Previous Performance Work Statement - NGATS Software Support.docx

Performance Work Statement (PWS) for

Common Operator Test Environment (COTE) Support

1. SCOPE

1.1 To provide sustaining engineering and technical support services related to the system software enhancements, bug fixes, and patches to the Army’s Full Rate Production (FRP) Next Generation Automatic Test System (NGATS) platform for the United States Army Combat Capabilities Development Command (DEVCOM) Armaments Center, Automated Test Equipment (ATE) Branch.

2. BACKGROUND

2.1 This Performance Work Statement (PWS) defines the DEVCOM Armament Centers requirement for software support services for the Automated Test Equipment Branch on the NGATS. NGATS is part of the Army’s Integrated Family of Test Equipment (IFTE). The NGATS ATE provides a deployable, interoperable, general purpose, reconfigurable testing capability for Department of Defense (DoD) weapon systems. It comprises a strategic component of the Army’s Off Platform Automated Test Systems (OPATS) used to test and fault isolate Line Replaceable Units (LRUs). NGATS is a replacement for the Version 3 and Version 5 Base Shop Test Facility (BSTF) and the Direct Support Electrical System Test Set (DSESTS). The NGATS station software provides the run time environment for performing off platform diagnostic testing and fault isolation of LRUs and Shop Replaceable Units (SRU) for the electrical weapon systems.

3. APPLICABLE DOCUMENTS (for reference)

ASME Y14.5M-2 Dimensioning and Tolerancing, 2009 Attachment 1 - CMMI-SE/SW/SS V 2.0 - Capability Maturity Model Integration [Picatinny], MIL-STD-31000B - Technical Data Package (TDP), 31 October 2018

4. REQUIREMENTS

4.1 FRP NGATS System Software Support

4.1.1 The Contractor shall develop Common Operator Test Environment (COTE) for it to be used with Visual Studio 2017.

4.1.2 No proprietary code in any software shall be used in this effort unless identified at award of this task.

4.1.3 The Contractor shall provide system software and hardware support and troubleshooting to address latent defects, field performance issues, lab development issues, requirements and performance shortfalls, and obsolescence issues.

4.1.4 The Contractor shall provide support for problem investigation and develop solutions for resolution of system software and hardware issues. This shall include all system software and development environments.

4.1.5 The Contractor shall maintain and update the Team Forge artifacts that identify all of the hardware and software issues that impact the operational availability of the NGATS. Issues that are considered routine and maintenance shall also be included in the Team Forge artifact submissions. Corrective actions shall be implemented once approved by the Program Director (PD).

4.1.6 The Contractor shall provide hardware and software updates in accordance with a Contractor developed and Government program manager approved schedule. All hardware and software updates must be backward compatible. Deviations from backward compatibility must be approved by the Government.

4.1.7 The Contractor shall analyze obsolescence issues and develop and implement strategies and solutions to mitigate identified obsolescence risks.

4.1.8 The Contractor shall provide a complete release of system software, at a minimum once during this period of performance.

4.1.9 The Contractor shall provide system software patches at least once each quarter during this period of performance.

4.1.10 The Contractor shall update Regression Analysis Software (RAS) and Test Description Interface (TDI) analysis software (TAS) in conjunction with updates to the system software baseline as appropriate.

4.1.11 System software patches shall be designed to be installed on NGATS using the Manage capability and built using InstallShield 2020 as applicable.

4.1.12 The Contractor will be given access to source code baseline and documentation in the Team Forge application. The Contractor shall submit updates to source code and documentation through the Team Forge application.

4.1.13 Included with each complete release of system software and with each software patch, the Contractor shall update, as applicable, and deliver the following NGATS software documents provided on the Team Forge application:

Commercially Available/Privately Developed Software (CASW), (NGATS-CASW-001), DI-CMAN-80895 Software Test Description (STD) (NGATS-STD-001), DI-IPSC-81439A Software Requirements Specification (SRS) (NGATS-SRS-001), DI-IPSC-81433A Software Interface Requirements Specification (IRS) (NGATS-IRS-001), DI-IPSC-81434A Software Design Description (SDD) (NGATS-SDD-001), DI-IPSC-81435A Software Version Description (SVD) (ND201510-01), DI-IPSC-81442A Software Product Specification (SPS) (NGATS-SPS-001), DI-IPSC-81441A Software Users Manual (SUM) (NGATS-SUM-001), DI-IPSC-81443A Software Functional Configuration (FCA) Audit Report (NGATS-SWFCA-001), DI-SESS-81022E Software Physical Configuration (PCA) Audit Report, (NGATS-SWPCA-002), DI-SESS-81022E Software Test Plan (STP) (NGATS STP-001), DI-IPSC-81438A Software Test Report (STR) (NGATS-SCTTR-001), DI-IPSC-81440A Software Source Code, Executable Code, Register Edit File and Software Load, DI-IPSC-81488 Firmware Support Manual (FSM) (NGATS-FS-001), DI-IPSC-81448B

4.2 Communication and Process

4.2.1 The Contractor shall prepare Engineering Change Proposals (ECPs) using the Multi User Engineering Change Proposal Automated Review System (MEARS) tool.

4.2.2 The Contractor shall participate in a bi-weekly technical meeting with Government personnel.

4.2.3 The Contractor shall conduct a quarterly Program Management Review (PMR) via teleconference or at the Contractors facility in conjunction with Program Director, Test Measurement and Diagnostic Equipment (PD TMDE), and the Automated Test Equipment Branch. The Contractor shall provide an advanced copy of the PMR presentation materials to the Contracting Officers Representative (COR) at least seven (7) calendar days prior to conducting the review. The Contractor shall record minutes and manage action items of the reviews and provide electronic copies in Contractor format to all attendees within seven (7) calendar days after conducting the reviews (DI-ADMN-81505). The PMR review shall consist of overall program status that includes:

Monthly task performance by site and NGATS to include:

Service request count Maximum, Minimum, and Average service request acknowledgment times Resolved and unresolved service request count Maximum, Minimum, and Average resolution times Support request count by category (e.g. ATE repair, Test Program Set (TPS) troubleshooting, shelter maintenance, training, etc.) Problem reports and issues Field Configuration systems Free Standing Configuration systems Unresolved support request plans and status Recommendations to help achieve the NGATS Readiness Objective

5. GENERAL INFORMATION

5.1 Period and place of performance: The period of performance for this task is twelve months following task award. All work will be performed at the Contractors facility. The Contractors facility will be determined at task award.

5.2 Travel: No travel is required for this task.

5.3 Materials: No materials are anticipated to be purchased for this task.

5.4 Incidental Government Furnished Property (GFP) - All incidental GFP will be inventoried at the conclusion of the Period of Performance, and no less frequently than annually, and reported to the Contracting Officers Representative (COR) on a memo. The Scheduled Government Property Listing attachment will be added to the contract after award when Government Computers are assigned/provided.

5.4.1 Government Furnished Property (GFP) - The Contractor shall manage (control, use, preserve, protect, and maintain) Government Furnished Property pursuant to FAR 52.245-1(f)(1) and prevent damage to Government property beyond reasonable wear and tear as stipulated in FAR 52.245-1. The Contractor shall submit a Property Management Plan no later than thirty (30) calendar days after task award (DI-MGMT-80441D). The Contractor shall report receipt of all Government property at the onset of performance following task award (DI-MGMT-82173).

5.5 Data Rights

5.5.1 The Government shall have the unrestricted right to use, modify, reproduce, release, perform, display or disclose technical data, software and products for all work products developed and modified under this task. All reference material, documents, training support material, and other information obtained, produced, or developed by the Contractor in support of this effort shall become the property of the Government.

5.6 The Contractor shall submit a Program Progress Report (DI-MGMT-80555A), ten (10) business days after the end of the first month after task award, and monthly thereafter. The Contractor shall submit a Contract Summary Report (DI-ADMN-80447A). The Contract Summary Report shall be submitted within thirty (30) days following task conclusion, and shall include a summary of work completed on the task.

5.7 The Contractor shall report within twenty four (24) hours any major accident/incident (including fire) resulting in any one or more of the following: causing one or more fatalities or one or more disabling injuries; damage of Government property exceeding $10,000; affecting program planning or production schedules; degrading the safety of equipment under contract, such as personnel injury or property damage may be involved; identifying a potential hazard requiring corrective action which are related to this contract. The Contractor shall prepare an Accident/Incident report (DI-SAFT-81563). A separate accident/incident report shall be submitted immediately, no later than five (5) business days after each accident/incident.

6. COMBATING TRAFFICKING IN PERSONS

6.1 The Contractor shall establish policies and procedures for ensuring its employees do not engage in or support trafficking in persons or use forced labor in the performance of this contract.

7. SECURITY

7.1 THIS EFFORT IS UNCLASSIFIED.

7.2 For Contractors Requiring Common Access Card (CAC) Before CAC issuance, The Contractor employee requires, at a minimum, a favorable adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-

05. The Contractor employee will be issued a CAC only if duties involve one of the following: (1) both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) remote access, via logon, to a DoD network using DoD approved remote access procedures; (3) physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled National Awareness Check With Inquiries (NACI) at the Office of Personnel Management.

7.3 Employees Who Require Access to Government Information Systems - All Contractor employees, including subcontractor employees, with access to a Government information system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services and must successfully complete the DoD Cyber Awareness training prior to access to the information system and then annually thereafter.

7.4 Information Assurance (IA)/Information Technology (IT) Training - All Contractor employees, including subcontractor employees, must complete the DoD Cyber Awareness training before issuance of network access and annually thereafter (DI-MGMT-81862, Tailored). All Contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoD 8570.01-M, and AR 25-2 within six months of employment.

7.5 Government Furnished Items - All Contractor employees, including subcontractor employees, will return all issued U.S. Government owned equipment, Common Access Cards, installation badges, and/or access passes to the COR when the contract is completed or when a Contractor employee no longer requires access to the installation or facility.

7.6 Information Management Army Information Technology /IA. The Contractor shall be capable of accessing, handling, receiving, and storing UNCLASSIFIED documents, equipment, hardware, and test items, using the applicable standards of For Official Use Only (FOUO) information. Controlled Unclassified Information (CUI) (documents designated as FOR OFFICIAL USE ONLY and/or LIMITED DISTRIBUTION) shall be submitted by a controlled means using United States Postal Service (USPS) mail, Safe Access File Exchange (SAFE) website and/or DoD Army approved encryption software as per AR 25-1.

7.7 Export Control Laws/International Traffic in Arms Regulation. DFARS Clause 252.225-7048, Export-Controlled Items applies to this effort. All documents determined to contain export controlled technical data shall be marked with the following notice: WARNING: - This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., App. 2401 et seq. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.

7.8 Development of an Operations Security (OPSEC) Standing Operating Procedure/Plan The Contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan, (DI-MGMT-80934C), within ninety (90) calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer, per AR 530-1, Operations Security. This SOP/Plan will specify the projects critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. In addition, the Contractor shall identify an individual who will be an OPSEC Coordinator. The Contractor will ensure that this individual becomes OPSEC Level II certified per AR 530-1. DEVCOM Armaments Center OPSEC POC email: usarmy.pica.ccdc-ac.mbx.ardec-opsec@mail.mil

7.9 OPSEC Training - Per AR 530-1 (or DoDM 5205.02-M), new Contractor employees, including subcontractor employees, must complete initial (Level I) OPSEC training within thirty (30) calendar days of reporting for duty and must also complete annual OPSEC awareness training as provided by the appropriately designated OPSEC level II trained OPSEC Officer/Coordinator (DI-MGMT-81862, Tailored). The COR or Agreements Officer Representative (AOR) can request DEVCOM Armaments Center OPSEC training from the DEVCOM Armaments Center OPSEC POC e-mail: usarmy.pica.ccdc-ac.mbx.ardec-opsec@mail.mil.

7.10 Public Release of Information - Per AR 530-1(or DoDM 5205.02-M), an OPSEC review is required prior to all public releases. All Government information intended for public release by a contractor will undergo a government OPSEC review prior to release.

7.11 Controlled Unclassified Information (CUI) OR Critical Program Information (CPI). System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews:

(a) Within thirty (30) calendar days of contract award, unless otherwise notified by the Government, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered Contractor information system(s) available for review by the Government at the Contractor's facility. The SSP(s) shall describe how the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 security requirements are implemented as required by Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract, and identify all applicable Commercial and Government Entity Code codes affected. The Contractor shall fully cooperate in the Government's review of the SSPs at the Contractor's facility.

(b) If the Government determines that the SSP(s) does not adequately describe how the NIST SP 800-171 security requirements are implemented, then the Government will notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) calendar days of notification by the Government. The Contracting Officer may provide for a correction period longer than thirty (30) calendar days and, in such a case, may require the Contractor to submit a Plan of Action and Milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the Contracting Officer of any failure or anticipated failure to meet a milestone in such a POAM.

(c) Upon conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor's facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

(d) The Government may, in its sole discretion or in response to a cyber incident, conduct subsequent reviews at the Contractor's site to verify the information in the SSP(s). The Government may conduct reviews at any time upon thirty (30) calendar days' notice to the Contractor.

7.12 Controlled Unclassified Information (CUI) OR Critical Program Information (CPI). Compliance to NIST SP 800-171:

(a) The Contractor shall fully implement the Controlled Unclassified Information (CUI) Security Requirements (Requirements) in NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the Contracting Officer, or establish a SSP(s) and POAMs) that varies from NIST SP 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered Contractor information systems affecting this contract.

(b) Notwithstanding the allowance for such variation, the Contractor shall identify in any SSP and POAM their plans to implement the following, at a minimum:Aug 2016

(1) Implement Requirement 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Requirement 3.1.5 (least privilege) and associated Requirements, and identify practices that the Contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Requirement 3.1.12 (monitoring and control remote access sessions)-Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods;

(4) Audit user privileges on at least an annual basis;

(5) Implement Requirement 3.13.11 (Federal Information Processing Standards (FIPS) 140-2 validated cryptology or implementation of National Security Agency- or NIST-approved algorithms (i.e., FIPS 140-2 Annex A: Advanced Encryption Standard (AES) Or Triple Data Encryption Standard (DES) or compensating controls as documented in a SSP and POAM));

(6) Implement Requirement 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which can be evaluated by the Government Program Manager for risk to the program;

(7) Implement Requirement 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

7.13 Controlled Unclassified Information (CUI) OR Critical Program Information (CPI). Army Counterintelligence (CI) Outreach: The Contractor shall engage, whenever practicable, with Army Cl industry outreach efforts and consider recommendations for hardening of covered Contractor information systems affecting Army programs and technologies; and make Contractor personnel available for threat briefings specific to foreign intelligence threats to Army programs and technologies.

7.14 Controlled Unclassified Information (CUI) OR Critical Program Information (CPI). Cyber Incident Response:

(a) The Contractor shall, within fifteen (15) calendar days of discovering the cyber incident (inclusive of the seventy two (72)-hour reporting period in DFARS clause 252.204-7012), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact. Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/lnstructions_for_Submitting_Media.docx . In delivery of the incident data, the Contractor shall, to the extent practical, remove Contractor-owned information from Government covered defense information.

(b) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the Contracting Officer in writing and shall deliver the incident data within ten (10) calendar days of identification. In such a case, the Contractor may request a delivery date later than ten (10) calendar days after identification. The Contracting Officer will approve or disapprove the request after coordination with DC3.

7.15 Controlled Unclassified Information (CUI) OR Critical Program Information (CPI). Army CI/Industry Monitoring:

(a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Army Cl, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor, or vendor logs that show network activity, including any additional logs the Contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

(b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor shall coordinate with Army Cl to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by the Army Cl, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an Army Cl network device shall be the subject of a separate agreement negotiated between Army Cl and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by Army Cl. Use of this alternative approach shall also be the subject of a separate agreement negotiated between Army Cl and the Contractor.

(c) In all cases, the collection or provision of data and any activities associated with this PWS shall be in accordance with federal, state, and non-U.S. law.

7.16 Information Disclosure - A Certificate of Non-Disclosure shall be signed by all Contractor employees working under this task and returned to the COR within thirty (30) calendar days of task award (DI-MGMT-82241). The Contractor shall not release any information or data without the approval of the Government.

8. NON-UNITED STATES CITIZEN EMPLOYEE REQUIREMENTS

8.1 For the performance of this contract, the Contractor shall utilize only employees who are United States citizens or lawfully admitted and employed non-citizens. Non-United States citizens will not be allowed to perform work on contracts or subcontracts involving access (or possible access) to sensitive data, software, or equipment without prior approval from Headquarters, Army Futures Command.