N64267-14-T-0137.pdf

NAVAL SURFACE WARFARE CENTER CORONA DIV

1999 FOURTH STREET BLDG 523

NORCO CA 92860

UNDER DPAS (15 CFR 700)

11. DELIVERY FOR FOB

RFQ

SEE SCHEDULE

14. METHOD OF SOLICITATION

IFB RFP

CODE

SEE ADDENDUM

BLOCK IS MARKED

DESTINATION UNLESS

12. DISCOUNT TERMS

(No Collect Calls)

25.5MIL

13b. RATING

13a. THIS CONTRACT IS A RATED ORDER

X

CODE

N64267-14-T-0137 14-May-2014

b. TELEPHONE NUMBER

951-273-5259

8. OFFER DUE DATE/LOCAL TIME

12:00 PM 23 May 2014

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV 3/2005)

Prescribed by GSA

FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER) 31c. DATE SIGNED

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

22. UNIT 23. UNIT PRICE 24. AMOUNT21. QUANTITY

CODE 10. THIS ACQUISITION IS

UNRESTRICTED

FAX: NAICS:

TEL:

CODE 18a. PAYMENT WILL BE MADE BYOFFEROR

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TEL.

N64267

SIZE STD:

9. ISSUED BY

FACILITY

CODE

17a.CONTRACTOR/

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

15. DELIVER TO CODE N64267 16. ADMINISTERED BY

NAVAL SURFACE WARFARE CENTER CORONA DIV

JOSEPH TRUNKO

1999 FOURTH STREET BUILDING 204

NORCO CA 92860

TEL: FAX:

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

TASHELL A RICHMOND

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

19. ITEM NO. 20. SCHEDULE OF SUPPLIES/ SERVICES

SEE SCHEDULE

541512

TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER ALL ITEMS

SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS

SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED HEREIN.

SB

HUBZONE SB

SET ASIDE: 100 % FOR

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

1300413661

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

TEL: EMAIL:

0 COPIES

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

.OFFER DATED YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN 29. AWARD OF CONTRACT: REFERENCE

8(A)

SVC-DISABLED VET-OWNED SB

EMERGING SB

X

X

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Lot TFR C&A Services

FFP

Trouble and Failure Reporting(TFR) System Certification & Accreditiation

Services

FOB: Destination

PURCHASE REQUEST NUMBER: 1300413661

NET AMT

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0002 1 Lot TFR IA Engineering Services

FFP

Trouble and Failure Reporting (TFR) System Information Assurance Engineering

Services

PURCHASE REQUEST NUMBER: 1300413661

NET AMT

CLAUSES INCORPORATED BY FULL TEXT

HQ B-2-0022 CONTRACT SUMMARY FOR PAYMENT OFFICE (FIXED

PRICE) (FEB 1997)

This entire contract is fixed price.

(End of Text)

Section C - Descriptions and Specifications

STATEMENT OF WORK

Sales Tax Exemption: The Contractor is hereby advised that the United States Government and Agencies thereof are exempt from State and Local Government tax by virtue of Article 6 of the United States Constitution. No exemption certificate is required.

1.0 INTRODUCTION

Naval Surface Warfare Center Corona (NSWC, Corona) Quality Assessment Department, Strategic Weapons Assurance Division (QA10) requires a Firm Fixed Price (FFP) contract for Information Assurance (IA) Certification and Accreditation (C&A) validation services and IA engineering technical support.

2.0 BACKGROUND

QA10 has a requirement to achieve and maintain its IA C&A status on Trouble and Failure Reporting (TFR) System. The TFR System has a valid Authority to Operate (ATO) and requires independent validation services and servicing to ensure proper security baselines are adequate and reported per guidance and the ATO reflects all current and planned network configurations. In order to meet these requirements, QA10 requires IA C&A support and system support services listed in this Statement of Work (SOW), including supported related to: the C&A documentation requirements including C&A plan, C&A package, Retina/ACAS scanning and mitigation, Gold Disk Reports, implementing Security Technical Implementation Guide (STIG) requirements and generating checklists, Plan of Action and Milestones (POA&M) updates, C&A artifact documents, and uploading into Enterprise Mission Assurance Support Service (eMASS). Support is required to perform validation requirements to include: Validate IA Controls, Validate POA&M, Validate Scorecard, create Certification Determination (CD) Letter, and representation at Collaboration Meeting(s).

3.0 SCOPE

The scope of this work is for system security validation and Tier 2 Security Engineering support of QA10’s information technology (IT) systems. The system covered by this SOW is the TFR Enclave – Unclassified Strategic Weapons System Network (SWSNet), including production, development, and test environments; and applicable ATO renewal and maintenance. The ATO shall be maintained current to reflect enclave configuration and IA requirements. (TFR Enclave ATO will renew in 2014.)

3.1 Trouble and Failure Reporting (TFR) System Enclave Description

The TFR Enclave currently consists of the following physical/virtual servers, operating systems, and workstations/hosts, along with server/machine counts (Workstation/host: no. of servers):

Development Environment: Virtual (W2K8R2:3) DMZ: Virtual (W2K8:1) Production Environment: Physical (W2K3:1, W2k8R2:2) and Virtual (W2K8R2:6 ,W2K3:1) Virtualization Management (vSphere): Physical (ESXi:6) Test Environment: Virtual: 5 SAN: Physical: 1 Tape: Physical/Virtual Combined: 1 Firewall: Physical: 1 Intrusion Detection and Prevention (IDP): Physical: 1 Switches: Physical: 6 Workstations: Physical Host and Virtual Combined (Win7: 38)

4.0 APPLICABLE DIRECTIVES/DOCUMENTS

The Contractor is required to adhere to all applicable standards and guidelines specified in the basic contract. In the absence of named standards, Department of Defense (DoD), Department of the Navy (DoN) standards, applicable Federal Information Processing Standards (FIPS), and broadly accepted professional standards shall prevail as related to the associated industries within the task identified in this Section. The most current version of all documents applies through life of this contract.

4.1 OPNAV Instruction 5510.60M Security Regulations for Offices under the Cognizance of the Chief of

Naval Operations

4.2 OPNAV 5300.23 Occupational Safety & Health Administration (OSHA)

4.3 OPNAVINST 5090.1C Navy Environmental and Natural Resources Program Manual

4.4 Executive Order 13423 Strengthening Federal Environmental, Energy, and Transportation

Management

4.5 Security Regulations:

DoD 5220.22-R, DoD Industrial Security Program DoD 5200.1-R, DoD Information Security Program DoD 5220.22-M, National Industrial Security Program Operating Manual DoD 5400.11-R, DoD Privacy Program Privacy Act of 1974 (As Amended) Directive-Type Memorandum (DTM) 08-003 SECNAV M-5510.36, DoN Information Security Program SECNAVINST 5211.5, DoN PRIVACY PROGRAM CNICNOTE 5530 of 02 May, 2011 NSWCCORDIVINST 5510.2, Information and Personnel Security Program NSWCCORDIVINST 5530.2, Physical Security Program NSWCCORDIVINST 3070.1, Operations Security

4.6 DoD Directive 8500.01, Information Assurance (IA)

4.7 DoD Instruction 8500.02, Information Assurance (IA) Implementation

4.8 SECNAVINST 5239.3, Department of the Navy Information Assurance (IA) Policy

4.9 NAVSEAINST 5239.2: NAVAL SEA SYSTEMS COMMAND (NAVSEA) INFORMATION

ASSURANCE (IA) PROGRAM

4.10 OPNAVINST 5239.1, Navy Information Assurance (IA) Program

4.11 DoD Directive 8570.01, Information Assurance Training, Certification, and Workforce Management

4.12 United States Strategic Command (USSTRATCOM) Directive 527-1, Department of Defense

Information Operations Condition (INFOCON) System Procedures

4.13 DoD Instruction 8510.01, DoD Information Assurance Certification and Accreditation Process

(DIACAP

4.14 Chairman of the Joint Chiefs of Staff (CJCS) Manual 6510.01 Defense-in-Depth: Information

Assurance (IA) and Computer Network Defense (CND)

4.15 DoD Instruction 8520.2, Public Key Infrastructure (PKI) and Public Key (PK) Enabling

4.17 Naval Telecommunication Directives: https://infosec.navy.mil/

5.0 GENERAL REQUIREMENTS

The Contractor shall provide IA C&A support to NSWC Corona in the areas of engineering, technical, information assurance and data management capabilities executed by QA10. The Contractor shall provide qualified personnel to perform the tasks in support of QA10 IT systems described in this SOW.

These tasks will include independent C&A validation, maintaining applicable C&A status and documentation, and engineering support as described in this SOW.

The Contractor shall provide rapid startup of assigned tasking to address critical issues relating to DoD policy.

http://www.dtic.mil/whs/directives/corres/pdf/850002p.pdf http://www.navsea.navy.mil/NAVINST/05239-002A.pdf http://www.navsea.navy.mil/NAVINST/05239-002A.pdf http://doni.daps.dla.mil/Directives/05000%20General%20Management%20Security%20and%20Safety%20Services/05-200%20Management%20Program%20and%20Techniques%20Services/5239.1C.pdf http://www.dtic.mil/whs/directives/corres/pdf/857001p.pdf https://powhatan.iiie.disa.mil/policy-guidance/d527-01.pdf http://www.dtic.mil/whs/directives/corres/pdf/851001p.pdf http://www.dtic.mil/cjcs_directives/cdata/unlimit/m651001_v1.pdf http://www.dtic.mil/whs/directives/corres/html/852002.htm

5.1 PERFORMANCE REQUIREMENTS

The contractor shall perform the following in order to achieve the outcomes desired by the government under this contract.

5.1.1 C&A Support (CLIN0001) (QA10/TFR Enclave)

5.1.1.1 Conduct Annual Security Review and Annual Testing of IA Controls for QA10 – 25 days at 8 hrs/day

5.1.1.2 Maintain and update existing ATO to reflect current network configuration, including workstation and development network assets (TFR Enclave ATO will renew in 2014, Annual Review will be required during this contracting period) – 25 days at 8 hrs/day

1) Submit strategy for IA compliance to maintain ATO to QA10 (Annual Review).

2) Make recommendations and provide guidance based on DoD and DoN IA standards in order to meet IA compliance for system engineering activities.

3) Ensure C&A and IA compliance in accordance with the current DoD and DoN IT Instructions and policies for all IT devices owned and supported by the customer.

4) Perform the maintenance, updating, and revising all documentation required by the cognizant

Designated Approving Authority (DAA) for all QA10 systems, during their life cycle.

5) Perform all steps stipulated in DoD and DoN Instructions and from collaboration meetings and reviews to coordinate and ensure systems are accredited in accordance with current DoD and DoN policies. All C&A documents will be turned over to the customer.

6) Maintain all collaboration meeting minutes, agendas, and action items

7) Serve as a Navy Certification Agent and have a current appointment by the Navy Certifying

Authority as a Fully Qualified Navy Certification Agent

8) Meet the Fully Qualified Level requirements for Navy Certification Agent and represent customer

C&A packages as a Validator to the cognizant DAA, Office of Designated Approving Authority (ODAA), Echelon Command, and Certification Authority (CA).

9) Perform vulnerability tests, scans, patches, security assessments, and remediation on systems for systems to maintain DoD and DoN IT compliance as systems go through upgrades and throughout the lifecycle of systems.

10) Perform the maintenance of Plan of Action & Milestones (POA&Ms) in the event the systems exhibit open findings. Assist with the production of a remediation POA&M in coordination with the local IA Officer, Project Leads, and System Administrators.

11) Provide summary data, status reports, and graphs for internal and external IA compliance and technical information gathering that result from data calls given by the Command.

12) Prepare the responses to various IA audits and security inspection questions. Be present during audits and act as technical liaison for audit team(s) to obtain passing and satisfactory audit results in the IA compliance area.

5.1.2 IA Engineering Technical Support (CLIN 0002) (QA10) – 4 days/mo. x 12 months at 8 hrs/day

5.1.2.1 Support system integration, installation, and maintenance of the QA10 TFR System. These tasks will be conducted as required per TFR System Administration, and shall include, but not limited to:

1) Install or support operating system and hardware installations or upgrades.

2) Perform or support system and equipment level tests to ensure operability prior to deployment.

3) Perform or support update and maintenance of computer security devices such as anti-virus servers, log servers, router, firewall, Host Based Security System, and Network intrusion detection devices.

4) Conduct or support patching to ensure network equipment software is maintained at the latest versions.

5) Maintain or support port security for all network switches.

6) Support router configuration management to ensure routers are maintained correctly, and routing protocols are implemented in a secure fashion.

7) Support access list management/maintenance by adding and removing entries in the access lists as necessary. Identifying and debug issues arising from network access lists.

8) Maintain intrusion detection system signature updates by ensuring all intrusion detection system (IDS) signatures are updated weekly.

9) Reviewing and analyze network logs, as well as notifying appropriate security personnel in the event of a possible security violation/network intrusion.

5.1.3 Required Qualifications of Contractor

5.1.3.1 C&A Qualifications:

1) Primary performer must have experience developing Navy Certification & Accreditation packages.

2) Must be a Fully Qualified Navy Validator. Validator shall be IAT Level 3 certified under IA

Workforce.

3) Must have developed policy for Navy Certification & Accreditation.

4) Must have experience with working with the Echelon 2 command representatives, Navy CA

Liaisons, & ODAA action officers under new Navy C&A process.

5) Must have experience with configuration and management of host based security system

(HBSS).

5.1.3.2 Non-Validator C&A personnel shall be minimum IAT Level 2 certified under IA Workforce.

6.0 DELIVERABLES

Deliverables under this contract shall be provided in accordance with “DON Policy on Digital Product/Technical Data,” ASN RD&A MEMO of 23 Oct 04 and shall be provided in accordance with the Contract Data Requirements Lists, (CDRL, DD Form 1423 and supporting Data Item Descriptions (DIDs).

Number Description Periodicity

A001 Progress and Status Report Monthly

A002 C&A Documentation As required

A003 Scan Results As required

A004 Annual Security Review and Annual Testing of IA Controls As required

A005 Contractor's Personnel Roster Monthly

7.0 GOVERNMENT FURNISHED PROPERTY (GFP)

The Government will provide up to one (1) workspace at NSWC Corona with access to the TFR Enclave.

The Government will provide electronic copies of current IA related documentation for each existing system upon request.

8.0 CONTRACTOR EQUIPMENT

The Contractor will be allowed to use Contractor-owned equipment at NSWC Corona sites to perform IT, IA, and C&A tasks provided the equipment is compliant with DOD and DON IA directives. The NSWC Corona IAM must approve in writing all Contractor equipment used to perform work on this Statement of Work (SOW). Use of e-mail request/approval is acceptable.

9.0 SECURITY

9.1 Security Clearances and Investigations. All personnel shall obtain and maintain background investigations and (if necessary) clearances appropriate to support contract performance. Clearances shall be maintained for the duration of this procurement. Personnel unable to successfully obtain or maintain an appropriate investigation or necessary clearance will immediately, upon notification from Facility Security Officer (FSO), be expected to vacate the installation or performance location. The department manager, subject matter expert (SME), and security office will also be notified of any such vacancy. Contractors who are Navy Fully Qualified Validators shall possess SSBI investigations for the IT-1 Position Sensitivity under the DD254 associated with this contract.

9.2 Clearance Lists. A list of personnel and their security clearances shall be delivered to the (NSWCCORDIV) security office and SME no later than 20 business days following award and shall be updated with the monthly personnel listing deliverable and when personnel changes occur.

9.2.1 Personnel Lists. Contractor will provide government a personnel list on company letterhead signed by competent authority/manager of all (prime and sub) personnel performing on the contract. This list will also be reconciled and forwarded to the NSWCCORDIV security office as changes occur. A preferred template example not containing PII is available from the SME or security office.

9.3 Contractors will immediately notify the SME of any subcontracting.

9.4 General Security Compliance. Contractor personnel shall comply with all DoD, DoN, NAVSEA, NSWCCORDIV, and other performance location’s security instructions, policies, procedures and guidance. These requirements apply both on and off Government property at NSWC Corona, remote sites or travel destinations, to include any established check-in / check-out procedures of personnel occupying Government facilities.

9.5 System Authorization Access Request (SAAR-N) The Contractor shall complete/sign Classified and Unclassified User Authorization Agreements as applicable, using OPNAV 5239/14 SAAR-N forms, and Privileged Access Agreements. Contractor personnel shall complete the DOD Annual Information Awareness training prior to being granted access to government IT systems and must indicate on the OPNAV 5239/14 SAAR-N, the IA training completion date. The Contractor shall submit a copy of their IA training certificates to the NSWCCORDIV COR.

9.6 Security Inspections. Security Inspections (to include Industrial) will occur a minimum of once per year. Department Manager and FSO will be informed of results. Inspections will also typically involve interaction with 2-3 contractor employees. Brief unannounced spot-checks of department occur throughout the year and are at the discretion of the government.

9. 7 Foreign Interests. Contractors with defined Foreign Interests (a Facility that is owned, controlled, or influenced by foreign interests) will ensure adherence to DoD and Navy regulations. Full disclosure to the Corona Contracting Officer, SME and security office is mandated.

9.8 Training. Personnel will participate in Annual Security Refresher Brief, New Employee Security Brief, and Annual Counter-Intelligence Brief. FSO will be given initial orientation training either in person or electronically of installation concept of operations as relative to the contract.

9.9 Emergency Management. Employees are expected to register Regional (AtHoc) Emergency Notification System. Contractors will follow Corona emergency preparedness and antiterrorism protocol during designated command emergencies and declared threat conditions.

9.10 Common Access Cards (CACs). CAC issuance is at the discretion of the Government and will only be to personnel who meet at least one of the three following criteria:

1) The individual requires both access to a DoD facility and logon access to DoD networks on site or remotely.

2) The applicant requires remote access to DoD networks that use only the CAC logon for user authentication.

3) The applicant requires frequent access to a DoD network to perform volunteer duties (volunteers only).

9.11 Government Facilities. Access to Government facilities is at the discretion of the Government. The Government reserves the right to rescind access at any time.

In each instance when employees no longer work for a company due to circumstances favorable or unfavorable, the FSO shall ensure the prompt return of the following materials:

1) Government-owned keys to desks, offices, etc.

2) CAC, except for CACs issued to retired military personnel and retired civil servants on that basis.

3) Base Passes, except for passes issued to retired military personnel and retired civil servants on that basis

4) Base stickers for the employee’s vehicle, except for stickers issued to retired military personnel and retired civil servants on that basis

5) Government Furnished Equipment (GFE) and Government Furnished Information (GFI), with special attention to Information Technology (IT) equipment, Critical Information (CI), and Critical Program Information (CPI). In executing the provisions above, the contractor may collect the materials listed in that paragraph and return them to the custody of an appropriate Government employee or direct the contractor employee to surrender these items to the security office, whichever is appropriate to the circumstances.

9.12 Isolated Personnel Reporting. Contractor personnel traveling overseas shall contact the Antiterrorism Officer and if required, complete all mandated Foreign Travel requirements.

9.13 Information protection will occur as per any applicable governing directives.

9.14 Contractor personnel granted access to the NMCI network will be required to complete Navy Information Assurance (IA) or comparable training, at the Government’s discretion, and complete and sign appropriate IA forms required to be granted continued access to Government information technology networks. All IA security concerns will be directed to the Information Assurance Manager.

9.15 Operations Security. Background, Operations Security (OPSEC) is a process for protecting unclassified sensitive information from exploitation by an adversary. Sensitive unclassified information – which is also referred to as CI or CPI – is defined as information that is not classified but which needs to be protected from unauthorized disclosure. Examples are information labeled “For Official Use Only (FOUO),” proprietary information, contractor sensitive information, limited distribution information, and Personally Identifiable Information (PII).

9.15.1 The contractor and all subcontractors shall provide OPSEC protection for sensitive unclassified information as identified in the CI List (see below) paragraphs and CPI List, if applicable. The prime contractor and all subcontractors shall employ the countermeasures listed below in order to protect that information. Additional countermeasures may be employed as necessary. If an OPSEC Plan is provided, the contractor and all subcontractors shall comply with that plan. These OPSEC requirements will be in effect throughout the life of the procurement from award through the conclusion of services at the end of the Period of Performance (PoP) or other procurement termination. If required, the contractor and all subcontractors shall prepare an OPSEC Plan.

9.15.2 Contractor personnel shall follow OPSEC concepts and principles in the conduct of this requirement to protect CI, personnel, facilities, equipment and operations from compromise. The contractor shall consult with the SME within 5 working days of receipt of order to determine all special circumstances affecting OPSEC under this requirement. In any case where there is uncertainty or ambiguity regarding OPSEC measures, the contractor shall consult the SME as soon as possible. If the SME is unavailable, the contractor shall consult the contracting officer instead. The prime contractor and all subcontractors shall provide OPSEC protection for sensitive unclassified information and comply with all OPSEC requirements.

9.15.3 Minimum Protection Requirements for CI. CI is exempt from public release under Exemption 2 of the Freedom of Information Act (FOIA). It is designated “For Official Use Only (FOUO)” and is considered controlled unclassified information. Specific Critical Program Information, for reasons of OPSEC will not be identified to offerors prior to award. CPI will be identified to the successful offeror only after receipt of order.

9.16 Personally Identifiable Information (PII). PII will be protected in accordance with DoD and Navy directives, in such a manner as to prevent unauthorized disclosure. Email containing PII must be encrypted.

9.17 Controlled Unclassified Information (CUI): CUI is official information that requires the application of controls and protective measures for a variety of reasons and has not been approved for public release, to include technical information, proprietary data, information requiring protection under the Privacy Act of 1974, and Government-developed privileged information involving the award of contracts. CUI is a categorical designation that refers to unclassified information that does not meet the standards for National Security Classification under Executive Order(s), but is pertinent to the national interest of the United States or to the important interests of entities outside the Federal Government, and under law or policy requires protection from unauthorized disclosure, special handling safeguards, or prescribed limits on exchange or dissemination.

9.17.1 Minimum Requirements for Access to CUI: Prior to access, contractor personnel requiring access to DoN CUI or "user level access to DoN or DoD networks and information systems, system security and network defense systems, or to system resources providing visual access and/or ability to input, delete or otherwise manipulate sensitive information without controls to identify and deny sensitive information" who do not have clearance eligibility are required to submit a Questionnaire for Public Trust Positions (Standard Form 85P) through the cognizant Facility Security Officer or contractor entity representative for a suitability determination by DoN Central Adjudication Facility.

9.17.2 Minimum Protection Requirements for CUI: Contract deliverables taking the form of unclassified limited-distribution documents (FOUO), are not authorized for public release and therefore shall not be posted on a publicly accessible web server, nor electronically transmitted via electronic mail unless appropriately encrypted.

9.18 Countermeasures. Countermeasures to CI exploitation are required to negate the susceptibility of critical information to exploitation by an adversary or competitor. The contractor shall protect all CI listed in a manner appropriate to the nature of the information, including use of the necessary countermeasures as listed below applicable to specifics items.

1) Encryption of electronically-stored CI.

2) Encryption of e-mail containing CI.

3) Storage of hard copy CI, optical media and external hard drives in locked containers when not in use.

4) Transmission of CI to the minimum set of recipients with a need to know.

5) Proper marking of CI with warnings to include at a minimum “FOR OFFICIAL USE ONLY”; as appropriate to the nature of the CI it shall also be marked with “UNCLASSIFIED BUT

SENSITIVE,” “PRIVACY ACT INFORMATION,” “PERSONALLY IDENTIFYING INFORMATION,”

“PROTECT FROM UNAUTHORIZED DISCLOSURE” or other similar statements cautioning protection of the CI.

6) Restricting disclosure of CI at meetings and conferences (including teleconferences) to the minimum necessary to the performance of this requirement.

7) Immediate and appropriate destruction in a manner precluding reconstruction of all CI no longer needed under this requirement.

8) Restricting verbal discussion of CI to venues and circumstances that prevent the monitoring and interception of the discussion by unauthorized personnel.

9) Maintaining current, successful completion of Navy-mandated Information Assurance (IA) and OPSEC training by all personnel handling CI.

10) Refraining from the use of unencrypted cellular telephones to transmit CI.

11) Refraining from the use of foreign postal systems to ship CI.

12) Promptly retrieving documents containing CI printed on printers accessible by persons without a need to know the CI.

13) Use of cover pages or other appropriate means to prevent the viewing of CI by unauthorized persons.

14) Limiting the inclusion of CI in contract and budget documents, presentations, press releases and other publications to that which is essential to the performance of this requirement.

15) Use of protected databases and strong passwords and the protection of user identifications (UserIDs).

16) During test and evaluation events (as applicable to this requirement) practice OPSEC methodologies with respect to staging units, personnel and materials out of the observation of unauthorized persons; desensitization; and the speed of execution of the event.

9.19 Compromise. The contractor shall notify the SME, FSO, and security office immediately of all known and suspected compromises of CI, classified information, or PII. If the SME cannot be reached, the contractor shall notify the Contracting Officer (or the Command Duty Officer if after normal work hours).

9.20 FOUO. The FOUO marking is assigned to information at the time of its creation. It is not authorized as a substitute for a security classification marking but is used on official Government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA). Use of FOUO markings does not mean that the information can’t be released to the public, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

9.20.1 All UNCLASSIFIED documents created under this procurement that contain FOUO information will be marked “FOR OFFICIAL USE ONLY” on the bottom of the cover page and interior pages.

9.20.2 Classified documents containing FOUO do not require any markings on the cover of the document. However, the interior pages containing only FOUO information shall be marked at the top and bottom center with “FOR OFFICIAL USE ONLY.” Only unclassified portions containing FOUO shall be marked with “(FOUO)” immediately before each unclassified FOUO portion.

9.20.3 All FOUO information released to the contractor will be marked with the following statement prior to transfer:

THIS DOCUMENT CONTAINS INFORMATION EXEMPT FROM MANDATORY

DISCLOSURE UNDER THE FOIA. EXEMPTIONS(S) ______ APPLY.

9.20.4 Removal of the FOUO marking may be accomplished only by the originator or other competent authority. The contractor SHALL NOT REMOVE ANY FOUO MARKING WITHOUT WRITTEN AUTHORIZATION FROM NSWC CORONA OR THE AUTHOR. The Government will notify the contractor when the FOUO status is terminated.

9.20.5 The contractor is authorized to disseminate FOUO information to its employees and those having a need to know the information in order to accomplish the requirements of this procurement.

9.20.6 During working hours, reasonable steps shall be taken to minimize the risk of access to FOUO information by unauthorized personnel. FOUO information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need to know the information in order to perform the requirements of this procurement. During non-working hours, the FOUO information shall be stored in a locked desk, file cabinet, bookcase, rooms, or other lockable container or space affording reasonable protection from unauthorized disclosure.

9.20.7 FOUO information may be transmitted via US postal service first-class mail, parcel post and fourth-class mail for bulk shipments only. The contractor shall not permit FOUO information to enter foreign postal systems and parcel delivery systems.

9.20.8 When no longer needed, FOUO information shall either be returned to appropriate Government custody or destroyed in a manner precluding reconstruction of the information.

9.20.9 Electronic transmission of FOUO information (via voice, data, or facsimile transmission) shall be by approved secure communications systems (such as encryption if unclassified). If circumstances preclude the use of such a system, the contractor shall consult the SME; if the SME is not available and time requirements do not permit delay, the contractor shall consult the contracting officer.

9.21 ACCESS BRIEFINGS. FSO will provide any necessary access briefings required for contract performance (NATO, CNWDI, etc.).

9.22 The Contractor shall notify NSWC Corona if any of the limitations mentioned above need modification. Conversely, the Government will notify the Contractor when security requirements delineated in this SOW are modified.

9.23 Access to Government Information Systems

The Contractor shall require access to Government Information Systems to perform the duties under this SOW. The Contractor shall access systems on unclassified networks including but not limited to NMCI/NGEN, NIPRNET, closed enclaves, and non-networked systems.

9.24 Access to Intelligence information is not required for performance of this contract.

9.25 Information Storage

Documentation, system test results and sensitive information shall be stored at NSWC Corona and NMCI shared drives under NSWC Corona cognizance.

10.0 ON-SITE SAFETY AWARENESS

(a) In accordance with 29 CFR 1925 Safety and Health Standards for Federal Service Contracts, the contractor company shall strictly adhere to Federal Occupational Safety and Health Administration (OSHA) Regulations, Environmental Protection Agency (EPA) Regulations, and all applicable state and local requirements. OSHA Directive CSP 03-01-003 Voluntary Protection Programs (VPP) Policies and Protection Manual defines contractors into two categories.

1) Applicable Contractor. A contractor whose employees worked at least 1,000 hours for a VPP participant in any calendar quarter within the last 12 months and are not directly supervised by the applicant/participant.

2) Nested Contractor. Reference (a) does not specifically define this term. However, in discussing injury and illness data requirements for contractors, the OSHA guidance states that “nested contractors. . . are supervised by host site management”, and “are regularly intermingled with the owner’s employees and under direct supervision by management”.

(b) In accordance with OPNAVINST 5100.23(series) and OSHA Directive CSP 03-01-003, our command is to ensure that all contractor employees have read the NSWC Corona Divisions document entitled, “Commanding Officers Occupational Safety and Health Policy Statement” and “Occupational Safety and Health Administration (OSHA) Voluntary Protection Programs (VPP) document” within 30 days of commencing performance. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Subject Matter Expert (SME) for additional assistance/options.

(c) In accordance with OPNAVINST 5100.23(series) and OSHA Directive CSP 03-01-003, our command is to ensure that all nested contractor employees completes the Voluntary Protection Program (VPP) Awareness Training within 30 days of commencing performance at NSWC Corona Division. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Subject Matter Expert (SME) for additional assistance/options.

https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/

(d) In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, the contractor company shall certify that all contractor employees have read the NSWC Corona Divisions document entitled “Commanding Officers Occupational Safety and Health Policy Statement” and “Occupational Safety and Health Administration (OSHA) Voluntary Protection Programs (VPP) document” and all nested contractor employees have taken the Voluntary Protection Program (VPP) awareness training within 30 days of commencing performance at NSWC Corona Division. This can be accomplished by sending an e-mail to their Subject Matter Expert (SME) with a copy to Environmental, Safety and Health (ESH) Program Office (Code 013) (joseph.edgman@navy.mil). The document/e-mail shall include the employees name, work site, and contract number.

(e) In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, the contractor company shall submit their OSHA 300 Logs (injury/illness rates) within 30 days of commencing performance at NSWC Corona Division to their Subject Matter Expert (SME) with a copy to Environmental, Safety and Health (ESH) Program Office for review by the ESH Manager (Code 013).

(f) In accordance with 29 CFR 1904 Standards for Recording and Reporting Occupational Injuries and Illness, the contractor shall post their OSHA 300 Logs in a conspicuous place where employee notices are posted immediately upon commencing performance and at intervals as required by CFR.

(g) In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, require Contractor Company to provide quarterly reports of recordable cases and hours worked so that site OSHA recordkeeping personnel can calculate and monitor contractor TCIR/DART rates. Only include cases and hours for work performed at the VPP participant's site.

(h) In accordance with OPNAVINST 5100.23(series) and OSHA Directive CSP 03-01-003, the applicable contractor company shall submit Total Case Incident Rate (TCIR) and Days Away, Restricted and Transfer (DART) rates for the past three years within 30 days of commencing performance at NSWC Corona Division to their Subject Matter Expert (SME) with a copy to Environmental, Safety and Health (ESH) Program Office for review by the ESH Manager (Code 013).

(i) In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, the contractor shall report all work-related injuries/illnesses that occurred while working at NSWC Corona Division to their Subject Matter Expert (SME) and to Environmental, Safety and Health (ESH) Program Office for review by the ESH Manager (Code 013).

(j) In accordance with 29 CFR 1925 and OSHA Directive CSP 03-01-003, the contractor shall ensure that all contractor employees working at NSWC Corona Division are briefed with the applicable sections of the Safety and Occupational Health (SOH) Program Manual (NSWCCORDIVINST 5100.3(series)). This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact Subject Matter Expert (SME) for additional assistance/options.

These are requirement from OSHA Code of Federal Regulations (CFR), 29 CFR 1910 Standards for General Industry, and 29 CFR 1925 Safety and Health Standards for Federal Service Contracts, and from OPNAVINST 5090.1 (series)

11.0 ON-SITE ENVIRONMENTAL AWARENESS

(a) In accordance with 29 CFR 1925 Safety and Health Standards for Federal Service Contracts, the contractor shall strictly adhere to Federal Occupational Safety and Health Administration (OSHA) Regulations, Environmental Protection Agency (EPA) Regulations, and all applicable state and local requirements.

(b) In accordance with OPNAVINST 5090.1 (series) the contractor shall ensure that each contractor employee reads the NSWC Corona Division document entitled, “Commanding Officer’s Environmental and Natural Resources Policy statement” within 30 days of commencing performance at NSWC Corona Division. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your or Subject Matter Expert (SME) for additional assistance/options.

mailto:joseph.edgman@navy.mil

(c) In accordance with OPNAVINST 5090.1 (series) the contractor shall ensure that each contractor employee who will be resident at NSWC Corona Division completes the Environmental Management System (EMS) Awareness training within 30 days of commencing performance at NSWC Corona Division. This training is available at https://www.navfac.ecatts.com/ or you can contact your or Subject Matter Expert (SME) for additional options.

(d) In accordance with OPNAVINST 5090.1 (series) the contractor shall certify that employees have read the NSWC Corona Divisions document entitled “Commanding Officer’s Environmental and Natural Resources Policy statement” and taken the Environmental Management System (EMS) Awareness training within 30 days of commencing performance at NSWC Corona Division. This shall be accomplished by e-mail to their Subject Matter Expert (SME) with a copy to Environmental, Safety and Health (ESH) Program Office (Code 013) (joseph.edgman@navy.mil). The e-mail shall include the employees name, work site, and contract number.

(e) In accordance with OPNAVINST 5090.1 (series) the contractor shall complete the “ECATTS Training Workbook” for each contractor employee who will be resident at NSWC Corona Division within 30 days of commencing performance at NSWC Corona Division. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Subject Matter Expert (SME) for additional assistance/options.

PERIOD OF PERFORMANCE:

Contracted Period of performance is 19 June 2014 – 18 June 2015 https://www.navfac.ecatts.com/ mailto:joseph.edgman@navy.mil

Section E - Inspection and Acceptance

INSPECTION AND ACCEPTANCE

PERFORMANCE REQUIREMENT SUMMARY (PRS)

Quality Assurance

As a performance based service acquisition, the TFR C&A Services, and IA Engineering and Technical Support Contract specifies work tasks in terms of desired outcome. The overriding outcome expected is the IA/information technology (IT) systems in the TFR enclave obtain and maintain ATO status. The Contractor will be evaluated in the context of the task requirements in the performance work statement.

Performance relative to these task requirements will be evaluated.

Successful completion of these tasks requires proper management of contract work and the generation of high quality outcomes delivered in a timely manner that meet program requirements.

The PRS measures the Contractor’s demonstrated performance with respect to the following factors: Compliance with Contract Requirements, Quality of Deliverables, Efficient Use of Resources, and Job Knowledge.

Surveying Quality of Contract Requirements

The Contractor’s performance will be evaluated on an ongoing basis by the QA Department personnel responsible for the overall TFR IA/IT environment. The effort will include both periodic review of the deliverables and an on-going evaluation of the work as it is performed in the QA Department.

Evaluation Categories and Factors

The Contractor’s performance during the contract period shall be judged in the following categories:

(1) Technical Performance, and

(2) Schedule Performance.

Unsatisfactory performance in either of these areas will be addressed to the Contractor and they will be requested to correct the deficiencies.

The Contractor’s performance during the contract period shall be judged in the following categories: (1) Technical Performance, and (2) Schedule Performance. Unsatisfactory performance in either of these areas will be addressed to the contractor and they will be requested to correct the deficiencies.

Performance Requirement Summary (PRS)

Standards for performance for specific requirements: For the purposes of this table, “services” shall refer to those services specified in Section 5.0, Performance Requirements. Specified quality levels must be met unless otherwise properly justified by events or developments beyond the control of the contractor.

Performance Objective PWS Performance Standard

Provide high quality products to program sponsors in a timely manner that meets program/contract requirements.

Section 5.0

- Ability to provide efficient and effective deliverables in a timely manner.

- Report completed metrics and deliverable results to CT and Senior Leadership.

-When required, effectively train Corona personnel

Performance Ratings

The Government will evaluate the contractor’s performance of the Performance Work Statement and the Contracting Officer will assign one of the following ratings:

(1) Excellent

(2) Satisfactory

(3) Unsatisfactory

The standards associated with these ratings are given in the following Table 1.

Table 1: Overall Performance Ratings

Overall Performance Rating

Standard

Excellent “Excellent” ratings for all performance evaluation criteria.

Satisfactory A minimum of “Satisfactory” ratings for all performance evaluation criteria.

Unsatisfactory A rating of “Unsatisfactory” for one or more performance evaluation criteria.

(b) Objectives.

The Contracting Officer will make a performance determination for the TO at the end of each evaluation period. The determination will be based upon the Subject Matter Expert’s (SME) recommendations, the contractor’s comments including any Self- Evaluation Reports and any other information deemed relevant by the Contracting Officer. The Contracting Officer shall resolve disagreements between the SME’s recommendations and the contractor’s comments/reports regarding the evaluation. The Contracting Officer’s performance evaluation is unilateral and final. The Contracting Officer will document the determination and provide a copy to the contractor within 30 calendar days of receipt of the contractor’s self assessment.

The Government may not exercise an option year term unless the contractor meets the acceptable performance definition during all previous rating periods.

(c) Performance Evaluation Criteria.

The contractor’s performance under this TO will be evaluated using the criteria and standards provided for each objective and identified in Tables 2 through 4 of this PRS.

(d) Organization.

The performance evaluation organization consists of the Contracting Officer, who will serve as the Determining Official, and the SME.

(e) This performance evaluation does not replace any other requirement for evaluating contractor performance that may be required by this contract such as a Contractor Performance Assessment Reporting System (CPARS) report.

TABLE 1: OVERALL PERFORMANCE RATINGS

OVERALL

PERFORMANCE RATING STANDARD

Excellent “Excellent” ratings for all performance evaluation criteria.

Satisfactory A minimum of “Satisfactory” ratings for all performance evaluation criteria.

Unsatisfactory A rating of “Unsatisfactory” for one or more performance evaluation criteria.

TABLE 2: TASK PERFORMANCE EVALUATION

CRITERIA AND STANDARDS

CRITERION UNSATISFACTORY SATISFACTORY EXCELLENT

Task Performance

Work product fails to meet Acceptable Quality Levels (AQLs) defined in Performance Requirements Summary Table, Exhibit A.

Work product routinely meets Acceptable Quality Levels (AQLs) defined in Performance Requirements Summary Exhibit A.

Work product frequently exceeds Acceptable Quality Levels (AQLs) defined in Performance Requirements Summary Exhibit A.

Staffing Contractor provides marginally qualified or unqualified personnel.

Lapses in coverage occur regularly.

Contractor provides qualified personnel.

Lapses in coverage may occasionally occur and are managed per TO policy.

Contractor provides highly qualified personnel.

Contractor reassigns personnel to ensure proper coverage.

Actual lapses in coverage occur very rarely, if ever, and are managed per TO policy. Contractor ensures staff training remains current.

Timeliness Contractor frequently misses deadlines, schedules, or is slow to respond to Government requests or is non-responsive to Government requests.

Contractor routinely meets deadlines, schedules, and responds quickly to Government requests.

Contractor always meets deadlines, schedules, and responds immediately to Government requests.

TABLE 3: CONTRACT MANAGEMENT PERFORMANCE EVALUATION

Problem Resolution

Problems are unresolved, repetitive, or take excessive Government effort to resolve.

Problems are resolved quickly with minimal Government involvement.

Problems are non-existent or the Contractor takes corrective action without Government involvement.

Responsiveness Contractor’s management is unresponsive to Government requests and concerns.

Contractor’s management is responsive to Government requests and concerns.

Contractor’s management takes proactive approach in dealing with Government representatives and anticipates Government concerns.

Communications Contractor often fails to communicate with Government in an effective and timely manner.

Contractor routinely communicates with Government in an effective and timely manner.

Contractor takes a proactive approach such that communications are almost always clear, effective and timely.

TABLE 4: COST EFFICIENCY PERFORMANCE EVALUATION

Cost Management

Contractor routinely fails to complete the effort within the originally agreed-to estimate cost, i.e. cost overruns frequently occur.

Contractor routinely completes the effort within the originally agreed-to estimated cost. Contractor provides measures for controlling all costs at estimated costs.

Funds and resources are generally used in a cost-effective manner. No major resource management problems are apparent.

Reductions in direct costs to the Government below contract estimated costs are noteworthy.

Contractor provides detailed cost analysis and recommendations to Government for resolution of problems identified. Funds and resources are optimally used to provide the maximum benefit for the funds and resources available. Documented savings are apparent.

Cost Reporting

Reports are generally late, inaccurate incomplete or unclear.

Reports are timely, accurate, complete and clearly written.

Problems and/or trends are addressed, and an analysis is also submitted.

Reports are clear, accurate, and pro-active. Problems and/or trends are addressed thoroughly, and the Contractor’s recommendations and/or corrective plans are implemented and effective.

NOTIFICATION OF DEFICIENT PERFORMANCE

Any Performance deficiency identified during the rating period will be brought to the immediate attention of the SME, who will inform the Contracting Officer of this issue.

When Contractor performance in any area approaches or reaches a minimum acceptable quality level, or is not fully compliant with the…