ATT (1) Statement of Work (SOW) 210003 Final 10SEP21.pdf

SOW 210003

10 September 2021

STATEMENT OF WORK

FOR

UNITED STATES MARINE CORPS (USMC)

CH-53E FY-22 MODIFICATION PROGRAM

DEPARTMENT OF THE NAVY

PROGRAM EXECUTIVE OFFICE (PEO),

AVIATION COMMON SYSTEMS AND COMMERCIAL SERVICES (CS)/PMA-205

47123 PATUXENT RIVER, MD 20670

DISTRIBUTION STATEMENT D: Distribution limited to Department of Defense (DoD) and U.S. DoD contractors only (Administrative or Operational Use)(29 January 2021). Other requests shall be referred to Department of the Navy, PEO (CS)/PMA-205, 47123 Buse Road, RADM William A. Moffett Building, Patuxent River, Maryland 20670-1547.

SOW CERTIFICATION FORM

FUNCTIONAL

DISCIPLINE NAME, PHONE RESPONSIBILITY CONCURRENCE

(Signature & date) IPT Member’s

Supervisor Project Engineer Barry Supersano,

(407) 380-4260 Primary Drafter of SOW & Primarily Responsible for Engineering & technical tasks and CDRL items

Signature via email dated

DD/MMM/YYYY

Hoa Pham, 407-380-4280

Software Engineer Ibrahim Akyol, 407-380-8307

Software Development Requirements and CDRL items

Signature via email dated

DD/MMM/YYYY

Bradly Cope, GT524, 407-380-8556

Visual Engineer Benito Graniela, 407-380-8031

Visual System Related Task Requirements and CDRL items

Signature via email dated

DD/MMM/YYYY

Wolfinger, William, 407w 380-8452

DSN 524

Aero/Motion Engineer

David Beltz, 407-380-8091

Aero and Motion System Related Task Requirements and CDRL items

Signature via email dated 26/April /2021

Craig Snoderly, 407-380-8394

T&E Engineer Alexandra Dyar, 301-633-5915

Overall evaluation of the system under test supported by other subject matter expertise. Specific responsibilities include test planning and preparation, test execution, data analysis of test results for conclusions and recommendations to USG Program Office.

Signature via email dated 23/April/2021

Hoa Pham, 407-380-4280

Security Specialist Luisa Santana,

(407) 380-8249

Security Program Requirements and CDRL items

Signature via email dated

DD/MMM/YYYY

Roger D. Stephens, 407-380-8243

ILSM Tamela Hall, 407-380-4575

Integrated Logistics Support Program Requirements and CDRL items, including Provisioning, Technical Documentation, Configuration Management, Facilities

Signature via email dated 26/April/2021

Howard Hiser, 407-380-4965

Information Security Specialist

Jonathan Vargas

(407) 380-8470

Cybersecurity Program Requirements and CDRL items

Signature via email dated

DD/MMM/YYYY

Matthew O’Morrow, 407-380-8592

Program Management

Sonja Sacket, 301-247-6842

D-IPTL Signature via email dated 23/April 2021

Daniel Shannon, 240-587-0060 ii

Table of Contents

Section Title Page

1. SCOPE

2. APPLICABLE DOCUMENTS

2.1 Government Documents

2.2 Non-Government Documents

3. REQUIREMENTS

3.1 General

3.1.1 Program Management

Program Planning Life Cycle Model Management Infrastructure Management Program Assessment and Control Program Decision Management Work Planning and Scheduling

Subcontractor Management and Reporting Integrated Product Team (IPT) Risk Management Quality Management

Control of Government-Furnished Equipment (GFE) GFE Tracking and Reporting Requirements Use of Contractor’s Inspection Equipment

Configuration Management (CM) Change Management Configuration Status Accounting Configuration Audits

Information Management Online Information Exchange Data Management

Program Measurement

3.1.2 Security

Classified Processing and Access to Classified Systems Operations Security (OPSEC) Unclassified Contractor-Owned Network Security - Safeguarding of Unclassified Controlled Technical Information Cyber Incident and Compromise Reporting Access to DoD Installations, Government Information, and

Information Technology (IT) Systems - Personnel Security Background Checks

Personnel Security – Background Checks International Traffic and Arms Regulation

Section Title Page iii

Personnel Security – Reporting of Adverse or Derogatory Information related to Contractors

Government-Issued Personal Identification Credentials Contractor “Out-processing” Policy Supply Chain Risk Management (SCRM) For National Security

Systems Protection of Critical Program Information (CPI) Transmission of Controlled Unclassified Information (CUI) via e-mail Transmission of Controlled Unclassified Information (CUI) via

DoD SAFE

3.1.3 Cybersecurity

Initial Cybersecurity Risk Management Framework (RMF) Meeting

Cybersecurity Certification and Accreditation Support Processing of National Security Information Cybersecurity Compliance Cybersecurity/IA Vulnerability Management Program (IAVMP) Hardware Management Cybersecurity Training Contractor Cybersecurity Training and Certification

3.1.4 Telephone/Internet Access

3.2 Detailed Tasks

3.2.1 Trainer Modification Task

Reserved Digital Control Loading (DCL) System Replacement Computational Subsystem Replacement

Tactical Environment (TEn) Reuse Peripherals I/O Cards Replacement Visual System (VS)

Image Generator System (IGS) Replacement IGS enhanced brownout and whiteout hardware IGS visual cues for section flight IGS shipboard landing, external loads, patterns of life, countermeasures and special effects Image Display System (IDS) Replacement

Image Display System (IDS) Projector Replacement Device 2F239 Collimated Glass Mirror Inspection and Cleaning

(Option) iv

Visual and Sensor Databases, Moving Models, and Alignment and Test Patterns

Visual and Sensor Databases and Moving Models Development Visual and Sensor Databases and Moving Models Reuse

Visual MCAT link support Cockpit Instructor Operator Station (IOS) Aircraft Technical Directive (ATD) Implementations

AN/ARC-210 RT-2036 Gen 6 (AFC-XXX) AN/APR-39D(V)2 Radar Signal Detecting Set (RSDS) (AFC-

601) T5 Power Turbine Inlet Temperature Indicator (AFC-597) Pylon Unsafe for Flight (PUFF) AN/ALE-47 Airborne Countermeasure Dispenser System (H53-

CSC-201-P6)

AN/AAQ-24B(V) Directional Infrared Countermeasures (DIRCM)

(AVC-5838)

Helicopter Emergency Egress Lighting System (HEELS) (AFC-

555 Rev A) Integrated Mechanical Diagnostic Systems (IMDS) Airborne

Software Change (H53-ASC-029) CH-53E Operational Flight Program (OFP)

2F239 COMM3 Panels Update Trainer Engineering Change Requests (TECRs) Motion & Vibration System Hydraulic Hose and Seal Replacement

(2F174 Only) APT Enclosure Refurbishment (2F190 Only) APT Heating, Ventilating, and Air Conditioning (HVAC)

Replacement (2F190 Only) Pilot and Copilot seat cushions Marine Common Aircrew Trainer (MCAT) Interface Echo Rendezvous (RV) Air-to-Air Refueling (AAR) Circuit Breaker (CB) Malfunctions Aerial Refueling Visual Indicators IOS Approach Plates IOS and Host Computational System (HCS) Navigational Aids

(NAVAIDs) Magnetic Variance (MAGVAR) IOS Global Database Support

3.2.2 Device 2F239 Software Baseline Alignment (Option)

3.2.3 Systems Engineering Processes

System Requirements Definition v

System Requirements Analysis Traceability System Architectural Design Software Requirements Analysis

Software Requirements Verification Software Architectural Design

Software Architectural Design Verification Software Product Design (SPD) Implementation

Software Implementation Software Unit Construction and Testing Software Code Verification Software Integration Software Integration Verification

Software Qualification Testing System Integration

System Qualification Testing Device Transition

Software Product Installation Software Product Package

Cold Start Processes Installation Procedures Firmware Configuration Procedures Source Code, Media, and Storage Devices Software Media Marking Automated Processes Contractor Software Product Execution Procedure Artifacts Government Software Product Execution

System Validation Software Acceptance Support

Electromagnetic Environmental Effects (E3) Engineering Electrostatic Discharge (ESD) Management

Reliability and Maintainability (R&M) Engineering Failure Reporting, Analysis and Corrective Action System

(FRACAS)

Reliability and Maintainability (R&M) Predictions

Human Factors Engineering (HFE)

3.2.4 Conferences and Reviews

Post Award Conference (PAC) vi

PAC Entry Criteria PAC Completion Criteria

Logistics Guidance Conference (LGC) Provisioning Guidance Conference (PGC) Technical Manual Initial Guidance Conference (TMIGC)

Technical Interchange Meetings (TIMs) Systems Engineering Technical Review (SETR)

System Requirements Review-II-System Functional Review (SRR-

II-SFR)

SRR-II-SFR Entry Criteria SRR-II/SFR Completion Criteria

Critical Design Review (CDR) CDR Entry Criteria CDR Completion Criteria

TRR Conferences Program Management IPT Meetings In-Process Reviews (IPRs) IPT SETR Dry-Run Meeting Engineering Design Review (EDR) (2F239 Only) EDR Entry Criteria

EDR Completion Criteria Provisioning Item Selection Conference (PISC)

PISC Entry Criteria PISC Completion Criteria

Technical Documentation (TD) Reviews

3.2.5 Commercial and Non-Developmental Items (CaNDI)

3.2.6 Parts Management

Obsolescence Management Planning Obsolescence Management/Diminishing Manufacturing Sources and Material Shortages (DMSMS) Plan Exempt Hardware Parts Standardization Trainer Peculiar Equipment (TPE) requirements

Parts Selection Criteria for TPE Parts Management Advisory Team (PMAT) Non-Availability of Standard Parts Non-Standard Part Data Parts Management Advisory Team’s (PMAT’s) Recommendations Appeal of PMAT’s Recommendations Subcontractor Direction vii

Program Parts Selection List (PPSL) Certification Replacement of Parts

System Safety Tasks Safety Assessment (SA)

3.2.7 Handling/Temporary Storage of Hazardous Materials

(HAZMAT)/Wastes

3.2.8 Safety and Security

3.2.9 Product Assurance Audits and Inspections

3.2.10 Test and Evaluation (T&E)

Responsibility for Tests Test Authority T&E Program Planning Test Resources and Facilities Test Methods Test Criteria Tolerance Data Alignment Testing Interruptions due to Safety Concerns

Test Suspension Test Log Changes During Testing

Software Changes During Government Testing Changes After Testing T&E Deficiency Reporting System

Deficiency Review Board T&E Program Components

Conformance Inspections Functional Configuration Audit

3.2.10.15.1.1.1 Baseline Test prior to EDR for 2F239

3.2.10.15.1.1.2 Contractor Preliminary Inspection (DT-C1)

3.2.10.15.1.1.3 Test Readiness Review (2F190-2 and 2F174-2)

3.2.10.15.1.1.3.1 TRR Entry Criteria

3.2.10.15.1.1.3.2 TRR Completion Criteria

3.2.10.15.1.1.4 Joint Preliminary Inspection (IT-C1 for 2F190-2 and 2F174-2)

3.2.10.15.1.1.4.1 IT-C1 Completion Criteria

3.2.10.15.1.1.5 TRR (device 2F239)

3.2.10.15.1.1.5.1 TRR Entry Criteria

3.2.10.15.1.1.5.2 TRR Completion Criteria

3.2.10.15.1.1.6 Joint Final Inspection (IT-C2 for 2F190-2 AND 2F174-2/IT-C1 for

2F239) viii

3.2.10.15.1.1.6.1 IT-C2/IT-C1 Completion Criteria

Physical Configuration Audit (PCA)

3.2.10.15.1.2.1 Incremental PCA (IPCA)

3.2.10.15.1.2.1.1 IPCA Entry Criteria

3.2.10.15.1.2.1.2 IPCA Completion Criteria

3.2.10.15.1.2.2 Final PCA (FPCA)

3.2.10.15.1.2.2.1 FPCA Entry Criteria

3.2.10.15.1.2.2.2 FPCA Completion Criteria

Integrated Logistics Support Verification (ILSV) Conference Integrated Logistics Support (ILS) Program Logistics Product Data (LPD) Engineering Data for Provisioning (EDFP) Bill of Materials (BOM) for Logistics and Supply Chain Risk

Management Buy Through The Prime (BTTP) Special Tools and Test Equipment

Excess Trainer Material Disposal Inventory Management Technical Data Package (TDP) and Technical Manuals (TMs) Verification and Validation (V&V) of TDP

3.2.10.15.1.13.1 Validation of TDP and TMs

3.2.10.15.1.13.2 Verification of TMs

Training Program

3.2.10.15.1.14.1 Instructor/Operator Training Courses

3.2.10.15.1.14.2 Maintenance Training (Device Maintainer Training)

Maintenance Planning

3.2.11 Preventive Maintenance

3.2.12 Interim Contractor Support (ICS)

3.2.13 Facility Requirements

Facility Site Survey Trainer / Facility Electrical Integration Trainer Equipment Installation Training System Installation Support Electrical and Mechanical Fire Detections/Suppression and fire Extinguishing Systems Disposal of Hazardous Materials Facility and Equipment Repairs Safety

Facility Clean-up

3.2.14 IUID Assignment

ix

APPENDICES

Appendix Title Page A Terms and Definitions.................................................................................A-1 B Interim Contractor Support (ICS) Service Performance Work

Statement (PWS) ......................................................................................... B-1 C TECRs .......................................................................................................... C-1

Statement of Work For

The USMC CH-53E FY-22 Modification Program (MP)

1. SCOPE

The MP will incorporate technology upgrades to enhance USMC pilot’s level of proficiency and extend the usable life of the training devices until the end of the CH-53E helicopter program in 2030. This Statement of Work (SOW) falls within the scope of the Training Systems Contract IV (TSC IV) Indefinite Delivery/Indefinite Quantity Contract (ID/IQC). The tasks and detailed requirements herein are in support of an MP order under TSC-IV. This SOW establishes the contractor tasks for the design, modification, installation, Interim Contractor Support, Provisioned Item Orders, and test of the following devices:

a. The CH-53E WST, device 2F174 SN 2, located at MCAS Miramar, California.

b. The CH-53E APT, device 2F190 SN 2, located at MCAS Miramar. California.

c. The CH-53E Flight Training Device (FTD), device 2F239 SN 1, located at Joint Base

McGuire-Dix-Lakehurst (JB MDL) in Trenton, New Jersey.

Definitions of terms applicable to this SOW are included in Appendix A.

2. APPLICABLE DOCUMENTS

The following documents of the issue listed form a part of this SOW to the extent specified herein. In the event of a conflict between documents referenced herein and the contents of this SOW, the contents of this SOW take precedence. Nothing in this SOW, however, supersedes applicable laws and regulations, unless a specific exemption has been obtained.

2.1 Government Documents

SPECIFICATIONS:

Naval Air Warfare Center Training Systems Division (NAWCTSD)

PRF 210004

- Performance Specification For USMC CH-53E FY-22 Modernization Program, dated 9 April 2021

STANDARD PRACTICES:

Department of Defense (DoD)

MIL-STD-881E

MIL-STD -882E

Work Breakdown Structures for Defense Materiel Items Standard Practice for System Safety

(Copies of these documents are available online at http://quicksearch.dla.mil, or from the Standardization Document Order Desk, 700 Robbins Avenue, Building 4D, Philadelphia, PA 19111-5094.)

OTHER PUBLICATIONS:

Aircraft Technical Directives

H53-AFC-549 Rev A - H-53 Airframe Change (AFC) No. 549 Revision A for AN/ARC-210 SATCOM radio, dated 27 March 2013 http://quicksearch.dla.mil/

H53-AFC-555 Rev A - H-53 Airframe Change (AFC) No. 555 Revision A for the Helicopter Emergency Egress Lighting System (HEELS), dated 22 August 2012

H53-AFC-595 Rev A - H-53 Airframe Change (AFC) No. 595 Revision A for the Fire Warning Test, dated 02 May 2019

H53-AFC-597

- H-53 Airframe Change (AFC) No. 597 Technical Directive for the T5 Power Inlet Temperature Indicator, dated 07 November 2018

H53-AFC-601 - H-53 Airframe Change (AFC) No. 601 for the Radar Signal Detecting Set AN/APR-39D(V)2, dated 25 Nov

H53-AFC-XXX - H-53 Airframe Change (AFC) No. XXX for AN/ARC- 210 SATCOM radio, dated 04 Oct 2020

H53-ASC-029 - H-53 Airborne Software Change (ASC) No. 29 for the Integrated Mechanical Diagnostic System (IMDS), dated 27 may 2020.

H53-AVC-5838 - H-53 Avionics Change (AVC) No. 5838 for the Direct Infrared Countermeasures AN/AAQ-24B(V)25, dated 26 August 2019

H53-CSC-201-P6 - H-53 Commodity Software Change (CSC) No. 201-P6 for the Airborne Countermeasure Dispenser System

AN/ALE-47.

(The above documents will be provided as GFI)

Code of Federal Regulations (CFR)

29 CFR 1910.147

29 CFR 1915.81

29 CFR 1926.416

The control of hazardous energy (lockout/tagout) Housekeeping General Requirements

(OSHA regulations are downloadable from https://www.osha.gov/law-regs.html)

Department of Defense (DoD) Handbooks MIL-HDBK-217F, Notice 2 - Reliability Prediction of Electronic Equipment MIL-HDBK-472, Notice 2 - Maintainability Prediction (Copies of the above handbooks are available at http://quicksearch.dla.mil, or from the Standardization Document Order Desk, 700 Robbins Ave., Bldg 4D, Philadelphia, PA 19111-5094.)

DoD and Department of the Navy (DoN) Security and Cybersecurity Documents DoDI 8510.01 - Risk Management Framework (RMF) for DoD

Information Technology (IT) – Incorporating Change 2, dated 28 July 2017

CNSS Instruction No. 1253 - Security Categorization and Control Selection for National Security Systems, dated 27 March 2014

NIST SP 800-53 Revision 5 - Security and Privacy Controls for Federal Information Systems and Organizations, dated September 2020

NIST SP 800-131A Revision 2 - Transitioning the Use of Cryptographic Algorithms and Key Lengths, dated March 2019 https://www.osha.gov/law-regs.html http://quicksearch.dla.mil/

NIST SP 800-171 - Protecting Controller Unclassified Information in Nonfederal Information Systems and Organizations

NIST SP 800-147B - BIOS Protection Guidelines for Servers, dated August

DoDI 8520.02 - Public Key Infrastructure (PKI) and Public Key (PK) Enabling, dated 24 May 2011

DoD 8570.01-M - Information Assurance Workforce Improvement Program, dated 19 Dec 2005 (w/CH4 of 10 Nov 2015)

ISO/IEC 11889-1:2015 - Information Technology – Trusted Platform Module – Part 1: Overview, First Edition 15 May 2015

ISO/IEC 11889-2:2015 - Information Technology – Trusted Platform Module – Part 2: Design Principles, First Edition 15 May 2015

ISO/IEC 11889-3:2015 - Information Technology – Trusted Platform Module – Part 3: Structures, First Edition 15 May 2015

ISO/IEC 11889-4:2015 - Information Technology – Trusted Platform Module – Part 4: Commands, First Edition 15 May 2015

DoD Manuals DoD 5010-12M - Procedures for Acquisition Management of

Technical Data The above publication is available at http://www.dtic.mil/whs/directives/corres/pdf/501012m.pdf

TMCR 20-15 - Technical Manual Contract Requirements

TDPCR 20-07 - Technical Data Package Contract Requirements

Operational Naval Instructions (OPNAVINST)

OPNAVINST 3750.6S - Naval Aviation Safety Management System

OPNAVINST 11010.20H - Navy Facilities Projects

Available: http://doni.daps.dla.mil

NAVAIR Instructions NAVAIRINST 3960.4D - Project Test Plan Policy For Testing Air Vehicles, Air

Vehicle Weapons, and Air Vehicle Installed Systems, NAVAIRINST 4355.19E - Systems Engineering Technical Review Process, dated

6 Feb 2015 NAVAIRINST 5000.21B - Naval Syscom Risk Management Policy

(NAVAIR Instructions are downloadable from https://directives.navair.navy.mil)

United States (U.S.) Code Title 10, Section 2451 - 2456 - Defense Standardization Program (U.S Code is downloadable from http://uscode.house.gov/search/criteria.shtml) https://directives.navair.navy.mil/ http://uscode.house.gov/search/criteria.shtml

US Army Corp of Engineers EM-385-1-1 - Manual EM 385-1-1 – Safety and Health Requirements (EM 385-1-1 is downloadable from http://140.194.76.129/publications/eng-manuals/em385-1- 1/2003_English/toc.htm)

DoD Unified Facilities Criteria Program UFC 1-200-01 DoD Building Code UFC 3-501-01 Electrical Engineering UFC 3-600-01 Fire Protection Engineering for Facilities UCF 4-010-01 Minimum Antiterrorism Standard for Buildings (UFC is available from: http://www.wbdg.org/references/pa_dod.php)

2.2 Non-Government Documents

INDUSTRY STANDARDS

American National Standards Institute (ANSI)/American Society for Quality (ASQ)/ International Organization for Standardization (ISO)

ANSI/ASQ/ISO Q9000-2015 - Quality Management Systems - Fundamentals and Vocabulary

ANSI/ASQ/ISO Q9001-2015 - Quality Management Systems - Requirements ANSI/ASQ/ISO Q9004-2009 - Quality Management Systems - Guidelines for

Performance Improvements (Copies of the above documents are available from www.ansi.org)

ANSI/Institute of Electrical and Electronics Engineers (IEEE)

ANSI/IEEE 1008-

1993IEEE_Std_1008_1997_R2 003_IEEE_Std_1008_1997_R2 003_

- IEEE Standard for Software Unit Testing

IEEE 12207-2017, 2nd Edition - Systems and Software Engineering – Software Life Cycle Processes

IEEE 15288-2015, 1st Edition - Systems and Software Engineering – System Life Cycle Processes

IEEE 15939-2017 - Adoption of ISO/IEC 15939:2017- Systems and Software Engineering - Measurement Process

IEEE 29148-2018 - Systems and Software Engineering Life Cycle Processes Requirements Engineering

(Copies of this document are available from www.ieee.org or IEEE Service Center, 445 Hoes Lane, Piscataway, NJ 08854-1331.)

National Fire Protection Association (NFPA) NFPA 13 - Standard for the Installation of Sprinkler Systems, 2010

Edition NFPA 25 - Standard for the Inspection, Testing, and Maintenance of

Water-Based Fire Protection Systems, 2011 Edition NFPA 70 - 2017 National Electrical Code® NFPA 70E - Standard for Electrical Safety in the Workplace, 2012

Edition http://140.194.76.129/publications/eng-manuals/em385-1-1/2003_English/toc.htm http://140.194.76.129/publications/eng-manuals/em385-1-1/2003_English/toc.htm http://www.wbdg.org/references/pa_dod.php http://www.ansi.org/ http://www.ieee.org/

NFPA 75

NFPA 90A

Standard for the Fire Protection of Information Standard for the Installation of Air Conditioning and Ventilating Systems

NFPA 101 - Life Safety Code, 2012 Edition NFPA 2001 - Standard for Clean Agent Fire Extinguishing Systems, 2012 Edition (Copies of this document are available from www.NFPA.org)

SAE International/Electronic Industries Alliance (EIA)

SAE/EIA-649-1 2014 - Configuration Management Requirements for Defense Contracts

(Copies of the above document are available from www.ansi.org)

3. REQUIREMENTS

3.1 General

3.1.1 Program Management

The contractor shall organize, coordinate, and control the program activities to ensure compliance with the contractual requirements and the timely delivery of the required product and services. The contractor shall provide program management, systems engineering, materials, services, equipment, facilities, testing, technical, logistics, manufacturing, and clerical support for the efforts described in this SOW and PRF 210004. The contractor shall measure, record, monitor, and evaluate the progress of the work performed and costs incurred under this SOW.

The contractor shall prepare the Contractor’s Progress, Status, and Management Report (CPSMR) in accordance with (IAW) the Contract Data Requirements List (CDRL) B001.

Program Planning The contractor shall perform program planning processes IAW section 6.3.1.3 of IEEE 12207- 2017.

a. The contractor shall develop, document, manage, and apply an Integrated Master Schedule (IMS) that presents the contractor’s and subcontractor’s plans and schedules to meet the applicable terms and conditions.

b. The contractor shall develop and document a scheduling system showing the program milestones, prerequisite events, critical paths, conferences, reviews, data submittals, and deliveries.

c. The contractor shall construct the IMS to ensure that the program milestones are met and to ensure that the deliveries meet the contractual requirements.

d. The contractor shall perform analyses of the IMS tasks, compare the IMS tasks to the schedule baseline, report potential or existing problem areas, and recommend corrective actions to eliminate or reduce schedule impact.

e. The contractor shall use the IMS as a day-to-day execution tool and to periodically assess progress in meeting program requirements. The contractor shall prepare the IMS as part of the Integrated Program Management Data and Analysis Report (IPMDAR) IAW

CDRL B002.

http://www.nfpa.org/ http://www.ansi.org/

Life Cycle Model Management The contractor shall perform life cycle model management at the program level IAW the organizational implementation standards in section 6.2.1 of IEEE 12207-2017.

Infrastructure Management The contractor shall perform infrastructure management at the program level IAW the organizational implementation standards in section 6.2.2 of IEEE 12207-2017.

Program Assessment and Control The contractor shall define, document, manage, and apply program assessment and control IAW section 6.3.2 of IEEE 12207-2017.

Program Decision Management The contractor shall define, document, manage, and apply a program decision management process IAW section 6.3.3 of IEEE 12207-20.

Work Planning and Scheduling The contractor shall develop, implement, control, and maintain an IMS—updated, statused, and reported monthly—which presents the contractor’s plans and schedules to meet the contractual requirements. The contractor shall document the planning and scheduling effort, related Government responsibilities, and the interaction for the efforts required for development and delivery of the training products. The contractor shall develop and document a scheduling system showing program milestones and prerequisite events, conferences, reviews, data submittals, Government trainers down time, Government facility readiness dates, and deliveries.

The contractor shall integrate all required deliverables and subcontractor schedules into the contractor’s IMS. The contractor shall construct the IMS to ensure that the program milestones are met and to ensure that all deliveries meet the contractual requirements. Contractor schedule information delivered to the Government or presented at program reviews shall originate from the IMS. The contractor shall perform analyses of the IMS tasks, compare the IMS tasks to the schedule baseline, report potential or existing problem areas, and recommend corrective actions to eliminate or reduce schedule impact. The contractor shall revise the IMS to reflect requirement changes that occur during the course of performance. The contractor shall use the IMS as a day-to-day execution tool and to periodically assess progress in meeting program requirements.

Subcontractor Management and Reporting The contractor shall manage all subcontracts, including those for a firm-fixed-price (FFP). The contractor shall ensure the timely award of applicable subcontracts and the integration of the every subcontractor’s plans into the appropriate schedules with sufficient detail. The contractor shall monitor each subcontractor’s staffing plans, including the execution of those staffing plans at the required levels with the required skills. The contractor shall reserve the right for itself and the Government to send personnel into the subcontractor’s facilities to monitor and evaluate subcontracted activities. The contractor shall ensure that the subcontractor’s efforts are accomplished per the contractual requirements, including the requirements for technical, quality, configuration management, and risk processes.

Integrated Product Team (IPT) The contractor shall define, document, implement, and maintain an IPT structure throughout the entire course of performance. The contractor shall comprise the IPT’s membership of multi-functional stakeholders that meet and work together with a product-oriented focus. The contractor should empower the IPT, including any sub-IPTs (e.g., for logistics or engineering), to make minor life cycle decisions regarding each product or process within the given IPT’s purview. The contractor shall defer decisions on all other matters to Government Program Management with recommendations. The contractor shall apply IPTs at various levels, ranging from the overall structure of an organization to informal groups functioning across existing units.

With Government input, the contractor shall define and document the composition, structure, roles, and responsibilities of each IPT. The contractor shall maintain a list of membership for every IPT established. The contractor shall ensure that each IPT (1) consists of Government, contractor, and any applicable subcontractor personnel and (2) has Government and contractor co-chairs.

Risk Management The contractor shall perform the following:

a. Conduct risk management reviews to allow program systematic control of the uncertainty in the project’s ability to meet cost, schedule, and performance requirements.

b. Provide the Government visibility into the contractor’s tools, assessment, mitigation, and control techniques.

c. Perform risk management activities and tasks as specified in section 6.3.4.3 of IEEE 15288-2015, 1st Edition.

d. Participate in the Government Risk Working Group established for the program.

e. Present and discuss the status of risk items during all scheduled conferences and reviews using the 5x5 risk cube described in enclosure (1) of NAVAIRINST 5000.21B.

f. The contractor shall report risk information, data, and analysis in the CPSMR cited in paragraph 3.1.1 above.

Quality Management The contractor shall define, document, manage, and apply a quality management process IAW sections 6.2.5 and 6.3.8 of IEEE 12207-2017 and ANSI/ASQ/ISO Q9001-2015 (equivalent quality management system). The contractor may use ANSI/ASQ/ISO Q9000-2015 and ANSI/ASQ/ISO Q9004-2009 for guidance.

Control of Government-Furnished Equipment (GFE) The contractor shall perform the following tasks to control GFE as part of the quality management process:

a. Examine upon receipt, consistent with practicality, to detect damage

b. Provide storage that precludes deterioration

c. Examine prior to installation, consistent with practicality, to detect damage

d. Identify and protect from improper use or disposition

e. Verify and audit quantity periodically

f. Document and inspect for software and configuration

g. Periodic inspection and precautions to assure adequate storage conditions to guard against damage from handling and deterioration during storage

h. Functional testing shall be performed prior to installation to determine satisfactory operation

GFE Tracking and Reporting Requirements

The contractor shall update their GFE tracking system when GFE location changes to reflect the new location and the reason for the change in location. If GFE is moved off-site the contractor shall complete a DD-1149 and provide a copy to the Deputy Assistant Program Manager for Logistics (DAPML). The GFE tracking system shall include at a minimum for each piece of GFE following:

a. Device the GFE is installed on or, if not installed, its physical location.

b. Part Number

c. Serial Number

d. Hardware Configuration

e. Software configuration

f. Date GFE received

g. Date GFE shipped

h. Reason for shipment

Use of Contractor’s Inspection Equipment

The contractor shall make measuring and testing devices available for use by the Government when required to determine conformance with the contractual requirements. The contractor shall provide the personnel needed to operate such devices and to verify current calibration, accuracy, and appropriate working condition.

Configuration Management (CM) The contractor shall define, document, manage, and apply a CM process IAW section 6.3.5 of IEEE 12207-2017 and SAE/EIA-649-1 2014. The contractor shall place Government-Furnished Software (GFS), Non-Developmental Items (NDI), Commercial Item software, and each item’s associated documentation under CM upon receipt. The contractor shall place commercial software items under CM as “disk image” files of the physical media. The CM process shall be maintained throughout the Test and Evaluation (T&E) periods to distinguish between different test load versions under test as well as more formal deliveries.

Change Management The contractor shall define, document, manage, and apply a process to accomplish change management. The contractor shall request changes to an approved baseline, to include pertinent design changes made after Critical Design Review (CDR), by submitting an Engineering Change Proposal (ECP) or a Request for Variance (RFV). The contractor shall prepare RFVs IAW CDRLs A007, G007, and N007, respectively. The contractor shall prepare ECPs IAW CDRLs A008, G008, and N008, respectively.

Configuration Status Accounting The contractor shall define, document, manage, and apply a process to accomplish configuration status accounting. The contractor shall identify and document all items incorporated into or deleted from the training device during development and modification. Documentation will include traceability and concurrence with the Requirements Verification Traceability Matrix (RVTM) and the ECP CDRL. The contractor shall prepare the supplier’s Configuration Management Plan IAW CDRL B007. The contractor shall prepare the Training Device Interim Support Report (TDISR) IAW CDRLs R002, X002, and AD02, respectively.

Configuration Audits The contractor shall define, document, manage, and apply a process to accomplish configuration audits. The contractor shall conduct and participate in the Functional and Physical Configuration Audits (FCA and PCA), as specified in paragraphs 3.2.10.15.1.1.4 and 3.2.10.15.1.2.

Information Management The contractor shall define, document, manage, and apply an information management process IAW section 6.3.6 of IEEE 12207-2017. The contractor shall include the status of technical data deliveries in the CPSMR cited above in paragraph 3.1.1.

Online Information Exchange The contractor shall provide the contractually required documents, data, and information IAW the CDRLs via a site that meets current Federal Government, Navy, and NAWCTSD Information Assurance standards when a given CDRL requires such deliveries. The agreed to means for delivery shall be determined by the IPT with final approval by the Government. The contractor shall notify the Government team via email upon each posting of new or changed contractual documents, data, and information. Only unclassified data shall be posted.

Data Management The contractor shall develop, manage, and implement a data management process for data deliverables. The contractor shall establish and implement procedures to manage the configuration of contractually required data, including data provided by subcontractors. The contractor may use DoD 5010-12M as guidance during the preparation of the CDRL items. The contractor can obtain copies of the Data Item Descriptions (DIDs) cited in the CDRL items from the following web site: http://quicksearch.dla.mil/qsSearch.aspx. The contractor shall ensure that all data item deliverables are delivered without read-write restrictions and with password protection.

Program Measurement The contractor shall define, document, manage and apply a process to collect, analyze, track, and report a balanced and diverse set of measures and metrics IAW section 6.3.7 of IEEE 12207- 2017 and IEEE 15939-2017, incorporating inputs from Government IPT members as necessary.

a. The contractor shall provide program-related measures and metrics that reflect schedule, cost, quality, staffing, product stability, requirements volatility, and complexity information.

http://quicksearch.dla.mil/qsSearch.aspx

b. The contractor shall incorporate into the overall process software specific measures and metrics related to schedule, quality, staffing, build stability, size, requirements volatility, and resource utilization.

c. The contractor shall track, measure, and analyze metrics data over time to report trends.

d. The contractor shall identify and define bounding criteria associated with each metric.

e. The contractor shall implement corrective action when a metric deviates from the defined bounding criteria.

f. The contractor shall report metrics data and analysis in the CPSMR cited above in paragraph 3.1.1.

3.1.2 Security

The security requirements specified herein shall apply to the contractor and subcontractors. The contractor shall comply with applicable on-site security regulations related to government installation and facility access. All Contractor personnel shall maintain security clearance eligibility commensurate with the level of classification of the work performed as annotated in the Contract's DD-254, Contract Security Classification Specification Form.

Classified Processing and Access to Classified Systems The contractor shall comply with security requirements specified in the DD-254 attached to this contract. Information or data that the contractor accesses shall be handled at the appropriate classification level. Unclassified information shall be handled in accordance with the appropriate designation (Controlled Unclassified Information; Legacy FOUO; Covered Defense Information). Distribution is authorized to the Requiring Office's Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the TPOC of this contract for approval.

Controlled Unclassified Information including Legacy FOUO and Covered Defense Information (meeting the definition of 48 CFR 252.204–7012(a)) generated and/or provided under this contract shall be marked and safeguarded as specified in DoD Instruction 5200.48, Controlled Unclassified Information (CUI). available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF. Any product containing Covered Defense Information shall be assigned a distribution statement (distribution statements B through F) using the criteria set forth in DoDI 5230.24 (Distribution Statements on Technical Documents); and have this statement displayed per DoDI 5230.24, Enclosure 3.

Any controlled unclassified information pertaining to this contract shall not be released for public dissemination, including posting to any social media sites such as Facebook or Twitter, unless it has been approved for public release by appropriate U.S. government authority.

Proposed public releases shall be submitted in accordance with the DD-254 attached to this contract for approval prior to release through PEO (T), Public Affairs Office, 47123 Buse Road, RADM William A. Moffett Building, Patuxent River, MD 20670-1547 and include the completed NAVAIR FORM 5720.10. Technical Documents shall have this statement displayed per DoDI 5230.24, Enclosure 3.

Operations Security (OPSEC) The Contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the Contractor and any subcontractor during performance of the contract. The Contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. This program may include Information Assurance and Communications Security (COMSEC). The OPSEC program shall be in accordance with National Security Decision Directive (NSDD) 298, and at a minimum shall include as outlined in the 2013 OPSEC Annex in the DD254:

a. Assignment of responsibility for OPSEC direction and implementation.

b. Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

c. Establishment of OPSEC education and awareness training.

d. Provisions for management, annual review, and evaluation of OPSEC programs.

e. Flow down of OPSEC requirements to subcontractors when applicable.

While performing aboard USG, NAVAIR or NAWC sites, the contractor shall comply with facility OPSEC program instructions and contribute to organization-level OPSEC efforts.

Include OPSEC as part of its ongoing security awareness program and take all required Agency training. Be responsive to the Supporting OPSEC Manager on a non-interference basis. Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the RO and contractor in support of the mission.

Unclassified Contractor-Owned Network Security - Safeguarding of Unclassified Controlled Technical Information

The safeguarding of Controlled Unclassified Technical Information applies to prime contractors and their subcontractors (if applicable) for information resident on or transiting through contractor unclassified information systems. The contractor shall provide security to safeguard unclassified controlled technical information on their unclassified information systems from unauthorized access and disclosure. The contractor shall take means (defense-in-depth measures) necessary to protect the confidentiality, integrity, and availability of Government CUI.

a. The security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations,” http://dx.doi.org/10.6028/NIST.SP.800-171, that is in effect at the time the solicitation is issued or as authorized by the Procurement Contracting Officer (PCO), as soon as practical, but not later than December 31, 2017. The contractor shall manage and http://dx.doi.org/10.6028/NIST.SP.800-171 maintain contractor-owned unclassified IT network assets used to process U.S.

Government CUI (sensitive information) IAW DFARS 252.204-7012.

b. The Contractor shall implement NIST SP 800-171, as soon as practical, but not later than December 31, 2017. For all contracts awarded prior to October 1, 2017, the Contractor shall notify the IPT ISSO or Deputy USMC ISSM via e-mail.

c. Alternative but equally effective security measures used to compensate for the inability to satisfy a particular requirement and achieve equivalent protection accepted in writing by an authorized representative of the DoD CIO

d. Apply other information systems security measures when the contractor reasonably determines that information systems security measures, in addition to those identified in paragraph (b)(1) of DFARS 252.204-7012, may be required to provide adequate security in a dynamic environment based on an assessed risk or vulnerability

Cyber Incident and Compromise Reporting The contractor shall report to DoD certain cyber incidents that affect unclassified controlled technical information resident on or transiting contractor unclassified information systems set forth IAW DFARS 252.204-7012. The contractor shall also provide the report to the NAWCTSD Contracting Officer, NAWCTSD Security Manager, and the NAWCTSD Information Systems Security Manager (ISSM).

Access to DoD Installations, Government Information, and Information Technology (IT) Systems - Personnel Security Background Checks

a. The Common Access Card (CAC) shall be the principal identity credential for supporting interoperable access to DoD installations and access to U.S. Government information systems IAW FAR 52.204-9. The Defense Biometric Identification System (DBIDS) shall be used for contractors and vendors who do not have a CAC, but only requires access to a base/installation Navy command. The contractor shall first coordinate with the appropriate NAWCTSD Contracting Officer Representative, Technical Point of Contact, or government sponsor to request an application to be process through the NAWCTSD Security Office Trusted Agents for issuance of the CAC or via the Trusted Associate Sponsorship System. The base Visitor Control Center representative will process request for installation access using the DBIDS. More information for obtaining the CAC can be found at http://www.cac.mil/common-access-card/getting-your-cac/for-contractors/ and for DBIDS at https://www.cnic.navy.mil/om/dbids.html.

b. Contractor personnel whom do not have a security clearance but require a CAC in performance of their sensitive duties (including access to CUI, but no access classified information) shall coordinate with the NAWCTSD Security Office to complete a National Agency Check with Local Agency Checks, including a Credit Check (NACLC/TIER- 3) background investigation, which requires the submission of fingerprints and the Standard Form SF-86 (Questionnaire for National Security Positions). The contractor shall submit the Standard Form 86 to the NAWCTSD Security Office for processing. There shall be no additional NACLC/TIER-3 submissions for contractors holding a valid national security clearance. The Government may issue the credential upon favorable return of the Federal Bureau of Investigations (FBI) fingerprint check, pending final favorable completion of the NACLC/TIER-3.

http://www.cac.mil/common-access-card/getting-your-cac/for-contractors/ https://www.cnic.navy.mil/om/dbids.html

c. Access to restricted areas, CUI, or Government Information Technology by contractor personnel shall be limited to those individuals who have been determined trustworthy as a result of the favorable completion of a NACLC/TIER-3 or who are under the escort of appropriately cleared personnel. Where escorting such persons is not feasible, a NACLC/TIER 3 shall be conducted and favorably reviewed by the appropriate DoD component, agency, or activity prior to permitting such access.

d. The contractor shall comply with the Cybersecurity and personnel security requirements for accessing U.S. Government IT systems specified in the applicable terms and conditions. The contractor shall review and become familiar with the credentialing standards presented in OPM Memorandum for Issuing Personal Identity Verification Cards to use as an aid in their employee selection process. The NAWCTSD Security Office will apply the credentialing standards and execute the credentialing process for individual contractors.

Personnel Security – Background Checks Contractor personnel shall undergo the company internal vetting process prior to gaining access to Government CUI. To comply with immigration law, the contractor shall use the Employment Eligibility Verification Program (E-Verify) IAW FAR 52.222-54.

International Traffic and Arms Regulation The contractor shall ensure that foreign persons, as defined under section 120.16 of the International Traffic and Arms Regulation (ITAR) 22 CFR, Parts 120 through 130, are not given access to U.S. Government CUI, sensitive information, defense articles, defense services, or technical data, as defined in the ITAR, Part 120, without proper issuance of an export license from the U.S. Government authority.

Personnel Security – Reporting of Adverse or Derogatory Information related to Contractors

The contractor shall report to the NAWCTSD Security Office adverse or derogatory information pertaining to on-site Contractor Support Services (CSS) personnel (when applicable) or contractor personnel in direct support of this SOW. Information reported to the Government Contracting Agency shall be integrated and reported in Contractor Performance Assessment Reporting System (CPARS) on contractor performance of PERsonnel SECurity (PERSEC) related aspects of contractor performance.

a. Adverse or derogatory information reporting of contractor personnel. Example: Domestic Violence arrest or other violent or sexual crime arrest or self-report.

b. When contractor personnel receive a revocation of an Interim or denial for the issuance of a CAC until final adjudication

c. When a denial or suspension of clearance occurs for a contractor employee

d. When contractor employee receives a final denial of eligibility for a security clearance.

Government-Issued Personal Identification Credentials The contractor and subcontractors working for the contractor shall account for all forms of U.S Government-provided identification credentials (CAC or U.S. Government-issued identification badges) issued to the contractor (or contractor employees) in connection with performance under this SOW. The contracting officer may delay final payment under the contract vehicle if the contractor or subcontractor fails to comply with the requirements of this paragraph. The contractor shall return such identification credentials to the issuing agency at the earliest of any of the circumstances listed below unless otherwise authorized by the U.S. Government:

a. When no longer needed for the performance of this SOW.

b. Upon the completion of employee’s employment with the contractor or a subcontractor.

c. Upon the contract vehicle’s completion or termination.

Contractor “Out-processing” Policy The contractor and subcontractors working for the contractor shall have in place (established and enforced) an “out-processing” policy for employees that leave the company, including suspension of account access, return of all PCs, laptops, smartphones, and other electronic devices (Government-furnished IT equipment and contractor-issued IT equipment) that contain U.S. Government CUI. The contractor shall also ensure that out-processed employees receive debriefings on the need to maintain confidentiality of U.S. Government CUI.

Supply Chain Risk Management (SCRM) For National Security Systems The contractor shall mitigate supply chain risk in the provision of supplies and services to the Government per DFARS 252.239-7018, Supply Chain Risk, and Committee on National Security Standards (CNSSD) 505, Supply Chain Risk Management (SCRM). The contractor shall implement a process for managing supply chain risk by identifying susceptibilities, vulnerabilities, and threats throughout the supply chain and developing mitigation strategies to combat those threats whether presented by the supplier, the supplied product and its subcomponents, or the supply chain (e.g., initial production, packaging, handling, storage, transport, mission operation, and disposal).

Protection of Critical Program Information (CPI)

a. When applicable, the contractor shall identify candidate CPI and Resident CPI, which requires protection IAW NIST SP 800-53 Revision 5. The CPI identified shall be approved by the U.S. Government Program Manager. The CPI identification shall include a review of the system, unique integration, support equipment, and the Non- Resident design/process/material aspects of the program. All identified CPI shall be protected with appropriate countermeasures.

b. When applicable, the contractor shall develop a Program Protection Implementation Plan (PPIP) to include all requirements outlined in the Government provided Program Protection Plan (PPP). The PPIP shall be used as a focal point for the contractor’s Program Security efforts. The PPIP is derived from the PPP and should not restate what is written in the PPP but rather address specifically how the contractor will implement Program Protection.