SOW_for_PE00_IA_C-A_Base_plus_2_option_years.docx

1.0 INTRODUCTION

Naval Surface Warfare Center Corona (NSWC, Corona), Product Engineering Department (PE) Code PE00, requires a Firm Fixed Price (FFP) contract for Information Assurance (IA) Certification and Accreditation (C&A) support and advanced systems support training services. PE requires a 12 month contract with two (2) option years.

2.0 BACKGROUND

PE00 has a requirement to maintain its Information Assurance (IA) Certification and Accreditation (C&A) status on up to four systems. Each system is at a different stage in its C&A lifecycle, ranging from full C&A package development to system maintenance as defined in the DODI 8510.01. PE00 requires independent validation services to ensure proper security baselines are adequate per guidance. PE00 also has a requirement for its systems managers to participate in continuous learning training in advanced systems support, to maintain their IA certifications. The required training will satisfy qualification for certification requirements. In order to meet these requirements, PE00 requires IA C&A support and advanced systems training services listed in this Statement of Work (SOW).

3.0 SCOPE

The scope of this work is for system security validation and Tier 2 Security Engineering support for each of PE’s four IT systems and advanced systems training for its Information Assurance workforce and certifiers.

4.0 APPLICABLE DIRECTIVES/DOCUMENTS

Federal Standards: The Contractor is required to adhere to all applicable standards and guidelines specified in the basic contract. In the absence of named standards, Department of the Navy (DON) standards, applicable Federal Information Processing Standards (FIPS), and broadly accepted professional standards shall prevail as related to the associated industries within the task identified in this Section. The most current version of all documents applies through life of this contract.

5.0 GENERAL REQUIREMENTS

The Contractor shall provide IA C&A support to NSWC Corona in all areas of engineering, technical, information assurance and data management capabilities executed by the PE Department. These tasks will include collection and distribution of data, operation and certification of PE IT systems, and advanced systems training.

The Contractor shall provide rapid startup of assigned tasking to address critical issues relating to Department of Defense (DOD) policy.

5.1 PERFORMANCE REQUIREMENTS

The contractor shall perform the following in order to achieve the outcomes desired by the government under this contract.

5.1.1 Engineering Technical Support (CLIN 0001)

A. Provide system integration, installation, and de-installation of unclassified and classified systems supported by the PE Department. The systems will include: Gage Design and Certification (GD&C); Trident Surveillance Systems (TSL) unclassified and classified; and Engineering and Calibration Component System (ECCS). These tasks will include:

1. Operate and maintain unclassified/classified enclaves

2. Test the operational functionality of the systems during schedule routine maintenances

3. Perform on-site operational testing on systems

4. Conduct system and equipment level tests to ensure operability prior to deployment B. Provide information system management (10 test events annually) which includes the following:

1. Operate and maintain unclassified/classified enclaves by establishing system reviews of new operating system releases

2. Install software updates

3. Perform system upgrades These services are to be provided at:

NSWC Corona NSWC Corona, Seal Beach C. Provide development of 4 documentation packages annually to include:

1. Generate Information Assurance (IA) and Certification and Accreditation (C&A) documentation ( 4 packages annually) D. Perform system maintenance to include the following on the systems (3 times annually):

1. Update and maintain computer security devices such as anti-virus servers, log servers, and Network intrusion detection devices.

E. Develop and submit Information Assurance (IA) Strategy for IA compliance, to gain and maintain Authority to Operate (ATO), for all devices owned and supported by the customer, both at NSWC Corona and at NSWC Corona, Seal Beach (4 systems annually):

1. Make recommendations and provide guidance based on DoD Information Assurance standards in order to meet IA compliance for system engineering activities.

2. Ensure Certification and Accreditation (C&A) and IA compliance in accordance with the current Department of Defense (DOD) and Department of the Navy (DON) IT instructions and policies for all IT devices owned and supported by the customer.

3. Perform the creation, maintenance, updating, and revising of all documentation required by the cognizant Designated Approving Authority (DAA) for all PE systems, during their life cycle. Perform all steps stipulated in DOD and DON instructions and from collaboration meetings and reviews to coordinate and ensure PE systems are accredited in accordance with current DoD and DON policies. All C&A documents will be turned over to the customer.

4. Maintain all collaboration meeting minutes, agendas, and action items.

5. Serve as a Navy Certification Agent and have a current appointment by the Navy Certifying Authority as a Fully Qualified Navy Certification Agent.

6. Meet the Fully Qualified Level requirements for Navy Certification Agent and represent customer C&A packages as a validator to the cognizant DAA, ODAA, Echelon Command, and Certification Authority (CA).

7. Perform vulnerability tests, scans, patches, security assessments, and remediation on systems for PE systems to maintain DOD and DON IT compliance as systems go through upgrades and throughout the lifecycle of systems.

8. Perform the creation and maintenance of Plan of Action & Milestones (POA&Ms) in the event the systems exhibit open findings. Assist with the production of a remediation POA&M in coordination with the local IA Officer, Project Leads, and System Administrators.

9. Provide summary data, status reports, and graphs for internal and external IA compliance and technical information gathering that result from data calls given by the Command.

10. Prepare the responses to various IA audits and security inspection questions. Be present during audits and act as technical liaison for audit team(s) to obtain passing and satisfactory audit results in the IA compliance area.

11. Attend weekly IA meetings and specific program meetings.

12. Upload C&A scans into VMS (Vulnerability Management System).

13. Develop POA&Ms in VMS for DISA (Defense Information Systems Agency) acceptance of risks.

14. Upload and process C&A packages in eMASS or current Navy system.

5.1.2. TRAINING

The contractor shall provide advanced systems training that will satisfy qualification certification requirements, allowing PE personnel to obtain and/or maintain their qualification for IA certifications.

A. Training: Microsoft Windows 7, MCSA (with certification exams 70-680 and 70-685). (CLIN 0002)

This training is to prepare students for on-site delivery of the following certification exams:

· Exam 70-680: Windows 7, Configuring

· Exam 70-685: Windows 7, Enterprise Desktop Support Technician.

Five-day course (8 hours/day) provided at government’s location For up to 5 trainees Provide up to 5 sets of training material compatible with MS Office 2007 applications Government retains all training material Labor, travel, lodging, rental car, training material, meals and incidentals are at contractor’s expense Proxy exams at government location

B. Training: Microsoft SQL Server 2008, MCSA (with certification exams 70-432 and 70-448)

This training is to prepare students for on-site delivery of the following certification exams:

Exam 70-432: MS SQL Server 2008, Implementation and Maintenance Exam 70-448: MS SQL Server 2008, Business Intelligence Development and Maintenance.

Seven-day course (8 hours/day) provided at government’s location For up to 3 trainees Provide up to 3 sets of training material compatible with MS Office 2007 applications Government retains all training material Labor, travel, lodging, rental car, training material, meals and incidentals are at contractor’s expense Proxy exams at government location

6.0 DELIVERABLES

Deliverables under this contract will be reviewed by the government subject matter expert and shall be provided in accordance with section F and the contract data requirements list (CDRL), DD form 1423, attachments 1-4.

7.0 GOVERNMENT FURNISHED PROPERTY (GFP)

The Government will provide up to one (1) workspace at NSWC Corona with a Naval Marine Corps Intranet (NMCI) computer. The Government will provide electronic copies of current IA related documentation for each existing system owned by PE00.

8.0 CONTRACTOR EQUIPMENT

The Contractor will be allowed to use Contractor-owned equipment at NSWC Corona sites to perform IT, IA, and C&A tasks provided the equipment is compliant with DOD and DON IA directives. The NSWC Corona IAM must approve in writing all Contractor equipment used to perform work on this Performance Work Statement (PWS). Use of e-mail request/approval is acceptable.

9.0 SECURITY

The Contractor will be required to perform the following tasks in accordance with the DD254 associated with this contract (Attachment xx):

· Transport, and/or store, classified information

· Generate classified media

The Contractor shall notify NSWC Corona if any of the limitations mentioned above need modification. Conversely, the Government will notify the Contractor when security requirements delineated in this PWS are modified.

The component parts of the IA & C&A processes are expected to contain sensitive information not cleared for public release information up to and including information at the SECRET and CNWDI SECRET level.

9.1 Security Clearances and Investigations. All personnel shall obtain and maintain background investigations and clearances appropriate to support contract performance. Clearances shall be maintained for the duration of this procurement. Personnel unable to successfully obtain or maintain an appropriate investigation or necessary clearance will immediately, upon notification from Facility Security Officer (FSO), will be expected to vacate the installation or performance location. The department manager, COR and security office will also be notified of any such vacancy.

9.1.1 The Contractor will be required to perform the following tasks in accordance with the DD254 associated with this contract (Attachment xx): Transport, or store, classified information; and generate classified media.

9.1.2 Contractors must have a Government granted facility security clearance (FCL) at a minimum of the Secret level. Access to classified material and classified information systems is required. Contractor's with an Interim security clearance will be allowed to work, but will have limited access to certain systems, data, or functions.

9.1.3 The Contractor shall notify NSWC Corona if any of the limitations mentioned above need modification. Conversely, the Government will notify the Contractor when security requirements delineated in this PWS are modified.

9.1.4 The component parts of the IA & C&A processes are expected to contain sensitive information not cleared for public release information up to and including information at the SECRET and CNWDI SECRET level.

9.2 Clearance Lists. A list of personnel and their security clearances shall be delivered to the (NSWCCORDIV) security office COR no later than 20 business days following award and shall be updated with the monthly personnel listing deliverable and when personnel changes occur.

9.2.1 Personnel Lists. Contractor will provide government a personnel list and/or in accordance with established CDRL requirements, on company letterhead signed by competent authority/manager of all (prime and sub) personnel performing (to include location) on the contract. This list will also be reconciled and forwarded to the NSWCCORDIV security office as changes occur. A preferred template example not containing PII is available from the COR or security office.

9.3 Contractors will immediately notify the COR of any subcontracting.

9.4 General Security Compliance. Contractor personnel shall comply with all DoD, DoN, NAVSEA, NSWCCORDIV, and other performance location’s security instructions, policies, procedures and guidance. These requirements apply both on and off Government property at NSWC Corona, remote sites or travel destinations, to include any established check-in / check-out procedures of personnel occupying Government facilities.

9.5 System Authorization Access Request (SAAR-N) The Contractor shall complete/sign Classified and Unclassified User Authorization Agreements as applicable, using OPNAV 5239/14 SAAR-N forms, and Privileged Access Agreements. Contractor personnel shall complete the DOD Annual Information Awareness training prior to being granted access to government IT systems and must indicate on the OPNAV 5239/14 SAAR-N, the IA training completion date. The Contractor shall submit a copy of their IA training certificates to the NSWCCORDIV COR.

9.6 Security Inspections. Security Inspections (to include Industrial) will occur a minimum of once per year. Department Manager and FSO will be informed of results. Inspections will also typically involve interaction with 2-3 contractor employees. Brief unannounced spot-checks of department occur throughout the year and are at the discretion of the government.

9. 7 Foreign Interests. Contractors with defined Foreign Interests (a Facility that is owned, controlled, or influenced by foreign interests) will ensure adherence to DoD and Navy regulations. Full disclosure to the Corona Contracting Officer, COR and security office is mandated.

9.8 Training. Personnel will participate in Annual Security Refresher Brief, New Employee Security Brief, and Annual Counter-Intelligence Brief. FSO will be given initial orientation training either in person or electronically of installation concept of operations as relative to the contract.

9.9 Emergency Management. Employees are expected to register Regional (AtHoc) Emergency Notification System. Contractors will follow Corona emergency preparedness and antiterrorism protocol during designated command emergencies and declared threat conditions.

9.10 Common Access Cards (CACs) . CAC issuance is at the discretion of the Government and will only be to personnel who meet at least one of the three following criteria:

(1) The Applicant requires access to both a DoD facility and logon access to DoD network.

Network Name = __________________________________.

(2) The Applicant will be required to travel to a foreign country as a ‘regular’ requirement of their job.

Name of Foreign Country = ______________________.

(3) The Applicant requires access to 2 or more DoD facilities, on behalf of the DoD, on a recurring basis for a period of 6 months or more. *(NOT applicable to Contractors assigned to CONUS, Hawaii and Joint Region Marianas facilities that use NCACS for base access control).

(4) The Applicant requires remote access to a DoD network that use only the CAC logon for user authentication. Network Name = ______________________________. *(NOT applicable to Contractors assigned to CONUS, Hawaii and Joint Region Marianas facilities that use NCACS for base access control).

(5) The Applicant is a Volunteer who requires frequent access to a DoD network (Applicable to Volunteers Only). Network Name = ______________________________.

9.11 Government Facilities. Access to Government facilities is at the discretion of the Government. The Government reserves the right to rescind access at any time.

In each instance when employees no longer work for a company due to circumstances favorable or unfavorable, the FSO shall ensure the prompt return of the following materials:

#1 Government-owned keys to desks, offices, etc.

#2 CAC, except for CACs issued to retired military personnel and retired civil servants on that basis.

#3 Base Passes, except for passes issued to retired military personnel and retired civil servants on that basis #4 Base stickers for the employee’s vehicle, except for stickers issued to retired military personnel and retired civil servants on that basis

#5 Government Furnished Equipment (GFE) and Government Furnished Information (GFI), with special attention to Information Technology (IT) equipment, Critical Information (CI), and Critical Program Information (CPI). In executing the provisions above, the contractor may collect the materials listed in that paragraph and return them to the custody of an appropriate Government employee or direct the contractor employee to surrender these items to the security office, whichever is appropriate to the circumstances.

9.12 Isolated Personnel Reporting. Contractor personnel traveling oversees shall contact the Antiterrorism Officer and if required, complete all mandated Foreign Travel requirements.

9.13 Information protection will occur as per any applicable governing directives.

9.14 Contractor personnel granted access to the NMCI network will be required to complete Navy Information Assurance (IA) or comparable training, at the Government’s discretion, and complete and sign appropriate IA forms required to be granted continued access to Government information technology networks. All IA security concerns will be directed to the Information Assurance Manager.

9.15 Operations Security. Background, Operations Security (OPSEC) is a process for protecting unclassified sensitive information from exploitation by an adversary. Sensitive unclassified information – which is also referred to as CI or CPI – is defined as information that is not classified but which needs to be protected from unauthorized disclosure. Examples are information labeled “For Official Use Only (FOUO),” proprietary information, contractor sensitive information, limited distribution information, and Personally Identifiable Information (PII).

9.15.1 The contractor and all subcontractors shall provide OPSEC protection for sensitive unclassified information as identified in the CI List (see below) paragraphs and CPI List, if applicable. The prime contractor and all subcontractors shall employ the countermeasures listed below in order to protect that information. Additional countermeasures may be employed as necessary. If an OPSEC Plan is provided, the contractor and all subcontractors shall comply with that plan. These OPSEC requirements will be in effect throughout the life of the procurement from award through the conclusion of services at the end of the Period of Performance (PoP) or other procurement termination. If required, the contractor and all subcontractors shall prepare an OPSEC Plan.

9.15.2 Contractor personnel shall follow OPSEC concepts and principles in the conduct of this requirement to protect CI, personnel, facilities, equipment and operations from compromise. The contractor shall consult with the COR within 5 working days of receipt of order to determine all special circumstances affecting OPSEC under this requirement. In any case where there is uncertainty or ambiguity regarding OPSEC measures, the contractor shall consult the COR as soon as possible. If the COR is unavailable, the contractor shall consult the contracting officer instead. The prime contractor and all subcontractors shall provide OPSEC protection for sensitive unclassified information and comply with all OPSEC requirements.

9.15.3 Minimum Protection Requirements for CI. CI is exempt from public release under Exemption 2 of the Freedom of Information Act (FOIA). It is designated “For Official Use Only (FOUO)” and is considered controlled unclassified information. Specific Critical Program Information, for reasons of OPSEC will not be identified to offerors prior to award. CPI will be identified to the successful offeror only after receipt of order.

9.16 Personally Identifiable Information (PII). PII will be protected in accordance with DoD and Navy directives, in such a manner as to prevent unauthorized disclosure. Email containing PII must be encrypted.

9.17 Controlled Unclassified Information (CUI): CUI is official information that requires the application of controls and protective measures for a variety of reasons and has not been approved for public release, to include technical information, proprietary data, information requiring protection under the Privacy Act of 1974, and Government-developed privileged information involving the award of contracts. CUI is a categorical designation that refers to unclassified information that does not meet the standards for National Security Classification under Executive Order(s), but is pertinent to the national interest of the United States or to the important interests of entities outside the Federal Government, and under law or policy requires protection from unauthorized disclosure, special handling safeguards, or prescribed limits on exchange or dissemination.

9.17.1 Minimum Requirements for Access to CUI: Prior to access, contractor personnel requiring access to DoN CUI or "user level access to DoN or DoD networks and information systems, system security and network defense systems, or to system resources providing visual access and/or ability to input, delete or otherwise manipulate sensitive information without controls to identify and deny sensitive information" who do not have clearance eligibility are required to submit a Questionnaire for Public Trust Positions (Standard Form 85P) through the cognizant Facility Security Officer or contractor entity representative for a suitability determination by DoN Central Adjudication Facility.

9.17.2 Minimum Protection Requirements for CUI: Contract deliverables taking the form of unclassified limited-distribution documents (FOUO), are not authorized for public release and therefore shall not be posted on a publicly accessible web server, nor electronically transmitted via electronic mail unless appropriately encrypted.

9.18 Countermeasures. Countermeasures to CI exploitation are required to negate the susceptibility of critical information to exploitation by an adversary or competitor. The contractor shall protect all CI listed in a manner appropriate to the nature of the information, including use of the necessary countermeasures as listed below applicable to specifics items.

a. Encryption of electronically-stored CI.

b. Encryption of e-mail containing CI.

c. Storage of hard copy CI, optical media and external hard drives in locked containers when not in use.

d. Transmission of CI to the minimum set of recipients with a need to know.

e. Proper marking of CI with warnings to include at a minimum “FOR OFFICIAL USE ONLY”; as appropriate to the nature of the CI it shall also be marked with “UNCLASSIFIED BUT SENSITIVE,” “PRIVACY ACT INFORMATION,” “PERSONALLY IDENTIFYING INFORMATION,” “PROTECT FROM UNAUTHORIZED DISCLOSURE” or other similar statements cautioning protection of the CI.

f. Restricting disclosure of CI at meetings and conferences (including teleconferences) to the minimum necessary to the performance of this requirement.

g. Immediate and appropriate destruction in a manner precluding reconstruction of all CI no longer needed under this requirement.

h. Restricting verbal discussion of CI to venues and circumstances that prevent the monitoring and interception of the discussion by unauthorized personnel.

i. Maintaining current, successful completion of Navy-mandated Information Assurance (IA) and OPSEC training by all personnel handling CI.

j. Refraining from the use of unencrypted cellular telephones to transmit CI.

k. Refraining from the use of foreign postal systems to ship CI.

l. Promptly retrieving documents containing CI printed on printers accessible by persons without a need to know the CI.

m. Use of cover pages or other appropriate means to prevent the viewing of CI by unauthorized persons.

n. Limiting the inclusion of CI in contract and budget documents, presentations, press releases and other publications to that which is essential to the performance of this requirement.

o. Use of protected databases and strong passwords and the protection of user identifications (UserIDs).

p. During test and evaluation events (as applicable to this requirement) practice OPSEC methodologies with respect to staging units, personnel and materials out of the observation of unauthorized persons; desensitization; and the speed of execution of the event.

9.19 Compromise. The contractor shall notify the COR, FSO, and security office immediately of all known and suspected compromises of CI, classified information, or PII. If the COR cannot be reached, the contractor shall notify the Contracting Officer (or the Command Duty Officer if after normal work hours).

9.20 FOUO. The FOUO marking is assigned to information at the time of its creation. It is not authorized as a substitute for a security classification marking but is used on official Government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA). Use of FOUO markings does not mean that the information can’t be released to the public, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

9.20.1 All UNCLASSIFIED documents created under this procurement that contain FOUO information will be marked “FOR OFFICIAL USE ONLY” on the bottom of the cover page and interior pages.

9.20.2 Classified documents containing FOUO do not require any markings on the cover of the document. However, the interior pages containing only FOUO information shall be marked at the top and bottom center with “FOR OFFICIAL USE ONLY.” Only unclassified portions containing FOUO shall be marked with “(FOUO)” immediately before each unclassified FOUO portion.

9.20.3 All FOUO information released to the contractor will be marked with the following statement prior to transfer:

THIS DOCUMENT CONTAINS INFORMATION EXEMPT FROM MANDATORY

DISCLOSURE UNDER THE FOIA. EXEMPTIONS(S) ______ APPLY.

9.20.4 Removal of the FOUO marking may be accomplished only by the originator or other competent authority. The contractor SHALL NOT REMOVE ANY FOUO MARKING WITHOUT WRITTEN AUTHORIZATION FROM NSWC CORONA OR THE AUTHOR. The Government will notify the contractor when the FOUO status is terminated.

9.20.5 The contractor is authorized to disseminate FOUO information to its employees and those having a need to know the information in order to accomplish the requirements of this procurement.

9.20.6 During working hours, reasonable steps shall be taken to minimize the risk of access to FOUO information by unauthorized personnel. FOUO information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need to know the information in order to perform the requirements of this procurement. During non-working hours, the FOUO information shall be stored in a locked desk, file cabinet, bookcase, rooms, or other lockable container or space affording reasonable protection from unauthorized disclosure.

9.20.7 FOUO information may be transmitted via US postal service first-class mail, parcel post and fourth-class mail for bulk shipments only. The contractor shall not permit FOUO information to enter foreign postal systems and parcel delivery systems.

9.20.8 When no longer needed, FOUO information shall either be returned to appropriate Government custody or destroyed in a manner precluding reconstruction of the information.

9.20.9 Electronic transmission of FOUO information (via voice, data, or facsimile transmission) shall be by approved secure communications systems (such as encryption if unclassified). If circumstances preclude the use of such a system, the contractor shall consult the COR; if the COR is not available and time requirements do not permit delay, the contractor shall consult the contracting officer.

9.21 ACCESS BRIEFINGS. FSO will provide any necessary access briefings required for contract performance (NATO, CNWDI, etc.).

9.22 CNWDI Briefing Required. The Contractor shall obtain a CNWDI briefing in order to be granted Trident classified access. Access to CNWDI information is not required for performance of this contract. However, access to the Trident classified system is required and current regulations require a CNWDI briefing prior to Trident classified access.

9.23 NATO Briefing Required. The Contractor shall obtain a NATO briefing in order to be granted SIPRNET access. Access to NATO information is not required for performance of this contract. However, access to the SIPRNET is required and current regulations require a NATO briefing prior to SIPRNET access

9.24 Couriering. FSO will provide a courier briefing to any personnel designated to courier classified material in support of contract performance. FSO will provide the NSWCCORDIV security office list of any personnel authorized (briefed) to courier classified material with applicable details (CONUS/OCONUS), clearance level, and expiration date. This list will also be reconciled and forwarded to the security office as changes occur.

9.25 Classified information performance will occur only at locations specified in the DD254.

9.26 Information Storage. Documentation, system test results and sensitive information shall be stored at NSWC Corona, remote NSWC Corona sites described in PWS Section 10.0. The Contractor shall not process or store classified information at their facility.

9.27 Non-Disclosure. The Contractor shall not disclose sensitive or proprietary information of, or in the possession of, NSWC Corona or any of its operating units. Contractor employees will be required to sign a Government provided non-disclosure agreement at contract award.

9.28 The prime contracted FSO will immediately provide the COR a copy of any DD254 subcontracting classified information performance.

10.0 ON-SITE SAFETY AWARENESS

(a) In accordance with 29 CFR 1925 Safety and Health Standards for Federal Service Contracts, the contractor company shall strictly adhere to Federal Occupational Safety and Health Administration (OSHA) Regulations, Environmental Protection Agency (EPA) Regulations, and all applicable state and local requirements. OSHA Directive CSP 03-01-003 Voluntary Protection Programs (VPP) Policies and Protection Manual defines contractors into two categories.

1) Applicable Contractor. A contractor whose employees worked at least 1,000 hours for a VPP participant in any calendar quarter within the last 12 months and are not directly supervised by the applicant/participant.

2) Nested Contractor. Reference (a) does not specifically define this term. However, in discussing injury and illness data requirements for contractors, the OSHA guidance states that “nested contractors. . . are supervised by host site management”, and “are regularly intermingled with the owner’s employees and under direct supervision by management”.

(b) In accordance with OPNAVINST 5100.23(series) and OSHA Directive CSP 03-01-003, our command is to ensure that all contractor employees have read the NSWC Corona Divisions document entitled, “Commanding Officers Occupational Safety and Health Policy Statement” and “Occupational Safety and Health Administration (OSHA) Voluntary Protection Programs (VPP) document” within 30 days of commencing performance. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Subject Matter Expert (SME) for additional assistance/options.

(c) In accordance with OPNAVINST 5100.23(series) and OSHA Directive CSP 03-01-003, our command is to ensure that all nested contractor employees completes the Voluntary Protection Program (VPP) Awareness Training within 30 days of commencing performance at NSWC Corona Division. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Subject Matter Expert (SME) for additional assistance/options.

(d) In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, the contractor company shall certify that all contractor employees have read the NSWC Corona Divisions document entitled “Commanding Officers Occupational Safety and Health Policy Statement” and “Occupational Safety and Health Administration (OSHA) Voluntary Protection Programs (VPP) document” and all nested contractor employees have taken the Voluntary Protection Program (VPP) awareness training within 30 days of commencing performance at NSWC Corona Division. This can be accomplished by sending an e-mail to their Subject Matter Expert (SME) with a copy to Environmental, Safety and Health (ESH) Program Office (Code 013) (joseph.edgman@navy.mil). The document/e-mail shall include the employees name, work site, and contract number.

(e) In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, the contractor company shall submit their OSHA 300 Logs (injury/illness rates) within 30 days of commencing performance at NSWC Corona Division to their Subject Matter Expert (SME) with a copy to Environmental, Safety and Health (ESH) Program Office for review by the ESH Manager (Code 013).

(f) In accordance with 29 CFR 1904 Standards for Recording and Reporting Occupational Injuries and Illness, the contractor shall post their OSHA 300 Logs in a conspicuous place where employee notices are posted immediately upon commencing performance and at intervals as required by CFR.

(g) In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, require Contractor Company to provide quarterly reports of recordable cases and hours worked so that site OSHA recordkeeping personnel can calculate and monitor contractor TCIR/DART rates. Only include cases and hours for work performed at the VPP participant's site.

(h) In accordance with OPNAVINST 5100.23(series) and OSHA Directive CSP 03-01-003, the applicable contractor company shall submit Total Case Incident Rate (TCIR) and Days Away, Restricted and Transfer (DART) rates for the past three years within 30 days of commencing performance at NSWC Corona Division to their subject matter expert with a copy to Environmental, Safety and Health (ESH) Program Office for review by the ESH Manager (Code 013).

(i) In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, the contractor shall report all work- related injuries/illnesses that occurred while working at NSWC Corona Division to their Subject Matter Expert (SME) and to Environmental, Safety and Health (ESH) Program Office for review by the ESH Manager (Code 013).

(j) In accordance with 29 CFR 1925 and OSHA Directive CSP 03-01-003, the contractor shall ensure that all contractor employees working at NSWC Corona Division are briefed with the applicable sections of the Safety and Occupational Health (SOH) Program Manual (NSWCCORDIVINST 5100.3(series)). This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Subject Matter Expert (SME) for additional assistance/options.

These are requirement from OSHA Code of Federal Regulations (CFR), 29 CFR 1910 Standards for General Industry, and 29 CFR 1925 Safety and Health Standards for Federal Service Contracts, and from OPNAVINST

5090.1 (series)

11.0 ON-SITE ENVIRONMENTAL AWARENESS

(a) In accordance with 29 CFR 1925 Safety and Health Standards for Federal Service Contracts, the contractor shall strictly adhere to Federal Occupational Safety and Health Administration (OSHA) Regulations, Environmental Protection Agency (EPA) Regulations, and all applicable state and local requirements.

(b) In accordance with OPNAVINST 5090.1 (series) the contractor shall ensure that each contractor employee reads the NSWC Corona Division document entitled, “Commanding Officer’s Environmental and Natural Resources Policy statement” within 30 days of commencing performance at NSWC Corona Division. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Subject Matter Expert (SME) for additional assistance/options.

(c) In accordance with OPNAVINST 5090.1 (series) the contractor shall ensure that each contractor employee who will be resident at NSWC Corona Division completes the Environmental Management System (EMS) Awareness training within 30 days of commencing performance at NSWC Corona Division. This training is available at https://www.navfac.ecatts.com/ or you can contact your Subject Matter Expert (SME) for additional options.

(d) In accordance with OPNAVINST 5090.1 (series) the contractor shall certify that employees have read the NSWC Corona Divisions document entitled “Commanding Officer’s Environmental and Natural Resources Policy statement” and taken the Environmental Management System (EMS) Awareness training within 30 days of commencing performance at NSWC Corona Division. This shall be accomplished by e-mail to their Subject Matter Expert (SME) with a copy to Environmental, Safety and Health

(ESH) Program Office (Code 013) (joseph.edgman@navy.mil). The e-mail shall include the employees name, work site, and contract number.

(e) In accordance with OPNAVINST 5090.1 (series) the contractor shall complete the “ECATTS Training Workbook” for each contractor employee who will be resident at NSWC Corona Division within 30 days of commencing performance at NSWC Corona Division. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Subject Matter Expert (SME) for additional assistance/options.

PLACE OF PERFORMANCE

The Contractor shall perform work at locations:

NSWC CORONA DIVISION

1999 FOURTH ST

NORCO, CA 92860

NSWC CORONA DIVISION, SEAL BEACH DETACHMENT

800 SEAL BEACH BLVD

SEAL BEACH, CA 90740-5000

PERIOD OF PERFORMANCE:

Base year: 12 months from date of Award Option year 1: 24 months from date of Award Option year 2: 36 months from date of Award