19R0023_Statement_of_Work.docx

STATEMENT OF WORK

MULTI-SPECTRAL ELECTRONIC WARFARE SYSTEM SUPPORT ACTIVITY

INTEGRATED PRODUCT TEAM (MDEWSSA IPT)

ELECTRONIC WARFARE (EW) JAMMER

AN/ALQ-165 AND AN/ALQ-214 SOFTWARE ENGINEERING SERVICES

20 February 2019

1.0 INTRODUCTION

1.1 BACKGROUND

The Naval Air Warfare Center, Weapons Division (NAWCWD) Point Mugu, CA has been designated the System Support Activity (SSA) for Navy Multi-Spectral Electronic Warfare System Support Activity Integrated Product Team (MDEWSSA IPT) systems and has the responsibility for integrating the Advanced Self-Protection Jammer (ASPJ) AN/ALQ-165, the Integrated Defensive Electronic Countermeasures (IDECM) AN/ALQ-214, and Aircraft Self Protection Optimization (ASPO) with other EW systems already under their cognizance.

The AN/ALQ-165 and AN/ALQ-214 are both Radio Frequency (RF) Jammer systems, and ASPO is a software upgrade to the AN/ALQ-214. The MDEWSSA IPT at NAWCWD, Point Mugu, California, executes the Software Support Activity (SSA) for both the AN/ALQ-165 and the AN/ALQ-214.

1.2 SCOPE

The NAWCWD MDEWSSA IPT has a follow-on requirement for engineering services and software support equipment products for the ASPJ AN/ALQ-165 and the IDECM AN/ALQ-214. This Statement of Work (SOW) establishes the requirements for software development of products within the MDEWSSA IPT located at the NAWCWD, Point Mugu, CA as identified in each Task Order (TO) issued by the Government, this contract includes the following support for AN/ALQ-165 and the AN/ALQ-214:

· General requirements

· Software Development (Software, firmware, tools and algorithms)

· Anomaly Investigations and Tracking

· Laboratory and Flight Test Support

· On-site Consultant

· Workshop Familiarization and Materials (including syllabus and presentation material)

· Support Equipment

· Presentation Material

· Source Data Generation

· Engineering Services and Hardware Support for Lab Maintenance, Upgrade, Procurement and Repair

· Meetings, Conference calls, and Teleconferences

The contract requirements include enhancing the Operational Flight Program (OFP), the Mission Data File (MDF), the Mission Data File Generator (MDFG), the User Data File (UDF), the UDFG, firmware, developing tools when applicable to support the AN/ALQ-165 and the AN/ALQ-214 systems currently in the Navy’s fleet on the FA-18A through F aircraft and on Foreign FA-18A-D and FA-18E/F aircraft, and providing products and services for Foreign Military Sales (FMS). This is a non-performance based requirement.

2.0 APPLICABLE DOCUMENTS

2.1 This section lists all applicable documents that shall provide a basis for the services and products requested in this SOW.

2.1.1 GOVERNMENT DOCUMENTS

The following documents are applicable to this effort and are designated as guidance in the support of the execution of the tasks requested in this SOW:

Incorporating Change 1, effective 28 April 2016

2.1.2 NON-GOVERNMENT DOCUMENTS

The following documents are applicable to this effort and in the execution of the efforts requested herein:

CMU/SEI-2006-TR-008

ESC-TR-2006-008

2.2 Information Technology (IT) Requirements:

2.2.1 The Government will provide all necessary obsolete reference documents and those not generally available to the contractor as requested.

The contractor shall not purchase any IT equipment on behalf of Naval Air Systems Command (NAVAIR) in support of this Contract, which reports to Program Budget Information System IT (PBIS-IT), without a NAVAIR Command Information Officer (CIO) approved NAV-IDAS ITPR.

2.2.2 CLINGER-COHEN ACT:

The contractor shall conduct analysis of program/project needs, acquisition strategy (AS) and program artifacts to identify and capture specific factors required to satisfy the 11 elements of CCA compliance listed in DODI 5000.02, Enclosure 1, Table 9. Using Microsoft Word, the contractor shall prepare a CCA compliance matrix following the organization and appearance of Table 11 with additional separate columns for the display of artifact: titles, date(s) of approval, page number(s), and paragraph or section number(s). The right-hand column shall include an embedded object permitting the reader to open unclassified artifacts. The column shall identify classified artifacts and shall describe approved classified channels for access of classified artifacts. The contractor shall support the program manager during CCA compliance review and assist in responding to reviewer comments if and when additional supporting information or revisions are required.

Updating approved CCA compliance packages: For updates of approved CCA compliance packages, the contractor shall conduct analysis of program/project needs, AS and program artifacts to identify and to determine if each of the Eleven (11) elements of CCA has changed and if no change has occurred a notation stating “no change” shall be entered in the CCA compliance matrix. If changes have been found, the contractor shall update the CCA compliance matrix to reflect the changes.

The contractor shall support the program manager during CCA compliance review and assist in responding to reviewer comments if and when additional supporting information or revisions are required.

2.2.3 SYSTEM SOFTWARE/APPLICATION COMPLIANCE:

All IT Systems or software/application development, modification or support shall be performed in accordance with Defense Business Transformation guidance (formerly Business Management Modernization Program (BMMP)), Department of the Navy (DON)/NAVAIR Functional Area Manager (FAM) Policies and Guidance, Network and Server Registration, and Web Enablement mandates.

2.2.4 WEB SITES, WEB ENABLEMENT AND APPLICATION / SYSTEM DEVELOPMENT, MODIFICATION, AND MAINTENANCE SUPPORT SERVICES:

All Information Technology systems, software, and website development, modification or support shall be performed in accordance with all applicable Federal, DoD, DON, and NAVAIR policy, guidance, standards, and strategies, and should be integrated within the NAVAIR Enterprise portal and collaboration environment whenever possible. Any websites/servers hosted/located in contractor facilities, or outside NAVAIR enclave, will transition to NAVAIR architecture and infrastructure in accordance with Legacy Shutdown guidance. Policies include, but are not limited to:

a. Office of Management and Budget Management of Federal Information Resources, OMB CIRCULAR NO. A- 130 Revised. <http://www.whitehouse.gov/omb/circulars_a130_a130trans4>

b. OMB Policies for Federal Agency Public Websites, OMB M-05-04.

<http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-04.pdf>

c. Section 508 Amendments to the Rehabilitation Act of 1973.

<http://www.section508.gov/Section-508-Of-The- Rehabilitation-Act>

d. Department of Defense Web Policies and Guidelines.

<http://www.defense.gov/webmasters>

e. Navy Information Operations Command (NIOC) Norfolk Web Risk Assessment Team Website.

<http://www.public.navy.mil/fcc-c10f/niocnorfolk/Pages/AboutWRA.aspx>

f. DON Policy for Content of Publicly Accessible World Wide Web Sites SECNAVINST 5720.47B.

<http://www.navy.mil/navydata/internet/secnav5720-47b.pdf>

g. NAVAIR CIO Website (NAVAIR specific policy and guidelines).

To request this policy contact the NAVAIR CIO office – 7.2.2 Applications Integration team – Web Manager: Shane Malamphy at 301- 342-1825.

h. Defense Information Systems Agency (DISA) Hosting of All Navy Websites (NAVADMIN 061/08).

<http://www.public.navy.mil/bupers-npc/reference/messages/Documents/NAVADMINS/NAV2008/NAV0806 1.txt>

i. Consolidation of Navy Web Sites - Reduction of IM/IT Footprint NAVADMIN 145/07.

<http://www.public.navy.mil/bupers- npc/reference/messages/Documents/NAVADMINS/NAV2007/NAV07145.txt>

j. DON Web Presence Policy: The Registration, Compliance of, and Investment in, All Unclassified Web Sites and Uniform Resource Locators.

<http://www.doncio.navy.mil/ContentView.aspx?ID=577>

k. Policy and Procedures for Web Risk Assessment (WRA) of Publicly Accessible Navy Sites (ALCOM 129/09).

www.public.navy.mil/fcc-c10f/niocnorfolk/Documents/NTD-08-09.txt

2.2.5 SOFTWARE DEVELOPMENT/SERVER PROCUREMENT:

Any tools developed that will be hosted by the Navy Marine Corps Intranet (NMCI) or run on NMCI workstations will be certified for NMCI and comply with NMCI policy. Additionally, any servers supporting this effort will be transitioned to meet the requirements of the current NAVAIR Server Consolidation effort.

2.2.6 CYBERSECURITY:

The contractor shall conduct investigation and analysis of acquisition program artifacts such as but not limited to Initial Capabilities Document (ICD), Capability Description Document (CDD), Capability Production Document (CPD), Navy urgent operational need (UON) and Marine Corps urgent universal need statement (UUNS), joint urgent operational needs (JUONs), threat assessments and AS. Knowledge gained from this analysis shall be used when developing the Cybersecurity Strategy (CS) needed to steer and inform the program’s development of an Operational Security (OPSEC) Plan in accordance with DoDI 8510.01, of 12 March 2014.

As a minimum, hardware, firmware, software, documentation (data deliverables) and/or Information Technology (IT) services delivered by this contract shall be in compliance with the following References:

a. DoDI 8500.01 Cybersecurity, 14 March 2014

b. DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), 12 March 2014, Incorporating Change 1, May 24, 2016.

c. Committee on National Security Systems Instruction 1253, “Security Categorization and Control Selection for National Security Systems,” March 27, 2014, as amended.

d. DoDD 8140.01, Cyberspace Workforce Management, 11 August 2015. DoD 8570.01-M Information Assurance Workforce Improvement Program, 15 August 2004, Certified Current as of 10 November 2015.

The contractor shall conduct investigation and perform analysis including; criticality analysis, threat assessment and vulnerability assessments. All findings and recommendations shall be reported to the government in technical reviews and submitted as written reports or documents as listed in Contract Data Requirements Lists (CDRLs). The contractor shall support government efforts needed for Information systems (IS) (enclaves or major applications), Platform Information Technology (PIT) or PIT systems to successfully categorize the system, achieve favorable assessment for selection, implementation and testing of security controls and authorization (approval to operate) before use or interconnection in an operating environment in accordance with references (a), (b) and (c). This includes IT that is standalone and IT that is connected to other systems, networks or enclaves. Information systems (IS) (enclaves or major applications), Platform Information Technology (PIT) or PIT systems delivered prior to award of this contract but included in the performance of this contract may have been delivered in compliance with Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) and as such shall require transition to Risk Management Framework cybersecurity compliance. Transition planning proposed or performed under this contract shall be in compliance with reference (b) Enclosure 8, Figure 2 and all hardware, firmware and software deliverables shall be capable of receiving Authorization to Operate in accordance with reference (b).

Information technology services shall only be performed by personnel who are qualified and certified in accordance with reference (d). Personnel proposed and/or used in the performance of this contract as certified personnel shall be limited to those who’s specifically assigned duties and responsibilities require certification.

2.2.6.1 DESIGNATION OF PLATFORM IT (PIT) AND PIT SYSTEMS:

The contractor shall investigate and conduct analysis in order to provide technical reviews to make a recommendation with data supporting the proposal(s) for the need for designation (or not) of the system, network or enclave as platform IT (PIT) or a PIT system in accordance with DoDI 8500.01, Cybersecurity, 14 March 2014. The proposal shall include all technical data required to engage in collaboration with the security control assessor, the authorizing official (staff) and PIT designating official(s). In the event the collaboration results in redesign or follow-up action after collaboration requiring additional or revised documentation, the contractor shall continue to assist the collaboration process.

2.2.6.2 SYSTEM CHARACTERIZATION AND SECURITY CONTROL SELECTION:

The contractor shall investigate and conduct analysis in order to provide technical reviews to make a recommendation with data supporting characterization and selection of security controls in accordance with DoDI 8500.01, Risk Management Framework (RMF) for DoD Information Technology (IT), 12 March 2014 Incorporating Change 1, May 24, 2016, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, Revision 4, April 2013, NIST SP 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems, February 2010, Federal Information Processing Standards Publication (FIPS 199, February 2004. Contractor performed analysis shall include; criticality analysis, threat assessment and vulnerability assessments. The contractor shall propose characterization of the system and selection of security controls use Committee on National Security Systems Instruction (CNSSI) 1253, Security Categorization and Control Selection for National Security Systems, 27 March 2014 to tailor the NIST guidance. The proposal shall include all technical data required to engage in collaboration with the security control assessor and the authorizing official (staff). In the event the collaboration results in redesign or follow-up action after collaboration requiring additional or revised documentation, the contractor shall continue to assist the collaboration process.

2.2.7 OPSEC: The contractor shall adhere to all OPSEC requirements specified in the DD Form 254. The contractor shall develop, implement, and maintain an OPSEC program to protect Critical Information (CI) e.g., controlled unclassified and classified activities, information, equipment, and material used or developed by the contractor and any subcontractor during performance of the TO. The contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. The OPSEC program shall be in accordance with National Security Decision Directive (NSDD) 298, and at a minimum shall include:

• Assignment of responsibility for OPSEC direction and implementation.

• Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

• Establishment of OPSEC education and awareness training.

• Provisions for management, annual review, and evaluation of OPSEC programs.

• Flow down of OPSEC requirements to subcontractors when applicable.

• The contractor shall prepare an OPSEC Plan in accordance with MIL-HDBK-254D for Government review.

Communications Security (COMSEC): The contractor will require access to COMSEC and will require a COMSEC account for the work being performed under this contract. U.S. cryptographic equipment inventory information, as well as the systems and manner in which each particular equipment is used, is for official use only. Publication or release of any related COMSEC information by any means, by the contractor, without prior written approval of the Contracting Officer is prohibited. The contractor must be a U.S. citizen, have a final Government security clearance with the appropriate personnel security background investigation for the level of classification involved, have strict need-to-know, have the appropriate COMSEC briefing before access is granted, and granted access only in conformance with procedures established for the particular type of COMSEC information involved. The contractor shall adhere to the DD Form 254 COMSEC security requirements, facility COMSEC material control and operating procedures, and all applicable COMSEC regulations, instructions, and policies. Prior approval from the Government Contracting Activity is required in order for a prime contractor to grant COMSEC access to a subcontractor.

Public Release: Disclosure of information is covered by DFARS 252.204-7000 Disclosure of Information, incorporated in Section I of the contract, the contractor must seek specific approval for disclosure of controlled unclassified information even if the information already exists within the public domain.

All Cybersecurity shall be in compliance with the following listed instructions:

a. DoDI 8582.01, Security Of Unclassified DoD Information On Non-DoD Information Systems, 06 May 2012

b. Chairman of the Joint Chiefs of Staff Instruction CJCSI 3170.01I (series), Joint Capabilities Integration and Development System (JCIDS), 23 January 2015.

c. CJCSI 6211.02D, Defense Information System Network (DISN): Policy and Responsibilities, 24 Jan 2012 (Current as of 4 Aug 2015).

d. CJCSI 6251.01D, Narrowband Satellite Communications Requirements, 30 Nov 2012.

e. CJCSI 6510.01F, Information Assurance (IA) and Support to Computer Network Defense (CND), 09 Feb 2011, certified current 9 Jun 2015.

f. Chairman of the Joint Chiefs of Staff Manual CJCSM 6510.01B – Cyber Incident Handling Program, 10 July 2012 (Current as of 18 Dec 2014).

g. Navy Ports Protocols, and Services (NPPS) Manual, Version 1.5, 16 November 2010.

h. Defense Acquisition Guidebook – Chapter 6, Information Technology and Business Systems, Section 6-3,, Protecting Information Technology, Version 0, 01 February 2017 or later

i. DoD 5220.22-M, National Industrial Security Program Operating Manual, February 28, 2006 (NISPOM) Incorporating Change 2 May 18, 2016.

j. DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19 Dec 2005, (Incorporating Change 3, 24 Jan 2012).

k. DoDD 8000.01, Management of the Department of Defense Information Enterprise, 17 March 2016.

l. DoDD 8100.02, Use of Commercial Wireless Devices, Services, and Technologies in the Department of Defense Global Information Grid (GIG), 14 April 2004, Certified Current, 23 April 2007.

m. DoDD 8140.01, Cyberspace Workforce Management, 11 August 2015.

n. DoDI 8330.01, Procedures for Interoperability and Supportability of Information Technology (IT) and National Security Systems (NSS), 21 May 2014.

o. DoDI8500.01, Cybersecurity, 14 March 2014.

p. DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, 24 May 2011.

q. DoDI 8551.01, Ports, Protocols, and Services Management (PPSM), 28 May 2014

r. DoDI 8580.1, Information Assurance (IA) in the Defense Acquisition System, 9 July 2004.

s. DoDI 8581.01, Information Assurance (IA) Policy for Space Systems Used by the Department of Defense, 8 June 2010.

t. DON CIO Memo 02-10, Department of the Navy Chief Information Officer Memorandum 02-10 Information Assurance Policy Update for Platform Information Technology, 26 April 2010.

u. DON letter 5239 NAVAIR 726/2322 of 18 Feb 09, NAVAIR Data at Rest Policy.

v. Federal Information Processing Standards Publications (FIPS PUB)-199, February 2004.

w. Committee on National Security Systems Policy CNSSP No. 11, 10 June 2013.

x. Office of the Chief of Naval Operations OPNAV INST 5239.1C, Navy Information Assurance (IA) Program, 20 Aug 08.

y. SECNAV M-5239.1, Department of the Navy Information Assurance Program; Information Assurance Manual, November 2005.

z. SECNAVINST 5230.15, Information Management/Information Technology Policy for Fielding of Commercial Off the Shelf Software, 10 April 2009.

aa. SECNAVINST 5239.3C, Department of the Navy Cybersecurity Policy, 2 May 2016.

ab. SECNAVINST 5239.19, Department of the Navy Computer Network Incident Response and Reporting Requirements, 18 March 2008.

ac. The National Security Act of 1947.

ad. Title 40/Clinger-Cohen Act.

ae. Title 44/ Federal Information Security Management Act.

af. National Institute of Standards and Technology Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, Revision 4, April 2013 (Updated 22 Jan 2015).

All IT procured on behalf of this contract shall meet all DoD/DON and NAVAIR cybersecurity polices. Failure to follow these policies will result in denied access to NMCI, One Net, Integrated Shipboard Network System (ISNS) and other DON, DoD and Joint Networks. These cybersecurity policies are standard across the Department and ensure cybersecurity compatibility and interoperability.

IT systems and or networks operated by contractors pursuant to a NAVAIR contract, regardless of the level of data processed, shall be operated in accordance with the NISPOM.

Approved contractor-owned equipment shall be permitted connections to NAVAIR/DoD networks in order to carry out the performance of this contract. All contractor-owned hardware and/or software shall meet DoDI 8500.1 Cybersecurity is subject to validation scanning and must be approved by the NAVAIR site Cybersecurity Manager prior to connection.

The following specific criteria must be met before the contractor can be connected to any DoD or NAVAIR network in support of this contract. Requirements include:

a. Network Vulnerability Scanning. NAVAIR Deputy CIO for Information Assurance maintains authorized auditing tools and shall provide for firewall/port scans, device discovery scan, vulnerability assessment, and other requirements as required to ensure secure interoperability with DoD networks. The contractor shall be responsible for the remediation of any equipment that fails these audits prior to the connection of the system to the networks; Results of approvals shall be documented via Memorandum of Agreement (MOA) with the Facility Security officer and the Defense Security Service Representative for that contractor.

b. Extent of Validation Scanning. To prevent scanning of corporate assets, all such networks, equipment and connections shall be physically segregated from any government/contractor corporate networks that are not in direct support of DoD contracts.

c. Circuit Provisioning. Any circuit or connection between NAVAIR and/or DoD site and the contractor site shall be provisioned via the Defense Information Security Agency and comply with CJCSI 6211.02D, Defense Information System Network (DISN): Policy and Responsibilities, 24 Jan 2012.

d. Servicing Systems from a Remote Contractor Site. Remote Access Service connections that allow off-station operation and/or administration of contractor owned systems, located at any NAVAIR facility or site, shall not be permitted, with the exception of those systems connecting to the Command via the Outreach Services identified in Section 6, Enterprise Architecture.

e. MOA and Inter-Connection Agreements. A Cybersecurity MOA between the contractor owning the equipment and AIR-7.2.6 shall be developed and signed before the equipment can be connected to NAVAIR networks. Failure to comply with the signed MOA shall be grounds for disconnection from the network.

2.2.8 Enterprise Architecture:

a. Contractor Networks and Connections. Contractor-owned and operated networks are prohibited on any NAVAIR facility or site in support of this contract. The contractor may access non- government, external Internet Protocol (IP) space via the NAVAIR provided Virtual Private Network (VPN) Outreach service or NAVAIR CIO approved IP service.

b. Architecture Compliance. The contractor shall ensure all IT solutions, including database solutions, comply with the appropriate NAE Enterprise Architecture, and are verified by the NAVAIR Enterprise Architect (AIR-7.2.3) prior to build out.

c. Disclosure of pre-existing networks, circuits or connections. Any and all networks, circuits or connections between the contractor and any NAVAIR site related to previous contracts shall be identified in the MOA. Failure to comply and subsequent discovery of an unregistered network, circuit or connection shall be grounds for immediate disconnection.

2.2.9 Capability Maturity Model Integration (CMMI) for Software Development:

The contractor shall follow methodologies for evaluating software processes, to gain insight into software development capability and maturity. The contractor shall follow CMMI-DEV, V1.3, as referenced in table 2.1.2, for Government software development best practices.

2.2.10 IT Personnel Security Report:

The contractor shall submit a status report that includes all employees requiring access to Government IT systems.

2.3 For Official Use Only (FOUO):

FOUO information generated and/or provided under this contract shall be marked and safeguarded as specified in DoDM 5200.01, Information Security Program Manual (Volume 4) available at http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf and DoD 5400.7-R, Freedom of Information Program, Chapter 3 (pages 31-42) available at http://www.dtic.mil/whs/directives/corres/pdf/540007r.pdf. The Contractor shall not store or transmit CUI on personal IT systems or via personal e-mail.

2.4 Program Protection Implementation Plan (PPIP):

The contractor shall update as necessary the PPIP to ensure effective and efficient protection of essential program information, technologies and systems, and in accordance with OPSEC requirements, which will include, at a minimum:

• The Security Management structure.

• The Critical Program Information (CPI) physical locations under the contractor’s or subcontractor’s control.

• The vulnerability of the CPI under the contractor’s or subcontractor’s control to intelligence collection in the following areas: Human Intelligence (HUMINT); Open Source Intelligence (OSINT); Signals Intelligence (SIGINT); Imagery Intelligence (IMINT); Computer Network Operations (CNO).

• Countermeasures at each site where CPI is held, from the following security domains (as applicable); physical security; personnel security; telecom and network security; application/systems development; cryptography; security architectures; operational security; network and IT access control.

• Any special handling procedures required for CPI, and procedures for recovering CPI in the event of a mishap. The contractor shall address these procedures for all phases of the program, including (but not limited to): Research Development Test and Evaluation (RDT&E); production; operations maintenance; logistics; transportation; training; disposal.

• Procedures for ensuring compliance with U.S. Government export statutes and regulations.

• Procedures for public release of program information. (CDRL A007)

3.0 REQUIREMENTS

The contractor shall provide engineering/technical services, and product support in the execution of the SSA activities for the AN/ALQ-165, AN/ALQ-214, and SWIP as further described below.

3.1 GENERAL REQUIREMENTS

3.1.1 General Support: The contractor shall perform the following for U.S. Navy and FMS customers, as applicable: integrate ALQ-165 and ALQ-214 software developed by NAWCWD Point Mugu with contractor-developed ALQ-165 and ALQ-214 software solutions; provide support for software design, development, integration, and test at NAWCWD Point Mugu for ALQ-165 and ALQ-214 software solutions; system engineering; configuration management; new product user guidance; testing; and maintenance and repair of hardware and software developed and produced under this contract. Software includes OFP, UDF, MDF, UDFG, MDFG, firmware, Flight Line Checkout (FLCO)/Flight Line UDF (FLTLNUDF) software and development tools when applicable. Work shall primarily be accomplished at the contractor’s facility, with design, development, integration, and test support at Point Mugu, CA; and test support at China Lake, CA; and FMS destinations listed in Section 6.2. The contractor shall provide a monthly summary of expenditures itemized for total labor costs, materials other direct cost (ODC), and travel ODC. Technical progress shall be summarized to include accomplishments, compliance to schedules, issues, problems and risks to completion of the contract effort. The contractor shall provide this information in one consolidated Monthly Status Report. (CDRL A001)

3.1.2 Technical Approach: The contractor shall integrate and produce OFP, UDF, MDF, UDFG, MDFG, Flight Line Checkout (FLCO)/Flight Line UDF (FLTLNUDF) software and firmware changes in a systems engineering environment as outlined in the Software Development Plan (SDP). The software integration process outlined in the SDP shall be capable of inclusion of software and firmware designed, developed, and tested by NAWCWD Point Mugu personnel. The contractor shall provide support, via availability for consultation as needed, to the Government laboratory at NAWCWD Point Mugu for the design, development, integration, test, and production of OFP, UDF, MDF, UDFG, MDFG, Flight Line Checkout (FLCO)/Flight Line UDF (FLTLNUDF) software and firmware changes performed at NAWCWD Point Mugu. The SDP shall include process and configuration management guidelines (as an Appendix) to meet customer requirements. The contractor shall maintain TO specific schedules and include them in Monthly Progress Reports. (CDRLs A001, A003, A004, A005)

3.1.2.1 The Contractor shall follow the SDP that they develop and submit in accordance with CDRL A005. The SDP shall define the contractor’s proposed life cycle model and the processes used as a part of that model. The term “life cycle model” is defined in Institute for Electrical and Electronics Engineers (IEEE)/Electronic Industries Alliance (EIA) Std. 12207. The SDP shall describe the overall life cycle and shall include primary, supporting, and organizational processes, based on the work content of this SOW. In accordance with the framework defined in IEEE/EIA Std. 12207, the SDP shall define the processes, activities to be performed as a part of the processes, tasks that support the activities, and techniques and tools used to perform the tasks in detail. IEEE/EIA Std. 12207 does not prescribe how to accomplish the task, so the contractor must provide detailed information so the Government can assess whether the contractor’s approach is viable. The plan shall include software design tools, source code control, time accounting, compiler or Integrated Development Environment (IDE), debugging aids, and defect tracking, to support best software development practices and design methodologies. (CDRLs A004, A005)

3.1.2.2 The SDP shall contain the information defined by IEEE/EIA Std. 12207.1, section 5.2.1 (generic content) and the Plans or Procedures in Table 1 of IEEE/EIA Std. 12207.1. In all cases, the level of detail shall be sufficient to define all software development processes, activities, and tasks to be conducted. Information provided must include, at minimum, specific standards, methods, tools, actions, strategies, and responsibilities associated with development and qualification. (CDRLs A004, A005)

3.2 SOFTWARE DEVELOPMENT

3.2.1 General: The contractor shall comply with the SDP and shall produce ALQ-165 an ALQ-214 software products consistent with Government approved processes. Work shall be performed in accordance with Software Engineering Institute Capability Maturity Model Integration (SEI CMMI) Level 3 or higher processes as defined in CMMI for Systems Engineering/Software Engineering/Integrated Product and Process Development/Supplier Sourcing, Version 1.3, dated November 2010. If not designated as SEI CMM or CMMI Level 3 or higher, then the contractor shall demonstrate they have processes consistent with a SEI CMM or CMMI Level 3 or higher organization.

3.2.2 OFP/UDFG/MDFG: The contractor shall integrate and generate production OFP/UDFG/MDFG/firmware software deliveries and software tools, if applicable, for U.S. Navy and specific FMS customers. The contractor shall support at NAWCWD Pt. Mugu the integration and generation of production OFP/UDFG/MDFG/firmware software deliveries for U.S. Navy and specific FMS customers. To the maximum extent possible, all software deliverables must be on the same common baseline. The contents shall be only those System Anomaly Reports (SAR’s) or Software Trouble Reports (STR’s) approved by the SSA Software Change Review Board (SCRB). The SCRB shall designate the baseline OFP/UDFG/MDFG into which the approved SAR’s or STR’s will be incorporated. The Government will provide input to the contractor on proposed solutions resulting from anomaly investigations that will require demonstration to the Navy using ALQ-165 and ALQ-214 hardware. Solutions for the ALQ-165 and ALQ-214 and future versions shall be maintained within synchronization as much as possible. The software used to demonstrate proposed solutions shall be engineering test loads. The contractor development shall include assessment of threat data effectiveness in providing accurate and timely Electronic Countermeasure (ECM) techniques in the AN/ALQ-214 and AN/ALQ-165. The contractor shall provide change pages for the software documentation impacted by Government-approved changes. (CDRLs A002, A003, A004, & A005)

3.2.3 Software Deliverables and Formats: Delivered ALQ-165 and ALQ-214 software builds shall include OFP/UDF/MDF/UDFG/MDFG/firmware source code listing, object code files, binary files, Memory Loader files, and any support files necessary to assemble, compile, link, build and execute the software. OFP/UDFG/MDFG software shall be delivered in the format compatible with the USQ-131 Memory Loader Verifier Set (MLVS) and the Program Loader Set (PLS). UDFG/MDFG software, firmware, and other system software configuration items such as development tools shall be delivered in the format compatible with the system they operate within. The contractor shall provide software products and shall also provide a Version Description Document (VDD) that identifies and describes all changes made to the software/firmware. The VDD shall also include complete configuration identification information to include what is displayed on the cockpit displays and what is stored in the software code itself. (CDRLs A003, A004, & A005)

3.2.4 Software Acceptance Criteria: Final acceptance shall be in accordance with the Acceptance Test Plan (ATP) and shall be evidenced by Government execution of a Material Inspection and Receiving Report, DD Form 250, submitted through the Wide Area Workflow (WAWF) system. The ATP shall be submitted to the Government in accordance with CDRL A005 prior to ATP execution. (CDRL A004)

3.2.5 Software Installation: The contractor shall install and provide installation instructions for the USN and FMS UDFG/MDFG software and validate the installation is functional. (CDRL A004)

3.3 ANOMALY INVESTIGATIONS AND TRACKING

3.3.1 Investigations: The contractor shall review anomaly reports, test data, test reports, and other written material, and shall provide a report to the Government on the suspected cause of the anomaly, the hardware and/or software unit suspected to be non-compliant with specifications, the recommended course of action, and recommend additional investigation, or corrective action for the U.S. Navy and specific FMS customers, if required in individual TOs. Analysis of the anomaly may require additional laboratory or flight-testing. If requested by the Government, the contractor shall present the results of the analysis in the Anomaly Investigation Technical Report. Anomalies shall be provided in increments to fit within defined build cycle. (CDRL A002)

3.3.2 Tracking: The contractor shall document and provide the Government a copy of any System Problem Report (SPR), SAR or STR that applies to the ALQ-165, ALQ-214 and future version’s computer software and/or firmware developed in parallel, to be entered in the Government anomaly reporting system. The anomaly shall be provided in XML and/or standard Microsoft Office formats (including forms) such as Word, Excel, or PowerPoint. The .pdf format shall not be used unless requested by the Government. (CDRLs A002, A004, A005)

3.4 LABORATORY AND FLIGHT TEST SUPPORT

3.4.1 The contractor shall provide test documentation of final contractor testing and the analysis of test data for all final delivered software products to include OFP, UDF, MDF, UDFG, MDFG, and firmware updates. (CDRL A00E)

3.4.2 The contractor shall provide support, via availability for consultation, to Government laboratory and flight test events of the software delivered. This support shall include test planning, test execution, test analysis and test reporting. The contractor shall conduct primary testing at the contractor’s laboratory and test support at Government laboratories at Point Mugu, CA and China Lake, CA. The contractor shall perform aircraft ground testing to verify system operation and performance. Ground testing shall include testing with Navy support equipment. The contractor shall assist with anomaly investigation in the laboratory and at technical interchange meetings and provide technical analysis as to the root cause of the anomaly. (CDRLs A002 & A009)

3.5 ON-SITE CONSULTANT

The contractor shall provide on-site technical assistance to specific ALQ-165 and ALQ-214 U.S. Navy and FMS customers. This shall include setting up laboratories, troubleshooting system operation and laboratory assets, providing installation support and instructions on UDFG/MDFG and software tools, and presenting technical briefings at TCM’s, PMR’s, and Technical Working Groups. (CDRLs A009 & A00D)

3.6 WORKSHOP FAMILIARIZATION AND MATERIALS

3.6.1 The contractor shall prepare new product user guidance that describes the operation of new/updated software such as OFP and UDFG/MDFG, workshop familiarization syllabus and materials as specified at the TO level. Upon Government approval via email or letter of formal approval, the contractor shall produce and deliver the final workshop familiarization syllabus and materials which may include but are not limited to software files, User Manual, and workshop familiarization materials in hard copy, and/or electronic media. (CDRLs A006 & A00D)

3.6.2 The contractor shall prepare and conduct the workshop familiarization as specified at the TO level. Upon completion of the workshop familiarization, the contractor will provide to the Government a report to document the accomplishments of the workshop familiarization. (CDRL A009)

3.7 SUPPORT EQUIPMENT

The contractor shall incorporate new requirements or problems identified in Government-approved SARs or STRs in the designated FLCO and FLTLNUDF baseline of the Navy support equipment. Engineering support shall include FLCO/FLTLNUDF requirements development, design, development, verification testing, and confirmation of separate software loading using the MLVS and/or PLS. The contractor shall incorporate new requirements to support software loading and verification with the Program Loader Set AN/USQ-203. The contractor shall incorporate new requirements or correct anomalies/trouble related to the software support adapters that are used with the USM-670 to conduct flight line maintenance. All documentation that is impacted by FLCO/FLTLNUDF changes shall be updated and provided to the Government for approval and shall be provided in a format to be specified by the TPOC or Government Configuration Manager. (CDRLs A003, A004, A005, A00E)

The contractor shall provide technical assistance such as FLCO/FLTLNUDF troubleshooting and integration for Government FLCO/FLTLNUDF changes. Unless otherwise specified, the FLCO/FLTLNUDF development shall be performed in the contractor’s facilities. (CDRL A002)

3.7.1 Support Equipment Logistics

The contractor shall provide an Item Unique Identification (IUID) Plan, a Maintenance Plan (MAPL) Report, and a Provisioning Parts List (PPL) for the ALQ-214(V)4 and (V)5 software support adapters. (CDRLs A00A, A00B, A00C)

3.7.2 ALQ-214(V)4 Software Support Adapters

The contractor shall produce and deliver ALQ-214(V)4 Software Support Adapters in accordance with PS410 Performance Specification for the ALQ-214(V)4/5 Software Support Adaptors. The contractor shall conduct an acceptance test procedure on each ALQ-214(V)4 software support adaptors in accordance with 4106736 ATP for the ALQ-214(V)4/(V)5 WRA-1 Rack Adapters prior to delivery. (CDRLs A003, A004, A005, A00E)

3.7.3 ALQ-214(V)4 Software Support Adapter Transit Case

The contractor shall provide lined cases for the ALQ-214(V)4 software support adaptors. The transit case shall be constructed of material strong enough to resist denting, breakage or other failure under harsh environmental and handling exposures. The transit case shall be in accordance with MIL-PRF-28800F. The transit case shall include a contents list that illustrates the storage location for ALQ-214(V)4 Software Support Adapter, name plate and external labels. The transit case shall be limited in weight to permit one-person lift.

3.8 PRESENTATION MATERIAL

The contractor shall prepare presentation materials as specified at the TO level. (CDRL A00D)

3.9 SOURCE DATA GENERATION

The contractor shall provide documentation that details all changes to aircraft cockpit displays and Built In Test (BIT) as a result of changes made to OFP, MDFG, UDFG, and algorithms. (CDRL A002)

3.10 ENGINEERING SERVICES AND HARDWARE SUPPORT FOR LAB MAINTENANCE, UPGRADE PROCUREMENT AND REPAIR

The contractor shall provide support for hardware and software maintenance and repair of all equipment of the system including, but not limited to: test benches, Prime Mission Equipment (PME), simulators, and associated calibration activities. The contractor shall perform upgrades if the equipment is not in the latest configuration, as directed in the TOs.

3.11 MEETINGS, CONFERENCE CALLS, AND TELECONFERENCES

The contractor shall provide support to attend meetings, telephone conference calls, and video teleconferences for the purpose of: exchanging technical information with customers, discussing status, reviewing requirements, and planning. The contractor shall provide personnel with the appropriate technical expertise and skills, dependent upon the purpose of the discussion. The contractor shall document meetings by minutes and/or presentations to record the technical issues, solutions, agreements and decisions that occurred. (CDRL’s A008, A00D)

4.0 REPORTS, DATA, AND OTHER DELIVERABLES

4.1 CONTRACT DATA LIST REQUIREMENTS

In performance of the support identified in this SOW, the contractor shall deliver reports, data, and other documentation in accordance with the applicable CDRLs. All software and documentation developed and delivered under this contract shall remain the property of the U.S. Government.

The contractor shall email the following unclassified Contract Data Requirements List (CDRL)s; Contractor’s Monthly Progress and Management Status Report monthly to the COR and Government Project Lead (GPL) who is identified in each individual task order. All other unclassified CDRLs will be sent to the following electronic mailbox “TACAIR_CM_DM@navy.mil”. Classified material shall be mailed in accordance with approved means as indicated by the Government, or via SIPRnet. Clarification concerning the details of specific tasks will be communicated by the Government COR and/or TPOC during bi-weekly meetings, status meetings, and/or via email. The contractor shall provide progress reports and general programmatic documentations to support reviews and projects.

5.0 MATERIALS AND PURCHASING

The contractor shall manage material and consumable supplies at levels to meet mission requirements. The contractor must obtain prior approval from the COR for any purchases valued over $10,000. All COR-approved purchases shall be submitted, documented, and filed for Contracting Officer post action review. The contractor must obtain prior approval from the Contracting Officer for any purchases valued over $25,000. To receive approval for the purchases, the contractor shall submit a consent package providing a description, price, evidence of adequate price competition, or if unavailable, a justification for use of a single source and a determination that the price is fair and reasonable. These requirements apply to all contractor purchases. The contractor shall follow the procedures in Clause 52.244-2 Subcontracts Alt I and notify the Contracting Officer reasonably in advance of entering into any subcontracts that exceeds either simplified acquisition threshold or 5 percent of the total estimated cost of this contract.

6.0 TRAVEL

6.1 During performance of individual TOs, the contractor shall be required to perform travel to support the tasking as determined by the Government Contracting Officer’s Representative (COR) or Technical Point of Contact (TPOC). The contractor shall submit a request for 10 days prior to the Government COR for approval. Each travel request will minimally consist of:

• Date of Request

• Delivery order number

• Employee(s)

• Date and duration of proposed travel

• Purpose of travel

• Destination

• Cost estimate (airfare, per diem, car rental, miscellaneous expenses)

• Total travel allowance on the TO

• Total travel cost expended to date

6.2 The contractor shall be required to perform CONUS and International travel to accomplish the requirements of this contract throughout the period of performance, as estimated below:

Point Mugu, CA

Nashua, NH

St. Louis, MO

Goleta, CA

Seosan, South Korea

Seoul, South Korea

Daegu, South Korea

Tikkakoski, Finland

Tampere, Finland

Adelaide, Australia

Interlaken, Switzerland

Ottawa, Canada

Ali Salem AF Base, Kuwait

PAX, MD

Upon completion of each trip the contractor shall submit a trip report. (CDRL A009)

7.0 GOVERNMENT FURNISHED PROPERTY

7.1 Government Furnished Property

Government Furnished Property (GFP), include Government Furnished Information (GFI), and Government Furnished Equipment (GFE) may be proceed to the contractor to accomplish contract requirements as specified in individual orders. The contractor shell inventory all GFP and is shall be dispositional by the Government at the completion of this contract.

7.2 Laboratory Access

The Government will furnish access to Government laboratories to accomplish tasking described in Section 3.4 of this SOW. Laboratories available for use are the Electronic Combat Simulation Laboratory (ECSEL), the Software Development Lab, and Support Equipment Lab at NAWCWD Point Mugu, CA plus the Advanced Weapons Laboratory (AWL) at NAWCWD China Lake, CA. The Government reserves the right to control laboratory schedule and use of documentation and information required for the performance of this contract. The Government will supply the contractor with information on where and how to send contractor personnel security clearances when visiting these laboratories. Should there be additional forms for the use of contractor equipment in the laboratory, the Government will provide the procedures and forms to the contractor.

8.0 QUALITY ASSURANCE (QA)

8.1 QA Program

The contractor shall provide a QA program consistent with the processes described in ISO 9001 and consistent with Capability Maturity Model Integration for Development (CMMI-DEV), Version 1.3, dated November 2010.