SOW_Attachment 2 18R0129 2019 Follow-On 11_02_18.pdf

SPACE AND NAVAL WARFARE SYSTEMS CENTER PACIFIC

INTEGRATED VOICE NETWORKS BRANCH

N66001-18-R-0129

STATEMENT OF WORK (SOW)

Department of the Navy (DoN) Space and Naval Warfare Systems Center, Pacific

Code 41270

Naval Station San Diego, Bldg. 3533

San Diego, CA 92136

10/30/2018 Statement of Work

41270 Integrated Voice Networks Contract

1.0 SCOPE

This Statement of Work provides for technical support for the Integrated Voice Networks Branch (Code 41270) and the Integrated Voice Communications System (IVCS) Life Cycle Support Facility (LCSF) in performance of the In-Service Engineering Activity (ISEA) duties, and other voice communications duties and assignments. The Branch’s scope of responsibility covers all phases of the life cycle for the communication systems and equipment assigned to the Space and Naval Warfare Systems Center Pacific (SSC Pacific) Code 41270 by the program sponsor, NAVSEA 05 which includes intra and inter-unit communications by wired and wireless means. Due to the wide scope of responsibility, the technical support under this Statement of Work (SOW) shall vary significantly. Required technical support includes design, redesign, upgrade, and maintenance of electronic equipment and systems and their associated computer programs on board Navy ships and shore Government sites. A significant portion of the support includes the in-service maintenance and upgrade of the Integrated Voice Communications System (IVCS). Required engineering and technical support also includes the maintenance, and upgrade of software and databases.

This support will be primarily for use by Code 41270, the Integrated Voice Networks Branch, for the systems listed below.

IVCS – Integrated Voice Communications System to include AN/STC-2(V), MarCom, AN/STC-3(V) and variants

Ship Service Telephone Systems (SSTS) – Integrated Voice Communications Network (IVCN), Integrated Voice Network (IVN), Avaya Definity 75, and Avaya Server based systems Voice IC – Sound Powered and Announcing Shipboard Wireless Systems to include AN/SRC-53(V), AN/SRC-55(V), AN/SRC-59(V), Personal Communications System (PCS), and IVN Wireless

2.0 APPLICABLE DOCUMENTS

The contractor is required to comply with NAVSEA Technical Specification 9090-310 (current version series), Alterations to Ships Accomplished by Alteration Installation Teams and the documents referenced therein. Documents, which are applicable to a specific task, shall be designated in the task order.

Documents to be used shall be the issue in effect at the date of award for each task order. In the event of a conflict between the text of this SOW and references cited herein, the text of this SOW shall take precedence. Nothing in the document however, shall supersede applicable laws and regulations, unless a specific exemption has been obtained.

2.1 OPTIONAL MILITARY SPECIFICATIONS:

MIL-D-23140 (Series), Drawings, Installation Control, for Electronic Equipment

MIL-DTL-15024 (Series), Plate, Tags and Bands for Identification of Equipment, General Specification for

MIL-P-24534 (Series), Planned Maintenance System: Development of Maintenance Requirement Cards, Maintenance Index Pages and Associated Documentation

MIL-PRF-29612 (Series), Training Data Products

2.2 OPTIONAL MILITARY STANDARDS:

MIL-STD-130 (Series), Identification Marking of U.S. Military Property

MIL-STD-461 (Series), Requirements for the Control of Electromagnetic Interference Emission and Susceptibility

MIL-STD-810 (Series), Environmental Engineering Considerations and Laboratory Tests

MIL-STD-882 (Series), Standard Practice for System Safety

MIL-STD-1686 (Series), Electrostatic Discharge Control Program for Protection of Electrical and Electronic Parts, Assemblies, and Equipment

2.3 OPTIONAL MILITARY HANDBOOKS:

MIL-HDBK-237 (Series), Guidance for Controlling Electromagnetic Environmental Effects on Platforms, Systems and Equipment

MIL-HDBK-419 (Series), Grounding and Shielding for Electronic Equipment and Facilities Basic Theory

MIL-HDBK-454 (Series), General Guidelines for Electronic Equipment

MIL-HDBK-831 (Series), Preparation of Test Reports

2.4 OTHER DOCUMENTS:

Advanced Maintenance Control System (AMCS) System User Manual

EE-630-AC-OPI-0010 Operating and Servicing Instructions for COTS Dot Matrix Printer and Enclosure Assembly used with the AN/STC-2

EE105-AR-MMO-010 Vol. 1: General Information, Safety Precautions, Conditions Of Readiness, Operation, Functional Description, Scheduled Maintenance MarCom

EE105-AR-MMO-020 Vol. 2: MarCom Fault Isolation, Removal/Replacement And Alignment Procedures, Parts List, Installation

EE105-AR-MMO-030, Vol. 3: MarCom Terminals, General Information

EE105-AR-MMO-040, Vol. 4: MarCom Accessories, General Information

Document No. K00010495, MarCom System Administration Terminal (SAT) User Manual

AMERICAN SOCIETY OF MECHANICAL ENGINEERS (ASME)

ASME Y14.100 (Series), Engineering Drawing Practices

AMERICAN SOCIETY FOR TESTING AND MATERIALS (ASTM)

ASTM D 3951 (Series), Packaging, Commercial

ELECTRONIC INDUSTRIES ASSOCIATION (EIA)

EIA 310-D (Series), Racks, Panels, and Associated Equipment

INSTITUTE OF ELECTRICAL AND ELECTRONIC ENGINEERS (IEEE)

IEEE 100 Standard Dictionary of Electrical and Electronic Terms IEEE 200 (Series), Reference Designations for Electrical and Electronic Parts and Equipment ANSI Y32.16, DOD adopted) IEEE 260.1 IEEE (Series), Standard Letter Symbols for Units of Measurement (SI Units, Customary Inch-Pound Units, and Certain Other Units)

IEEE 315 (Series), Graphic Symbols for Electrical and Electronics Diagrams (Including Reference Designation Class Designation Letters) (ANSI Y32.2)

National Electrical Code (NEC) (Series)

FEDERAL REGULATIONS

CFR 29 Code (Series) of Federal Regulations Title 29, Part 1910.1200 and Subpart Z Occupational Safety and Health Standards

CFR 47 Code (Series) of Federal Regulations, Title 47

2.5 OTHER NAVY DOCUMENTS

SE105-AQ-MMO-010/STC-2(V), Technical Manual for Integrated Voice Communication System, Chapter 1(General Information), Chapter 4 (Scheduled Maintenance), Chapter 6 (Corrective Maintenance)

SE105-AQ-MMO-020/STC-2(V), Technical Manual for Integrated Voice Communications System Chapter 2 (Operation)

SE105-AQ-MMO-030/STC-2(V), Technical Manual for Integrated Voice Communications System Chapter 3 (Functional Description)

SE105-AQ-MMO-041/STC-2(V), Technical Manual for Integrated Voice Communications System Chapter 5 (Troubleshooting)

SE105-AQ-MMO-042/STC-2(V), Technical Manual for Integrated Voice Communications System, Logic Diagrams

SE105-AQ-MMO-050/STC-2(V), Technical Manual for Integrated Voice Communications System, Parts List

NAVSEA 61Z1-286-I-308 System Operator Manual for AN/STC-2(V)

SE105-AQ-MMO-060/STC-2(V), Technical Manual for Integrated Voice Communications System Section I. Dial Terminal Maintenance Information Section II. Jackbox Terminal Maintenance Information Section III. Accessories Maintenance Information

NAVSEA Technical Specification 9090-310E (Series)

NAG 69D (Series) Information Systems Security Policy and Procedures for Fortezza Card CAW

SPAWAR EE000-BA-GYD-010 (Series) System Safety Checklist

SPAWAR Shore Plan System Descriptions and Equipment Lists, Version 1.1 (Series)

SPAWAR Notice 5300 (Series) Shore Installation Process Handbook (current version)

NAVAL SEA SYSTEMS COMMAND

NAVSEA 0967-LP-000-0110 (current version series) Electronic Installation and Maintenance Book:

Installation Standards

SD-2 (Series) Buying NDI

SD-5 (Series) Locating Off-The-Shelf Items

2.6 ADDITIONAL DOCUMENTS- CYBERSECURITY

Document Number Title

DoDI 5200.02

DoD Personnel Security Program (PSP) Reissues DoD Directive (DoDD) 5200.02

DoDM 5200.01 DoD Manual – Information Security Program Manual dtd 24 Feb 12 DoDD 5205.02E DoD Directive – Operations Security (OPSEC) Program dtd 20 Jun 12 DoD 5205.02-M DoD Manual – Operations Security (OPSEC) Program Manual dtd 3 Nov 08 DoD 5220.22-M DoD Manual – National Industrial Security Program Operating Manual

(NISPOM) dtd 28 Feb 06 DoDI 5220.22 DoD Instruction – National Industrial Security Program dtd 18 Mar 11 DoDI 6205.4 Department of Defense Instruction, Immunization of Other Than U.S. Forces

(OTUSF) for Biological Warfare Defense dtd 14 Apr 00 DoDI 8500.01 DoD Instruction – Cybersecurity dtd 14 Mar 14 DoDI 8510.01

DoD Instruction – Risk Management Framework (RMF) for DoD Information Technology (IT) dtd 12 Mar 14

DoD 8570.01-M

Information Assurance Workforce Improvement Program dtd 19 Dec 05 with Change 3 dtd 24 Jan 12

DoDD 8140.01 Cyberspace Workforce Management dtd 11 Aug 15 SECNAV M-5239.2 DON Cyberspace Information Technology and Cybersecurity Workforce

Management and Qualification Manual dtd Jun 16

SECNAV M-5510.30 Secretary of the Navy Manual – DoN Personnel Security Program dtd Jun 2006

SECNAV M-5510.36 Secretary of the Navy Manual – DoN Information Security Program dtd Jun

SECNAVINST

4440.34

Secretary of the Navy Instruction – Implementation of Item Unique Identification within the DoN, dtd 22 Dec 09

SECNAVINST

5239.19

Incident Response, dtd Mar 08

SECNAVINST

5239.20A

DON Cyberspace IT and Cybersecurity dtd 10 Feb 16

SECNAVINST

5239.3C

DON Cybersecurity Policy, dtd 2 May 16

SECNAVINST

5510.30

DON Regulation – Personnel Security Program dtd 6 Oct 06

DON CIO

Memorandum

Acceptable Use of Department of the Navy Information Technology (IT) dtd 12 Feb 16

SPAWARINST

3432.1

SPAWAR Instruction – Operations Security (OPSEC) Policy dtd 2 Feb 05

SPAWARINST

4440.12

Management of Operating Materials and Supplies (OM&S), Government Furnished Property (GFP), Contractor Acquired Property (CAP), Property, Plant and Equipment (PP&E), and Inventory

SPAWARINST

5721.1B

SPAWAR Section 508 Implementation Policy, 17 Nov 09

COMUSFLTFORCO

M/COMPACFLTINS

T 6320.3A

Commander US Fleet Forces Command/Commander US Pacific Fleet Instruction, Medical Screening For US Govt Civilian Employees, Contractor Personnel, and Guests prior to embarking Fleet Units, of 7 May 13

Navy Telecommunications Directive (NTD 10- 11)

System Authorization Access Request (SAAR) - Navy

3.0 REQUIREMENTS

The following paragraphs identify requirements that are to be accomplished under this contract when specified by task orders (TO). The specific tasks to be accomplished and the schedule for accomplishment are not known at this time. Specific tasks and their schedules for delivery or completion shall be provided in individual task orders. These requirements are limited to the systems stated in SOW paragraph 1.0, and as assigned to Code 41270 by the program sponsor, NAVSEA 05.

3.1 Perform repair and maintenance of hardware and software systems to include the tasks delineated below.

3.1.1 Modification of program source code

3.1.2 Program updates by individual ship, based on analysis of Ship Change Documents (SCD), ShipAlts, and approved Engineering Change Proposals (ECP)

3.1.3 Program updates for individual ships, based on ship’s needs and requests

3.1.4 Program updates based on software trouble reports (STRS)

3.1.5 Program improvements based on In-Service-Engineering-Activity (ISEA) software redesign, maintenance support, in-service engineering, and life-cycle system analysis

3.1.6 Analysis of failure reports to identify pattern failures, potential software problems, documentation shortcomings, etc.

3.1.7 Program updates to the Advanced Maintenance Control System (AMCS) on the AN/STC- 2(V) based on requests for improvement and maintenance

3.1.8 Modification of computer diagnostic programs in support of the maintenance of equipment and systems

3.1.9 Development of configuration databases and the generation of computer program updates that support planned ship configurations based on information from planning activities.

3.1.10 Review of engineering and technical documents such as technical manuals specifications, drawings, and reports for completeness, accuracy, and adequacy

3.1.11 Development and production of phone books based on ship’s configuration data and updates

3.1.12 Program designs, redesigns, and modifications.

3.1.13 In-depth software technical support for the computer programs and configuration databases. This support includes designing and developing prototype applications, collecting database information from Fleet and planning activities, ongoing maintenance, refinement, enhancement, and expansion of utility programs, configuration databases and their applications as required for life cycle support of communications systems. Document all programs generated, modified, or maintained during the course of this contract, in accordance with standards specified in the Task Orders. Perform Software Support Agent (SSA) duties to include software configuration control of all programs generated or maintained under this contract. Support and/or perform independent verification and validation of assigned software.

3.1.14 Technical support for system assessment, troubleshooting (remote and on-site), repairs, distance support (remote technical guidance and troubleshooting), Help desk Support, and groom. These services shall be available within short notice, at the ship’s current location, in port or at sea. The contractor shall provide expertise for timely and necessary repairs to resolve Casualty Reports (CASREPs) and requests for technical assistance.

3.1.15 Hardware engineering support for requirements definition, design, redesign, engineering, analysis, and on-site field engineering services for upgrade and maintenance to include: SCDs for Ship Modernization, ECPs for future field changes; circuit card upgrades to avoid obsolescence; system component, circuit card assembly, and new circuit design or redesign, to provide communications upgrades or enhancements; investigation of hardware diagnostic problems, and recommendation for changes to computer diagnostic programs; designing and building specialized test equipment, used to assist in on-line fault diagnosis, and to be included as built-in-test equipment (BITE) in the finished design; maintenance engineering analysis, interfacing with modern telephony and network communications systems, and backplane rewiring requirements. Design and develop field change kits to implement specified field changes.

3.2 Provide hardware and software upgrade of equipment and systems. This shall include site assessments and surveys, review of technical documents, drawings, specifications, etc., development of formal System Installation Drawing (SID) packages for Subject Matter Expert Teams (SMET), development of installation plan, with drawings, removal of existing hardware, preparation of location to receive new equipment, physical handling and mounting of system hardware, set up and termination of associated wiring. The contractor shall configure associated software, oversee, test, and inspect the upgrade of equipment/systems, prepare logistic support package, and redline drawings and documentation, such as technical manuals, operation manuals, System Operational Verification or Acceptance Test (SOVT), and OPNAV 4790CK Change Configuration documents.

3.3 Provide training support to include the development and revision of training curriculum. Conduct on the Job Training for the operation and maintenance of voice equipment. Prepare for and conduct technical demonstrations, briefings. Brief personnel on new techniques, methods, equipment, and software changes.

3.4 Provide Integrated Logistics Support and configuration management to include procurement, warehousing, and inventory control.

3.5 Provide program management support. The contractor shall assist in the generation of technical and financial status, response to data calls, preparation for program reviews, generation of viewgraphs, and tracking of outstanding actions. The contractor shall also assist in generating marketing material.

3.6 Provide Information Assurance (IA) and Cybersecurity support. The contractor shall evaluate, develop and implement cyber vulnerability detection and assessment, cyber computer incident response, computer incident response handling including malware, vulnerability analysis and cyber related infrastructure interdependencies. The contractor shall generate Risk Management Framework (RMF) packages to include mitigations of vulnerabilities as a result of ACAS/Nessus scans and Security Technical Implementation Guides (STIGs).

4.0 DELIVERABLES

Data deliverable shall have been reviewed IAW “DON Policy on Digital Product/Technical Data, ASNRDA memo of 23 OCT 2004” and “Software Process Improvement Initiative Contract Language, ASNRDA memo of 17 NOV 2006” and as specified in the CDRL, DD1423 for the individual Task Orders.

5.0 PERFORMANCE AND TRAVEL

5.1 PLACE OF PERFORMANCE

It is estimated that eighty percent (80%) of the work shall be performed at the IVCS Life Cycle Support Facility (LCSF) located at Naval Base San Diego CA; five percent (5%) of the work shall be performed at the contractor’s facilities; and fifteen percent (15%) shall be performed at temporary work sites or ports located in the continental U.S. or foreign countries. No travel costs will be incurred for work done in San Diego, CA. Additional or specific work locations shall be specified on individual task orders.

5.2 PERIOD OF PERFORMANCE

The period of performance is anticipated to be a base period of one-year, with four one-year option periods to be executed at the Government’s discretion. Each optional Contract Line Item Number (CLIN) will have a separate and distinct period of performance not to exceed twelve (12) months, and must be exercised (if needed) within the contract period of performance.

5.3 OVERTIME

Should overtime be required in the performance of any task under this contract, prior approval shall be required of the Ordering Officer, SSC Pacific Code, with verification and concurrence with the COR/technical code or as specified in each Task Order.

5.4 TRAVEL

The contractor shall ensure all travel is performed pursuant to clause 5252.231-9200. The contractor shall be required to travel worldwide for the performance of tasking on this basic contract. Travel is authorized as required to/from places of performance specified in each Task Order.

Contractor personnel are reminded of their obligation to safeguard the vital relationship our Nation has with Foreign Countries. This includes personal conduct while performing under the contract and on one’s personal time because, at all times, you are viewed by our partners as a representative of the United States, our Navy, and SPAWAR. Therefore, professional, courteous, and culturally aware conduct is necessary at all times. Inappropriate conduct, and especially intoxication and criminal behaviors, will not be tolerated. An all too common nexus for personnel misconduct while on travel is irresponsible consumption of alcohol. Intoxication increases your vulnerability to crime, injury, arrest, terrorism and espionage.

While traveling on official business, representing and performing in support of SPAWAR’s mission, all personnel, including military, civilian and contractors, are expected to act in a professional and responsible manner. In order to promote effective relationships with business partners and allied nations, it is incumbent on contractor personnel to follow local laws and employ courteous and culturally aware behavior. Inappropriate conduct may jeopardize important relationships for the United States Navy, SPAWAR, SSC Pacific and SSC Atlantic, and will not be tolerated.

Security Requirements The nature of this task requires access up to Secret information. The work performed by the contractor will include access up to Secret data, information, and spaces. The contractor will be required to attend meetings classified up to the Secret level.

1. If foreign travel is required, all outgoing Country/Theater clearance message requests shall be submitted to the Commanding Officer, Attn: Foreign Travel Team, Space and Naval Warfare Systems Center Pacific, 4201 Pacific Highway, Old Town Complex 2, Room 1656, San Diego, CA 92110 for action. A Request for Foreign Travel form shall be submitted for each traveler, in advance of the travel, to initiate the release of a clearance message at least 30 days in advance of departure. Each Traveler must also submit a Personal Protection Plan and have a Level 1 Antiterrorism/Force Protection briefing within one year of departure and a country specific briefing within 90 days of departure. Anti-Terrorism/Force Protection (AT/FP) briefings are required for all personnel (Military, DOD Civilian, and contractor) per OPNAVINST F3300.53C.

Contractor employees must receive the AT/FP briefing annually. The briefing is available at Joint Knowledge Online (JKO): https://jkodirect.jten.mil (prefix): JS; course number: US007;

title: Level 1 Anti-terrorism awareness training, if experiencing problems accessing this website contact ssc_fortrav@navy.mil. Forward a copy of the training certificate to the previous email address or fax to (619) 553-6863. Sere 100.2 Level A code of conduct training is also required prior to Oconus travel for all personnel. Sere 100.2 Level A training can be accessed at http://jko.jfcom.mil (recommended), https://jkodirect.jten.mil/atlas2/faces/page/login/login.seam, recommend course: prefix: J3T: course #: A-US1329, for civilian, military, and contractors.

Personnel utilizing the JKO site must have a CAC. Other specialized training for specific locations may also be required contact the SSC Pacific foreign travel team.

Finally, EUCOM has mandated that all personnel going on official travel to the EUCOM AOR must now register with the Smart Traveler Enrollment Program (STEP). When you sign up, you will automatically receive the most current information the State Department compiles about your destination country. You will also receive updates, including Travel Warnings and Travel Alerts.

Sign up is one-time only, after you have established your STEP account, you can easily add official or personal travel to anywhere in the world, not just EUCOM.

http://travel.state.gov/content/passports/en/go/step.html.

2. Anti-Terrorism/force Protection (AT/FP) briefings are required for all personnel (military, DOD civilian, and contractor) prior to commencement of foreign travel. Contractor employees must receive the AT/FP briefing annually. The briefing is available at Joint Knowledge Online (JKO):

https://jkodirect.jten.mil (prefix): JS; course number: US007; title: Level 1 Anti-terrorism awareness training, if experiencing problems accessing this website contact ssc_fortrav@navy.mil. note: per OPNAVINST F3300.53C contractor employees must receive the AT/FP briefing annually.

3. Operations Security (OPSEC). OPSEC is a five step analytical process (identify critical information; analyze the threat; analyze vulnerabilities; assess risk; develop countermeasures) that is used as a means to identify, control, and protect unclassified and unclassified sensitive information associated with U.S. national security related programs and activities. All personnel working under this task will at some time handle, produce or process Critical Information or Critical Program Information, and therefore all Contractor personnel must practice OPSEC. All work is to be performed in accordance with DoD OPSEC requirements, and in accordance with the OPSEC attachment to the DD254.

4. The Contractor shall be familiar with and comply with the requirements, terms and conditions of the Status of Forces Agreement between the United States and [Country].

In all cases, Contractors are reminded of their responsibilities under FAR 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015). The clause requires the contractor to:

• Have a written code of business ethics and conduct;

• Make a copy of the code available to each employee;

• Exercise due diligence to prevent and detect criminal conduct;

• Promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law.

https://jkodirect.jten.mil/ mailto:ssc_fortrav@navy.mil http://jko.jfcom.mil/ http://travel.state.gov/content/passports/en/go/step.html

The clause also requires Contractors to timely disclose, in writing, to the agency Office of the Inspector General (OIG), with a copy to the Contracting Officer, whenever, in connection with the award, performance, or closeout of this contract or any subcontract thereunder, the Contractor has credible evidence that a principal, employee, agent, or subcontractor of the Contractor has committed—

• A violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code; or

• A violation of the civil False Claims Act (31 U.S.C. 3729-3733).

6.0 GOVERNMENT FURNISHED MATERIAL/EQUIPMENT

6.1 All Government furnished resources shall be identified on individual task orders.

6.2 If any material is to be moved to the contractor’s facility, or control of any government owned material is to be transferred to the contractor, it shall be so noted in individual task orders.

7.0 CYBERSECURITY COMPLIANCE

7.1 Cybersecurity (which replaced the term Information Assurance (IA)) is defined as prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation.

Contractor personnel shall perform tasks to ensure Navy applications, systems, and networks satisfy Federal/DoD/DON/Navy cybersecurity requirements.

7.2 Cyber IT and Cybersecurity Personnel

(i) The Cyberspace workforce elements addressed include contractors performing functions in designated Cyber IT positions and Cybersecurity positions. In accordance with DFARS Subpart 239.71, DoDD 8140.01, SECNAVINST 5239.20A, and SECNAV M-5239.2, contractor personnel performing cybersecurity functions shall meet all cybersecurity training, certification, and tracking requirements as cited in DoD 8570.01-M prior to accessing DoD information systems. Proposed contractor Cyber IT and cybersecurity personnel shall be appropriately qualified prior to the start of the contract performance period or before assignment to the contract during the course of the performance period.

(ii) The contractor shall be responsible for identifying, tracking and reporting cybersecurity personnel, also known as Cybersecurity Workforce (CSWF) and Cyber IT workforce personnel. CSWF Report requirements are explained in a following paragraph. Although the minimum frequency of reporting is monthly, the task order can require additional updates at any time.

(iii) Contractors that access Navy IT shall also follow guidelines and provisions documented in Navy Telecommunications Directive (NTD 10-11) and are required to complete a System Authorization Access Request (SAAR) – Navy form as documented below.

When a contractor requires logical access to a government IT system or resource (directly or indirectly), the required CAC will have a Public Key Infrastructure (PKI). A hardware solution and software (e.g., ActiveGold) is required to securely read the card via a personal computer. Pursuant to DoDM 1000.13- M-V1, CAC PKI certificates will be associated with an official government issued e-mail address (e.g.

.mil, .gov, .edu). Prior to receipt of a CAC with PKI, contractor personnel shall complete the mandatory

Cybersecurity Awareness training and submit a signed System Authorization Access Request Navy (SAAR-N) form to the contract’s specified COR. Note: In order for personnel to maintain a CAC with PKI, each contractor employee shall complete annual cybersecurity training. The following guidance for training and form submittal is provided; however, contractors shall seek latest guidance from their appointed company Security Officer and the SPAWAR/SSC Atlantic/SSC Pacific Information Assurance Management (IAM) office:

• For annual DoD Cybersecurity/IA Awareness training, contractors shall use this site:

https://twms.nmci.navy.mil/. For those contractors requiring initial training and do not have a CAC, contact the SPAWAR/SSC Atlantic/SSC Pacific IAM office at phone number (843)218-6152 or e-mail questions to ssc_lant_iam_office.fcm@navy.mil for additional instructions. Training can be taken at the IAM office or online at http://iase.disa.mil/index2.html.

• For SAAR-N form, the contractor shall use OPNAV 5239/14 (Rev 9/2011). Contractors can obtain a form from the SPAWAR/SSC Atlantic/SSC Pacific IAM office at or from the website: https://navalforms.documentservices.dla.mil/. Digitally signed forms will be routed to the IAM office via encrypted e-mail to ssclant_it_secmtg@navy.mil.

(iv) Contractor personnel with privileged access will be required to acknowledge special responsibilities with a Privileged Access Agreement (PAA) IAW SECNAVINST 5239.20A.

7.3 Design, Integration, Configuration or Installation of Hardware and Software

The contractor shall ensure any equipment/system installed or integrated into Navy platform will meet the cybersecurity requirements as specified under DoDI 8500.01. The contractor shall ensure that any design change, integration change, configuration change, or installation of hardware and software is in accordance with established DoD/DON/Navy cyber directives and does not violate the terms and conditions of the accreditation/authorization issued by the appropriate Accreditation/Authorization official. Contractors that access Navy IT are also required to follow the provisions contained in DON CIO Memorandum: Acceptable Use of Department of the Navy Information Technology (IT) dtd 12 Feb

16. Use of blacklisted software is specifically prohibited and only software that is registered in DON Application and Database Management System (DADMS) and is Functional Area Manager (FAM) approved can be used as documented in para 4.2.2. Procurement and installation of software governed by DON Enterprise License Agreements (ELAs) – Microsoft, Oracle, Cisco, Axway, Symantec, ActivIdentity, VMware, Red Hat, NetApp, and EMC shall be in accordance with DON CIO Policy and DON ELAs awarded.

7.4 Cybersecurity Workforce (CSWF) Report

The following Cybersecurity Workforce (CSWF) Report is required for all service contracts utilizing Cybersecurity (i.e., Information Assurance) personnel supporting the DoD Global Information Grid (GIG) per DoD Instruction 8500.01. DoD 8570.01-M and DFAR’s PGI 239.7102-3 have promulgated that contractor personnel shall have documented current cybersecurity certification status within their contract.

The contractor shall develop, maintain, and submit a CSWF Report monthly or as applicable at the task order level (Note: If initiated at the TO level, report not necessary at contract level). IAW clause DFARS 252.239-7001, if cybersecurity support is provided, the contractor shall provide a Cybersecurity Workforce (CSWF) list that identifies those individuals who are IA trained and certified. Utilizing the format provided in CSWF CDRL Attachment 1, the prime contractor shall be responsible for collecting, integrating, and reporting all subcontractor personnel. See applicable DD Form 1423 for additional https://twms.nmci.navy.mil/ mailto:ssc_lant_iam_office.fcm@navy.mil http://iase.disa.mil/index2.html https://navalforms.documentservices.dla.mil/ mailto:ssclant_it_secmtg@navy.mil reporting details and distribution instructions. Contractor shall verify with the COR or other government representative the proper labor category cybersecurity designation and certification requirements.

7.5 Information Technology (IT) Services Requirements

The paragraph only applies to IT contracts. Information Technology (IT) is defined as any equipment or interconnected system(s) or subsystem(s) of equipment, that is used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data of information by the agency. IT includes computers, ancillary equipment, peripherals, input, output, and storage devices necessary for security and surveillance.

Electronic and Information technology (EIT) is IT that is used in the creation, conversion, or duplication of data or information. EIT includes: telecommunication products, such as telephones; information kiosks; transaction machines; World Wide Web sites; multimedia (including videotapes); and office equipment, such as copiers and fax machines.

7.5.1 IT General Requirements

When applicable, the contractor shall be responsible for the following:

• Ensure that no production systems are operational on any RDT&E network.

• Follow DoDI 8510.01 of 12 Mar 2014 when deploying, integrating, and implementing IT capabilities.

• Migrate all Navy Ashore production systems to the NMCI environment where available.

• Work with government personnel to ensure compliance with all current Navy IT & cybersecurity policies, including those pertaining to Cyber Asset Reduction and Security (CARS).

• Follow SECNAVINST 5239.3B of 17 June 2009 & DoDI 8510.01 of 12 Mar 2014 prior to integration and implementation of IT solutions or systems.

• Register any contractor-owned or contractor-maintained IT systems utilized on contract in the Department of Defense IT Portfolio Registry (DITPR)-DON.

• Only perform work specified within the limitations of the contract/task order.

7.5.2 Acquisition of Commercial Software Products, Hardware, and Related Services

This paragraph applies only to the purchasing/hosting of commercial software. Contractors recommending or purchasing commercial software products, hardware, and related services supporting Navy programs and projects shall ensure they recommend or procure items from approved sources in accordance with the latest DoN and DoD policies.

(i) DoN Enterprise Licensing Agreement/DoD Enterprise Software Initiative Program

Pursuant to DoN Memorandum – Mandatory use of DoN Enterprise Licensing Agreement (ELA) dtd 22 Feb 12, contractors that are authorized to use Government supply sources per FAR 51.101 shall verify if the product is attainable through DoN ELAs and if so, procure that item in accordance with appropriate ELA procedures. If an item is not attainable through the DoN ELA program, contractors shall then utilize DoD Enterprise Software Initiative (ESI) program (see DFARS 208.74) and government-wide SmartBuy program (see DoD memo dtd 22 Dec 05). The contractor shall ensure any items purchased outside these programs have the required approved waivers as applicable to the program. Software requirements will be specified at the TO/contract level.

(ii) DoN Application and Database Management System (DADMS)

The contractor shall ensure that no Functional Area Manager (FAM) disapproved applications are integrated, installed or operational on Navy networks. The contractor shall ensure that all databases that use database management systems (DBMS) designed, implemented, and/or hosted on servers and/or mainframes supporting Navy applications and systems be registered in DoN Application and Database Management System (DADMS) and are FAM approved. All integrated, installed, or operational applications hosted on Navy networks must also be registered in DADMS and approved by the FAM. No operational systems or applications will be integrated, installed, or operational on the RDT&E network.

7.5.3 Section 508 Compliance

This paragraph only applies to IT contracts. The contractor shall ensure that all software recommended, procured, and/or developed is compliant with Section 508 of the Rehabilitation Act of 1973, 26 CFR Part 1194 and pursuant to SPAWARINST 5721.1B of 17 Nov 2009. In accordance with FAR 39.204, this requirement does not apply to contractor acquired software that is incidental to the task, software procured/developed to support a program or system designated as a National Security System (NSS) or if the product is located in spaces frequented only by service personnel for maintenance, repair or occasional monitoring of equipment.

7.5.4 Software Development/Modernization and Hosting

This paragraph only applies to software development and modernization. The contractor shall ensure all programs utilizing this contract for software development/ modernization (DEV/MOD); including the development of IT tools to automate SPAWAR/SSC Atlantic/SSC Pacific business processes are compliant with DON Information Management/Information Technology (DON IM/IT) Investment Review Process Guidance requirements. Contractors shall neither host nor develop IT tools to automate SPAWAR/SSC Atlantic/SSC Pacific business processes unless specifically tasked within the task order or contract. The contractor shall ensure IT tools developed to automate SPAWAR/SSC Atlantic/SSC Pacific business processes will be delivered with full documentation to allow non-proprietary operation and maintenance by any source. The contractor shall ensure all programs are submitted with proof of completed DEV/MOD certification approval from the appropriate authority in accordance with DON policy prior to contract/TO award. (DITPR-DON Update) *Note must be listed on Investment Review Board (IRB) approved list.

7.6 Information Security

Pursuant to DoDM 5200.01, the contractor shall provide adequate security for all unclassified DoD information passing through non-DoD information system including all subcontractor information systems utilized on contract. The contractor shall disseminate unclassified DoD information within the scope of assigned duties and with a clear expectation that confidentiality is preserved. Examples of such information include the following: non-public information provided to the contractor, information developed during the course of the contract, and privileged contract information (e.g., program schedules, contract-related tracking).

7.7 IT Position Categories

Paragraph (e) only applies when IT labor categories/positions are proposed. Pursuant to DoDI 8500.01, DoD 8570.01-M, SECNAVINST 5510.30, SECNAV M-5239.2, and applicable to unclassified DoD information systems, a designator is assigned to certain individuals that indicates the level of IT access required to execute the responsibilities of the position based on the potential for an individual assigned to the position to adversely impact DoD missions or functions. As defined in DoD 5200.2-R, SECNAVINST 5510.30 and SECNAV M-5510.30, three basic DoN IT levels/Position categories exist:

• Tier 5/5R: IT-I (Privileged access)

• Tier 3/3R: IT-II (Limited Privileged, sensitive information)

• Tier 1/1R: IT-III (Non-Privileged, no sensitive information)

Note: The term IT Position is synonymous with the older term Automated Data Processing (ADP) Position (as used in DoD 5200.2-R, Appendix 10).

Investigative requirements for each category vary, depending on the role and whether the individual is a U.S. civilian contractor or a foreign national. The Contractor PM shall assist the Government Project Manager or COR in determining the appropriate IT Position Category assignment for all contractor personnel. All required Single-Scope Background Investigation (SSBI) or Tier 5, SSBI Periodic Reinvestigation (SSBI-PR) or Tier 5R, and National Agency Check with Law and Credit (NACLC) or Tier 3/3R adjudication will be performed Pursuant to DoDI 8500.01 and SECNAVINST 5510.30.

Requests for investigation of contractor personnel for fitness determinations or IT eligibility without classified access are submitted by SPAWAR/SSC Atlantic/SSC Pacific Security Office, processed by the OPM, and adjudicated by DOD CAF. IT Position Categories are determined based on the following criteria:

Tier 5/5R: IT-I Level (Privileged) - Positions in which the incumbent is responsible for the planning, direction, and implementation of a computer security program; major responsibility for the direction, planning and design of a computer system, including the hardware and software; or, can access a system during the operation or maintenance in such a way, and with a relatively high risk for causing grave damage, or realize a significant personal gain. Personnel whose duties meet the criteria for IT-I Position designation require a favorably adjudication of Single Scope Background Investigation (SSBI) or SSBI- PR or Tier 5/5R. The SSBI or SSBI-PR or Tier 5/5R is updated a minimum of every 5 years.

Assignment to designated IT-I positions requires U.S. citizenship unless a waiver request is approved by

CNO.

Tier 3/3R: IT-II Level (Limited Privileged) - Positions in which the incumbent is responsible for the-direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority at the IT-II Position level to insure the integrity of the system.

Personnel whose duties meet the criteria for an IT-II Position require a favorably adjudication of a Position of Trust National Agency Check with Law and Credit (PT/NACLC) or Tier 3/3R. Assignment to designated IT-II positions requires U.S. citizenship unless a waiver request is approved by CNO.

Tier 1/1R: IT-III Level (Non-privileged) - All other positions involved in computer activities. Incumbent in this position has non-privileged access to one or more DoD information systems/applications or database to which they are authorized access. Personnel whose duties meet the criteria for an IT-III

Position designation require a favorably adjudication of a Position of Trust National Agency Check with Written Inquiries (PT/NACI) or Tier 1/1R.

8.0 SECURITY

8.1 The work to be performed in completion of tasking of this basic contract involves access to and handling of, classified matter up to and including SECRET; all classified work will be performed at the government site. Contractor may be required to be Restricted Data briefed. All work performed shall be accomplished in strict adherence to the contract DOD Contract Security Classification Specification, DD Form 254.

8.2 The contractor shall appoint a Security Officer who shall be responsible for compliance with the Department of Defense Industrial Security Manual.

8.3 Contractor and Subcontractor personnel assigned work under this basic contract shall, as a minimum, be U.S. citizens and have a valid SECRET clearance as required.

8.4 Anti-Terrorism/force Protection (AT/FP) briefings are required for all personnel (military, DOD civilian, and contractor) prior to commencement of foreign travel. Contractor employees must receive the AT/FP briefing annually. The briefing is available at Joint Knowledge Online (JKO):

https://jkodirect.jten.mil (prefix): JS; course number: US007; title: Level 1 Anti-terrorism awareness training, if experiencing problems accessing this website contact ssc_fortrav@navy.mil. note: per OPNAVINST F3300.53C contractor employees must receive the AT/FP briefing annually.

8.5 As required by National Industrial Security Program Operating Manual (NISPOM) Chapter 1, Section 3, contractors are required to report certain events that have an impact on: 1) the status of the facility clearance (FCL); 2) the status of an employee's personnel clearance (PCL); 3) the proper safeguarding of classified information; 4) or an indication that classified information has been lost or compromised.

Contractors working under SSC Pacific contracts will ensure information pertaining to assigned contractor personnel are reported to the Contracting Officer Representative (COR)/Technical Point of Contact (TPOC), the Contracting Specialist, and the Security's COR in addition to notifying appropriate agencies such as Cognizant Security Agency (CSA), Cognizant Security Office (CSO), or Department Of Defense Central Adjudication Facility (DODCAF) when that information relates to the denial, suspension, or revocation of a security clearance of any assigned personnel; any adverse information on an assigned employee's continued suitability for continued access to classified access; any instance of loss or compromise, or suspected loss or compromise, of classified information; actual, probable or possible espionage, sabotage, or subversive information; or any other circumstances of a security nature that would affect the contractor's operation while working under SSC Pacific contracts.

8.6 Operations Security (OPSEC). OPSEC is a five step analytical process (identify critical information; analyze the threat; analyze vulnerabilities; assess risk; develop countermeasures) that is used as a means to identify, control, and protect unclassified and unclassified sensitive information associated with U.S. national security related programs and activities. All personnel working under this task will at some time handle, produce or process Critical Information or Critical Program Information, and therefore all Contractor personnel must practice OPSEC. All work is to be performed in accordance with DoD OPSEC requirements, and in accordance with the OPSEC attachment to the DD254.

9.0 GOVERNMENT FURNISHED DOCUMENTS

Technical documents identified in the SOW shall be made available to the contractor by SSC Pacific. All documents furnished during the life of the contract remain the property of the government, and if removed from SSC Pacific shall be returned upon completion of the tasking unless otherwise specified in the individual task order.

10.0 GOVERNMENT FURNISHED MATERIAL/EQUIPMENT

(GFM/GFE)

A listing of Government Furnished Material (GFM) or Government Furnished Equipment (GFE) shall be specified in each Task Order. All GFM/GFE furnished during the life of the contract remain the property of the government, and if removed from SSC Pacific shall be returned upon completion of the tasking, unless otherwise specified in the individual task order.

11.0 GOVERNMENT FURNISHED FACILITIES

11.1 The contractor shall be responsible for establishing and maintaining the contractor support facility.

However, tasks under this contract may require specialized facilities to adequately perform them. When such facilities already exist and it is in the governments interest not to require what may be a costly duplication of resources; the government may provide the contractor access to these facilities for use in this tasking. These facilities may include but are not limited to:

11.1.1. U.S. Government Platforms (Submarines, Surface Vessels, etc.).

11.1.2. Integrated voice communications systems (IVCS), life cycle support facility (LCSF)

11.1.3. Test Equipment Test, storage and Control Area.

11.1.4. U.S. Government Training Facilities

11.2 When Government Furnished Facilities are to be provided; the facilities shall be identified in the individual Task Orders issued against this basic contract.

12.0 QUALITY ASSURANCE SURVEILLANCE PLAN

12.1 Acceptable Quality Level (AQL): All products shall be completed within the stated period of performance and shall be capable of being used for its intended purpose as defined herein.

12.1.1 All document and drawing products shall contain no spelling errors, be grammatically correct, be in the correct format and in the specified software, adhere to appropriate directives, and be compliant with plan(s), process(es) and specifications as defined in individual task orders.

12.1.2 All Subject Matter Expert Teams, services and engineering work products shall be in accordance with the appropriate directives, and be compliant with plan(s), process(es) and specifications listed in the individual task order.

12.1.3 All services and work products shall adhere to commercially practiced safety and security standards and regulations. All task orders shall be completed without an incidence of injury, damage or danger to all involved individuals or property.

12.1.4 GFM/GFE is maintained as prescribed by regulations. Inoperative equipment is reported to the COR the same working day as a problem occurs 95% of the time.

12.2 Surveillance Method: The Contracting Officer’s Representative (COR) shall perform 100 percent inspection on all initial deliverables under this contract for compliance with the stated objectives herein.

When a record of consistent quality is established, the Government may use a periodic review method to ensure quality. The contractor shall continue to inspect all submissions for the level of quality required under section 11.1 herein.

12.3 Corrective Action: If required by the COR or the Contracting Officer deliverables not in compliance with established quality levels shall be returned to the Contractor for corrective action. Re-work hours shall be non-fee bearing. Persistent problems shall result in a negative assessment in the Contractor Performance Appraisal Rating System (CPARS). Contract Clause 52.246-5 allows for further actions if the contractor does not meet the required quality standards.

13.0 ENTERPRISE-WIDE CONTRACTOR MANPOWER REPORTING

APPLICATION (ECMRA)

The contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for SSC Pacific via a secure data collection site.

Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities;

(4) D, Automatic Data Processing and Telecommunications, IT and Telecom- Telecommunications Transmission (D304) and Internet (D322) ONLY;

(5) S, Utilities ONLY;

(6) V, Freight and Shipping ONLY.

The contractor is required to completely fill in all required data fields using the following web address:

https://www.ecmra.mil.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://www.ecmra.mil.

For purposes of ECMRA reporting, the Product Service Code applicable to the contract/order is

J059 (MAINT/REPAIR/REBUILD OF EQUIPMENT- ELECTRICAL AND ELECTRONIC

EQUIPMENT COMPONENTS)

15.