PWS.pdf

[Ver dtd 31 Aug 17] 1 of 16

SECTION C – DESCRIPTION/SPECS/WORK STATEMENT

SPECIFICATIONS/STATEMENT OF WORK/PERFORMANCE WORK STATEMENT

Work under this performance-based contract will be performed in accordance with the following description/ specifications/ statement of work (SOW) which herein will be referred to as Performance Work Statement (PWS):

SHORT TITLE: MAINTENANCE ENGINEERING SUPPORT CENTER (MESC)

CONSOLIDATED AFLOAT NETWORK ENTERPRISE SERVICES (CANES) END OF LIFE

(EOL) SUSTAINMENT ANALYSIS AND REPORTING

1.0 PURPOSE

1.1 SCOPE

This PWS provides analysis, reporting, Course of Action (COA) development and Engineering Change Requests (ECR) for CANES End of Life and Sustainment for Obsolescence Management, and Spares management in order for CANES platforms to maintain their warfighter capabilities.

Note: In accordance with the Fleet Forces Command (FFC) and Naval Sea Systems Command (NAVSEA) Joint Industry-Navy Improvements Initiative (JINII) and in accordance with current SPAWARSYSCEN Atlantic (SSC Atlantic) Installation Management Office (IMO) Policy, the scope of this contract specifically excludes system installation related tasks involving U.S. Navy property (ships, shore stations) and excludes installation related tasks funded with U.S. Navy Funds.

This PWS covers primarily support for Space and Naval Warfare Systems Center Atlantic (SPAWARSYSCEN Atlantic) Afloat and Ashore Tactical Networks. The support will include at a minimum the following areas: Logistics Engineering, Technical, and ILS.

2.0 PLACE(S) OF PERFORMANCE

The contractor shall provide support at the following locations:

a. SPAWAR Pacific, San Diego, CA (NOTE: KTR plans to visit gov’t sites during POP)

b. SPAWAR Atlantic, Norfolk, VA (NOTE: KTR plans to visit gov’t sites during POP)

c. Contractor facilities

2.1 GOVERNMENT FACILITIES

No Government facilities (i.e., office space or lab space) are provided on this contract. Work shall be performed at the contractor facility and/or temporarily at locations specified under travel.

2.2 CONTRACTOR FACILITIES

The contractor can have its facility location anywhere as long as the location does not present a hardship to complete work required on task. The contractor shall have real-time communication between the contractor personnel supporting the efforts and government personnel available at time of award.

3.0 PERFORMANCE REQUIREMENTS

The following paragraphs list all required non-personal services tasks that will be required throughout the contract. The contractor shall provide necessary resources with knowledge and experience as cited in the personal qualification clause to support the listed tasks. Contractors shall perform requirements in accordance with Federal Acquisition Regulation (FAR) and/or Defense Federal

[Ver dtd 31 Aug 17] 2 of 16

Acquisition Regulation Supplement (DFARS) which does not include performance of inherently Governmental functions. The contractor shall complete all required tasks while controlling and tracking performance and goals in terms of costs, schedules, and resources.

3.1. INTEGRATED LOGISTICS SUPPORT

CLIN PURCHASE ORDER SECTION PROGRAMS FUNDING

CLIN 1 3.1.1, 3.1.2 CANES OMN

The Contractor shall be able to apply ILS approach to the management and technical activities needed to influence operational and materiel requirements and design specifications for logistics support.

The principal objective of lifecycle (acquisition) logistics are to ensure that support considerations are an integral part of the system’s design requirements, that the system can be cost effectively supported through it life-cycle, and that the research and development facilities and infrastructure elements necessary to the design, development, initial fielding, and operational support of the system are identified, developed, acquired, and supported.

3.1.1 Obsolescence Management: The Contractor shall develop and implement a proactive Obsolescence Management Plan that clearly defines the procedures, processes, roles, and responsibilities to be used by the Obsolescence Management Team. Contractor shall execute the Management Plan by identifying obsolescence issues, cost/readiness impacts, business case analysis of risks and best value alternatives, and strategies for Obsolescence Management issue resolution.

The Contractor shall develop and implement a standardized Case Resolution Process to manage Diminishing Manufacturer Sources Material Shortages (DMSMS) cases. The process will include a knowledge repository of ongoing and completed DMSMS cases and tools to track/report DMSMS cost/performance metrics. The Contractor shall use the Sustainment Technology Assessment Resource (QSTAR) obsolescence management system. The contractor shall conduct a monthly DMSMS meeting with Logistics, Engineering, and Configuration Management Teams to determine final DMSMS resolution. (CDRLs: A001, T001, T002)

3.1.2 Logistics Engineering Support: The contractor shall provide CANES Sustainment Analysis and Reporting, which supports all CANES variants and provides projected end-of life, end of sale and end of support dates for each lowest replaceable unit. The contractor shall provide Courses of Action (COA) for CANES Diminishing Resources. (CDRLs: A001, T001, T002)

4.0 INFORMATION TECHNOLOGY (IT) SERVICES REQUIREMENTS

4.1 INFORMATION TECHNOLOGY (IT) GENERAL REQUIREMENTS

The contractor shall be responsible for the following:

4.1.1 Ensure that no production systems are operational on any research, development, test and evaluation (RDT&E) network.

4.1.2 Follow DoDI 8510.01 when deploying, integrating, and implementing IT capabilities.

4.1.3 Migrate all Navy Ashore production systems to the Navy, Marine Corps Intranet (NMCI) environment where available.

4.1.4 Work with Government personnel to ensure compliance with all current Navy IT & cybersecurity policies, including those pertaining to Cyber Asset Reduction and Security (CARS).

4.1.5 Follow SECNAVINST 5239.3B & DoDI 8510.01 prior to integration and implementation of IT solutions or systems.

[Ver dtd 31 Aug 17] 3 of 16

4.1.6 Register any contractor-owned or contractor-maintained IT systems utilized on contract in the Department of Defense IT Portfolio Registry (DITPR)-DON.

4.1.7 Ensure all software recommended, procured, and/or developed is compliant with Section 508 of the Rehabilitation Act of 1973, 26 CFR Part 1194 and pursuant to SPAWARINST 5721.1B.

5.0 CONTRACT ADMINISTRATION

Administration of the work being performed is required; it provides the Government a means for contract management and monitoring. Regardless of the level of support, the ultimate objective of the contractor is ensuring the Government’s requirements are met, delivered on schedule, and performed within budget.

5.1 CONTRACTING OFFICER REPRESENTATIVE (COR) DESIGNATION

The COR for this contract is identified in contract clause 5252.201-9201.

5.2 CONTRACTOR LIAISON

The contractor shall assign a technical single point of contact, also known as the Program Manager (PM) who shall work closely with the Government Contracting Officer and COR. The contractor PM, located in the contractor’s facility, shall ultimately be responsible for ensuring that the contractor’s performance meets all Government contract requirements within cost and schedule. PM shall have the requisite authority for full control over all company resources necessary for contract performance and be available to support emergent situations. The PM shall ultimately be responsible for the following: personnel management; management of Government material and assets; and personnel and facility security. In support of open communication, the contractor shall initiate periodic meetings with the COR.

5.3 CONTRACTOR MONITORING AND MAINTENANCE

The contractor shall have processes established in order to provide all necessary resources and documentation during various times throughout the day including business and non-business hours in order to facilitate a timely contract response or modification in particular during urgent requirements.

5.3.1 Contract Administration & Documentation

Various types of administration documents are required throughout the life of the contract. At a minimum, the contractor shall provide the following documentation:

5.3.1.1 Contract Status Report (CSR)

The contractor shall develop a Contract Status Report (CSR) (CDRL A001) and submit it monthly at least 30 days after contract award on the 10th of each month. Only one report is submitted per contract. The prime shall be responsible for collecting, integrating, and reporting all subcontractor reports. The contractor shall report on various contract functions: performance, schedule, financial, business relations, and staffing plan/key personnel. See applicable DD Form 1423 for additional reporting details and distribution instructions. This CDRL includes a Staffing Plan (CDRL A001 Attachment 1 of Exhibit A), Personnel Listing (CDRL A001 Attachment 2of Exhibit A), and Government-furnished property (GFP) Template (CDRL A001 Attachment 3 of Exhibit A) necessary for additional data collection as applicable.

5.3.1.2 Contract Closeout Report

The contractor shall develop a contract closeout report (CDRL A002) and submit it no later than 15 days before the contract completion date. The prime contractor shall be responsible for collecting, integrating, and reporting all subcontracting information. See applicable DD Form 1423 for additional reporting details and distribution instructions.

[Ver dtd 31 Aug 17] 4 of 16

5.3.1.3 Enterprise-wide Contractor Manpower Reporting Application Pursuant to NMCARS 5237.102-90, the contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the DoD via a secure data collection website – Enterprise-wide Contractor Manpower Reporting Application (eCMRA). The Product/Service Codes (PSC) for contracted services excluded from reporting are as follows:

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities;

(4) S, Utilities ONLY;

(5) V, Freight and Shipping ONLY.

The contractor shall completely fill-in all required data fields using the following web address:

https:// doncmra.nmci.navy.mil/. Reporting inputs consists of labor hours executed during the contract period of performance within each Government fiscal year (FY) which runs from October 1 through September 30. While inputs may be reported any time during the FY, the contractor shall report all data no later than October 31 of each calendar year. Contractors may direct questions to the help desk at http://www.ecrma.mil/.

5.3.1.4 WAWF Invoicing Notification and Support Documentation Pursuant to DFARS clause 252.232-7003 and 252.232-7006, the contractor shall submit payment requests and receiving reports using DoD Invoicing, Receipt, Acceptance, and Property Transfer (iRAPT) application (part of the Wide Area Work Flow (WAWF) e-Business Suite) which is a secure Government web-based system for electronic invoicing, receipt, and acceptance. The contractor shall provide e-mail notification to the COR when payment requests are submitted to the iRAPT/WAWF and the contractor shall include cost back–up documentation (e.g., delivery receipts, time sheets, & material/travel costs, etc.) to the invoice in iRAPT/WAWF. When requested by the COR, the contractor shall directly provide a soft copy of the invoice and any supporting invoice documentation (CDRL A003) directly to the COR within 24 hours of request to assist in validating the invoiced amount against the products/services provided during the billing cycle.

5.4 CONTRACTOR PERFORMANCE MANAGEMENT

Contractor performance standards and requirements are outlined in the contract QASP. The ability of a contractor to perform to the outlined standards and requirement will be captured in the Contractor Performance Assessment Reporting System (CPARS). In support of tracking contractor performance, the contractor shall provide the following documents: Cost and Schedule Milestone Plan (CDRL A004) submitted 10 days after contract award and CPARS Draft Approval Document (CDAD) Report (CDRL A005) submitted monthly.

5.5 EARNED VALUE MANAGEMENT (EVM)

In accordance with DoD policy, this contract does not require Earned Value Management (EVM) implementation due to the contract type is wholly Firm-fixed Price (FFP).

6.0 DOCUMENTATION AND DELIVERABLES

6.1 CONTRACT DATA REQUIREMENTS LIST (CDRL)

The following listing identifies the data item deliverables required under this contract and the applicable section of the PWS for which they are required. Section J includes the DD Form 1423s that itemize each Contract Data Requirements List (CDRL) required under the basic contract. The contractor shall establish a practical and cost-effective system for developing and tracking the http://www.ecrma.mil/

[Ver dtd 31 Aug 17] 5 of 16 required CDRLs generated under each task. The contractor shall not develop any CDRL classified TOP SECRET with SCI.

6.1.1 Administrative CDRL

The following table lists all required administrative data deliverables, CDRLs, applicable to this contract:

CDRL

# Deliverable Title

PWS

Reference

Para Frequency Date Due

A001 Contract Status Report

(CSR)

5.3.1.1, 8.2.2.1,

10.0 MTHLY 30 DACA and monthly on

the 10th

A002 Contract Closeout Report 5.3.1.2 1TIME NLT 15 days before completion date

A003 Invoice Support Documentation 5.3.1.4 ASREQ Within 24 hrs from request

A004 Cost and Milestones Schedule Plan 5.4

One time with revisions

(ONE/R)

NLT 10 DACA revision NLT 7 days after receipt of

Govt review

A005 Contractor CPARS Draft Approval Document (CDAD) Report

5.4 MTHLY 30 DACA and monthly on

the 10th

6.1.2 Technical CDRL

The following table lists all required technical data deliverables, (CDRLs), applicable to this contract:

The following table lists all required technical data deliverables, CDRLs, applicable to this order:

CDRL

# Deliverable Title PWS

Ref Para Frequency Date Due

T001 CANES DMSMS Report 3.1.1,

3.1.2 QTRLY 15 Jan, 15 Apr, 15 Jul, & 15

Oct

T002 CANES Obsolescence Course Of Action (COA)

3.1.1,

3.1.2 QTRLY 15 Jan, 15 Apr, 15 Jul, & 15

Oct

6.2 ELECTRONIC FORMAT

At a minimum, the contractor shall provide deliverables electronically by e-mail; hard copies are only required if requested by the Government. To ensure information compatibility, the contractor shall guarantee all deliverables (i.e., CDRLs), data, correspondence, and etc., are provided in a format approved by the receiving Government representative. The contractor shall provide all data in an editable format compatible with SPAWARSYSCEN Atlantic corporate standard software configuration as specified below. Contractor shall conform to SPAWARSYSCEN Atlantic corporate standards within 30 days of contract award. The initial or future upgrades costs of the listed computer programs are not chargeable as a direct cost to the Government.

Deliverable Software to be used

a. Word Processing Microsoft Word

b. Technical Publishing PageMaker/Interleaf/SGML/ MSPublisher

c. Spreadsheet/Graphics Microsoft Excel

d. Presentations Microsoft PowerPoint

e. Scheduling Microsoft Project

6.3 INFORMATION SYSTEM

[Ver dtd 31 Aug 17] 6 of 16

6.3.1 Electronic Communication

The contractor shall have broadband Internet connectivity and an industry standard email system for communication with the Government. The contractor shall be capable of Public Key Infrastructure (PKI) client side authentication to DOD private web servers. Unless otherwise specified, all key personnel on task shall be accessible by e-mail through individual accounts during all hours.

6.3.2 Information Security

Pursuant to DoDM 5200.01, the contractor shall provide adequate security for all unclassified DoD information passing through non-DoD information system including all subcontractor information systems utilized on task. The contractor shall disseminate unclassified DoD information within the scope of assigned duties and with a clear expectation that confidentiality is preserved. Examples of such information include the following: non-public information provided to the contractor, information developed during the course of the contract, and privileged contract information (e.g., program schedules and contract-related tracking).

6.3.2.1 Safeguards

The contractor shall protect Government information and shall provide compliance documentation validating they are meeting this requirement in accordance with DFARS clause 252.204-7012. The contractor and all subcontractors shall abide by the following safeguards:

(a) Do not process DoD information on public computers (e.g., those available for use by the general public in kiosks or hotel business centers) or computers that do not have access control.

(b) Protect information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.

(c) Sanitize media (e.g., overwrite) before external release or disposal.

(d) Encrypt all information that has been identified as controlled unclassified information (CUI) when it is stored on mobile computing devices such as laptops and personal digital assistants, or removable storage media such as portable hard drives and digital optical disks, using DoD Authorized Data-at-Rest encryption technology. NOTE: Thumb drives are not authorized for DoD work, storage, or transfer. Use GSA Awarded DAR solutions (GSA # 10359) complying with ASD- NII/DOD-CIO Memorandum, “Encryption of Sensitive Unclassified Data-at-Rest on Mobile Computing Devices and Removable Storage.” The contractor shall ensure all solutions meet FIPS 140-2 compliance requirements.

(e) Limit information transfer to subcontractors or teaming partners with a need to know and a commitment to at least the same level of protection.

(f) Transmit e-mail, text messages, and similar communications using technology and processes that provide the best level of privacy available, given facilities, conditions, and environment.

Examples of recommended technologies or processes include closed networks, virtual private networks, public key-enabled encryption, and Transport Layer Security (TLS). Encrypt organizational wireless connections and use encrypted wireless connection where available when traveling. If encrypted wireless is not available, encrypt application files (e.g., spreadsheet and word processing files), using at least application-provided password protection level encryption.

(g) Transmit voice and fax transmissions only when there is a reasonable assurance that access is limited to authorized recipients.

(h) Do not post DoD information to Web site pages that are publicly available or have access limited only by domain or Internet protocol restriction. Such information may be posted to Web site pages that control access by user identification or password, user certificates, or other technical means

[Ver dtd 31 Aug 17] 7 of 16 and provide protection via use of TLS or other equivalent technologies. Access control may be provided by the intranet (vice the Web site itself or the application it hosts).

(i) Provide protection against computer network intrusions and data exfiltration, minimally including the following:

1. Current and regularly updated malware protection services, e.g., anti-virus, anti-spyware.

2. Monitoring and control of inbound and outbound network traffic as appropriate (e.g., at the external boundary, sub-networks, individual hosts) including blocking unauthorized ingress, egress, and exfiltration through technologies such as firewalls and router policies, intrusion prevention or detection services, and host-based security services.

3. Prompt application of security-relevant software patches, service packs, and hot fixes.

(j) As applicable, comply with other current Federal and DoD information protection and reporting requirements for specified categories of information (e.g., medical, critical program information (CPI), personally identifiable information, export controlled).

(k) Report loss or unauthorized disclosure of information in accordance with contract or agreement requirements and mechanisms.

6.3.2.2 Compliance

Pursuant to DoDM 5200.01, the contractor shall include in their quality processes procedures that are compliant with information security requirements.

7.0 QUALITY

7.1 QUALITY SYSTEM

Upon contract award, the prime contractor shall have and maintain a quality system that meets contract requirements and program objectives while ensuring customer satisfaction and defect-free products/process. The contractor shall have an adequately documented quality system which contains processes, procedures, planning, and all other documentation and data necessary to provide an efficient and effective quality system, which includes an internal auditing system. The contractor shall make their quality system available to the Government for review at both a program and worksite services level during predetermined visits. Existing quality documents that meet the requirements of this contract may continue to be used. If any quality documentation is disapproved or requires revisions, the contractor shall correct the problem(s) and submit revised documentation NLT 2 weeks after initial disapproval notification. The contractor shall also require all subcontractors to possess a quality assurance and control program commensurate with the services and supplies to be provided as determined by the prime’s internal audit system. The Government reserves the right to disapprove the contractor’s and/or subcontractor’s quality system or portions thereof when the quality system(s) fails to meet contractual requirements at either the program or worksite services level. The Government reserves the right to participate in the process improvement elements of the contractor’s quality assurance plan or quality system, and development of quality related documents. At a minimum, the contractor shall ensure their quality system meets the following key criteria:

• Establish documented, capable, and repeatable processes

• Track issues and associated changes needed

• Monitor and control critical process, product, and service variations

• Establish mechanisms for feedback of field product and service performance

• Implement and effective root-cause analysis and corrective action system

• Establish methods and procedures and create data used for continuous process improvement

7.2 MANAGE QUALITY COMPLIANCE

[Ver dtd 31 Aug 17] 8 of 16

7.2.1 General

The contractor shall have quality processes or a Quality Management System (QMS) processes in place that coincide with the Government’s Manage Quality processes which address Quality Control, Quality Assurance, Software Quality, and/or project Quality System tasks. The contractor shall use best industry practices including, when applicable, ISO/IEC 15288 for System life cycle processes and ISO/IEC 12207 for Software life cycle processes. As applicable, the contractor shall also support and/or participate in Acquisition Milestones, Phases, and Decision Points, which are standard elements of the Defense Acquisition System and support DoDD 5000.01 and DoDI 5000.02. The contractor shall provide technical program and project management support that will mitigate the risks to successful program execution including employment and objective evidence of Lean Six Sigma, Risk Management, and System Engineering methodologies; and System and Software Engineering best practices.

7.3 QUALITY ASSURANCE

The contractor shall perform all quality assurance process audits necessary in the performance of the various tasks as assigned and identified in the contractor‘s Quality Assurance Plan (QAP) or by the respective WBS, POA&M, or quality system/QMS documentation in support of continuous improvement. The contractor shall deliver related QAP and any associated procedural documents upon request. The Government reserves the right to perform any additional audits deemed necessary to assure that the contractor processes, products, and related services, documents, and material meet the prescribed requirements and to reject any or all processes or related products, services, documents, and material in a category when noncompliance is established.

7.4 QUALITY CONTROL

The contractor shall perform all quality control inspections necessary in the performance of the various tasks as assigned and identified in the contractor QAP or by the respective WBS, POA&M, or quality system/QMS documentation.

8.0 SECURITY

8.1 ORGANIZATION

8.1.1 Security Classification

All work performed under this contract is “unclassified.” A facility security clearance (FCL) is not required; therefore, DoD Contract Security Classification Specification, DD Form 254, does not exist.

Pursuant to DoDM 5200.01 – Volume 4, Controlled Unclassified Information (CUI), the contractor shall safeguard any sensitive Government information.

8.2 PERSONNEL

The contractor shall conform to the security provisions of DoDI 5220.22/DoD 5220.22-M – National Industrial Security Program Operating Manual (NISPOM), SECNAV M-5510.30, DoD 8570.01-M, and the Privacy Act of 1974. Prior to any labor hours being charged on contract, the contractor shall ensure all personnel (including administrative and subcontractor personnel) have obtained and can maintain favorable background investigations at the appropriate level(s) for access required for the contract, and if applicable, are certified/credentialed for the CSWF. A favorable background determination is determined by either a Tier 1 (T1) investigation, Tier 3 (T3) investigation, or Tier 5 (T5) investigation and favorable Federal Bureau of Investigation (FBI) fingerprint checks.

Investigations are not necessarily required for personnel performing unclassified work who do not require access to Government installations/facilities, Government IT systems and IT resources, or SPAWARSYSCEN Atlantic information. Cost to meet these security requirements is not directly chargeable to contract.

[Ver dtd 31 Aug 17] 9 of 16

NOTE: If a final determination is made that an individual does not meet or cannot maintain the minimum security fitness requirements, the contractor shall permanently remove the individual from SPAWARSYSCEN Atlantic facilities, projects, and/or programs. If an individual who has been submitted for a fitness determination or security clearance is "denied," receives an "Interim Declination," or unfavorable fingerprint, the contractor shall remove the individual from SPAWARSYSCEN Atlantic facilities, projects, and/or programs until such time as the investigation is fully adjudicated or the individual is resubmitted and is approved. All contractor and subcontractor personnel removed from facilities, projects, and/or programs shall cease charging labor hours directly or indirectly on contract.

8.2.1 Access Control of Contractor Personnel

8.2.1.1 Physical Access to Government Facilities and Installations Contractor personnel shall physically access Government facilities and installations for purposes of site visitation, supervisory and quality evaluation, work performed within Government spaces (either temporary or permanent), or meeting attendance. Individuals supporting these efforts shall comply with the latest security regulations applicable to the Government facility/installation.

(a) The majority of Government facilities require contractor personnel to have an approved visit request on file at the facility/installation security office prior to access. For admission to SPAWARSYSCEN Atlantic facilities/installations, the contractor shall forward a visit request to Joint Personnel Adjudication System (JPAS) /SMO 652366, or submit request on company or agency letterhead by fax to (843)218-4045 or mail to Space and Naval Warfare Systems Center Atlantic, P.O.

Box 190022, North Charleston, SC 29419-9022, Attn: Security Office. For visitation to all other Government locations, the contractor shall forward visit request documentation directly to the on-site facility/installation security office.

(b) Depending on the facility/installation regulations, contractor personnel shall present a proper form of identification(s) and vehicle proof of insurance or vehicle rental agreement. NOTE:

SPAWARSYSCEN Atlantic facilities located on Joint Base Charleston require a Common Access Card (CAC) each time physical installation access is required. Contractor shall contact SPAWARSYSCEN Atlantic Security Office directly for latest policy.

(c) All contractor persons engaged in work while on Government property shall be subject to inspection of their vehicles at any time by the Government, and shall report any known or suspected security violations to the Security Department at that location.

8.2.1.2 Identification and Disclosure Requirements

Contractor and subcontractor employees shall take all means necessary to not represent themselves as Government employees. All contractor personnel shall follow the identification and Government facility disclosure requirement as specified in contract clause 5252.237-9602, Contractor Identification.

8.2.1.3 Government Badge Requirements

Some contract personnel shall require a Government issued picture badge in accordance with contract clause 5252.204-9202, Contractor Picture Badge. While on Government installations/facilities, contractors shall abide by each site’s security badge requirements. Various Government installations are continually updating their security requirements to meet Homeland Security Presidential Directive (HSPD-12) identification standards. Contractors are responsible for obtaining and complying with the latest security identification requirements for their personnel. Contractors shall submit valid paper work (e.g., site visit request, request for picture badge, and/or SF-86 for CAC) to the applicable Government security office via the COR. The contractor FSO shall track all personnel holding local Government badges at the contract level.

[Ver dtd 31 Aug 17] 10 of 16

8.2.1.4 Common Access Card (CAC) Requirements

Some Government facilities/installations (e.g., Joint Base Charleston) require contractor personnel to have a CAC for physical access to the facilities or installations. Contractors supporting work that requires access to any DoD IT/network also requires a CAC. Granting of logical and physical access privileges remains a local policy and business operation function of the local facility. The contractor is responsible for obtaining the latest facility/installation and IT CAC requirements from the applicable local Security Office. When a CAC is required to perform work, contractor personnel shall be able to meet all of the following security requirements prior to work being performed:

(a) Pursuant to DoDM 1000.13-V1, issuance of a CAC is based on the following four criteria:

1. Eligibility for a CAC – to be eligible for a CAC, Contractor personnel’s access requirement shall meet one of the following three criteria: (a) individual requires access to multiple DoD facilities or access to multiple non-DoD federally controlled facilities on behalf of the SPAWARSYSCEN Atlantic on a recurring bases for a period of 6 months or more, (b) individual requires both access to a DoD facility and access to DoD network on site or remotely, or (c) individual requires remote access to DoD networks that use only the CAC logon for user identification.

2. Verification of DoD affiliation from an authoritative data source – CAC eligible personnel must be registered in the Defense Enrollment Eligibility Reporting Systems (DEERS) through either an authoritative personnel data feed from the appropriate Service or Agency or Trusted Associated Sponsorship System (TASS).

3. Completion of background vetting requirements according to FIPS PUB 201-2 and DoD 5200.2-R – at a minimum, the completion of FBI fingerprint check with favorable results and submission of a T1 investigation to the Office of Personnel Management (OPM), or a DoD-determined equivalent investigation. NOTE: Contractor personnel requiring logical access shall obtain and maintain a favorable T3 investigation. Contractor personnel shall contact the SPAWARSYSCEN Atlantic Security Office to obtain the latest CAC requirements and procedures.

4. Verification of a claimed identity – all contractor personnel shall present two forms of identification in its original form to verify a claimed identity. The identity source documents must come from the list of acceptable documents included in Form I-9, OMB No. 115-0136, Employment Eligibility Verification. Consistent with applicable law, at least one document from the Form I-9 list must be a valid (unexpired) State or Federal Government-issued picture identification (ID). The identity documents will be inspected for authenticity, scanned, and stored in the DEERS.

(b) When a contractor requires logical access to a Government IT system or resource (directly or indirectly), the required CAC will have a PKI. A hardware solution and software (e.g., ActiveGold) is required to securely read the card via a personal computer. Pursuant to DoDM 1000.13-V1, CAC PKI certificates will be associated with an official Government issued e-mail address (e.g. .mil, .gov, .edu). Prior to receipt of a CAC with PKI, contractor personnel shall complete the mandatory Cybersecurity Awareness training and submit a signed System Authorization Access Request Navy (SAAR-N) form to the contract specified COR. Note: In order for personnel to maintain a CAC with PKI, each contractor employee shall complete annual cybersecurity training. The following guidance for training and form submittal is provided; however, contractors shall seek latest guidance from their appointed company Security Officer and the SPAWARSYSCEN Atlantic Information Systems Security Management (ISSM) office:

1. For annual DoD Cybersecurity/IA Awareness training, contractors shall use this site:

https://twms.nmci.navy.mil/. For those contractors requiring initial training and do not have a CAC, contact the SPAWARSYSCEN Atlantic ISSM office at phone number (843)218-6152 or e-mail questions to ssc_lant_iam_office.fcm@navy.mil for additional instructions.

Training can be taken at the IAM office or online at http://iase.disa.mil/index2.html.

2. For SAAR-N form, the contractor shall use OPNAV 5239/14 (Rev 9/2011). Contractors can obtain a form from the SPAWARSYSCEN Atlantic ISSM office at or from the website:

https://twms.nmci.navy.mil/ mailto:ssc_lant_iam_office.fcm@navy.mil http://iase.disa.mil/index2.html

[Ver dtd 31 Aug 17] 11 of 16 https://navalforms.documentservices.dla.mil/. Digitally signed forms will be routed to the ISSM office via encrypted e-mail to ssclant_it_secmtg@navy.mil.

8.2.1.5 Contractor Check-in and Check-out Procedures

All SPAWARSYSCEN Atlantic contractor personnel requiring or possessing a Government badge and/or CAC for facility and/or IT access shall have a SPAWARSYSCEN Atlantic Government sponsor and be in compliance with the most current version of Contractor Check-in and Check-out Instruction and Forms as posted on the Command Operating Guide (COG) website. Throughout contract performance, the contractor shall provide necessary employee information and documentation for employees hired, transferred, and/or terminated in support of this contract within the required timeframe as cited in the Check-in and Check-out instructions. The contractor (FSO, if applicable) shall ensure all contractor employees whose services are no longer required on this contract return all applicable Government documents/badges to the appropriate Government representative. NOTE: If the contractor does not have access to the SPAWARSYSCEN Atlantic COG website, the contractor shall get all necessary instruction and forms from the COR.

8.2.1.6 Accessing Navy Enterprise Resources Planning (ERP) System Contractor personnel shall not access the Navy Enterprise Resource Planning (Navy ERP) system.

8.2.2 Security Training

Applicable for unclassified and classified contracts, contractor personnel (including subcontractors) shall complete all required mandatory Government training in accordance with COMSPAWARSYSCOM Code 80330 mandatory training webpage:

https://wiki.spawar.navy.mil/confluence/display/HQ/Employee+Mandatory+Training. Contractors without access to the SPAWAR webpage shall coordinate with the COR concerning mandatory training as listed on the training webpage.

8.3 OPERATIONS SECURITY (OPSEC) REQUIREMENTS

Security programs are oriented towards protection of classified information and material. Operations Security (OPSEC) is an operations function which involves the protection of any critical information

– focusing on unclassified information that may be susceptible to adversary exploitation. Pursuant to DoDD 5205.02E and SPAWARINST 3432.1, SPAWARSYSCEN Atlantic’s OPSEC program implements requirements in DoD 5205.02-M – OPSEC Program Manual and SPAWARSYSCENLANTINST 3070.1B. Note: OPSEC requirements are applicable when contract personnel have access to either classified information or unclassified Critical Program Information (CPI)/sensitive information.

8.3.1 Local and Internal OPSEC Requirement

Contractor personnel, including subcontractors if applicable, shall adhere to the OPSEC program policies and practices as cited in the SPAWARINST 3432.1 and existing local site OPSEC procedures. The contractor shall development their own internal OPSEC program specific to the contract and based on SPAWARSYSCEN Atlantic OPSEC requirements. At a minimum, the contractor’s program shall identify the current SPAWARSYSCEN Atlantic site OPSEC Officer/Coordinator.

8.3.2 OPSEC Training

Contractor shall track and ensure applicable personnel receive initial and annual OPSEC awareness training in accordance with requirements outline in the Security Training, Para 8.2.3. OPSEC training requirements are applicable for personnel during their entire term supporting this SPAWARSYSCEN Atlantic contract.

8.3.3 SPAWARSYSCEN Atlantic OPSEC Program

https://navalforms.documentservices.dla.mil/ mailto:ssclant_it_secmtg@navy.mil https://wiki.spawar.navy.mil/confluence/display/HQ/Employee+Mandatory+Training

[Ver dtd 31 Aug 17] 12 of 16

Contractor shall participate in SPAWARSYSCEN Atlantic OPSEC program briefings and working meetings, and the contractor shall complete any required OPSEC survey or data call within the timeframe specified.

8.4 EFFECTIVE USE OF CONTROLS

The contractor shall screen all electronic deliverables or electronically provided information for malicious code using DoD approved anti-virus software prior to delivery to the Government. The contractor shall utilize appropriate controls (firewalls, password protection, encryption, digital certificates, etc.) at all times to protect contract related information processed, stored or transmitted on the contractor’s and Government’s computers/servers to ensure confidentiality, integrity, availability, authentication and non-repudiation. The contractor shall ensure provisions are in place that will safeguard all aspects of information operations pertaining to this contract in compliance with all applicable PWS references. In compliance with Para 6.4.2.1, the contractor shall ensure Data-at- Rest is required on all portable electronic devices including storage of all types. Encryption/digital signing of communications is required for authentication and non-repudiation. The contractor shall follow minimum standard in SECNAV M-5510-36 for classifying, safeguarding, transmitting, and destroying classified information.

9.0 GOVERNMENT FURNISHED INFORMATION (GFI)

Government Furnished Information (GFI) is Government owned intellectual property provided to contractors for performance on a contract. For the purposes of this contract, GFI includes manuals, technical specifications, maps, building designs, schedules, drawings, test data, etc. Depending on information contained in a document, the contractor shall comply with additional controls (e.g., completion of a Non-Disclosure Agreements, etc.) for access and distribution.

GFI is utilized on this contract. Any applicable document (PWS Para 16.0) not available online, the Government will provide document as GFI listed in the table below. The contractor shall inventory all GFI by tracking distribution and location and provide a GFI inventory to the Government. The contractor shall use the GFI provided to support this contract only – use of GFI document(s) to support other projects beyond this contract is not allowed. Unless otherwise specified, all GFI will be provided by the Government by the estimated delivery date listed in the table below, and the contractor shall return all GFI to the Government at completion of the contract. If a contractor requires additional GFI other than what is listed, the contractor shall submit a request to the COR within 30 days after contract award.

Item

Description GFI Estimated Delivery Date

1. Navy Data Environment (NDE) 30 days after TO award

2. Configuration Management Professional (CMPRO) 30 days after TO award

3. SHIPALT Installation Drawings 30 days after TO award

4. Integrated Logistics Support (ILS) Documentation 30 days after TO award

5. Reference Drawings 30 days after TO award

6. Integration Books 30 days after TO award

10.0 GOVERNMENT PROPERTY

As defined in FAR Part 45, Government property is property owned or leased by the Government which includes Government-furnished property (GFP) and Contractor-acquired property (CAP).

Government property is material, equipment, special tooling, special test equipment, and real property.

[Ver dtd 31 Aug 17] 13 of 16

GFP will not be provided and CAP is not anticipated on this contract.

11.0 TRAVEL

11.1 LOCATIONS

The contractor shall be prepared to travel to the following locations. Prior to any travel taken in support of this contract, the contractor shall obtain COR concurrence.

# Trips # People # Days/Nights From (Location) To (Location) 2 1 5/4 San Diego, CA Norfolk, VA

12.0 SAFETY ISSUES

12.1 OCCUPATIONAL SAFETY AND HEALTH REQUIREMENTS

The contractor shall be responsible for ensuring the safety of all company employees, other working personnel, and Government property. The contractor is solely responsible for compliance with the Occupational Safety and Health Act (OSHA) (Public Law 91-596) and the resulting applicable standards, OSHA Standard 29 CFR 1910 (general), 1915 (shipboard/submarine) and 1926 (shore), and for the protection, safety and health of their employees and any subcontractors assigned to the contracts. Without Government assistance, the contractor shall make certain that all safety requirements are met, safety equipment is provided, and safety procedures are documented as part of their quality management system. If performing within Government facilities, contractor shall immediately report any accidents involving Government or contractor personnel injuries or property/equipment damage to the Contracting Officer and COR. Additionally, the contractor is responsible for securing the scene and impounding evidence/wreckage until released by the COR or on-site Government representative.

13.0 SUBCONTRACTING REQUIREMENTS

13.1 APPROVED SUBCONTRACTORS

If the prime contractor is planning to utilize subcontractor(s) on this contract, the applicable subcontractors shall be specified at contract award, if applicable. Per FAR clause 52.244-2, if a subcontractor (includes tier 1, tier 2, tier 3, etc.) is proposed by a prime and is not approved on the basic contract, formal justification is required and subject to Government approval. [Contracting Officer will insert a list of the approved subcontractors for the contract.]

14.0 ACCEPTANCE PLAN

Inspection and acceptance is performed by the COR on all services, data, and non-data deliverables in accordance with the QASP, Attachment 1.

15.0 OTHER CONDITIONS/REQUIREMENTS

No other conditions or requirements are applicable.

16.0 APPLICABLE DOCUMENTS (AND DEFINITIONS)

The contractor shall ensure all work accomplished utilizes the latest, relevant industry practices and standards when applicable unless otherwise indicated by text. In accordance with Defense Acquisition Policy, maximum utilization of non-Government standards will be made wherever practical.

[Ver dtd 31 Aug 17] 14 of 16

16.1 REQUIRED DOCUMENTS

The contractor shall utilize the following mandatory documents in support of this contract. The documents referenced in this section list the minimum version dates; however, the contractor shall meet requirements for any referenced document including subsequent updates applicable at time the contract request for proposal is posted.

Document Number Title

a. DoD 5200.2-R DoD Regulation – Personnel Security Program dtd Jan 87 (and subsequent revisions)

b. DoDM 5200.01 DoD Manual – Information Security Program Manual dtd 24 Feb 12

c. DoDD 5205.02E DoD Directive – Operations Security (OPSEC) Program dtd 20 Jun 12

d. DoD 5205.02-M DoD Manual – Operations Security (OPSEC) Program Manual dtd 3 Nov 08

e. DoD 5220.22-M DoD Manual – National Industrial Security Program Operating Manual (NISPOM) dtd 28 Feb 06

f. DoDI 5220.22 DoD Instruction – National Industrial Security Program (NISP) dtd 18 Mar 11

g. DoDI 8500.01 DoD Instruction – Cybersecurity dtd 14 Mar 14

h. DoDI 8510.01 DoD Instruction – Risk Management Framework (RMF) for DoD Information Technology (IT) dtd 12 Mar 14

i. DoD 8570.01-M

DoD Manual – Information Assurance Workforce Improvement Program dtd 19 Dec 05 with Change 3 dtd 24 Jan 12 and Change 4 dtd 10 Nov 15 (and subsequent revisions)

j. DON CIO Memorandum Acceptable Use of Department of the Navy Information Technology (IT) dtd 22 Feb 16

k. SECNAV M-5510.30 Secretary of the Navy Manual – DoN Personnel Security Program dtd Jun 2006

l. SECNAV M-5510.36 Secretary of the Navy Manual – DoN Information Security Program dtd Jun 2006

m. SECNAVINST 5239.3B Secretary of the Navy Instruction – DoN Information Assurance Policy dtd 17 Jun 09

n. SPAWARINST 3432.1 Space and Naval Warfare Instruction – Operations Security (OPSEC) Policy dtd 2 Feb 05

o. SPAWARINST 4440.12A Space and Naval Warfare Instruction – Management of Operating Materials and Supplies (OM&S), Government Furnished Property (GFP), and Inventory

p. SPAWARSYSCENLANT

INST 3070.1B

Space and Naval Warfare Systems Center Atlantic Instruction

– Operations Security Policy dtd 20 Jan 17

q. Privacy Act of 1974 United States federal law, Pub.L. 93–579, 88 Stat. 1896, dtd December 31, 1974, 5 U.S.C. § 552a

16.2 GUIDANCE DOCUMENTS

The contractor shall utilize the following guidance documents in support of this contract. The documents referenced in this section list the minimum version dates; however, the document’s effective date of issue is the contract’s request for proposal issue date.

a. MIL-HDBK-61A Configuration Management

[Ver dtd 31 Aug 17] 15 of 16

b. MIL-STD-881C Work Breakdown Structure for Defense Materiel Items

c. MIL-STD-1916 DoD Test Method Standard – DoD Preferred Methods for Acceptance Of Product

d. DoDM 1000.13-V1 DoD Manual – DoD Identification Cards: ID card Life-Cycle, Volume 1, dtd 23 Jan 14

e. DoDD 5000.01 DoD Directive – The Defense Acquisition System

f. DoDI 5000.02 DoD Instruction – Operation of the Defense Acquisition System

g. ISO/IEC 12207 International Organization for Standardization/ International Electrotechnical Commission: Systems and Software Engineering – Software Life Cycle Processes

h. ISO/IEC/IEEE 15288 International Organization for Standardization/ International Electrotechnical Commission: Systems and Software Engineering – System Life Cycle Processes

i. ASTM Std E-2135-06 American Section of the International Association for Testing Materials, Standard

j. HSPD-12 Homeland Security Presidential Directive – Policy for a Common Identification Standard for Federal Employees and Contractors dtd 27 Aug 04

k. FIPS PUB 201-2 Federal Information Processing Standards Publication 201-2 – Personal Identity Verification (PIV) of Federal Employees and Contractors, August 2013

l. Form I-9, OMB No. 115-

US Department of Justice, Immigration and Naturalization Services, Form I-9, OMB No. 115-0136 – Employment Eligibility Verification

m. N/A SPAWARSYSCEN Atlantic Contractor Check-in portal – https://wiki.spawar.navy.mil/confluence/display/SSCACOG/Co ntractor+Checkin

n. N/A

COMSPAWARSYSCOM Code 80330 mandatory training webpage – https://wiki.spawar.navy.mil/confluence/display/HQ/Employee +Mandatory+Training

16.3 SOURCE OF DOCUMENTS

The contractor shall obtain all applicable documents necessary for performance on this contract. Many documents are available from online sources. Specifications and commercial/industrial documents may be obtained from the following sources:

Copies of Federal Specifications may be obtained from General Services Administration Offices in Washington, DC, Seattle, San Francisco, Denver, Kansas City, MO., Chicago, Atlanta, New York, Boston, Dallas and Los Angeles.

Copies of military specifications may be obtained from the Commanding Officer, Naval Supply Depot, 3801 Tabor Avenue, Philadelphia, PA 19120-5099. Application for copies of other Military Documents should be addressed to Commanding Officer, Naval Publications and Forms Center, 5801 Tabor Ave., Philadelphia, PA 19120-5099.

All other commercial and industrial documents can be obtained through the respective organization’s website.

INSTRUCTION ONLY – USE FOR VALIDATION AND PR PACKAGE REVIEW ONLY

[NOT PART OF PWS – To be deleted by contract specialist only prior to incorporation in CWS] https://wiki.spawar.navy.mil/confluence/display/SSCACOG/Contractor+Checkin https://wiki.spawar.navy.mil/confluence/display/SSCACOG/Contractor+Checkin

[Ver dtd 31 Aug 17] 16 of 16

LIST OF EXHIBITS & ATTACHMENTS

Exhibit A -- CDRLs - DD FORM 1423 Attachment 1 – Quality Assurance Surveillance Plan (QASP)