRL items (DD Forms 1423). The SOO approach provides the contractor with flexibility to propose innovative approaches to satisfy the Government's requirements. The contractor's response to the SOO also demonstrates the contractor's understanding of the effort to be performed. When the DO is awarded, contractor prepared-documentation will replace the Government-prepared SOO.

SOO Approach

1.4 The TDPC ID/IQ multiple award contract is divided into two LOTS. LOT I is the Non Set- Aside portion and consists of materialized requirements which are of greater complexity and will require an open competition of the offerors qualified in the LOT I Functional Area(s). The ID/IQC MAC LOT II will be set-aside for small businesses and work that require lesser complexity in their performance requirements.

Guidelines for Defining Work Complexity

The requirements for a Delivery Order will be analyzed to determine the size, complexity, risk, schedule, and the maturity level of defined requirements. To standardize the decision process, the Government will use the following guidelines to identify the complexity level of DO tasking.

The output of this decision-making process will identify the scope of the work and recommend whether the work is best suited for LOT I (full and open competition) or LOT II (small business set-aside). Assignment of materialized requirements to LOT I or II is at the discretion of the DO Contracting Officer as noted in Section C.2 of the contract schedule. In making the determination as to which Functional Area under LOTS I or II the requirement may be solicited, the Government will consider a combination of, but not limited to, the following elements:

a. Functional Area 1 - Complex: Analysis, design, and evaluation for weapon system acquisition (pre-Milestone (MS) A through MS C) and other complex tasking that may include the following DO requirements:

(1) Functional Area 1 tasks for entire occupational structures, having multiple jobs, positions, systems, and equipment

(2) Analyses for weapon system acquisition (pre-MS A to MS C)

(3) Human engineering analyses

(4) Efforts where Subject Matter Experts (SMEs) do not exist

(5) Large scale - manpower intensive with short schedules

(6) More than one job or training site

(7) One job with multiple positions, multiple jobs with one position each, or multiple jobs with multiple positions

(8) Jobs and positions having multiple qualifications, certifications, or licenses (QCL)

(9) Multiple missions and/or courses of instruction

(10) Medium to high technical, cost and schedule risks

b. Functional Area 1 - Non Complex: Analysis, design, and evaluation for post-MS C and other non-complex tasking that may include the following DO requirements:

(1) Jobs that currently exist and are defined in the field

(2) One job, with one position

(3) One job, having one training site

(4) One level of QCL

(5) Single mission or single course of instruction

(6) Readily available SMEs in the field

(7) Small manpower requirements, with long lead times

(8) Low technical, cost and schedule risk

c. Functional Area 2 - Complex: Development, Production and Implementation of a training system that may include the following DO requirements:

(1) Weapon system acquisition (pre-MS A to MS C)

(2) Development of more than 80 hours of content

(3) Development of more than 40 hours of content having medium to high technical, cost, or schedule risk

(4) Use of proprietary or specialized software requiring special training

(5) Limited availability of personnel trained in the required software applications

(6) Data immature and not available

(7) Production of high levels of learning for knowledge (problem solving), skill

(readiness, mechanism, adaptation and origination), and attitudes (receiving, responding, valuing, competence and innovation) (Reference definitions in MIL-HDBK-29612-2A)

(8) Medium to high degree of physical and functional fidelity

(9) Simulation and simulation gaming as a strategy

(10) Large scale, manpower intensive tasks having short schedules

(11) New development of IETMs, technical publications, and integrated training and technical documentation/publications (performance support systems)

d. Functional Area 2 - Non Complex: Development, production, and implementation of a training system that may include the following DO requirements:

(1) New development for already implemented training systems (DODI 5000.02 model post-MS C, Operation and Support Acquisition Phase)

(2) Development of less than 80 hours of content having low schedule risk

(3) Use of two-dimensional and three-dimensional (2D and 3D) animations and graphics only. Has no simulation or simulation gaming requirements

(4) Simulation with low degree of physical and functional fidelity

(5) Requires production of only lower levels of learning to include knowledge (fact, rule and discrimination) and skill (perception, gross motor skills, and continuous movement) (Reference definitions in MIL-HDBK-29612-2A)

(6) Commercial Item software and hardware

(7) Data available and mature

(8) Manpower requirements small with long lead times

(9) Low technical, cost and schedule risks

(10) Development of stand-alone job aid, checklist or decision aid

e. Functional Area 3 - Complex: Sustainment of training system that may include the following DO requirements:

(1) Requires rapid Instructional Systems Development (ISD) processes to identify, analyze, design, develop, implement, evaluate, manage, track, report, plan, resource, cost, recommend, and make changes

(2) Unknown, ill defined, or ever changing requirements

(3) Unknown, ill-defined, or ever changing requirements daily impacting production workforce

(4) Unknown changes greater than known changes (Method 3 - combined sustainment method – see 3.2.2.3.3)

(5) Medium to high performance/technical risk

(6) Medium to high cost risk

(7) Medium to high schedule risk

(8) Tasks requiring an Earned Value Management System (EVMS) (greater than

$20M)

(9) Supporting technical data is immature and not readily available

(10) SMEs may not be readily available for emerging job/tactics/system changes

(11) Rapid tactics changes impacting currency of training content

(12) Problem solving, analysis, synthesis and evaluation of large amounts of technical data required to perform rapid ISD

(13) Sustaining training at multiple sites

(14) Sustaining multiple courses of instruction across a training continuum

(15) Upgrading hardware and software delivery systems to meet new policy, guidance or standards

(16) Support deployable training systems or training conducted at forward deployed/ embarked locations

(17) Update of existing IETMs, technical publications and performance support systems to meet Engineering Change Proposals (ECPs), technical directives, policy or standard operating procedure changes

f. Functional Area 3 - Non Complex: Sustainment of training systems that may include the following DO requirements:

(1) Documented list of required changes (known requirements)

(2) Production requirements fixed based on known list of changes

(3) Workforce fixed based on known list of changes

(4) Low performance/technical risks due to Government defined changes

(5) Low cost and schedule risks due to Government defined changes

(6) Technical data readily available

(7) SMEs readily available

(8) Requires defined changes to training at one site

(9) Required defined changes for one course of instruction or part of one course

2.

The following documents shall be used as guidance for execution of the TDPC ID/IQC multiple award contract and the subsequent DOs. In the event of a conflict between documents referenced below and in DO SOWs, the contents of this SOW take precedence. Nothing in this SOW, however, supersedes applicable laws and regulations, unless a specific exemption has been obtained. Additional documents may be defined in each individual DO.

APPLICABLE DOCUMENTS

2.1 The following documents form a part of this SOW to the extent specified herein.

Government Documents

Department of Defense (DOD) Specifications and Handbooks

MIL-PRF-29612B - Performance Specification Training Data Products MIL-HDBK-29612-1A - Guidance for the Acquisition of training Data Products (Part 1 of 5) MIL-HDBK-29612-2A - Instructional Systems Development/ Systems Approach to training and Education (Part 2 of 5) MIL-HDBK-29612-3A - Development of Interactive Multimedia Instruction (Part 3 of 5) MIL-HDBK-29612-4A - Glossary for Training (Part 4 of 5) MIL-HDBK-29612-5 - Advanced Distributed Learning (ADL) Products and Systems

(Part 5 of 5) NOTE: Copies are also available from the DOD Single Stock Point or from the Acquisition Streamlining and Standardization Information System (ASSIST) Web Site. Electronic copies can be downloaded from the ASSIST Web Site located at: http://www.assistdocs.com/search/search_basic.cfm

Government Regulations

29 U.S.C. 794d - Section 508 of the Rehabilitation Act – Title 29 – Labor, Chapter 16 – Vocational Rehabilitation And Other Rehabilitation Services, Section 794d – Electronic and Information Technology

(United States Code is downloadable from http://uscode.house.gov/search/criteria.shtml) http://www.assistdocs.com/search/search_basic.cfm� http://uscode.house.gov/search/criteria.shtml�

Federal Acquisition Regulations (FAR) FAR 52.204-9 - Personal Identity Verification of Contractor Personnel FAR 52.222-54 - Employment Eligibility Verification (FAR Clauses are downloadable from http://farsite.hill.af.mil/vffara.htm)

DOD and Department of the Navy (DON) Security and Information Assurance (IA) Instructions, Manuals, Policy Memos, and Guidance Documents

DOD 5220.22-M - National Industrial Security Program Operating Manual, dated 28 Feb 2006

DODI 8500.2 - Information Assurance (IA) Implementation dated 6 February

DODI 8510.01 - DOD Information Assurance Certification and Accreditation Process (DIACAP), dated 28 Nov 2007

DON DIACAP Handbook (Unnumbered)

- DON DOD Information Assurance Certification And Accreditation Process (DIACAP) Handbook series , dated 15 July 2008

DON CIO Memo 01-09 - Department of the Navy Chief Information Officer Memorandum, Information Assurance Policy for Platform Information Technology, dated 30 Jan 2009

Enclosure (2) of DON CIO Memo 01-09

- DON Platform IT Information Assurance Guidance

(The above IA documents are available at http://nawctsd.navair.navy.mil/Resources/Library/IA/Index.cfm. The NISPOM is available at http://www.dtic.mil/whs/directives/corres/pub1.html

Code of Federal Regulations (CFR)

5 CFR, 731.202 (b) - Criteria for Making Suitability Determinations (The above regulation are available at http://www.access.gpo.gov/nara/cfr/waisidx_09/5cfr731_09.html)

22 CFR, Parts 120 - 130 - Foreign Relations, Chapter I - Department of State, Subchapter M - International Traffic in Arms Regulations

(The above regulations are available at http://www.pmddtc.state.gov/official_itar_and_amendments.htm.)

29 CFR 1910.147 - The control of hazardous energy (lockout/tagout) (OSHA standards are downloadable from http://www.osha.gov)

Other Policy and Documents

DODI 1322.26 - Development, Management, and Delivery of Distributed Learning, dated 16 Jun 2006

DODI 5000.02 - Operation of the Defense Acquisition System DOD 8552.01 - Use of Mobile Code Technologies in DOD Information Systems SECNAVINST 5720.47B - Department of The Navy Policy for Content of Publicly

Accessible World Wide Web Sites, dated 28 Dec 2005 SECNAVINST 5230.15 - Information Management/Information Technology Policy for

Fielding of Commercial Off the Shelf Software http://farsite.hill.af.mil/vffara.htm� http://nawctsd.navair.navy.mil/Resources/Library/IA/Index.cfm� http://www.dtic.mil/whs/directives/corres/pub1.html� http://www.access.gpo.gov/nara/cfr/waisidx_09/5cfr731_09.html� http://www.pmddtc.state.gov/official_itar_and_amendments.htm� http://www.osha.gov/�

Other Policy and Documents SECNAVINST 5000.36A - Department of the Navy Information Technology Application and Data Management OPNAVINST 1500.76A - Naval Training Systems Requirements, Acquisition and

Management OPNAVINST 11010.20G - Facilities Project Instruction OPNAV P-751-1-9-97 - Navy Training Requirements Documentation Manual

(NTRDM)

OPNAV P-751-2-9-97 - Training Planning Process Methodology Guide OPNAV P-751-3-9-97 - Training Planning Process Methodology Manual Unnumbered Document - Department of the Navy XML Naming and Design Rules, Final

Version 2, dated Jan 2005 NAWCTSD Acquisition Guide

- Earned Value Documentation and Guidance http://nawctsd.navair.navy.mil/Resources/Library/Acqguide/evm.

htm#2

(DOD Issuances are available at http://www.dtic.mil/whs/directives/. SECNAV and OPNAV Instructions are available at http://doni.daps.dla.mil/allinstructions.aspx) The DON XML NDR is available at http://www.doncio.navy.mil/Products.aspx?ID=604

2.2 The following documents form a part of this SOW to the extent specified herein.

Non-Government Documents

Commercial Standards American National Standards Institute (ANSI)/American Society for Quality (ASQ)

ANSI/ASQ Q9001-2008 - Quality Management Systems - Requirements (Copies of the above documents are available from www.ansi.org or Global Engineering Documents, 15 Inverness Way, East Englewood, CO 80112.)

ANSI/Electronic Industries Alliance (EIA)

ANSI/EIA 649-A 2004 - National Consensus Standard for Configuration Management ANSI/EIA-748-B - Earned Value Management System (Copies of the above document are available from www.ansi.org or Global Engineering Documents, 15 Inverness Way, East Englewood, CO 80112.)

International Organization for Standardization/International Electro-technical Commission

(ISO/IEC)

ISO/IEC 27002:2005 - Information technology - Security techniques - Code of practice for information security management (Redesignation of ISO/IEC 17799:2005)

(Copies of this document are available from http://www.ansi.org)

Institute of Electrical and Electronics Engineers (IEEE)/EIA

ANSI/IEEE Std 1008-1987 - IEEE Standard for Software Unit Testing

- IEEE Std 1233-1998 IEEE Guide for Developing System Requirements http://nawctsd.navair.navy.mil/Resources/Library/Acqguide/evm.htm� http://nawctsd.navair.navy.mil/Resources/Library/Acqguide/evm.htm� http://www.dtic.mil/whs/directives/� http://doni.daps.dla.mil/allinstructions.aspx� http://www.doncio.navy.mil/Products.aspx?ID=604� http://www.ansi.org/� http://www.ansi.org/� http://www.ansi.org/�

Institute of Electrical and Electronics Engineers (IEEE)/EIA Edition (R2002) Specifications IEEE/EIA 12207.1-1997 - Standard for Information Technology – Software Life Cycle

Process – Life Cycle Data IEEE Std 12207-2008, 2nd - Edition

Systems and Software Engineering – Software life cycle processes

IEEE Std 15288-2008, 2nd - Edition

Systems and Software Engineering – System Life Cycle Process

IEEE Std 15939-2008 - Adoption of ISO/IEC 15939:2007 - Systems and Software Engineering - Measurement Process

(Copies of this document are available from http://www.ieee.org/ or IEEE Service Center, 445 Hoes Lane, Piscataway, NJ 08854-1331.)

3.

3.1

GENERAL REQUIREMENTS

The requirements defined herein form the basis for all work performed for the Government as a part of this TDPC. The contractor shall be required to apply the Human Performance, Instructional Systems Development and Systems Engineering Models in performance of all tasks defined as within scope of the TDPC SOW. The tasks defined in this SOW blend the three models to ensure that defined and derived requirements are articulated in the form of a baseline and are capable of being traced throughout the design, development, production, test, and sustainment cycles.

General Requirements

3.1.1 When required in individual DOs, the contractor shall organize, coordinate, and control the program activities to ensure compliance with the contract requirements and the timely delivery of the required product and services. The contractor shall provide the necessary program management functions to include planning, controlling, leading, managing, resourcing, controlling, scheduling, and clerical support for the efforts as required and specified in the individual DO. The contractor shall measure, monitor, and assess the progress of the work performed and costs incurred under the contract. The contractor shall prepare the Contractor’s Progress, Status, and Management Report (CPSMR) as required and specified in the individual

DO.

Program Management

3.1.1.1 When required in individual DOs, the contractor shall define, document, manage, and apply program planning processes IAW

Program Planning

IEEE Std 12207-2008, sections 6.1.2.3.4.5, 6.3.1, and

7.1.1.3.1. The contractor shall prepare the System Engineering Management Plan (SEMP), the Life Cycle Sustainment Plan (LCSP), and Software Development Plan (SDP) as required and specified in the individual DO.

http://www.ieee.org/�

3.1.1.1.1 When required in individual DOs, the contractor shall define, document, manage, and apply life cycle model management, at the program level, IAW

Life Cycle Model Management

IEEE Std 12207-2008, section 6.2.1.

References to the organizational implementation of infrastructure management within IEEE Std 12207-2008, section 6.2.1 shall not apply.

3.1.1.1.2 When required in individual DOs, the contractor shall define, document, manage, and apply infrastructure management, at the program level, IAW

Infrastructure Management

IEEE Std 12207-2008, section 6.2.2.

References to the organizational implementation of infrastructure management within IEEE Std 12207-2008, section 6.2.2 shall not apply.

3.1.1.1.3 When required in individual DOs, the contractor shall define, document, manage, and apply program assessment and control IAW

Program Assessment and Control

IEEE Std 12207-2008, section 6.3.2.

3.1.1.1.4 When required in individual DOs, the contractor shall define, document, manage, and apply a program decision management process IAW

Program Decision Management

IEEE Std 12207-2008, section 6.3.3.

3.1.1.1.5 When required in individual DOs, the contractor shall develop, document, manage, and apply a CWBS and CWBS dictionary that define the work structures required to perform the work required by the contract. The contractor shall use the CWBS as the framework for contract planning, budgeting, and reporting of cost, schedule, and performance. A baseline program WBS shall be provided as an attachment to individual DOs. The contractor shall extend the CWBS to lower levels that represent the plan to accomplish the entire contract work scope consistent with internal organizations and processes. The contractor shall define and describe each element of the CWBS in the CWBS dictionary. The contractor shall update the CWBS and CWBS dictionary as changes occur.

Development of a Contract Work Breakdown Structure (CWBS)

3.1.1.1.6 When required in individual DOs, the contractor shall develop, document, manage, and apply a Resource Loaded Integrated Master Schedule (IMS) that presents the contractor’s and subcontractor’s plans and schedules to meet the requirements of the contract. The contractor shall develop and document a tiered scheduling system based on the CWBS elements showing the program milestones and prerequisite events, conferences, reviews, data submittals, deliveries, and resources. The contractor shall construct the IMS to ensure that the program milestones are met and to ensure that deliveries meet the requirements of the contract.

Work Planning and Scheduling

3.1.1.2 When required in individual DOs, the contractor shall define, document, implement, and maintain an IPT structure for the duration of the contract. IPT membership may consist of multi-functional stakeholders working together with a product-oriented focus. Each IPT will be

Integrated Product Teams (IPTs) empowered to make critical life cycle decisions regarding each product or process within their purview. IPTs may be applied at various levels ranging from the overall structure of an organization to informal groups functioning across existing units. With Government input, the contractor shall define and document the composition, structure, roles, and responsibilities of each IPT. Each IPT will maintain a list of membership. Each IPT will consist of Government and contractor personnel and have Government and contractor co-chairs. Each IPT will publish an agenda before each meeting. Each IPT will record and maintain meeting minutes. IPT minutes will be shared among and between the other IPTs.

3.1.1.3 When required in an individual DO, the contractor shall conduct risk management to systematically control the uncertainty in the project’s ability to meet cost, schedule, and performance requirements. The contractor shall provide the Government visibility into the contractor’s tools, assessment, mitigation, and control techniques. When required in an individual DO, the contractor shall define, document, manage, and apply a risk management process IAW

Risk Management

IEEE Std 12207-2008, section 6.3.4. The contractor shall report risk information, data, and analysis in the CPSMR cited in 3.1.1 above, as required and specified in the individual

DO.

3.1.1.4 When required in an individual DO, the contractor shall define, document, manage, and apply a quality management process IAW

Quality Management

IEEE Std 12207-2008, sections 6.2.5 and 7.2.3; and ANSI/ASQ Q9001-2008 (or equivalent quality management system) for the following activities:

a. Control of Government Furnished Property (GFP)

b. When required in an individual DO, the contractor shall perform the following tasks to control GFE as part of the quality management process:

(1) Ensure receipt of GFP

(2) Examine upon receipt, consistent with practicality, to detect damage

(3) Provide storage that precludes deterioration

(4) Examine prior to installation, consistent with practicality, to detect damage

(5) Identify and protect from improper use or disposition

(6) Verify and audit quantity periodically

(7) Report IAW the terms and conditions of the contract and the individual DO

3.1.1.4.1 When required in individual DOs, the contractor shall make measuring and testing devices available for use by the Government when required to determine conformance with contract requirements. The contractor shall provide the personnel needed to operate such devices and to verify calibration, accuracy, and condition.

Use of Contractor’s Inspection Equipment

3.1.1.5 When required in individual DOs, the contractor shall define, document, manage, and apply a CM process IAW

Configuration Management (CM)

IEEE Std 12207-2008, section 6.3.5 and 7.2.2; and ANSI/EIA 649-A 2004.

The contractor shall place Government Furnished Software (GFS), Non Developmental Items (NDI), and Commercial Item software, and each item’s associated documentation under CM upon receipt. The contractor shall place Commercial Item software items under CM as “disk image” files of the physical media.

3.1.1.5.1 When required in individual DOs, the contractor shall define, document, manage, and apply a change management process. The contractor shall use Engineering Change Proposals (ECPs) and Request for Deviations (RFDs) to request changes to an approved baseline. The contractor shall prepare the ECP and RFD as required and specified in the individual DO.

Change Management

3.1.1.5.2 When required in individual DOs, the contractor shall define, document, manage, and apply a process to accomplish configuration status accounting. The contractor shall identify and document all items incorporated into or deleted from the academic training system during development and modification. The contractor shall prepare the Training Change Request (TCR) as required and specified in the individual DO.

Configuration Status Accounting

3.1.1.5.3 When required in individual DOs, the contractor shall define, document, manage, and apply a process to accomplish configuration audits of the academic training system. The contractor shall conduct and participate in the Functional and Physical Configuration Audits (FCA and PCA), as specified in

Configuration Audits

C.8.12.4.1 and C.8.12.4.2.

3.1.1.5.4 When required in individual DOs, the contractor shall establish and maintain a data library consisting of all DO documentation, data, and information. The contractor shall develop and maintain a master listing of all contract related documentation, data, and information developed for use in the planning, analysis, design, development, production, implementation, and evaluation tasks required in the individual DO. The Data Library shall be available on the Infoshare Website developed for the individual DO.

Data Library

3.1.1.6 When required in individual DOs, the contractor shall define, document, manage, and apply an information management process IAW

Information Management

IEEE Std 12207-2008, section 6.3.6 and 7.2.1. The contractor shall include the status of technical data deliveries in the CPSMR cited above in 3.1.1 as required in the individual DO.

3.1.1.6.1 When required in individual DOs, the contractor will be provided access to a secure NAWCTSD Infoshare Website to post and retrieve contract-related documents, data, and information. The NAWCTSD Infoshare Website meets current Federal Government, Navy, and NAWCTSD Information Assurance standards. The contractor shall request the Point of Contact for the NAWCTSD Infoshare from the Government Program Manager to coordinate access to the NAWCTSD Infoshare Website. The contractor shall notify the Government Program Manager

Infoshare Website and team members, via email, when new or changed contract-related documents, data, and information are posted in the NAWCTSD Infoshare Website. Only unclassified data shall be posted in the NAWCTSD Infoshare Website.

3.1.1.6.2 When required in individual DOs, the contractor shall maintain procedures to enable participation in the GIDEP. If not a participant already, the contractor shall contact the GIDEP Help Desk by calling (951) 898-3207 or access the GIDEP Web site at http://www.gidep.org within 30 days after contract award to obtain the guidance necessary to become a GIDEP participant. The mailing address is GIDEP Operations Center, P.O. Box 8000, Corona CA 92878-8000. Compliance with this requirement shall not relieve the contractor from complying with other provisions of the contract. The contractor shall insert this requirement in subcontracts hereunder exceeding $550,000. When so inserted, the word “contractor” shall be changed to “subcontractor.”

Government/Industry Data Exchange Program (GIDEP)

3.1.1.7 When required in individual DOs, the contractor shall define, document, manage and apply a process to collect, analyze, track, and report a balanced and diverse set of measures and metrics

IAW

Program Measurement

IEEE Std 12207-2008, section 6.3.7 and IEEE Std 15939-2008. Program related measures and metrics shall reflect schedule, cost, quality, staffing, product stability, requirements volatility, and complexity information. Software specific measures and metrics related to schedule, quality, staffing, build stability, size, requirements volatility, and resource utilization shall be incorporated into the overall measurement process. The contractor shall collect and analyze the measures and metrics as specified in individual DOs. Measures and metrics data shall be tracked and analyzed over time to report trends. The contractor shall define acceptable bounding criteria associated with each metric. The contractor shall have defined and implement a corrective action process when a metric deviates from the acceptable bounding criteria.

Metrics data, analysis, and reporting shall be available via the NAWCTSD Infoshare Website (see 3.1.1.6.1) and presented at formal reviews and audits. The contractor shall report metrics data and analysis in the CPSMR cited above in 3.1.1 as required and specified in the individual

DO.

3.1.1.7.1 When required in an individual DO, the contractor shall establish, control, maintain, and apply an integrated performance management system compliant with the industry guidelines for Earned Value Management Systems (EVMS) described in

Integrated Performance Management System

ANSI/EIA-748-B for cost type contracts. The application of the EVMS shall provide for indications of contract cost and schedule performance. Earned value assessments shall also correlate with technical performance. The contractor shall monitor the progress of the work performed and costs incurred under the contract and report the contract performance and the status of contract funds.

The contractor shall prepare the Contract Performance Report (CPR) and the Contract Funds Status Report (CFSR) as required and specified in the individual DO.

3.1.2

3.1.2.1

Security

When required in an individual DO, the contractor shall safeguard classified information and meet the security requirements identified in the DD Form 254. The contractor shall enforce these safeguards throughout the life of the contract, including the transport and delivery phases.

Security Requirements for Classified Programs

3.1.2.1.1 When required in an individual DO, the contractor shall provide OPSEC protection for classified information and sensitive information. Security policy, procedures, and requirements for classified information are provided in

Operations Security (OPSEC)

DOD 5220.22-M. The contractor shall safeguard sensitive and critical program information IAW the OPSEC Plan. The contractor shall enforce these safeguards throughout the life of the contract from development through support as required and specified in the individual DO.

3.1.2.1.2

The Common Access Card (CAC) shall be the principal identity credential for supporting interoperable access to DOD installations, facilities, buildings, controlled spaces, and access to U.S. Government information systems IAW

Personnel Security - Background Check (Physical Access to and Working on DOD Installations)

FAR 52.204-9. A National Agency Check with Inquiries (NACI) or equivalent national security clearance (e.g. National Agency Check with Local Agency Checks including Credit Check (NACLC)) will be required for permanent issuance of the credential. The Government may issue the credential upon favorable return of the Federal Bureau of Investigations (FBI) fingerprint check, pending final favorable completion of the NACI or equivalent. There shall be no additional NACI or equivalent submission for an individual holding a valid national security clearance. Access to restricted areas, controlled unclassified information (sensitive information), or Government equipment by contractor personnel shall be limited to those individuals who have been determined trustworthy as a result of the favorable completion of a NACI (or equivalent) or who are under the escort of appropriately cleared personnel. Where escorting such persons is not feasible, a NACI (or equivalent) shall be conducted and favorably reviewed by the appropriate DOD component, agency, or activity prior to permitting such access. When required in an individual DO, the contractor shall use the Standard Form 85P (Questionnaire for Public Trust Positions) in order to obtain the CAC and access to controlled unclassified information.

3.1.2.1.2.1 When required in an individual DO, the contractor and subcontractor(s) (when applicable) shall account for all forms of U.S Government-provided identification credentials (CAC or U.S.

Government-issued identification badges) issued to the contractor (or their employees in connection with performance) under the contract. The contractor shall return such identification credentials to the issuing agency at the earliest of any of the circumstances listed below, unless otherwise determined by the U.S. Government. The contracting officer may delay final payment under an individual DO if the contractor or subcontractor fails to comply with these requirements.

Government-Issued Personal Identification Credentials

a. When no longer needed for contract performance

b. Upon completion of the contractor employee’s employment

c. Upon contract completion or termination

3.1.2.1.3 Contractor personnel working in the contractor’s own facilities shall undergo the company internal vetting process prior to gaining access to U.S. Government controlled unclassified information. To comply with immigration law, the contractor shall use the Employment Eligibility Verification Program (E-Verify) IAW

Personnel Security – Background Checks (Contractor Facility)

FAR 52.222-54. When required in an individual DO, the contractor shall use the Standard Form 85P (Questionnaire for Public Trust Positions) in order to gain access to U.S. Government controlled unclassified information. When required in an individual DO, the contractor shall ensure that foreign persons, as defined under section 120.16 of the International Traffic and Arms Regulation (ITAR) (22 CFR, Parts 120 - 130), are not given access to U.S. Government controlled unclassified information, sensitive information, defense articles, defense services, or technical data.

3.1.2.1.4

When required in an individual DO, the contractor shall comply with the IA and personnel security requirements for accessing U.S. Government IT systems specified in the contract.

Contractors requiring access to U.S. Government IT systems will be subject to a background check. The contractor shall review and become familiar with the suitability factors presented in

Information Assurance and Personnel Security Requirements for Accessing Government Information Technology (IT) Systems - Suitability/Positions of Public Trust

5 CFR, 731.202 (b), to use as an aid in their employee selection process. The NAWCTSD Security Office will make final determinations of suitability for individual contractors.

3.1.2.1.5 When required in an individual DO, the contractor shall take means (defense-in-depth measures) necessary to protect the confidentiality, integrity, and availability of Government controlled unclassified information in the same manner as the contractor would protect its own company proprietary information. The contractor shall manage and maintain contractor-owned unclassified IT network assets (including computer assets used for contractor Teleworkers) used to process U.S. Government controlled unclassified information (sensitive information) IAW commercial best practices, vendor-specific, or other nationally or internationally-recognized IT configuration and management standards (e.g., Center for Internet Security (CIS), Control Objectives for Information and related Technology (CobiT®), Common Criteria, National Information Assurance Program (NIAP), DOD, Defense Information Systems Agency (DISA), International Computer Security Association (ICSA), National Industrial Security Program (NISP), National Security Agency (NSA), System Administration, Networking, and Security Institute (SANS), and

Unclassified Contractor–Owned Network Security

ISO/IEC 27002:2005) as required and specified for the individual DO.

The contractor shall prevent U.S. Government controlled unclassified information from being placed or stored on peer-to-peer applications or social media applications on contractor owned networks, including Teleworker computer assets. The contractor shall manage and control networks (which contain U.S. Government controlled unclassified information) serving in a Continuity of Operations (COOP) capacity to meet the same personnel and security requirements identified in this SOW and the DD-Form-254.

3.1.2.1.6

When required in an individual DO, the contractor shall safeguard unclassified DOD information stored on non-DOD information systems to prevent the loss, misuse, and unauthorized access to or modification of this information. The contractor shall:

Information Security Requirements for Protection of Unclassified DOD Information on Non-DOD Systems

a. Not process DOD information on public computers (e.g., those available for use by the general public in kiosks or hotel business centers) or computers that do not have access control.

b. Protect information by no less than one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.

c. Sanitize media (e.g., overwrite) before external release or disposal.

d. Encrypt the information that has been identified as Controlled Unclassified Information

(CUI) when it is stored on mobile computing devices such as laptops and personal digital assistants, or removable storage media such as thumb drives and compact disks, using the best available encryption technology.

e. Limit information transfer to subcontractors or teaming partners with a need to know and a commitment to at least the same level of protection.

f. Transmit e-mail, text messages, and similar communications using technology and processes that provide the best level of privacy available, given facilities, conditions, and environment. Examples of recommended technologies or processes include closed networks, virtual private networks, public key-enabled encryption, and Transport Layer Security (TLS).

g. Encrypt organizational wireless connections and use encrypted wireless connection, where available, when traveling. When encrypted wireless is not available, encrypt application files (e.g., spreadsheet and word processing files), using no less than application-provided password protection level encryption.

h. Transmit voice and fax transmissions only when there is a reasonable assurance that access is limited to authorized recipients.

i. Not post DOD information to Web site pages that are publicly available or have access limited only by domain or…