A1.5 SOW REVISED.docx

PERFORMANCE WORK STATEMENT (PWS))

PROJECT TITLE: Defense Fuel Support Point (DFSP) San Pedro ACS Upgrades and Support

1.0 TASK ORDER PURPOSE

1.1 SCOPE

This project addresses the need for Access Control System (ACS) upgrades for Defense Fuel Support Point (DFSP) San Pedro. Efforts include installation of five (5) HID Card Readers, one (1) Enrollment Workstation, and other necessary infrastructure components to connect all devices. This is a non-severable, completion type, requirement with a term of 12 months.

1.2 BACKGROUND

Access Control System upgrades are required to meet facility’s new physical security policies.

2.0 APPLICABLE DOCUMENTS

a. SPAWAR Shore Installation Process Handbook (SIPH) – Available upon request from SPAWAR

b. DoDI 8510.1 – Risk Management Framework (RMF) for DoD Information Technology

c. DoD Directive 8570.1 – Information Assurance Training, Certification and Workforce Management

d. SECNAVINST 5239.3A – Department of the Navy Information Assurance (IA) Policy

e. SSCPACINST 5239.4 – Cybersecurity Policy

f. SECNAVINST 5510.30B – Department of Navy Personnel Security Program Instruction

g. SECNAV M-5510.36 – DON Personnel Security Program Instruction

h. SECNAVINST 5510.36A – DON Information Security Program (ISP)

3.0 TECHNICAL REQUIREMENTS

The contractor shall:

a. Complete all installation and integration upgrade activities within 120 days from date of contract award.

b. Integrate all upgrades according to the approximated floor plans to be provided by NIWC Pacific.

c. Repair or replace any failed hardware and wiring infrastructure during and after all upgrades are completed and complete any Return Merchandise Authorization (RMA) returns or exchanges as required for material failures under warranty including labor and shipping fees.

d. Keep existing system operational until the new upgrades are integrated and ready for cutover.

e. Remove and dispose of all legacy materials.

3.1 DFSP SAN PEDRO ACS UPGRADE

The contractor shall implement ACS upgrades by completing the following tasks:

3.1.1 Procure, configure, and integrate the following ACS materials:

a. 1 new Dell Optiplex 7060 Workstation

b. 1 new Dell P2717H monitor, 27”, or equivalent

c. 1 new IOGear GSR202 Card Reader or equivalent

d. 1 new Dell PowerEdge R440 Server

e. 5 new HID 923NPRTEK000HD with Smart Chip Technology Card Readers

f. 3 new HID VertX EVO V2000 Dual Door Controllers

g. 5 new HID 6132AKK Spacers (for readers)

h. 1 new HES 9000 Series Electric Strikes or equivalent

i. 5 new HID 5006PGGMN Card Stock, Format# H2005613, 100 Count Packs

j. 1 new Red Hat Enterprise Linux Licenses

k. 1 new Cisco WS-C3560CX-12PC-S Network Switches, 12 Port POE

l. 1 new Tripp-Lite B030-008-17-IP console or equivalent

m. 1 new Great Lakes GL720E-2436P Full (37U) Rack or equivalent

n. 1 new APC SMT3000RM2U power supply or equivalent

o. 2 new Altronix AL600ULACM Power Supplies, 8 Outputs

p. 4 new Adams Rite 8611-LRM2-36 Exit Device Exit or equivalent

q. 5 new STI BIO-7504 Protective Card Reader Covers or equivalent

r. 6 new Securitron DPS-W door sensors or equivalent

s. Ethernet, CAT6, Plenum, 1000 ft.

t. Data, 22/6 Plenum, 3000 ft.

u. Power, 18/2 Plenum, 1000 ft.

v. Conduit, 1 in EMT, 1000 ft.

w. Miscellaneous materials as required

3.1.2 Remove all existing, dated, ACS hardware extracted during integration of new ACS upgrades.

3.1.3 Integrate five (5) card readers (HID 923NPRTEK000HD), protective covers (STI BIO-7504), and spacers (HID 6132AKK) on the exterior of the designated Building 100 entrances depicted in the Notional Design Plan.

3.1.4 Integrate one (1) enrollment workstation (OptiPlex 7060), one (1) Monitor (Dell P2717H or equivalent), and one (1) IOGear GSR202 Card Reader in Building 100 space depicted in the Notional Design Plan.

3.1.5 Integrate:

a. Four (4) exit devices with Electric Latch Retraction (Adams Rite 8611-LRM2-36 or equivalent) and Five (5) door position switches (Securitron DPS-W or equivalent) at designated Building 100 - ACS entrances.

The contractor shall execute upgrades in accordance with SACNAV 5510.36A and ACE ATO directives.

3.1.6 Integrate one (1) HES 9000 Series Electric Strikes and one (1) door position switch (Securitron DPS-W or equivalent) on the exterior entrance of Kitchen/mess area, in accordance with SACNAV 5510.36A and ACE ATO directives.

3.1.7 Remove all CCTV equipment in existing ½ racks located in the Guard Shack. The Contractor shall:

a. Relocate CCTV hardware in accordance with Section 3.1.8.

b. Dismantle and dispose of the existing racks.

3.1.8 Integrate one (1) new Great Lakes GL720E-2436P Full (37U) Rack in the Guard Shack, to replace dated ½ racks. The contractor shall:

a. Rack mount and integrate the CCTV equipment, removed from the old racks.

b. Troubleshoot and repair any failed CCTV infrastructure, damaged during execution of the equipment transfer, to restore performance, as required.

3.1.9 Integrate Server (Dell R440) and UPS (SMT3000RM2U or equivalent) in new rack located new Guard Shack, as depicted in the Notional Design Plan.

3.1.10 Integrate Network Switch (Cisco WS-C3560CX-12PC-S), Door Controllers (HID VertX EVO V2000), and power supplies (AL600ULACM) in existing 12U wall mounted rack in Building 100. The contractor shall leverage CCTV infrastructure to network system.

3.1.11 Integrate Tripp-Lite B030-008-17-IP console (or equivalent) in CCTV equipment rack at Fuel Pier. The contractor shall:

a. Mount console in equipment rack

b. Connect console to existing CCTV system in accordance with government instruction.

c. Conduct system checks to verify proper integration

3.1.12 Integrate conduit as required for exposed wiring not protected by dry wall, ceilings, etc.

3.1.13 Support System Operational Verification Test (SOVT) testing with SPAWAR and the customer to confirm the completion of upgrades including troubleshooting issues, documenting discrepancies found, and resolving findings.

3.1.14 Document all upgrades in a complete As-Built drawing package according to SIPH requirements.

3.1.15 Execute and provide one set of ACAS scans in accordance with the existing ATO for Access Control Enforcer (ACE), Enterprise Mission Assurance Support Service (eMASS)# 9018. If Category 1 and/or Category 2 findings are present, the contractor shall execute remediation, including however not limited to implementation of:

a. Software patches

b. LINUX environment and Window 10 environment updates

c. Firmware updates

4.0 CYBER SECURITY WORKFORCE

‘Cyber Security Workforce’ Section Tips.

· In an effort to avoid introducing cyber-related risks into SPAWAR systems a PWS template (including both mandatory and recommended language) pertaining to cyber security has been provided in Policy Alert 17-007 and SCPPM→ Planning→ Cybersecurity Contract Language.

· If the TO requires contractor personnel performing Cybersecurity functions, a Cybersecurity Workforce (CSWF) Report should be a required CDRL. Labor categories/hours should coincide with the proposed categories/hours in the IGCE/IGE.

· If taskings include Cyber Security services, include Cyber Security Assurance (CSA) language in the PWS/SOW. Consider the following sample language for PWS/SOW task order as follows:

CYBERSECURITY COMPLIANCE

Cybersecurity (which replaced the term Information Assurance (IA)) is defined as prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation. Contractor personnel shall perform tasks to ensure Navy applications, systems, and networks satisfy Federal/DoD/DON/Navy cybersecurity requirements.

CYBER IT AND CYBERSECURITY PERSONNEL

(a) The Cyberspace workforce elements addressed include contractors performing functions in designated Cyber IT positions and Cybersecurity positions. In accordance with DFARS Subpart 239.71, DoDD 8140.01, SECNAVINST 5239.20A, and SECNAV M-5239.2, contractor personnel performing cybersecurity functions shall meet all cybersecurity training, certification, and tracking requirements as cited in DoD 8570.01-M prior to accessing DoD information systems. Proposed contractor Cyber IT and cybersecurity personnel shall be appropriately qualified prior to the start of the contract performance period or before assignment to the contract during the course of the performance period.

(b) The contractor shall be responsible for identifying, tracking and reporting cybersecurity personnel, also known as Cybersecurity Workforce (CSWF) and Cyber IT workforce personnel. Although the minimum frequency of reporting is monthly, the task order can require additional updates at any time.

(c ) Contractors that access Navy IT shall also follow guidelines and provisions documented in Navy Telecommunications Directive (NTD 10-11) and are required to complete a System Authorization Access Request (SAAR) – Navy form as documented in para 8.2.2.4(b).

When a contractor requires logical access to a government IT system or resource (directly or indirectly), the required CAC will have a Public Key Infrastructure (PKI). A hardware solution and software (e.g., ActiveGold) is required to securely read the card via a personal computer. Pursuant to DoDM 1000.13-M-V1, CAC PKI certificates will be associated with an official government issued e-mail address (e.g. .mil, .gov, .edu). Prior to receipt of a CAC with PKI, contractor personnel shall complete the mandatory Cybersecurity Awareness training and submit a signed System Authorization Access Request Navy (SAAR-N) form to the contract’s specified COR. Note: In order for personnel to maintain a CAC with PKI, each contractor employee shall complete annual cybersecurity training. The following guidance for training and form submittal is provided; however, contractors shall seek latest guidance from their appointed company Security Officer and the NIWC Pacific Information Assurance Management (IAM) office:

1. For annual DoD Cybersecurity/IA Awareness training, contractors shall use this site: https://twms.nmci.navy.mil/. For those contractors requiring initial training and do not have a CAC, contact the NIWC Pacific office at phone number [insert applicable contract information] (843)218-6152 or e-mail questions to ssc_lant_iam_office.fcm@navy.mil for additional instructions. Training can be taken at the IAM office or online at http://iase.disa.mil/index2.html.

1. For SAAR-N form, the contractor shall use OPNAV 5239/14 (Rev 9/2011). Contractors can obtain a form from the NIWC Pacific office at or from the website: https://navalforms.documentservices.dla.mil/. [insert applicable contract information] Digitally signed forms will be routed to the IAM office via encrypted e-mail to ssclant_it_secmtg@navy.mil.

(d) Contractor personnel with privileged access will be required to acknowledge special responsibilities with a Privileged Access Agreement (PAA) IAW SECNAVINST 5239.20A.

DESIGN, INTEGRATION, CONFIGURATION OR INSTALLATION OF HARDWARE AND SOFTWARE

The contractor shall ensure any equipment/system installed or integrated into Navy platform will meet the cybersecurity requirements as specified under DoDI 8500.01. The contractor shall ensure that any design change, integration change, configuration change, or installation of hardware and software is in accordance with established DoD/DON/Navy cyber directives and does not violate the terms and conditions of the accreditation/authorization issued by the appropriate Accreditation/Authorization official. Contractors that access Navy IT are also required to follow the provisions contained in DON CIO Memorandum: Acceptable Use of Department of the Navy Information Technology (IT) dtd 12 Feb 16. Use of blacklisted software is specifically prohibited and only software that is registered in DON Application and Database Management System (DADMS) and is Functional Area Manager (FAM) approved can be used as documented in para 5.2.2. Procurement and installation of software governed by DON Enterprise License Agreements (ELAs) – Microsoft, Oracle, Cisco, Axway, Symantec, ActivIdentity, VMware, Red Hat, NetApp, and EMC shall be in accordance with DON CIO Policy and DON ELAs awarded.

CYBERSECURITY WORKFORCE (CSWF) REPORT

DoD 8570.01-M and DFARS PGI 239.7102-3 have promulgated that contractor personnel shall have documented current cybersecurity certification status within their contract. The contractor shall develop, maintain, and submit a CSWF Report as applicable at the task order level. IAW clause DFARS 252.239-7001, if cybersecurity support is provided, the contractor shall provide a Cybersecurity Workforce (CSWF) list that identifies those individuals who are IA trained and certified. Utilizing the format provided at the task order level, the prime contractor shall be responsible for collecting, integrating, and reporting all subcontractor personnel. See applicable DD Form 1423 for additional reporting details and distribution instructions. Contractor shall verify with the COR or other government representative the proper labor category cybersecurity designation and certification requirements.

INFORMATION TECHNOLOGY (IT) SERVICES REQUIREMENTS

This paragraph only applies to IT contracts. Information Technology (IT) is defined as any equipment or interconnected system(s) or subsystem(s) of equipment that is used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data of information by the agency. IT includes computers, ancillary equipment, peripherals, input, output, and storage devices necessary for security and surveillance. Electronic and Information technology (EIT) is IT that is used in the creation, conversion, or duplication of data or information. EIT includes: telecommunication products, such as telephones; information kiosks; transaction machines; World Wide Web sites; multimedia (including videotapes); and office equipment, such as copiers and fax machines.

INFORMATION TECHNOLOGY (IT) GENERAL REQUIREMENTS

When applicable, the contractor shall be responsible for the following:

• Ensure that no production systems are operational on any RDT&E network.

• Follow DoDI 8510.01 of 12 Mar 2014 when deploying, integrating, and implementing IT capabilities.

• Migrate all Navy Ashore production systems to the NMCI environment where available.

• Work with government personnel to ensure compliance with all current Navy IT & cybersecurity policies, including those pertaining to Cyber Asset Reduction and Security (CARS).

• Follow SECNAVINST 5239.3B of 17 June 2009 & DoDI 8510.01 of 12 Mar 2014 prior to integration and implementation of IT solutions or systems.

• Register any contractor-owned or contractor-maintained IT systems utilized on contract in the Department of Defense IT Portfolio Registry (DITPR)-DON.

• Only perform work specified within the limitations of the task order.

ACQUISITION OF COMMERCIAL SOFTWARE PRODUCTS, HARDWARE, AND RELATED SERVICES

This paragraph only applies to the purchasing/hosting of commercial software. Contractors recommending or purchasing commercial software products, hardware, and related services supporting Navy programs and projects shall ensure they recommend or procure items from approved sources in accordance with the latest DoN and DoD policies.

DON ENTERPRISE LICENSING AGREEMENT/DOD ENTERPRISE SOFTWARE INITIATIVE PROGRAM

Pursuant to DoN Memorandum – Mandatory use of DoN Enterprise Licensing Agreement (ELA) dtd 22 Feb 12, contractors that are authorized to use Government supply sources per FAR 51.101 shall verify if the product is attainable through DoN ELAs and if so, procure that item in accordance with appropriate ELA procedures. If an item is not attainable through the DoN ELA program, contractors shall then utilize DoD Enterprise Software Initiative (ESI) program (see DFARS 208.74) and government-wide SmartBuy program (see DoD memo dtd 22 Dec 05). The contractor shall ensure any items purchased outside these programs have the required approved waivers as applicable to the program. Software requirements will be specified at the task order level.

DON APPLICATION AND DATABASE MANAGEMENT SYSTEM (DADMS)

The contractor shall ensure that no Functional Area Manager (FAM) disapproved applications are integrated, installed or operational on Navy networks. The contractor shall ensure that all databases that use database management systems (DBMS) designed, implemented, and/or hosted on servers and/or mainframes supporting Navy applications and systems be registered in DoN Application and Database Management System (DADMS) and are FAM approved. All integrated, installed, or operational applications hosted on Navy networks must also be registered in DADMS and approved by the FAM. No operational systems or applications will be integrated, installed, or operational on the RDT&E network.

SECTION 508 COMPLIANCE

This paragraph only applies to IT contracts. The contractor shall ensure that all software recommended, procured, and/or developed is compliant with Section 508 of the Rehabilitation Act of 1973, 26 CFR Part 1194 and pursuant to SPAWARINST 5721.1B of 17 Nov 2009. In accordance with FAR 39.204, this requirement does not apply to contractor acquired software that is incidental to the task, software procured/developed to support a program or system designated as a National Security System (NSS) or if the product is located in spaces frequented only by service personnel for maintenance, repair or occasional monitoring of equipment.

SOFTWARE DEVELOPMENT/MODERNIZATION AND HOSTING

This paragraph only applies to software development and modernization. The contractor shall ensure all programs utilizing this contract for software development/ modernization (DEV/MOD), including the development of IT tools to automate NIWC Pacific business processes are compliant with DON Information Management/Information Technology (DON IM/IT) Investment Review Process Guidance requirements. Contractors shall neither host nor develop IT tools to automate NIWC Pacific business processes unless specifically tasked within the task order or contract. The contractor shall ensure IT tools developed to automate NIWC Pacific business processes will be delivered with full documentation and source code, as specified at the task order level, to allow non-proprietary operation and maintenance by any source. The contractor shall ensure all programs are submitted with proof of completed DEV/MOD certification approval from the appropriate authority in accordance with DON policy prior to task order award. *Note must be listed on Investment Review Board (IRB) approved list.

INFORMATION SECURITY

Pursuant to DoDM 5200.01, the contractor shall provide adequate security for all unclassified DoD information passing through non-DoD information system including all subcontractor information systems utilized on contract. The contractor shall disseminate unclassified DoD information within the scope of assigned duties and with a clear expectation that confidentiality is preserved. Examples of such information include the following: non-public information provided to the contractor, information developed during the course of the contract, and privileged contract information (e.g., program schedules, contract-related tracking).

IT POSITION CATEGORIES

Pursuant to DoDI 8500.01, DoD 8570.01-M, SECNAVINST 5510.30, SECNAV M-5239.2, and applicable to unclassified DoD information systems, a designator is assigned to certain individuals that indicates the level of IT access required to execute the responsibilities of the position based on the potential for an individual assigned to the position to adversely impact DoD missions or functions. As defined in DoD 5200.2-R, SECNAVINST 5510.30 and SECNAV M-5510.30, three basic DoN IT levels/Position categories exist:

• IT-I (Privileged access)

• IT-II (Limited Privileged, sensitive information)

Note: The term IT Position is synonymous with the older term Automated Data Processing (ADP) Position (as used in DoD 5200.2-R, Appendix 10). Investigative requirements for each category vary, depending on the role and whether the individual is a U.S. civilian contractor or a foreign national. The Contractor PM shall assist the Government Project Manager or COR in determining the appropriate IT Position Category assignment for all contractor personnel. All required Single-Scope Background Investigation (SSBI)/Tier 5, SSBI Periodic Reinvestigation (SSBI-PR)/Tier 5R, and National Agency Check (NAC)/Tier 3R adjudication will be performed Pursuant to DoDI 8500.01 and SECNAVINST 5510.30. Requests for investigation of contractor personnel for fitness determinations or IT eligibility without classified access are submitted by SPAWAR/SSC Atlantic/NIWC Pacific Security Office, processed by the OPM, and adjudicated by DOD CAF. IT Position Categories are determined based on the following criteria:

IT-I Level (Privileged) - Positions in which the incumbent is responsible for the planning, direction, and implementation of a computer security program; major responsibility for the direction, planning and design of a computer system, including the hardware and software; or, can access a system during the operation or maintenance in such a way, and with a relatively high risk for causing grave damage, or realize a significant personal gain. Personnel whose duties meet the criteria for IT-I Position designation require a favorably adjudication of Single Scope Background Investigation (SSBI)/Tier 5 or SSBI-PR/Tier 5R. The SSBI/Tier 5 or SSBI-PR/Tier 5R is updated a minimum of every 5 years. Assignment to designated IT-I positions requires U.S. citizenship unless a waiver request is approved by CNO.

IT-II Level (Limited Privileged) - Positions in which the incumbent is responsible for the-direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority at the IT-II Position level to insure the integrity of the system. Personnel whose duties meet the criteria for an IT-II Position require a favorably adjudication of a Position of Trust National Agency Check with Law and Credit (PT/NACLC)/Tier 3R. Assignment to designated IT-II positions requires U.S. citizenship unless a waiver request is approved by CNO.

IT-III Level (Non-privileged) - All other positions involved in computer activities. Incumbent in this position has non-privileged access to one or more DoD information systems/applications or database to which they are authorized access. Personnel whose duties meet the criteria for an IT-III Position designation require a favorably adjudication of a Position of Trust National Agency Check with Written Inquiries (PT/NACI).

· The Cyber Security Workforce team is available to assist with CS requirements. Contact the Cyber Security Workforce team for additional guidance – points of contract can be found on the Hub by searching ‘Cybersecurity Team.’

· If language is inserted, the above referenced CDRL data item should be included as an exhibit to the order.

5.0 TRAVEL

Travel is anticipated in performance of this order. The following table represents the Government’s forecast of potential travel requirements under the order. The contractor shall prepare and submit a travel request to the COR for approval prior to each trip. The contractor’s travel request shall include an itemized travel budget indicating the specific trip destination, duration, and numbers of travelers proposed to make the trip, and the cumulative travel costs already accrued in performance of this task order. The COR will approve or deny specific travel requests in writing (email is acceptable). Contractor personnel are not authorized to travel prior to receipt of the COR’s written approval of the trip.

6.0 PROPERTY REQUIREMENTS

No property requirements are anticipated on this order.

7.0 SECURITY

The work to be performed under this Task Order involves access to and handling of SENSITIVE/ CONFIDENTIAL classified material. All locations, spaces, and areas will require contractor personnel to be cleared to a level of SECRET.

Anti-Terrorism/force Protection (AT/FP) briefings are required for all personnel (military, DOD civilian, and contractor) prior to commencement of foreign travel. Contractor employees must receive the AT/FP briefing annually. The briefing is available at Joint Knowledge Online (JKO): https://jkodirect.jten.mil (prefix): JS; course number: US007; title: Level 1 Anti-terrorism awareness training, if experiencing problems accessing this website contact ssc_fortrav@navy.mil. Note: per OPNAVINST F3300.53C contractor employees must receive the AT/FP briefing annually.

As required by National Industrial Security Program Operating Manual (NISPOM) Chapter 1, Section 3, contractors are required to report certain events that have an impact on: 1) the status of the facility clearance (FCL); 2) the status of an employee's personnel clearance (PCL); 3) the proper safeguarding of classified information; 4) or an indication that classified information has been lost or compromised. Contractors working under NIWC Pacific contracts will ensure information pertaining to assigned contractor personnel are reported to the Contracting Officer Representative (COR)/Technical Point of Contact (TPOC), the Contracting Specialist, and the Security's COR in addition to notifying appropriate agencies such as Cognizant Security Agency (CSA), Cognizant Security Office (CSO), or Department Of Defense Central Adjudication Facility (DODCAF) when that information relates to the denial, suspension, or revocation of a security clearance of any assigned personnel; any adverse information on an assigned employee's continued suitability for continued access to classified access; any instance of loss or compromise, or suspected loss or compromise, of classified information; actual, probable or possible espionage, sabotage, or subversive information; or any other circumstances of a security nature that would affect the contractor's operation while working under NIWC Pacific contracts.

8.0 DELIVERABLES

The contractor shall deliver timely work products, services and documents that conform to the requirements of this order. The contractor shall deliver reports and other documents in accordance with the CDRLS attached to this order. Final inspection and acceptance of services delivered is performed by the COR.

9.0 OTHER DRIECT COSTS (ODC)

The Government will reimburse the Contractor only for the actual price paid for supplies that are expressly identified as reimbursable items by this Order. “Actual Price” paid by the Contractor includes tax paid, if any, and reduced by any and all credits and rebates, whether accrued or realized, associated with the supplies and services provided.

The Contractor shall not exceed or incur costs that exceed the amount of funding available on the ODC CLIN at the time a reimbursable item is ordered. The Government is not obligated to reimburse the Contractor for an otherwise reimbursable ODC in excess of the funded amount stated on a reimbursable CLIN. Accordingly, the Contractor is not obligated to continue performance of any reimbursable work under this Contract or otherwise incur costs for reimbursable ODCs in excess of the funded amount stated on a reimbursable CLIN unless the Contracting Officer notifies the Contractor that the funded amount stated on the reimbursable CLIN has been increased. When the Contractor expects total funding expended for reimbursable ODCs to reach 85 percent of the total funds available on the ODC CLIN, the Contractor shall provide notification to the COR. The notice shall state the estimated amount of additional funds required to continue performance for the period specified in the order.

Changes to the order shall not be considered an authorization to exceed the funded amount stated on a reimbursable CLIN unless the change contains a statement expressly increasing the funded amount of the reimbursable CLIN by a sufficient amount to cover the change.