FBO_SOLICITATION_N64267-14-T-0202.pdf

N64267-14-T-0202

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Lot

C&A SERVICES

FFP

C&A SERVICES

FOB: Destination

PURCHASE REQUEST NUMBER: 1300430602

NET AMT

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0002 1 Lot

IA ENGINEERING TECH SUPPORT

FFP

IA ENGINEERING TECH SUPPORT

PURCHASE REQUEST NUMBER: 1300430602

NET AMT

Section C - Descriptions and Specifications

GENERAL

SALES TAX EXEMPTION

The contractor is hereby advised that the United States Government and Agencies thereof are exempt from State and Local Government tax by virtue of Article 6 of the United States Constitution. No exemption certificate is required.

1.0 INTRODUCTION

Naval Surface Warfare Center Corona (NSWC, Corona) Quality Assessment Department, Government-Industry Data Exchange Program (GIDEP) (QA30) requires a Firm Fixed Price (FFP) contract for Information Assurance (IA) Certification and Accreditation (C&A) validation services and IA engineering technical support.

2.0 BACKGROUND

QA30 has a requirement to maintain its IA C&A status on Government-Industry Data Exchange Program System.

The GIDEP System requires a valid Authority to Operate (ATO) and independent validation services and servicing to ensure proper security baselines are adequate and reported per guidance and the ATO reflects all current and planned network configurations. In order to meet these requirements, QA30 requires IA C&A support and system support services listed in this Statement of Work (SOW), including supported related to: preparation of the ATO, and the C&A documentation requirements including C&A plan, C&A package, Retina scanning and mitigation, Gold Disk Reports, implementing Security Technical Implementation Guide (STIG) requirements and generating checklists, Plan of Action and Milestones (POA&M) updates, C&A artifact documents, and uploading into Information Assurance Tracking System (IATS) repository. Support is required to perform validation requirements to include: Validate IA Controls, Validate POA&M, Validate Scorecard, Create Certification Determination (CD) Letter, and Represent at Collaboration Meeting.

3.0 SCOPE

The scope of this work is for system security validation and Tier 2 Security Engineering support of QA30’s information technology (IT) systems. The system covered by this SOW is the GIDEP Enclave – Unclassified System Network; ATO will require system maintenance support and updating to include workstations and development environment.

The GIDEP Enclave currently consists of the following elements:

3.1 Development Environment consisting of two Solaris 10 x86 (2 physical), Windows Server 2012 Datacenter

(1 physical), Windows 2008 R2 x64 (6 virtual), and Windows 7 Ultimate x64 (15 physical).

3.2 A demilitarized zone (DMZ) comprised of Windows 2008 R2 x64 (6 virtual), Windows Server 2012

Datacenter (1 physical), and Windows Server 2012 Standard (1 physical).

3.3 Production Environment comprised of Windows 2008 R2 x64 (4 virtual), Windows Server 2012 Datacenter

(1 physical), and Windows Server 2012 Standard (1 physical).

3.4 Contractor Equipment

The Contractor will be allowed to use Contractor-owned equipment at NSWC Corona sites to perform IT, IA, and C&A tasks provided the equipment is compliant with DoD and DoN IA directives. The NSWC Corona IAM must approve in writing all Contractor equipment used to perform work on this Statement of Work (SOW). Use of e-mail request/approval is acceptable.

4.0 APPLICABLE DIRECTIVES/DOCUMENTS

The Contractor is required to adhere to all applicable standards and guidelines specified in the basic contract. In the absence of named standards, Department of Defense (DoD), Department of the Navy (DoN) standards, applicable Federal Information Processing Standards (FIPS), and broadly accepted professional standards shall prevail as related to the associated industries within the task identified in this Section. The most current version of all documents applies through life of this contract.

4.1 OPNAV Instruction 5510.60M Security Regulations for Offices under the Cognizance of the Chief of Naval

Operations available at www.fas.org/irp/doddir/navy/opnavinst/5510_60m.pdf

4.2 OPNAV 5300.23 Occupational Safety & Health Administration (OSHA) available at www.lejeune.usmc.mil/2dfssg/med/files/NAVOSH%20Manual.pdf

4.3 OPNAVINST 5090.1C Navy Environmental and Natural Resources Program Manual available at www.navylabs.navy.mil/Archive/5090.1C%20Manual.pdf

4.4 Executive Order 13423 Strengthening Federal Environmental, Energy, and Transportation Management available at http://www.archives.gov/federal-register/executive-orders/2007.html

4.5 Security Regulations:

DoD 5220.22-R, DoD Industrial Security Program DoD 5200.1-R, DoD Information Security Program DoD 5220.22-M, National Industrial Security Program Operating Manual DoD 5400.11-R, DoD Privacy Program Privacy Act of 1974 (As Amended) Directive-Type Memorandum (DTM) 08-003 SECNAV M-5510.36, DoN Information Security Program SECNAVINST 5211.5E, DoN PRIVACY PROGRAM CNICNOTE 5530 of 02 May, 2011 NSWCCORDIVINST M-5510.2, Information and Personnel Security Program NSWCCORDIVINST 5530.2, Physical Security Plan

4.6 NSWCCORDIVINST 3070.1 Operations Security (Attachment 2)

4.7 DoD Directive 8500.01E, Information Assurance (IA) of 24 October 2002

4.8 DoD Instruction 8500.02, Information Assurance (IA) Implementation of 2 June 2003

4.9 SECNAVINST 5239.3B, Department of the Navy Information Assurance (IA) Policy of 17 June 2009 available at http://www.fas.org/irp/doddir/navy/secnavinst/5239_3b.pdf

4.10 NAVSEAINST 5239.2: NAVAL SEA SYSTEMS COMMAND (NAVSEA) INFORMATION

ASSURANCE (IA) PROGRAM

4.11 OPNAVINST 5239.1C, Navy Information Assurance (IA) Program of 8 August 2008

4.12 DoD Directive 8570.01, Information Assurance Training, Certification, and Workforce Management of 15

August 2004

4.13 United States Strategic Command (USSTRATCOM) Directive 527-1, Department of Defense Information

Operations Condition (INFOCON) System Procedures of 27 January 2006

4.14 DoD Instruction 8510.01, DoD Information Assurance Certification and Accreditation Process (DIACAP) of

28 November 2007

4.15 Chairman of the Joint Chiefs of Staff (CJCS) Manual 6510.01A of 24 June 2009 Defense-in-Depth:

Information Assurance (IA) and Computer Network Defense (CND)

4.16 DoDI 8520.2, Public Key Infrastructure (PKI) and Public Key (PK) Enabling of 1 April 2004

4.17 C&A Templates:

https://www.portal.navy.mil/netwarcom/navycanda/Lists/DON%20DIACAP%20CA%20TEMPLATES/AllIt ems.aspx

4.18 Circuit C&A Guidance:

https://www.portal.navy.mil/netwarcom/navycanda/Lists/Navy%20SIPRNET%20and%20NIPRNET%20Circ uit%20Accreditation%20Pac/AllItems.aspx

4.19 NAVSEA RDT&E C&A Guidance (use email certificate on CAC for access):

https://inavsea.nmci.navy.mil/hq/00i/ia/default.aspx

4.20 Naval Telecommunication Directives: https://infosec.navy.mil/docs/index.jsp?tab=7&folder=40 http://www.fas.org/irp/doddir/navy/opnavinst/5510_60m.pdf http://www.lejeune.usmc.mil/2dfssg/med/files/NAVOSH%20Manual.pdf http://www.navylabs.navy.mil/Archive/5090.1C%20Manual.pdf http://www.archives.gov/federal-register/executive-orders/2007.html http://www.dtic.mil/whs/directives/corres/pdf/850002p.pdf http://www.navsea.navy.mil/NAVINST/05239-002A.pdf http://www.navsea.navy.mil/NAVINST/05239-002A.pdf http://doni.daps.dla.mil/Directives/05000%20General%20Management%20Security%20and%20Safety%20Services/05-200%20Management%20Program%20and%20Techniques%20Services/5239.1C.pdf http://www.dtic.mil/whs/directives/corres/pdf/857001p.pdf https://powhatan.iiie.disa.mil/policy-guidance/d527-01.pdf http://www.dtic.mil/whs/directives/corres/pdf/851001p.pdf http://www.dtic.mil/cjcs_directives/cdata/unlimit/m651001_v1.pdf http://www.dtic.mil/whs/directives/corres/html/852002.htm https://www.portal.navy.mil/netwarcom/navycanda/Lists/DON%20DIACAP%20CA%20TEMPLATES/AllItems.aspx https://www.portal.navy.mil/netwarcom/navycanda/Lists/DON%20DIACAP%20CA%20TEMPLATES/AllItems.aspx https://www.portal.navy.mil/netwarcom/navycanda/Lists/Navy%20SIPRNET%20and%20NIPRNET%20Circuit%20Accreditation%20Pac/AllItems.aspx https://www.portal.navy.mil/netwarcom/navycanda/Lists/Navy%20SIPRNET%20and%20NIPRNET%20Circuit%20Accreditation%20Pac/AllItems.aspx https://inavsea.nmci.navy.mil/hq/00i/ia/default.aspx https://infosec.navy.mil/docs/index.jsp?tab=7&folder=40

5.0 GENERAL REQUIREMENTS

The Contractor shall provide IA C&A support to NSWC Corona in the areas of engineering, technical, information assurance and data management capabilities executed by QA31. The Contractor shall provide qualified personnel to perform the tasks in support of QA31 IT systems described in this SOW. These tasks will include independent C&A validation, maintaining applicable C&A status and documentation, and engineering support as described in this SOW.

The Contractor shall provide rapid startup of assigned tasking to address critical issues relating to DoD policy.

5.1 PERFORMANCE REQUIREMENTS

The contractor shall perform the following in order to achieve the outcomes desired by the government under this contract.

5.1.1 C&A Services (CLIN0001)

5.1.1.1 Conduct Annual Security Review and Annual Testing of IA Controls for QA31.

1) Perform Annual Security Review/Annual Testing of IA Controls for those systems not actively renewing their ATOs. At a minimum, conduct required scans, update C&A package, update topology, update scorecard, and update POAM. Annual review is due within 14 days of each systems validation.

2) Work with QA31 staff to address and mitigate findings to acceptable levels.

3) Provide required reports of results and submit to the cognizant ODAA.

5.1.1.2 Develop and submit IA strategy for IA compliance, and to gain ATO for all devices supported by customer as part of the GIDEP System. Update C&A documentation to reflect current GIDEP System configuration, addressing both production and development network and workstation assets. This will entail updating existing C&A documentation to reflect current production network configuration and include production workstations; and incorporate or establish C&A documentation for development network and associated development workstations.

1) Submit strategy for IA compliance to update/maintain ATO to QA31.

2) Make recommendations and provide guidance based on DoD and DoN IA standards in order to meet

IA compliance for system engineering activities.

3) Ensure C&A and IA compliance in accordance with the current DoD and DoN IT Instructions and policies for all IT devices owned and supported by the customer.

4) Perform the creation, maintenance, updating, and revising all documentation required by the cognizant

Designated Approving Authority (DAA) for all QA31 systems, during their life cycle.

5) Perform all steps stipulated in DoD and DoN Instructions and from collaboration meetings and reviews to coordinate and ensure systems are accredited in accordance with current DoD and DoN policies.

All C&A documents will be turned over to the customer.

6) Maintain all collaboration meeting minutes, agendas, and action items.

7) Serve as a Navy Certification Agent and have a current appointment by the Navy Certifying Authority as a Fully Qualified Navy Certification Agent

8) Meet the Fully Qualified Level requirements for Navy Certification Agent and represent customer

C&A packages as a Validator to the cognizant DAA, ODAA, Echelon Command, and Certification Authority (CA).

9) Perform vulnerability tests, scans, patches, security assessments, and remediation on systems for systems to maintain DoD and DoN IT compliance as systems go through upgrades and throughout the lifecycle of systems.

10) Perform the creation and maintenance of Plan of Action & Milestones (POA&Ms) in the event the systems exhibit open findings. Assist with the production of a remediation POA&M in coordination with the local IA Officer, Project Leads, and System Administrators.

11) Provide summary data, status reports, and graphs for internal and external IA compliance and technical information gathering that result from data calls given by the Command.

12) Provide vulnerability scan analysis results of the QA31 systems documenting the findings and corrections made to systems during system validation activities. The results will include a summary of CAT I , CAT II & CAT III findings, details on remediation applied, remediation metrics per system, vulnerability remediated and any other observations related to Information Assurance practices.

13) Prepare the responses to various IA audits and security inspection questions. Be present during audits and act as technical liaison for audit team(s) to obtain passing and satisfactory audit results in the IA compliance area.

5.1.1.3 Generate and provide IA and C&A Documentation (1-2 packages annually):

1) Generate Annual Security Review and Annual Testing of IA Controls for the complete GIDEP System.

At a minimum the contractor shall scan, update C&A package, update topology, update scorecard, and update POA&M. If establishing new or separate ATO for an environment of the GIDEP System, that full C&A package will serve at the Annual Security Review and Annual Testing of IA Controls for that environment covered by the new ATO.

5.1.2 IA Engineering Technical Support (CLIN 0002)

5.1.2.1 Support system integration, installation, and maintenance of the QA31 GIDEP System (approximately 4 days per month). These tasks will include, but are not limited to:

1) Install or support installation of software updates.

2) Perform or support system upgrades.

3) Perform or support system and equipment level tests to ensure operability prior to deployment.

4) Perform or support operational testing on systems.

5) Perform or support update and maintenance of computer security devices such as anti-virus servers, log servers, router, firewall, HBSS, and Network intrusion detection devices.

6) Services performed will be included in monthly progress and status reports.

Deliverables under this contract shall be provided in accordance with “DON Policy on Digital Product/Technical Data,” ASN RD&A Memo of 23 Oct 04 and shall be provided in accordance with the Contract Data Requirements List, (CDRL, DD Form 1423 and supporting Data Item Descriptions (DIDs).

6.0 DELIVERABLES

Number Description Periodicity

A001 Progress and Status Report Monthly

A002 C&A Documentation As required

A003 Scan Results As required

A004 Annual Security Review and Annual Testing of IA Controls As required

A005 Contractor's Personnel Roster Monthly

7.0 GOVERNMENT FURNISHED PROPERTY (GFP)

The Government will provide up to one (1) workspace at NSWC Corona with one (1) Naval Marine Corps Intranet (NMCI) computer. The Government will make at least 1 laptop available for vulnerability scanning. The Government will provide electronic copies of current IA related documentation for each existing system.

8.0 SECURITY

8.1 Security Clearances and Investigations. All personnel shall obtain and maintain background investigations and (if necessary) clearances appropriate to support contract performance. Clearances shall be maintained for the duration of this procurement. Personnel unable to successfully obtain or maintain an appropriate investigation or necessary clearance will immediately, upon notification from Facility Security Officer (FSO), be expected to vacate the installation or performance location. The department manager, designated Subject Matter Expert (SME) and security office will also be notified of any such vacancy.

8.2 Clearance Lists. A list of personnel and their security clearances shall be delivered to the (NSWCCORDIV) security office and SME no later than 20 business days following award and shall be updated with the monthly personnel listing deliverable and when personnel changes occur.

8.2.1 Personnel Lists. Contractor will provide government a personnel list on company letterhead signed by competent authority/manager of all (prime and sub) personnel performing on the contract. This list will also be reconciled and forwarded to the NSWCCORDIV security office as changes occur. A preferred template example not containing PII is available from the SME or security office.

8.3 Contractors will immediately notify the SME of any subcontracting.

8.4 General Security Compliance. Contractor personnel shall comply with all DoD, DoN, NAVSEA, NSWCCORDIV, and other performance location’s security instructions, policies, procedures and guidance. These requirements apply both on and off Government property at NSWC Corona, remote sites or travel destinations, to include any established check-in / check-out procedures of personnel occupying Government facilities.

8.5 System Authorization Access Request (SAAR-N) The Contractor shall complete/sign Classified and Unclassified User Authorization Agreements as applicable, using OPNAV 5239/14 SAAR-N forms, and Privileged Access Agreements. Contractor personnel shall complete the DoD Annual Information Awareness training prior to being granted access to government IT systems and must indicate on the OPNAV 5239/14 SAAR-N, the IA training completion date. The Contractor shall submit a copy of their IA training certificates to the NSWCCORDIV SME.

8.6 Security Inspections. Security Inspections (to include Industrial) will occur a minimum of once per year.

Department Manager and FSO will be informed of results. Inspections will also typically involve interaction with 2- 3 contractor employees. Brief unannounced spot-checks of department occur throughout the year and are at the discretion of the government.

8.7 Foreign Interests. Contractors with defined Foreign Interests (a Facility that is owned, controlled, or influenced by foreign interests) will ensure adherence to DoD and Navy regulations. Full disclosure to the Corona Contracting Officer, SME and security office is mandated.

8.8 Training. Personnel will participate in Annual Security Refresher Brief, New Employee Security Brief, and Annual Counter-Intelligence Brief. FSO will be given initial orientation training either in person or electronically of installation concept of operations as relative to the contract.

8.9 Emergency Management. Employees are expected to register Regional (AtHoc) Emergency Notification System. Contractors will follow Corona emergency preparedness and antiterrorism protocol during designated command emergencies and declared threat conditions.

8.10 Common Access Cards (CACs). CAC issuance is at the discretion of the Government and will only be to personnel who meet at least one of the three following criteria:

1) The individual requires both access to a DoD facility and logon access to DoD networks on site or remotely.

2) The applicant requires remote access to DoD networks that use only the CAC logon for user authentication.

3) The applicant requires frequent access to a DoD network to perform volunteer duties (volunteers only).

8.11 Government Facilities. Access to Government facilities is at the discretion of the Government. The Government reserves the right to rescind access at any time.

In each instance when employees no longer work for a company due to circumstances favorable or unfavorable, the FSO shall ensure the prompt return of the following materials:

1) Government-owned keys to desks, offices, etc.

2) CAC, except for CACs issued to retired military personnel and retired civil servants on that basis.

3) Base Passes, except for passes issued to retired military personnel and retired civil servants on that basis

4) Base stickers for the employee’s vehicle, except for stickers issued to retired military personnel and retired civil servants on that basis

5) Government Furnished Equipment (GFE) and Government Furnished Information (GFI), with special attention to Information Technology (IT) equipment, Critical Information (CI), and Critical Program Information (CPI). In executing the provisions above, the contractor may collect the materials listed in that paragraph and return them to the custody of an appropriate Government employee or direct the contractor employee to surrender these items to the security office, whichever is appropriate to the circumstances.

8.12 Isolated Personnel Reporting. Contractor personnel traveling overseas shall contact the Antiterrorism Officer and if required, complete all mandated Foreign Travel requirements.

8.13 Information protection will occur as per any applicable governing directives.

8.14 Contractor personnel granted access to the NMCI network will be required to complete Navy Information Assurance (IA) or comparable training, at the Government’s discretion, and complete and sign appropriate IA forms required to be granted continued access to Government information technology networks. All IA security concerns will be directed to the Information Assurance Manager.

8.15 Operations Security. Background, Operations Security (OPSEC) is a process for protecting unclassified sensitive information from exploitation by an adversary. Sensitive unclassified information – which is also referred to as CI or CPI – is defined as information that is not classified but which needs to be protected from unauthorized disclosure. Examples are information labeled “For Official Use Only (FOUO),” proprietary information, contractor sensitive information, limited distribution information, and Personally Identifiable Information (PII).

8.15.1 The contractor and all subcontractors shall provide OPSEC protection for sensitive unclassified information as identified in the CI List (see below) paragraphs and CPI List, if applicable. The prime contractor and all subcontractors shall employ the countermeasures listed below in order to protect that information. Additional countermeasures may be employed as necessary. If an OPSEC Plan is provided, the contractor and all subcontractors shall comply with that plan. These OPSEC requirements will be in effect throughout the life of the procurement from award through the conclusion of services at the end of the Period of Performance (PoP) or other procurement termination. If required, the contractor and all subcontractors shall prepare an OPSEC Plan.

8.15.2 Contractor personnel shall follow OPSEC concepts and principles in the conduct of this requirement to protect CI, personnel, facilities, equipment and operations from compromise. The contractor shall consult with the SME within 5 working days of receipt of order to determine all special circumstances affecting OPSEC under this requirement. In any case where there is uncertainty or ambiguity regarding OPSEC measures, the contractor shall consult the SME as soon as possible. If the SME is unavailable, the contractor shall consult the contracting officer instead. The prime contractor and all subcontractors shall provide OPSEC protection for sensitive unclassified information and comply with all OPSEC requirements.

8.15.3 Minimum Protection Requirements for CI. CI is exempt from public release under Exemption 2 of the Freedom of Information Act (FOIA). It is designated “For Official Use Only (FOUO)” and is considered controlled unclassified information. Specific Critical Program Information, for reasons of OPSEC will not be identified to offerors prior to award. CPI will be identified to the successful offeror only after receipt of order.

8.16 Personally Identifiable Information (PII). PII will be protected in accordance with DoD and Navy directives, in such a manner as to prevent unauthorized disclosure. Email containing PII must be encrypted.

8.17 Controlled Unclassified Information (CUI): CUI is official information that requires the application of controls and protective measures for a variety of reasons and has not been approved for public release, to include technical information, proprietary data, information requiring protection under the Privacy Act of 1974, and Government-developed privileged information involving the award of contracts. CUI is a categorical designation that refers to unclassified information that does not meet the standards for National Security Classification under Executive Order(s), but is pertinent to the national interest of the United States or to the important interests of entities outside the Federal Government, and under law or policy requires protection from unauthorized disclosure, special handling safeguards, or prescribed limits on exchange or dissemination.

8.17.1 Minimum Requirements for Access to CUI: Prior to access, contractor personnel requiring access to DoN CUI or "user level access to DoN or DoD networks and information systems, system security and network defense systems, or to system resources providing visual access and/or ability to input, delete or otherwise manipulate sensitive information without controls to identify and deny sensitive information" who do not have clearance eligibility are required to submit a Questionnaire for Public Trust Positions (Standard Form 85P) through the cognizant Facility Security Officer or contractor entity representative for a suitability determination by DoN Central Adjudication Facility.

8.17.2 Minimum Protection Requirements for CUI: Contract deliverables taking the form of unclassified limited-distribution documents (FOUO), are not authorized for public release and therefore shall not be posted on a publicly accessible web server, nor electronically transmitted via electronic mail unless appropriately encrypted.

8.18 Countermeasures. Countermeasures to CI exploitation are required to negate the susceptibility of critical information to exploitation by an adversary or competitor. The contractor shall protect all CI listed in a manner appropriate to the nature of the information, including use of the necessary countermeasures as listed below applicable to specifics items.

1) Encryption of electronically-stored CI.

2) Encryption of e-mail containing CI.

3) Storage of hard copy CI, optical media and external hard drives in locked containers when not in use.

4) Transmission of CI to the minimum set of recipients with a need to know.

5) Proper marking of CI with warnings to include at a minimum “FOR OFFICIAL USE ONLY”; as appropriate to the nature of the CI it shall also be marked with “UNCLASSIFIED BUT SENSITIVE,”

“PRIVACY ACT INFORMATION,” “PERSONALLY IDENTIFYING INFORMATION,” “PROTECT

FROM UNAUTHORIZED DISCLOSURE” or other similar statements cautioning protection of the CI.

6) Restricting disclosure of CI at meetings and conferences (including teleconferences) to the minimum necessary to the performance of this requirement.

7) Immediate and appropriate destruction in a manner precluding reconstruction of all CI no longer needed under this requirement.

8) Restricting verbal discussion of CI to venues and circumstances that prevent the monitoring and interception of the discussion by unauthorized personnel.

9) Maintaining current, successful completion of Navy-mandated Information Assurance (IA) and OPSEC training by all personnel handling CI.

10) Refraining from the use of unencrypted cellular telephones to transmit CI.

11) Refraining from the use of foreign postal systems to ship CI.

12) Promptly retrieving documents containing CI printed on printers accessible by persons without a need to know the CI.

13) Use of cover pages or other appropriate means to prevent the viewing of CI by unauthorized persons.

14) Limiting the inclusion of CI in contract and budget documents, presentations, press releases and other publications to that which is essential to the performance of this requirement.

15) Use of protected databases and strong passwords and the protection of user identifications (UserIDs).

16) During test and evaluation events (as applicable to this requirement) practice OPSEC methodologies with respect to staging units, personnel and materials out of the observation of unauthorized persons;

desensitization; and the speed of execution of the event.

8.19 Compromise. The contractor shall notify the SME, FSO, and security office immediately of all known and suspected compromises of CI, classified information, or PII. If the SME cannot be reached, the contractor shall notify the Contracting Officer (or the Command Duty Officer if after normal work hours).

8.20 FOUO. The FOUO marking is assigned to information at the time of its creation. It is not authorized as a substitute for a security classification marking but is used on official Government information that may be withheld from the public under exemptions 2 through 9 of the Freedom of Information Act (FOIA). Use of FOUO markings does not mean that the information can’t be released to the public, only that it must be reviewed by the Government prior to its release to determine whether a significant and legitimate government purpose is served by withholding the information or portions of it.

8.20.1 All UNCLASSIFIED documents created under this procurement that contain FOUO information will be marked “FOR OFFICIAL USE ONLY” on the bottom of the cover page and interior pages.

8.20.2 Classified documents containing FOUO do not require any markings on the cover of the document.

However, the interior pages containing only FOUO information shall be marked at the top and bottom center with “FOR OFFICIAL USE ONLY.” Only unclassified portions containing FOUO shall be marked with “(FOUO)” immediately before each unclassified FOUO portion.

8.20.3 All FOUO information released to the contractor will be marked with the following statement prior to transfer:

THIS DOCUMENT CONTAINS INFORMATION EXEMPT FROM MANDATORY

DISCLOSURE UNDER THE FOIA. EXEMPTIONS(S) ______ APPLY.

8.20.4 Removal of the FOUO marking may be accomplished only by the originator or other competent authority.

The contractor SHALL NOT REMOVE ANY FOUO MARKING WITHOUT WRITTEN AUTHORIZATION FROM NSWC CORONA OR THE AUTHOR. The Government will notify the contractor when the FOUO status is terminated.

8.20.5 The contractor is authorized to disseminate FOUO information to its employees and those having a need to know the information in order to accomplish the requirements of this procurement.

8.20.6 During working hours, reasonable steps shall be taken to minimize the risk of access to FOUO information by unauthorized personnel. FOUO information shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need to know the information in order to perform the requirements of this procurement. During non-working hours, the FOUO information shall be stored in a locked desk, file cabinet, bookcase, rooms, or other lockable container or space affording reasonable protection from unauthorized disclosure.

8.20.7 FOUO information may be transmitted via US postal service first-class mail, parcel post and fourth-class mail for bulk shipments only. The contractor shall not permit FOUO information to enter foreign postal systems and parcel delivery systems.

8.20.8 When no longer needed, FOUO information shall either be returned to appropriate Government custody or destroyed in a manner precluding reconstruction of the information.

8.20.9 Electronic transmission of FOUO information (via voice, data, or facsimile transmission) shall be by approved secure communications systems (such as encryption if unclassified). If circumstances preclude the use of such a system, the contractor shall consult the SME; if the SME is not available and time requirements do not permit delay, the contractor shall consult the Contracting Officer.

8.21 ACCESS BRIEFINGS. FSO will provide any necessary access briefings required for contract performance (NATO, CNWDI, etc.).

8.22 The Contractor shall notify NSWC Corona if any of the limitations mentioned above need modification.

Conversely, the Government will notify the Contractor when security requirements delineated in this SOW are modified.

8.23 Access to Government Information Systems

The Contractor shall require access to Government Information Systems to perform the duties under this SOW.

The Contractor shall access systems on unclassified networks including but not limited to NMCI/NGEN, NIPRNET, closed enclaves, and non-networked systems.

8.24 Access to Intelligence information is not required for performance of this contract.

8.25 Information Storage

Documentation, system test results and sensitive information shall be stored at NSWC Corona and NMCI shared drives under NSWC Corona cognizance.

9.0 ON SITE SAFETY AWARENESS

(a) In accordance with 29 CFR 1925 Safety and Health Standards for Federal Service Contracts, the contractor company shall strictly adhere to Federal Occupational Safety and Health Administration (OSHA) Regulations, Environmental Protection Agency (EPA) Regulations, and all applicable state and local requirements. OSHA Directive CSP 03-01-003 Voluntary Protection Programs (VPP) Policies and Protection Manual defines contractors into two categories.

1) Applicable Contractor. A contractor whose employees worked at least 1,000 hours for a VPP participant in any calendar quarter within the last 12 months and are not directly supervised by the applicant/participant.

2) Nested Contractor. Reference (a) does not specifically define this term. However, in discussing injury and illness data requirements for contractors, the OSHA guidance states that “nested contractors. . . are supervised by host site management”, and “are regularly intermingled with the owner’s employees and under direct supervision by management”.

(b) In accordance with OPNAVINST 5100.23(series) and OSHA Directive CSP 03-01-003, our command is to ensure that all contractor employees have read the NSWC Corona Divisions document entitled, “Commanding Officers Occupational Safety and Health Policy Statement” and “Occupational Safety and Health Administration (OSHA) Voluntary Protection Programs (VPP) document” within 30 days of commencing performance. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Subject Matter Expert (SME) for additional assistance/options.

(c) In accordance with OPNAVINST 5100.23(series) and OSHA Directive CSP 03-01-003, our command is to ensure that all nested contractor employees completes the Voluntary Protection Program (VPP) Awareness Training within 30 days of commencing performance at NSWC Corona Division. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Subject Matter Expert (SME) for additional assistance/options.

(d) In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, the contractor company shall certify that all contractor employees have read the NSWC Corona Divisions document entitled “Commanding Officers Occupational Safety and Health Policy Statement” and “Occupational Safety and Health Administration (OSHA) Voluntary Protection Programs (VPP) document” and all nested contractor employees have taken the Voluntary Protection Program (VPP) awareness training within 30 days of commencing performance at NSWC Corona Division. This can be accomplished by sending an e-mail to their Subject Matter Expert (SME) with a copy to Environmental, Safety and Health (ESH) Program Office (Code 013) (joseph.edgman@navy.mil). The document/e-mail shall include the employees name, work site, and contract number.

(e) In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, the contractor company shall submit their OSHA 300 Logs (injury/illness rates) within 30 days of commencing performance at NSWC Corona Division to their Subject Matter Expert (SME) with a copy to Environmental, Safety and Health (ESH) Program Office for review by the ESH Manager (Code 013).

(f) In accordance with 29 CFR 1904 Standards for Recording and Reporting Occupational Injuries and Illness, the contractor shall post their OSHA 300 Logs in a conspicuous place where employee notices are posted immediately upon commencing performance and at intervals as required by CFR.

(g) In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, require Contractor Company to provide quarterly reports of recordable cases and hours worked so that site OSHA recordkeeping personnel can calculate and monitor contractor TCIR/DART rates. Only include cases and hours for work performed at the VPP participant's site.

(h) In accordance with OPNAVINST 5100.23(series) and OSHA Directive CSP 03-01-003, the applicable contractor company shall submit Total Case Incident Rate (TCIR) and Days Away, Restricted and Transfer (DART) rates for the past three years within 30 days of commencing performance at NSWC Corona Division to their Subject Matter Expert (SME) with a copy to Environmental, Safety and Health (ESH) Program Office for review by the ESH Manager (Code 013).

(i) In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, the contractor shall report all work-related injuries/illnesses that occurred while working at NSWC Corona Division to their Subject Matter Expert (SME) and to Environmental, Safety and Health (ESH) Program Office for review by the ESH Manager (Code 013).

(j) In accordance with 29 CFR 1925 and OSHA Directive CSP 03-01-003, the contractor shall ensure that all contractor employees working at NSWC Corona Division are briefed with the applicable sections of the Safety and Occupational Health (SOH) Program Manual (NSWCCORDIVINST 5100.3(series)). This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact Subject Matter Expert (SME) for additional assistance/options.

https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ mailto:joseph.edgman@navy.mil

These are requirement from OSHA Code of Federal Regulations (CFR), 29 CFR 1910 Standards for General Industry, and 29 CFR 1925 Safety and Health Standards for Federal Service Contracts, and from OPNAVINST

5090.1 (series)

10.0 ON SITE ENVIRONMENTAL AWARENESS

a) In accordance with 29 CFR 1925 Safety and Health Standards for Federal Service Contracts, the contractor shall strictly adhere to Federal Occupational Safety and Health Administration (OSHA) Regulations, Environmental Protection Agency (EPA) Regulations, and all applicable state and local requirements.

(b) In accordance with OPNAVINST 5090.1 (series) the contractor shall ensure that each contractor employee reads the NSWC Corona Division document entitled, “Commanding Officer’s Environmental and Natural Resources Policy statement” within 30 days of commencing performance at NSWC Corona Division. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your or Subject Matter Expert (SME) for additional assistance/options.

(c) In accordance with OPNAVINST 5090.1 (series) the contractor shall ensure that each contractor employee who will be resident at NSWC Corona Division completes the Environmental Management System (EMS) Awareness training within 30 days of commencing performance at NSWC Corona Division. This training is available at https://www.navfac.ecatts.com/ or you can contact your or Subject Matter Expert (SME) for additional options.

(d) In accordance with OPNAVINST 5090.1 (series) the contractor shall certify that employees have read the NSWC Corona Divisions document entitled “Commanding Officer’s Environmental and Natural Resources Policy statement” and taken the Environmental Management System (EMS) Awareness training within 30 days of commencing performance at NSWC Corona Division. This shall be accomplished by e-mail to their Subject Matter Expert (SME) with a copy to Environmental, Safety and Health (ESH) Program Office (Code 013) (joseph.edgman@navy.mil). The e-mail shall include the employees name, work site, and contract number.

(e) In accordance with OPNAVINST 5090.1 (series) the contractor shall complete the “ECATTS Training Workbook” for each contractor employee who will be resident at NSWC Corona Division within 30 days of commencing performance at NSWC Corona Division. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Subject Matter Expert (SME) for additional assistance/options.

11.0 NAVY MARINE CORPS INTRANET (NMCI) (NOT APPLICABLE)

https://www.navfac.ecatts.com/ mailto:joseph.edgman@navy.mil

Section E - Inspection and Acceptance

PERFORMANCE QUALITY SUMMARY

Quality Assurance

As a performance based service acquisition, the GIDEP C&A Services, and IA Engineering and Technical Support Contract specifies work tasks in terms of desired outcome. The overriding outcome expected is the IA/IM systems in the GIDEP enclave obtain and maintain ATO status.

The contractor will be evaluated in the context of the task requirements in the performance work statement. Performance relative to these task requirements will be evaluated.

Successful completion of these tasks requires proper management of contract work and the generation of high quality outcomes delivered in a timely manner that meet program requirements.

The PRS measures the contractor’s demonstrated performance with respect to the following factors: Compliance with Contract Requirements, Quality of Deliverables, Efficient Use of Resources, and Job Knowledge.

Surveying Quality of Contract Requirements

The Contractor’s performance will be evaluated on an ongoing basis by the QA Department personnel responsible for the overall GIDEP IA/IT environment. The effort will include both periodic review of the deliverables and an on-going evaluation of the work as it is performed in the QA Department.

Evaluation Categories and Factors

The Contractor’s performance during the contract period shall be judged in the following categories: (1) Technical Performance, and (2) Schedule Performance. Unsatisfactory performance in either of these areas will be addressed to the contractor and they will be requested to correct the deficiencies.

Performance Requirement Summary (PRS) Performance Objective PWS Performance Standard Provide high quality products to program sponsors in a timely manner that meets program/contract requirements.

5.1 - Ability to Develop a C&A package which is capable of receiving an ATO

- Ability to Develop the wiritten documentation to support the validation of each system

- Ability to communicate/collaborate within each step o fthe C&A process to obtaion and maintain an ATO

(a) Performance Ratings

The Government will evaluate the contractor’s performance of the Performance Work Statement and the Contracting Officer will assign one of the following ratings:

(1) Excellent

(2) Satisfactory

(3) Unsatisfactory

The standards associated with these ratings are given in the following Table 1.

TABLE 1: OVERALL PERFORMANCE RATINGS

Overall Performance Rating Standard

Excellent “Excellent” ratings for all performance evaluation criteria.

Satisfactory A minimum of “Satisfactory” ratings for all performance evaluation criteria.

Unsatisfactory A rating of “Unsatisfactory” for one or more performance evaluation criteria.

(b) Objectives.

The Contracting Officer will make a performance determination for the TO at the end of each evaluation period. The determination will be based upon the Subject Matter Expert (SME) recommendations, the contractor’s comments including any Self-Evaluation Reports and any other information deemed relevant by the Contracting Officer. The Contracting Officer shall resolve disagreements between the SME’s recommendations and the contractor’s comments/reports regarding the evaluation. The Contracting Officer’s performance evaluation is unilateral and final. The Contracting Officer will document the determination and provide a copy to the contractor within 30 calendar days of receipt of the contractor’s self assessment.

The Government may not exercise an option year term unless the contractor meets the acceptable performance definition during all previous rating periods.

(c) Performance Evaluation Criteria.

The contractor’s performance under this TO will be evaluated using the criteria and standards provided for each objective and identified in Tables 2 through 4 of this QASP.

(d) Organization.

The performance evaluation organization consists of the Contracting Officer, who will serve as the Determining Official, and the SME.

(e) This performance evaluation does not replace any other requirement for evaluating contractor performance that may be required by this contract such as a Contractor Performance Assessment Reporting System (CPARS) report.

TABLE 2: TASK PERFORMANCE EVALUATION CRITERIA AND STANDARDS

CRITERION UNSATISFACTORY SATISFACTORY EXCELLENT

Task Performance

Work product fails to meet Acceptable Quality Levels (AQLs) defined in Performance Requirements Summary Table, Exhibit A.

Work product routinely meets Acceptable Quality Levels (AQLs) defined in Performance Requirements Summary Exhibit A.

Work product frequently exceeds Acceptable Quality Levels (AQLs) defined in Performance Requirements Summary Exhibit A.

Staffing

Contractor provides marginally qualified or unqualified personnel.

Lapses in coverage occur regularly.

Contractor provides qualified personnel.

Lapses in coverage may occasionally occur and are managed per TO policy.

Contractor provides highly qualified personnel.

Contractor reassigns personnel to ensure proper coverage. Actual lapses in coverage occur very rarely, if ever, and are managed per TO policy.

Contractor ensures staff training remains current.

Timeliness

Contractor frequently misses deadlines, schedules, or is slow to respond to Government requests or is non-responsive to Government requests.

Contractor routinely meets deadlines, schedules, and responds quickly to Government requests.

Contractor always meets deadlines, schedules, and responds immediately to Government requests.

Table 3: CONTRACT MANAGEMENT PERFORMANCE EVALUATION CRITERIA AND

STANDARDS

CRITERION UNSATISFACTORY SATISFACTORY EXCELLENT

Problem Resolution

Problems are unresolved, repetitive, or take excessive Government effort to resolve.

Problems are resolved quickly with minimal Government involvement.

Problems are non-existent or the contractor takes corrective action without Government involvement.

Responsiveness Contractor’s management Contractor’s Contractor’s is unresponsive to Government requests and concerns.

management is responsive to Government requests and concerns.

management takes proactive approach in dealing with Government representatives and anticipates Government concerns.

Communications

Contractor often fails to communicate with Government in an effective and timely manner.

Contractor routinely communicates with Government in an effective and timely manner.

Contractor takes a proactive approach such that communications are almost always clear, effective and timely.

TABLE 4: COST EFFICIENCY PERFORMANCE EVALUATION CRITERIA AND

STANDARDS

CRITERION UNSATISFACTORY SATISFACTORY EXCELLENT

Cost Management

Contractor routinely fails to complete the effort within the originally agreed-to estimate cost, i.e. cost overruns frequently occur.

Contractor routinely completes the effort within the originally agreed-to estimated cost. Contractor provides measures for controlling all costs at estimated costs. Funds and resources are generally used in a cost-effective manner. No major resource management problems are apparent.

Reductions in direct costs to the Government below contract estimated costs are noteworthy. Contractor provides detailed cost analysis and recommendations to Government for resolution of problems identified.

Funds and resources are optimally used to provide the maximum benefit for the funds and resources available. Documented savings are apparent.

Cost Reporting

Reports are generally late, inaccurate incomplete or unclear.

Reports are timely, accurate, complete and clearly written. Problems and/or trends are addressed, and an analysis is also submitted.

Reports are clear, accurate, and pro-active. Problems and/or trends are addressed thoroughly, and the contractor’s recommendations and/or corrective plans are implemented and effective.

NOTIFICATION OF DEFICIENT PERFORMANCE

Any Performance deficiency identified during the rating period will be brought to the immediate attention of the SME, who will inform the Contracting Officer of this issue. When contractor performance in any area approaches or reaches a minimum acceptable quality level, or is not fully compliant with the requirements of the TO, the SME will notify the contractor Site Manager of the discrepancy in writing. The contractor will then have two weeks to implement corrective action and to explain the corrective action in writing to the SME. If the contractor’s response resolves the problem, no further action will be taken. If the problem continues after implementation of corrective action, the SME will submit a Contract Discrepancy Report (Exhibit A-CDR) to the contractor.

Unsatisfactory contractor performance that causes significant injury or damage to personnel or equipment, which puts personnel, or equipment unnecessarily at risk, or which results from gross negligence or inattention to standing procedures may result in an immediate CDR with no advance notification by the SME. When the SME submits a CDR, the contractor is required to prepare a formal reply delineating corrective action. If the reply satisfies the SME, no further action will be taken. If replies are unsatisfactory and resolution cannot be obtained, the SME will forward the contractor’s reply along with the recommended action to the Contracting Officer to initiate formal action against the contractor for unsatisfactory performance. When appropriate, Contracting Officer may investigate any event further to determine if all the facts and circumstances surrounding the event were considered in the SME’s recommendation.

EVALUATION OF CONTRACTOR PERFORMANCE

To: Subject Matter Expert Date:

Contact: Contractor: XYZ Task: Survey Period: 1st Quarter FY XX

Method of Surveillance: Task Originator review.

Evaluation of Contractor Performance: Performance Assessment Rating

Timeliness and Quality of Work

Control Of Government Furnished Property

Deliverables

Funds Status Report Narrative Discussion Of Contractor Performance During Survey Period:

Recommendations:

Prepared By:

Note(s):

1. Evaluation follows PAP Table 1. Performance Rating Criteria.

2. See PAP Section 4.0

CONTRACT DISCREPANCY REPORT

DATE AND TIME:

CONT…