Attachment_01_-_AUTEC_Performance_Work_Statement_(PWS)_16.5.doc

1.0 Background

The Atlantic Undersea Test and Evaluation Center (AUTEC) is the U.S. Navy’s Large-Area, Deep-Water, Undersea T&E Range within DoD’s Major Range & Test Facility Base (MRTFB). The range is located at Andros Island, Commonwealth of the Bahamas (AUTEC/Andros). The selected offeror will assume a legacy of Management and Operation (M&O) of AUTEC Business, Base and Test operations going back 50 years. The offeror shall supply a highly capable technical workforce who will operate and maintain unique tracking and instrumentation systems to support Navy Developmental and Fleet Training and Readiness missions. In addition, the contractor will be responsible for operating a self-sufficient one square mile Navy outpost.

The primary Government Operational Areas (OP Areas) are located in the Tongue of the Ocean (TOTO) in the Bahamas. The test range area encompasses the air, surface, and underwater space adjacent to the east coast of Andros Island, extending approximately 45 miles southeastward from Site 1 (located near Fresh Creek), and from 5 to 20 miles seaward from shore. The instrumented facilities available to support range operations are located ashore at AUTEC/Andros Site 1 and downrange at AUTEC/Andros Site 2. Downrange Sites 3, 4 and 7 are closed and are monitored periodically and only minor maintenance is tasked. The downrange sites (Sites 2, 3, 4, and 7) are located 15 to 50 miles southward from Site 1 and are spaced approximately 8 to 15 miles apart. Site 2 is the only site accessible by road from Site 1. All downrange sites, including Site 2, are accessible by sea and helicopter; and landing pads are provided at all sites.

Underwater research, testing, and evaluation of anti-submarine weapons, sonar tracking and communications are the predominant activities conducted at AUTEC. AUTEC supports Developmental Operational T&E threshold decisions regarding performance of undersea warfare systems coincident on Anti-Submarine Warfare (ASW) platforms operating in multiple areas. AUTEC provides unique instrumentation and measurement systems for the safe conduct of dynamic real-time operations with platforms, vehicle, and weapon systems. AUTEC also supports fleet assessment and readiness exercises.

Test Operations are primarily conducted on AUTEC/Andros Range systems which are normally operated at fixed locations. AUTEC/Andros Sites 1 and 2 house various Range instrumentation systems including Radio Frequency (RF) communications; microwave communications; timing; in-water, in-air, Global Positioning System (GPS), and radar tracking systems; digital signal processors; and electronic warfare systems and equipment.

2.0 Scope

Enterprise Operations

Enterprise Operations encompasses all functions relative to General Information Management and Services sustaining AUTEC in the performance of its mission.

The contract technical requirements are presented within the PWS. Citations are introduced throughout the PWS to provide additional specification of the tasking. The citations within the PWS are not intended to present revision or document issuance information. Contract Attachment 03 (List of PWS Citations and References) presents the revision and issuance data for contract administration. Attachment 03 will be updated periodically throughout the life of the contract to maintain tasking currency.

AUTEC requires contractors to provide all of the security services specified in the PWS. The scope of the services will vary depending on the location of the service, whether it is provided at AUTEC/Andros or AUTEC/WPB. In all instances, the contractor tasking is within the AUTEC Security Program, which encompasses physical security, information security, cyber security, operations security, industrial security and personnel security at all AUTEC facilities. The Government is always responsible for law enforcement and investigative functions.

The contractor has varying roles and responsibilities within configuration management tasking. They provide support to the Government in the administration of the AUTEC Configuration Management Plan. The contractor is also designated Design Agent for systems and components in Attachment 05 - AUTEC Configuration Item List, as such they are required to initiate, design and document changes to those systems through the AUTEC CM process. Lastly, the contractor supports integration and testing of all changes to AUTEC systems as approved by the AUTEC CCB’s.

Test Operations Test Operations are conducted based upon requirements set in Government provided test plans. The contractor reviews test plans as they are being developed and provides comments prior to Government issuance of the Test Plans. The contractor makes internal preparations to support the Test Plans requirements and communicates those plans in the Operations Directive as tasked within the PWS.

Tests conducted on AUTEC's instrumented ranges are controlled and directed from the Command Control Building (CCB) at Site 1 on Andros Island. Track data is collected from in-water and in-air instrumentation systems. Using track information, the movement of participating and non-participating units is monitored and used for the production of data products. The AUTEC/Andros instrumented ranges include the Deep Water Weapons Range (North and South), and the Naval Forces Weapon and Sensor Accuracy Check Site (FORACS) Range.

The contractor has responsibilities in pre- and post-test operations on a variety of exercise weapons, unmanned vehicles, and targets used on the Range. The handling of ordnance is critical in the performance of these PWS tasks requiring strict adherence to the cited documentation to assure safe operations. The contractor conducts specified launch and recovery operations also focused on safety.

Acoustic pinger systems consists of an electronic device powering a transducer that transmits acoustic signals into the water for on-range tracking of weapons (light and heavy weight weapons), MK-30 targets, and vessels. The contractor is tasked to provide vessel installations, removals, and rechecks at locations such as Groton, CT, Norfolk, VA, Kings Bay, GA, Port Canaveral, FL, and Port Everglades, FL.

The AUTEC marine vessels are operated by the contractor to support deployment of targets, deployment of lightweight and heavyweight torpedoes, recovery of expended torpedoes, personnel transfer, and various logistics functions. The vessels are maintained by the contractor so they are ready for use in accordance with the AUTEC Test schedule.

The contractor is tasked with providing Heavy-lift Helicopter Services as captured in the PWS. Two S-61N Heavy Lift Helicopters are available for purchase by the successful offeror from the incumbent. If purchased, an H-clause defines the constraints for operating and maintaining these platforms.

Base Operations

AUTEC/Andros Sites 1 and 2 are fully self-sufficient installations. Major logistics and support functions such as permanent party and transient housing, food service operations, base utilities, facility maintenance and repair, and transportation are key elements of the scope of work.

Public Works encompass all functions relative to Maintenance and Repair, Utilities and Transportation required to sustain AUTEC/Andros in the performance of its mission and ensuring the welfare of assigned personnel.

Maintenance is construed to mean recurring, periodic, or scheduled work and inspections required to preserve the condition, operability, safety, habitability, or appearance of such property or equipment, so as to ensure its continued serviceability for its designated purpose.

Repair is the correction of a condition, resulting from deterioration or breakage, which detracts from or precludes such serviceability and restores a facility or equipment to such condition that it may be effectively and efficiently utilized for its designed purpose.

Construction is the erection, installation or assembly of a new, real property facility; or the addition, expansion, extension, alteration, conversion, or replacement of an existing real property facility; or the relocation of real property facility.

The Contractor is tasked to provide maintenance, repair, and minor construction of real property and grounds for AUTEC/Andros sites.

AUTEC’s electric power is furnished by six 870 kW, 4160V diesel-powered generator sets (GENSETS) and a 1 MW wind turbine. Generators are turned on and off as appropriate when load demands change throughout the day. Two to three generators are in use during non-peak hours and three to four are in use during peak hours.

Potable water at AUTEC is produced by a Reverse Osmosis plant which takes raw (untreated) water from wells, an intrusion trench system and Catchment Basin and produces up to 2.8 million gallons of potable water per month.

AUTEC/Andros receives fuel (diesel, MOGAS and avjet) from tankers at Site 1’s Harrison Wharf and diesel by tanker at Site 2. The fuel is transferred through pipelines to their respective storage tanks and distributed to various users via direct pipeline, fuel caddy, fuel truck or at the gas station. The fuel used at AUTEC belongs to Defense Logistics Agency Energy (DLA-E) until it is issued from inventory/sold to AUTEC personnel and other authorized users. DLA-E requires meticulous record keeping of all fuel transactions and inventories. The infrastructure associated with fuel (pipeline, storage tanks, etc.) also belong to DLA-E who is responsible for its repair and major maintenance.

AUTEC maintains various items of aircraft Ground Support Equipment (GSE) in a ready-for-issue status for use by visiting range user helicopter squadron personnel. AUTEC is an Organizational-Level maintenance facility for this equipment. Items with repair needs that exceed Organizational-Level maintenance are sent to the Aircraft Intermediate Maintenance Department (AIMD), Mayport, FL.

Logistics encompasses all functions relative to acquisition, delivery, warehousing, and control/disposition of Government-furnished property. Due to AUTEC Andros Island’s remote location, all food, supplies and material are shipped to and from AUTEC/Andros by a Military Sealift Command (MSC) barge from Cape Canaveral, FL. At Cape Canaveral, all contract acquired/government property is received, inspected and manifested by the Contractor before being loaded onto the barge by Surface Distribution and Deployment Command (SDDC, who also unload the barge at Cape Canaveral). On AUTEC/Andros, these efforts are performed by the Contractor.

Transient housing is available at AUTEC/Andros, for authorized visitors with rates determined by the Government. Permanent Party Housing is provided for permanently assigned Government, Contractor and Navy personnel.

Food services are provided at AUTEC/Andros Site 1 with meal costs determined by the Government and on range vessels for extended underway operations. All food is shipped to AUTEC/Andros once a week, via the Military Sealift Command (MSC) barge, from Port Canaveral, FL.

AUTEC/Andros does not have an Environmental Protection Agency (EPA) permitted Treatment, Storage and Disposal Facility (TSDF). AUTEC does, however, provide various hazardous waste accumulation points and storage areas on Andros Island. Hazardous waste is collected separately and returned to CONUS through Defense Logistics Agency for disposal.

The predominance of workforce will be located at the Navy facilities on AUTEC/Andros. There are some functions identified in Contract Attachment 09 (Workload Factors) that are anticipated to be performed in the AUTEC/West Palm Beach Headquarters (AUTEC/WPB) location. Work not required to be performed in Government provided facilities is anticipated to be performed in Contractor spaces as proposed in response to the AUTEC RFP.

The AUTEC contractor normally performs persistent work for the contract at AUTEC/Andros, AUTEC/WPB, Port Canaveral FL, and Yorktown VA. The Contractor normally performs work for the contract at the following temporary duty locations Bahamas (Freeport), Fort Pierce FL, Jacksonville FL, Groton CT, Norfolk VA, Kings Bay GA, San Diego CA, Keyport WA, Kauai HI, Honolulu HI, Newport RI, Mayport FL, Norway, Greece, Belgium and Canada. Contractor temporary duty requirements will be communicated through test plans and technical instructions and Contractor may be tasked to perform test operation functions in these locations ir other currently unspecified locations.

3.0 Applicable Documents

For a list of all applicable documents, see Attachment 3, List of PWS Citations and References. The contractor performs contract tasking in accordance with the latest revision of each document. Attachment 03 will be updated by the Government annually or otherwise as needed.

4.0 ATLANTIC UNDERSEA TEST AND EVALUATION CENTER (AUTEC) requirements

4.1 AUTEC Enterprise

4.1.1 Program Management

Government inspections

Government audits Audit Plans

Customer feedback Contractor metrics Contractor self-assessment

4.1.1.1 The Contractor shall issue a Program Management plan that defines their approach to the entire contract inclusive of manning structure, risk and opportunity planning, work control, quality control, teaming arrangements, property management, and Government provided fuel, Air-taxi service, and cargo. The Program Management plan shall be delivered to the Government with a pass/fail criteria assigned. [Contract Data Requirements List (CDRL) A001]

4.1.1.2 The Contractor shall have a Continuity of Operations Program (COOP) Plan that includes a Hurricane Operating Procedure for AUTEC/Andros and AUTEC/West Palm Beach (WPB) facilities. The Plan shall address maintaining operations to the maximum extent practicable in the face of deteriorating conditions while always maintaining safety and security of facility and personnel. The Contractor shall address reconstitution of the Range at full performance at the conclusion of the event. The Contractor shall simulate the exercise of the COOP Plan and Hurricane Operating Procedure during Navy drills at AUTEC/Andros and AUTEC/WPB facilities. [CDRL A002]

4.1.1.2.1 For all assigned tasks, the contractor shall prepare a Contractor’s Status Report that indicates the progress of work, status of the program(s), and existing or potential problem areas. The contractor shall submit the Contract Status Report for the same timeframe as each invoice submitted in the Invoicing, Receipt, Acceptance, and Property Transfer (iRAPT) module of Wide Area Work Flow (WAWF). Contract status report shall include all cost reimbursement and fixed price CLINS. [CDRL A003]

4.1.1.2.2 The Contractor shall submit an acknowledgement narrative summary in response to areas of concern addressed in the preceding three month period assessment of Contractor performance as part of the Award Fee process. [CDRL A004]

4.1.1.2.3 The Contractor shall conduct and host a quarterly Program Management Review (PMR). At a minimum, the PMR shall address program status, actual costs against planned costs, risks and opportunities, and areas requiring management attention.

4.1.1.2.4 The Contractor shall provide a Balance of Payments report. [CDRL A005]

4.1.2 Oversight and Accountability

Government audits Audit Plans

Customer feedback

4.1.2.1 The Contractor shall prepare and maintain a Contractor Work Breakdown Structure (CWBS) to depict all contract costs to include variable and fixed costs, direct and indirect costs, recurring and nonrecurring costs, and inflationary and other cost-growth factors. The Contractor shall produce a CWBS that is directly compatible with Attachment 10, “AUTEC WBS”, the Performance Work Statement (PWS) and the Government Fiscal Year (GFY). [CDRL A006]

4.1.2.1.1 The Contractor shall ensure that the CWBS is consistent with Attachment 10, “AUTEC WBS”. The Contractor shall use a single numbering system based on the PWS.

4.1.2.2 The Contractor shall employ the CWBS as the basis for contract planning associated with budgeting, estimating and proposals in response to contract change requests made by the Government. Cost reporting, including actuals versus budget must also be made per the CWBS.

4.1.2.3 The Contractor shall provide cost estimates when requested by the Contracting Officer for future tasks that will be directed by Technical Instruction (TI) or contract modifications.

4.1.2.4 The Contractor shall accrue all costs for TIs within 60 days of completion date.

4.1.2.5 The Contractor shall deliver CDRLs per Exhibit A.

4.1.2.5.1 The Contractor shall provide narrative overview of cost control initiatives undertaken by Specification Chapter, achievements, variances, and cost recoveries realized. A table of costs at the voucher line item level, comparing contract amount, monthly (and quarterly) actual, year-to-date actual), estimate to completion, and variance between the contract and Estimate to Complete (ETC) amount for all voucher costs shall be provided. The quarterly update shall include an analysis of the original contract year plan versus the current projected cost and an explanation for the need for the revision from the original plan. Detailed information shall be provided by Specification Chapter/Section. Data supporting fringe rate changes will be included when they occur. [CDRL A007]

4.1.2.5.2 The Contractor shall provide a detailed current month cost and labor data summarized by TI. [CDRL A008]

4.1.2.6 The Contractor shall collect metric data in accordance with data collection plans to self-assess performance against all Acceptable Quality Levels (AQLs) in this Performance Work Statement. The Government will provide data collection plans at the time of contract award. The contractor shall upload data for all data collection plans on a monthly basis to a location accessible by the Government work force. [CDRL A00G]

4.1.3 Business Operations

Government audits Audit Plans

Customer feedback

4.1.3.1 The Contractor shall comply with all logistical, informational, and data requests as a result of external or internal audit or inspection required per TIs.

4.1.3.2 The Contractor shall pay any applicable fees (dockage, immigration, and customs) necessary to perform contract tasking. Reasonable costs of such fees are allowable expenses under this contract.

4.1.3.2.1 The Contractor shall identify all applicable fees charged by external organizations in the execution of this contract. The Contractor shall validate the accuracy of those fees charged and notify the AUTEC Contracting Officer’s Representative (COR) of any discrepancies that cannot be resolved. The Contractor shall report to COR that Customs charges submitted by the Bahamian Government are in accordance with Attachment 06 – Bahamas AUTEC Agreement. The Contractor shall report to COR that Customs charges reflect time periods during which vessels were at the dock.

4.1.3.3 The Contractor shall make arrangements to accept major credit cards including current US Government-contracted commercial cards for cost recovery services rendered for which payment is required to be collected by the Contractor on behalf of the Government. Acceptance of the cards shall be in accordance with standard commercial practices, and associated costs shall be reimbursable as allowable costs under this contract.

4.1.3.4 The Contractor shall ensure that the contract is adequately staffed (including subcontracts) and, where required, ensure that employees meet all certification, licensing, experience, and training requirements for the position occupied.

4.1.3.5 The Contractor shall maintain records of training, certification, and licensing for each individual.

4.1.3.6 The Contractor shall obtain licenses and permits required for contractor staffing associated with the performance of any work under this contract.

4.1.3.7 The Contractor shall ensure that all employees, including newly hired employees and subcontractors, receive required DoD and DoN Required Information Security training and that adequate recordkeeping of the training is maintained.

4.1.3.8 AUTEC, Andros Island, Commonwealth of the Bahamas, is a remote site and is not equipped to provide in-depth care for persons with chronic health problems, or whose health may otherwise be at risk. Accordingly, the Contractor shall conduct medical examinations and review medical history sufficiently thorough to identify dental or medical problems the treatment of which, either on a routine or emergency basis, would exceed AUTEC/Andros medical treatment capabilities, would require frequent referral off-site, or falls within a high risk category. The Contractor shall make a specific determination as to whether an individual is medically qualified to perform his or her occupational duties or if a medical condition exists which disqualifies the individual for AUTEC/Andros employment.

4.1.4 AUTEC Electronic Data

4.1.4.1 AUTEC Integrated Data Management System (AIDMS) (Government hosted, mil domain)

Government audits Audit Plans

Customer feedback

4.1.4.1.1 AUTEC is transitioning to Navy Marine Corp Internet (NMCI) and Government hosted cloud-based management system. The Contractor shall organize and maintain the information contained in this Government hosted cloud-based management system. The Contractor shall comply with Department of Defense (DoD), Navy and NAVSEA policies regarding the release of information to the public per NUWCDIVNPTINST 5570.1; Public Release of Unclassified Technical Information and the DD254, Contract Security Classification Specification.

4.1.4.1.2 The contract shall propose a document format standard for all content generated in performance of contractual obligations. The proposal can include more than one standard as best fits the document purpose. Once the Government approves the proposed format(s), the Contractor shall adhere to the format specification until a new proposal is adopted. It will be the responsibility of the Contractor to convert any external documents provided by the Contractor to the standard formats. Externally provided documents (DoD or Commercial sources) can be archived in their original format, but should be converted to the Government approved document format standard (if possible) in order to minimize end user conversions.

4.1.4.2 Electronic Data Interchange (EDI) (Contractor hosted, Commercial domain)

4.1.4.2.1 The Contractor shall implement and maintain a seamless EDI Network utilizing web-enabled technology to provide continuously available, secure, encrypted remote access to the Government for all draft or completed data item archives and the CDRL as well as all other working data, including subcontractor data, developed to support the management and engineering efforts of the program. The Contractor shall establish an EDI Network capable of fully supporting Government access to information within ten business days of contract award. The AUTEC program office will provide a list of authorized personnel for access to the Contractor's database after contract award. The Contractor shall provide the Government a user’s guide to include a system map. The Contractor's information shall be compatible with typical Government PC-based systems using the MS Office suite of applications (e.g., Word, Excel, and PowerPoint) as well as Adobe Acrobat. Organize the documentation per the CDRL requirements. [CDRL A009]

4.1.4.2.2 The Contractor shall provide controlled access to AUTEC Government personnel on EDI via Common Access Card.

4.1.4.2.3 The Contractor shall ensure that EDI data conforms to DoD Cyber Security (CS) regulations.

4.1.4.2.4 The Contractor shall clearly mark any data that is proprietary to the Contractor and deliver separately from non-proprietary data.

4.1.5 AUTEC Audio/Visual Systems

4.1.5.1 The Contractor shall conduct digital imaging photography, audio, and video programming as required by TIs for official business and per NUWCDIVNPTINST 5200.4; NUWCDIVNPT Publications and Presentations Guide and NUWCDIVNPTINST 5500_4; NUWC DIV NPT Security Manual.

4.1.5.2 The Contractor shall produce and edit official programming material based upon AUTEC or contractor content (such as commercial, public, and Government live and recorded local, general and emergency information) to broadcast local information on AUTEC/Andros Closed-Circuit Cable Television (CCTV) system Channel 4. The Contractor shall comply with DoD, Navy and NAVSEA policies regarding the release of information to the public per NUWCDIVNPTINST 5570.1; Public Release of Unclassified Technical Information.

4.1.5.3 The Contractor shall continually schedule, operate, and maintain the calendar for the Navy Video Teleconferencing Centers (VTCs) located in AUTEC/WPB and AUTEC/Andros Site 1 per NUWCDIVNPTINST 2300.4A; Management of Telecommunications Systems and Services.

4.1.6 Program Documentation Support

Government audits Audit Plans

Customer feedback

4.1.6.1 The Contractor shall review and technically edit Operating Control Directives (OCD) per OCD (15.4)-05-XX; Preparation and Control of OCDs. The Contractor shall make recommendations for improvements or efficiencies to existing processes when identified, for Government consideration for incorporation into future document revisions. [CDRL A00A]

4.1.6.2 The Contractor shall create and maintain a technical library of all technical documentation for all AUTEC equipment, Andros facilities, and AUTEC Configuration Items. Technical documentation includes Operating Instructions, Maintenance Instructions, Operations Control Directives, Standard Procedures (SPs), AUTEC Plans, technical procedures, system drawings, vendor points of contact, hardware and software utilities/ applications, and any other procedures developed in the performance of this contract on AIDMS. The Contractor shall summarize new documents or changes to existing documentation as they occur and deliver the summary to the Government. The Contractor shall make available electronically, all existing documentation, changes to existing documentation, and newly generated documentation for the AUTEC project other than those considered to be internal/proprietary, at the time of contract award; within 30 days of generation [CDRL A00B]

4.1.6.2.1 The Contractor shall deliver changes to Contractor technical documentation. The contractor shall make available all existing SPs other than those considered to be internal/proprietary, at the time of contract award and any newly generated SPs for the AUTEC Project, other than those considered to be internal/proprietary, within 30 days of SP generation. [CDRL A00C]

4.1.6.3 The Contractor shall use applicable Distribution Statements and other markings as outlined in DoDM 5200-01, Volume 4, DoD Information Security Program; Controlled Unclassified Information, and maintain, receipt, catalog, and control distribution of all AUTEC drawings, subscriptions, and publications provided or developed under this contract.

4.1.6.4 The Contractor shall maintain a hardcopy library comprised of nautical charts and overlays located at AUTEC/Andros and AUTEC/WPB. The library shall be up to date, accurate and accessible during standard AUTEC business hours.

4.1.6.5 The Contractor shall manage a mail room to track and distribute all Government and Contractor addressed internal and external incoming and outgoing mail, at AUTEC/WPB following appropriate security guidelines for classification, identification, marking, and safeguarding per SECNAV M-5210.1, DoN Records Management Program - Records Management Manual, and SECNAV M-5210.2; DoN Standard Subject Identification Code (SSIC) Manual.

4.1.6.6 The Contractor shall file all official AUTEC Government correspondence received at AUTEC/WPB in the central filing system at AUTEC/WPB following appropriate security guidelines for classification, identification, marking, and safeguarding per SECNAV M-5210.1; DoN Records Management Program - Records Management Manual.

4.1.7 Security

Government audits Audit Plans

Customer feedback

4.1.7.1 Personnel Security

Government audits Audit Plans

Customer feedback

4.1.7.1.1 The Contractor shall maintain Security clearances for AUTEC Contractor employees per SECNAV 5510.36; DoN Information Security Program (ISP) Instruction and as specified in DD Form 254 – DoD Contract Security Classification Specification; DoD 5200.22-M National Industrial Security Program Operating Manual.

4.1.7.1.2 All Contractor personnel shall have and maintain a security clearance per established DoD personnel security requirements for routine and privileged access to Government information systems and physical access to facilities and locations supporting the project.

4.1.7.1.3 The Contractor shall input data for all of its employed personnel (Andros Island, WPB, and remote locations) into the NUWCDIVNPT Contractor Check-in/Check-out (CCICO) database and will submit annual visit requests via CCICO and Joint Personnel Adjudication System (JPAS) for their assigned Contractor personnel. The Contractor will manage visit requests submitted via JPAS, Navy International Program Office (NIPO) and other approved means to issue badges to official visitors and authorized travelers.

4.1.7.1.4 The Contractor shall make requests via the System Authorization Access Request - Navy (SAAR-N) to the AUTEC COR, coordinated with the NUWC Det AUTEC Security POC for badging, IT access, and Common Access Cards (CAC) for approval by the Government. The Contractor shall return badges, CACs, and other Government furnished badging equipment to the Government when no longer required.

4.1.7.2 Industrial Security/Information Security

Government audits Audit Plans

Customer feedback Contractor metrics

DSS Reports

4.1.7.2.1 The Contractor shall control and protect any U.S. Government, Foreign Government, and North Atlantic Treaty organization (NATO) marked information and hardware it comes into contact with during contract performance per SECNAV 5510.36; DoN Information Security Program (ISP) Instruction, DoDM 5200.01_Vol3, DoD Information Security Program - Protection of Classified Information, DoDM 5200.01, Vol4, DoD Information Security Program - Controlled Unclassified Information (CUI) and DoD ADMIN INST AI 27; Control of NATO Classified Documents, and OPNAVINST 5510.100 United States Security Authority for North Atlantic Treaty Affairs (USSAN) Instruction 1-07, Implementation of Alternative Compensatory Control Measures (ACCM)/NATO Security Requirements (as stipulated in DD Form 254 – DoD Contract Security Classification Specification); DoD 5220.22-M National Industrial Security Program Operating Manual, and comply with the Privacy Act and Personal Identifiable Information (PII) protection, distribution, transmission, breach handling and reporting requirements.

4.1.7.2.2 The Contractor shall account for, store, transfer, transmit, track, courier, and protect classified and unclassified information, hardware and equipment for U.S. Government, Foreign Government, and NATO between and within AUTEC's facilities and sites to U.S. and foreign Range Users, other U.S. Navy commands and to other Government or appropriate agencies during contract performance.

4.1.7.2.3 The Contractor shall use the NUWCDIVNPT Base Inventory Tracking System (BITS) to track all classified information/media, and conduct an annual inventory of all classified material assigned to the Contractor at AUTEC/Andros and AUTEC/WPB facilities.

4.1.7.2.4 The Contractor shall maintain an accurate inventory of General Services Administration (GSA) security containers approved to store classified material assigned to the Contractor at AUTEC/Andros and AUTEC/WPB facilities.

4.1.7.2.5 The Contractor shall notify the AUTEC Government Security Manager of all security infractions and security violations involving classified information upon discovery.

4.1.7.2.6 The Contractor will apply definitive classification markings when reproducing, extracting, or summarizing classified information.

4.1.7.3 Physical Security

Government audits Audit Plans

Customer feedback

4.1.7.3.1 The Contractor shall provide ongoing pass and identification services for control of access to the NUWCDET AUTEC installation and facilities on Andros Island, Bahamas and West Palm Beach, FL per NUWCDETAUTECINST 5530.4; NUWC DET AUTEC Access and Visitor Control Program, and as specified for System of Records such as, but not limited to, the JPAS.

4.1.7.3.1.1 The Contractor office responsible for pass and identification services shall register pets, privately owned motorized vehicles, private vessels and bicycles per NUWCDETAUTECINST M-11200.5, AUTEC TRAFFIC MANUAL, and NUWCDETAUTECINST 10570.1: Control of Feral and Domesticated Animals at AUTEC.

4.1.7.3.2 The Contractor shall operate and maintain the Automated Physical Access Control System (APACS) and Electronic Security System (ESS) at AUTEC/Andros and AUTEC/WPB and provide compensatory measures to mitigate risks during outages.

4.1.7.3.3 The Contractor shall create and issue CAC for Contractors as approved by the Government and create and issue CACs for DoD personnel as required by DoD INST1000, Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and Other Eligible Individuals.

4.1.7.3.4 The Contractor shall provide unarmed, uniformed entry control personnel at AUTEC/Andros to provide continuous 24/7 access control, CCTV surveillance, and alarm monitoring. The Contractor shall provide personnel to operate a consolidated certified dispatch center (Dispatch) at AUTEC/Andros. Dispatch will provide continuous 24/7 CCTV surveillance, alarm monitoring, receipt of routine calls for service and dispatch of appropriate first responders during routine and emergency calls for service on Andros Island, Bahamas. The Contractor shall provide unarmed, uniformed entry control personnel at AUTEC/WPB to provide access control, continuous 24/7 CCTV surveillance, alarm monitoring, utilization of X-Ray scanning equipment, conduct and annotate physical checks of Level One and Level Two Restricted Areas, and in process of routine and emergency calls make record of, prioritize and notify the appropriate first responders per the functions contained in NUWCDETAUTECINST 5530_1; AUTEC Physical Security and Law Enforcement Manual, OPNAVINST 5530.14; Navy Physical Security and Law Enforcement Program, and NTTP 3-07.2.3; Law Enforcement and Physical Security for service on Andros Island, Bahamas.

4.1.7.3.5 The Contractor shall maintain a record (Desk/Journal) of all calls made and received by Security, and of events and actions taken as they occur during each shift.

4.1.7.3.6 The Contractor shall create and maintain an Incident Notification Matrix and shall notify the Navy Security Force (NSF) Watch Commander, the NSF Security Officer and NUWC Security Manager of all reportable incidents as they are received.

4.1.7.3.7 The Contractor shall support Navy Anti-Terrorism/Force Protection (AT/FP), and real-world incidents at AUTEC/Andros and AUTEC/WPB locations.

4.1.7.3.8 Per Department of Homeland Security; Risk Management Process for Federal Facilities; An Interagency Security Committee Standard, the Contractor shall support and comply with the AUTEC; Occupant Emergency Plan at AUTEC/WPB.

4.1.7.3.9 The Contractor shall control access to and provide protection of Level One and Level Two Restricted Areas per OPNAVINST 5530.14; Navy Physical Security and Law Enforcement Program, NTTP 3-07.2.3; Law Enforcement and Physical Security, and SECNAV 5510.36; DoN Information Security Program (ISP) Instruction. The Contractor role is not a law enforcement function.

4.1.7.3.10 The Contractor shall conduct and annotate Physical Security checks of designated Level One and Level Two restricted areas and Protective Distribution System (PDS) as outlined in OPNAVINST 5530.14; Navy Physical Security and Law Enforcement Program, NTTP 3-07.2.3; Law Enforcement and Physical Security, SECNAV 5510.36; DoN Information Security Program (ISP) Instruction and IA-Pub 5239-22 Information Assurance Protected Distribution System (PDS) Publication. The Contractor role is not a law enforcement function.

4.1.7.3.11 The Contractor shall conduct monthly alarm system verification of functionality for spaces and buildings, and report discrepancies to the Government.

4.1.7.4 Operational Security

Government audits Audit Plans

Customer feedback

4.1.7.4.1 The Contractor shall perform its contractual obligations per DD Form 254 and NUWCDETAUTECINST 3070.1; AUTEC OPSEC Plan, for protection of classified and unclassified information and procedures.

4.1.7.4.1.1 The Contractor shall be responsible for following appropriate security guidelines for classification, identification, marking, safeguarding, storing, packaging, and distribution of photographic/video material per SECNAV 5510.36; DoN Information Security Program (ISP) Instruction, DoDM 5200.01_Vol3, DoD Information Security Program - Protection of Classified Information, DoDM 5200.01, Vol4, DoD Information Security Program - Controlled Unclassified Information (CUI) and DoD ADMIN INST AI 27; Control of NATO Classified Documents, and OPNAVINST 5510.100D United States Security Authority for North Atlantic Treaty Affairs (USSAN) Instruction 1-07, Implementation of NATO Security Requirements (as stipulated in DD Form 254 – DoD Contract Security Classification Specification).

4.1.7.5 Cyber Security

Periodic Sampling

Government inspections

Government audits

Audit Plans

Customer feedback

Contractor metrics Contractor self-assessment

Periodic Sampling

Government inspections

Government audits

Audit Plans

Customer feedback

Contractor metrics Contractor self-assessment

Periodic Sampling

Government inspections

Government audits

Audit Plans

Customer feedback

Contractor metrics Contractor self-assessment

Government audits

Audit Plans

Customer feedback

4.1.7.5.1 The Contractor shall familiarize itself with all applicable DoD and Department of Navy (DoN) Cyber Security documents as outlined in “Cyber Security Reference Documents List – AUTEC GFI”, and determine their applicability/impact to maintain each AUTEC Information System’s Assessment and Authorization (A&A) (Configuration Item (CI) 1.0 through CI 5.2). The contractor shall provide updates to the “Cyber Security Reference Documents List – AUTEC GFI” annually. [CDRL A00D]

4.1.7.5.2 The Contractor shall monitor all applicable documents and notify the Government of any changes to the documents which would cause an impact to AUTEC systems, and an estimate of the scope of the impact.

4.1.7.5.3 The Contractor shall maintain all AUTEC Information Systems (CI 1.0 through 5.2) in accordance with AUTEC Information Systems Security Manager (ISSM) or NUWC DIV ISSM identified applicable DoD and DoN Cyber Security regulations.

4.1.7.5.4 The Contractor shall provide certified Cyber Security Workforce (CSWF) Including an ISSM and sufficient Information System Security Officer's (ISSO's) for the sustainment of the AUTEC Information Systems. [CDRL A00E] (CI 1.0 through 5.2)

4.1.7.5.5 The Contractor shall monitor and analyze user logs, trouble logs, network downtime, network usage trends, and network metrics for violations of DoD and/or Navy policies and procedures.

4.1.7.5.6 The Contractor shall identify, prioritize and coordinate the protection of critical Computer Network Defense infrastructure and key resources as determined by the AUTEC Risk Management Framework (RMF) process.

4.1.7.5.7 The Contractor shall verify that rules and signatures are updated correctly (e.g., intrusion detection/protection systems, anti-virus, and content blacklists) for specialized Computer Network Defense applications.

4.1.7.5.8 The Contractor shall upon electronic notification from NUWCDIVNPT ISSM, validate, create, edit, and manage changes to network access control lists on AUTEC Defense Research Engineering Network (DREN) connected switches and routers and RDS Systems per the AUTEC Configuration Management Plan (CMP). (CI 1.0 through CI 5.2)

4.1.7.5.9 The Contractor shall provide evidence to validate that any changes made to AUTEC systems via the AUTEC CMP are per DoD and DoN Cyber Security Regulations. (CI 1.0 through CI 5.2) [CDRL A00D]

4.1.7.5.10 The Contractor shall collect intrusion artifacts and use discovered data to enable mitigation of potential Computer Network Defense incidents at AUTEC. (CI 1.0 through CI 5.2)

4.1.7.5.11 The Contractor shall provide post cyber triage information to Navy Computer Network Defense technicians to resolve Computer Network Defense incidents.

4.1.7.5.12 The Contractor shall filter and correlate incident data to identify specific vulnerabilities and make recommendations to AUTEC ISSM to determine if a mitigation plan is required.

4.1.7.5.13 The Contractor shall employ approved Defense in Depth principles and practices per CNSSI 1253; Security Categorization and Control Selection for National Security Systems, DoDI 8500.01; Cybersecurity, applicable Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), and OPNAVINST 5239.1; Navy Information Assurance (IA) Program.

4.1.7.5.14 The Contractor shall monitor DoD and Navy cyber security information authorities (“Cyber Security Reference Documents List – AUTEC GFI”) to maintain currency of Computer Network Defense threat conditions and determine which security issues may have an impact on AUTEC networks.

4.1.7.5.15 The Contractor shall research and perform analysis of automatically logged files from individual host logs, network traffic logs, and intrusion detection systems, logs to identify possible threats to network security.

4.1.7.5.16 The Contractor shall perform Computer Network Defense incident triage per DoDI 8530.01; Cybersecurity Activities Support to DoD Network Operations to include determining scope, urgency, and potential impact; identify the specific vulnerability and make recommendations that enable expeditious remediation.

4.1.7.5.17 The Contractor shall receive and analyze network alerts from various sources within AUTEC networks (CI 1.1.2, CSCI 2.2.3.4, CI 3.2.1.1.1, CI 3.2.1.1.10, CSCI 3.2.1.3, CI 3.2.3.2.1,) and determine possible causes of such alerts.

4.1.7.5.18 The Contractor shall provide supporting documentation to Navy Criminal Investigation Service (NCIS) in response to ongoing investigations; as directed by the Contracting Officer.

4.1.7.5.19 The Contractor shall track and document local remediation efforts on Computer Network Defense incidents from initial detection through final resolution, and provide lessons learned to the AUTEC ISSM.

4.1.7.5.20 The Contractor shall conduct required annual reviews within environment for CIs 1.0-4.0 as prescribed by CJCSINST 6510_01; Info Assurance and Support to Computer Network Defense, DISN_CPG; DISN Connection Process Guide, and DODM 5200-01-vol1 DoD Information Security Program - Overview Classification_Declassification; DODM 5200-01-vol2 DoD Information Security Program - Marking of Classified Information, DoDM 5200.01-vol3; DoD Information Security Program - Protection of Classified Information, DoDM 5200.01-vol4; DoD Information Security Program – Controlled Unclassified Information (CUI), and DoDI 8510.01; Risk Management Framework for DoD Information Technology.

4.1.7.5.21 The Contractor shall perform an annual review of all information systems at AUTEC with specific focus on Cyber Security to include technical evaluation of technology and non-technical evaluation of People, Operational Risks and Vulnerability Assessments.

4.1.7.5.22 The Contractor shall prepare audit reports that identify technical and procedural findings and provide recommended remediation strategies and solutions to the AUTEC ISSM to determine required response action to maintain A&A. (CDRL A00D)

4.1.7.5.23 The Contractor shall develop a process for the install and maintain AUTEC Information Technology (IT) configuration in compliance with current DISA STIGs per DoDI 8500.01 Cybersecurity.

4.1.7.5.24 The Contractor shall draft statements of preliminary or residual security risks for system operation per DoDI 8510.01; Risk Management Framework for DoD Information Technology.

4.1.7.5.25 The Contractor shall continuously monitor approved AUTEC systems to confirm the level of risk is within limits approved by Operational Designated Approving Authority (ODAA).

4.1.7.5.26 The Contractor shall develop and update information systems assurance and accreditation materials and categorize systems per CNSSI 1253; Security Categorization and Control Selection for National Security Systems, NAVSEA Business Rules; NAVSEA RDTE Interim Assessment & Authorization Business Rules, and NAVSEA Business Rules IntVer1.0; NAVSEA eMASS PIT Assessment and Authorization BRs for Non-Afloat Systems.

4.1.7.5.27 The Contractor shall develop, maintain, and track risk assessment plans for CI 3.2.1.1.1, CI 3.2.1.2, CI 3.2.1.4.1, CI 3.2.2.1, CI 3.2.3.2.1, CI 3.2.3.4, CSCI 3.2.3.6, CI 3.2.4.2 Assessment Packages will be delivered to the appropriate Certified Navy validator for validation 145 days prior to expiration of Authority to Operate (ATO) as prescribed NAVSEA RDTE Interim Assessment & Authorization Business Rules, and NAVSEA Business Rules IntVer1.0; and NAVSEA eMASS PIT Assessment and Authorization BRs for Non-Afloat Systems. The Contractor shall correct Assessment Packages or Waiver Packages returned by NUWC, NAVSEA, or NETWARCOM for corrective action will be returned to NUWCDETAUTEC within 5 days.

4.1.7.5.28 The Contractor shall plan and conduct security authorization reviews and assurance case development for initial installation of software applications, systems, and networks in order to create A&A package. All A&A packages shall include continuity of operations planning.

4.1.7.5.29 The Contractor shall recommend new or revised security, resilience, and dependability measures based on the results of reviews to the ISSM to determine required response action to maintain A&A.

4.1.7.5.30 The Contractor shall verify A&A documentation in eMass authorizes use for all third party systems used at AUTEC.

4.1.7.5.31 The Contractor shall verify application software/network/system security compliance postures are implemented, document deviations from applicable STIGs, and recommend required actions to the ISSM to correct those deviations.

4.1.7.5.32 The Contractor shall continually monitor the Host Based Security System (HBSS) and process incident responses to alerts per NUWCDIVNPT Cyber Security Program Manual.

4.1.7.5.33 The Contractor shall continually audit the centralized logging system for compliance with STIG.

4.1.7.5.34 The Contractor shall produce auditable evidence of security measures, reviews, and STIG checklists. [CDRL A00D]

4.1.7.5.35 The Contractor shall advise ISSM of changes negatively affecting the organization's Cyber Security posture of AUTEC Systems.

4.1.7.5.36 The Contractor…