3 PWS UPDATED FINAL.docx

SPAWARSYSCEN ATLANTIC PWS TEMPLATE FOR SERVICES –

SIMPLIFIED ACQUISITION PROCEDURES (SAP)

[Contracts at or below Simplified Acquisition Threshold (SAT)] CMID#: SSCA_20_TEMPL_00026_SAP PWS Template_1.10

SECTION C – DESCRIPTION/SPECS/WORK STATEMENT

SPECIFICATIONS/STATEMENT OF WORK/PERFORMANCE WORK STATEMENT

Work under this performance-based contract will be performed in accordance with the following description/ specifications/ statement of work (SOW) which herein will be referred to as Performance Work Statement (PWS):

SHORT TITLE: Broadcast Keying System Submarine Message Gateway (BKS) MOBILE TRAINING TEAM (MTT) System Grooms

1.0 PURPOSE

Space and Naval Warfare Systems Center Atlantic (SPAWARSYSCEN Atlantic)

1.1 SCOPE

This task order is being issued to provide mobile training team support on FSBS Broadcast Keying System Submarine Message Gateway (BKS SMG) for the FSBS Digital Shore Submarine communications systems supporting COMNAVIDFOR. SPAWARSYSCEN Atlantic is the designated In-Service Engineering Agent (ISEA) for these systems and requires the services requested within this this task order in the execution of their duties.

1.2 BACKGROUND

The Submarine Operating Authority Submarine Message Gateway program encompasses all Program Of Record (POR) systems for PEO C4I PMW 770-2 and are part of the Fleet Submarine Broadcast System (FSBS) architecture. These shore systems are used for strategic and tactical operational control of the submarine fleet worldwide. These systems are installed in four (4) submarine Broadcast Control Authorities (BCAs), six (6) Broadcast Keying System Submarine Message Gateway (BKS SMG) sites and ten (10) Broadcast Transmitter Sites (BTS) sites worldwide. The systems included within the PMW 700 portfolio are Information Screening and Delivery Subsystem (ISDS), Submarine Message Gateway (SMG), Submarine Message Gateway - Legacy (SMG-L), Submarine Common Operational Toolset (SCOT), Web Enable Over-The-Air Monitor (WEBOTAM), Windows Over-The-Air Monitor (WinOTAM), BKS SMG, and NATO Interoperable Submarine Broadcast System (NISBS).

2.0 PLACE(S) OF PERFORMANCE

The contractor shall provide support at the following location:

a. SPAWARSYSCEN Atlantic

b. Contractor Facilities

2.1 GOVERNMENT FACILITIES

Government facilities (i.e., office space or lab space) are provided to those contractor personnel that would otherwise adversely affect the work performance if they were not available on Government site. Labor categories with supplied Government facilities shall be located at St Juliens Creek SPAWARSYSCEN Atlantic in Portsmouth VA.

2.2 CONTRACTOR FACILITIES

A significant portion of work issued under this contract requires close liaison with the Government. The contractor shall be prepared to establish a local facility within a thirty (30)-mile radius of SPAWARSYSCEN Atlantic Portsmouth VA. Close proximity allows for proper contract administration duties. The contractor’s facility is not necessary for the exclusive use of this contract and can be utilized on a shared basis. For contracts with Government Property, the contractor’s facility shall include physical security to protect Government assets as identified in Para10.0. The contractor shall meet all facility location and size requirements within 30 days after contract award.

3.0 PERFORMANCE REQUIREMENTS

The following paragraphs list all required non-personal services tasks that will be required throughout the contract. The contractor shall provide necessary resources with knowledge and experience as cited in the personal qualification clause to support the listed tasks. Contractors shall perform requirements in accordance with Federal Acquisition Regulation (FAR) and/or Defense Federal Acquisition Regulation Supplement (DFARS) which do not include performance of inherently governmental functions. The contractor shall complete all required tasks while controlling and tracking performance and goals in terms of costs, schedules, and resources.

3.1 Broadcast Keying System Submarine Message Gateway (BKS SMG) MTT Technical Support

3.1.1 The Contractor shall perform BKS SMG equipment/system grooms at the six (6) Broadcast Keying Sites (BKS) locations as defined in Paragraph 11. Each site shall be visited during the execution of this task. All maintenance actions will be recorded using SPAWAR REMEDY trouble reporting system and report this in the Weekly Status Report. The contractor shall submit a Technical/Analysis & Report (CDRL A007) within ten (10) days upon completion of trip.

3.1.2 (OMN) The contractor shall provide a schedule that includes each of the four groom visits in Microsoft Project format no later than 30 days after issuance of this task.

3.1.3 (OMN) Upon completion of the groom in paragraph 3.1.1. The contractor shall perform a demonstration of the BKS SMG system with site operator and maintenance personnel to ensure that the system is operating correctly. The contractor shall perform On-The-Job training to site personnel in the execution of this demonstration. The contractor shall submit a Technical/Analysis Report (CDRL A007), within ten (10) days upon completion of trip.

4.0 INFORMATION TECHNOLOGY (IT) SERVICES REQUIREMENTS

4.1 INFORMATION TECHNOLOGY (IT) GENERAL REQUIREMENTS

The contractor shall adhere to the following requirements when the IT support services and/or supplies are applicable to the requirement:

4.1.1 Ensure that no production systems are operational on any research, development, test and evaluation (RDT&E) network.

4.1.2 Follow DoDI 8510.01 when deploying, integrating, and implementing IT capabilities.

4.1.3 Migrate all Navy Ashore production systems to the Navy, Marine Corps Intranet (NMCI) environment where available.

4.1.4 Work with Government personnel to ensure compliance with all current Navy IT & cybersecurity policies, including those pertaining to Cyber Asset Reduction and Security (CARS).

4.1.5 Follow SECNAVINST 5239.3C & DoDI 8510.01 prior to integration and implementation of IT solutions or systems.

4.1.6 Register any contractor-owned or contractor-maintained IT systems utilized on contract in the Department of Defense IT Portfolio Registry (DITPR)-DON.

4.1.7 Ensure all software recommended, procured, and/or developed is compliant with Section 508 of the Rehabilitation Act of 1973, 26 CFR Part 1194 and pursuant to SPAWARINST 5721.1B.

4.1.8 Only perform IT work specified within the limitations of the contract.

5.0 CONTRACT ADMINISTRATION

Administration of the work being performed is required; it provides the Government a means for contract management and monitoring. Regardless of the level of support, the ultimate objective of the contractor is ensuring the Government’s requirements are met, delivered on schedule, and performed within budget.

5.1 CONTRACTING OFFICER REPRESENTATIVE (COR) DESIGNATION

The COR for this contract is identified in contract clause 5252.201-9201.

5.2 CONTRACTOR MONITORING AND MAINTENANCE

The contractor shall have processes established in order to provide all necessary resources and documentation during various times throughout the day including business and non-business hours in order to facilitate a timely contract response or modification in particular during urgent requirements.

5.2.1 Contract Administration & Documentation

Various types of administration documents are required throughout the life of the contract. At a minimum, the contractor shall provide the following documentation:

5.2.1.1 Contract Status Report (CSR)

The contractor shall develop a Contract Status Report (CSR) (CDRL A001) and submit it monthly at least 30 days after contract award on the 15th of each month. Only one report is submitted per contract. The prime shall be responsible for collecting, integrating, and reporting all subcontractor reports. The contractor shall report on various contract functions: performance, schedule, financial, business relations, and staffing plan/key personnel. See applicable DD Form 1423 for additional reporting details and distribution instructions. This CDRL includes a Staffing Plan (CDRL A001 Attachment 1 of Exhibit A), Personnel Listing (CDRL A001 Attachment 2 of Exhibit A)

5.2.1.2 Enterprise-wide Contractor Manpower Reporting Application Pursuant to NMCARS 5237.102-90, the contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the DoD via a secure data collection website – Enterprise-wide Contractor Manpower Reporting Application (eCMRA). The Product/Service Codes (PSC) for contracted services excluded from reporting are as follows:

The contractor shall completely fill-in all required data fields using the following web address: https://www.ecmra.mil/. Reporting inputs consists of labor hours executed during the task order period of performance within each Government fiscal year (FY) which runs from October 1 through September 30. While inputs may be reported any time during the FY, the contractor shall report all data in the applicable FY no later than October 31 of each calendar year. The contractor shall send notice to the COR and Contracting Officer after the applicable eCMRA data has been successfully entered. For reporting questions, contractors may contact the help desk email accessible through the eCMRA login webpage.

5.2.1.3 WAWF Invoicing Notification and Support Documentation Pursuant to DFARS clause 252.232-7003 and 252.232-7006, the contractor shall submit payment requests and receiving reports using DoD Invoicing, Receipt, Acceptance, and Property Transfer (iRAPT) application (part of the Wide Area Work Flow (WAWF) e-Business Suite) which is a secure Government web-based system for electronic invoicing, receipt, and acceptance. The contractor shall provide e-mail notification to the COR when payment requests are submitted to the iRAPT/WAWF and if requested, the contractor shall include cost back–up documentation (e.g., delivery receipts, time sheets, & material/travel costs, etc.) to the invoice in iRAPT/WAWF. When requested by the COR the contractor shall directly provide a soft copy of the invoice and any invoice supporting documentation (CDRL A002) directly to the COR within 24 hours of request to assist in validating the invoiced amount against the products/services provided during the billing cycle.

5.4 CONTRACTOR PERFORMANCE MANAGEMENT

Contractor performance standards and requirements are outlined in the contract/task order QASP. The ability of a contractor to perform to the outlined standards and requirement will be captured in the Contractor Performance Assessment Reporting System (CPARS). In support of tracking contractor performance, the contractor shall provide the following documents: Cost and Schedule Milestone Plan (CDRL A003) submitted 15 days after contract award and CPARS Draft Approval Document (CDAD) Report (CDRL A004) submitted monthly.

6.0 DOCUMENTATION AND DELIVERABLES

The contractor shall screen all electronic deliverables or electronically provided information for malicious code using DoD approved anti-virus software prior to delivery to the Government.

6.1 CONTRACT DATA REQUIREMENTS LIST (CDRL)

The following listing identifies the data item deliverables required under this contract and the applicable paragraph of the PWS for which they are required. Section J includes the DD Form 1423s that itemize each Contract Data Requirements List (CDRL) required under the contract. The contractor shall establish a practical and cost-effective system for developing and tracking the required CDRLs generated under each task. The contractor shall not develop any CDRL classified TOP SECRET with SCI.

3.1.1, 3.1.3

ASREQ

NLT 10 days after completion of trip

6.2 ELECTRONIC FORMAT

At a minimum, the contractor shall provide deliverables electronically by e-mail; hard copies are only required if requested by the Government. To ensure information compatibility, the contractor shall guarantee all deliverables (i.e., CDRLs), data, correspondence, and etc., are provided in a format approved by the receiving COR. The contractor shall provide all data in an editable format compatible with SPAWARSYSCEN Atlantic corporate standard software configuration as specified below. Contractor shall conform to SPAWARSYSCEN Atlantic corporate standards within 30 days of contract award. The initial or future upgrades costs of the listed computer programs are not chargeable as a direct cost to the Government.

7.0 QUALITY

7.1 QUALITY SYSTEM

Upon contract award, the prime contractor shall have and maintain a quality system that meets contract requirements and program objectives while ensuring customer satisfaction and defect-free products/process. The contractor shall have an adequately documented quality system which contains processes, procedures, planning, and all other documentation and data necessary to provide an efficient and effective quality system, which includes an internal auditing system Thirty (30) days after contract award, the contractor shall be able to provide, as requested by the Government, a copy of the contractor’s Quality Assurance Plan (QAP) and any other quality related documents (CDRL A007. The contractor shall make their quality system available to the Government for review at both a program and worksite services level during predetermined visits. Existing quality documents that meet the requirements of this contract may continue to be used. The contractor shall also require all subcontractors to possess a quality assurance and control program commensurate with the services and supplies to be provided as determined by the prime’s internal audit system. The Government reserves the right to disapprove the contractor’s and/or subcontractor’s quality system or portions thereof when the quality system(s) fails to meet contractual requirements at either the program or worksite services level. The Government reserves the right to participate in the process improvement elements of the contractor’s quality assurance plan or quality system, and development of quality related documents. At a minimum, the contractor shall ensure their quality system meets the following key criteria:

· Establish documented, capable, and repeatable processes

· Track issues and associated changes needed

· Monitor and control critical process, product, and service variations

· Establish mechanisms for feedback of field product and service performance

· Implement and effective root-cause analysis and corrective action system

· Establish methods and procedures and create data used for continuous process improvement

7.2 MANAGE QUALITY COMPLIANCE

7.2.1 General

The contractor shall have quality processes or a Quality Management System (QMS) processes in place that coincide with the Government’s Manage Quality processes which address Quality Control, Quality Assurance, Software Quality, and/or project Quality System tasks. The contractor shall use best industry practices including, when applicable, ISO/IEC 15288 for System life cycle processes and ISO/IEC 12207 for Software life cycle processes. As applicable, the contractor shall also support and/or participate in Acquisition Milestones, Phases, and Decision Points, which are standard elements of the Defense Acquisition System and support DoDD 5000.01 and DoDI 5000.02. The contractor shall provide technical program and project management support that will mitigate the risks to successful program execution including employment and objective evidence of Lean Six Sigma, Risk Management, and System Engineering methodologies; and System and Software Engineering best practices. As part of a team, the contractor shall support projects at SPAWARSYSCEN Atlantic that are currently, or in the process of, being assessed under a Capability Maturity Model Integration (CMMI) program. The contractor shall be required to utilize the processes and procedures already established for the project and deliver products that are compliant with the aforementioned processes and procedures that is commensurate with the CMMI level the government project is at or working towards. Contractor is not required to have a formal CMMI appraisal; however, possession is desired.

8.0 SECURITY

8.1 ORGANIZATION

8.1.1 Security Classification

As specified in the DoD Contract Security Classification Specification, DD Form 254, the contractor shall perform classified work under this contract. At time of contract award, the contractor shall have a SECRET facility clearance (FCL).

8.1.1.1 U.S. Government security clearance eligibility is required to access and handle classified and certain controlled unclassified information (CUI), attend program meetings, and work within restricted areas unescorted.

8.1.2 Security Officer

The contractor shall appoint a Facility Security Officer (FSO) to support those contractor personnel requiring clearance and/or access to Government facility/installation and/or access to information technology systems under this contract. Typically, the FSO is a key management personnel who is the contractor’s main POC for security issues. The FSO shall have a U.S. Government security clearance equal to or higher than the FCL required on this contract. The FSO shall be responsible for tracking the security requirements for all personnel (subcontractors included) utilized on contract. Responsibilities include tracking all personnel assigned Government badges and entering/maintaining personnel security mandatory training information within the Staffing Plan document, which is an attachment to the CSR (CDRL A001).

8.2 PERSONNEL

The contractor shall conform to the security provisions of DoDI 5220.22/DoD 5220.22-M – National Industrial Security Program Operating Manual (NISPOM), SECNAV M-5510.30, DoD 8570.01-M, and the Privacy Act of 1974. Prior to any labor hours being charged on contract, the contractor shall ensure all personnel (including administrative and subcontractor personnel) have obtained and can maintain favorable background investigations at the appropriate level(s) for access required for the contract. A favorable background determination is determined by either a Tier 1 (T1) investigation, Tier 3 (T3) investigation, or Tier 5 (T5) investigation and favorable Federal Bureau of Investigation (FBI) fingerprint checks. Investigations are not necessarily required for personnel performing unclassified work who do not require access to Government installations/facilities, Government IT systems and IT resources, or SPAWARSYSCEN Atlantic information. Cost to meet these security requirements is not directly chargeable to the contract.

NOTE: If a final determination is made that an individual does not meet or cannot maintain the minimum security fitness requirements, the contractor shall permanently remove the individual from SPAWARSYSCEN Atlantic facilities, projects, and/or programs. If an individual who has been submitted for a fitness determination or security clearance is "denied," receives an "Interim Declination," or unfavorable fingerprint, the contractor shall remove the individual from SPAWARSYSCEN Atlantic facilities, projects, and/or programs until such time as the investigation is fully adjudicated or the individual is resubmitted and is approved. All contractor and subcontractor personnel removed from facilities, projects, and/or programs shall cease charging labor hours directly or indirectly on the contract.

8.2.1 Personnel Clearance

The majority of personnel associated with this contract shall possess a TOP SECRET personnel security clearance (PCL). On case-by case basis, Top Secret (TS) clearances are eligible for access to Sensitive Compartmented Information (SCI). These programs/tasks include, as a minimum, contractor personnel having the appropriate clearances required for access to classified data as applicable. Prior to starting work on the task, contractor personnel shall have the required clearance granted by the DoD CAF and shall comply with IT access authorization requirements. In addition, contractor personnel shall possess the appropriate IT level of access for the respective task and position assignment as applicable per DoDI 8500.01, DoD Instruction for Cybersecurity. Any future revision to the respective directive and instruction will be applied as a contract modification. Contractor personnel shall handle and safeguard any Controlled Unclassified Information (CUI) and/or classified information in accordance with appropriate Department of Defense, Navy, and SPAWARSYSCEN Atlantic security regulations. The contractor shall immediately report any security violation to the SPAWARSYSCEN Atlantic Security Management Office, the Contracting Officer, and COR.

8.2.1.1 The following labor categories shall meet the required minimum personnel clearances (PCL):

8.2.2 Access Control of Contractor Personnel

8.2.2.1 Physical Access to Government Facilities and Installations Contractor personnel shall physically access Government facilities and installations for purposes of site visitation, supervisory and quality evaluation, work performed within Government spaces (either temporary or permanent), or meeting attendance. Individuals supporting these efforts shall comply with the latest security regulations applicable to the Government facility/installation.

(a) The majority of Government facilities require contractor personnel to have an approved visit request on file at the facility/installation security office prior to access. For admission to SPAWARSYSCEN Atlantic facilities/installations, the contractor shall forward a visit request to Joint Personnel Adjudication System (JPAS) /SMO 652366, or submit request on company or agency letterhead by fax to (843) 218-4045 or mail to Space and Naval Warfare Systems Center Atlantic, P.O. Box 190022, North Charleston, SC 29419-9022, Attn: Security Office. For visitation to all other Government locations, the contractor shall forward visit request documentation directly to the on-site facility/installation security office.

(b) Depending on the facility/installation regulations, contractor personnel shall present a proper form of identification(s) and vehicle proof of insurance or vehicle rental agreement. NOTE: SPAWARSYSCEN Atlantic facilities located on Joint Base Charleston require a Common Access Card (CAC) each time physical installation access is required. Contractor shall contact SPAWARSYSCEN Atlantic Security Office directly for latest policy.

(c) All contractor persons engaged in work while on Government property shall be subject to inspection of their vehicles at any time by the Government, and shall report any known or suspected security violations to the Security Department at that location.

8.2.2.2 Identification and Disclosure Requirements

Regardless if a contractor is physically located on Government installation or not, the contractor and subcontractor employees shall take all means necessary to not represent themselves as Government employees. All contractor personnel shall follow the identification and Government facility disclosure requirement as specified in contract clause 5252.237-9602, Contractor Identification.

8.2.2.3 Government Badge Requirements

Some contract personnel shall require a Government issued picture badge in accordance with contract clause 5252.204-9202, Contractor Picture Badge. While on Government installations/facilities, contractors shall abide by each site’s security badge requirements. Various Government installations are continually updating their security requirements to meet Homeland Security Presidential Directive (HSPD-12) identification standards. Contractors are responsible for obtaining and complying with the latest security identification requirements for their personnel. Contractors shall submit valid paper work (e.g., site visit request, request for picture badge, and/or SF-86 for CAC) to the applicable Government security office via the COR or Contracting Officer. The contractor (FSO is applicable) shall track all personnel holding local Government badges at the contract level.

8.2.2.4 Common Access Card (CAC) Requirements

Some Government facilities/installations (e.g., Joint Base Charleston) require contractor personnel to have a CAC for physical access to the facilities or installations. Contractors supporting work that requires access to any DoD IT/network also requires a CAC. Granting of logical and physical access privileges remains a local policy and business operation function of the local facility. The contractor is responsible for obtaining the latest facility/installation and IT CAC requirements from the applicable local Security Office. When a CAC is required to perform work, contractor personnel shall be able to meet all of the following security requirements prior to work being performed:

8.2.2.5 Contractor Check-in and Check-out Procedures

All SPAWARSYSCEN Atlantic contractor personnel requiring or possessing a Government badge and/or CAC for facility and/or IT access shall have a SPAWARSYSCEN Atlantic Government sponsor and be in compliance with the most current version of Contractor Check-in and Check-out Instruction and Forms as posted on the Command Operating Guide (COG) website. Throughout contract performance, the contractor shall provide necessary employee information and documentation for employees hired, transferred, and/or terminated in support of this contract within the required timeframe as cited in the Check-in and Check-out instructions. The contractor (FSO, if applicable) shall ensure all contractor employees whose services are no longer required on this contract return all applicable Government documents/badges to the appropriate COR. If the contractor does not have access to the SPAWARSYSCEN Atlantic COG website, the contractor shall get all necessary instruction and forms from the COR.

8.2.3 Mandatory Training

Contractor personnel (including subcontractors) shall complete all applicable required mandatory Government training in accordance with COMSPAWARSYSCOM Code 8.0.3.3.0 mandatory training webpage: https://wiki.spawar.navy.mil/confluence/display/HQ/Employee+Mandatory+Training. Contractors without access to the SPAWAR webpage shall coordinate with the COR concerning mandatory training as listed on the training webpage.

8.2.3.1 The contractor shall be responsible for verifying applicable personnel receive all required training. The contractor shall report individual contractor personnel training status by completing and updating the contract status report (CSR) (CDRL A001 Attachment 1 of Exhibit A), Training tab.

8.2.3.2 The contractor shall educate employees on the procedures for the handling and production of classified material and documents, and other security measures as described in the PWS in accordance with DoD 5220.22-M.

8.2.4 Handling of Personally Identifiable Information (PII)

In accordance with the Privacy Act, the contractor shall safeguard PII from theft, loss, and compromise. The contractor shall transmit and dispose of Personally Identifiable Information (PII) in accordance with the latest DoN policies. The contractor shall not store any Government PII on their personal computers. The contractor shall mark all developed documentation containing PII information accordingly in either the header or footer of the document: “FOUO – Privacy Sensitive. Any misuse or unauthorized disclosure may result in both criminal and civil penalties.” Any unauthorized disclosure of privacy sensitive information through negligence or misconduct can lead to contractor removal or contract termination depending on the severity of the disclosure. Upon discovery of a PII breach, the contractor shall immediately notify the Contracting Officer and COR. Contractors responsible for the unauthorized disclosure of PII shall be held accountable for any costs associated with breach mitigation, including those incurred as a result of having to notify personnel. If a contractor, including any subcontractor, is authorized access to PII, the contractor shall complete annual PII training requirements and comply with all privacy protections under the Privacy Act.

8.3 OPERATIONS SECURITY (OPSEC) REQUIREMENTS

Security programs are oriented towards protection of classified information and material. Operations Security (OPSEC) is an operations function which involves the protection of any critical information – focusing on unclassified information that may be susceptible to adversary exploitation. Pursuant to DoDD 5205.02E and SPAWARINST 3432.1, SPAWARSYSCEN Atlantic’s OPSEC program implements requirements in DoD 5205.02-M – OPSEC Program Manual and SPAWARSYSCENLANTINST 3070.1B. Note: OPSEC requirements are applicable when contract personnel have access to classified information or unclassified Critical Program Information (CPI)/sensitive information.

8.3.1 Local and Internal OPSEC Requirement

Contractor personnel, including subcontractors if applicable, shall adhere to the OPSEC program policies and practices as cited in the SPAWARINST 3432.1 and existing local site OPSEC procedures. The contractor shall develop their own internal OPSEC program specific to the contract and based on SPAWARSYSCEN Atlantic OPSEC requirements. At a minimum, the contractor’s program shall identify the current SPAWARSYSCEN Atlantic site OPSEC Officer/Coordinator.

8.3.2 OPSEC Training

Contractor shall track and ensure applicable personnel receive initial and annual OPSEC awareness training. In addition to online OPSEC training provided through the Total Workforce Management System (TWMS), training may be provided by the Government or a contractor’s OPSEC Manager. Contractor training shall, as a minimum, cover OPSEC as it relates to contract work, discuss the Critical Information applicable in the contract, and review OPSEC requirements if working at Government facilities. The contractor shall ensure any training materials developed by the contractor shall be reviewed by the SPAWARSYSCEN Atlantic OPSEC Officer, who will ensure it is consistent with SPAWARSYSCEN Atlantic OPSEC policies. OPSEC training requirements are applicable for personnel during their entire term supporting this SPAWARSYSCEN Atlantic contract.

8.3.3 SPAWARSYSCEN Atlantic OPSEC Program

Contractor shall participate in SPAWARSYSCEN Atlantic OPSEC program briefings and working meetings, and the contractor shall complete any required OPSEC survey or data call within the timeframe specified.

8.4 INFORMATION SYSTEM SECURITY

8.4.1 Electronic Communication

The contractor shall have broadband Internet connectivity and an industry standard email system for communication with the Government. The contractor shall be capable of Public Key Infrastructure (PKI) client side authentication to DoD private web servers. Unless otherwise specified, all key personnel on task shall be accessible by e-mail through individual accounts during all hours.

8.4.2 Information Security

Pursuant to DoDM 5200.01, the contractor shall provide adequate security for all unclassified DoD information passing through non-DoD information system including all subcontractor information systems utilized on task. The contractor shall disseminate unclassified DoD information within the scope of assigned duties and with a clear expectation that confidentiality is preserved. Examples of such information include the following: non-public information provided to the contractor, information developed during the course of the contract, and privileged contract information (e.g., program schedules and contract-related tracking).

8.4.2.1 Safeguards

The contractor shall protect Government information and shall provide compliance documentation validating they are meeting this requirement in accordance with DFARS clause 252.204-7012. The contractor and all subcontractors shall abide by the following safeguards:

(a) Do not process DoD information on public computers (e.g., those available for use by the general public in kiosks or hotel business centers) or computers that do not have access control.

(b) Protect information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.

(c) Sanitize media (e.g., overwrite) before external release or disposal.

(d) Encrypt all information that has been identified as controlled unclassified information (CUI) when it is stored on mobile computing devices such as laptops and personal digital assistants, or removable storage media such as portable hard drives and digital optical disks, using DoD Authorized Data-at-Rest encryption technology. NOTE: Thumb drives are not authorized for DoD work, storage, or transfer. Use GSA Awarded DAR solutions (GSA # 10359) complying with ASD-NII/DOD-CIO Memorandum, “Encryption of Sensitive Unclassified Data-at-Rest on Mobile Computing Devices and Removable Storage.” The contractor shall ensure all solutions meet FIPS 140-2 compliance requirements.

(e) Limit information transfer to subcontractors or teaming partners with a need to know and a commitment to at least the same level of protection.

(f) Transmit e-mail, text messages, and similar communications using technology and processes that provide the best level of privacy available, given facilities, conditions, and environment. Examples of recommended technologies or processes include closed networks, virtual private networks, public key-enabled encryption, and Transport Layer Security (TLS). Encrypt organizational wireless connections and use encrypted wireless connection where available when traveling. If encrypted wireless is not available, encrypt application files (e.g., spreadsheet and word processing files), using at least application-provided password protection level encryption.

(g) Transmit voice and fax transmissions only when there is a reasonable assurance that access is limited to authorized recipients.

(h) Do not post DoD information to Web site pages that are publicly available or have access limited only by domain or Internet protocol restriction. Such information may be posted to Web site pages that control access by user identification or password, user certificates, or other technical means and provide protection via use of TLS or other equivalent technologies. Access control may be provided by the intranet (vice the Web site itself or the application it hosts).

(i) Provide protection against computer network intrusions and data exfiltration, minimally including the following:

1. Current and regularly updated malware protection services, e.g., anti-virus, anti-spyware.

2. Monitoring and control of inbound and outbound network traffic as appropriate (e.g., at the external boundary, sub-networks, individual hosts) including blocking unauthorized ingress, egress, and exfiltration through technologies such as firewalls and router policies, intrusion prevention or detection services, and host-based security services.

3. Prompt application of security-relevant software patches, service packs, and hot fixes.

(j) As applicable, comply with other current Federal and DoD information protection and reporting requirements for specified categories of information (e.g., medical, critical program information (CPI), personally identifiable information, export controlled).

(k) Report loss or unauthorized disclosure of information in accordance with contract requirements and mechanisms.

(l) The contractor shall follow minimum standard in SECNAV M-5510.36 for classifying, safeguarding, transmitting, and destroying classified information.

8.4.2.2 Compliance

Pursuant to DoDM 5200.01, the contractor shall include in their quality processes procedures that are compliant with information security requirements.

9.0 GOVERNMENT FURNISHED INFORMATION (GFI)

Government Furnished Information (GFI) is Government owned intellectual property provided to contractors for performance on a contract. For the purposes of this contract, GFI includes manuals, technical specifications, maps, building designs, schedules, drawings, test data, etc. Depending on information contained in a document, the contractor shall comply with additional controls (e.g., completion of a Non-Disclosure Agreements, etc.) for access and distribution.

GFI is not anticipated on this contract.

10.0 GOVERNMENT PROPERTY

As defined in FAR Part 45, Government property is property owned or leased by the Government which includes Government-furnished (GFP) and Contractor-acquired property (CAP); however, CAP is not applicable on fixed-priced contracts. GFP includes material, equipment, special tooling, and special test equipment.

GFP will not be provided on this contract.

11.0 TRAVEL

11.1 LOCATIONS

The contractor shall be prepared to travel to the following locations. Prior to any travel taken in support of this contract, the contractor shall obtain COR or Contracting Officer concurrence. Although estimated sites are listed, the contractor shall be prepared to travel to any of the following alternative sites: NCTS Far East, NRTF Awase, NRTF Lualualei, NRTF Dixon, COMSUBGRU-9, NCTS Sigonella. Travel to foreign countries outside of the continental United States (OCONUS) is required. The applicable countries include the following: Japan, Italy. Prior to travel, the contractor shall meet all necessary travel requirements for their company and personnel to support work in the noted foreign OCONUS sites.

11.3 OCONUS TRAVEL REQUIREMENTS

Pursuant to SPAWARSYSCENLANTINST 12910.1B, DoDI 3020.41, and the latest DoD Foreign Clearance Guide requirements, the contractor shall travel outside the continental United States (OCONUS) sites to support deployed forces.

11.3.1 General OCONUS Requirements

The contractor shall ensure compliance with applicable clauses and travel guide requirements prior to traveling to each of the specified travel locations. The contractor shall be responsible for knowing and understanding all travel requirements as identified by the applicable combatant command (CCMD) and country. The contractor shall be responsible for submitting applicable deployment forms and/or OCONUS deployment packages (CDRL A005) to the COR or Contracting Officer and SPAWARSYSCEN Atlantic Deployment Manager no later than 30 days prior to travel. For all OCONUS travel, the contractor shall submit an official OCONUS Travel Form (SPAWARSYSCENLANT 12990/12) and shall ensure all OCONUS travel has an approved Aircraft and Personnel Automated Clearance System (APACS) request. The COR or Contracting Officer will provide a blank travel form after contract award.

11.3.2 OCONUS Immunization Requirements

Pursuant to DoDI 6205.4, SPAWARSYSCENLANTINST 12910.1B, and any additional DON specific requirements, contractor employees who deploy to OCONUS locations both shore and afloat shall require up to date immunizations.

11.3.3 OCONUS Training

Contractor personnel (including subcontractors) shall complete Antiterrorism Training as well as any regional specific training in accordance with Official OCONUS Travel webpage: https://wiki.spawar.navy.mil/confluence/x/DIvYAQ. Contractors without access to the SPAWAR webpage shall coordinate with the COR concerning mandatory training as listed on the training webpage.

12.0 SAFETY ISSUES

12.1 OCCUPATIONAL SAFETY AND HEALTH REQUIREMENTS

The contractor shall be responsible for ensuring the safety of all company employees, other working personnel, and Government property. The contractor is solely responsible for compliance with the Occupational Safety and Health Act (OSHA) (Public Law 91-596) and the resulting applicable standards, OSHA Standard 29 CFR 1910 (general), 1915 (shipboard/submarine) and 1926 (shore), and for the protection, safety and health of their employees and any subcontractors assigned to the contracts. Without Government assistance, the contractor shall make certain that all safety requirements are met, safety equipment is provided, and safety procedures are documented as part of their quality management system. If performing within Government facilities, contractor shall immediately report any accidents involving Government or contractor personnel injuries or property/equipment damage to the Contracting Officer and COR. Additionally, the contractor is responsible for securing the scene and impounding evidence/wreckage until released by the Contracting Officer or on-site COR.

13.0 SUBCONTRACTING REQUIREMENTS

The contractor shall identify the use of all subcontractors throughout the performance of the contract.

14.0 ACCEPTANCE PLAN

Inspection and acceptance is performed by the COR on all services, data, and non-data deliverables in accordance with the Quality Assurance Surveillance Plan (QASP), Attachment #.

15.0 OTHER CONDITIONS/REQUIREMENTS

No other conditions or requirements are applicable.

16.0 APPLICABLE DOCUMENTS

The contractor shall ensure all work accomplished utilizes the latest, relevant industry practices and standards when applicable unless otherwise indicated by text. In accordance with Defense Acquisition Policy, maximum utilization of non-Government standards will be made wherever practical.

16.1 REQUIRED DOCUMENTS

The contractor shall utilize the following mandatory documents in support of this contract. The documents referenced in this paragraph list the minimum version dates; however, the contractor shall meet requirements for any referenced document including subsequent updates applicable at time the contract request for proposal is posted.

16.2 GUIDANCE DOCUMENTS

The contractor shall have knowledge and utilize the following guidance documents in support of this contract. The documents referenced in this paragraph list the minimum version dates; however, the document’s effective date of issue is the contract’s request for proposal issue date.