PWS draft_ECC Posting 18 May 2017.docx

SECTION C – DESCRIPTION/SPECS/WORK STATEMENT

SPECIFICATIONS/STATEMENT OF WORK/PERFORMANCE WORK STATEMENT

Work under this performance-based contract will be performed in accordance with the following description/ specifications/ statement of work (SOW) which herein will be referred to as Performance Work Statement (PWS):

SHORT TITLE: SPAWAR Cyber Red Team and Operational Test Support

1.0 PURPOSE

1.1 BACKGROUND

The Space and Naval Warfare Systems Center (SPAWARSYSCEN) Atlantic is responsible for providing Information Assurance, Cyber Defense, Cyber Systems Security and Network Infrastructure Program Management. In 2014, SPAWARSYSCEN Atlantic was certified by the National Security Agency and accredited by the United States Strategic Command (USSTRATCOM) as a DoD Cyber Red Team in accordance with CJCSM 6510.03. SPAWARSYSCEN Atlantic utilizes this designation to perform external assessments of Cyber Security Service Providers, perform adversarial assessments as part of Operational Test and Evaluation, and participate in cyber exercises.

1.2 SCOPE

This PWS supports all aspects of Cyber Red teaming, Purple teaming as relates to Cyber Security Service Provider Services, Cyber Security Developmental and Operational Testing.

NOTE: Work will not be performed in Afghanistan.

2.0 APPLICABLE DOCUMENTS

The contractor shall ensure all work accomplished on task utilizes the best commercial practices and current acceptable industry standards. The applicable references and standards invoked will vary within individual tasks and will be specifically called-out in each task order (TO). In accordance with Defense Acquisition Policy changes, maximum utilization of non-government standards will be made wherever practical. Where backward compatibility with existing systems is required, selected interoperability standards will be invoked. For purposes of proposing, the following documents are not exclusive; however, all contractors shall be able to meet those cited when applicable to the TO.

2.1 REQUIRED DOCUMENTS

The following instructional documents are mandatory for use. Unless otherwise specified, the document’s effective date of issue is the date on the request for proposal. Additional applicable documents may be included in specific TOs.

DoD Instruction – Risk Management Framework (RMF) for DoD Information Technology (IT) dtd 12 Mar 14

and Accreditation, dtd 28 Feb 13

u.

DoD Cyber Red Team Evaluator Scoring Metrics version 2

2.2 GUIDANCE DOCUMENTS

The following documents are to be used as guidance. Unless otherwise specified, the document’s effective date of issue is the date on the request for proposal. Additional applicable documents may be included in specific TOs.

o.

Federal Communications Commission Rules and Regulations, part 68

2.3 SOURCE OF DOCUMENTS

The contractor shall obtain all applicable documents. Many documents are available from online sources. Specifications and commercial/industrial documents may be obtained from the following sources:

Copies of Federal Specifications may be obtained from General Services Administration Offices in Washington, DC, Seattle, San Francisco, Denver, Kansas City, MO., Chicago, Atlanta, New York, Boston, Dallas and Los Angeles.

Copies of military specifications may be obtained from the Commanding Officer, Naval Supply Depot, 3801 Tabor Avenue, Philadelphia, PA 19120-5099. Application for copies of other Military Documents should be addressed to Commanding Officer, Naval Publications and Forms Center, 5801 Tabor Ave., Philadelphia, PA 19120-5099.

All other commercial and industrial documents can be obtained through the respective organization’s website.

3.0 PERFORMANCE REQUIREMENTS

The following paragraphs list all required support tasks that will be required throughout the contract life. The contractor shall provide necessary resources and knowledge to support the listed tasks. Specific objectives will be dependent on the basic contract and the TO written against the basic contract. The contractor shall complete all required tasks while controlling and tracking performance and goals in terms of costs, schedules, and resources.

3.1 Cyber Red Team Support

The contractor shall support adversarial operations against government customer networks. The red team shall be used to assess the network and system security posture of government customer sites. The contractor shall work as part of the red team to support onsite and remote assessments. Specifically the contractor shall:

3.2 Cyber Test Range Support

The contractor shall support testing of systems on a variety of cyber ranges to include the Joint Information Operations Range and the National Cyber Range (NCR). The contractor shall develop tools to accomplish automated cybersecurity testing of systems utilizing ranges. In support of the NCR instance located at SPAWARSYSCEN Atlantic the contractor shall also support administration of infrastructure located on the government site necessary to conducting testing inside ranges to include infrastructure to capture tests in action to allow for later replay and analysis. The contactor shall work closely with cyber defenders to ensure that NCR conditions simulate real world cyber defense conditions where practical.

3.3 Cyber Developmental Test Support

The contractor shall support all phases of cybersecurity developmental test and evaluation (DT&E) to include understanding cybersecurity requirements for a system (Phase 1), characterizing cyber-attack surface (Phase 2), vulnerability identification (Phase 3) and adversarial DT&E (Phase 4). The contractor shall participate in Tabletop Mission Cyber Risk Assessments (TMCRA) and other assessments designed to reveal the cyber-attack surface of a system under test. The contactor shall complete DT&E activities utilizing lab and cyber range infrastructure. In order to effectively support DT&E the contractor shall:

3.4 Cyber Operational Test Support

The contractor shall provide support for Operational Cybersecurity Testing in accordance with Director Operational Test and Evaluation memo on Cybersecurity testing dated 1 August 2014. In support of that directive the contractor shall support Cooperative Vulnerability (Phase 5) and Penetration Assessment support as well as Adversarial Assessment (Phase 6) support. The contractor shall specifically support:

3.5 Exercise and Training Support

The contractor shall support development, production, review, and refinement of a training plan and curriculum necessary to ensure Red Team certification and accreditation inspections and self-assessment activities are sufficiently adequate to meet Red Team certification and accreditation needs as defined by CJCSM 6510.03 and the Cyber Red Team Evaluator Scoring metrics. The contractor shall specifically provide a deconstruction of all DoD Red Team policies and ESM requirements and build curriculum, courseware, laboratory environments, checklists, and study aids required for all project staff in all functional areas to meet the demands of DoD Red Team certification and accreditation and self-assessment activities.

3.6 Purple Team Support

The contractor shall support the collaborative interaction between the Red Team and the Cyber Security Service Provider (CSSP) utilizing a Red Team persistence infrastructure constructed during operations. Interaction between the two teams should leverage a portion of Red Team compromised infrastructure within the subscriber base of the CSSP to execute activities designed to measure the effectiveness of the CSSP processes and procedures as well as the effectiveness of detection of CSSP developed indicators of compromise. The contractor shall:

3.7 Cyber Tool Development

The contractor shall support the development of cyber test tools necessary to accomplish red team operations objectives. These tools shall provide a way to exploit or compromise assets on a target network and maintain remote access or persistence via covert channels. Tools shall support a variety of common desktop and server operating systems as well as network appliances of common manufacture (e.g. Cisco, Avaya, etc.). The contractor shall develop a system for the management of compromised network infrastructure and communications with that infrastructure. The contractor shall also develop a common operating picture (COP) to track operations and compromised assets as well as tracking network defenders’ operations against red team compromised assets. The contactor shall perform the following specific actions with regard to tools developed:

3.8 Red Team Attack/Exploitation Infrastructure Support

The contractor shall supply cloud computing infrastructure necessary to support non-attributable red team operations. The contractor shall provide infrastructure, possibly from multiple cloud providers, such that the red team can easily shift from source network address to source network address to avoid network defenders associating red team activity coming from a single remote network address. Contractor shall also procure network domains (DNS registration) and corresponding commercial SSL certificates (server certificates and software signing certificates) as required to support red team operations.

3.9 Red Team Certification and Accreditation Support

The contractor shall provide support necessary to maintain the Red Team’s accreditation status and standing to include Registration, Verification, Validation, and Post Accreditation phases as defined by CJCSM 6510.03. These services shall be in support of both the CSSP accreditation and Red Team accreditation which describes how operations are conducted at Red team operational sites and selected customer sites. The Red Team augments the CSSP Protect and Sustain functions and therefore support under this description passage directly impacts both the CSSP and Red Team accreditations. The CSSP and Red Team accreditations must be maintained separately, but must also be harmoniously synchronized on an ongoing basis. The contractor shall specifically provide support developing:

3.9.1 A Red Team document control and accreditation package supporting artifacts (CONOPS) and corresponding Standard Operating Procedures (SOPs) and Desktop Procedures (DTPs) necessary to maintain the documentation and artifacts required to maintain the Red Team accreditation package. This body of documentation shall be updated and reviewed not less than annually, and also upon changes to the CJCSM 6510.03 and corresponding Evaluators Scoring Metrics (ESM), and changes to SNRT operational locations as appropriate.

3.9.2 A Red Team self-assessment against the Red Team ESM and governing policies not less than annually but also upon notification from the CSSP certification authority that an out-of-cycle inspection is required consistent with DoD’s Red Team policy. Minimally this will occur when a site from which Red Team operations are added or other significant programmatic change occurs.

3.10 Cybersecurity/Information Assurance

Cybersecurity (also known as Information Assurance (IA)) includes tasks which the contractor shall protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. This includes providing for restoration of information systems by incorporating protection, detection, and reaction capabilities.

3.10.1 Cybersecurity Personnel

(a) In accordance with DFAR clause 252.239-7001, DoDD 8140.01 and SECNAV M-5239.2, contractor personnel performing cybersecurity functions shall meet all cybersecurity training, certification, and tracking requirements as cited in SECNAV M-5239.2 prior to accessing DoD information systems.

(b) The contractor shall be responsible for tracking and reporting cybersecurity personnel, also known as Cybersecurity Workforce (CSWF). See PWS Para 5.2.1.3 for CSWF Report (CDRL A003) requirements. Although the minimum frequency of reporting is monthly, the TO can require additional updates at any time.

3.10.2 Design Changes

The contractor shall ensure any equipment/system installed or integrated into Navy platform will meet the cybersecurity requirements as specified under DoDI 8500.01.

3.11 Equipment and Material Support

As specified on TOs, the contractor shall provide various equipment/material support that ranges from research, procurement, fabrication, integration, and delivery.

3.11.1 Equipment/Material Research

The contractor shall research specified equipment and/or material within the parameters outlined in the TOs.

3.11.2 Equipment/Material Procurement

Pursuant to SPAWARINST 4440.12, the contractor shall procure items listed under the Contractor Acquired Property (CAP) paragraph. The contractor shall ensure acquisition selection factors include price, availability, reliability, and supportability within current supply system. The contractor shall keep source selection records and make it available for government review as needed. The contractor shall provide all support data and cost estimates necessary to justify a fair and reasonable price per item procured. The contractor shall have an adequate accounting system to track all items and the delivery status per TO and per item. After receipt, the contractor shall have an adequate property management system to track the item location per TO per item. Unless otherwise noted, all items procured by the contractor shall be utilized or staged at the contractor’s facility, transported by the contractor to the installation, integrated or consumed in a system, or returned to the government at the completion of the contract/TO. The contractor shall be responsible for generating inventory tracking report(s) (CDRL A004) for the basic contract and/or each TO summary report. Deliverable documentation shall vary and be specified in each TO, if applicable.

Contractor shall recommend items that conform to applicable product validation, identification, and tracking requirements.

(a) Product Validation – The contractor shall certify that it purchases supplies from authorized resellers and/or distributers. Unless otherwise specified, the contractor shall warrant that the products are new, in their original box. The contractor shall obtain all manufacturer products submitted in task/delivery order offers from authentic manufacturers or through legal distribution channels only, in accordance with all applicable laws and policies at the time of purchase. The contractor shall provide the Government with a copy of the End User license agreement, and shall warrant that all manufacturer software is licensed originally to Government as the original licensee authorized to use the manufacturer software. The contractor shall track the licensing information and have it available for government review as needed.

(b) Cybersecurity/Computer Security Requirements – The contractor shall ensure that all products recommended and/or procured that impact cybersecurity or Information Assurance (IA) shall be selected from the NIAP Validated Products List. The contractor shall ensure the products chosen are based on the appropriate Evaluated Assurance Level (EAL) for the network involved, and utilized in accordance with latest Defense Information Systems Agency (DISA) policy at time of order. The contractor shall store all product information and have it available for government review as needed.

(c) Item Unique Identification (IUID) – In accordance with DFARS clause 252.211-7003/7007 and SECNAVINST 4440.34, the contractor shall ensure that an item manufactured, integrated, or purchased with a unit cost equal to or exceeding $5,000 (or less if item is serially managed or if government specifies items on individual task/delivery orders) is labeled with an item unique identification number or Unique Item Identifier (UII). At time of delivery of the item to the Government, the contractor shall clearly mark and identify each applicable item based on the criteria provided in DoD MIL-STD-130N for those items not already marked. The contractor shall specify the construct, syntax, marking methodology, and quality methodology chosen to mark the required parts and any corresponding technical justification. All IUID information shall be recorded and shall be subject to government review as needed. The contractor shall track IUID items and maintain information being recorded.

(i) After CAP is delivered to the government, the contractor shall enter all items with Unique Item Identifier (UII) in the IUID Registry. The contractor shall register and validate each IUID in the IUID Registry. The contractor shall submit IUID data via Invoicing, Receipt, Acceptance, and Property Transfer (iRAPT) (formerly Wide Area Workflow (WAWF)) as part of the Material Inspection and Receiving Report.

(ii) Contractor shall be responsible maintaining and updating information in the IUID Registry. Contractor shall update custody status when items are designated as government furnished material, returned to government position, change physical location, or has been consumed, destroyed, scrapped, lost or abandoned during contract/TO performance.

(d) Radio Frequency Identification (RFID) – In accordance with DFARS clause 252.211-7006, and Under Secretary of Defense Memo Radio Frequency Identification (RFID), July 30, 2004, the contractor shall mark applicable items with Radio Frequency Identification (RFID).

3.12 Property/Inventory Tracking

In accordance with FAR clause 52.245-1, the contractor shall create and maintain internal records of all government property accountable to the contract/TO, including Government-furnished and Contractor-acquired property. The contractor shall record each item delivered and/or ordered in a Material Inspection and Receiving Report/Inventory Tracking Report (CDRL A004) as specified in DFARS clause 252.211-7003. At a minimum, the report shall track the following information: item description, order date, serial number, model number, lot number, delivery location, and the manufacturer warranty period and expiration date, if applicable. The contractor shall have inventory report information available for government review as needed, and the contractor shall ensure the report information has the ability to be sorted and manipulated by any of the input fields. Separate from the government tracking system, the information in the contractor’s records is a backup to the government records; therefore, the government shall own all data rights to the collected information.

4.0 INFORMATION TECHNOLOGY (IT) SERVICES REQUIREMENTS

4.1 INFORMATION TECHNOLOGY (IT) GENERAL REQUIREMENTS

When applicable, the contractor shall be responsible for the following:

4.1.1 Ensure that no production systems are operational on any RDT&E network.

4.1.2 Follow DoDI 8510.01 of 12 Mar 2014 when deploying, integrating, and implementing IT capabilities.

4.1.3 Migrate all Navy Ashore production systems to the NMCI environment where available.

4.1.4 Work with government personnel to ensure compliance with all current Navy IT & cybersecurity policies, including those pertaining to Cyber Asset Reduction and Security (CARS).

4.1.5 Follow SECNAVINST 5239.3B of 17 June 2009 & DoDI 8510.01 of 12 Mar 2014 prior to integration and implementation of IT solutions or systems.

4.1.6 Register any contractor-owned or contractor-maintained IT systems utilized on contract in the Department of Defense IT Portfolio Registry (DITPR)-DON.

5.0 CONTRACT ADMINISTRATION

Contract administration is required for all contracts; it provides the government a means for contract management and monitoring. Regardless of the level of support, the ultimate objective of the contractor is ensuring the government’s requirements are met, delivered on schedule, and performed within budget.

5.1 CONTRACT LIAISON

The contractor shall assign a technical single point of contact, also known as the Program Manager (PM) who shall work closely with the government Contracting Officer and Contracting Officer’s Representative (COR), as applicable. The CORs are designated at the task order level. The contractor PM, located in the contractor’s facility, shall ultimately be responsible for ensuring that the contractor’s performance meets all government contracting requirements within cost and schedule. PM shall have the requisite authority for full control over all company resources necessary for contract performance. The PM shall have authority to approve TO proposals or modifications in emergent situations. The PM shall ultimately be responsible for the following: personnel management; management of government material and assets; and personnel and facility security. In support of open communication, the contractor shall initiate, unless otherwise directed at the TO level, periodic meetings with the COR.

5.2 CONTRACT MONITORING AND MAINTENANCE

The contractor shall have processes established in order to provide all necessary resources and documentation during various times throughout the day in order to facilitate a timely TO award or modification. Prior to TO award, the contractor shall be responsible for providing any required support documentation in a timely manner so as to not disrupt the TO award process. To address urgent requirements, the contractor shall have processes established during business and non-business hours/days in order to provide all necessary documentation and resources to facilitate a timely TO award or modification. NOTE: Directly billing to a TO prior to TO award is prohibited.

5.2.1 Contract Administration Documentation

Various types of contract administration documents are required throughout the life of the contract. At a minimum, the contractor shall provide the following documentation, unless otherwise specified:

5.2.1.1 Task Order Status Report (TOSR)

The contractor shall develop a TOSR (CDRL A005) and submit it monthly, weekly, and/or as cited in the requirements of each TO. The prime shall be responsible for collecting, integrating, and reporting all subcontractor reports. The TOSR include the following variations of reports:

(a) Monthly TOSR – the contractor shall develop and submit a TO status report monthly at least 30 days after TO award on the 10th of each month for those months the TO is active. The contractor shall report on various TO functions: performance, schedule, financial, business relations, and staffing plan/key personnel; see applicable DD Form 1423 for additional reporting details and distribution instructions. This CDRL includes a Staffing Plan (Attachment 1), Personnel Listing (Attachment 2), and Government Furnished Property (GFP) Template (Attachment 3) necessary for additional data collection as applicable.

5.2.1.2 Task Order Closeout Report

The contractor shall develop a TO closeout report (CDRL A006) and submit it no later than 15 days before the TO completion date. The Prime shall be responsible for collecting, integrating, and reporting all subcontracting information. See applicable DD Form 1423 for additional reporting details and distribution instructions.

5.2.1.3 Cybersecurity Workforce (CSWF) Report

DoDD 8140.01 and DFAR’s PGI 239.7102-3 have promulgated that contractor personnel shall have documented current cybersecurity certification status within their contract. The contractor shall develop, maintain, and submit a CSWF Report (CDRL A003) monthly or as applicable at the TO level (Note: If initiated at the TO level, report not necessary at contract level). IAW clause DFARS 252.239-7001, if cybersecurity support is provided, the contractor shall provide a Cybersecurity Workforce (CSWF) list that identifies those individuals who are IA trained and certified. Utilizing the format provided in CSWF CDRL Attachment 1, the prime contractor shall be responsible for collecting, integrating, and reporting all subcontractor personnel. See applicable DD Form 1423 for additional reporting details and distribution instructions. Contractor shall verify with the COR or other government representative the proper labor category cybersecurity designation and certification requirements.

5.2.1.4 Contractor Manpower Reporting

The following reporting is required for all DoD contracts acquiring services regardless if cost type or firm-fixed price contract:

(a) Contractor Manpower Quarterly Status Report (QSR) The contractor shall provide a Contractor Manpower Quarterly Status Report (CDRL A007) to the government four times throughout the calendar year. Required by SPAWARSYSCEN Atlantic for all active service contracts/TOs (regardless if fixed-price or cost type), the Manpower report itemizes specific contract and/or TO administrative data for SPAWARSYSCEN Atlantic. Reporting period begins at the time of contract/TO award. Utilizing the format provided in QSR CDRL Attachment 1, the contractor shall collect required data throughout the specified performance period and shall submit one cumulative report on the applicable quarterly due date. See applicable DD Form 1423 for additional reporting details and distribution instructions. The following table lists the pre-set submittal due dates and the corresponding performance periods:

(b) Enterprise-wide Contractor Manpower Reporting Application In addition to the QSR CDRL reporting requirements noted above and pursuant to NMCARS 5237.102-90, the contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the DoD via a secure data collection website – Enterprise-wide Contractor Manpower Reporting Application (eCMRA). Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

The contractor shall completely fill-in all required data fields using the following web address: https:// doncmra.nmci.navy.mil/.

Reporting inputs consists of labor hours executed during the contract/TO period of performance within each Government fiscal year (FY) which runs from October 1 through September 30. While inputs may be reported any time during the FY, the contractor shall report all data no later than October 31 of each calendar year. Contractors may direct questions to the help desk at http://www.ecrma.mil/.

5.2.1.5 WAWF Invoicing Notification and Support Documentation Pursuant to DFARS clause 252.232-7003 and 252.232-7006, the contractor shall submit payment requests and receiving reports using DoD Invoicing, Receipt, Acceptance, and Property Transfer (iRAPT) application (part of the Wide Area Work Flow (WAWF) e-Business Suite) which is a secure government web-based system for electronic invoicing, receipt, and acceptance. In accordance with clause 252.232-7006, the contractor shall provide e-mail notification to the COR when payment requests are submitted to the iRAPT/WAWF and the contractor shall include cost back–up documentation (e.g., delivery receipts, time sheets, & material/travel costs, etc.) to the invoice in iRAPT/WAWF. As requested, the contractor shall directly provide a soft copy of the invoice and any supporting invoice documentation (CDRL A008) directly to the COR within 24 hours of request to assist in validating the invoiced amount against the products/services provided during the billing cycle.

5.2.1.6 Labor Rate Limitation Notification

For all cost type, labor-hour service contracts/TO (not applicable for Simplified Acquisition Procedures (SAP) contracts or contracts/TOs that are wholly fix-priced), the contractors shall monitor the following labor rates as part of the monthly contract/TO status report (see CSR/TOSR CDRL Attachment 2 – Personnel Listing). The contractor shall initiate required notification if specified threshold values are met. NOTE: TOs that are wholly firm-fixed price are exempt from this requirement. The ability of a contractor to monitor labor rates effectively will be included in the contract/TO Quality Assurance Surveillance Plan (QASP).

(a) Fully burden labor rates per person (subcontractor included) charged on contract/TO – If the actual invoiced fully burden rate (inclusive of fee) of any individual in any labor category exceeds the threshold amount of $165.00/hour and the individual’s rate was not disclosed in pre-award of the basic contract (or TO for IDIQ contracts), the contractor shall send notice and rationale (CDRL A009) for the identified labor rate to the COR who will then send appropriate notification to the Contracting/Ordering Officer. NOTE: Within one labor category, if the total collective estimated and/or actual hours in any given period of performance are less than or equal to 500 labor hours, the labor category is excluded from the required CDRL notification regardless if an individual within that labor category exceeds the threshold.

(b) Average actual labor rates (total actual fully burdened labor costs “divided by” total number of hours performed) compared to average negotiated labor rates (total negotiated fully burdened labor costs “divided by” total number of hours negotiated) – If the average actual burdened labor rates exceeds the average proposed/negotiated rate by 15%, the contractor shall send notice and rationale (CDRL A009) for the rate variance to the COR who will then send appropriate notification to the Contracting /Ordering Officer. Additionally, contractors shall notify the COR if variances exceed 15% for more than three consecutive months. Contractors shall annotate the variance percentage of monthly average actual labor rates versus average negotiated labor rates in the monthly contract/TO status reports.

5.2.1.7 ODC Limitation Notification

Contractors shall monitor Other Direct Costs (ODCs) as part of the monthly contract/TO status reports. For this monitoring purpose, ODCs include incidental material, travel, and other non-labor costs (excluding subcontracting and consultant labor cost) required in performance of the service. For any given period of performance, if the cumulative total cost of ODCs exceeds the awarded total cost of ODCs (regardless of any modifications to the awarded amount) by 10%, the contractor shall send notice and rationale (CDRL A009) for exceeding cost to the COR who will then send a memorandum signed by the PM (or equivalent) to the Contracting Officer documenting the reasons justifying the increase of ODC. The ability of a contractor to monitor ODCs will be included in the contract/TO Quality Assurance Surveillance Plan (QASP).

5.2.1.8 Limitation of Subcontracting

In accordance with FAR 52.219-14, limitation of subcontracting is applicable for contracts/TOs that have been wholly or partially set aside for small business or 8(a) concerns. When providing services, the prime contractor shall perform at least 50% of the total contract labor cost and if applicable, shall perform at least 50% of the total contract labor cost on each subsequent TO. When providing supplies (other than procurement from a non-manufacturer of such supplies), the prime contractor shall perform work for at least 50% of the cost of manufacturing the supplies, not including the cost of material. To ensure compliance with clause 52.219-14, the contactor shall develop and submit a Limitation of Subcontracting Report (LSR) (CDRL A010) every 3 months. See applicable DD Form 1423 for reporting details and distribution instructions. The labor cost provided should correspond to the cumulative monthly submitted invoices. The government reserves the right to perform spot checks and/or request copies of any supporting documentation. If the prime contractor’s total labor cost is under 50% at either the contract and/or TO level, the contractor shall annotate in the LSR the deficiency and include an explanation addressing why the contractor is non-compliant and if the contract/TO is not complete how the prime contractor intends to rectify the deficiency.

5.3 EARNED VALUE MANAGEMENT (EVM)

Earned Value Management (EVM) implementation will be determined at the TO level since this IDIQ contract is utilized by multiple users and multiple programs. The government will specify EVM requirements, if any, prior to task order award. For contracts supporting multiple programs, requiring EVM is not based on the cumulative contract or task order amounts but on the single program effort over the life of the contract. Pursuant to DFARS 252.234-7001 (DEVIATION 2015-O0017)(SEP 2015) and 252.234-7002 (DEVIATION 2015-O0017)(SEP 2015), the contractor is required to have an Earned Value Management System (EVMS) which is determined by the dollar value of the single program effort. For contract program dollar values less than $20M, EVM is not required. In lieu of EVM, the contractor shall develop and maintain, as applicable to the TO, a Contract Funds Status Report (CFSR) (CDRL A011) to help track cost expenditures against performance. For program dollar values equal to or exceeding $20M, the contractor shall have an EVMS that complies with ANSI/EIA-748A. For program dollar values equal to or exceeding $100M, contractors shall ensure their EVMS is formally validated and accepted by the Cognizant Federal Agency (CFA) (i.e., DCMA). For work requiring EVM, the contractor shall ensure their EVMS is capable of the following:

5.3.1 Relate resource planning to schedules and technical performance requirements

5.3.2 Integrate technical performance, cost, schedule, and risk management

5.3.3 Provide the integrated management information to plan the timely performance of work, budget resources, account for costs, and measure actual performance against plans and by the Work Breakdown Structure (WBS) and Contract Work Breakdown Structure (CWBS) elements in accordance with MIL-STD-881. The contractor shall be able to sort, report, and account for tasking and expenditures by the WBS elements assigned in the task order (i.e., CWBS). The contractor shall ensure the EVMS has the capability to predict, isolate, and identify variances and the factors causing the variances.

5.3.3.1 The contractor shall develop and maintain a contract WBS (CWBS) and CWBS dictionary (CDRL A012) in accordance with DID DI-MGMT-81334B and the tasking assigned to support the program WBS as specified at the TO level. The contractor shall ensure the government approved CWBS is written to the lowest level needed for adequate management and control of the contractual effort. The contractor shall ensure the CWBS includes all the elements for the products (hardware, software, data, or services) which are the responsibility of the contractor, and the CWBS reflects all work to be accomplished and facilitate management, data collection, and reporting. The contractor shall keep the CWBS dictionary current at all times and provide updates to the government as specified. In accordance with DID DI-MGMT-81334A, changes to the CWBS or associated definitions at any reporting level, require Government approval.

5.3.3.2 The contractor shall provide a monthly Integrated Program Management Report (IPMR) (CDRL A013) which combines the Contract Performance Report (CPR) with the Integrated Master Schedule (IMS) into a single report. Specific requirements are noted in CDRL DD Form 1423 and DID DI-MGMT-81861 where IPMR formats 1-7 are required but formats 2, 3, & 4 are optional for program values $20M -$100M.

5.3.4 For program dollar values equal to or exceeding $20M, Schedule Risk Assessment is optional. For program dollar values equal to or exceeding $100M, Schedule Risk Assessment is required.

5.3.5 The contractor shall engage jointly with the Government’s program manager in Integrated Baseline Reviews (IBRs) to evaluate the risks inherent in the contract’s planned performance measurement baseline. The contractor shall ensure the initial IBR occurs as soon as feasible but not later than six months after contract award, and subsequently, following all major changes to the baseline. The contractor shall verify during each IBR that the contractor uses a reliable performance measurement baseline, which includes the entire contract scope of work, is consistent with contract schedule requirements, and has adequate resources assigned. Each IBR should also record any indications that effective Earned Value Management (EVM) is not being used. The contractor shall conduct IBRs on subcontracts that meet or exceed the EVM threshold. The prime contractor shall lead the subcontractor IBRs, with active participation by the Government.

6.0 QUALITY

6.1 QUALITY SYSTEM

Upon contract award, the prime contractor shall have and maintain a quality assurance process that meets contract requirements and program objectives while ensuring customer satisfaction and defect-free products/process. The contractor shall have a sufficiently documented quality system which contains procedures, planning, and all other documentation and data necessary to provide an efficient and effective quality system based on a contractor’s internal auditing system. Thirty (30) days after contract award, the contractor shall provide to the government a copy of its Quality Assurance Plan (QAP) and any other quality related documents (CDRL A014) as applicable to the TO. The contractor shall make the quality system available to the government for review at both a program and worksite services level during predetermined visits. Existing quality documents that meet the requirements of this contract may continue to be used. If any quality documentation is disapproved or requires revisions, the contractor shall correct the problem(s) and submit revised documentation NLT 2 weeks after initial disapproval notification. The contractor shall also require all subcontractors to possess a quality assurance and control program commensurate with the services and supplies to be provided as determined by the prime’s internal audit system. The Government reserves the right to disapprove the contractor’s and/or subcontractor’s quality system or portions thereof when the quality system(s) fails to meet contractual requirements at either the program or worksite services level. The Government reserves the right to participate in the process improvement elements of the contractor’s quality assurance plan and development of quality related documents as needed. At a minimum, the contractor shall ensure their quality system meets the following key criteria:

· Establish documented, capable, and repeatable processes

· Track issues and associated changes needed

· Monitor and control critical product and process variations

· Establish mechanisms for feedback of field product performance

· Implement and effective root-cause analysis and corrective action system

· Establish methods and procedures for continuous process improvement

6.2 QUALITY MANAGEMENT PROCESS COMPLIANCE

6.2.1 General

The contractor shall have processes in place that coincide with the government’s quality management processes. The contractor shall use best industry practices including, when applicable, ISO/IEC 15288 for System life cycle processes and ISO/IEC 12207 for Software life cycle processes. As applicable, the contractor shall also support and/or participate in event-driven milestones and reviews as stated in the Defense Acquisition University's (DAU's) DoD Integrated Defense Acquisition, Technology, and Logistics Life Cycle Management System Chart which is incorporates multiple DoD directives and instructions – specifically DoDD 5000.01 and DoDI 5000.02. The contractor shall provide technical program and project management support that will mitigate the risks to successful program execution including employment of Lean Six Sigma methodologies in compliance with SPAWARSYSCEN Atlantic requirements and with the SSC Engineering Process Office (EPO) Capability Maturity Model Integration (CMMI) program. As part of a team, the contractor shall support projects at SPAWARSYSCEN Atlantic that are currently, or in the process of, being assessed under the SSC EPO CMMI program. The contractor shall be required to utilize the processes and procedures already established for the project and the SSC EPO CMMI program and deliver products that are compliant with the aforementioned processes and procedures. Although having a formal CMMI appraisal is desired, it is not required.

6.3 QUALITY ASSURANCE

The contractor shall perform all quality assurance process audits necessary in the performance of the various tasks as assigned and identified by the respective WBS, POA&M, or quality system, and the contractor shall deliver related quality plan/procedural documents upon request. The Government reserves the right to perform any additional audits deemed necessary to assure that the contractor processes and related services, documents, and material meet the prescribed requirements and to reject any or all processes or related services, documents, and material in a category when noncompliance is established.

6.4 QUALITY CONTROL

The contractor shall perform all quality control inspections necessary in the performance of the various tasks as assigned and identified by the respective WBS, POA&M, or quality system, and the contractor shall submit related quality objective evidence upon request. Quality objective evidence (CDRL A014) includes any of the following as applicable:

· Detailed incoming receipt inspection records

· First article inspection records

·…