RFQ_N6426717T0310.pdf

N6426717T0310

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Lot A&A Support

FFP

Base Year Provide support IAW the SOW FOB: Destination

NET AMT

0002 1 Lot CS Engineering Technical Support

FFP

Base Year

1001 1 Lot OPTION A&A Support

FFP

Option Year 1

1002 1 Lot OPTION CS Engineering Technical Support

FFP

Option Year 1

CLAUSES INCORPORATED BY FULL TEXT

HQ B-2-0022 CONTRACT SUMMARY FOR PAYMENT OFFICE (FIXED

PRICE) (FEB 1997)

This entire contract is fixed price.

(End of Text)

Section C - Descriptions and Specifications

SALES TAX EXEMPTION

The contractor is hereby advised that the United States Government and Agencies thereof are exempt from State and Local Government tax by virtue of Article 6 of the United States Constitution. No exemption certificate is required.

STATEMENT OF WORK

1. INTRODUCTION

Naval Surface Warfare Center Corona Division (NSWC Corona) Acquisition and Readiness Department, Trouble and Failure Report (TFR) Project requires a Firm Fixed Price (FFP) contract for Cybersecurity (CS) Assessment and Accreditation (A&A) validation services and TFR CS engineering technical support.

2. BACKGROUND

The TFR Project has a requirement to achieve and maintain its CS (A&A) status on TFR System. The TFR System requires a valid Authority to Operate (ATO) and independent validation services and servicing to ensure proper security baselines are adequate and reported per guidance and the ATO reflects all current and planned network configurations. In order to meet these requirements, TFR Project requires CSA&A support and system support services listed in this Statement of Work (SOW), including support related to: the A&A documentation requirements per Risk Management Framework (RMF) requirements, including A&A package, Assured Compliance Assessment Solution (ACAS) scanning, mitigation, and reporting, implementing Security Technical Implementation Guide (STIG) requirements and generating checklists, Plan of Action and Milestones (POA&M) updates, A&A artifact documents, and uploading into Enterprise Mission Assurance Support Service (eMASS). Support is required to perform validation requirements to include: Validate CS Security Controls, validate POA&M, validate Scorecard, representation at Checkpoint/Collaboration Meeting(s), and perform vulnerability and compliance management and support finding remediation.

3. SCOPE

The scope of this work is for system security validation and Tier 2 Security Engineering support of TFR Project information technology (IT) systems and corresponding ATO maintenance. The TFR System covered by this SOW is the TFR Enclave – Unclassified Strategic Weapons System Network (SWSNet), including production, development, and test environments; and the TFR application software. The ATO(s) shall be maintained current to reflect system configuration and CS requirements. The scope of work also includes CS engineering support as defined herein.

3.1 TFR Enclave Description (TFR Enclave ATO was renewed in 2015)

The TFR Enclave currently consists of the following physical/virtual servers, operating systems, and workstations/hosts, along with server/machine counts (Workstation/host: no. of servers):

1) Development Environment: Virtual (W2K8R2:5) (with all servers transition to MS Server 2012)

2) DMZ: Virtual (W2K8R2:1)

3) Production Environment: Virtual (W2K8R2:3)

4) Infrastructure Environment: Physical (W2K8R2:2) and Virtual (W2K8R2:10, Win7:2)

5) Virtualization Management (vSphere): Physical (ESXi:6)

6) Test Environment: Virtual: 5

7) SAN: Physical: 1

8) Tape: Physical/Virtual Combined: 1

9) Firewall: Physical: 1

10) Intrusion Detection and Prevention (IDP): Physical: 1

11) Switches: Physical: 8

12) Workstations: Physical Host and Virtual Combined (Win7/10: 45)

4. APPLICABLE DIRECTIVES/DOCUMENTS

See Attachment 1 Applicable Directives in Section J

5. PERFORMANCE REQUIREMENTS

The Contractor shall provide CS A&A support to NSWC Corona in the areas of engineering, technical, information assurance, and data management capabilities executed by the TFR Project. The Contractor shall provide qualified personnel to perform the tasks in support of the TFR Project described in this SOW. These tasks will include independent A&A validation, maintaining applicable A&A status and documentation, and CS engineering support as described herein.

The Contractor shall provide rapid startup of assigned tasking to address critical issues relating to DoD policy and TFR Project CS postures.

The Contractor shall perform the following in order to achieve the outcomes desired by the Government under this contract.

5.1. A&A Support (TFR Enclave)

Conduct Accreditation and/or Annual Security Review and Testing of CS Security Controls for TFR System – 35 days at 8 hours/day.

5.1.1. Maintain and update existing ATOs to reflect current application and/or network configuration, including workstation and development network assets (TFR Enclave ATO was renewed in 2015). Annual Review(s) will be required during this contracting period;

5.1.2. Submit strategy for CS compliance to maintain ATO(s) to TFR Project (For Annual Review and/or Accreditation), including RMF considerations.

5.1.3. Make recommendations and provide guidance based on DoD and DoN CS standards in order to meet CS compliance for system engineering activities.

5.1.4. Ensure A&A and CS compliance in accordance with the current DoD and DoN IT Instructions and policies for all IT devices owned and supported by the customer.

5.1.5. Perform and/or assist the maintenance, updating, and revising all documentation required by the cognizant Authorizing Official (AO) for all TFR Project systems, during their life cycle. A&A documentation shall be transitioned into the RMF format and content.

5.1.6. Perform all steps stipulated in DoD and DoN Instructions and from checkpoint/collaboration meetings and reviews to coordinate and ensure systems are accredited in accordance with current DoD and DoN policies. All A&A documents will be turned over to the customer.

5.1.7. Maintain all checkpoint/collaboration meeting minutes, agendas, and action items.

5.1.8. Serve as a Navy Certification Agent and have a current appointment by the Navy Certifying Authority as a Navy Qualified Validator.

5.1.9. Meet the Fully Qualified Level requirements for Navy Certification Agent and represent customer A&A packages as a Validator to the cognizant AO, Office of Authorizing Official (OAO), Echelon Command, and Security Control Assessor (SCA).

5.1.10. Perform assessments on vulnerability tests, scans, patches, and provide remediation on systems to maintain DoD and DoN IT compliance throughout the lifecycle of systems.

5.1.11. Perform the maintenance of POA&Ms in eMASS in the event the systems exhibit open findings. Assist with the production of a remediation POA&M in coordination with the local CS Officer, Project Leads, and System Administrators.

5.1.12. Assist in the preparation of summary data, status reports, and graphs for internal and external CS compliance and technical information gathering that result from data calls given by the Command.

5.1.13. Prepare the responses to various CS audits and security inspection questions. Be present during audits and act as technical liaison for audit team(s) to obtain passing and satisfactory audit results in the CS compliance area.

5.2. CS Engineering Technical Support (TFR Enclave)

Support monitoring, review and mitigation of the TFR Enclave – 4 days/month x 12 months at 6 hours/day.

These tasks will be conducted as required per TFR Enclave system administration, and shall include, but not limited to:

5.2.1. Review/update and maintain enclave security devices such as anti-virus servers, log servers, Host Based Security System (HBSS), ACAS, and Network intrusion detection devices. Assist in maintaining security device system signature updates as required.

5.2.2. Support/review port security for all network switches.

5.2.3. Review/support issues arising from network access list changes.

5.2.4. Review and analyze network logs, as well as notifying appropriate security personnel in the event of a possible security violation/network intrusion.

6. DELIVERABLES

Deliverables under this contract shall be provided in accordance with “DON Policy on Digital Product/Technical Data,” ASN RD&A MEMO of 23 Oct 04 and shall be provided in accordance with the Contract Data Requirements Lists, (CDRL, DD Form 1423 and supporting Data Item Descriptions (DIDs).

Number Description Periodicity A001 Progress and Status Report Monthly A002 RMF Documentation As required A003 Scan Results As required A004 Annual Security Review and Annual Testing of Security Controls As required A005 Contractor's Personnel Roster 20 Days ARO and as required thereafter.

7. GENERAL REQUIREMENTS

This section describes the general requirements for this effort. The following sub-sections provide details of various considerations on this effort.

7.1 Non-Personal Services

The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Procuring Contracting Officer (PCO) immediately.

7.2 Business Relations

The contractor shall successfully integrate and coordinate all activity needed to execute the requirement. The contractor shall manage the timeliness, completeness, and quality of problem identification. The contractor shall provide corrective action plans, proposal submittals, timely identification of issues, and effective management of subcontractors. The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

7.3 Contract Administration and Management

The following subsections specify requirements for contract, management, and personnel administration.

7.3.1 Contract Management

The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. The contractor must maintain continuity between the support operations and the contractor's corporate offices.

7.3.2 Contract Administration

The contractor shall establish processes and assign appropriate resources to effectively administer the requirement.

The contractor shall respond to Government requests for contractual actions in a timely fashion. The contractor shall have a single point of contact between the Government and Contractor personnel assigned to support contracts or task orders. The contractor shall assign work effort and maintain proper and accurate time keeping records of personnel assigned to work on the requirement. The Contractor shall provide the necessary resources and infrastructure to manage, perform, and administer the contract.

7.3.3 Personnel Administration

The contractor shall provide the following management and support as required. The contractor shall provide for employees during designated Government non-work days or other periods where Government offices are closed due to weather or security conditions. The contractor shall maintain the currency of their employees by providing initial and refresher training as required to meet the PWS requirements. The contractor shall provide administrative support to employees in a timely fashion (time keeping, leave processing, pay, emergency needs).

7.4 Subcontract Management

N/A

7.5 Contractor Personnel, Disciplines, and Specialties

The contractor shall accomplish the assigned work by employing and utilizing qualified personnel with appropriate combinations of education, training, and experience. The contractor shall match personnel skills to the work or task with a minimum of under/over employment of resources. The contractor shall ensure the labor categories as established on contract award, labor rates, and man-hours utilized in the performance of the requirements herein will be the minimum necessary to accomplish the task.

7.6 Location and Hours of Work

Accomplishment of this tasking requires work at NSWC Corona.

7.7 Travel / Temporary Duty (TDY)

N/A

7.8 Transition

N/A

8. SECURITY REQUIREMENTS

8.1 Personnel Security

Contractors performing on Naval Surface Warfare Center, Corona Division (NSWCCORDIV) contracts are required to successfully obtain and maintain (to include periodic reinvestigations) background investigations and clearances (if required) commensurate to contractor work performance and/or environment. Contract personnel investigation and adjudication records are subject to oversight by the Security Manager (SM) via the establishment of a “servicing” relationship with the records in the Joint Personnel Adjudication System (JPAS), Department of Defense (DoD) system of record for personnel security management. Contractor personnel unable to successfully obtain or maintain the appropriate investigation or necessary clearance shall immediately, upon notification from Facility Security Officer (FSO) be expected to vacate the installation or performance location. NSWCCORDIV Department Manager, Contracting Officer (KO), Contracting Officer’s Representative (COR) and the SM shall be notified of any such vacancy.

a. Contractor employees are not normally subjected to investigation unless access to classified information is required, in which case they are investigated and cleared under the National Industrial Security Program (NISP).

Security clearances will not be granted to contractor employees for ease of movement within a restricted, controlled, or industrial area when their duties do not require direct access to classified information.

b. NSWCCORDIV does interact with contractors in matters that involve access to Controlled Unclassified Information (CUI) or areas critical to the operation of the Command which may not satisfy the prerequisites for personnel security clearances but do warrant a judgment of an employee’s trustworthiness. To meet this requirement the Security Office must coordinate and submit a National Agency Check with Inquiries (NACI) background investigation through the Office of Personnel Management (OPM). NSWCCORDIV will also submit a Single Scope Background Investigation (SSBI) or a Phased Periodic Reinvestigation (PPR) when contractor duties are designated as IT-I (privileged access) positions in accordance with SECNAVINST M-5510.30.

c. Contractor FSO shall report reportable derogatory contractor information and behaviors that bring into question an individual’s trustworthiness, judgment, and reliability to protect classified information to the Department of Defense Central Adjudication Facility (DoD CAF) via a JPAS incident report in accordance with the National Industrial Security Program Operating Manual (NISPOM). Contractor shall also notify the KO, COR, and SM of such incidents. Upon receipt of derogatory information, NSWCCORDIV Commanding Officer (CO) will determine based on the facts, whether a contractor can continue performing on the contract.

8.2 Contractor’s Personnel Roster

Contractor shall provide Government a personnel roster of all Prime and Subcontractor personnel and submit to the COR and Security COR via e-mail utilizing the following distribution address:

CRNA_Contractor_Rosters@navy.mil no later than 20 business days following award and shall be updated monthly and when changes occur (CDRL A005).

8.3 Physical Security

Access to Government facilities/installations is at the discretion of the Government. The Government reserves the right to rescind access at any time. In each instance when contractors are terminated, separated or the contract is at the end date, the Contractor Manager or FSO shall ensure the prompt return of any issued items to the Government issuer (i.e. Government-owned keys; Common Access Cards (CACs) and/or issued identification picture badges).

a. Contractor Personnel Check-in/Check-out. Contractors entering onto or separating from the contract shall notify the NSWCCORDIV via e-mail utilizing the following distribution address: CRNA_Checkin_Checkout@navy.mil and include the following information: list the contract number, supporting code, contractor name and first day of work or the last day of work as applicable.

b. Contractor Issued CACs. Contractors issued a U.S. Department of Defense Government Identification CAC shall present the CAC as personal identification to gain entrance to installations. The CAC does not serve as authority to gain access to any Restricted Areas (RAs) within the command without proper vetting and approval.

8.3.1 Identification (ID) Picture Badges.

a. NSWCCORDIV shall issue ID picture badges to Contractor personnel who are not issued a CAC. Contractor shall submit an NSWCCORDIV Badge/Access Request (NSWCCORDIV 5512/22) located at:

https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/Documents/Forms/5512_22_Badge-Access%20Request.pdf.

Badges and/or CACs are the property of the U.S. Government and will be used for official business only.

Unauthorized use of badges and/or CACs shall be reported to the Security Office, local Naval Criminal Investigative Services (NCIS), and the Defense Security Service (DSS) representative assigned to the Prime and/or Sub- Contractor.

b. Standards for Wearing CACs/Badges. Contractors who have been issued CACs and/or badges shall wear them at all times on outer garments above the waist and removed when exiting the installation. CACs or badges shall not be worn outside the installation nor used as personal identification except as indicated by NSWCCORDIVINST 5530.2A.

c. Separating/Terminating Procedures. Prior to separation/termination of a Contractor who has been issued a CAC and/or badge, the Contractor FSO shall notify the COR and submit a Contractor check-out via e-mail utilizing the following distribution address: CRNA_Checkin_Checkout@navy.mil. The email shall include the contract number, supported code, contractor name, and the last day of work. All credentials shall be collected immediately and returned to the local Security Office or Visitor Reception Office no later than five workdays after the effective date of Contractor’s separation/termination or the end of the contract.

8.3.2 Common Access Cards (CACs) for Contract Performance

Contractor personnel requiring CACs for performance of this contract shall coordinate the issuance of CACs through their assigned Trusted Agent who shall via the Trusted Associate Sponsorship System (TASS) (formerly known as Contractor Verification System (CVS) process a contractor application for CAC issuance.

a. Sponsorship. The sponsor is the person affiliated with the DoD or other Federal agency who takes responsibility for verifying and authorizing the applicant’s need for an ID card. Applicants applying for a CAC shall be sponsored by a DoD Government official or employee.

b. Eligibility. Eligibility is based on the DoD Government sponsor’s determination of the type and frequency of access required to DoD facilities or networks. The applicant’s sponsor must confirm that the applicant meets one of the following requirements:

(1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely. Access to the DoD network must require the use of a computer with Government-controlled configuration or use of a DoD-approved remote access procedure in accordance with the Defense Information Systems Agency Security Technical Implementation Guide.

(2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures.

(3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD (applicable to DoD contractors only) on a recurring basis for a period of 6 months or more.

a. The frequency of “recurring basis” for access shall be determined by the DoD Component concerned in coordination with installation security policies.

b. CAC eligibility for applicants requiring physical access to multiple DoD facilities on a recurring basis for less than 6 months are risk-based decisions that shall be made by NSWCCORDIV in coordination with installation security policies. These applicants may instead be eligible for local or regional base passes in accordance with local installation security policies and procedures.

c. Background Investigation. Background investigations are required for those individuals eligible for a CAC.

Sponsored CAC applicants shall not be issued a CAC without the required background investigation stipulated in Federal Information Processing Standards Publication 201-2. Initial issuance of a CAC requires, at a minimum, the completion of the Federal Bureau of Investigation (FBI) fingerprint check with favorable results and submission of a NACI (or investigation approved in Federal Investigative Standards). Completed NACI’s for CAC issuance shall be adjudicated in accordance with Office of Personnel Management Memorandum.

d. CAC Expiration Dates. CACs shall be issued for a period not to exceed three years from the date of issuance or contract expiration date, whichever is shorter. Unfunded contract options shall be considered in the determinations of the length of contract. For example, a contractor hired under DoD contract with a base year plus 2 option years shall be issued a CAC with a 3-year expiration. The expiration of the Public Key Infrastructure (PKI) certificates on the CAC shall match the expiration date on the card.

8.4 Information Security

8.4.1 Controlled Unclassified Information (CUI)

a. Controlled Unclassified Information (CUI). CUI is official information that requires the application of controls and protective measures for a variety of reasons and has not been approved for public release, to include technical information, proprietary data, information requiring protection under the Privacy Act of 1974, and Government-developed privileged information involving the award of contracts per Executive Order 13556 and DoDM 5200.01, Vol 4. CUI is a categorical designation that refers to unclassified information that does not meet the standards for National Security Classification under Executive Order 12958, as amended, but is (a) pertinent to the national interest of the United States or to the important interests of entities outside the Federal Government, and (b) under law or policy requires protection from unauthorized disclosure, special handling safeguards, or prescribed limits on exchange or dissemination.

b. Minimum Requirements for Access to CUI. Prior to access, contractor personnel requiring access to Department of the Navy (DON) CUI or “user level access” to DON or DoD networks and information systems, system security and network defense systems, or to system resources providing visual access and/or ability to input, delete or otherwise manipulate sensitive information without controls to identify and deny sensitive information who do not have clearance eligibility are required to submit a Questionnaire for Non-Sensitive Positions (Standard Form 85) through the cognizant FSO or contractor entity representative to NSWCCORDIV Security Office for a suitability determination by DoD CAF.

c. Minimum Protection Requirements for CUI. Task Order deliverables taking the form of unclassified limited-distribution documents (e.g., For Official Use Only (FOUO), Distribution Statement Controlled) are not authorized for public release and, therefore, shall not be posted on a publicly accessible web server or electronically transmitted via e-mail unless appropriately encrypted.

8.4.2 Personally Identifiable Information (PII)

a. Personally Identifiable Information (PII). PII is defined as information about an individual or individuals which can be used to distinguish or trace an individual’s identity; or relates to, is unique to, or describes the individual (e.g., home address, date of birth, social security number, credit or charge card account numbers, medical information, education information, etc.). PII can also be defined as two unique pieces of personal information linked or linkable to an individual which require safeguarding.

b. Contractor shall:

(1) Mark properly all documents containing PII data (i.e., letters, memos, emails, messages, faxed documents, etc.)

as “FOR OFFICIAL USE ONLY – PRIVACY SENSITIVE: ANY MISUSE OR UNAUTHORIZED DISLCOSURE MAY RESULT IN BOTH CIVIL AND CRIMINAL PENALTIES” and ensure that e-mails are encrypted.

(2) Ensure that each system of records and documents containing personal information are stored in either a locked cabinet or secured room when not in use by an employee performing official duties related to the records or documents.

(3) Refrain from disclosing any information contained in a system of records by means of communication to any person or agency, except as authorized by NSWCCORDINST 5211.1A or the specific Privacy Act systems of records notice.

(4) Refrain from maintaining unnecessary PII files.

(5) Report any loss or unauthorized disclosure of PII to the Privacy Program Manager immediately upon discovery.

If the loss occurs during non-duty hours, the Staff Duty Officer (SDO) must be notified at 951-232-3990. The Privacy Program Manager or SDO must, in turn, notify appropriate privacy officials.

(6) Properly dispose of any PII records in a manner to prevent inadvertent disclosure.

8.4.3 Couriering

Contractors designated to courier classified material in support of contract performance shall be briefed by the Contractor FSO on their responsibility to safeguard classified information, ensure they possess an identification card or badge which contains the contractor’s name, and the name and a photograph of the employee. Contractor shall provide NSWCCORDIV SM and COR a list of contractors authorized to courier and updated as changes occur.

8.4.4 Media Transfer Agent/Data Transfer Agent (MTA/DTA)

Contractors designated as Media Transfer Agents shall comply with mandatory training and procedures per NSWCCORDIVINST 5510.4A, Classified Information Systems Removable Media Policy.

8.4.5 Command All Shred Policy

Contractor shall dispose of all unclassified paper whether generated with NSWCCORDIV or received from outside sources through shredding or placement in a command designated shred bin on a daily basis to eliminate unauthorized disclosure of Privacy Act, PII, FOUO information, or other types of CUI. This includes but is not limited to reports, briefings, meeting notes, memos, sticky notes, user manuals, working papers, operating instructions, newspapers, magazines and laminated paper. Brown paper bags (burn bags) and recycle bins are not authorized for storing or accumulation of unclassified office paper.

8.4.6 Loss or Compromise including Electronic Spillages

a. Electronic Spillages. An electronic spillage occurs when data is placed on an IT system possessing insufficient security controls to protect the data at the required classification. In accordance with Navy Telecommunications Directive 03-06 Serial C, Mandatory Reporting Requirements Associated with Electronic Spillages of Classified Information classified information placed on an IT system operating at a lower level of classification must be presumed compromised until proven otherwise.

b. Loss or Compromise Reporting Requirement. Upon discovery of a possible loss or compromise of classified material, the first priority is to protect and/or retrieve the material. Any contractor who becomes aware of a possible loss or compromise of classified information will promptly notify NSWCCORDIV SM. Upon notification, the SM will determine if a Preliminary Inquiry (PI) is necessary.

8.5 Operations Security (OPSEC)

a. OPSEC. As defined in National Security Decision Directive (NSDD) 298, National Operations Security Program, OPSEC is a systematic and proven process by which the U.S. Government and its supporting contractors can deny to potential adversaries information about capabilities and intentions by identifying, controlling, and protecting generally unclassified evidence of the planning and execution of sensitive Government activities.

b. NSWCCORDIV Critical Information List (CIL) Quick Reference Guide. Critical Information Items (CII) 1 through 11 is designated as NSWCORDIV critical information and the Quick Reference Guide must be displayed at each workstation:

(1) Information about operations, missions, and exercises.

(2) Test schedule or specific test location.

(3) Date, time, route, or destination of the off-base movement of classified or sensitive information (e.g., equipment, documents, etc.) or arms, ammunition, and explosives (AA&E).

(4) Location of sensitive equipment (AA&E, COMSEC, etc.) or sensitive facilities (e.g., SCIF or laboratories).

(5) Project milestones.

(6) Personnel information that reveals force structure and readiness such as recall rosters.

(7) Information about capabilities, vulnerabilities, and limitations; information revealing a security weakness.

(8) Existence and/or details of intrusions into or attacks against DoD networks or information systems, including, but not limited to tactics, techniques and procedures used, network vulnerabilities exploited, and data targeted for exploitation.

(9) Network (and system) user IDs and passwords.

(10) Movements of key command personnel or visiting dignitaries, including itineraries, meeting agendas, hotel and transportation reservations, plans/routes, etc. (recommend protection of this information for all command personnel).

(11) Information revealing the security classification of equipment, systems, operations, missions, exercises, etc.

c. CIL Countermeasures. Contractor shall employ the following countermeasures to mitigate the susceptibility of critical information to exploitation, when applicable:

(1) OPSEC awareness & practice.

(2) Public key infrastructure when using (PKI) encryption and digital signature when using NIPRNET or transmission via secure systems or means (e.g., SIPRNET, JWICS, secure fax, secure phone).

(3) Adhere to All Shred policy and do not excessively fill shred bins.

(4) When janitorial services or other un-cleared visitors are in the work area, protect sensitive information by covering or putting away documents, refrain from discussing in their presence, etc.

(5) Limit detail in contract, budget, presentation, press release or publication to that essential for legitimacy.

(6) Use protected databases, follow guidance on composing strong passwords (avoid words found in dictionary), and protect user IDs and CACs.

(7) Do not provide more information than necessary in voicemail announcement.

(8) Outlook out- of-office autoreply shall not include dates and locations for out of command option.

(9) Vary day-to-day routines, both on and off the installation, including travel routine.

(10) During testing and evaluation, practice OPSEC methodologies of staging out of sight, desensitization, or speed of execution.

(11) Routinely change call signs.

d. Contractor shall:

(1) Display CIL Quick Reference Guide at workstation.

(2) Strictly adhere to need-to-know principles when discussing sensitive information and/or information that could be considered as an indicator of operational plans and/or intentions.

(3) Be knowledgeable of critical information, indicators, and countermeasures.

(4) Encrypt sensitive information in transit and at rest, in accordance with NSDD 298.

(5) Report OPSEC issues (potential critical information, vulnerabilities, indicators, etc.) to the OPSEC Program Manager.

8.6 Antiterrorism (AT) Foreign Travel

Contractors officially traveling overseas shall contact the Antiterrorism Officer (ATO) and if required, complete all mandated Foreign Travel requirements.

8.7 General Security Requirements

a. Subcontracting. Contractor shall immediately notify the COR and Security COR prior to subcontracting and submit a copy of the sub-contract DD254 if applicable.

b. Security Inspections. NSWCCORDIV security inspections shall occur annually and the Department Heads and CORs shall be informed of inspection results. Security inspections will include all embedded contractor personnel working in government facilities. Unannounced security spot-checks of departments shall occur throughout the year and are at the discretion of the Government.

c. Foreign Interests. Contractors with defined Foreign Interests (a Facility that is owned, controlled, or influenced by foreign interests) will ensure adherence to DoD and DON regulations, directives and policies. Full disclosure to NSWCCORDIV KO, COR, and Security COR is required.

d. Emergency Management.

(1) Contractors shall ensure that they are able to receive Command Desktop Notification System (CDNS) (aka AtHoc) messages by contacting Navy Marine Corps Intranet (NMCI) at 1-866-843-6624. The CDNS alerts registered users to various hazards, emergencies, traffic conditions, and Force Protection Condition (FPCON) changes, etc., both during and after working hours. The Automated Telephone Notification System (ATNS), a sub-system of the Wide Area Alert Network (WAAN), enables a registered user to receive telephonic, email, and text alerts on devices indicated.

(2) Contractors shall maintain a copy of the NSWCCORDIV Bomb Threat Card (NSWCCORDIV 5530/5) next to each Command telephone. If a telephonic bomb threat is received, complete the card as accurately as possible and immediately contact the Regional Dispatch Center (RDC).

9. ON-SITE SAFETY AWARENESS

a. In accordance with 29 CFR 1925 Safety and Health Standards for Federal Service Contracts, the contractor company shall strictly adhere to Federal Occupational Safety and Health Administration (OSHA) Regulations, Environmental Protection Agency (EPA) Regulations, and all applicable state and local requirements. OSHA Directive CSP 03-01-003 Voluntary Protection Programs (VPP) Policies and Protection Manual defines contractors into two categories.

1) Applicable Contractor. A contractor whose employees worked at least 1,000 hours for a VPP participant in any calendar quarter within the last 12 months and are not directly supervised by the applicant/participant.

2) Nested Contractor. Reference (a) does not specifically define this term. However, in discussing injury and illness data requirements for contractors, the OSHA guidance states that “nested contractors. . . are supervised by host site management”, and “are regularly intermingled with the owner’s employees and under direct supervision by management”.

b. In accordance with OPNAVINST 5100.23(series) and OSHA Directive CSP 03-01-003, our command is to ensure that all contractor employees have read the NSWC Corona Divisions document entitled, “Commanding Officers Occupational Safety and Health Policy Statement” and “Occupational Safety and Health Administration (OSHA) Voluntary Protection Programs (VPP) document” within 30 days of commencing performance. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your COR or Subject Matter Expert (SME) for additional assistance/options.

c. In accordance with OPNAVINST 5100.23(series) and OSHA Directive CSP 03-01-003, our command is to ensure that all nested contractor employees completes the Voluntary Protection Program (VPP) Awareness Training within 30 days of commencing performance at NSWC Corona Division. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your COR or SME for additional assistance/options.

d. In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, the contractor company shall certify that all contractor employees have read the NSWC Corona Divisions document entitled “Commanding Officers Occupational Safety and Health Policy Statement” and “Occupational Safety and Health Administration (OSHA) Voluntary Protection Programs (VPP) document” and all nested contractor employees have taken the Voluntary Protection Program (VPP) awareness training within 30 days of commencing performance at NSWC Corona Division. This can be accomplished by sending an e-mail to their COR or SME with a copy to Environmental, Safety and Health (ESH) Program Office (Code 013) (joseph.edgman@navy.mil). The document/e-mail shall include the employees name, work site, and contract number.

e. In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, the contractor company shall submit their OSHA 300 Logs (injury/illness rates) within 30 days of commencing performance at NSWC Corona Division to their COR or SME with a copy to ESH Program Office for review by the ESH Manager (Code 013).

f. In accordance with 29 CFR 1904 Standards for Recording and Reporting Occupational Injuries and Illness, the contractor shall post their OSHA 300 Logs in a conspicuous place where employee notices are posted immediately upon commencing performance and at intervals as required by CFR.

g. In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, require Contractor Company to provide quarterly reports of recordable cases and hours worked so that site OSHA recordkeeping personnel can calculate and monitor contractor TCIR/DART rates. Only include cases and hours for work performed at the VPP participant's site.

h. In accordance with OPNAVINST 5100.23(series) and OSHA Directive CSP 03-01-003, the applicable contractor company shall submit Total Case Incident Rate (TCIR) and Days Away, Restricted and Transfer (DART) rates for the past three years within 30 days of commencing performance at NSWC Corona Division to their COR with a copy to ESH Program Office for review by the ESH Manager (Code 013).

i. In accordance with 29 CFR 1904 and OSHA Directive CSP 03-01-003, the contractor shall report all work-related injuries/illnesses that occurred while working at NSWC Corona Division to their COR or SME and to ESH Program Office for review by the ESH Manager (Code 013).

j. In accordance with 29 CFR 1925 and OSHA Directive CSP 03-01-003, the contractor shall ensure that all contractor employees working at NSWC Corona Division are briefed with the applicable sections of the Safety and Occupational Health (SOH) Program Manual (NSWCCORDIVINST 5100.3(series)). This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your COR or SME for additional assistance/options.

These are requirement from OSHA Code of Federal Regulations (CFR), 29 CFR 1910 Standards for General Industry, and 29 CFR 1925 Safety and Health Standards for Federal Service Contracts, and from OPNAVINST

5090.1 (series)

10. ON-SITE ENVIRONMENTAL AWARENESS

a. In accordance with 29 CFR 1925 Safety and Health Standards for Federal Service Contracts, the contractor shall strictly adhere to Federal Occupational Safety and Health Administration (OSHA) Regulations, Environmental Protection Agency (EPA) Regulations, and all applicable state and local requirements.

b. In accordance with OPNAVINST 5090.1 (series) the contractor shall ensure that each contractor employee reads the NSWC Corona Division document entitled, “Commanding Officer’s Environmental and Natural Resources Policy statement” within 30 days of commencing performance at NSWC Corona Division. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your Contracting Officer Representative (COR) or Subject Matter Expert (SME) for additional assistance/options.

c. In accordance with OPNAVINST 5090.1 (series) the contractor shall ensure that each contractor employee who will be resident at NSWC Corona Division completes the Environmental Management System (EMS) Awareness training within 30 days of commencing performance at NSWC Corona Division. This training is available at https://www.navfac.ecatts.com/ or you can contact your COR or SME for additional options.

d. In accordance with OPNAVINST 5090.1 (series) the contractor shall certify that employees have read the NSWC Corona Divisions document entitled “Commanding Officer’s Environmental and Natural Resources Policy statement” and taken the Environmental Management System (EMS) Awareness training within 30 days of commencing performance at NSWC Corona Division. This shall be accomplished by e-mail to their COR or SME with a copy to Environmental, Safety and Health (ESH) Program Office (Code 013) (joseph.edgman@navy.mil).

The e-mail shall include the employees name, work site, and contract number.

e. In accordance with OPNAVINST 5090.1 (series) the contractor shall complete the “ECATTS Training Workbook” for each contractor employee who will be resident at NSWC Corona Division within 30 days of commencing performance at NSWC Corona Division. This document is available at https://intranet.crna.nmci.navy.mil/CMD/wwwroot2/ or you can contact your COR or SME for additional assistance/options.

11. GOVERNMENT FURNISHED PROPERTY (GFP)

N/A

12. CONTRACTOR EQUIPMENT

The Contractor will be allowed to use Contractor-owned equipment at NSWC Corona sites to perform IT, CS, and A&A tasks provided the equipment is compliant with DOD and DON CS directives. The NSWC Corona IAM must approve in writing all Contractor equipment used to perform work on this contract. Use of e-mail request/approval is acceptable.

HQ C-1-0001 ITEMS A001-A005 DATA REQUIREMENTS (NAVSEA) (SEP 1992)

The data to be furnished hereunder shall be prepared in accordance with the Contract Data Requirements List, DD Form 1423, Exhibit A, attached hereto.

HQ C-2-0063 USE OF NAVY SUPPORT CONTRACTORS FOR OFFICIAL

CONTRACT FILES (NAVSEA) (APR 2004)

(a) NAVSEA may use a file room management support contractor, hereinafter referred to as "the support contractor", to manage its file room, in which all official contract files, including the official file supporting this procurement, are retained. These official files may contain information that is considered a trade secret, proprietary, business sensitive or otherwise protected pursuant to law or regulation, hereinafter referred to as “protected information”. File room management services consist of any of the following: secretarial or clerical support; data entry; document reproduction, scanning, imaging, or destruction; operation, management, or maintenance of paper-based or electronic mail rooms, file rooms, or libraries; and supervision in connection with functions listed herein.

(b) The cognizant Contracting Officer will ensure that any NAVSEA contract under which these file room management services are acquired will contain a requirement that:

The support contractor not disclose any information;

(2) Individual employees are to be instructed by the support contractor regarding the sensitivity of the official contract files;

(3) The support contractor performing these services be barred from providing any other supplies and/or services, or competing to do so, to NAVSEA for the period of performance of its contract and for an additional three years thereafter unless otherwise provided by law or regulation; and,

(4) In addition to any other rights the contractor may have, it is a third party beneficiary who has the right of direct action against the support contractor, or any person to whom the support contractor has released or disclosed protected information, for the unauthorized duplication, release, or disclosure of such protected information.

(c) Execution of this contract by the contractor is considered consent to NAVSEA's permitting access to any information, irrespective of restrictive markings or the nature of the information submitted, by its file room management support contractor for the limited purpose of executing its file room support contract responsibilities.

(d) NAVSEA may, without further notice, enter into contracts with other contractors for these services. Contractors are free to enter into separate non-disclosure agreements with the file room contractor. (Please contact Director, E Business Division for contractor specifics.) However, any such agreement will not be considered a prerequisite before information submitted is stored in the file room or otherwise encumber the government.

Section D - Packaging and Marking

HQ D-1-0001 PACKAGING OF DATA

Data to be delivered by Integrated Digital Environment (IDE) or other electronic media shall be as specified in the contract.

All unclassified data to be shipped shall be prepared for shipment in accordance with best commercial practice.

Classified reports, data, and documentation shall be prepared for shipment in accordance with National Industrial Security Program Operating Manual (NISPOM), DOD 5220.22-M dated 28 February 2006 with Change 1 dated 28 March 2013.

HQ D-2-0008 MARKING OF REPORTS (NAVSEA) (SEP 1990)

All reports delivered by the Contractor to the Government under this contract shall prominently show on the cover of the report:

(1) name and business address of the Contractor

(2) contract number

(3) contract dollar amount

(4) whether the contract was competitively or non-competitively awarded

(5) sponsor: TBD (Name of Individual Sponsor)

(Name of Requiring Activity)

(City and State)

Section E - Inspection and Acceptance

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government 0002 Destination Government Destination Government 1001 Destination Government Destination Government 1002 Destination Government Destination Government

CLAUSES INCORPORATED BY REFERENCE

52.246-1 Contractor Inspection Requirements APR 1984

HQ E-1-0001 INSPECTION AND ACCEPTANCE LANGUAGE FOR DATA

Inspection and acceptance of all data shall be as specified on the attached Contract Data Requirements List(s), DD Form 1423.

HQ E-1-0002 INSPECTION AND ACCEPTANCE LANGUAGE FOR ENGINEERING SERVICES

Items 0001, 0002, 1001, 1002 - Inspections and acceptance shall be made at destination by a representative of the Government.

Section F - Deliveries or Performance

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 POP 30-SEP-2017 TO

29-SEP-2018

N/A NAVAL SURFACE WARFARE CENTER

CORONA DIV.

JOSEPH TRUNKO

1999 FOURTH STREET BUILDING 204

NORCO CA 92860

(951) 393-4949

N64267

0002 POP 30-SEP-2017 TO

29-SEP-2018

N/A (SAME AS PREVIOUS LOCATION)

1001 POP 30-SEP-2018 TO

29-SEP-2019

N/A (SAME AS PREVIOUS LOCATION)

1002 POP 30-SEP-2018 TO

29-SEP-2019

N/A (SAME AS PREVIOUS LOCATION)

HQ F-2-0003 DATA DELIVERY LANGUAGE FOR SERVICES ONLY PROCUREMENTS

All data to be furnished under this contract shall be delivered prepaid to the destination(s) and at the time(s) specified on the Contract Data Requirements List(s), DD Form 1423.

Section G - Contract Administration Data

252.204-0001 Line Item Specific: Single Funding SEP 2009 252.204-7006 Billing Instructions OCT 2005 252.232-7003 Electronic Submission of Payment Requests and Receiving

Reports

JUN 2012

252.232-7006 WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (MAY 2013)

(a) Definitions. As used in this clause--

Department of Defense Activity Address Code (DoDAAC) is a six position code that uniquely identifies a unit, activity, or organization.

Document type means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

Local processing office (LPO) is the office responsible for payment certification when payment certification is done external to the entitlement system.

(b) Electronic invoicing. The WAWF system is the method to electronically process vendor payment requests and receiving reports, as authorized by DFARS 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) WAWF access. To access WAWF, the Contractor shall--

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.acquisition.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this Web site.

(d) WAWF training. The Contractor should follow the training instructions of the WAWF Web-Based Training Course and use the Practice Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the “Web Based Training” link on the WAWF home page at https://wawf.eb.mil/.

(e) WAWF methods of document submission. Document submissions may be via Web entry, Electronic Data Interchange, or File Transfer Protocol.

(f) WAWF payment instructions. The Contractor must use the following information when submitting payment requests and receiving reports in WAWF for this contract/order:

(1) Document type. The Contractor shall use the following document type(s).

Invoicing and Receiving Report Combo

(2) Inspection/acceptance location. The Contractor shall select the following inspection/acceptance location(s) in WAWF, as specified by the contracting officer.

Destination/Destination

(3) Document routing. The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in WAWF when creating payment requests and receiving reports in the system.

Routing Data Table* Field Name in WAWF Data to be entered in WAWF Contract Number TBD Delivery Order Number TBD CAGE Code TBD Pay Official DoDAAC N62827 Issue By DoDAAC N64267 Admin DoDAAC N64267 Inspect By DoDAAC N64267 Ship To Code N64267 Ship From Code N/A Mark For Code N/A Service Approver (DoDAAC) N64267 Service Acceptor (DoDAAC) N/A Accept at Other DoDAAC N/A LPO DoDAAC N/A DCAA Auditor DoDAAC N/A Other DoDAAC(s) N/A

(4) Payment request and supporting documentation. The Contractor shall ensure a payment request includes appropriate contract line item and subline item descriptions of the work performed or supplies delivered, unit price/cost per unit, fee (if applicable), and all relevant back-up documentation, as defined in DFARS Appendix F, (e.g. timesheets) in support of each payment request.

(5) WAWF email notifications.