N64267-15-T-0187_Support_IA_Services.pdf

NAVAL SURFACE WARFARE CENTER CORONA DIV.

1999 FOURTH STREET BLDG 523

NORCO CA 92860

UNDER DPAS (15 CFR 700)

11. DELIVERY FOR FOB

RFQ

SEE SCHEDULE

14. METHOD OF SOLICITATION

IFB RFP

CODE

SEE ADDENDUM

BLOCK IS MARKED

DESTINATION UNLESS

12. DISCOUNT TERMS

(No Collect Calls)

$27.5M

13b. RATING

13a. THIS CONTRACT IS A RATED ORDER

X

CODE

N64267-15-T-0187 07-Jul-2015

b. TELEPHONE NUMBER

951-393-5637

8. OFFER DUE DATE/LOCAL TIME

12:00 PM 13 Jul 2015

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV 3/2005)

Prescribed by GSA

FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER) 31c. DATE SIGNED

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

22. UNIT 23. UNIT PRICE 24. AMOUNT21. QUANTITY

CODE 10. THIS ACQUISITION IS

UNRESTRICTED

FAX: NAICS:

TEL:

CODE 18a. PAYMENT WILL BE MADE BYOFFEROR

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TEL.

N64267

SIZE STD:

9. ISSUED BY

FACILITY

CODE

17a.CONTRACTOR/

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

15. DELIVER TO CODE N64267 16. ADMINISTERED BY

NAVAL SURFACE WARFARE CENTER CORONA DIV.

FELICIA A HURST

PO BOX 5000

NORCO CA 92878-5000

TEL: 951-393-5637 FAX: (951) 273-4013

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

FELICIA A HURST

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

19. ITEM NO. 20. SCHEDULE OF SUPPLIES/ SERVICES

SEE SCHEDULE

541512

TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER ALL ITEMS

SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS

SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED HEREIN.

SB

HUBZONE SB

SET ASIDE: 100 % FOR

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

1300506502

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

TEL: EMAIL:

COPIES

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

.OFFER DATED YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN 29. AWARD OF CONTRACT: REFERENCE

8(A)

SVC-DISABLED VET-OWNED SB

EMERGING SB

X X

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

SEE SCHEDULE

19. ITEM NO. 20. SCHEDULE OF SUPPLIES/ SERVICES 21. QUANTITY 22. UNIT 24. AMOUNT

PAGE 2 OF

23. UNIT PRICE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV 3/2005) BACK

Prescribed by GSA

FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

N64267-15-T-0187

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Lot Engineering Technical Support

FFP

Period of Performance: 12 months ARO FOB: Destination

PURCHASE REQUEST NUMBER: 1300506502

NET AMT

Section C - Descriptions and Specifications

STATEMENT OF WORK

This is a Request for Quotation (RFQ) for a commercial item(s) prepared in accordance with the information in FAR Part 13.

SALES TAX EXEMPTION: The Contractor is hereby advised that the United States Government and Agencies thereof are exempt from State and Local Government tax by virtue of Article 6 of the United States Constitution. No exemption certificate is required.

1.0 INTRODUCTION

Naval Surface Warfare Center Corona (NSWC, Corona), Command Operations Department Code 104, requires a Firm Fixed Price (FFP) contract for Information Assurance (IA) Certification and Accreditation (C&A) and Tier 2 Security Engineering support.

2.0 BACKGROUND

Code 104 has a requirement to produce two new Information Assurance (IA) Certification and Accreditations (C&A) for two (2) new IT systems. Code 104 requires independent validation services, along with C&A support and Tier 2 Security Engineering to fully accredit the new systems. Additionally, Code104 has a requirement to maintain its Information Assurance (IA) Certification and Accreditation (C&A) status on four existing IT systems. Each of the four (4) IT systems is at a different stage in its C&A lifecycle, ranging from full C&A package development to system maintenance as defined in the DODI 8510.01.

3.0 SCOPE

The scope of this work is for system security validation and Tier 2 Security Engineering support for each of Code 104’s four (4) IT systems and for C&A development support for two (2) new IT systems.

4.0 APPLICABLE DIRECTIVES/DOCUMENTS

Federal Standards: The Contractor is required to adhere to all applicable standards and guidelines specified in the basic contract. In the absence of named standards, Department of the Navy (DON) standards, applicable Federal Information Processing Standards (FIPS), and broadly accepted professional standards shall prevail as related to the associated industries within the task identified in this Section. The most current version of all documents applies through life of this contract.

DOCUMENT TYPE/NO. TITLE LINK DATE

INDUSTRIAL SECURITY

DoD 5220.22-M Change 1 (CH 1)

National Industrial Security Program Operating Manual

(NISPOM)

http://www.dtic.mil/whs/directives/corres/pdf/522022m.pdf

CH 1

3/28/2013 2/28/2006

DoDI 5220.22-R Industrial Security Regulation http://www.dtic.mil/whs/directives/corres/pdf/522022r.pdf 12/4/1985

DoDI 5220.22 National Industrial Security Program (NISP) http://www.dtic.mil/whs/directives/corres/pdf/522022p.pdf

3/18/2011

DoDD 5220.6 Change 4 (CH 4)

Defense Industrial Personnel Security Clearance Review Program http://www.dtic.mil/whs/directives/corres/pdf/522006p.pdf

CH 4

4/20/99 1/2/92

INFORMATION SECURITY

DoDM 5200.01 Vol. 1

DoD Information Security Program: Overview, Classification, and Declassification http://www.dtic.mil/whs/directives/corres/pdf/520001_vol1.pdf

2/24/2012

DoDM 5200.01 Vol. 2 DoD Information Security Program: Marking of Classified http://www.dtic.mil/whs/directives/corres/pdf/520001_vol2.pdf

CH 2

Information of 3/19/2013

DODM 5200.01 Vol. 3

DoD Information Security Program: Protection of Classified Information http://www.dtic.mil/whs/directives/corres/pdf/520001_vol3.pdf

CH 2

3/19/2013 2/24/2012

DODM 5200.01 Vol. 4

DoD Information Security Program: Overview, Controlled Unclassified Information (CUI) http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf

Executive Order 12968

(as Amended)

Access to Classified Information http://www.gpo.gov/fdsys/pkg/FR-1995-08-07/pdf/95-19654.pdf

8/2/1985

Executive Order 13526 Classified National Security Information http://www.gpo.gov/fdsys/pkg/FR-2010-01-05/pdf/E9- 31418.pdf

12/29/2009

Executive Order 13556

Controlled Unclassified Information (CUI) http://www.gpo.gov/fdsys/pkg/FR-2010-11-09/pdf/2010- 28360.pdf

11/4/2010

Navy Telecommunications Directive (NTD) 03-06, Serial C, Mandatory Reporting Requirements Associated with Electronic Spillages of Classified Information https://usff.portal.navy.mil/sites/netwarcom/netops/netops2/neto ps24/Electronic%20Spillage%20References/032052Z%20NOV

%2008%20NTD%2011-

08,%20ELECTRONIC%20SPILLAGE%20REQUIREMENTS.t xt

May 2006

SECNAV M-5510.36

DON Information Security Program http://doni.daps.dla.mil/SECNAV%20Manuals1/5510.36.pdf

June 2006

NSWCCORDIVINST 5510.2D

Information and Personnel Security https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/Documents/ Instructions/NSWCCORDIVINST%205510.2D%20Security%2

0INST%205%20SEP%202014.pdf

9/5/2014

NSWCCORDIV M-5510.2

NSWC Corona Division, Information & Personnel Security Manual https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/Documents/ Instructions/NSWCCORDIVINST%20M5510%202%20Securit y%20Manual%202014%20FINAL.pdf

9/5/2014

NSWCCORDIVINST 5510.4A

Classified Information Systems Removable Media Policy https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/Documents/ Instructions/NSWCINST%205510.4A%20Classified%20Remov able%20Media%2026%20Aug%2014.pdf

8/16/2014

PRIVACY ACT/PII

OSD DA&M Memo

Safeguarding Against and Reporting to the Breach of Personally Identifiable Information

(PII)

http://www.dod.gov/pubs/foi/privacy/docs/OMB_22May2007.p df

5/22/2007

5 U.S.C. 552a

Privacy Act of 1974 http://www.gpo.gov/fdsys/pkg/USCODE-2012-title5/pdf/USCODE-2012-title5-partI-chap5-subchapII-sec552a.pdf

12/31/1974

SECNAVINST 5211.5e

DON Privacy Program http://doni.daps.dla.mil/Directives/05000%20General%20Mana gement%20Security%20and%20Safety%20Services/05-

200%20Management%20Program%20and%20Techniques%20S ervices/5211.5E.pdf

12/28/2005

NSWCCORDIV 5211.1A

DON Privacy Program https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/Documents/ Instructions/NSWCCORDIVINST%205211.1A%20Department

%20of%20the%20navy%20privacy%20program%20- %20FINAL.pdf

12/11/2009

PERSONNEL SECURITY

DoD 5200.2-R, CH 3

Personnel Security Program http://www.dtic.mil/whs/directives/corres/pdf/520008r.pdf

CH 3

2/23/1996 1/1/1987

DoD Instruction 5200.02 Change 1

DoD Personnel Security Program http://www.dtic.mil/whs/directives/corres/pdf/520002_2014.pdf

CH 1

9/9/2014

3/21/2014 SECNAV M-5510.30 DON Personnel Security Program http://doni.daps.dla.mil/SECNAV%20Manuals1/5510.30.pdf June 2006

OPERATIONS SECURITY

DoDD 5205.02E DoD Operations Security (OPSEC) Program http://www.dtic.mil/whs/directives/corres/pdf/520502e.pdf

6/20/2012

National Security Decision Directive (NSDD) 298

National Operations Security http://www.reagan.utexas.edu/archives/reference/Scanned%20N SDS/NSDD298.pdf

1/22/1988

NSWCCORDIVINST 3070.1A

DON Operations Security (OPSEC) Program

Instructions/3070%201A_OPSEC%20FINAL%20V5.pdf

4/4/2012

NSWCCORDIVINST 3070.2

Designation of Critical Information Under the Operations Security (OPSEC) Program https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/Documents/ Instructions/NSWCCORDIVINST%203070.2%20Designation% 20of%20critical%20info%20under%20OPSEC%20Program%2

02014.pdf

6/7/2011

PHYSICAL SECURITY

DoD 5200.08-R, CH 1

Physical Security Program http://www.dtic.mil/whs/directives/corres/pdf/520008r.pdf

CH 1

5/27/2009 4/9/2007

DTM-09-012, CH 4

Interim Policy Guidance for DoD Physical Access Control http://www.dtic.mil/whs/directives/corres/pdf/DTM-09-012.pdf

CH 4

4/22/2014 12/8/2009

DTM-13-005, CH 2

Deviations from the DoD Physical Security Program http://www.dtic.mil/whs/directives/corres/pdf/DTM-13-005.pdf

CH 2

11/5/2014 4/25/2013

NSWCCORDIVINST 5530.2A

Physical Security Plan

Instructions/NSWCCORDIVINST%205530-

2A%20Physical%20Security%20CH- 2%20of%2015%20Aug%2014..pdf

CH-1

10/29/2012

CH-2

8/15/2014 9/8/2011

NSWCCORDIV Form 5530/5

Bomb Threat - Telephone https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/library/doc db/doc_download.cfm?doc_id=426

11/8/2008

ANTITERRORISM SECURITY

NSWCCORDIV Appendix 4 to Annex J

Antiterrorism (AT) Plan

Instructions/Appendix%204%20to%20Annex%20J%20to%20A ntiterrorism%20Plan%20-%20Final%20Draft.pdf

9/29/2011

COMMON ACCESS CARD

(CAC)

DoD Manual 1000.13, Volume 1 DoD Identification (ID) Cards: ID Card Life-Cycle http://www.dtic.mil/whs/directives/corres/pdf/100013_vol1.pdf

1/23/2014

DoD Manual 1000.13, Volume 2

DoD Identification (ID) Cards:

Benefits for Members of the Uniformed Services, Their Dependents, and Other Eligible Individuals http://www.dtic.mil/whs/directives/corres/pdf/100013_vol2.pdf

1/21/2014

DoD Instruction 5200.46

DoD Investigative and Adjudicative Guidance for Issuing the Common Access Card (CAC) http://www.dtic.mil/whs/directives/corres/pdf/520046p.pdf

9/9/2014

Federal Information Processing Standards (FIPS) Publication 201-

Personal Identity Verification (PIV) of Federal Employees and Contractors http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf

August

CNO Ltr Ser N09N2/11U213200 DON Implementation of Homeland Security Presidential Directive http://www.secnav.navy.mil/dusnp/Security/Personnel/Documen ts/11U213200.pdf

12/22/2011

Office of Personnel Management Memorandum

Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD-12 http://www.opm.gov/news/reports-publications/management-budget-reports/homeland-security-presidential-directive-hspd-

12.pdf

7/31/2008

Homeland Security Presidential Directive 12

Policy for a Common Identification Standard for Federal Employees and Contractors http://www.dhs.gov/homeland-security-presidential-directive-12

8/27/2004

5.0 GENERAL REQUIREMENTS

The Contractor shall provide Information Assurance (IA) C&A support to NSWC Corona in all areas of engineering, technical, information assurance and data management capabilities executed by the Code 104 Division. These tasks will include collection and distribution of data, operation and certification of Code 104 IT systems.

The Contractor shall provide rapid startup of assigned tasking to address critical issues relating to Department of Defense (DOD) Information Assurance (IA) policy.

5.1 PERFORMANCE REQUIREMENTS

The contractor shall perform the following in order to achieve the outcomes desired by the government under this contract.

5.1.1 Engineering Technical Support for New Systems (CLIN 0001)

A. Generate Information Assurance (IA) and Certification and Accreditation (C&A) documentation for the two new systems in coordination with local IA Officer, Project Leads, and System Administrators.

a. Command DISA Zone D Enclave, developmental enclave only

b. Command ACAS, a fully STIG’d stand-alone enclave.

These tasks will include:

1. Make recommendations and provide guidance based on DoD IA standards in order to meet IA compliance for system engineering activities.

2. Ensure Certification and Accreditation (C&A) and IA compliance in accordance with the current Department of Defense (DOD) and Department of the Navy (DON) IT instructions and policies for all IT devices owned and supported by the customer.

3. Perform initial system hardening of any IT assets by applying required IA policy and processes.

4. Perform initial on-site scanning of the systems once they are have had applied Information Assurance policy.

5. Remediate findings until acceptable for C&A package submission.

6. Perform the creation, maintenance, updating, and revising all documentation required by the cognizant

Designated Approving Authority (DAA) for the new Code 104 systems. Perform all steps stipulated in DOD and DON instructions and from collaboration meetings and reviews to coordinate and ensure Code 104 systems are accredited in accordance with current DoD and DON policies. All C&A documents will be turned over to the customer.

7. Perform validation services for each of the new systems.

8. Update the Enterprise Mission Assurance Support Service (eMASS) system as required

9. Serve as a Navy Certification Agent and have a current appointment by the Navy Certifying Authority as a Fully Qualified Navy Certification Agent for these systems.

These services are to be provided at: NSWC Corona

B. In coordination with the local IA Officer, Project Leads, and System Administrators, provide monthly system management and maintenance once the new systems have received an Authority to Operate (ATO) and.

1. Assist in the installation software updates and reviews of any new operating systems.

2. Assist in any system upgrades as required.

3. Perform vulnerability tests, scans, patches, security assessments, and remediation for the two new systems to maintain DOD and DON IT compliance as systems go through upgrades and throughout the lifecycle of systems.

4. Perform the creation and maintenance of Plan of Action & Milestones (POA&Ms) in the event the systems exhibit open findings. Assist with the production of a remediation POA&M in coordination with the local IA Officer, Project Leads, and System Administrators.

5. Provide summary data, status reports, and graphs for internal and external IA compliance and technical information gathering that result from data calls given by the Command.

6. Prepare the responses to various IA audits and security inspection questions. Be present during audits and act as technical liaison for audit team(s) to obtain passing and satisfactory audit results in the IA compliance area.

7. Attend weekly IA meetings and specific program meetings.

5.1.2 Engineering Technical Support for Existing IT Systems (CLIN 0001)

A. Provide system integration, installation, and de-installation of unclassified systems supported by the Code 104

Division. The systems will include:

a. Fleet Training Department Information Management System (FTDIMS) which is also known as

(aka) the Command Web Information System (CIWS),

b. the Command Virtual Server System (CVSS) including incorporation and virtualization of

FTDIMS (aka CIWS) and ABM onto the CVSS and any re-accreditations resulting from these consolidations,

c. Base Badging System (BBS) including preparation as Platform Information Technology (PIT) or System Package, and

d. Automated Budget Module (ABM).

These tasks will include:

1. Operate and maintain unclassified enclaves

2. Test the operational functionality of the systems during schedule routine maintenances

3. Perform on-site operational testing on systems

4. Conduct system and equipment level tests to ensure operability prior to deployment

B. Provide information system management (12 test events annually) which includes the following:

1. Operate and maintain unclassified enclaves by establishing system reviews of new operating system releases

2. Install software updates

3. Perform system upgrades

C. Provide development of four (4) documentation packages annually to include:

1. Generate Information Assurance (IA) and Certification and Accreditation (C&A) documentation (4 packages annually)

2. Generate Annual Security Review and Annual Testing of IA Controls for those systems not actively renewing their ATOs. (4 packages annually) The contractor shall scan, update C&A package, update topology, update scorecard, and update POAM. If a system is renewing their ATO, the full C&A package from Section 5.1.2.C.1 will act as the Annual Security Review and Annual Testing of IA Controls.

D. Develop and submit Information Assurance Strategy for IA compliance, and to gain and maintain Authority to Operate (ATO), for all devices owned and supported by the customer at NSWC Corona (for 4 systems annually):

1. Make recommendations and provide guidance based on DoD IA standards in order to meet IA compliance for system engineering activities.

2. Ensure Certification and Accreditation (C&A) and IA compliance in accordance with the current Department of Defense (DOD) and Department of the Navy (DON) IT instructions and policies for all IT devices owned and supported by the customer.

3. Convert existing DIACAP format to new Risk Management Framework when required by NAVSEA.

4. Perform the creation, maintenance, updating, and revising all documentation required by the cognizant

Designated Approving Authority (DAA) for all Code 104 systems, during their life cycle including any updates to C&A needed due to changes in security posture and upgrades to infrastructure or software.

Perform all steps stipulated in DOD and DON instructions and from collaboration meetings and reviews to coordinate and ensure Code 104 systems are accredited in accordance with current DoD and DON policies. All C&A documents will be turned over to the customer.

5. Maintain all collaboration meeting minutes, agendas, and action items

6. Serve as a Navy Certification Agent and have a current appointment by the Navy Certifying Authority as a Fully Qualified Navy Certification Agent

7. Meet the Fully Qualified Level requirements for Navy Certification Agent and represent customer

C&A packages as a validator to the cognizant DAA, NAO, Echelon Command, and Certification Authority (CA).

8. Perform vulnerability tests, scans, patches, security assessments, and remediation on systems for Code 104 systems to maintain DOD and DON IT compliance as systems go through upgrades and throughout the lifecycle of systems.

9. Perform the creation and maintenance of Plan of Action & Milestones (POA&Ms) in the event the systems exhibit open findings. Assist with the production of a remediation POA&M in coordination with the local IA Officer, Project Leads, and System Administrators.

10. Provide summary data, status reports, and graphs for internal and external IA compliance and technical information gathering that result from data calls given by the Command.

11. Prepare the responses to various IA audits and security inspection questions. Be present during audits and act as technical liaison for audit team(s) to obtain passing and satisfactory audit results in the IA compliance area.

12. Attend weekly IA meetings and specific program meetings.

These services are to be provided at: NSWC Corona

5.1.3 Required Qualifications of Contractor

5.1.3.1 C&A Qualifications:

1. Validator C&A personnel must have experience developing Navy Certification & Accreditation packages.

2. Shall be a Fully Qualified Navy Validator. Validator shall be IAT Level 3 certified under Cybersecurity Workforce.

3. Shall have completed or initiated Single Scope Background Investigation (SSBI) for position sensitivity

IT-I.

4. Shall have developed policy for Navy Certification & Accreditation.

5. Shall have experience with working with the NAVSEA Echelon 2 command representatives, Navy CA

Liaisons, & NAO action officers.

6. Shall have experience with configuration and management of host based security system (HBSS).

5.1.3.2 Non-Validator C&A personnel qualifications:

1. Shall be minimum IAT Level 2 certified under Cybersecurity Workforce.

2. Shall have completed or initiated Single Scope Background Investigation (SSBI) for position sensitivity IT-I.

6.0 DELIVERABLES

Deliverables under this contract shall be provided in accordance with “DON Policy on Digital Product/Technical Data,” ASN RD&A MEMO of 23 Oct 04 and shall be provided in accordance with the Contract Data Requirements Lists, (CDRL, DD Form 1423 and supporting Data Item Descriptions (DIDs).

Number Description Periodicity A001 Progress and Status Report Monthly A002 C&A Documentation As required A003 Scan Results As required A004 Contractor's Personnel Roster Monthly A005 Annual Security Review and Annual Testing of IA Controls As required

7.0 GOVERNMENT FURNISHED PROPERTY (GFP)

The Government will provide up to four (4) workspaces at NSWC Corona with at least two (2) Naval Marine Corps Intranet (NMCI) computers. The Government will make at least 1 laptop available for vulnerability scanning. The Government will provide electronic copies of current IA related documentation for each existing system owned by Code 104.

8.0 CONTRACTOR EQUIPMENT

The Contractor will be allowed to use Contractor-owned equipment at NSWC Corona sites to perform IT, IA, and C&A tasks provided the equipment is compliant with DOD and DON IA directives. The NSWC Corona ISSM must approve in writing all Contractor equipment used to perform work on this Statement of Work (SOW). Use of e-mail request/approval is acceptable.

SECURITY REQUIREMENTS

9.1 Personnel Security

Contractors performing on Naval Surface Warfare Center, Corona Division (NSWCCORDIV) contracts are required to successfully obtain and maintain (to include periodic reinvestigations) background investigations and clearances (if required) commensurate to contractor work performance and/or environment. Contract personnel investigation and adjudication records are subject to oversight by the Security Manager (SM) via the establishment of a “servicing” relationship with the records in the Joint Personnel Adjudication System (JPAS), Department of Defense (DoD) system of record for personnel security management. Contractor personnel unable to successfully obtain or maintain the appropriate investigation or necessary clearance shall immediately, upon notification from Facility Security Officer (FSO), be expected to vacate the installation or performance location. NSWCCORDIV Department Manager, Contracting Officer (KO), Contracting Officer’s Representative (COR) and the Security COR shall be notified of any such vacancy.

a. Contractor employees are not normally subjected to investigation unless access to classified information is required, in which case they are investigated and cleared under the National Industrial Security Program (NISP).

Security clearances will not be granted to contractor employees for ease of movement within a restricted, controlled, or industrial area when their duties do not require direct access to classified information.

b. NSWCCORDIV does interact with contractors in matters that involve access to Controlled Unclassified Information (CUI) or areas critical to the operation of the Command which may not satisfy the prerequisites for personnel security clearances but do warrant a judgment of an employee’s trustworthiness. To meet this requirement the Security Office must coordinate and submit a National Agency Check with Inquiries (NACI) background investigation through the Office of Personnel Management (OPM). NSWCCORDIV will also submit a Single Scope Background Investigation (SSBI) or a Phased Periodic Reinvestigation (PPR) when contractor duties are designated as IT-I (privileged access) positions in accordance with SECNAVINST M-5510.30.

c. Contractor FSO shall report reportable derogatory contractor information and behaviors that bring into question an individual’s trustworthiness, judgment, and reliability to protect classified information to the Department of Defense Central Adjudication Facility (DoD CAF) via a JPAS incident report in accordance with the National Industrial Security Program Operating Manual (NISPOM). Contractor shall also notify the KO, COR, and Security COR of such incidents. Upon receipt of derogatory information, NSWCCORDIV Commanding Officer (CO) will determine based on the facts, whether a contractor can continue performing on the contract.

9.2 Contractor’s Personnel Roster

Contractor shall provide Government a personnel roster of all Prime and Subcontractor personnel and submit to the COR and Security COR via e-mail utilizing the following distribution address:

CRNA_Contractor_Rosters@navy.mil no later than 20 business days following award and shall be updated monthly and when changes occur (CDRL A003).

9.3 Physical Security

Access to Government facilities/installations is at the discretion of the Government. The Government reserves the right to rescind access at any time. In each instance when contractors are terminated, separated or the contract is at the end date, the Contractor Manager or FSO shall ensure the prompt return of any issued items to the Government issuer (i.e. Government-owned keys; Common Access Cards (CACs) and/or issued identification picture badges).

a. Contractor Personnel Check-in/Check-out. Contractors entering onto or separating from the contract shall notify the NSWCCORDIV via e-mail utilizing the following distribution address:

CRNA_Checkin_Checkout@navy.mil and include the following information: list the contract number, supporting code, contractor name and first day of work or the last day of work as applicable.

b. Contractor Issued CACs. Contractors issued a U.S. Department of Defense Government Identification CAC shall present the CAC as personal identification to gain entrance to installations. The CAC does not serve as authority to gain access to any Restricted Areas (RAs) within the command without proper vetting and approval.

9.3.1 Identification (ID) Picture Badges

a. NSWCCORDIV shall issue ID picture badges to Contractor personnel who are not issued a CAC.

Contractor shall submit an NSWCCORDIV Badge/Access Request (NSWCCORDIV 5512/22) located at:

https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/Documents/Forms/5512_22_Badge-Access%20Request.pdf.

Badges and/or CACs are the property of the U.S. Government and will be used for official business only.

Unauthorized use of badges and/or CACs shall be reported to the Security Office, local Naval Criminal Investigative Services (NCIS), and the Defense Security Service (DSS) representative assigned to the Prime and/or Sub- Contractor.

b. Standards for Wearing CACs/Badges. Contractors who have been issued CACs and/or badges shall wear them at all times on outer garments above the waist and removed when exiting the installation. CACs or badges shall not be worn outside the installation nor used as personal identification except as indicated by

NSWCCORDIVINST 5530.2A.

c. Separating/Terminating Procedures. Prior to separation/termination of a Contractor who has been issued a CAC and/or badge, the Contractor FSO shall notify the COR and submit a Contractor check-out via e-mail utilizing the following distribution address: CRNA_Checkin_Checkout@navy.mil. The email shall include the contract number, supported code, contractor name, and the last day of work. All credentials shall be collected immediately and returned to the local Security Office or Visitor Reception Office no later than five workdays after the effective date of Contractor’s separation/termination or the end of the contract.

9.3.2 Common Access Cards (CACs) for Contract Performance

Contractor personnel requiring CACs for performance of this contract shall coordinate the issuance of CACs through their assigned Trusted Agent who shall via the Trusted Associate Sponsorship System (TASS) (formerly known as Contractor Verification System (CVS) to process a contractor application for CAC issuance.

a. Sponsorship. The sponsor is the person affiliated with the DoD or other Federal agency who takes responsibility for verifying and authorizing the applicant’s need for an ID card. Applicants applying for a CAC shall be sponsored by a DoD Government official or employee.

b. Eligibility. Eligibility is based on the DoD Government sponsor’s determination of the type and frequency of access required to DoD facilities or networks. The applicant’s sponsor must confirm that the applicant meets one of the following requirements:

(1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely. Access to the DoD network must require the use of a computer with Government-controlled configuration or use of a DoD-approved remote access procedure in accordance with the Defense Information Systems Agency Security Technical Implementation Guide.

(2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures.

(3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD (applicable to DoD contractors only) on a recurring basis for a period of 6 months or more.

a. The frequency of “recurring basis” for access shall be determined by the DoD Component concerned in coordination with installation security policies.

b. CAC eligibility for applicants requiring physical access to multiple DoD facilities on a recurring basis for less than 6 months are risk-based decisions that shall be made by NSWCCORDIV in coordination with installation security policies. These applicants may instead be eligible for local or regional base passes in accordance with local installation security policies and procedures.

c. Background Investigation. Background investigations are required for those individuals eligible for a

CAC. Sponsored CAC applicants shall not be issued a CAC without the required background investigation stipulated in Federal Information Processing Standards Publication 201-2. Initial issuance of a CAC requires, at a minimum, the completion of the Federal Bureau of Investigation (FBI) fingerprint check with favorable results and submission of a NACI (or investigation approved in Federal Investigative Standards). Completed NACI’s for CAC issuance shall be adjudicated in accordance with Office of Personnel Management Memorandum.

d. CAC Expiration Dates. CACs shall be issued for a period not to exceed three years from the date of issuance or contract expiration date, whichever is shorter. Unfunded contract options shall be considered in the determinations of the length of contract. For example, a contractor hired under DoD contract with a base year plus 2 option years shall be issued a CAC with a 3-year expiration. The expiration of the Public Key Infrastructure (PKI) certificates on the CAC shall match the expiration date on the card.

9.4 Information Security

9.4.1 Controlled Unclassified Information (CUI)

a. Controlled Unclassified Information (CUI). CUI is official information that requires the application of controls and protective measures for a variety of reasons and has not been approved for public release, to include technical information, proprietary data, information requiring protection under the Privacy Act of 1974, and Government-developed privileged information involving the award of contracts per Executive Order 13556 and DoDM 5200.01, Vol 4. CUI is a categorical designation that refers to unclassified information that does not meet the standards for National Security Classification under Executive Order 12958, as amended, but is (a) pertinent to the national interest of the United States or to the important interests of entities outside the Federal Government, and

(b) under law or policy requires protection from unauthorized disclosure, special handling safeguards, or prescribed limits on exchange or dissemination.

b. Minimum Requirements for Access to CUI. Prior to access, contractor personnel requiring access to Department of the Navy (DON) CUI or “user level access” to DON or DoD networks and information systems, system security and network defense systems, or to system resources providing visual access and/or ability to input, delete or otherwise manipulate sensitive information without controls to identify and deny sensitive information who do not have clearance eligibility are required to submit a Questionnaire for Non-Sensitive Positions (Standard Form

85) through the cognizant FSO or contractor entity representative to NSWCCORDIV Security Office for a suitability determination by DoD CAF.

c. Minimum Protection Requirements for CUI. Task Order deliverables taking the form of unclassified limited-distribution documents (e.g., For Official Use Only (FOUO), Distribution Statement Controlled) are not authorized for public release and, therefore, shall not be posted on a publicly accessible web server or electronically transmitted via e-mail unless appropriately encrypted.

9.4.2 Personally Identifiable Information (PII)

a. Personally Identifiable Information (PII). PII is defined as information about an individual or individuals which can be used to distinguish or trace an individual’s identity; or relates to, is unique to, or describes the individual (e.g., home address, date of birth, social security number, credit or charge card account numbers, medical information, education information, etc.). PII can also be defined as two unique pieces of personal information linked or linkable to an individual which require safeguarding.

b. Contractor shall:

(1) Mark properly all documents containing PII data (i.e., letters, memos, emails, messages, faxed documents, etc.) as “FOR OFFICIAL USE ONLY – PRIVACY SENSITIVE: ANY MISUSE OR

UNAUTHORIZED DISLCOSURE MAY RESULT IN BOTH CIVIL AND CRIMINAL

PENALTIES” and ensure that e-mails are encrypted.

(2) Ensure that each system of records and documents containing personal information are stored in either a locked cabinet or secured room when not in use by an employee performing official duties related to the records or documents.

(3) Refrain from disclosing any information contained in a system of records by means of communication to any person or agency, except as authorized by NSWCCORDINST 5211.1A or the specific Privacy Act systems of records notice.

(4) Refrain from maintaining unnecessary PII files.

(5) Report any loss or unauthorized disclosure of PII to the Privacy Program Manager immediately upon discovery. If the loss occurs during non-duty hours, the Staff Duty Officer (SDO) must be notified at 951-232-3990. The Privacy Program Manager or SDO must, in turn, notify appropriate privacy officials.

(6) Properly dispose of any PII records in a manner to prevent inadvertent disclosure.

9.4.3 Couriering

Contractors designated to courier classified material in support of contract performance shall be briefed by the Contractor FSO on their responsibility to safeguard classified information, ensure they possess an identification card or badge which contains the contractor’s name, and the name and a photograph of the employee. Contractor shall provide NSWCCORDIV Security COR a list of contractors authorized to courier and updated as changes occur.

9.4.4 Media Transfer Agent/Data Transfer Agent (MTA/DTA)

Contractors designated as Media Transfer Agents shall comply with mandatory training and procedures per NSWCCORDIVINST 5510.4A, Classified Information Systems Removable Media Policy.

9.4.5 Command All Shred Policy

Contractor shall dispose of all unclassified paper whether generated with NSWCCORDIV or received from outside sources through shredding or placement in a command designated shred bin on a daily basis to eliminate unauthorized disclosure of Privacy Act, PII, FOUO information, or other types of CUI. This includes but is not limited to reports, briefings, meeting notes, memos, sticky notes, user manuals, working papers, operating instructions, newspapers, magazines and laminated paper. Brown paper bags (burn bags) and recycle bins are not authorized for storing or accumulation of unclassified office paper.

9.4.6 Loss or Compromise including Electronic Spillages

a. Electronic Spillages. An electronic spillage occurs when data is placed on an IT system possessing insufficient security controls to protect the data at the required classification. In accordance with Navy Telecommunications Directive 03-06 Serial C, Mandatory Reporting Requirements Associated with Electronic Spillages of Classified Information classified information placed on an IT system operating at a lower level of classification must be presumed compromised until proven otherwise.

b. Loss or Compromise Reporting Requirement. Upon discovery of a possible loss or compromise of classified material, the first priority is to protect and/or retrieve the material. Any contractor who becomes aware of a possible loss or compromise of classified information will promptly notify NSWCCORDIV SM. Upon notification, the SM will determine if a Preliminary Inquiry (PI) is necessary.

9.5 Operations Security (OPSEC)

a. OPSEC. As defined in National Security Decision Directive (NSDD) 298, National Operations Security Program, OPSEC is a systematic and proven process by which the U.S. Government and its supporting contractors can deny to potential adversaries information about capabilities and intentions by identifying, controlling, and protecting generally unclassified evidence of the planning and execution of sensitive Government activities.

b. NSWCCORDIV Critical Information List (CIL) Quick Reference Guide. Critical Information Items (CII) 1 through 11 is designated as NSWCORDIV critical information and the Quick Reference Guide must be displayed at each workstation:

(1) Information about operations, missions, and exercises.

(2) Test schedule or specific test location.

(3) Date, time, route, or destination of the off-base movement of classified or sensitive information (e.g., equipment, documents, etc.) or arms, ammunition, and explosives (AA&E).

(4) Location of sensitive equipment (AA&E, COMSEC, etc.) or sensitive facilities (e.g., SCIF or laboratories).

(5) Project milestones.

(6) Personnel information that reveals force structure and readiness such as recall rosters.

(7) Information about capabilities, vulnerabilities, and limitations; information revealing a security weakness.

(8) Existence and/or details of intrusions into or attacks against DoD networks or information systems, including, but not limited to tactics, techniques and procedures used, network vulnerabilities exploited, and data targeted for exploitation.

(9) Network (and system) user IDs and passwords.

(10) Movements of key command personnel or visiting dignitaries, including itineraries, meeting agendas, hotel and transportation reservations, plans/routes, etc. (recommend protection of this information for all command personnel).

(11) Information revealing the security classification of equipment, systems, operations, missions, exercises, etc.

c. CIL Countermeasures. Contractor shall employ the following countermeasures to mitigate the susceptibility of critical information to exploitation, when applicable:

(1) OPSEC awareness & practice.

(2) Public key infrastructure when using (PKI) encryption and digital signature when using NIPRNET or transmission via secure systems or means (e.g., SIPRNET, JWICS, secure fax, secure phone).

(3) Adhere to All Shred policy and do not excessively fill shred bins.

(4) When janitorial services or other un-cleared visitors are in the work area, protect sensitive information by covering or putting away documents, refrain from discussing in their presence, etc.

(5) Limit detail in contract, budget, presentation, press release or publication to that essential for legitimacy.

(6) Use protected databases, follow guidance on composing strong passwords (avoid words found in dictionary), and protect user IDs and CACs.

(7) Do not provide more information than necessary in voicemail announcement.

(8) Outlook out- of-office autoreply shall not include dates and locations for out of command option.

(9) Vary day-to-day routines, both on and off the installation, including travel routine.

(10) During testing and evaluation, practice OPSEC methodologies of staging out of sight, desensitization, or speed of execution.

(11) Routinely change call signs.

d. Contractor shall:

(1) Display CIL Quick Reference Guide at workstation.

(2) Strictly adhere to need-to-know principles when discussing sensitive information and/or information that could be considered as an indicator of operational plans and/or intentions.

(3) Be knowledgeable of critical information, indicators, and countermeasures.

(4) Encrypt sensitive information in transit and at rest, in accordance with NSDD 298.

(5) Report OPSEC issues (potential critical information, vulnerabilities, indicators, etc.) to the OPSEC Program Manager.

9.6 Antiterrorism (AT) Foreign Travel

Contractors officially traveling overseas shall contact the Antiterrorism Officer (ATO) and if required, complete all mandated Foreign Travel requirements.

9.7 General Security Requirements

a. Subcontracting. Contractor shall immediately notify the COR and Security COR prior to subcontracting and submit a copy of the sub-contract DD254 if applicable.

b. Security Inspections. NSWCCORDIV security inspections shall occur annually and the Department Heads and CORs shall be informed of inspection results. Security inspections will include all embedded contractor personnel working in government facilities. Unannounced security spot-checks of departments shall occur throughout the year and are at the discretion of the Government.

c. Foreign Interests. Contractors with defined Foreign Interests (a Facility that is owned, controlled, or influenced by foreign interests) will ensure adherence to DoD and DON regulations, directives and policies. Full disclosure to NSWCCORDIV KO, COR, and Security COR is required.

d. Emergency Management.

(1) Contractors shall ensure that they are able to receive Command Desktop Notification System (CDNS) (aka AtHoc) messages by contacting Navy Marine Corps Intranet (NMCI) at 1-866-843-6624.

The CDNS alerts registered users to various hazards, emergencies, traffic conditions, and Force Protection Condition (FPCON) changes, etc., both during and after working hours. The Automated Telephone Notification System (ATNS), a sub-system of the Wide Area Alert Network (WAAN), enables a registered user to receive telephonic, email, and text alerts on devices indicated.

(2) Contractors shall maintain a copy of the NSWCCORDIV Bomb Threat Card (NSWCCORDIV 5530/5) next to each Command telephone. If a telephonic bomb threat is received, complete the card as accurately as possible and immediately contact the Regional Dispatch Center (RDC).

10.0 ON-SITE ENVIRONMENTAL AWARENESS

(a) In accordance with 29 CFR 1925 Safety and Health Standards for Federal Service Contracts, the contractor shall strictly adhere to Federal Occupational Safety and Health Administration (OSHA) Regulations, Environmental Protection Agency (EPA) Regulations, and all applicable state and local requirements.

(b) In accordance with OPNAVINST 5090.1 (series) the contractor shall ensure that each contractor employee reads the NSWC Corona Division document entitled, “Commanding Officer’s Environmental and Natural Resources Policy statement” within 30 days of commencing performance at NSWC Corona Division. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Contracting Officer Representative (COR) ) or Subject Matter Expert (SME) for additional assistance/options.

(c) In accordance with OPNAVINST 5090.1 (series) the contractor shall ensure that each contractor employee who will be resident at NSWC Corona Division completes the Environmental Management System (EMS) Awareness training within 30 days of commencing performance at NSWC Corona Division. This training is available at https://www.navfac.ecatts.com/ or you can contact your Contracting Officer Representative (COR) ) or Subject Matter Expert (SME) for additional options.

(d) In accordance with OPNAVINST 5090.1 (series) the contractor shall certify that employees have read the NSWC Corona Divisions document entitled “Commanding Officer’s Environmental and Natural Resources Policy statement” and taken the Environmental Management System (EMS) Awareness training within 30 days of commencing performance at NSWC Corona Division. This shall be accomplished by e-mail to their Contracting Officer Representative (COR) ) or Subject Matter Expert (SME) with a copy to Environmental, Safety and Health (ESH) Program Office (Code 013) (joseph.edgman@navy.mil). The e-mail shall include the employees name, work site, and contract number.

(e) In accordance with OPNAVINST 5090.1 (series) the contractor shall complete the “ECATTS Training Workbook” for each contractor employee who will be resident at NSWC Corona Division within 30 days of commencing performance at NSWC Corona Division. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Contracting Officer Representative (COR) ) or Subject Matter Expert (SME) for additional assistance/options.

11.0 ON-SITE SAFETY AWARENESS

(a) In accordance with 29 CFR 1925 Safety and Health Standards for Federal Service Contracts, the contractor company shall strictly adhere to Federal Occupational Safety and Health Administration (OSHA) Regulations, Environmental Protection Agency (EPA) Regulations, and all applicable state and local requirements. OSHA Directive CSP 03-01-003 Voluntary Protection Programs (VPP) Policies and Protection Manual defines contractors into two categories.

1) Applicable Contractor. A contractor whose employees worked at least 1,000 hours for a VPP participant in any calendar quarter within the last 12 months and are not directly supervised by the applicant/participant.

2) Nested Contractor. Reference (a) does not specifically define this term. However, in discussing injury and illness data requirements for contractors, the OSHA guidance states that “nested contractors. . . are supervised by host site management”, and “are regularly intermingled with the owner’s employees and under direct supervision by management”.

(b) In accordance with OPNAVINST 5100.23(series) and OSHA Directive CSP 03-01-003, our command is to ensure that all contractor employees have read the NSWC Corona Divisions document entitled, “Commanding Officers Occupational Safety and Health Policy Statement” and “Occupational Safety and Health Administration (OSHA) Voluntary Protection Programs (VPP) document” within 30 days of commencing performance. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Contracting Officer Representative (COR) or Subject Matter Expert (SME) for additional assistance/options.

(c) In accordance with OPNAVINST 5100.23(series) and OSHA Directive CSP 03-01-003, our command is to ensure that all nested contractor employees completes the Voluntary Protection Program (VPP) Awareness Training within 30 days of commencing performance at NSWC Corona Division. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Contracting Officer Representative (COR) ) or Subject Matter Expert (SME) for additional assistance/options.

(d) In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, the contractor company shall certify that all contractor employees have read the NSWC Corona Divisions document entitled “Commanding Officers Occupational Safety and Health Policy Statement” and “Occupational Safety and Health Administration (OSHA) Voluntary Protection Programs (VPP) document” and all nested contractor employees have taken the Voluntary Protection Program (VPP) awareness training within 30 days of commencing performance at NSWC Corona Division.