I. G. Statement of Work_Cybersecurity_FINAL.pdf

STATEMENT OF WORK (SOW)

MK 66 Mod 0 Heavyweight Undersea Training Target (MK 66 HUTT)

1.0 Background

The Undersea Weapons Program Office (PMS404) has tasked the Naval Undersea Warfare Center Division Newport (NUWCDIVNPT), Code 85, to field the MK 66 Mod 0 Heavyweight Undersea Training Target (HUTT) to the Maintenance Activities (MA), conduct engineering services for future upgrades and enhancements, establish a logistics program, and procure production units. The SAAB AUV62-AT is a commercially available Anti- Submarine Warfare (ASW) training target that will provide the fleet with an improved and realistic ASW target for on range and open ocean use. The SAAB AUV62-AT will form the baseline MK 66 Mod 0 capability with minor modifications.

The MK 66 HUTT system is a modular, scalable, and easily configurable Autonomous Underwater Vehicle (AUV) system. The MK 66 HUTT is an artificial acoustic target that echo repeats and provides tonals that simulate a submarine target.

1.1 Places of Performance

The effort is expected to be completed primarily at the Contractor’s Facility.

1.2 Authorized Users

NUWCDIVNPT Code 85

1.3 Sponsors

PMS404 (Undersea Weapons)

1.4 Types of Funding

• Weapons Procurement, Navy (WPN)

2.0 Scope

The contractor shall deliver cybersecurity reporting for the MK 66 Heavyweight Undersea Training Target (MK 66 HUTT) program .

2.1 Program or Systems Supported

This contract supports ASW training Targets funded by PMS404.

3.0 Applicable Documents

The contractor shall perform the tasking required in Section 4.0 in accordance with (IAW) the below Applicable Documents (ADs).

Number Title Revision Date Applicable SOW Task

3.3 DoDI 8500.01, "Cybersecurity", 14 March 2014 4.2.2

3.4 DoDI 8510.01, "Risk Management Framework

(RMF) for DoD Information Technology (IT)" 19 July 2022 4.2.2

3.5 DoDM 8140.03, “Cyberspace Workforce

Qualification Program”

15 February 2023 4.2.2

3.6 NIST SP 800-53, “Security and Privacy Controls for

Information Systems and Organizations”

07 November 2023 4.2.2

3.7 System Level Continuous Monitoring (SLCM)

Strategy

04 November 2022 4.2.2

3.8 DoDD 8140.01, “Cyberspace Workforce

Management”

05 October 2020 4.2.2

3.9 DoDI 5200.39, "Critical Program Information (CPI)

Identification and Protection within the Department of Defense Research, Development, Test, and Evaluation

(RDT&E)

28 May 2015 4.2.2

4.0 Technical Requirements

The following tasks shall be performed in accordance with ADs listed in section 3.0 and using the Government Furnished Information (GFI) listed in section 6.0.

4.1.1 Cybersecurity

The contractor shall develop and deliver a Security Controls Traceability Matrix (SCTM), and a Cybersecurity Plan.

The contractor shall implement required security controls to align with the Assess Only baseline set of security controls for Platform Information Technology (PIT). The SCTM is the baseline set of security controls that the contractor shall utilize to describe how the required security controls are being implemented, or planned to be implemented, implementation status, and track compliance. The contractor shall implement continuous monitoring activities for cybersecurity vulnerabilities. The contractor shall identify and allocate resources for implementing Risk Management Framework (RMF). This effort (and associated deliverables) shall be performed throughout the life of the contract.

The contractor shall establish and maintain security measures to protect all aspects of the system to include vulnerability management to meet DoD security and Cybersecurity requirements. The contractor shall perform cybersecurity (and associated deliverables) as specified in the contract.

The contractor shall host Government Cybersecurity test events required to obtain an Authorization to Operate.

The contractor shall provide input to the Government’s System Security Plan (SSP), to provide an overview of security requirements, description of security controls, and other artifacts required to support the submittal for Authorization to Operate. The contractor shall document non-compliant results from test events in a Plan of Actions and Milestones (POA&M) along with mitigating factors. The POA&M shall be included in the SSP. .

The contractor shall ensure that personnel working in the area of cybersecurity vulnerability management are trained and appropriately certified for providing Cybersecurity functional services.

The contractor shall prepare a Cybersecurity Plan tailored to the MK66 HUTT security features which the contractor has designed into the system. The plan shall address the security measures to protect all aspects of the system.

The contractor shall deliver documentation in accordance with CDRL A001: Technical Report – Study/Services (Security Controls Traceability Matrix (SCTM))

The contractor shall deliver documentation in accordance with CDRL A002; Technical Report – Study/Services (Cybersecurity Plan)

5.0 RESERVED

6.0 Government Furnished Information

The following Government Furnished Information (GFI) will be made available under this contract.

N/A

7.0 Government Furnished Property

N/A

8.0 Quality Surveillance

The Government will conduct quality surveillance via various methods including formal and informal meetings, review of technical reports, review of monthly progress reports, and review of deliverables.

9.0 Information and Communication Technology (ICT) Accessibility Requirements

The Government has determined that this procurement is an exception to the Information and Communication Technology (ICT) Accessibility Standards (36 C.F.R. Part 1194, Appendix A). Notwithstanding that an exception exists, the Contractor may furnish items or services provided under this contract that comply with the ICT Accessibility Standards (36 C.F.R. Part 1194, Appendix A).

Exception #1 National Security for MK 66 Program

10.0 Security Compliance

10.1 Program Protection

SECURITY: All contractor personnel shall adhere to the Security provisions of 32 CFR Part 117 – National Industrial Security Program Operating Manual (NISPOM) and the security requirements of the attached DD254.

While performing work at a Government Facility, contractor personnel shall comply with the security regulations of the host facility. Applicable FAR, DFARS, NMCARS clauses, and NAVSEA text shall be adhered to in the performance of this contract. Security incidents shall be promptly reported through the companies Facility Security Officer (FSO), to the Contracting Officer’s Representative (COR), Technical Point of Contact (TPOC), and the Cognizant Security Office to NUWCDIVNPT Security.

Controlled Unclassified Information (CUI) including Legacy FOUO and Covered Defense Information (meeting the definition of 48 CFR 252.204–7012(a)) generated and/or provided under this contract shall be marked and safeguarded as specified in DoD Instruction 5200.48, CUI available at:

https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF. Any product containing Covered Defense Information shall be assigned a distribution statement (distribution statements B through F) in accordance with DoDI 5230.24 (Distribution Statements on Technical Documents); and DoDI 5230.24, Enclosure 3 Procedures, available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/523024p.pdf

INFORMATION SECURITY: If the work is performed at the contractor's facility, the contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and controlled unclassified information (CUI) and to control distribution of CUI in accordance with National Industrial Security Program Operating Manual (NISPOM) codifying 32 CFR Part 117, NISPOM Rule, and SECNAV M- 5510.36B. If the work is performed at the Government's facility, the contractor shall comply with facility policy.

CUI INCIDENT REPORTING AND RESPONSE: The contractor shall promptly report any unauthorized, inadvertent, or illegal release or disclosure of CUI to the Contracting Officer’s Representative / Technical Point of Contact (TPOC), Procuring Contracting Officer, and the Security Office. Contractor personnel shall coordinate this effort through the relevant industry site FSO.

PUBLIC RELEASE: Any controlled unclassified information pertaining to this contract shall not be released for public dissemination, including posting to any social media sites such as Facebook or Twitter, unless it has been approved for public release by appropriate U.S. Government authority. Proposed public releases shall be submitted for approval prior to release through the appropriate U.S. Government Office.

10.2 Operations Security (OPSEC)

OPSEC is a process that identifies critical information to determine if friendly actions can be observed by adversary intelligence systems, determines if information obtained by adversaries could be interpreted to be useful to them, and then executes selected measures that eliminate or reduce adversary exploitation of friendly critical information.

The contractor shall develop and implement, and update and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the contractor and any subcontractor during performance of the contract. The contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. The contractor developed OPSEC program may include Information Assurance and Communications Security (COMSEC). The OPSEC program shall be in accordance with National Security Presidential Memorandum (NSPM) 28, and at a minimum shall include:

1) Assignment of responsibility for OPSEC direction and implementation.

2) Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

3) Establishment of OPSEC education and awareness training.

4) Provisions for management, annual review, and evaluation of OPSEC programs.

5) Flow down of OPSEC requirements to subcontractors when applicable.

While performing aboard Government sites, the contractor shall: comply with all OPSEC instructions and policies;

include OPSEC as part of its ongoing security awareness program and take all required Agency training; be responsive to the Supporting OPSEC Manager on a non-interference basis; and Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the Requiring Organization and contractor in support of the mission.

10.3 Electronic Spillage

Electronic Spillage (ES) is defined as a situation where information of higher classification than a system is authorized to process is introduced into that system, intentionally or otherwise. If a contractor is determined to be responsible for an ES, all direct and indirect costs incurred by the Government for ES remediation will be charged to the contractor.