N66001-18-R-0005.pdf

CODE

(Hour)

PAGE(S)

until 02:00 PM local time 05 Jun 2018

X

A X B X C X D

EX

X

G F 66 - 76

77 - 91 X H 92 - 96

RATING PAGE OF PAGES

7. ISSUED BY

(Date)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

Previous Edition is Unusable 33-134 STANDARD FORM 33 (REV. 9-97)

Prescribed by GSA FAR (48 CFR) 53.214(c)

1 96

(If other than Item 7) N66001

15A. NAME 16. NAME AND TITLE OF PERSON AUTHORIZED TO

AND

ADDRESS

SIGN OFFER (Type or print)

OF

OFFEROR

AMENDMENT NO. DATE

15B. TELEPHONE NO (Include area code) 17. SIGNATURE15C. CHECK IF REMITTANCE ADDRESS

IS DIFFERENT FROM ABOVE - ENTER

SUCH ADDRESS IN SCHEDULE.

18. OFFER DATE

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

2. CONTRACT NO.

N66001 8. ADDRESS OFFER TO

9. Sealed offers in original and 1 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in

CAUTION - LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and

L-TXT-38

conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME (NO COLLECT CALLS)

11. TABLE OF CONTENTS

SOLICITATION/ CONTRACT FORM

SUPPLIES OR SERVICES AND PRICES/ COSTS

2 - 5

X I CONTRACT CLAUSES

DESCRIPTION/ SPECS./ WORK STATEMENT X

PACKAGING AND MARKING

6 - 24

J LIST OF ATTACHMENTS

INSPECTION AND ACCEPTANCE

DELIVERIES OR PERFORMANCE

X K

REPRESENTATIONS, CERTIFICATIONS AND

OTHER STATEMENTS OF OFFERORS

CONTRACT ADMINISTRATION DATA 28 - 34 X

SPECIAL CONTRACT REQUIREMENTS

OFFER (Must be fully completed by offeror) 35 - 46 X M

L INSTRS., CONDS., AND NOTICES TO OFFERORS

EVALUATION FACTORS FOR AWARD

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52.232-8)

14. ACKNOWLEDGMENT OF AMENDMENTS

(The offeror acknowledges receipt of amendments

AMENDMENT NO. DATE

to the SOLICITATION for offerors and related documents numbered and dated):

FACILITY

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period

SOLICITATION, OFFER AND AWARD

X

(X) SEC. DESCRIPTION (X) SEC. DESCRIPTION PAGE(S)

PART I - THE SCHEDULE

26. NAME OF CONTRACTING OFFICER (Type or print) 27. UNITED STATES OF AMERICA 28. AWARD DATE

EMAIL:TEL: (Signature of Contracting Officer)

CODE CODE

B. TELEPHONE (Include area code) C. E-MAIL ADDRESS

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT 21. ACCOUNTING AND APPROPRIATION

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

10 U.S.C. 2304(c)( ) 41 U.S.C. 253(c)( ) (4 copies unless otherwise specified)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN ITEM

24. ADMINISTERED BY (If other than Item 7) CODE 25. PAYMENT WILL BE MADE BY CODE

PART IV - REPRESENTATIONS AND INSTRUCTIONS

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

47 - 64

PART II - CONTRACT CLAUSES

SPAWAR SYSTEMS CENTER PACIFIC

DAVID RODEN, CODE 22710

DAVID.RODEN@NAVY.MIL

SAN DIEGO CA 92152-5001

SEE SECTION L

ELECTRONIC SUBMISSION

HTTPS://E-COMMERCE.SSCNO.NMCI.NAVY.MIL/

CA 619-553-2087

619-553-3280FAX:

TEL:

FAX:

TEL:

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

SOLICITATION

6. REQUISITION/PURCHASE NO.5. DATE ISSUED

03 May 2018

4. TYPE OF SOLICITATION

SEALED BID (IFB)

NEGOTIATED (RFP)

[ X ]

3. SOLICITATION NO.

N6600118R0005

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Lot IT Management Services

CPFF

Base Period (2 Years). Provide services in accordance with the Statement of Work, Section C, as specified in individual task orders.

FOB: Destination

ESTIMATED COST

FIXED FEE

TOTAL EST COST + FEE

0002 1 Lot Other Direct Costs (ODC)

COST

Base Period (2 Years). ODCs including but not limited to travel, materials, and equipment in support of CLIN 0001.

0003 Lot Data (Not Separately Priced)

1001 1 Lot OPTION IT Management Services

CPFF

Option Period (3 Years). Provide services in accordance with the Statement of Work, Section C, as specified in individual task orders.

FIXED FEE

TOTAL EST COST + FEE

1002 1 Lot Other Direct Costs (ODC)

COST

Option Period (3 Years). ODCs including but not limited to travel, materials, and equipment in support of CLIN 1001.

OPTION

1003 Lot OPTION Data (Not Separately Priced)

CLAUSES INCORPORATED BY FULL TEXT

B-TXT-01 PAYMENT OF FIXED FEE (COMPLETION TYPE) (JUN 2017)

FIXED FEE: $*. The Government shall make payment to the Contractor when requested as work progresses, but no more frequently than biweekly, on account of the fixed fee, equal to ** percent of the amounts invoiced by the Contractor under the “Allowable Cost and Payment” clause hereof for the related period, subject to the withholding provisions of paragraph (b) of the “Fixed Fee” clause. In the event of discontinuance of the work in accordance with clause of this contract entitled “Limitation of *** the fixed fee shall be redetermined by mutual agreement equitably to reflect the diminution of the work performed; the amount by which such fixed fee is less than, or exceeds payments previously made on account of fee, shall be paid, or repaid by, the Contractor, as the case may be.

*To be completed upon award of the contract.

**To be determined at the Task Order level. The allowable fee percentage will be negotiated at the Task Order level, and shall not exceed the percentage proposed at the basic contract level.

*** To be determined at the Task Order level.

(End of clause)

B-TXT-04 LEVEL OF EFFORT--FEE ADJUSTMENT FORMULA (JUN 2017)

(a) Subject to the provisions of the “Limitation of Cost” or “Limitation of Funds” clause (whichever is applicable to this contract), it is hereby understood and agreed that the fixed fee is based upon the Contractor providing the below listed number of staff-hours of direct labor, hereinafter referred to as X, at the estimated cost and during the term of this contract specified elsewhere herein:

CLIN Total Staff-hours of Direct Labor (X)

0001 TBD at the Task Order Level 1001 TBD at the Task Order Level

The Contractor agrees to provide the total level of effort specified above in performance of work described in Sections “B” and “C” of this contract. The total staff-hours of direct labor shall include subcontractor direct labor hours for those subcontractors identified in the Contractor’s proposal as having hours included in the proposed level of effort.

(b) Of the total staff-hours of direct labor set forth above, it is estimated that 0 staff-hours are competitive time (uncompensated overtime). Competitive time (uncompensated overtime) is defined as hours provided by personnel in excess of 40 hours per week without additional compensation for such excess work. All other effort is defined as compensated effort. If no amount is indicated in the first sentence of this paragraph, competitive time (uncompensated overtime) effort performed by the contractor shall not be counted in fulfillment of the level of effort obligations under this contract.

(c) Effort performed in fulfilling the total level of effort obligations specified above shall only include effort performed in direct support of this contract and shall not include time and effort expended on such things as local travel from an employee’s residence to their usual work location, uncompensated effort while on travel status, truncated lunch periods, or other time and effort which does not have a specific and direct contribution to the tasks described in Section B.

(d) It is understood and agreed that various conditions may exist prior to or upon expiration of the term of the contract, with regard to the expenditure of labor staff-hours and/or costs thereunder which may require adjustment to the aggregate fixed fee. The following actions shall be dictated by the existence of said conditions:

(1) If the Contractor has provided not more than 105% of X or not less than 95% of X, within the estimated cost, and at the term of the contract, then the fee shall remain as set forth in Section B.

(2) If the Contractor has provided X-staff-hours, within the term, and has not exceeded the estimated cost then the Contracting Officer may require the Contractor to continue performance until the expiration of the term, or until the expenditure of the estimated cost of the contract except that, in the case of any items or tasks funded with O&MN funds, performance shall not extend beyond 30 September. In no event shall the Contractor be required to provide more than 105% of X within the term and estimated cost of this contract. The fee shall remain as set forth in Section B.

(3) If the Contractor expends the estimated cost of the contract, during the term of the contract and has provided less than X staff-hours, the Government may require the Contractor to continue performance, by providing cost growth funding, without adjusting the fixed fee, until such time as the Contractor has provided X staff-hours.

(4) If the Contracting Officer does not elect to exercise the Government’s rights as set forth in paragraph (d)(2) and (d)(3) above, and the Contractor has not expended more than 95 % of X staff-hours, the fixed fee shall be equitably adjusted downward to reflect the diminution of work.

(5) Nothing herein contained shall, in any way, abrogate the Contractor’s responsibilities, and/or the Government’s rights within the terms of the contract provision entitled “Limitation of Cost” or “Limitation of Funds” as they shall apply throughout the term of the contract, based upon the total amount of funding allotted to the contract during its specified term.

(e) Within 45 days after completion of the work under each separately identified period of performance hereunder, the Contractor shall submit the following information in writing to the Contracting Officer with copies to the cognizant Contract Administration Office and DCAA office to which vouchers are submitted:

(1) The total number of staff-hours of direct labor expended during the applicable period.

(2) A breakdown of this total showing the number of staff-hours expended in each direct labor classification and associated direct and indirect costs.

(3) A breakdown of other costs incurred.

(4) The Contractor’s estimate of the total allowable cost incurred under the contract for the period.

In the case of a cost under-run, the Contractor shall submit the following information in addition to that required above:

(5) The amount by which the estimated cost of this contract may be reduced to recover excess funds and the total amount of staff-hours not expended, if any.

(6) A calculation of the appropriate fee reduction in accordance with this clause.

All submissions required by this paragraph shall include subcontractor information, if any.

(f) SPECIAL INSTRUCTION TO THE PAYING OFFICE REGARDING WITHHELD FEE

Fees withheld pursuant to the provisions of this contract, such as the withholding provided by the “Allowable Cost and Payment” and “Fixed Fee” clauses, shall not be paid until the contract has been modified to reduce the fixed fee in accordance with paragraph (d) above, except that no such action is required if the total level of effort provided falls within the limits established in paragraph (d) above.

B-TXT-08 MINIMUM AND MAXIMUM QUANTITIES (JUN 2017)

As referred to in paragraph (b) of the “Indefinite Quantity” clause of this contract, the contract minimum quantity is a total of $10,000.00 worth of orders at the contract unit price(s). The maximum quantity is the total estimated amount of the contract. The maximum quantity is not to be exceeded without prior approval of the Procuring Contracting Officer.

The combined/overall ceiling for all awardees under this Multiple Award Contract is $*; however, no MAC awardee can exceed the value of its contract maximum quantity.

*To be determined at time of contract award

Section C - Descriptions and Specifications

STATEMENT OF WORK (SOW)

INFORMATION TECHNOLOGY MANAGEMENT

1. INTRODUCTION

Space and Naval Warfare Systems Center Pacific’s (SSC Pacific’s) Information Technology Management (ITM) Competency, Code 82000, has a requirement for professional and technical services to support the physical and logical infrastructure of the Research, Development, Testing, and Evaluation (RDT&E) network and associated IT services.

1.1. BACKGROUND

The RDT&E network is a complex network of computing and communications systems and software supporting a scientific user community that relies on available and stable access to timely information. The RDT&E environment allows customers to utilize Navy computers and network infrastructure to develop, test, and certify new systems that are either directly in support of Navy initiatives or support internal or external customer requirements. Included in the overall RDT&E network environment is the SECRET network (SRDT&E), which provides local secure connectivity. The RDT&E network is not affiliated with the Navy Marine Corps Intranet (NMCI) network or NMCI desktop services.

1.2. SCOPE

This is a service acquisition to provide RDT&E IT infrastructure support as an enabling service to the 130+ Research & Development labs associated with SSC Pacific. The objective is to provide Information Technology Infrastructure Library (ITIL) aligned professional and technical IT support services in the following areas:

• Video Teleconferencing (VTC)

• Telephone Infrastructure Support

• Information Resources Management (IRM)

• RDT&E Operations Center (ROC)

• IT Project, Administrative and Business Analysis Support

• Server System Administration/Engineering

• Microsoft System Center Configuration Management Administration/Engineering

• Virtualization Infrastructure Management

• Client System Administration

• IT Registrar

• Navy Marine Corps Intranet (NMCI) Support

• Network Security

• Cybersecurity

• RDT&E and SRDT&E Network Infrastructure Support

• Cloud Administration/Engineering

2. APPLICABLE DIRECTIVES AND REFERENCES

The following documents were used in the development of this SOW and may be invoked for individual task orders.

The contractor shall also adhere to the following documents, current and future updates as applicable:

Document Date Title ANSI/NECA/BICSI 568-2006 5/25/2011 Standard for Installing Commercial Building

Telecommunications Cabling

CJCSM 6510.01B 12/18/2014 Cyber Incident Handling Program

DOD Manual 5200.01 Volumes 1 through 4

2/24/2012 DOD Information Security Program

DOD Directive 5205.02E 6/20/2012 DOD Operations Security (OPSEC) Program

DOD 5220.22-M 5/18/2016 National Industrial Security Program Operating Manual (NISPOM)

DOD Manual 5200.02 4/3/2017 Procedures For The DoD Personnel Security Program (PSP)

DoD Instruction 8500.01 14-Mar-14 Cybersecurity

DoD Instruction 8510.01 12-Mar-14 Risk Management Framework (RMF) for DoD Information Technology (IT)

DOD 8570.01-M 11/10/2015 Information Assurance Workforce Improvement Program

National Security Decision Directive Number 298

1/22/1988 National Operations Security Program

OPNAVINST 3432.1A 8/4/2011 Operation Security

OPNAVINST 5239.1C 8/20/2008 NAVY INFORMATION ASSURANCE (IA)

PROGRAM

SECNAVINST 3300.2B 12/28/2005 DEPARTMENT OF THE NAVY (DON)

ANTITERRORISM (AT) PROGRAM

S.2521 - Federal Information Security Modernization Act of 2014

12/18/2014 Federal Information Security Modernization Act of

SECNAV M-5239.1 11/1/2005 Department of the Navy Information Assurance Manual

SECNAV M-5239.2 6/27/2016 DEPARTMENT OF THE NAVY CYBERSPACE

INFORMATION TECHNOLOGY AND

CYBERSECURITY WORKFORCE

MANAGEMENT AND QUALIFICATION

MANUAL

SECNAV M-5510.30 6/1/2006 Department of the Navy Personnel Security Program

SECNAV M-5510.36 6/1/2006 Department of the Navy Information Security Program

SECNAVINST 5239.3C 5/2/2016 DEPARTMENT OF THE NAVY

CYBERSECURITY POLICY

SPAWARINST 3432.1 2/2/2005 Operations Security (OPSEC) Policy

SSCPACINST 2280.2C 9/23/2014 Communications Security Material System Material and Equipment Guidance

SSCPACINST 5239.4 CH-1 1/11/2017 Cybersecurity Policy

3. TECHNICAL REQUIREMENTS

3.1. GENERAL

3.1.1. The support services annotated in this section shall follow ITIL and IT Service Management (ITSM) best practices, where applicable. The requirements in this SOW are for support services and the contractor shall not be acquiring or purchasing equipment and/or materials.

3.1.2. All contractor personnel shall be proficient in the use of Microsoft Windows and office products.

3.1.3. The contractor shall prepare and deliver the contractor’s Monthly Status Report, which indicates the cost, schedule, performance, personnel, travel and other direct cost status.

3.1.4. The contractor shall deliver all contract and technical information in digital form. All applications must be compatible with the latest NMCI approved versions or as coordinated with the Government.

All required data and documentation will be delivered in electronic media format via email, CD or DVD. All data shall be in Microsoft Word and Microsoft Excel with the exception of presentation material, which shall be delivered in Microsoft PowerPoint. Any electronic submittals, including attachments, submitted via e-mail shall be readable on a standard Personal Computer (PC) using Windows 7; OSX or later, Microsoft Office Suite 2007 or later, Microsoft Project 2007 or later.

3.2. IT PROJECT, ADMINISTRATIVE AND BUSINESS ANALYSIS SUPPORT

3.2.1. The contractor shall manage IT project schedules and plans as required by IT Management. The contractor shall also administrate project meetings, maintain lists of action items, and prepare reports and presentations as required.

3.2.2. The contractor shall analyze business processes and procedures, formulate best practices, develop standard operating procedures, process documentation and assist in defining, establishing and implementing IT business policies, standards, and service offerings. The contractor shall research and compile information on the current state of the art of Information Technology industry for business case studies, feasibility, cost and benefits analysis and recommendations of IT business investments.

The contractor shall perform technical writing.

3.2.3. The contractor shall provide IT administrative support to include spreadsheet entry, database entry, word processing and supporting customers using defined processes and procedures.

3.3. NETWORK SECURITY

3.3.1. The contractor shall provide RDT&E Security Operations Center (SOC) support to the Network Security Branch. This will include, but is not limited to IT project support; cyber security auditing and compliance; incident response and digital forensic analysis; cyber defense operations; network monitoring; vulnerability and web risk assessment; software engineering, integration and development operations; system architecture and administration support for security stack appliances, servers, hosts, and applications.

3.4. CYBERSECURITY

3.4.1. The contractor shall provide diverse Cybersecurity services that enforce, comply with, and support the DoD and cybersecurity security directives, policies and procedures. The contractor shall also work directly with customers as well as other Cybersecurity teams to ensure timely resolution of vulnerabilities.

3.4.2. The contractor shall assist with preparations for Command Cyber Readiness Inspections (CCRIs), Cyber Security Inspections (CSIs), and other network inspections.

3.4.3. The contractor shall review, assess, conduct collaborations on and submit required Certification and

Accreditation (C&A) and Assessment and Authorization (A&A) documentation to obtain and maintain system, site and network level authorizations. The contractor shall analyze system security scans, testing (i.e. STIGs, etc) and make recommendations to remedy and mitigate vulnerabilities through applying DoD and Navy level approved remediation’s, mitigations, updates, fixes or patches strategies.

3.4.4. The contractor shall conduct threat, vulnerability and risk analysis of existing, new, and developing systems. The contractor shall document analysis results and recommend corrective action, contingencies, and justifications as appropriate.

3.5. RDT&E AND SRDT&E NETWORK INFRASTRUCTURE SUPPORT

3.5.1. The contractor shall provide day-to-day operational support for the physical, data link, and network layers of the RDT&E network environment (i.e., Open Systems Interconnection (OSI) layers 1/2/3).

This support will encompass integration, analysis, testing, troubleshooting of network devices and services, RDT&E layer 1/2/3 asset management, and use of enterprise network management tools to monitor and analyze network performance at the physical infrastructure and Internet Protocol packet level.

3.5.2. The contractor shall provide day-to-day operational support for the physical, data link, and network layers of the SRDT&E network environment. The support includes, at minimum, hardware/software installation, firmware upgrades, and enhancements to switches, routers, hubs, and bridges. This support will encompass, integration, analysis, testing, troubleshooting of network devices and services, SRDT&E layer 1/2/3 asset management, and use of enterprise network management tools to monitor and analyze network performance physical layer and the IP packet level.

3.5.3. The contractor shall support the inspection of SSC Pacific’s Protected Distribution System (PDS).

Inspections shall take place on a daily basis, including weekends and holidays, to validate the integrity of welds on PDS manhole covers and vaults, as well as the integrity of all PDS cable runs and/or conduit. Any suspected compromise of the PDS shall be immediately reported to the SRDT&E Security Officer.

3.5.4. The contractor shall support Cryptographic equipment hardware/software installation, firmware upgrades, Cryptographic Keying Material loading, testing, and troubleshooting.

3.5.5. The contractor shall perform and record maintenance including tracking of network infrastructure, plant account, trend analysis, and documentation. This contractor shall develop and maintain drawings of network infrastructure.

3.6. RDT&E OPERATIONS CENTER (ROC)

3.6.1. The contractor shall provide ROC support by managing all RDT&E IT incident, service and change request tickets to resolution utilizing an ITIL aligned methodology. Requests which are in scope for ownership by the ROC will include, but are not limited to network account, operating system, application, and network configuration requests.

3.6.2. The contractor shall ensure that all requests received in-person or via telephone, facsimile, e-mail, or other electronic means are documented, assigned, communicated, and either resolved and closed or as appropriate escalated and reassigned to higher support tiers within documented Ticket Target Resolution Times (TRT).

3.6.3. The contractor shall assist the Government in defining and creating incident, service, and change request processes for delivered IT services.

3.6.4. The contractor shall open and close ROC facilities at the SECRET level and monitor Protected

Distribution Systems (PDS) during working hours.

3.7. SERVER SYSTEM ADMINISTRATION/ENGINEERING

3.7.1. The contractor shall provide system administration services for enterprise Windows, UNIX/Linux, and Macintosh operating systems.

3.7.2. The contractor shall manage enterprise servers, monitor infrastructure performance/availability, and complete root cause analysis of identified issues. This includes automating system patch availability, and performing configuration management and compliance auditing. The contractor shall also harden servers in compliance with DISA Security Technical Implementation Guidelines (STIGs) and develop process documentation.

3.8. MICROSOFT SYSTEM CENTER CONFIGURATION MANAGEMENT

ADMINISTRATION/ENGINEERING

3.8.1. The contractor shall provide Microsoft System Center client imaging and patch management. This includes installing, configuring, and maintaining the infrastructure necessary to deploy corporate operating system images, performing lifecycle management, and Microsoft or third party patching.

The contractor shall also maintain a system image inventory, run reports on compliance and patch levels and perform other administrative duties as required.

3.9. VIRTUALIZATION INFRASTRUCTURE MANAGEMENT

3.9.1. The contractor shall manage virtual infrastructure at SSC Pacific and remote sites to include allocating resources through hypervisor console, creating images, cloning, mounting images, creating snapshots and performing backup and restore functions. This also includes host maintenance and supporting servers and patching, vulnerability management and testing of upgrades.

3.10. CLIENT SYSTEM ADMINISTRATION

3.10.1. The contractor shall provide system administration support for RDT&E computer systems, to include application installation, software and operating system patching, imaging, complying with local and Navy computing directives and DISA STIGs, network connectivity configuration and troubleshooting, hardware repair/break-fix, network imaging, end-user data transfers, and other general root level administrative tasks necessary to support end-users.

3.11. VIDEO TELECONFERENCING

3.11.1. The contractor shall support the installation, configuration, operation and troubleshooting of hardware systems for the purpose of maintaining the Defense Information Systems Network Video Services Global facility as well as other VTC (both classified and unclassified) facilities throughout SSC Pacific.

3.11.2. The contractor shall support cryptographic equipment hardware/software installation, firmware upgrades, cryptographic keying material loading, testing, and troubleshooting.

3.11.3. The contractor shall perform communications support for Integrated Services Digital Network, Defense Information Systems Agency (DISA) networks, Defense Collaboration Services (DCS), and commercial interconnects.

3.12. TELEPHONE INFRASTRUCTURE

3.12.1. The contractor shall perform administrative support for telephone and usage infrastructure, as well as system administration support for the telephone voice mail system.

3.12.2. The contractor shall provide software engineering, integration, and development operations support for network registration and telephone infrastructure tools.

3.13. NMCI SUPPORT

3.13.1. The contractor shall support the SSC Pacific NMCI Service Center team in the overall management of NMCI for SSC Pacific. The contractor shall interface with personnel as required to complete NMCI related transactions and requests for end-users at SSC Pacific.

3.14. INFORMATION RESOURCES MANAGEMENT

3.14.1. The contractor shall perform administrative support for the Information Resource Management team using enterprise-level databases i.e. Defense Application & Database Management System (DADMS)/ DoD IT Portfolio Repository- DON (DITPR-DON) and Navy Enterprise Resource Planning (N-ERP).

3.14.2. The contractor shall ensure Cybersecurity compliance in procurement requests.

3.15. IT REGISTRAR

3.15.1. The contractor shall administrate and manage changes to SSC Pacific’s Lightweight Directory

Access Protocol (LDAP) database, and request and manage soft Public Key Infrastructure (PKI) certificates for unclassified and SECRET servers, systems and designated personnel.

3.15.2. The contractor shall serve as the Trusted Agent (TA) for alternate tokens (hard PKI certificates on

Smart Card) for end-users at SSC Pacific.

3.16. CLOUD ADMINISTRATION/ENGINEERING

3.16.1. The contractor shall install, configure and administer cloud-based applications, infrastructure, integration, services and resources, integrated DevOps environments, virtualized containers, systems, storage and networks.

3.16.2. The contractor shall configure and maintain user accounts and associated privileges and memberships required to facilitate access to cloud services.

3.16.3. The contractor shall engineer, implement, support and maintain cybersecurity activities and

Authorization & Accreditation (A&A) for cloud infrastructure and services.

3.16.4. The contractor shall implement and maintain cloud based scripting and automation.

4. CYBER SECURITY

CYBERSECURITY COMPLIANCE

Cybersecurity (which replaced the term Information Assurance (IA)) is defined as prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation. Contractor personnel shall perform tasks to ensure Navy applications, systems, and networks satisfy Federal/DoD/DON/Navy cybersecurity requirements.

CYBER IT AND CYBERSECURITY PERSONNEL

(a) The Cyberspace workforce elements addressed include contractors performing functions in designated Cyber IT positions and Cybersecurity positions. In accordance with DFARS Subpart 239.71, DoDD 8140.01, SECNAVINST 5239.20A, and SECNAV M-5239.2, contractor personnel performing cybersecurity functions shall meet all cybersecurity training, certification, and tracking requirements as cited in DoD 8570.01-M prior to accessing DoD information systems. Proposed contractor Cyber IT and cybersecurity personnel shall be appropriately qualified prior to the start of the contract performance period or before assignment to the contract during the course of the performance period.

(b) The contractor shall be responsible for identifying, tracking and reporting cybersecurity personnel, also known as Cybersecurity Workforce (CSWF) and Cyber IT workforce personnel. Although the minimum frequency of reporting is monthly, the task order can require additional updates at any time.

(c) Contractors that access Navy IT shall also follow guidelines and provisions documented in Navy Telecommunications Directive (NTD 10-11) and are required to complete a System Authorization Access Request (SAAR) – Navy form as documented in para 8.2.2.4(b).

When a contractor requires logical access to a government IT system or resource (directly or indirectly), the required CAC will have a Public Key Infrastructure (PKI). A hardware solution and software (e.g., ActiveGold) is required to securely read the card via a personal computer. Pursuant to DoDM 1000.13-M-V1, CAC PKI certificates will be associated with an official government issued e-mail address (e.g. .mil, .gov, .edu). Prior to receipt of a CAC with PKI, contractor personnel shall complete the mandatory Cybersecurity Awareness training and submit a signed System Authorization Access Request Navy (SAAR-N) form to the contract’s specified COR. Note: In order for personnel to maintain a CAC with PKI, each contractor employee shall complete annual cybersecurity training. The following guidance for training and form submittal is provided;

however, contractors shall seek latest guidance from their appointed company Security Officer and the SSC Pacific Information Assurance Management (IAM) office:

1. For annual DoD Cybersecurity/IA Awareness training, contractors shall use this site:

https://twms.nmci.navy.mil/. For those contractors requiring initial training and do not have a CAC, contact the SSC Pacific IAM office at phone number [insert applicable contract information] (843)218-6152 or e-mail questions to ssc_lant_iam_office.fcm@navy.mil for additional instructions. Training can be taken at the IAM office or online at http://iase.disa.mil/index2.html.

2. For SAAR-N form, the contractor shall use OPNAV 5239/14 (Rev 9/2011). Contractors can obtain a form from the SSC Pacific IAM office at or from the website: https://navalforms.documentservices.dla.mil/. [insert applicable contract information] Digitally signed forms will be routed to the IAM office via encrypted e-mail to ssclant_it_secmtg@navy.mil.

(d) Contractor personnel with privileged access will be required to acknowledge special responsibilities with a Privileged Access Agreement (PAA) IAW SECNAVINST 5239.20A.

DESIGN, INTEGRATION, CONFIGURATION OR INSTALLATION OF HARDWARE AND

SOFTWARE

The contractor shall ensure any equipment/system installed or integrated into Navy platform will meet the cybersecurity requirements as specified under DoDI 8500.01. The contractor shall ensure that any design change, integration change, configuration change, or installation of hardware and software is in accordance with established DoD/DON/Navy cyber directives and does not violate the terms and conditions of the accreditation/authorization issued by the appropriate Accreditation/Authorization official. Contractors that access Navy IT are also required to follow the provisions contained in DON CIO Memorandum: Acceptable Use of Department of the Navy Information Technology (IT) dtd 12 Feb 16. Use of blacklisted software is specifically prohibited and only software that is registered in DON Application and Database Management System (DADMS) and is Functional Area Manager (FAM) approved can be used as documented in para 5.2.2.

Procurement and installation of software governed by DON Enterprise License Agreements (ELAs) – Microsoft, Oracle, Cisco, Axway, Symantec, ActivIdentity, VMware, Red Hat, NetApp, and EMC shall be in accordance with DON CIO Policy and DON ELAs awarded.

CYBERSECURITY WORKFORCE (CSWF) REPORT

DoD 8570.01-M and DFARS PGI 239.7102-3 have promulgated that contractor personnel shall have documented current cybersecurity certification status within their contract. The contractor shall develop, maintain, and submit a CSWF Report as applicable at the task order level. IAW clause DFARS 252.239-7001, if cybersecurity support is provided, the contractor shall provide a Cybersecurity Workforce (CSWF) list that identifies those individuals who are IA trained and certified. Utilizing the format provided at the task order level, the prime contractor shall be responsible for collecting, integrating, and reporting all subcontractor personnel. See applicable DD Form 1423 for additional reporting details and distribution instructions.

Contractor shall verify with the COR or other government representative the proper labor category cybersecurity designation and certification requirements.

INFORMATION TECHNOLOGY (IT) SERVICES REQUIREMENTS

This paragraph only applies to IT contracts. Information Technology (IT) is defined as any equipment or interconnected system(s) or subsystem(s) of equipment that is used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data of information by the agency. IT includes computers, ancillary equipment, peripherals, input, output, and storage devices necessary for security and surveillance. Electronic and Information technology (EIT) is IT that is used in the creation, conversion, or duplication of data or information.

EIT includes: telecommunication products, such as telephones; information kiosks; transaction machines; World Wide Web sites; multimedia (including videotapes); and office equipment, such as copiers and fax machines.

INFORMATION TECHNOLOGY (IT) GENERAL REQUIREMENTS

When applicable, the contractor shall be responsible for the following:

• Ensure that no production systems are operational on any RDT&E network.

• Follow DoDI 8510.01 of 12 Mar 2014 when deploying, integrating, and implementing IT capabilities.

• Migrate all Navy Ashore production systems to the NMCI environment where available.

• Work with government personnel to ensure compliance with all current Navy IT & cybersecurity policies, including those pertaining to Cyber Asset Reduction and Security (CARS).

• Follow SECNAVINST 5239.3B of 17 June 2009 & DoDI 8510.01 of 12 Mar 2014 prior to integration and implementation of IT solutions or systems.

• Register any contractor-owned or contractor-maintained IT systems utilized on contract in the Department of Defense IT Portfolio Registry (DITPR)-DON.

• Only perform work specified within the limitations of the task order.

ACQUISITION OF COMMERCIAL SOFTWARE PRODUCTS, HARDWARE, AND RELATED

SERVICES

This paragraph only applies to the purchasing/hosting of commercial software. Contractors recommending or purchasing commercial software products, hardware, and related services supporting Navy programs and projects shall ensure they recommend or procure items from approved sources in accordance with the latest DoN and DoD policies.

DON ENTERPRISE LICENSING AGREEMENT/DOD ENTERPRISE SOFTWARE INITIATIVE

PROGRAM

Pursuant to DoN Memorandum – Mandatory use of DoN Enterprise Licensing Agreement (ELA) dtd 22 Feb 12, contractors that are authorized to use Government supply sources per FAR 51.101 shall verify if the product is attainable through DoN ELAs and if so, procure that item in accordance with appropriate ELA procedures. If an item is not attainable through the DoN ELA program, contractors shall then utilize DoD Enterprise Software Initiative (ESI) program (see DFARS 208.74) and government-wide SmartBuy program (see DoD memo dtd 22 Dec 05). The contractor shall ensure any items purchased outside these programs have the required approved waivers as applicable to the program. Software requirements will be specified at the task order level.

DON APPLICATION AND DATABASE MANAGEMENT SYSTEM (DADMS)

The contractor shall ensure that no Functional Area Manager (FAM) disapproved applications are integrated, installed or operational on Navy networks. The contractor shall ensure that all databases that use database management systems (DBMS) designed, implemented, and/or hosted on servers and/or mainframes supporting

Navy applications and systems be registered in DoN Application and Database Management System (DADMS) and are FAM approved. All integrated, installed, or operational applications hosted on Navy networks must also be registered in DADMS and approved by the FAM. No operational systems or applications will be integrated, installed, or operational on the RDT&E network.

SECTION 508 COMPLIANCE

This paragraph only applies to IT contracts. The contractor shall ensure that all software recommended, procured, and/or developed is compliant with Section 508 of the Rehabilitation Act of 1973, 26 CFR Part 1194 and pursuant to SPAWARINST 5721.1B of 17 Nov 2009. In accordance with FAR 39.204, this requirement does not apply to contractor acquired software that is incidental to the task, software procured/developed to support a program or system designated as a National Security System (NSS) or if the product is located in spaces frequented only by service personnel for maintenance, repair or occasional monitoring of equipment.

SOFTWARE DEVELOPMENT/MODERNIZATION AND HOSTING

This paragraph only applies to software development and modernization. The contractor shall ensure all programs utilizing this contract for software development/ modernization (DEV/MOD), including the development of IT tools to automate SSC Pacific business processes are compliant with DON Information Management/Information Technology (DON IM/IT) Investment Review Process Guidance requirements.

Contractors shall neither host nor develop IT tools to automate SSC Pacific business processes unless specifically tasked within the task order or contract. The contractor shall ensure IT tools developed to automate SSC Pacific business processes will be delivered with full documentation and source code, as specified at the task order level, to allow non-proprietary operation and maintenance by any source. The contractor shall ensure all programs are submitted with proof of completed DEV/MOD certification approval from the appropriate authority in accordance with DON policy prior to task order award. *Note must be listed on Investment Review Board (IRB) approved list.

INFORMATION SECURITY

Pursuant to DoDM 5200.01, the contractor shall provide adequate security for all unclassified DoD information passing through non-DoD information system including all subcontractor information systems utilized on contract. The contractor shall disseminate unclassified DoD information within the scope of assigned duties and with a clear expectation that confidentiality is preserved. Examples of such information include the following:

non-public information provided to the contractor, information developed during the course of the contract, and privileged contract information (e.g., program schedules, contract-related tracking).

IT POSITION CATEGORIES

Pursuant to DoDI 8500.01, DoD 8570.01-M, SECNAVINST 5510.30, SECNAV M-5239.2, and applicable to unclassified DoD information systems, a designator is assigned to certain individuals that indicates the level of IT access required to execute the responsibilities of the position based on the potential for an individual assigned to the position to adversely impact DoD missions or functions. As defined in DoD 5200.2-R, SECNAVINST

5510.30 and SECNAV M-5510.30, three basic DoN IT levels/Position categories exist:

• IT-I (Privileged access)

• IT-II (Limited Privileged, sensitive information)

• IT-III (Non-privileged)

Note: The term IT Position is synonymous with the older term Automated Data Processing (ADP) Position (as used in DoD 5200.2-R, Appendix 10). Investigative requirements for each category vary, depending on the role and whether the individual is a U.S. civilian contractor or a foreign national. The Contractor PM shall assist the Government Project Manager or COR in determining the appropriate IT Position Category assignment for all contractor personnel. All required Single-Scope Background Investigation (SSBI)/Tier 5, SSBI Periodic Reinvestigation (SSBI-PR)/Tier 5R, and National Agency Check (NAC)/Tier 3R adjudication will be performed Pursuant to DoDI 8500.01 and SECNAVINST 5510.30. Requests for investigation of contractor personnel for fitness determinations or IT eligibility without classified access are submitted by SPAWAR/SSC Atlantic/SSC Pacific Security Office, processed by the OPM, and adjudicated by DOD CAF. IT Position Categories are determined based on the following criteria:

IT-I Level (Privileged) - Positions in which the incumbent is responsible for the planning, direction, and implementation of a computer security program; major responsibility for the direction, planning and design of a computer system, including the hardware and software; or, can access a system during the operation or maintenance in such a way, and with a relatively high risk for causing grave damage, or realize a significant personal gain. Personnel whose duties meet the criteria for IT-I Position designation require a favorably adjudication of Single Scope Background Investigation (SSBI)/Tier 5 or SSBI-PR/Tier 5R. The SSBI/Tier 5 or SSBI-PR/Tier 5R is updated a minimum of every 5 years. Assignment to designated IT-I positions requires U.S.

citizenship unless a waiver request is approved by CNO.

IT-II Level (Limited Privileged) - Positions in which the incumbent is responsible for the-direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority at the IT-II Position level to insure the integrity of the system. Personnel whose duties meet the criteria for an IT-II Position require a favorably adjudication of a Position of Trust National Agency Check with Law and Credit (PT/NACLC)/Tier 3R. Assignment to designated IT-II positions requires U.S. citizenship unless a waiver request is approved by CNO.

IT-III Level (Non-privileged) - All other positions involved in computer activities. Incumbent in this position has non-privileged access to one or more DoD information systems/applications or database to which they are authorized access. Personnel whose duties meet the criteria for an IT-III Position designation require a favorably adjudication of a Position of Trust National Agency Check with Written Inquiries (PT/NACI).

5. TRAVEL

If required, travel requirements will be identified at the task order level.

6. GOVERNMENT FURNISHED PROPERTY/INFORMATION (GFP/GFI)

If required, GFP/GFI will be identified at the task order level.

7. SECURITY

7.1. Security. The security requirement for this tasking will be up to and including Secret. The work performed by the Contractor will include access to unclassified and up to Secret data, information, and spaces. The Contractor will be required to attend meetings classified up to Secret level. The contractor will require access to Communications Security (COMSEC) and the Secure Internet Protocol Router Network (SIPRNet). The contractor shall receive North Atlantic Treaty Organization (NATO) awareness brief and complete the derivative classification training prior to being granted access to SIPRnet; training is provided by the facility security officer.

Those contractors that are designate system administrators will need to be NATO read-on because while performing system administrative duties the contractor may potentially come into contact with NATO classified data. The contractor’s facility security office will read-on its company’s employees and make and entry in JPAS. These personnel will also be required to complete the derivative classification training.

If foreign travel is required, all outgoing Country/Theater clearance message requests shall be submitted to Commanding Officer, Attn: Foreign Travel Team, Space and Naval Warfare Systems Center Pacific, 53560 Hull Street, Building 27, 2nd Floor -Room 206, San Diego, CA 92152 for action. A Request for Foreign Travel form shall be submitted for each traveler, in advance of the travel, to initiate the release of a clearance message at least 30 days in advance of departure. Each Traveler must also submit a Personal Protection Plan and have a Level 1 Antiterrorism/Force Protection briefing within one year of departure and a country specific briefing within 90 days of departure. Anti-Terrorism/Force Protection (AT/FP) briefings are required for all personnel (Military, DOD Civilian, and contractor) per OPNAVINST F3300.53C. Contractor employees must receive the AT/FP briefing annually. The briefing is available at Joint Knowledge Online (JKO): https://jkodirect.jten.mil (prefix): course number: US007; title: Level 1 Anti-terrorism Awareness Training, if experiencing problems accessing this website contact ssc_fortrav@navy.mil. Forward a copy of the training certificate to the previous email address or fax to

(619) 553-6863. Sere 100.2 Level A code of conduct training is also required prior to Oconus travel for all personnel. Sere 100.2 Level A training can be accessed at http://jko.jfcom.mil (recommended), https://jkodirect.jten.mil/atlas2/faces/page/login/login.seam, recommended course: prefix: J3T: course #:

A-US1329, for civilian, military, and contractors. Personnel utilizing this site must have a CAC. A Sere

100.2 Level A training disk can be borrowed at the SSC Pacific Point Loma Office or Old Town Campus Office. Specialized training for specific locations, such as SOUTHCOM human rights, or U.S. forces Korea entry training, may also be required; SSC Pacific security personnel will inform you if there are additional training requirements. Finally, EUCOM has mandated that all personnel going on official travel to the EUCOM AOR must now register with the Smart Traveler Enrollment Program (STEP).

When you sign up, you will automatically receive the most current information the State Department compiles about your destination country. You will also receive updates, including Travel Warnings and Travel Alerts. Sign up is one-time only, after you have established your STEP account, you can easily add official or personal travel to anywhere in the world, not just EUCOM.

http://travel.state.gov/content/passports/en/go/step.html

As required by National Industrial Security Program Operating Manual (NISPOM) Chapter 1, Section 3, contractors are required to report certain events that have an impact on: 1) the status of the facility clearance (FCL); 2) the status of an employee's personnel clearance (PCL); 3) the proper safeguarding of classified information; 4) or an indication that classified information has been lost or compromised.

Contractors working under SSC Pacific contracts will ensure information pertaining to assigned contractor personnel are reported to the Contracting Officer Representative (COR)/Technical Point of Contact (TPOC), the Contracting Specialist, and the Security's COR in addition to notifying appropriate agencies such as Cognizant Security Agency (CSA), Cognizant Security Office (CSO), or Department Of Defense Central Adjudication Facility (DODCAF) when that information relates to the denial, suspension, or revocation of a security clearance of any assigned personnel; any adverse information on an assigned employee's continued suitability for continued access to classified access; any instance of loss or compromise, or suspected loss or compromise, of classified information; actual, probable or possible espionage, sabotage, or subversive information; or any other circumstances of a security nature that would affect the contractor's operation while working under SSC Pacific contracts.

Applicable documents are as follows: SECNAV Manual 5510.30 (Series), Department of Navy Personnel Security Program, SECNAV Manual 5510.36 (Series), Department of Navy Information Security Program, DOD 5200.01 Volumes 1 through 4 (Series), DOD Security Program, and DOD 5220.22-M (Series), National Industrial Security Program Operating Manual (NISPOM).

7.2. Operations Security (OPSEC). OPSEC is a five step analytical process (identify critical information;

analyze the threat; analyze vulnerabilities; assess risk; develop countermeasures) that is used as a means to identify, control, and protect unclassified and unclassified sensitive information associated with U.S.