N6134019R0075_Attch_1_LVC_SOW_dtd_22_May_18_master.docx

SOW PDX18EE01

22 May 18

SOW PDX18EE01

22 May 18

Appendix A

Acronym List (Continued)

SOW PDX18EE01

22 May 2018

STATEMENT OF WORK (SOW)

FOR THE

LIVE, VIRTUAL, CONSTRUCTIVE

INDEFINITE DELIVERY/INDEFINITE

QUANTITY CONTRACT (ID/IQC)

NAVAL AIR WARFARE CENTER

TRAINING SYSTEMS DIVISION

12211 Science Dr.

ORLANDO, FL 32826-3275

APPROVED BY: DATE:

Table of Contents

Statement of Work (SOW) Live, Virtual, Constructive (LVC) Indefinite Delivery/Indefinite Quantity Contract (ID/IQC)

SCOPE

This SOW establishes the requirements for the LVC ID/IQC.

Goals and Objectives The Naval Air Warfare Center Training Systems Division (NAWCTSD) goals and objectives are to acquire the capability to design, develop, fabricate, modify, integrate, test, and deliver LVC training and simulation systems including aircraft and surface ship representations.

Background The LVC family of training systems is built upon a common core foundation of sensor simulation and signal processing software. LVC systems also use Commercial Off-the-Shelf (COTS) hardware and Red Hat Enterprise Linux (RHEL) and Windows operating systems to emulate, simulate, and/or stimulate various naval tactical systems for training purposes. The LVC family of training systems is networked, PC-based deployable trainers designed to support integrated and coordinated Anti-Submarine Warfare (ASW) tactical training, Anti-Access Area-Denial (A2AD) and Cyber Warfare using Joint Semi-Automated Forces (JSAF) Navy Training Baseline (NTB) simulation. The current training system configuration is comprised of personal computers (PC), each PC system representing a mission training station in a particular aircraft (i.e. SH-60B, SH-60F, P-3C), Ship-board system or combat systems which, when in a networked environment, allow for integrated mission training. Some of the LVC training systems are used as training gap fillers until suitable devices can be delivered in the future. The LVC training systems run on Commercial Item PC technology. Commercial Item PC technology changes rapidly and it is not unusual for systems to become unsupportable over a period of time. When this happens, the government will have to replace the existing LVC trainer hardware with the latest PC technology and latest software in order to be information assurance (IA) compliant.

Definitions The following definitions apply to this SOW.

Commercial Item Per the Federal Acquisition Regulations, Part 2.101, “Commercial Item” means:

a. Any item, other than real property, that is of a type customarily used by the general public or by non-governmental entities for purposes other than governmental purposes, and-

(1) Has been sold, leased, or licensed to the general public; or,

(2) Has been offered for sale, lease, or license to the general public;

b. Any item that evolved from an item described in paragraph a. of this definition through advances in technology or performance and that is not yet available in the commercial marketplace, but is available in the commercial marketplace in time to satisfy the delivery requirements under a government solicitation;

c. Any item that would satisfy a criterion expressed in paragraphs a. or b. of this definition, but for-

(1) Modifications of a type customarily available in the commercial marketplace; or

(2) Minor modifications of a type not customarily available in the commercial marketplace made to meet Federal government requirements. Minor modifications mean modifications that do not significantly alter the non-governmental function or essential physical characteristics of an item or component, or change the purpose of a process. Factors to consider in determining whether a modification is minor include the value and size of the modification and the comparative value and size of the final product. Dollar values and percentages are used as guideposts, but are not conclusive evidence that a modification is minor;

d. Any combination of items meeting the requirements of paragraphs a., b., c., or e. of this definition that are of a type customarily combined and sold in combination to the general public;

e. Installation services, maintenance services, repair services, training services, and other services if-

(1) Such services are procured for support of an item referred to in paragraphs a., b., c., or d. of this definition, regardless of whether such services are provided by the same source or at the same time as the item; and

(2) The source of such services provides similar services contemporaneously to the general public under terms and conditions similar to those offered to the federal government;

f. Services of a type offered and sold competitively in substantial quantities in the commercial marketplace based on established catalog or market prices for specific tasks performed or specific outcomes to be achieved and under standard commercial terms and conditions. For purposes of these services-

(1) “Catalog price” means a price included in a catalog, price list, schedule, or other form that is regularly maintained by the manufacturer or vendor, is either published or otherwise available for inspection by customers, and states prices at which sales are currently, or were last, made to a significant number of buyers constituting the general public; and

(2) “Market prices” means current prices that are established in the course of ordinary trade between buyers and sellers free to bargain and that are substantiated through competition or from sources independent of the offerors.

g. Any item, combination of items, or service referred to in paragraphs a. through f. of this definition, notwithstanding the fact that the item, combination of items, or service is transferred between or among separate divisions, subsidiaries, or affiliates of a contractor; or

h. A Non-Developmental Item, if the procuring agency determines the item was developed exclusively at private expense and sold in substantial quantities, on a competitive basis, to multiple state and local governments.

Enhanced User/Privilege User An Authorized User (military, civilian or contractor) is one who requires detailed knowledge of Cyber IT and/or cybersecurity to support work in the development, maintenance, or operation of DON systems, including weapons, tactical, electronic and electrical services, navigation, and engineering. Enhanced Users possess advanced Cyber IT/CS knowledge and abilities centered on particular professional areas.

Initial Support Kit (ISK) The ISK includes:

a. Spares (repairable items) and repair parts that are manufactured, subcontracted, or modified by the prime contractor having the design control responsibility.

b. Spares that support vendor hardware utilized by the devices, which are procured on the open market or from established sources and for which the prime contractor is not the design activity.

c. Support items that are not an integral part of the end item, but are required to inspect, test, calibrate, service, repair, or overhaul the end item, which are manufactured, subcontracted, or modified by the prime contractor having the design control responsibility.

d. Items required for support of the trainer system (excluding common hand tools), which are procured on the open market or from established sources and for which the prime contractor is not the design activity.

Non-Developmental Item (NDI) Per the Federal Acquisition Regulations, Part 2.101, NDI means:

a. Any previously developed item of supply used exclusively for governmental purposes by a federal agency, a state or local government, or a foreign government with which the United States has a mutual defense cooperation agreement;

b. Any item described in paragraph a. of this definition that requires only Minor Modifications (see 1.3.1, c., (2)) or modifications of a type customarily available in the commercial marketplace in order to meet the requirements of the procuring department or agency; or

c. Any item of supply being produced that does not meet the requirements of paragraph a. or b., solely because the item is not yet in use.

Trainer-Peculiar Equipment (TPE) The following types of equipment are defined as TPE:

a. Trainer equipment which has not been classified by the government as a Commercial Item, Government-Furnished Equipment (GFE), NDI, or Contractor Acquired Operational Equipment (CAOE).

b. Commercial Item, NDI, GFE, or CAOE, that:

(1) Needs other than Minor Modifications (see 1.3.1, c., (2)) or modifications which are not of a type customarily available in the commercial marketplace to meet the requirements of the Delivery Order (DO), or:

(2) Does not have sufficient existing product documentation for government logistic support.

Interim Contractor Support (ICS) ICS consists of those technical and advisory services provided to the government by the prime training system contractor at the training system installation site(s) by trained engineers and technicians. ICS requirements are those needed to assist and support government maintenance personnel in operating and maintaining the training system during the initial support period. ICS may consist of the following:

a. Identification and procurement of spares and repair parts.

b. All levels of maintenance and repair including labor, material, engineering, and logistics support.

c. Trainer operation.

d. Over the shoulder training

e. Compilation of usage and performance data.

f. Maintaining inventory of spares.

APPLICABLE DOCUMENTS

The following documents of the issue listed form a part of this SOW to the extent specified herein. In the event of conflict between the documents referenced herein and the contents of this SOW, the contents of this SOW take precedence. Nothing in this SOW, however, supersedes applicable laws and regulations, unless a specific exemption has been obtained. American National Standards Institute (ANSI) information and documents are found at website http://www.ansi.org. Institute of Electrical and Electronics Engineers (IEEE) information and documents are found at website http://www.ieee.org.

Government Documents DoD Cybersecurity, Risk Management Framework for DoD IT and Department of the Navy (DoN) Instructions, Manuals, Policy Memos, and Guidance Documents

DoD 5220.22-M

National Industrial Security Program Operating (NISPOM) Manual, dated 28 Feb 2006

DODI 8510.01

Risk Management Framework for DoD IT, dated 12 MAR 2014

NIST SP 800-53r4

National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations

CNSS 1253

Committee on National Security Systems (CNSS) Instruction No. 1253, Security Categorization and Control Selection for National Security Systems, dated 27 MAR 2014

SECNAV M-5239.2

RMFPG V1.0

Navy Authorizing Official and Security Control Assessor Risk Management Framework Process Guide

The above Cybersecurity documents are available at http://www.navair.navy.mil/nawctsd/3io-cybersecurity.html.

The NISPOM is available at http://www.esd.whs.mil/DD/

Non-Government Documents Unless otherwise noted elsewhere in the document, the latest version of the listed documents shall apply.

American National Standards Institute (ANSI)/American Society for Quality Control (ASQC)

a. Quality Management and Quality Assurance Standards - Guidelines for Selection and Use

b. Quality Systems - Model for Quality Assurance in Design/Development, Production, Installation, and Servicing

c. Quality Management Systems - Guidelines for Performance Improvements

d. Quality Management and Quality System Elements

(Copies of the above documents are available from www.ansi.org or Global Engineering Documents, 15 Inverness Way, East Englewood, CO 80112.)

IEEE/Electronic Industries Association (EIA)

a. IEEE Standard for Distributed Interactive Simulation (DIS, Series 1278)

b. Industry Implementation of International Standard International Organization for Standardization/International Electro-technical Commission (ISO/IEC) 12207:1995 –

c. Standard for Information Technology - Software Life Cycle Processes

(Copies of the above documents are available from http://www.ieee.org/ or IEEE Service Center, 445 Hoes Lane, Piscataway, NJ 08854-1331.)

HLA Interface Specifications (obtainable by email to HLA@dmso.mil)

a. HLA Interface Specification Annex B: C++ API

b. HLA Interface Specification Version 1.3

c. HLA Object Model Template Specification (Version 1.3)

d. HLA Rules (Version 1.3)

REQUIREMENTS

General Requirements Under this ID/IQC, the contractor shall provide engineering disciplines required to design, develop, integrate, enhance, test, and deliver the LVC family of training systems, to include installation at the various locations. Detailed requirements and appropriate Contract Data Requirements List (CDRL) items for specific deliveries are defined in each DO that is issued under the terms and conditions of the ID/IQC.

Scope of Tasking DOs require specific research, engineering, logistics, and other efforts in support of the development of the LVC family of training systems. Tasks may consist of any combination of the typical efforts described in this SOW. Disciplines of engineering expertise required, singularly and in combination, may derive from the efforts described. These efforts shall include all or any combination of:

a. Engineering

b. Software development

c. Installation

d. Training of government personnel

e. Engineering corrections

f. Documentation preparation

g. System Test and Evaluation (T&E)

h. Logistics

i. Instructional systems analysis, design, and development

Method of Tasking Government requirements issued under the basic ID/IQC are met through individual DOs with a DO SOW containing the requirements for specific tasks. Individual DOs are issued based on the SOW approach. The SOW approach is described in 3.1.2.1 below. Each awarded DO will contain a SOW and will usually contain a NAWCTSD specification describing the specific products for that individual program requirement with respect to the performance, end item(s), delivery schedule(s), delivery address(es), performance milestones, government reviews, travel, and where applicable, end item validation. DOs are written against any portion of this SOW and are issued at any time during contract performance. Additionally, the government will include a set of data item requirements for the DO in the form of CDRL items. The contractor shall not perform any requirement until a DO setting forth the specific requirements is executed by the Procuring Contracting Officer (PCO).

SOW Approach The government will prepare a DO SOW specifying the requirements. In addition to the DO SOW, the government may include separate product performance requirements in the form of a Training System Requirements Document (TSRD) or a performance specification. The government will provide appropriate CDRL items (DD Forms 1423) and other required DO documentation to the contractor.

Deliverables The contractor shall provide with each DO the Exhibits, CDRLs (DD Form 1423s), citing the Data Item Description(s) (DIDs) for the technical data and other information. Section J of the contract “Exhibits” is a listing of data items that are required under individual DOs. This listing is for information purposes only and is subject to change based on the requirements of the individual DOs.

Program and Engineering Management The contractor shall organize, coordinate, and control all program activities to ensure compliance with the DO requirements and the timely delivery of the required product. The contractor shall provide the necessary program management, system engineering, design engineering, materials, equipment, facilities, testing and logistics necessary for requirements described in this SOW and the efforts specified in each of the DOs awarded under this ID/IQC. Program management shall include continuous monitoring of available resources, task assignments, schedule and schedule constraints, and relevant technology constraints to provide recommendations related to program goals and objectives. The contractor shall coordinate the engineering management processes via the Integrated Product Team (IPT) process, which is defined below in section 3.1.4.5. The contractor shall monitor program status in sufficient detail to permit understanding of program progress and risks with respect to achievement of planned milestones and activities, planning, costs (for Cost Plus Fixed Fee (CPFF)), the LVC training system requirements, and design (hardware and software), problem areas, and planned corrective action. The contractor shall provide status information for review during the IPT meetings. The contractor shall prepare the Contractor’s Progress, Status, and Management Report (CPSMR) in accordance with (IAW) CDRL B001 of each individual DO. For administrative efficiency, the contractor may consolidate Cross Warfare Directorate CPMSR's into a single report with subsections describing status of each individual DO.

Work Planning and Scheduling The contractor shall develop, document, implement, control, and maintain an Integrated Program Management Report (IPMR) that presents the contractor’s and subcontractor’s schedules to meet the requirements of the DO. The contractor shall develop and document a tiered scheduling system showing the program milestones and prerequisite events, conferences, reviews, data submittals, and deliveries. The contractor shall construct the IPMR to ensure that the program milestones are met and to ensure that deliveries meet the requirements of the DO. The contractor shall prepare the IPMR as specified in the individual DO IAW CDRL B005.

Risk Management The contractor shall conduct risk management to systematically control the uncertainty in the project’s ability to meet cost, schedule, and performance objectives. The contractor shall conduct that part of risk management that directly impacts the technical effort and involves risk-management preparation, risk identification, risk assessment, risk-handling option assessment, risk analysis, risk mitigation and risk control. The contractor shall provide risk management to product requirements at the program and technical reviews. The contractor shall use the contractor’s internal risk management tools to perform risk management. The contractor shall provide the government visibility into the contractor’s tools, assessment, mitigation, and control techniques. When required in an individual DO, the contractor shall define, document, manage, and apply a risk management process IAW the IEEE Std 12207-2008, section 6.3.4 or Naval System Command (SYSCOM) Risk Management Policy. The contractor shall document risk management as part of the IPMR as specified in the individual DO. The contractor shall provide a risk management planning process for this contract that identifies how key technology risks, planned risk mitigation activities, fallback options in case of insurmountable difficulty, and decision points in the program schedule are made.

Cost Reporting The contractor shall document current expenditure data for each cost plus Contract Line Item (CLIN) within a DO. The contractor shall include the cost data in the Contractor’s Progress, Status, and Management Report.

Subcontractor Management and Reporting When required in an individual DO, the contractor shall manage all subcontracts. The contractor shall ensure the timely award of subcontracts, the integration of the subcontractor's plans into appropriate schedules, and the monitoring of the subcontractor's staffing plans, to include the execution of those staffing plans to the required levels with the required skills. The contractor shall ensure that the subcontractor’s efforts, to include technical, quality, configuration management, and risk processes are accomplished per contract requirements. The contractor shall integrate subcontractor reporting into the contractor’s IPMR and specified in the individual DO. The contractor shall ensure that the subcontractors use objective criteria to measure performance. The contractor shall integrate the principal subcontractors’ IPMRs into the contractor’s scheduling system. The contractor shall include the principal subcontractors’ IPMRs in the contractor’s IPMR and specified in the individual DO IAW CDRL B005.

Integrated Product Teams The contractor shall define, document, implement, and maintain IPT structures for the duration of each DO. IPTs are the organizational structure resulting from Integrated Product Development (IPD) implementation. The purpose of an IPT is to bring together the functions that have a stake in the performance of a product or process and concurrently make integrated decisions affecting that product or process. IPT membership shall consist of multi-functional stakeholders working together with a product-oriented focus. The IPTs will consist of government and contractor personnel and have a government chair. Each IPT is empowered to make critical life cycle decisions regarding the trainer system development. IPTs are applied at various levels ranging from the overall structure of an organization to informal groups functioning across existing units. Each IPT shall prepare the required planning documents (engineering plan, master schedule, and the like) for the system element to which it is assigned; shall develop and satisfy the specifications and baselines associated with the element; and shall complete the work outlined in each DO related to the element, including the technical reviews. The contractor shall ensure this methodology includes integration of engineering specialties and management of a totally integrated effort. The contractor shall provide the members of the IPT with visibility into the integration and test planning effort. The contractor shall identify problems and potential problems that could adversely impact system performance, cost and/or delivery schedule in a timely manner, accompanied by proposed solutions. The IPT process does not relieve the contractor of accountability and responsibility to perform IAW the requirements of this contract. The IPTs listed below are established for this ID/IQC per DO. IPTs shall consist of government and contractor personnel. IPT meetings are IAW Section 3.2.2.7.4 and 3.2.3.7.4.

a. Test and Evaluation IPT (T&E IPT) - The purpose of the T&E IPT is to create a forum suitable for maintaining an interchange of test related issues and to identify and resolve potential challenge areas related to a successful new trainer or trainer modifications T&E program. The T&E IPT is formed early in the new trainer or trainer modifications development program and shall consist of selected individuals from NAWCTSD, government Subject Matter Experts (SMEs), Fleet Project Team (FPT) members, and trainer contractor technical personnel. The T&E IPT is primarily concerned with events leading up to, and including, the conformance inspections.

b. The T&E IPT and its responsibilities are identified in the Test and Evaluation Master Plan (TEMP). The contractor shall deliver the TEMP IAW CDRL A008 for each DO. T&E IPT meetings are scheduled to coincide with scheduled requirements, design, progress, and Test Readiness Review (TRR) conferences.

c. Software/Information Assurance IPT (SW/IA IPT) - The purpose of the SW/IA IPT is to review/discuss software and IA design information (including technical documentation) and software/IA related issues, including those leading to a trainer type accreditation. The SW/IA IPT shall identify and resolve potential problem areas related to the trainer software and IA.

d. Integrated Logistics Support IPT (ILS IPT) - The purpose of the ILS IPT is to review and discuss logistic unique requirements and issues. The ILS IPT shall identify and resolve potential challenge areas related to configuration management (CM), life cycle, provisioning, spares, and technical documentation requirements.

e. Synthetic Environment Database IPT (SEDB IPT) – This IPT is established by the individual DO. SEDB IPT shall also identify, discuss, and resolve database related issues.

Information Management As defined in an individual DO, the contractor shall define, document, manage, and apply an information management process IAW the applicable version of IEEE Std. 12207. The contractor shall include the status of technical data deliveries in the IPMR cited above in section 3.1.4.1.

Data Share The government and the contractor will share information and data through email exchange to post and retrieve DO-related documents, data, and information. The contractor shall notify the government team via email when new or changed DO-related documents, data, and information are available. Only unclassified data is shared and posted through email exchange.

Government/Industry Data Exchange Program (GIDEP) As defined in an individual DO, the contractor shall maintain procedures to enable participation in the GIDEP. If not a participant already, the contractor shall contact the GIDEP Help Desk by calling (951) 898-3207 or access the GIDEP website at http://www.gidep.org within 30 days after ID/IQC award to obtain the guidance necessary to become a GIDEP participant. The mailing address is GIDEP Operations Center, P.O. Box 8000, Corona CA 92878-8000. Compliance with this requirement shall not relieve the contractor from complying with other provisions of the ID/IQC and each DO. The contractor shall insert this requirement in subcontracts hereunder exceeding $500,000. When so inserted, the word “contractor” shall be changed to “subcontractor.”

Security The security requirements specified herein shall apply to the contractor and subcontractors. The contractor shall comply with applicable on-site security regulations related to government installation and facility access. The contractor and subcontractor detailed security requirements including the following are specified in each DO.

Classified Processing and Access to Classified Systems The contractor shall safeguard classified information and meet the security requirements identified in the DD Form 254. The contractor shall enforce these safeguards throughout the life of the ID/IQC including the transport and delivery phases. A single DD Form 254 will be provided against the base ID/IQC and is applicable to all DO’s, unless the use of separate DD Form 254s is otherwise specified in the SOW for individual DOs.

Operations Security (OPSEC) The contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the contractor and any subcontractor during performance of the contract. Guidelines for applying the Risk Management Framework to federal information systems to include conducting the activities of security categorization, security control selection and implementation, security control assessment, information system authorization, and security control monitoring are provided in NIST SP 800-37. This program may include Cybersecurity and Communications Security (COMSEC). The OPSEC program shall be IAW National Security Decision Directive (NSDD) 298. If the contractor does not have an established OPSEC Plan that addresses the protection of classified information, critical information, sensitive, proprietary, or controlled unclassified information, the government will provide a template for the contractor’s internal development of an OPSEC Plan. Additional OPSEC program planning guidance can be found in DI-MGMT-80934C, OPERATIONS SECURITY (OPSEC) PLAN and NAVAIR OPERATIONS SECURITY (OPSEC) REQUIREMENTS (attachment). The OPSEC program, at a minimum, shall include:

a. Assignment of responsibility for OPSEC direction and implementation.

b. Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

c. Establishment of OPSEC education and awareness training to include Basic OPSEC training, produced by the Interagency OPSEC Support Staff (IOSS), which can be found at https://www.iad.gov/ioss/department/opsec-fundamentals-course-opse1300-opse1301-opse1300e-10045.cfm (OPSE1301 OPSEC Fundamentals).

d. Provisions for management, annual review, and evaluation of OPSEC programs.

e. Flow down of OPSEC requirements to subcontractors when applicable.

The contractor shall deliver section 3.2.1.1 IAW CDRL A00B. If so directed by the CDRL requirements of individual DOs, the government may task the contractor to prepare individual OPSEC Plans.

Unclassified Contractor-Owned Network Security – Safeguarding of Unclassified Controlled Technical Information The safeguarding of Controlled Unclassified Technical Information applies to prime contractors and their subcontractors (if applicable) for information resident on or transiting through contractor unclassified information systems. The contractor shall provide security to safeguard unclassified controlled technical information on their unclassified information systems from unauthorized access and disclosure. The contractor shall take means (defense-in-depth measures) necessary to protect the confidentiality, integrity, and availability of government controlled unclassified information.

(1) The contractor shall manage and maintain contractor-owned unclassified IT network assets used to process U.S. government controlled unclassified information (sensitive information) IAW FAR 252.204-7012,

(A) The security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations,” http://dx.doi.org/10.6028/NIST.SP.800-171 that is in effect at the time the solicitation is issued or as authorized by the Contracting Officer, as soon as practical, but not later than December 31, 2017. The contractor shall notify the DoD CIO, via email at osd.dibcsia@mail.mil, within 30 days of contract award, of any security requirements specified by NIST SP 800-171 not implemented at the time of contract award; or

(B) Alternative but equally effective security measures used to compensate for the inability to satisfy a particular requirement and achieve equivalent protection accepted in writing by an authorized representative of the DoD CIO; and

(2) Apply other information systems security measures when the contractor reasonably determines that information systems security measures, in addition to those identified in paragraph (b)(1) of FAR 252.204-7012, may be required to provide adequate security in a dynamic environment based on an assessed risk or vulnerability.

The contractor shall enforce these safeguards throughout the life of the DO including the transport and delivery phases and the disposition and storage of controlled unclassified information at DO completion.

Cyber Incident and Compromise Reporting The contractor shall report to DoD certain cyber incidents that affect unclassified controlled technical information resident on or transiting contractor unclassified information systems set forth IAW FAR 252.204-7012. The contractor shall also provide the report to the NAWCTSD Contracting Officer, NAWCTSD Security Manager, and the NAWCTSD Information Systems Security Manager (ISSM).

Access to DoD Installations, Government Information, and Information Technology (IT) Systems – Personnel Security Background Checks

(1) The Common Access Card (CAC) shall be the principal identity credential for supporting interoperable access to DoD installations, facilities, buildings, controlled spaces, and access to U.S. government information systems IAW FAR 52.204-9. The contractor shall coordinate with the appropriate NAWCTSD Technical Point of Contact (TPOC), Contracting Officer Representative (COR), government sponsor, and NAWCTSD Security Office Trusted Agents for issuance of the CAC via the Trusted Associate Sponsorship System (TASS) Program. More information for obtaining the CAC can be found at http://www.cac.mil/common-access-card/getting-your-cac/for-contractors/.

(2) Contractor personnel whom do not have a security clearance, but require a CAC in performance of their sensitive duties (including access to controlled unclassified information, but not access classified information), shall coordinate with the NAWCTSD Security Office to complete a National Agency Check with Local Agency Checks including Credit Check (NACLC/TIER- 3) background investigation, which includes submission of fingerprints and the Standard Form SF-86 (Questionnaire for National Security Positions). The contractor shall submit the Standard Form 86 to the NAWCTSD Security Office for processing. There shall be no additional NACLC/TIER-3 submissions for contractors holding a valid national security clearance. The government may issue the credential upon favorable return of the Federal Bureau of Investigations (FBI) fingerprint check, pending final favorable completion of the NACLC/TIER-3.

(3) Access to restricted areas, controlled unclassified information or government information technology by contractor personnel shall be limited to those individuals who have been determined trustworthy as a result of the favorable completion of a NACLC/TIER-3 or who are under the escort of appropriately cleared personnel. Where escorting such persons is not feasible, a NACLC/TIER 3 shall be conducted and favorably reviewed by the appropriate DoD component, agency, or activity prior to permitting such access.

(4) The contractor shall comply with the Cybersecurity and personnel security requirements for accessing U.S. government IT systems specified in the contract. The contractor shall review and become familiar with the credentialing standards presented in OPM Memorandum for Issuing Personal Identity Verification cards to use as an aid in their employee selection process. The NAWCTSD Security Office will apply the credentialing standards and execute the credentialing process for individual contractors.

Personnel Security – Background Checks Contractor personnel shall undergo the company internal vetting process prior to gaining access to U.S. government controlled unclassified information. To comply with the immigration law, the contractor shall use the Employment Eligibility Verification Program (E-Verify) IAW FAR 52.222-54.

International Traffic and Arms Regulation The contractor shall ensure that foreign persons, as defined under section 120.16 of the International Traffic and Arms Regulation (ITAR) (22 CFR, Parts 120 – 130), are not given access to U.S. government controlled unclassified information, sensitive information, defense articles, defense services, or technical data, as defined in the ITAR, Part 120, without proper issuance of an export license from the U.S. government authority.

Personnel Security – Reporting of Adverse or Derogatory Information related to Contractors The contractor shall report to the NAWCTSD Security Office adverse or derogatory information pertaining to on-site CSS personnel (when applicable) or contractor personnel in direct support of this contract. Information reported to the government contracting agency shall be integrated and reported in Contractor Performance Assessment Reporting System (CPARS) on contractor performance of PERsonnel SECurity (PERSEC) related aspects of contractor performance.

a) Adverse or derogatory information reporting of contractor personnel. Example: Domestic Violence arrest or other violent or sexual crime arrest or self-report.

b) When contractor personnel receive a revocation of an Interim or denial for the issuance of a CAC until final adjudication

c) When a denial or suspension of clearance occurs for a contractor employee

d) When contractor employee receives a final denial of eligibility for a security clearance.

Government-Issued Personal Identification Credentials The contractor and subcontractor(s) (when applicable) shall account for all forms of U.S government-provided identification credentials (CAC or U.S. government-issued identification badges) issued to the contractor (or their employees in connection with performance) under the contract. The contractor shall return such identification credentials to the issuing agency at the earliest of any of the circumstances listed below, unless otherwise determined by the U.S. government. The contracting officer may delay final payment under the contract if the contractor or subcontractor fails to comply with these requirements.

a) When no longer needed for contract performance.

b) Upon completion of the contractor employee’s employment.

c) Upon contract completion or termination

Contractor “Out-processing” Policy The contractor and subcontractor(s) (when applicable) shall have in place (established and enforced ) an “out-processing” policy for employees that leave the company, including suspension of account access, return of all PCs, laptops, smartphones, and other electronic devices (government-furnished IT equipment and contractor-issued IT equipment) that contain U.S. government Controlled Unclassified Information. The contractor shall also ensure that out-processed employees receive debriefings on the need to maintain confidentiality of U.S. government Controlled Unclassified Information.

Supply Chain Risk Management (SCRM) For National Security Systems The contractor shall mitigate supply chain risk in the provision of supplies and services to the government per FAR 252.239-7018, Supply Chain Risk, and CNSSD -505, Supply Chain Risk Management (SCRM). The contractor shall, implement a process for managing supply chain risk by identifying susceptibilities, vulnerabilities, and threats throughout the supply chain and developing mitigation strategies to combat those threats whether presented by the supplier, the supplied product and its subcomponents, or the supply chain (e.g., initial production, packaging, handling, storage, transport, mission operation, and disposal.

Protection of Critical Program Information (CPI)

a. When applicable, the contractor shall identify candidate CPI and Resident CPI which requires protection IAW DoDI 5200.39. The CPI identified shall be approved by the USG Program Manager. The CPI identification shall include a review of the system, unique integration, support equipment and the Non-Resident design/process/material aspects of the program. All identified CPI shall be protected with appropriate countermeasures.

b. When applicable, the contractor shall develop a Program Protection Implementation Plan (PPIP) to include all requirements outlined in the government provided PPP. The PPIP shall be used as a focal point for the contractor’s program security efforts. The PPIP is derived from the PPP and should not restate what is written in the PPP but rather address specifically how the contractor will implement Program Protection. The contractor shall plan for and implement countermeasures which mitigate foreign intelligence collection, technology exploitation, supply chain threats, and system vulnerabilities relative to the protection of CPI, CC, and CUI.

c. When applicable, the contractor shall ensure each contractor/ sub-contractor employee supporting this contract completes contractor developed and conducted program protection awareness training in contractor format; (a) prior to performing any contract/task order work, and (b) completes annual refresher course training throughout the period of performance. This training is specific to the protection of CPI and tailored to each facility handling, storing, processing CPI.

Transmission of Controlled Unclassified Information (CUI) via email The contractor shall use approved encryption to safeguard the electronic transmission of all Controlled Unclassified Information. The contractor shall ensure that when transmitting CUI over non-secure e-mail (e.g. not connected to the Navy Marine Corps Intranet through Broadband Unclassified Remote Access System / Virtual Private network), those transmissions are encrypted using Department of Defense Public Key Infrastructure (PKI), or an approved DoD External Certificate Authority, IAW Public Key Infrastructure & Public Key Enabling, DoDI 8520.02, 24 May 2011.

Transmission of Controlled Unclassified Information (CUI) via S.A.F.E.

Safe Access File Exchange (SAFE). SAFE is designed to provide an alternative way to send encrypted files other than email. Information regarding the use of SAFE can be found at https://safe.amrdec.army.mil/safe/Default.aspx. The contractor shall ensure the following:

· All files transferred via SAFE shall be for official U.S. government related business.

· All files transferred via SAFE shall be UNCLASSIFIED.

· SAFE CANNOT be used to transmit classified information

· All files shall be encrypted Cybersecurity The contractor shall design, develop, document, integrate, verify, and deliver a security architecture for the trainer that satisfies the DoD 8500.01 and DODI 8510.01 Risk Management Framework (RMF) security control set for NSS information system (IS) or platform information technology (PIT) system per CNSSI 1253 Security Categorization of (Confidentiality= High, Moderate or Low), (Integrity=High, Moderate or Low), (Availability=High, Moderate or Low) further defined in NIST SP 800-53r4.

Cybersecurity RMF Assess and Authorize Process Support The contractor shall support the RMF IAW DoDI 8510.01, Navy RMFPG and NAVAIR TSDG.

Authorization to Operate The contractor shall prepare the Authorization to Operate (ATO) Package IAW the CDRL.

Software Integrity Assessment and Validation The contractor shall assess and validate that the trainer software applications are designed to function in a properly secured operating system environment and are free of elements that might be detrimental to the secure operation of the resource operating system, as described in NIST SP 800-53r4. The contractor shall provide a Vendor Compliance Assessment Report for Software (VCARS) for contractor-developed software applications IAW the ATO Package CDRL. Commercial Item software does not require a VCARS.

Cybersecurity Compliance The contractor shall assess, verify, and document that the security architecture and configuration of modified trainer components are in compliance with the security requirements and security control set for NSS information system (IS) or platform information technology (PIT) system per CNSSI 1253 Security Categorization of (Confidentiality= High, Moderate or Low), (Integrity=High, Moderate or Low), (Availability=High, Moderate or Low) further defined in NIST SP 800-53r4. The contractor shall use DoD-authorized assessment tools to perform Cyber Security assessment (e.g. Assured Compliance Assessment Solution (ACAS), DISA Security Content Automation Protocol (SCAP) Tool), document, verify, and validate each applicable operating system Cyber Security configuration.