N6134019R1203_Exhibit__1a-ACTS_IDIQ_SOW_DRAFT.pdf

Exhibit - 1a

ACTS SOW

16 October 2018

STATEMENT OF WORK

FOR

ADVANCED COMPUTER-BASED TRAINING SYSTEM (ACTS)

Indefinite Delivery/Indefinite Quantity (IDIQ)

DEPARTMENT OF THE NAVY

NAVAL AIR WARFARE CENTER

TRAINING SYSTEMS DIVISION

12211 SCIENCE DRIVE

ORLANDO, FL 32826-3275

APPROVED BY: DATE:

Kirk Roudabush

Lead Project Manager, 1.6.3.2

APPROVED BY: DATE:

Mark Reemsnyder, Lead Project Engineer, 4.6.8.4

DISTRIBUTION STATEMENT C - Distribution authorized to U.S. Government agencies and their contractors. Other requests for this document shall be referred to COMMANDING OFFICER, NAVAL AIR WARFARE CENTER, TRAINING SYSTEMS

DIVISION, 12211 Science Drive, Orlando, FL 32826-3224

Multipurpose Reconfigurable Training System 3D, MRTS 3D, and the MRTS 3D logo are registered trademarks of the U.S. Navy.

Virtual Interactive Shipboard Instructional Tour, and VISIT 3D are trademarks of the U.S. Navy.

Exhibit – 1a ii

Table of Contents

Section Title Page

1.1.1 Acquisition Model

1.1.2 MRTS 3D Status

1.2 Method of Tasking

1.3 Definitions

1.3.1 Engineering Production Model (EPM)

1.3.2 Government Integration Laboratories

1.3.3 Enhanced User

2. APPLICABLE DOCUMENTS

2.1 Government Documents

2.2 Non-Government Documents

3. REQUIREMENTS

3.1 General

3.1.1 Contractor’s Role as a Developer, Contracted Systems Integrator and Hardware Provider

The contractor’s roles are Developer, Contracted Systems Integrator and Hardware

Provider. Each role shall focus on one or more of the following three tasks: modeling, software development and hardware support. The delivery order will specify the role(s) required to be performed under the terms of the DO. Sections 3.1.2 through 3.1.4 of this document apply to all roles

3.1.1.1 Developer

3.1.1.2 Contracted Systems Integrator (CSI)

3.1.1.3 Hardware Provider

3.1.2 Program Planning

3.1.2.1 Program Decision Management

3.1.2.1.1 Development of a Contract Work Breakdown Structure (CWBS)

3.1.2.1.2 Work Planning and Scheduling

3.1.2.2 Integrated Product Teams (IPTs)

3.1.2.3 Risk Management

3.1.2.4 Quality Management

3.1.2.5 Control of GFE/GFI

3.1.2.5.1 GFE/GFI Issued

3.1.2.6 Configuration Management (CM)

3.1.2.6.1 Change Management

3.1.2.6.2 Configuration Status Accounting

3.1.2.7 Use of Contractor’s Inspection Equipment

3.1.2.7.1 Contractor’s Progress, Status, and Management Report (CPSMR)

3.1.3 Security (Classified and Limited Distribution Programs)

3.1.3.1 Classified Processing and Access to Classified Systems

3.1.3.2 Operations Security (OPSEC)

iii

Exhibit - 1a

3.1.3.3 Access to DoD Installations, Government Information, and

Information Technology (IT) Systems – Personnel Security

Background Checks and DBIDS

3.1.3.4 Government-Issued Personal Identification Credentials

3.1.3.5 Personnel Security – Background Checks

3.1.3.6 Information Assurance and Personnel Security Requirements for

Accessing Government Information Technology (IT) Systems -

Credentialing Standards

3.1.3.7 Unclassified Contractor–Owned Network Security – Safeguarding of Unclassified Controlled Technical Information

3.1.3.8 Transmission of Controlled Unclassified Information (CUI) via e-mail

The Contractor shall use approved encryption to safeguard the electronic transmission of all Controlled Unclassified Information. The Contractor shall ensure that when transmitting CUI over non-secure e-mail (e.g. not connected to the Navy Marine Corps Intranet through Broadband

Unclassified Remote Access System / Virtual Private network), those transmissions are encrypted using Department of Defense

Public Key Infrastructure (PKI), or an approved DoD External

Certificate Authority, in accordance with Public Key Infrastructure

& Public Key Enabling, DoDI 8520.02, 24 May 2011

3.1.3.9 Transmission of Controlled Unclassified Information (CUI) via

S.A.F.E

3.1.3.10 Cyber Incident and Compromise Reporting

3.1.4 Cybersecurity

3.1.4.1 RMF Assess and Authorize Process Support

3.1.4.1.1 Authorization to Operate

3.1.4.2 Software Integrity Assessment and Validation

3.1.4.3 Cybersecurity Compliance

3.1.4.4 Information Assurance Vulnerability Management Program

(IAVMP)

3.1.4.4.1 Network Devices

3.1.4.5 Intrusion detection and virus protection

3.1.4.5.1 HBSS Modules

3.1.4.6 PKI Requirements

3.1.4.7 Third Party Software

3.1.4.8 Database Management System

3.1.4.8.1 Ports, Protocols, and Services

3.1.4.9 Audit Logging

3.1.4.9.1 Software Management System

3.1.4.9.2 Encryption

iv

Exhibit - 1a

3.1.4.9.3 Processing of National Security Information

3.1.4.9.4 Requirements for Operating Systems

3.1.4.9.5 Requirements for GOTS Developed Software Application Systems

3.1.4.10 Cyber Space and Cybersecurity Workforce Management

3.2 Detailed Tasks

3.2.1 Trainer Design, Development, and Fabrication

3.2.2 Systems Engineering Processes

3.2.2.1 System Requirements Definition

3.2.2.2 Traceability

3.2.2.3 System Architectural Design

3.2.2.4 Software Requirements Analysis

3.2.2.4.1 Derived Requirements Analysis

3.2.2.5 Software Architectural Design

3.2.2.5.1 Software and Data Asset Re-Use and Shared Repository

3.2.2.6 Implementation

3.2.2.6.1 Software Implementation

3.2.2.6.1.1 Development Environment and Practices

3.2.2.6.1.1.1 Software Development Languages, Libraries and Tools

3.2.2.6.1.1.2 Software User Instructions

3.2.2.6.1.1.3 Digital Media/Art Development Languages, Libraries and Tools

3.2.2.6.1.2 Digital Media Products

3.2.2.6.1.3 Image Generator Development and Support

3.2.2.6.1.4 Networking

3.2.2.6.1.5 Interfacing to External Systems

3.2.2.6.1.6 Database Employment and Maintenance

3.2.2.7 System Integration

3.2.2.8 Device Transition

3.2.2.8.1 Software Version Description

3.2.2.8.1.1 Cold Start Procedures

3.2.2.8.1.2 Installation and Configuration Procedures

3.2.2.8.1.3 Media and Storage Devices

3.2.2.8.1.4 Cold Start and Installation Procedure Media

3.2.2.8.1.5 Automated Processes

3.2.2.8.1.6 Contractor Execution

3.2.2.9 System Validation

3.2.2.10 Instructor / Contractor Maintenance Support (CMS) Training

3.2.3 Meetings and Reviews

3.2.3.1 Systems Engineering Technical Reviews (SETR)

3.2.3.1.1 Kick-off Meeting

3.2.3.1.1.1 Kick-off Meeting Entry/Exit Criteria

v

Exhibit - 1a

3.2.3.1.2 System Requirements Review-II-System Functional Review (SRR-

II-SFR)

3.2.3.1.2.1 SRR-II-SFR Entry/Exit Criteria

3.2.3.1.3 Preliminary Design Review (PDR)

3.2.3.1.3.1 PDR Entry/Exit Criteria

3.2.3.1.4 Critical Design Review (CDR)

3.2.3.1.4.1 CDR Entry / Exit Criteria

3.2.3.2 IPT Meetings

3.2.3.3 In-Process Reviews (IPR)

3.2.3.4 Technical Documentation (TD) Reviews

3.2.3.5 Production Readiness Review (PRR)

3.2.4 Commercial and Non-Developmental Items (CaNDI)

3.2.4.1 Parts Management

3.2.5 System Safety Tasks

3.2.6 Product Assurance Audits and Inspections

3.2.7 System Test and Evaluation

3.2.7.1 Responsibility for Tests

3.2.7.2 Test Authority

3.2.7.3 T&E Program Planning

3.2.7.4 Test Resources and Facilities

3.2.7.4.1 Facilities and Travel Restrictions

3.2.7.5 Test Methods

3.2.7.6 Test Criteria

3.2.7.7 Tolerance Data

3.2.7.8 Alignment

3.2.7.9 Test Log

3.2.7.10 Changes During Testing

3.2.7.10.1 Software Changes During Government Testing

3.2.7.11 Changes After Testing

3.2.7.12 T&E Deficiency Reporting System

3.2.7.13 T&E Program Components

3.2.7.13.1 DT-1 (Navy Preliminary Evaluation (NPE))

3.2.7.13.2 DT-2 (Contractor Preliminary Inspection)

3.2.7.13.3 Test Readiness Review-1

3.2.7.13.3.1 TRR-1 Entry/Exit Criteria

3.2.7.13.3.2 Functional Configuration Audit (FCA)

3.2.7.13.3.2.1 DT-3 (Government Preliminary Inspection)

3.2.7.13.3.2.1.1 DT-3 (Full Trainer Development)

3.2.7.13.3.2.1.2 DT-3 (Software Development Only)

3.2.7.13.3.2.1.3 DT-3 (GPI) Exit Criteria

vi

Exhibit - 1a

3.2.7.13.3.2.2 DT-4 (Contractor Final Inspection)

3.2.7.13.3.2.3 Test Readiness Review-2

3.2.7.13.3.2.3.1 TRR-2 Entry / Exit Criteria

3.2.7.13.3.2.4 DT-5 (Government Final Inspection)

3.2.7.13.3.2.4.1 DT-5 (GFI) Exit Criteria

3.2.7.13.3.3 Physical Configuration Audit (PCA)

3.2.7.13.3.3.1 Preliminary PCA

3.2.7.13.3.3.1.1 Preliminary PCA Entry / Exit Criteria

3.2.7.13.3.3.2 Final PCA

3.2.7.13.3.3.2.1 Final PCA Entry / Exit Criteria

3.2.8 IUID Assignment

3.3 Specific Tasks

3.3.1 Post Award Conference (PAC) / Administrative Requirements

3.3.1.1 Post Award Conference (PAC)

3.3.1.2 Administrative Requirements

3.3.2 Training Products (Firm Fixed Price(FFP))

3.3.3 Training Products (Cost Plus Fixed Fee(CPFF))

3.3.3.1 Backup Management System

3.3.4 Contracted Systems Integration (CSI) Products (Firm Fixed

Price(FFP))

3.3.5 Contracted Systems Integration (CSI) (Cost Plus Fixed

Fee(CPFF))

3.3.5.1 Backup Management System

3.3.6 Hardware Products (Firm Fixed Price(FFP))

3.3.6.1 Initial Support Kit List (ISKL)

3.3.6.2 Documentation

3.3.7 Contractor Travel

vii

APPENDICES

Appendix Title Page

A Table A List the Equipment

B Table B List of CDRLs

Advanced Computer-Based Training System ACTS Source Selection

Statement of Work

1. SCOPE

This statement of work (SOW) defines the effort required to provide Naval Air Warfare Center, Training Systems Division (NAWCTSD), with development, production and sustainment of an

Advanced Computer-Based Training System (ACTS) Indefinite Delivery/Indefinite Quantity

(IDIQ) contract to support the Multipurpose Reconfigurable Training System 3D® (MRTS 3D®) program, the Virtual Interactive Shipboard Instructional Tour 3D™ (VISIT 3D™) program, and other future training solutions. The contract awardee shall act as the Contracted Systems

Integrator (CSI) for both programs as well as future training programs. The ACTS IDIQ contract includes task orders for the design, development, production, test and evaluation, delivery, modification, and life cycle support of training systems for NAWCTSD customers. The MRTS

3D effort consists primarily of end item deliverables including: media, test and evaluation products, technical documentation, life cycle support products, workstation simulation products, and MRTS 3D software products consisting of re-used and expanded code, libraries, and data.

The VISIT 3D virtual tour product line consists of end item deliverables including: media, test and evaluation products, technical documentation, and VISIT 3D software products utilizing

Government Furnished Information (GFI), including the VISIT 3D software development kit

(SDK), libraries, authoring tools, and data. Delivery orders (DOs) will be issued to upgrade existing training solutions as well as develop and field new training solutions that simulate various military tactical systems. The DOs may scale to systems of systems and large scale simulations.

As the CSI, the ACTS awardee shall be responsible for managing a growing database of MRTS

3D, VISIT 3D, and other applications and ensure their timely delivery to training sites in support of the Navy’s Sailor 2025 and Ready-Relevant-Learning objectives. In this request for proposal

(RFP), MRTS 3D, VISIT 3D, and other applications shall be collectively referred to as applications. Individual DOs may include hardware procurement and integration of hardware with MRTS 3D software, life cycle support products, and data collection and analysis activities to directly support product development. Operation and maintenance of the fielded trainers is not a requirement under this SOW and is being provided via other contract vehicles, such as contractor maintenance services (CMS). VISIT 3D SDK maintenance and updates are not requirements under this SOW and are being performed via a different contract vehicle. Current

MRTS 3D products simulate tactical systems found on submarines, ships, aircraft, and aviation support equipment of the U.S. Navy, along with weapons platforms from various other services.

DOs of this contract may include products for the U.S. and foreign armed services and any other customer of NAWCTSD.

1.1 Background

The MRTS 3D uses primarily Commercial Off the Shelf (COTS) hardware and Windows operating systems to simulate various Naval tactical systems for training purposes. MRTS 3D training solutions consist of MRTS 3D Classrooms and MRTS 3D Laboratories (see the MRTS

3D Classroom and MRTS 3D Laboratory System/Software Requirements Specification for more information). MRTS 3D Classrooms create a desktop environment with dual monitors; a multi-touchscreen for MRTS 3D simulation interaction, the other for viewing training material that supports the simulation. In contrast, MRTS 3D Laboratories use large multi-touchscreens that can be moved around to create laboratory configurations that mimic station layouts of tactical systems. MRTS 3D simulation computers are linked together in a stand-alone Local Area

Network (LAN) that runs government-owned simulation software, while the training network is designed to be either standalone or connected to the Navy’s unclassified Training Network

(TRANETU). All MRTS 3D software applications are to be built in accordance with (IAW) the

MRTS 3D Instructor Operating System (IOS) Middleware and SDK (MSDK). The MRTS 3D

MSDK currently uses the Unity gaming engine for the client side graphics and C# as the primary language. Upgrades and updates of the MRTS 3D MSDK will be a required under this IDIQ via delivery Orders.

VISIT 3D is a familiarization training application providing assisted and unassisted exploration of a simulated environment. Trainees interact in a 3D rendered environment with items of interest to access descriptive or instructional media including: interactive courseware, workstation simulations, reference documents, quizzes, and common media files. Users navigate the 3D space using a COTS video game controller with stick, directional pad, and button interactions programmed to mimic industry standard control schemes. Once the VISIT 3D

Developers Guide, VISIT 3D SDK and VISIT 3D authoring tools are available as GFI, all VISIT

3D products shall be developed IAW them. VISIT 3D products also share a common graphics library with MRTS 3D. VISIT 3D products are designed to operate both on MRTS 3D-compatable hardware and other COTS computer equipment.

1.1.1 Acquisition Model

This contract includes several basic roles:

Tasks

Roles

CSI Developer Hardware Provider

Models Modeling Standards

Model Library

Modeling N/A

Software MRTS 3D MSDK

Application

Marketplace

Validate other contractors’ adherence to SDK’s & related standards

Software Development N/A

Hardware Hardware Standards

N/A Hardware

Procurement and

Delivery

Figure 1. Roles and Tasks for the ACTS IDIQ

The Government envisions an evolving “End State” that includes an CSI supporting a MRTS 3D

MSDK, overseeing development of individual applications while also integrating applications that are developed by other contractors. Section 3.1 of this SOW provides a detailed description of the roles and tasks shown in Figure 1.

Under this ACTS single award IDIQ, the offeror can be tasked with all roles and tasks shown in

Figure 1. Once the MRTS 3D MSDK is mature enough for other contractors to develop additional software applications, an ACTS Multiple Award Contract (MAC) will be awarded separately from this contract to increase production capacity to meet the Navy’s training needs.

The awardee of the single award ACTS IDIQ contract would continue the CSI roles listed in

Figure 1. All ACTS SDKs would be freely available to all developers in the MAC, establishing a common development structure to improve the development efficiency and standardize on a common product that could run on common hardware.

In the CSI role, the ACTS IDIQ Awardee shall receive applications from the MAC contractors and integrate and test them for specifications and standards conformance, and upon approval, make them available for distribution over a cloud based “application marketplace" type solution.

Note that for this task, the offeror shall use the MRTS 3D MSDK, which will be maintained by the offeror, and the VISIT 3D SDK, will be maintained by a separate contract vehicle.

As the need for hardware procurement and delivery increases, a later separate ACTS Hardware

Provider IDIQ contract may be issued for training system hardware procurement, delivery and installation. Under the CSI role, the ACTS IDIQ awardee would continue to be the standards holder for hardware and associated documentation under the “Hardware Support” task as shown in Figure 1.

More information on the MRTS 3D MSDK and the various submodules and inherent and future capabilities is available in the MRTS 3D MSDK Whitepaper (see section 2.1 for specific reference).

1.1.2 MRTS 3D Status

The MRTS 3D Program is currently supporting several aviation, surface and submarine training platforms, including the MQ-4C Triton unmanned aerial vehicle (UAV) and the Ford Class

Electromagnetic Aircraft Launch System (EMALS) and several variants of submarine weapons and diesel generator systems. A list of all MRTS 3D fielded and under development applications is in Table 1.

Platform System Application Title

Aviation MQ-4C Triton MRTS 3D Triton (Field in FY19)

Platform System Application Title

Electromagnetic Aircraft Launch

System (EMALS)

MRTS 3D EMALS (Field in FY19)

Mobile Electric Power Plant (MEPP) MRTS 3D MEPP

Surface

Ships

Arleigh Burke Radio Room MRTS 3D Journeyman

Communications Course (JCC) (Field in

FY19)

SLQ-32 MRTS 3D SLQ-32 (Field in FY19)

AEGIS SPY Radar System MRTS 3D AEGIS Spy-1 (Field in

FY19)

Submarines Weapons Systems MRTS 3D 688 2nd Flight Weapons

Launch Console (WLC) (Field in FY19)

MRTS 3D 688i WLC

MRTS 3D VIRGINIA Block (BLK) I/II

Torpedo Room

MRTS 3D VIRGINIA BLK III Torpedo

Room

Emergency Diesel Generators

(EDGs)

MRTS 3D VIRGINIA EDG

MRTS 3D Fairbanks Morse (FM) EDG

(Field in FY19)

Table 1: Current MRTS 3D Applications

MRTS 3D applications are distributed and hosted at numerous sites throughout the Navy. Table

2 contains a list of all the current Navy training sites supported by the MRTS 3D program. The

MRTS 3D program will no longer be fielding specific training devices. See the MRTS 3D

Classroom and MRTS 3D Laboratory S/SRS for more information.

Table 2 List of MRTS 3D Training Sites

Domain Command Location Systems

Aviation Center for Naval Aviation

Technical Training

(CNATT)

Pensacola, FL MRTS 3D Classroom

MRTS 3D Laboratory

CNATT Norfolk, VA MRTS 3D Classroom

MRTS 3D Laboratory (Field in

FY19)

Surface Center for Information

Warfare Training (CIWT)

Corry Station FL MRTS 3D Classrooms (Field in FY19)

Undersea Navy Submarine School Groton, CT MRTS 3D Laboratories

Naval Submarine Training

Center Pacific (NSTCP)

Pearl Harbor, HI MRTS 3D Laboratories

Submarine Learning

Facility

Norfolk, VA MRTS 3D Laboratory

Submarine Learning

Center Detachment San

Diego

San Diego, CA MRTS 3D Laboratory

(planned for FY19)

NSTCP Detachment

Guam

Guam MRTS 3D Laboratory

(Planned for FY19)

1.2 Method of Tasking

The government will issue requirements under the basic IDIQ Contract through individual DOs.

Each DO SOW will contain the requirements for specific tasks relating to training system products. DOs may be issued at any time during contract performance, and will be related to scope tasks outlined in the basic SOW. Additionally, the Government will include a set of data item requirements for the DO in the form of CDRL items.

1.3 Definitions

The following definitions apply to this SOW.

1.3.1 Engineering Production Model (EPM)

An EPM is a standalone system built to match the requirements of a fielded MRTS 3D

Classroom, MRTS 3D Laboratory, or other future training device. The MRTS 3D Integration

Laboratory has a small scale EPM supporting MRTS 3D Classroom and MRTS 3D Laboratory procurement and acceptance testing. At the government’s discretion, the EPM may be used for testing purposes during the course of the execution of the terms of this delivery order.

1.3.2 Government Integration Laboratories

The government integration labs are used by the government to accept products developed as the result of a delivery order. Currently, MRTS 3D and VISIT 3D assets are located at government facilities within or close vicinity of Naval Support Activity (NSA) Orlando, Florida. The labs currently have one MRTS 3D training device, but lab sizes and locations may change during the course of the contract. At the government’s discretion, contractor access to the integration labs may be granted to test on the EPMs as well as perform the core sustainment functions. The integration labs typically consist of but not limited to :

a. EPMs for integration, testing and accepting of training applications

b. Servers for configuration management of the software and data repositories

c. Storage space for accountable inventories

d. Associated spares

1.3.3 Enhanced User

Enhanced User or Privileged User: An Authorized User (military, civilian or contractor) who requires detailed knowledge of Cyber IT and/or cybersecurity to support work in the development, maintenance, or operation of DON systems, including weapons, tactical, electronic and electrical services, navigation, and engineering. Enhanced Users possess advanced Cyber

IT/CS knowledge and abilities centered on particular professional areas.

2. APPLICABLE DOCUMENTS

The following documents of the issue listed form a part of this SOW to the extent specified herein. In the event of a conflict between documents referenced herein and the contents of this

SOW, the contents of this SOW take precedence. Nothing in this SOW, however, supersedes applicable laws and regulations, unless a specific exemption has been obtained.

2.1 Government Documents

The following specifications, standards, and handbooks of the latest revision listed below form a part of this SOW to the extent specified herein.

Department of Defense (DoD) Standard Practices

MIL-STD-130N - Identification Marking of U.S. Military Property

MIL-STD-1472G - Human Engineering

(Copies of these documents are available online at http://quicksearch.dla.mil/ or from the Standardization

Document Order Desk, 700 Robbins Avenue, Building 4D, Philadelphia, PA 19111-5094.)

OTHER PUBLICATIONS:

Code of Federal Regulations (CFR)

22 CFR, Parts 120 - 130 - Foreign Relations, Chapter I - Department of State, Subchapter M - International Traffic in Arms Regulations

(The above regulations are available at http://www.pmddtc.state.gov/regulations_laws/itar_official.html

29 CFR 1910.147 - The control of hazardous energy (lockout/tagout)

(OSHA standards are downloadable from http://www.osha.gov)

Defense Federal Acquisition Regulations Supplement (DFARS)

DFARS 252.204-7008

DFARS 252.211-7003

Compliance with Safeguarding Covered Defense

Information Controls

Item Identification and Valuation

DFARS 252.239-7001

DFARS 252.239-7010

Information Assurance Contractor Training and

Certification

Cloud Computing Services

(DFARS is available at: http://www.acq.osd.mil/dpap/dars/index.html)

Department of Defense (DoD) Handbooks

MIL-HDBK-217F, Notice 2 - Reliability Prediction of Electronic Equipment

MIL-HDBK-472, Notice 1 - Maintainability Prediction

MIL-HDBK-881A - Work Breakdown Structures for Defense Materiel Items file:///C:/Users/kevin.DANG/AppData/Local/Microsoft/Windows/Temporary%20Internet%20Files/Content.Outlook/9Z6SLRRB/MRTS%203D%20MQ-4C%20Triton%20Lab%20-%20SOW%20(4-12-2017)%20Final%20-%20Rev%202.docx%23MIL_STD_130_ file:///C:/Users/kevin.DANG/AppData/Local/Microsoft/Windows/Temporary%20Internet%20Files/Content.Outlook/9Z6SLRRB/MRTS%203D%20MQ-4C%20Triton%20Lab%20-%20SOW%20(4-12-2017)%20Final%20-%20Rev%202.docx%23MIL_STD_1472F_ http://www.pmddtc.state.gov/regulations_laws/itar_official.html http://www.osha.gov/

(Copies of the above handbooks are available at http://assistdocs.com/search/search_basic.cfm or from the

Standardization Document Order Desk, 700 Robbins Ave., Bldg 4D, Philadelphia, PA 19111-5094.)

DoD Cybersecurity, Risk Management Framework for DoD IT and Department of the Navy

(DoN) Instructions, Manuals, Policy Memos, and Guidance Documents

DODD 8140.01

DODI 8500.01

Cyberspace Workforce Management

Cybersecurity

DoD 5220.22-M - National Industrial Security Program Operating

(NISPOM) Manual

DODI 8510.01

CNSS 1253

Risk Management Framework for DoD IT

Committee on National Security Systems (CNSS)

Instruction No. 1253, Security Categorization and

Control Selection for National Security Systems

SECNAV M-5239.2

RMFPG V1.0

NAVAIR TSDG V1.0

Department of the Navy Cyberspace Information

Technology and Cybersecurity Workforce

Management and Qualification

Navy Authorizing Official and Security Control

Assessor Risk Management Framework Process Guide

Naval Air Systems Command Training Systems

Domain Guide (TSDG)

The above Cybersecurity documents are available at http://nawctsd.navair.navy.mil/Resources/Library/IA/Index.cfm. The NISPOM is available at http://www.dtic.mil/whs/directives/corres/pub1.html

NAVAIR Instructions

NAVAIRINST 4355.19D Systems Engineering Technical Reviews

(NAVAIR Instructions are downloadable from https://homepages.navair.navy.mil/directives/index.cfm

United States (US) Code

Title 10, Section 2451 - 2456 - Defense Standardization Program

(U.S Code is downloadable from http://uscode.house.gov/search/criteria.shtml http://assistdocs.com/search/search_basic.cfm http://nawctsd.navair.navy.mil/Resources/Library/IA/Index.cfm http://www.dtic.mil/whs/directives/corres/pub1.html https://homepages.navair.navy.mil/directives/index.cfm http://uscode.house.gov/search/criteria.shtml

US Office of Personnel Management (OPM)

OPM Memorandum - Final Credentialing Standards for Issuing Personal Identity

Verification Cards under HSPD-12

The above document is downloadable from http://www.opm.gov/investigate/resources/final_crdentialin g_standards.pdf

NAWCTSD Documentation:

Product Documentation:

MRTS 3D Product Document

Weapons Launch Console Team

Trainer (WLCTT)

21E17 Training Systems Support Document

(TSSD)

21E17 Systems Interface Manual (SIM)

688i Software Design Document (SDD)

688i Software Version Description (SVD)

688VLS Software Design Document (SDD)

688VLS Software Version Description (SVD)

Title Description

Requirements Specification

MRTS 3D Classroom &

Laboratory System/Software

S/SRS for MRTS 3D Classroom & Laboratory version

1.3.1. This document describes the hardware

configurations of MRTS 3D Classrooms and MRTS

3D Laboratories.

MRTS 3D Instructor

Operator Station (IOS)

Middleware and Software

Development Kit (MSDK)

IOS/MSDK Specification may be under contract concurrently and if so, leverage in the procurement effort. Documentation set includes:

1. MRTS 3D MSDK Software Design Description

(SDD) with Application Programing Interface

(API) definitions for the modules are available.

2. MRTS 3D Style Guide Specification

3. Modeling Standards Guide

MRTS 3D Middleware and

System Development Kit

(MSDK) White Paper

MRTS 3D Middleware and System Development Kit

(MSDK) White Paper

VISIT 3D Software

Development Kit (SDK)

VISIT 3D Software Development Kit, once produced.

VIRGINIA BLK III Software Design Document

(SDD)

VIRGINIA BLK III Software Version Description

(SVD)

VIRGINIA Emergency Diesel

Generator (EDG)

Acceptance Test Procedures (ATP)

Requirements Traceability Verification Matrix (in

Microsoft Team Foundation Server (TFS) format)

Fairbanks-Morse EDG Software Users’ Manual

Acceptance Test Procedures (ATP)

Mobile Electric Power Plant

(MEPP)

Software Users’ Manual

Acceptance Test Procedures (ATP)

Requirements Traceability Verification Matrix (in

Microsoft Team Foundation Server (TFS) format)

Future Products

Triton MQ-4C UAV

Maintenance

Software Users’ Manual

Acceptance Test Procedures (ATP)

2.2 Non-Government Documents

INDUSTRY STANDARDS

American National Standards Institute (ANSI)/American Society for Quality (ASQ)

ANSI/ASQ Q9000-2005 - Quality Management Systems - Fundamentals and

Vocabulary

ANSI/ASQ Q9001-2008 - Quality Management Systems - Requirements

ANSI/ASQ Q9004-2009 - Quality Management Systems - Guidelines for

Performance Improvements

(Copies of the above documents are available from www.ansi.org or Global Engineering Documents, 15

Inverness Way, East Englewood, CO 80112.)

http://www.ansi.org/

ANSI/Electronic Industries Alliance (EIA)

ANSI/EIA-649-B 2011 - Configuration Management Standard

(Copies of the above document are available from www.ansi.org or Global Engineering Documents, 15

Inverness Way, East Englewood, CO 80112.)

ANSI/Institute of Electrical and Electronics Engineers (IEEE)

IEEE Std 1233-1998 Edition

(R2002)

- IEEE Guide for Developing System Requirements

Specifications

IEEE/EIA 12207.1-1997 - Standard for Information Technology – Software Life

Cycle Process – Life Cycle Data

IEEE Std 12207-2008, 2nd

Edition

- Systems and Software Engineering – Software life cycle processes

IEEE Std 15288-2008, 2nd

Edition

- Systems and Software Engineering – System Life Cycle

Process

(Copies of this document are available from www.ieee.org or IEEE Service Center, 445 Hoes Lane, Piscataway, NJ 08854-1331.)

International Organization for Standardization/International Electro-technical Commission

(ISO/IEC)

ISO/IEC 27002:2005 - Information technology - Security techniques - Code of practice for information security management

(Redesignation of ISO/IEC 17799:2005)

(Copies of this document are available from http://www.ansi.org)

3. REQUIREMENTS

3.1 General

The requirements defined herein form the basis for all work and products delivered to the

Government as a part of the contract. This SOW defines the scope of the projects which apply to the contract. Unless otherwise stated in a specific delivery order, all contractor work efforts shall be conducted at a non-government facility arranged by the contractor. The Contractor shall organize, coordinate, and control all program activities under contract to ensure compliance with the contract requirements and delivery of the required products and incidental services. The

Government shall retain unlimited rights to all works, as defined at DFARS clause 252.227-

7020, created, generated, or produced and required to be delivered under this contract.

3.1.1 Contractor’s Role as a Developer, Contracted Systems Integrator and Hardware

Provider

The contractor’s roles are Developer, Contracted Systems Integrator and Hardware Provider.

Each role shall focus on one or more of the following three tasks: modeling, software development and hardware support. The delivery order will specify the role(s) required to be http://www.ansi.org/ http://www.ieee.org/ http://www.ansi.org/ performed under the terms of the DO. Sections 3.1.2 through 3.1.4 of this document apply to all roles.

3.1.1.1 Developer

Within the Developer role, the contractor shall perform tasks including, but not limited to:

1) Modeling

a. Create new or modify existing models upon Delivery Order request IAW

Modeling Standards Guide. The developer may be required to develop models from the following sources:

i. Developing models from CAD data

ii. Developing models from Point Cloud Data

iii. Developing models from Lidar data

iv. Developing models from photo reference

v. Others as specified by the delivery order

b. Submit models for quality and compatibility testing

2) Software Development

a. Create new or modify existing applications upon Delivery Order request, IAW

MRTS 3D MSDK or VISIT 3D SDK as appropriate per DO

b. Submit applications for quality and compatibility testing

c. Deliver, install and test software applications

3.1.1.2 Contracted Systems Integrator (CSI)

The offeror will perform tasks as a Contracted Systems Integrator, performing configuration management and integration of the family of products under the ACTS umbrella. The contractor shall propose new ideas for future models, software applications and hardware improvements.

Within the CSI role the contractor shall perform tasks including, but not limited to:

1) Modeling Standards and Repository

a. Create a model library that NAWCTSD and other developers’ can:

i. Receive models from other contractors and validate IAW Modeling

Standard Guide

ii. Utilize a searchable and sortable function that catalogs the following information:

1. File Name / component name

2. Platform (e.g. Ford CVN, AEGIS DDG, VA SSN)

3. Platform space (ex. Frame number, space name)

4. System name (ex. AEGIS Radar, EMALS, “generic mechanical” for valves, “generic test equipment” for oscilloscopes and multi-meters)

5. Model format

6. Resolution and Level of Detail (LOD)

7. Model version with change description

8. Results of compatibility testing

9. Check in/out status for each model

b. Maintain models IAW MRTS 3D Modeling Standard Guide

c. Provide input to the MRTS 3D Modeling Standard Guide

d. Perform configuration management of above items

2) Software Development Standards and Repository (Functions listed below are performed in support of deliverable products)

a. Receive software applications from other contractors and validate IAW MRTS 3D

MSDK or the VISIT 3D SDK as appropriate

b. Maintain applications IAW MRTS 3D MSDK or the VISIT 3D SDK as appropriate

c. Draft, modify and maintain contractor software development guides IAW Human

Machine Interface (HMI) standards

d. Develop and maintain software architecture, networking and Instructor Operator

Station (IOS)

e. Continue to develop and maintain MRTS 3D MSDK product development through delivery orders.

f. Distribute and provide technical support with help desk for the MRTS 3D MSDK, MRTS 3D applications, and VISIT 3D applications

g. Provide support to maintain the Authority to Operate (ATO) for all MRTS 3D

Classrooms and MRTS 3D Laboratories as required by each delivery order.

h. Maintain host operating systems IAW Cybersecurity standards and ATOs.

i. Utilize a common software repository such as Microsoft Team Foundation Server

(TFS) that catalogs and stores

i. Source code

ii. Model data

iii. Documentation

iv. Application check in/out status

v. Application version with change description

vi. Results of compatibility testing

j. Maintain Application Market that captures:

i. Application configuration and documentation

ii. Application version with change description

k. Prepare and install software packages

l. Establish test methods and maintain a test environment for wide area distribution and wide area simulations to support distributed learning

m. Develop a process to maintain the library so that new assets can be added, and existing assets can be checked out / in by the Government and other contractors.

i. To account for growth beyond unclassified programs, the process shall account for retention of classified SECRET and unclassified assets, including those with For Official Use Only (FOUO), no foreign nationals

(NOFORN), and Naval Nuclear Propulsion Information (NNPI) handling restrictions. Note: It is possible during the life of the contract that delivery orders may receive GFI above the level of SECRET, and that the offeror may be directed to produce deliverables that are above the SECRET level.

A separate delivery order will be issued concurrently with the

Governments standup of this capability to provide a vehicle for the contractor to prepare.

ii. The process shall have a method to distribute a table of contents for each library to the Government and authorized contractors.

iii. Develop a process to examine incoming assets to validate compliance with the MRTS 3D MSDK and / or Modeling Style Guide and generate a report to the Government IAW CDRL A00F, Test Inspection Report. The contractor shall propose the report format for acceptance by the

Government.

n. Perform configuration management of above items.

3) Hardware Standards and Repository

a. Draft, modify and maintain Hardware Standards

b. Define standard hardware installation kit inventories

c. Maintain, utilize and store Government Furnished Equipment (GFE)

d. Maintain documentation such as the Systems Interface Manual for all sites

3.1.1.3 Hardware Provider

Within the Hardware Provider role, the contractor shall perform tasks including, but not limited to:

1) Hardware Support

a. Procure hardware kits to include spares

b. Install and remove hardware kits on site

c. Provide hardware technical support to users

d. Draft or update documentation such as the MRTS 3D Operations and

Maintenance Manual IAW CDRL E002.

3.1.2 Program Planning

The purpose of the program planning process is to produce and communicate effective and workable program plans. The contractor shall prepare and submit the System Engineering

Management Plan (SEMP) IAW CDRL A002. The contractor shall prepare and submit the

Software Development Plan (SDP) IAW CDRL A001. The contractor shall submit revised

SEMP and SDP, if required for each delivery order.

3.1.2.1 Program Decision Management

The purpose of the decision management process is to select the most beneficial course of program action where alternatives exist. The contractor shall define, document, manage, and apply a program decision management process IAW IEEE Std 12207-2008, section 6.3.3.

3.1.2.1.1 Development of a Contract Work Breakdown Structure (CWBS)

When required by the DO, the requirements of this paragraph shall apply. The contractor shall develop, document, maintain, and apply a CWBS and CWBS dictionary that define the work structures required to perform the work required by the DO. The contractor shall use the CWBS as the framework for planning, budgeting, and reporting of cost, schedule, and performance. The contractor shall use MIL-HDBK-881A for guidance in CWBS and CWBS dictionary definition.

The contractor shall extend the CWBS to lower levels that represent the plan to accomplish the entire DO work scope consistent with internal organizations and processes. The contractor shall update the CWBS and CWBS dictionary as changes occur or additional system definition is accomplished. The contractor shall prepare the CWBS IAW CDRL B004.

3.1.2.1.2 Work Planning and Scheduling

When required by the DO, the requirements of this paragraph shall apply. The contractor shall develop, document, manage, and apply an Integrated Master Schedule (IMS) that presents the contractor’s and subcontractor’s plans and schedules to meet the requirements of the DO. The contractor shall develop and document a tiered scheduling system based on the CWBS elements showing the program milestones and prerequisite events, conferences, reviews, data submittals, and deliveries. The contractor shall construct the IMS which is a sub-product of the Integrated

Program Management Report to ensure that the program milestones are met and to ensure that deliveries meet the requirements of the DO. Contractor schedule information delivered to the

Government or presented at program reviews shall originate from the IMS. The contractor shall perform analyses of the IMS tasks, compare the IMS tasks to the schedule baseline, report potential or existing problem areas, and recommend corrective actions to eliminate or reduce schedule impact. The contractor shall revise the IMS, where necessary, to reflect DO changes.

The contractor shall use the IMS as a day-to-day execution tool and to periodically assess progress in meeting program requirements. The contractor shall prepare the IMS IAW CDRL

B005.

3.1.2.2 Integrated Product Teams (IPTs)

When required by the DO, the requirements of this paragraph shall apply. The contractor shall define, document, implement, and maintain an IPT structure for the duration of the DO. The purpose of an IPT is to bring together the functions that have a stake in the performance of a product or process and concurrently make integrated decisions affecting that product or process.

IPT membership will consist of multi-functional stakeholders working together with a product-oriented focus. Each IPT will be empowered to make critical life cycle decisions regarding each product or process within their purview. IPTs will be applied at various levels ranging from the overall structure of an organization to informal groups functioning across existing units. With

Government input, the contractor shall define and document the composition, structure, roles, and responsibilities of each IPT. Each IPT will maintain a list of membership. Each IPT will consist of Government and contractor personnel and have a Government chair. Each IPT will publish an agenda before each meeting. Each IPT will record and maintain meeting minutes.

3.1.2.3 Risk Management

The purpose of the risk management process is to continuously identify, analyze, treat, and monitor the risks to the program. When required by the DO, the requirements of this paragraph shall apply. The contractor shall conduct risk management to systematically control the uncertainty in the project’s ability to meet cost, schedule, and performance requirements. The contractor may use NAVAIRINST 5000.21(series) for guidance in the contractor’s approved

Risk Management Plan (RMP) (CDRL A004). The contractor shall participate in the

Government Risk Working Group established for this program. The contractor shall report risk information, data, and analysis in the Contractor’s Progress, Status, and Management Report

(CPSMR) cited above.

3.1.2.4 Quality Management

The purpose of the quality management process is to assure that the products meet contractor quality objectives and Government requirements. When required by the DO, the requirements of this paragraph shall apply. The contractor shall address methods to control the quality of the DO product(s) in the SDP and SEMP. The contractor may use ANSI/ASQ Q9000-2005 and

ANSI/ASQ Q9004-2009 for guidance.

3.1.2.5 Control of GFE/GFI

The contractor shall perform the following tasks to control all GFE provided to support the DO as part of the quality management process:

a. Examine upon receipt, consistent with practicality, to detect damage

b. Provide storage that precludes deterioration

c. Examine prior to installation, consistent with practicality, to detect damage

d. Identify and protect from improper use or disposition

e. Verify and audit quantity periodically

3.1.2.5.1 GFE/GFI Issued

Equipment listed in Appendix A, Table A-V, is available for use by the contractor in the execution of delivery orders. The contractor shall protect GFE IAW FAR 52.245-1. The contractor shall return the GFE at the end of the delivery order or as directed by the government.

The returned GFE is subject to government inspection, and the contractor shall be responsible for costs associated with repairs due to negligent use or failing to follow FAR 52.245-1.

3.1.2.6 Configuration Management (CM)

The purpose of the CM process is to establish and maintain the integrity of identified

Configuration Items (CIs) over their lifecycle. When required by the DO, the requirements of this paragraph shall apply. The contractor shall define, document, manage, and apply a CM process IAW IEEE Std 12207-2008, section 6.3.5 and 7.2.2; and ANSI/EIA-649-B 2011 in the contractor’s approved Configuration Master Plan (CMP), prepared IAW with CDRL A003. The contractor shall place Government-Furnished Software (GFS), NDI, and Commercial Item software, and each item’s associated documentation under CM upon receipt. The contractor shall place Commercial Item software items under CM as “disk image” files of the physical media.

The Government will maintain a separate CM repository in the MRTS 3D integration labs. This repository is not accessible outside the integration labs, and is also used by Government team members to store Government developed MRTS 3D software and documentation and to track repository status. The contractor shall address the integration labs in the CMP and ensure that the integration labs are updated each time a testing event occurs and that all changes in software/documentation, under a DO are also captured in the integration lab repositories.

3.1.2.6.1 Change Management

When required by the DO, the requirements of this paragraph shall apply. The contractor shall define, document, manage, and apply a process to accomplish change management. The contractor shall use Engineering Change Proposals (ECPs) and Request for Deviations (RFDs) to request changes to an approved baseline. The contractor shall prepare the Engineering Change

Proposal (ECP) and Request for Deviation (RFD) IAW CDRLs A00L and A00M, respectively.

3.1.2.6.2 Configuration Status Accounting

When required by the DO, the requirements of this paragraph shall apply. The contractor shall define, document, manage, and apply a process to accomplish configuration status accounting.

The contractor shall identify and document all items incorporated into or deleted from the training device during development and modification. The contractor shall prepare the Technical

Directive (TD) (Training Equipment Change Directive (TECD)) IAW CDRL A00K.

3.1.2.7 Use of Contractor’s Inspection Equipment

When specified by the DO, the contractor shall make measuring and testing devices available for use by the Government when required to determine conformance with contract requirements.

The contractor shall provide the personnel needed to operate such devices and to verify calibration, accuracy, and condition.

3.1.2.7.1 Contractor’s Progress, Status, and Management Report (CPSMR)

The contractor shall prepare the Contractor’s Progress, Status, and Management Report in accordance with (IAW) the Contract Data Requirements List (CDRL B001) for all open delivery orders.

3.1.3 Security (Classified and Limited Distribution Programs)

The security requirements specified herein shall apply to the contractor and subcontractors. The contractor shall comply with applicable on-site security regulations related to government installation and facility access.

3.1.3.1 Classified Processing and Access to Classified Systems

The contractor shall safeguard classified information and meet the security requirements identified in the DD Form 254. The contractor shall enforce these safeguards throughout the life of the contract including the transport and delivery phases.

3.1.3.2 Operations Security (OPSEC)

The contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the contractor and any subcontractor during performance of the contract. Guidelines for applying the Risk Management Framework to federal information systems to include conducting the activities of security categorization, security control selection and implementation, security control assessment, information system authorization, and security control monitoring are provided in NIST SP 800-37. This program may include Cybersecurity and Communications

Security (COMSEC). The OPSEC program shall be in accordance with National Security

Decision Directive (NSDD) 298. If the contractor does not have an established OPSEC Plan that addresses the protection of classified information, critical information, sensitive, proprietary, or controlled unclassified information, the Government will provide a template for the Contractor’s internal development of an OPSEC Plan. Additional OPSEC program planning guidance can be found in DI-MGMT-80934C, OPERATIONS SECURITY (OPSEC) PLAN and NAVAIR

OPERATIONS SECURITY (OPSEC) REQUIREMENTS (attachment) IAW CDRL A006. The

OPSEC program, at a minimum, shall include:

a) Assignment of responsibility for OPSEC direction and implementation

b) Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures

c) Establishment of OPSEC education and awareness training to include Basic OPSEC training, produced by the Interagency OPSEC Support Staff (IOSS), which can be found at https://www.iad.gov/ioss/department/opsec-fundamentals-course-opse1300-opse1301-opse1300e-10045.cfm (OPSE1301 OPSEC Fundamentals)

d) Provisions for management, annual review, and evaluation of OPSEC programs

e) Flow down of OPSEC requirements to subcontractors when applicable

3.1.3.3 Access to DoD Installations, Government Information, and Information Technology

(IT) Systems – Personnel Security Background Checks and DBIDS

a) The Common Access Card (CAC) shall be the principal identity credential for supporting interoperable access to DoD installations and access to U.S. Government information systems

IAW FAR 52.204-9. The Defense Biometric Identification System (DBIDS) shall be used for contractors and vendors who do not have a CAC, but only requires access to a base/installation

Navy command. The Contractor shall first coordinate with the appropriate NAWCTSD

Contracting Officer Representative /Technical Point of Contact or government sponsor to request an application to be process through the NAWCTSD Security Office Trusted Agents for issuance of the CAC or via the Trusted Associate Sponsorship System. The base Visitor Control Center representative will process request for installation access using the DBIDS. More information for obtaining the CAC can be found at http://www.cac.mil/common-access-card/getting-your-cac/for-contractors/ and for DBIDS at https://www.cnic.navy.mil/om/dbids.html

b) Contractor personnel whom do not have a security clearance, but require a CAC in performance of their sensitive duties (including access to controlled unclassified information, but not access classified information), shall coordinate with the NAWCTSD Security Office to complete a National Agency Check with Local Agency Checks including Credit Check

(NACLC/TIER- 3) background investigation, which includes submission of fingerprints and the

Standard Form SF-86 (Questionnaire for National Security Positions). The contractor shall submit the Standard Form 86 to the NAWCTSD Security Office for processing. There shall be no additional NACLC/TIER-3 submissions for contractors holding a valid national security clearance. The Government may issue the credential upon favorable return of the Federal

Bureau of Investigations (FBI) fingerprint check, pending final favorable completion of the

NACLC/TIER-3.

c) Access to restricted areas, controlled unclassified information or Government Information

Technology by contractor personnel shall be limited to those individuals who have been https://www.iad.gov/ioss/department/opsec-fundamentals-course-opse1300-opse1301-opse1300e-10045.cfm https://www.iad.gov/ioss/department/opsec-fundamentals-course-opse1300-opse1301-opse1300e-10045.cfm http://www.cac.mil/common-access-card/getting-your-cac/for-contractors/ http://www.cac.mil/common-access-card/getting-your-cac/for-contractors/ https://www.cnic.navy.mil/om/dbids.html determined trustworthy as a result of the favorable completion of a NACLC/TIER-3 or who are under the escort of appropriately cleared personnel. Where escorting such persons is not feasible, a NACLC/TIER 3 shall be conducted and favorably reviewed by the appropriate DoD component, agency, or activity prior to permitting such access.

d)…