RMF_Solicitation_N6449819R4078.pdf

CODE

(Hour)

PAGE(S)

until 05:00 PM local time 19 Sep 2019

X

A X B X C X D

EX

X

G F 36

37 - 44 H 45 - 48 megan.mcmullen@navy.mil

RATING PAGE OF PAGES

7. ISSUED BY

(Date)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

Previous Edition is Unusable 33-134 STANDARD FORM 33 (REV. 9-97)

Prescribed by GSA FAR (48 CFR) 53.214(c)

1 48

(If other than Item 7)

15A. NAME 16. NAME AND TITLE OF PERSON AUTHORIZED TO

AND

ADDRESS

SIGN OFFER (Type or print)

OF

OFFEROR

AMENDMENT NO. DATE

15B. TELEPHONE NO (Include area code) 17. SIGNATURE15C. CHECK IF REMITTANCE ADDRESS

IS DIFFERENT FROM ABOVE - ENTER

SUCH ADDRESS IN SCHEDULE.

18. OFFER DATE

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

2. CONTRACT NO.

N64498 8. ADDRESS OFFER TO

See Item 7

9. Sealed offers in original and 0 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in

CAUTION - LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME (NO COLLECT CALLS)

MEGAN MCMULLEN 215-897-2876

11. TABLE OF CONTENTS

SOLICITATION/ CONTRACT FORM

SUPPLIES OR SERVICES AND PRICES/ COSTS

1 - 2 3 - 4

X I CONTRACT CLAUSES

DESCRIPTION/ SPECS./ WORK STATEMENT X

PACKAGING AND MARKING

5 - 19

J LIST OF ATTACHMENTS

INSPECTION AND ACCEPTANCE

DELIVERIES OR PERFORMANCE

X K

REPRESENTATIONS, CERTIFICATIONS AND

OTHER STATEMENTS OF OFFERORS

CONTRACT ADMINISTRATION DATA 23 - 29 X

SPECIAL CONTRACT REQUIREMENTS

OFFER (Must be fully completed by offeror) X M

L INSTRS., CONDS., AND NOTICES TO OFFERORS

EVALUATION FACTORS FOR AWARD

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52.232-8)

14. ACKNOWLEDGMENT OF AMENDMENTS

(The offeror acknowledges receipt of amendments

AMENDMENT NO. DATE

to the SOLICITATION for offerors and related documents numbered and dated):

FACILITY

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period

SOLICITATION, OFFER AND AWARD

X

(X) SEC. DESCRIPTION (X) SEC. DESCRIPTION PAGE(S)

PART I - THE SCHEDULE

26. NAME OF CONTRACTING OFFICER (Type or print) 27. UNITED STATES OF AMERICA 28. AWARD DATE

EMAIL:TEL: (Signature of Contracting Officer)

CODE CODE

B. TELEPHONE (Include area code) C. E-MAIL ADDRESS

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT 21. ACCOUNTING AND APPROPRIATION

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

10 U.S.C. 2304(c)( ) 41 U.S.C. 253(c)( ) (4 copies unless otherwise specified)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN ITEM

24. ADMINISTERED BY (If other than Item 7) CODE 25. PAYMENT WILL BE MADE BY CODE

PART IV - REPRESENTATIONS AND INSTRUCTIONS

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

30 - 34

PART II - CONTRACT CLAUSES

NAVAL SURFACE WARFARE CENTER PHILA

CODE 0232, MEGAN MCMULLEN

215-897-2876, MEGAN.MCMULLEN@NAVY.MIL

5001 SOUTH BROAD STREET

PHILADELPHIA PA 19112

215-897-2876

FAX:

TEL:

FAX:

TEL:

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

SOLICITATION

6. REQUISITION/PURCHASE NO.5. DATE ISSUED

12 Sep 2019

4. TYPE OF SOLICITATION

SEALED BID (IFB)

NEGOTIATED (RFP)

[ X ]

3. SOLICITATION NO.

N6449819R4078

Section A - Solicitation/Contract Form

NOTES TO OFFERORS

1) This acquisition is being issued as a Service-Disabled Veteran-Owned Small Business Set Aside, Competitve requirement.

2) Award of a Firm Fixed Price (FP) contract is anticipated.

3) This will be a one (1) year contract.

5) The due date of this solicitation is 5:00PM Eastern Daylight Time (EDT) on September 19, 2019.

6) The POCs for this action are:

Megan McMullen Contract Specialist Megan.McMullen@navy.mil 215-897-2876

Gregory Kaiser Contracting Officer gregory.kaiser@navy.mil 215-897-7215

7) Questions and concerns should be submitted via email to megan.mcmullen@navy.mil and gregory.kaiser@navy.mil. Due to the schedule of this requirement, questions sumbitted after 5:00PM Eastern Daylight Time (EDT) on September 16, 2019, may not receive a response.

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 2 Each RDT&E Zone D Information Systems

FFP

RDT&E Zone D Information System, Classified and NNPI packages in accordance with Section C.

FOB: Destination

PSC CD: D318

NET AMT

0002 2 Each Unclassified packages

FFP

Unclassified packages in accordance with Section C.

0003 1 Lot CDRL A001 Monthly Status report

FFP

Contract Data Requirements Lists IAW DD Form 1423. Please see the Statement of Work (Not Separately Priced).

0004 1 Lot CDRL A002 Contractor Personnel Roster

FFP

Contract Data Requirements Lists IAW DD Form 1423. Please see the Statement of Work (Not Separately Priced).

Section C - Descriptions and Specifications

PERFORMANCE WORK STATEMENT

Statement of Work (SOW) for

Risk Management Framework (RMF) Support to Code 104

1.0 INTRODUCTION

1.0.1 The Naval Surface Warfare Center Philadelphia Division (NSWCPD) is a Department of Defense entity responsible for research and development, test and evaluation, engineering and fleet support organization for the Navy’s ships, submarines, military watercraft and unmanned vehicles. This requirement is for NSWCPD’s Information Technology Operations Division Code 104.

1.0.2 This purchase order is for non-personal services. It does not create employment rights with the U.S. Government whether actual, inherent, or implied.

1.0.3 Government / Contractor Relationship

(a) The services to be delivered under this purchase order are non-personal services and the parties recognize and agree that no employer-employee relationship exists or will exist under the purchase order between the Government and the Contractor's personnel. Therefore, it is in the best interest of the Government to provide both parties a full understanding of their respective obligations.

(b) The Contractor employees shall identify themselves as Contractor personnel by introducing themselves or being introduced as Contractor personnel and displaying distinguishable badges or other visible identification for meetings with Government personnel. In addition, Contractor personnel shall appropriately identify themselves as Contractor employees in telephone conversations and in formal and informal written correspondence.

(c) Contractor personnel under this purchase order shall not engage in any of the inherently Governmental functions listed at FAR Subpart 7.5 or DFARS Subpart 207.5.

(d) Employee Relationship:

1) The services to be performed under this purchase order do not require the Contractor or its personnel to exercise personal judgment and discretion on behalf of the Government. Rather the Contractor's personnel will act and exercise personal judgment and discretion on behalf of the Contractor.

2) Rules, regulations, directives, and requirements that are issued by the U. S. Navy and NSWCPD under its responsibility for good order, administration, and security are applicable to all personnel who enter a Government installation or who travel on Government transportation.

This is not to be construed or interpreted to establish any degree of Government control that is inconsistent with a non-personal services contract.

(e) Inapplicability of Employee Benefits: This purchase order does not create an employer-employee relationship. Accordingly, entitlements and benefits applicable to such relationships do not apply.

(f) Notice. It is the Contractor's, as well as the Government's, responsibility to monitor purchase order activities and notify the Contracting Officer if the Contractor believes that the intent of this Section has been or may be violated.

1) The Contractor shall notify the Contracting Officer in writing via letter or email within three (3) calendar days from the date of any incident that the Contractor considers to constitute a violation of this Section. The notice should include the date, nature, and circumstances of the conduct; the name, function, and activity of each Government employee or Contractor official or employee involved or knowledgeable about such conduct; identify any documents or substance of any oral communication involved in the conduct; and the Contractor's estimated date when, absent a response, cost, schedule or performance will be impacted.

2) The Contracting Officer will, within five (5) calendar days after receipt of notice, respond to the notice in writing. In responding, the Contracting Officer will either:

(i) Confirm the conduct is in violation and when necessary direct the mode of further performance,

(ii) Countermand any communication regarded as a violation,

(iii) Deny that the conduct constitutes a violation and when necessary direct the mode of further performance, or

(iv) In the event the notice is inadequate to make a decision, advise the Contractor what additional information is required, and establish the date by which it should be furnished by the Contractor.

1.1 BACKGROUND

The purpose of this Purchase Order is to provide Cybersecurity support to NSWCPD’s Code 104 for the creation of Risk Management Framework (RMF) packages to obtain RMF/DoD Information Assurance Certification & Accreditation Process (DIACAP) Authorization To Operate (ATO). Cybersecurity support consists of creating and maintaining A&A packages and artifacts; creation and maintenance of the package record in the RMF system of record (currently eMASS), recommendation of security posture improvements, remediation or mitigation of

Category I and Category II vulnerabilities (as directed by the system representatives), and Subject Matter Expertise in RMF life cycle management. The contractor shall coordinate with system representatives via all avenues necessary to facilitate and acquire the required data to support this action. ATO is obtained through validated test results, security controls assessor review, and authorization official endorsement.

1.2 SCOPE OF WORK

1.2.1 This requirement is for obtaining an ATO for four medium-sized information systems (IS), defined as consisting of up to five operating systems, up to ten servers, and up to 200 workstations. Contractor shall fulfill assignments in accordance with the framework of RMF to certify and accredit new ISs, and re-accredit existing system packages for the ISs as follows; the ISs included will not have a requirement for any external penetration testing.

Two (2) RDT&E Zone D Information System, processing Classified and Naval Nuclear Propulsion Information (NNPI). All assets are located within the NSWCPD campus.

Two (2) Unclassified, Internet-facing Information Systems located in DoD or the Amazon Web Services FEDCLOUD data center operating under expired authorizations.

1.2.2 The Contractor will be provided accounts to access and utilize the Navy Enterprise Mission Assurance Support Service (eMASS) and fulfill the ISO and ISSE roles in eMASS throughout the package creation, validation, and ATO maintenance support processes. Instructions on how to access eMASS will be provided to the Contractor selected to perform this TO.

1.2.3 The Government will provide separate qualified Navy Validators outside of this contract to perform the A&A package validation.

2.0 APPLICABLE DOCUMENTS

2.1 DoD Instruction 8510.01, Subj: Risk Management Framework (RMF) for DoD Information Technology (IT)

2.2 Certification and Accreditation (C&A) Requirements for DoD-wide Managed

Enterprise Services Procurements, DoD Chief Information Officer memorandum

2.3 DON CIO Memo 01-09, Information Assurance Policy for Platform Information

Technology

2.4 NAVSEAINST 9400.2, Implementation of Naval Sea Systems Command (NAVSEA) Afloat Information Assurance (IA) Governance and Guidance

2.5 DoDI 8500.01, Cybersecurity

2.6 NAVSEAINST 5230.2B, NAVSEA Cybersecurity Program

2.7 NIST 800-37, Guide for the Security Certification and Accreditation of Federal

Information Systems

2.8 NIST Special Publication 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations

2.9 Navy Certification Agent Qualification Standards and Registration Guidebook

2.10 DoDD 8140.01, Cyberspace Workforce Management, 11 Aug 2015

2.11 DoD 8570.01-M Change 4, Information Assurance Workforce Improvement Program, 10 Nov 2015

2.12 United States Navy Risk Management Framework Process Guide (RPG)

The Contractor shall reference and utilize the latest version available when performing tasks within this purchase order.

3.0. REQUIREMENTS – NSWCPD requires RMF package creation and RMF/DIACAP ATO maintenance support; Contractor shall re-accredit Information Systems (IS) that have expired authorizations, and accredit new ISs, as indicated at Section 1.2. The ISs included will not have a requirement for any external penetration testing. The Contractor shall perform all requirements to achieve an ATO for the specified systems. All performance shall be in accordance with all NIST, DoD, DoN, NAVSEA, and NSWCPD policies, processes, and procedures, and all applicable commercial standards and regulations. In the event RMF is replaced by a new cybersecurity standard, the scope of required services in this SOW shall continue in accordance with the requirements identified in the new standard. To support this requirement, Contractor shall:

3.1 Adhere to the Navy-specific processes to identify and properly manage the risk of Navy

Information Technology (IT) in accordance with the DoD Instruction (DoDI) 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), taking into consideration Navy–unique operational and environmental demands detailed in the Department of Navy Risk Management Process Guide (RPG) and all superseding updates to the document; Contractor shall follow the published NAVSEA Business Rules, should any conflict between these rules exist they will be resolved by the Government Information System Security Manager (ISSM).

3.2 Collaborate with the designated Authorizing Official (AO) and/or their representatives for the packages throughout all steps of the RMF process.

3.3 Develop and maintain documents as required by DoD, DON, NAVSEA, NSWCPD, and Navy Enterprise Mission Assurance Support Service (eMASS). The Contractor shall provide artifacts to complete authorization and re-authorization based on each package’s unique requirements.

3.4 Scan for and apply remediation in accordance with the Defense Information Security Agency

(DISA) Security Technical Implementation Guides (STIGs), Security Requirements Guide (SRG), Security Readiness Review (SRR), and generate DISA checklists and/or artifacts;

Contractor shall notify the Government prior to implementation of the tools and scripts (and their capabilities and functionality) to be utilized in remediation or maintenance performed on the system, and document changes and updates applied to System and Network-documentation.

3.5 Analyze, remediate or mitigate, and document vulnerabilities in eMASS by:

3.5.1 Performing vulnerability analysis;

3.5.2 Remediating vulnerabilities posing a corresponding risk to operations (e.g., remove or quarantine); and

3.5.3 Documenting residual risks into Plan of Action and Milestones (POA&Ms), Risk

Assessment Reports (RARs), and other applicable documents.

3.6 Conduct vulnerability scanning of ISs utilizing Assured Compliance Assessment Solution (ACAS) and Security Content Automation Protocol (SCAP) and remediate system assets to acceptable levels designated by the ISSM. The Contractor shall create all documentation to prove compliance with requirements utilizing eMASS. The Contractor is not expected to provide any scanning tools or software licenses for this contract. The Contractor scans shall either include full authorization boundaries or sampling of authorization boundaries, as directed by the Government.

3.7 Register new systems in the Vulnerability Remediation Asset Manager (VRAM) database.

Import ACAS scans and maintain the VRAM database for all required ISs in accordance with DoD, DON, and NAVSEA requirements.

3.8 Update the relevant authorization process security documents and artifacts including, but not limited to: system categorization, Security Assessment Plan (SAP), Security Assessment Report (SAR), Privacy Impact Assessment (PIA), System Level Continuous Monitoring (SLCM), hardware/software lists, network diagrams, and POA&M updates based on the results of the continuous monitoring process for all assigned ISs.

3.9 Perform recurring real-time reviews of system artifacts for the ISs in conjunction with maintenance and change management activities.

3.10 Report the security status of the ISs (including the effectiveness of security controls employed within and inherited by the system) to the Authorizing Official – through the Command ISSM – and other appropriate organizational officials in accordance with the monitoring strategy, including, but not limited to, monthly status updates.

3.11 Review the reported security status of the ISs (including the effectiveness of security controls employed within and inherited by the ISs) on an ongoing basis, in accordance with the monitoring strategy, to determine whether the risk to operations, organizational assets, individuals, or other organizations remains acceptable.

3.12 Provide hardware and software data gathered during the ATO package creation to the

RDT&E Inventory Manager.

3.13 Validate each IS’s applicable security control (SC) families alongside Government provided independent validators with all applicable SCs for an assigned DoN IS, including developing the appropriate test procedures, as directed; executing the test procedures; and accurately documenting the test results. The Contractor shall not validate any packages that they have created in order to prevent a conflict of interest. The Contractor shall update the package documents for the assigned ISs. (The registration of NSWCPD ISs in the DoD Information Technology Portfolio Repository – Department of the Navy (DITPR-DON) and Department of the Navy Applications Database Management System (DADMS) is outside the scope of this TO).

3.14 Evaluate all vulnerabilities identified during the A&A processes and recommend mitigation measures for reducing or eliminating identified risk items.

3.15 Ensure that all CS requirements have been addressed in the A&A test and validation procedures.

3.16 Coordinate with the ISSE and the ISO equivalents to NSWCPD’s Information System

Security Officer (ISSO) to determine fixes or mitigation for weaknesses and to determine the level of revalidation testing that is necessary if immediate fixes are not applied.

3.17 Create POAMs and RARs documenting vulnerability test results and submit the POAMs and RARs for accreditation via eMASS.

3.17.1 Perform POAM reconciliation of the eMASS POAM as defined by system categorization or by specific ATO requirements.

3.18 Prepare ISs for the authorization and re-authorization process by making them compliant;

to include implementation of DISA’s STIG. The Contractor shall patch system assets to current acceptable levels; provide additional artifacts to complete accreditation and re-accreditation packages based on each package’s unique requirement; this may include System Security Plan (SSP), Risk Assessment (RA), Incident Response Plan (IRP), Continuity of Operations Plan (COOP), Configuration Management Plan (CMP), and Security Assessment Report (SAR), to complete the package.

3.19 Assist the Government with determining the security impact of proposed or actual changes to the ISs and their environment of operation.

3.20 Assess, document, and report the technical, management, and operational security controls employed within, and inherited by, the ISs in accordance with NSWCPD’s monitoring strategy.

3.21 Perform monthly remediation actions, to include patching and implementing STIG requirements.

3.22 Perform all DISA STIG requirements, manual security checklist items, and Security

Content Automation Protocol (SCAP) scans as required by the DISA release schedule for all assigned IS assets and make corresponding updates to the POAM.

3.23 Address all conditions in ATO letters.

3.24 Update the relevant DIACAP security documents and artifacts (or, as applicable, RMF security documents and artifacts) including, but not limited to, the RDT&E Certification & Accreditation Plan (CAP), PIT Enclosure 1, RMF security plan, security assessment report, and POAM based on the results of the continuous monitoring process for all assigned ISs.

3.25 Report the security status of the ISs (including the effectiveness of security controls employed within and inherited by the system) to the authorizing official and other appropriate organizational officials in accordance with the monitoring strategy, including, but not limited to, monthly status updates.

3.26 Upon receipt of ATO, provide the applicable NAVSEA/Navy Certification Letter evidencing successful execution.

3.27 The Contractor will be paid upon receipt of an ATO approval by the cognizant Authoring Official.

4. DATA REQUIREMENTS - CDRLs shall be delivered electronically, unless otherwise stated.

4.1 Contract Status Report (CDRL A001)

4.1.1 This report shall reflect both prime and Subcontractor data if applicable at the same level of detail.

4.1.2 This requirement applies to all tasks within Section 3.0.

4.2 Contractor’s Personnel Roster (CDRL A002)

4.2.1 The Contractor’s format is acceptable, the Government’s approval is required from the COR. This report shall reflect both prime and subcontractor data if applicable at the same level of detail.

5. SECURITY REQUIREMENTS

The Contractor is responsible for completing all required Government mandated training to maintain security and network access to government sites and IT systems to include but not limited to: Antiterrorism Level 1 Awareness; DoD Cyber Awareness Challenge; Combatting Human Trafficking; Records Management in the DON: Everyone's Responsibility; Training and Readiness: The Active Shooter; Constitution Day; NAVSEA Introduction to Controlled Unclassified Information; Operations Security (OPSEC); NAVSEA Counterintelligence Training; Privacy and Personally Identifiable Information (PII) Awareness Training; and NAVSEA Physical Security training. Certificates of successful completion shall be sent to the COR and as otherwise specified in the contract.

In accordance with SECNAV M-5510.30 Chapters 5 and 6, all Contractor personnel that require access to Department of Navy (DON) information systems and/or work on-site are designated Non-Critical Sensitive/IT-II positions, which require an open investigation or favorable adjudicated National Agency Check (NACLC) by the Industrial Security Clearance Office (DISCO). Investigations should be completed using the SF-86 Form and the SF-87 finger print card. An interim clearance can be granted by the company Security Officer and recorded in the Joint Personnel Adjudication System (JPAS). An open or closed investigation with a favorable adjudication is required prior to issuance of a badge providing access to NSWCPD sites and buildings. If an unfavorable adjudication is determined by DISCO all access will terminated. For Common Access Card (CAC) card you must have a completed investigation that has been favorably adjudicated or a final security clearance. A CAC Card may be issued to contractors who have an interim security clearance.

Contractor personnel that require a badge to work on-site at one of the NSWCPD sites must provide an I-9 form to verify proof of citizenship. The I-9 form should be signed by the company Facility Security Officer or the company Human Resource Department. In addition to the I-9 form, Contractors shall also bring their birth certificate, current United States Passport or naturalization certificate and state issued ID to the NSWCPD Security Officer at the time of badge request to verify citizenship. Finally, contractors shall supply a copy of their OPSEC Training Certificate or other proof that the training has been completed.

A Facility Access Determination (FAD) will be completed on any contractor that does not have a favorable adjudicated investigation in JPAS and is requesting swipe/non-swipe access to our buildings in excess of 120 days. Any contractor that has unfavorable information that has not been favorably adjudicated by Department of Defense Central Adjudication Facility (DOD CAF) will not be issued a badge.

This effort may require access to classified information up to the _SECRET_ level. No classified data will be generated or stored by the Contractor. The Contractor is required to have and maintain a _SECRET_ clearance. The requirements of the attached DD Form 254 apply.

The Contractor shall appoint a Facility Security Officer (FSO), who shall (1) be responsible for all security aspects of the work performed under this contract, (2) assure compliance with the National Industrial Security Program Operating Manual (NISPOM) (DOD 5220.22-M), and (3) assure compliance with any written instructions from the NSWCPD, Security Office Code 105.

The Prime Contractor shall:

(1) Forward signed copies of DD254s provided to subcontractors to the Naval Surface Warfare Center Philadelphia Division (NSWCPD), ATTN: Security.

(2) Direct the subcontractor to obtain approval, through the prime Contractor, for the public release of information received or generated by the sub through the prime Contractor.

(3) Submit the subcontractor request for public release through the technical point of contact identified on the DD 254.

All contractor personnel performing work on this effort shall be U.S. citizens.

Additional information related to the facility clearance process can be obtained by visiting www.dss.mil or http://www.dss.mil/isec/pcl_index.htm.

6. PLACE OF PERFORMANCE

6.1 Performance will primarily occur at the following government sites: NSWCPD, Philadelphia, PA 19112. Contractor-personnel may also work at the Contractor’s location.

6.1.1 Government will provide space for contractor-personnel under this purchase order.

6.1.2 The specific location(s) will be provided at time of award of the purchase order. The Contractor shall provide a list of employees who require access to these areas, including standard security clearance information for each person, to the Contracting Officer and Robert (BJ) Wyatt, Jr., Robert.wyatt@navy.mil no later than three business days after the date of award. The work space provided to the Contractor personnel shall be identified by the Awardee, with appropriate signage listing the company name and individual Contractor employee name.

6.1.3 Access to Government buildings at Naval Surface Warfare Center Philadelphia Division is from 0600 to 1800 Monday through Friday, except Federal holidays. Normal work hours are from 0600 to 1800, Monday through Friday. Contractor employees shall be under Government oversight at all times. Government oversight requires that a Government employee be present in the same building/facility whenever Contractor employee(s) are performing work under this purchase order. Contractor-personnel are not allowed to access any Government buildings at NSWCPD outside the hours of 0600 to 1800 without the express approval of the Procuring Contracting Officer (PCO).

6.1.4 Early Dismissal and Closure of Government Facilities

When a Government facility is closed and/or early dismissal of Federal employees is directed due to severe weather, security threat, or a facility related problem that prevents personnel from working, onsite Contractor personnel regularly assigned to work at that facility should follow the same reporting and/or departure directions given to Government personnel. The Contractor shall not direct charge to the contract for time off, but shall follow its own company policies regarding leave. Non-essential Contractor personnel, who are not required to remain at or report to the facility, shall follow their parent company policy regarding whether they should go/stay home or report to another company facility. Subsequent to an early dismissal and during periods of inclement weather, onsite Contractors should monitor radio and television announcements before departing for work to determine if the facility is closed or operating on a delayed arrival basis.

When Federal employees are excused from work due to a holiday or a special event (that is unrelated to severe weather, a security threat, or a facility related problem), on site Contractors will continue working established work hours or take leave in accordance with parent company policy. Those Contractors who take leave shall not direct charge the non-working hours to the purchase order. Contractors are responsible for predetermining and disclosing their charging practices for early dismissal, delayed openings, and closings in accordance with the FAR, applicable cost accounting standards, and company policy. Contractors shall follow their disclosed charging practices during the purchase order period of performance, and shall not follow any verbal directions to the contrary. The PCO will make the determination of cost allowability for time lost due to facility closure in accordance with FAR, applicable Cost Accounting Standards, and the Contractor's established accounting policy.

7.0 SPECIAL REQUIREMENTS

Cyber Security Workforce (CSWF) Program Requirements

In accordance with DoD 8570.01-M Change 4, Information Assurance Workforce Improvement Program. Contractor personnel performing CS functions must be designated as a member of the CSWF and meet qualification requirements for their duties, which may include both an CS baseline certification and operating system (OS)/Computing Environment (CE) certification requirement per below instructions:

a. Contractor personnel performing CS functions must meet the minimum CS baseline certification prior to performing services under this purchase order.

b. Upon commencement of performance of this purchase order, all Contractor personnel assigned to an IAM/IAT Level I-III position shall sign the Information System Privileged Access Agreement and Acknowledgement of Responsibilities statement.

7.1 Baseline Certification – The baseline certification is a security certification and is required for all CSWF members (all Information Assurance Technician (IAT) and Information Assurance Manager (IAM) levels) of the CSWF.

7.2 Continuing Professional Education (CPE) Requirements – As technology continuously advances, nearly all certifications expire or have continuing professional education (CPE) requirements. Both the baseline certifications and CE certifications may require continuous education. CPE requirements are not a direct Contractor cost to the Government. The Contractor is responsible for ensuring its personnel meet the qualification requirements for each personnel’s position on the contract and shall not invoice the Government for training, certification tests, or CPE requirements.

7.3 Contractor shall submit the roster of personnel who will work on this requirement, with evidence of compliance with CSWF qualification requirements, in accordance with CDRL A002.

CLAUSES INCORPORATED BY FULL TEXT

C-202-H001 ADDITIONAL DEFINITIONS–BASIC (NAVSEA) (OCT 2018)

(a) Department - means the Department of the Navy.

(b) Commander, Naval Sea Systems Command - means the Commander of the Naval Sea Systems Command of the Department of the Navy or his duly appointed successor.

(c) References to The Federal Acquisition Regulation (FAR) - All references to the FAR in this contract shall be deemed to also reference the appropriate sections of the Defense FAR Supplement (DFARS), unless clearly indicated otherwise.

(d) National Stock Numbers - Whenever the term Federal Item Identification Number and its acronym FIIN or the term Federal Stock Number and its acronym FSN appear in the contract, order or their cited specifications and standards, the terms and acronyms shall be interpreted as National Item Identification Number (NIIN) and National Stock Number (NSN) respectively which shall be defined as follows:

(1) National Item Identification Number (NIIN). The number assigned to each approved Item Identification under the Federal Cataloging Program. It consists of nine numeric characters, the first two of which are the National Codification Bureau (NCB) Code. The remaining positions consist of a seven digit non-significant number.

(2) National Stock Number (NSN). The National Stock Number (NSN) for an item of supply consists of the applicable four-position Federal Supply Class (FSC) plus the applicable nine-position NIIN assigned to the item of supply.

(End of text)

C-204-H001 USE OF NAVY SUPPORT CONTRACTORS FOR OFFICIAL CONTRACT FILES (NAVSEA)

(OCT 2018)

(a) NAVSEA may use a file room management support contractor, hereinafter referred to as "the support contractor", to manage its file room, in which all official contract files, including the official file supporting this procurement, are retained. These official files may contain information that is considered a trade secret, proprietary, business sensitive or otherwise protected pursuant to law or regulation, hereinafter referred to as “protected information”. File room management services consist of any of the following: secretarial or clerical support; data entry; document reproduction, scanning, imaging, or destruction; operation, management, or maintenance of paper-based or electronic mail rooms, file rooms, or libraries; and supervision in connection with functions listed herein.

(b) The cognizant Contracting Officer will ensure that any NAVSEA contract under which these file room management services are acquired will contain a requirement that:

(1) The support contractor not disclose any information;

(2) Individual employees are to be instructed by the support contractor regarding the sensitivity of the official contract files;

(3) The support contractor performing these services be barred from providing any other supplies and/or services, or competing to do so, to NAVSEA for the period of performance of its contract and for an additional three years thereafter unless otherwise provided by law or regulation; and,

(4) In addition to any other rights the contractor may have, it is a third party beneficiary who has the right of direct action against the support contractor, or any person to whom the support contractor has released or disclosed protected information, for the unauthorized duplication, release, or disclosure of such protected information.

(c) Execution of this contract by the contractor is considered consent to NAVSEA's permitting access to any information, irrespective of restrictive markings or the nature of the information submitted, by its file room management support contractor for the limited purpose of executing its file room support contract responsibilities.

(d) NAVSEA may, without further notice, enter into contracts with other contractors for these services. Contractors should enter into separate non-disclosure agreements with the file room contractor. Contact the Procuring Contracting Officer for contractor specifics. However, any such agreement will not be considered a prerequisite before information submitted is stored in the file room or otherwise encumber the government.

C-211-H018 APPROVAL BY THE GOVERNMENT (NAVSEA) (JAN 2019)

Approval by the Government as required under this contract and applicable specifications shall not relieve the Contractor of its obligation to comply with the specifications and with all other requirements of the contract, nor shall it impose upon the Government any liability it would not have had in the absence of such approval.

C-215-H002 CONTRACTOR PROPOSAL (NAVSEA) (OCT 2018)

(a) Performance of this contract by the Contractor shall be conducted and performed in accordance with the detailed obligations to which the Contractor committed itself in Proposal dated in response to Solicitation No.

N6449819R4078.

(b) The technical volume(s) of the Contractor's proposal is(are) hereby incorporated by reference and made subject to the "Order of Precedence" (FAR 52.215-8) clause of this contract. Under the "Order of Precedence" clause, the technical volume(s) of the Contractor's proposal referenced herein is (are) hereby designated as item (f) of the clause, following "the specifications" in the order of precedence.

C-223-W002 ON-SITE SAFETY REQUIREMENTS (NAVSEA) (OCT 2018)

(a) The contractor shall ensure that each contractor employee reads any necessary safety documents within 30 days of commencing performance at any Government facility. Required safety documents can be obtained from the respective safety office. Contractors shall notify the Safety office points of contact below to report completion of the required training via email. The email shall include the contractor employee’s name, work site, and contract number.

(b) It is expected that contractor employees will have received training from their employer on hazards associated with the areas in which they will be working and know what to do in order to protect themselves. Contractors are required to adhere to the requirements of 29 CFR 1910, 29 CFR 1926 and applicable state and local requirements while in Government spaces. The contractor shall ensure that all on-site contractor work at the Government facility is in accordance with any local safety instructions as provided via the COR. The contractor shall report all work-related injuries/illnesses that occurred while working at the Government site to the COR.

(c) Contractors whose employees perform work within Government spaces in excess of 1000 hours per calendar quarter during a calendar year shall submit the data elements on OSHA Form 300A, Summary of Work Related Injuries and Illnesses, for those employees to the safety office, via the COR by 15 January for the previous calendar year, even if no work related injuries or illnesses occurred. If a contractor’s injury/illness rates are above the Bureau of Labor Statistics industry standards, a safety assessment may be performed by the Safety Office to determine if any administrative or engineering controls can be utilized to prevent further injuries/illnesses, or if any additional Personal Protective Equipment or training will be required.

(d) Any contractor employee exhibiting unsafe behavior may be removed from the Government site. Such removal shall not relieve the contractor from meeting its contractual obligations and shall not be considered an excusable delay as defined in FAR 52.249-14.

(e) The Safety Office points of contacts are as follows:

Nick Kutufaris (Code 10) Nicholas.Kutufaris@navy.mil 215-897-1520

C-227-H006 DATA REQUIREMENTS (NAVSEA) (OCT 2018)

The data to be furnished hereunder shall be prepared in accordance with the Contract Data Requirements List, DD Form 1423, Exhibit(s) A001 & A002, attached hereto.

(End of Text)

C-237-H001 ENTERPRISE-WIDE CONTRACTOR MANPOWER REPORTING APPLICATION

(NAVSEA) (OCT 2018)

(a) The contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the [insert named component] via a secure data collection site.

Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities; (4) D, Automatic Data Processing and Telecommunications, IT and Telecom- Telecommunications Transmission (D304) and Internet (D322) ONLY;

(5) S, Utilities ONLY;

(6) V, Freight and Shipping ONLY.

(b) The contractor is required to completely fill in all required data fields using the following web address https://www.ecmra.mil.

(c) Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://dod.ecmra.support.desk@mail.mil.

C-247-H001 PERMITS AND RESPONSIBILITIES (NAVSEA) (DEC 2018)

The Contractor shall, without additional expense to the Government, be responsible for obtaining any necessary licenses and permits for complying with any applicable Federal, State, and Municipal laws, codes, and regulations for shipping and transportation including, but not limited to, any movement over public highways of overweight/over dimensional materials.

Section D - Packaging and Marking

D-211-H001 PACKAGING OF DATA (NAVSEA) (OCT 2018)

Data to be delivered by Integrated Digital Environment (IDE) or other electronic media shall be as specified in the contract.

All unclassified data to be shipped shall be prepared for shipment in accordance with best commercial practice.

Classified reports, data, and documentation shall be prepared for shipment in accordance with National Industrial Security Program Operating Manual (NISPOM), DOD 5220.22-M dated 28 February 2006 incorporating Change 2 dated 18 May 2016.

D-211-H002 MARKING OF REPORTS (NAVSEA) (OCT 2018)

All reports delivered by the Contractor to the Government under this contract shall prominently show on the cover of the report:

(1) name and business address of the Contractor

(2) contract number

(3) sponsor:

(Name of Individual Sponsor)

(Name of Requiring Activity)

(City and State)

Section E - Inspection and Acceptance

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government 0002 Destination Government Destination Government 0003 Destination Government Destination Government 0004 Destination Government Destination Government

E-246-H013 INSPECTION AND ACCEPTANCE OF DATA (NAVSEA) (OCT 2018)

Inspection and acceptance of all data shall be as specified on the attached Contract Data Requirements List(s), DD Form 1423.

E-246-H014 INSPECTION AND ACCEPTANCE OF ENGINEERING SERVICES (NAVSEA) (OCT 2018)

Item(s) 0001, 0002, 0003 & 0004 - Inspection and acceptance shall be made by the Contracting Officer’s Representative (COR) or a designated representative of the Government.

Section F - Deliveries or Performance

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 365 dys. ADC 2 NAVAL SURFACE WARFARE CENTER

PHILA

ADRIENNE BOTTI

NSWC PHILADELPHIA DIVISION

1601 LANGLEY AVENUE

BLDG 542

PHILADELPHIA PA 19112

215-897-7161

N64498

0002 365 dys. ADC 2 (SAME AS PREVIOUS LOCATION)

0003 365 dys. ADC 1 (SAME AS PREVIOUS LOCATION)

0004 365 dys. ADC 1 (SAME AS PREVIOUS LOCATION)

CLAUSES INCORPORATED BY REFERENCE

52.242-15 Stop-Work Order AUG 1989

F-211-H021 DELIVERY OR PERFORMANCE (NAVSEA) (MAR 2019) MAR 2019

F-247-H001 DELIVERY OF DATA (NAVSEA) (OCT 2018)

All data to be furnished under this contract shall be delivered prepaid to the destination(s) and at the time(s) specified on the Contract Data Requirements List(s), DD Form 1423.

Section G - Contract Administration Data

252.232-7006 Wide Area WorkFlow Payment Instructions DEC 2018

G-232-H002 PAYMENT INSTRUCTIONS AND CONTRACT TYPE SUMMARY FOR PAYMENT

OFFICE (NAVSEA) (JUN 2018)

(a) The following table of payment office allocation methods applies to the extent indicated.

For Government Use Only

Contract/Order Payment Clause

Type of Payment Request

Su pp ly

Se rv ic e

C on st ru ct io n

Payment Office Allocation Method

52.212-4 (Alt I), Contract Terms and Conditions— Commercial Items 52.216-7, Allowable Cost and Payment 52.232-7, Payments under Time-and-Materials and Labor-Hour Contracts

Cost Voucher X X N/A Line item specific proration. If there is more than one ACRN within a deliverable line or deliverable subline item, the funds will be allocated in the same proportion as the amount of funding currently unliquidated for each ACRN on the deliverable line or deliverable subline item for which payment is requested.

52.232-1, Payments Navy Shipbuilding Invoice (Fixed Price)

X N/A N/A Line Item specific by fiscal year. If there is more than one ACRN within a deliverable line or deliverable subline item, the funds will be allocated using the oldest funds. In the event of a deliverable line or deliverable subline item with two ACRNs with the same fiscal year, those amounts will be prorated to the available unliquidated funds for that year.

Contract/Order Payment Clause

Type of Payment Request

Su ic e

C on st ru ct io n

Payment Office Allocation Method

52.232-1, Payments;

52.232-2, Payments under Fixed-Price Research and Development Contracts;

52.232-3, Payments under Personal Services Contracts;

52.232-4, Payments under Transportation Contracts and Transportation-Related Services Contracts; and 52.232-6, Payments under Communication Service Contracts with Common Carriers

Invoice X X N/A Line Item Specific proration. If there is more than one ACRN within a deliverable line or deliverable subline item, the funds will be allocated in the same proportion as the amount of funding currently unliquidated for each ACRN on the deliverable line or deliverable subline item for which payment is requested.

52.232-5, Payments Under Fixed-Price Construction Contracts

Construction Payment Invoice

N/A N/A X Line Item specific by fiscal year. If there is more than one ACRN within a deliverable line or deliverable subline item, the funds will be allocated using the oldest funds. In the event of a deliverable line or deliverable subline item with two ACRNs with the same fiscal year, those amounts will be prorated to the available unliquidated funds for that year.

52.232-16, Progress Payments

Progress Payment*

X X N/A Contract-wide proration. Funds shall be allocated in the same proportion as the amount of funding currently unliquidated for each ACRN. Progress Payments are considered contract level financing, and the “contract price” shall reflect the fixed price portion of the contract per FAR 32.501-3.

52.232-29, Terms for Financing of Purchases of Commercial Items;

52.232-30, Installment Payments for Commercial Items

Commercial Item Financing*

X X N/A Specified in approved payment. The contracting officer shall specify the amount to be paid and the account(s) to be charged for each payment approval in accordance with FAR 32.207(b)(2) and 32.1007(b)(2).

52.232-32, Performance- Based Payments

Performance- Based Payments*

X X N/A Specified in approved payment. The contracting officer shall specify the amount to be paid and the account(s) to be charged for each payment approval in accordance with FAR 32.207(b)(2) and 32.1007(b)(2).

Contract/Order Payment Clause

Type of Payment Request

Su ic e

C on st ru ct io n

Payment Office Allocation Method

252.232-7002, Progress Payments for Foreign Military Sales Acquisitions

Progress Payment*

X X N/A Allocate costs among line items and countries in a manner acceptable to the Administrative Contracting Officer.

*Liquidation of Financing Payments. Liquidation will be applied by the payment office against those ACRNs which are identified by the payment instructions for the delivery payment and in keeping with the liquidation provision of the applicable contract financing clause (i.e., progress payment, performance-based payment, or commercial item financing).

(b) This procurement contains the following contract type(s):

Item Type*

0001 FP

0002 FP

0003 FP

0004 FP

*CR – Cost-Reimbursement FP – Fixed Price

G-232-H005 SUPPLEMENTAL INSTRUCTIONS REGARDING INVOICING (NAVSEA) (JAN 2019)

(a) For other than firm fixed priced contract line item numbers (CLINs), the Contractor agrees to segregate costs incurred under this contract/task order (TO), as applicable, at the lowest level of performance, either at the sub line item number (SLIN) or CLIN level, rather than at the total contract/TO level, and to submit invoices reflecting costs incurred at that level. Supporting documentation in Wide Area Workflow (WAWF) for invoices shall include summaries of work charged during the period covered as well as overall cumulative summaries by individual labor categories, rates, and hours (both straight time and overtime) invoiced; as well as, a cost breakdown of other direct costs (ODCs), materials, and travel, by technical instruction (TI), SLIN, or CLIN level. For other than firm fixed price subcontracts, subcontractors are also required to provide labor categories, rates, and hours (both straight time and overtime) invoiced; as well as, a cost breakdown of ODCs, materials, and travel invoiced. Supporting documentation may be encrypted before submission to the prime contractor for WAWF invoice submittal.

Subcontractors may email encryption code information directly to the Contracting Officer and Contracting Officer Representative (COR). Should the subcontractor lack encryption capability, the subcontractor may also email detailed supporting cost information directly to the Contracting Officer and COR; or other method as agreed to by the Contracting Officer.

(b) Contractors submitting payment requests and receiving reports to WAWF using either Electronic Data Interchange (EDI) or Secure File Transfer Protocol (SFTP) shall separately send an email notification to the COR and Contracting Officer on the same date they submit the invoice in WAWF. No payments shall be due if the contractor does not provide the COR and Contracting Officer email notification as required herein.

G-242-H001 GOVERNMENT CONTRACT ADMINISTRATION POINTS-OF-CONTACT AND

RESPONSIBILITIES (NAVSEA) (OCT 2018)

(a) The Government reserves the right to administratively substitute any of the points of contact listed below at any time.

(b) The contracting officer is the only person authorized to change this contract or orders issued…