PWS Final.docx

CUI

Northstar Network Communications Services

CUI

Northstar Network Communications Services

PERFORMANCE WORK STATEMENT (PWS)

Award

Contract Number:

Task Order Number:

Contractor Name

1. Contracting Officer’s Representative (COR).

a. Primary COR. Intentionally left blank.

b. Alternate COR. Intentionally left blank.

c. Property Administrator. Intentionally left blank

2. Contract or Task Order Title. Northstar Network Communications Services

3. Background. The Northstar Network is an Ultra-High Frequency/Line of Sight (UHF/LOS) communications system network. The communication services consist of digital voice, video, and data provided to suitably equipped aircraft users with coverage throughout the Continental United States (CONUS). The Northstar Network’s current configuration is comprised of Ground Entry Points (GEPs) controlled by Special Government Operation Centers (SGOCs). Each GEP shall be equipped with UHF communications equipment. Each GEP shall be capable of supporting digital communications to and from aircraft simultaneously. Through the Northstar Network, an aircraft may gain access to Department of Defense (DoD) Executive Airlift Communications Network (EACN), Secret IP Data Service (formerly known as Secret IP Router Network (SIPRNET)), Sensitive but Unclassified IP Data Service (formerly known as Non-secure Internet Protocol Router Network (NIPRNET)), as well as other voice and data networks. EACN is a network that provides digital voice, data, and video access utilizing various government and commercial transports.

Commander, Naval Air Forces, Atlantic, is responsible for oversight of the Northstar Network.

4. Objectives: The primary objective of this acquisition is to acquire a clear, secure voice, video and data communications connectivity under the existing Northstar Network to provide support to the Navy E-6B Aircraft. The communications services shall be available 24 hours a day, seven days a week, year-round (24/7/365). The Contractor shall protect and safeguard all sensitive Government Provided Information from inadvertent disclosure, misuse, display, theft, and unauthorized actions that would compromise, destroy and/or render the information unavailable for Government use.

5. Scope. The Contractor shall provide all materials, tools, equipment, travel, and labor necessary to provide continuous 24/7/365 connectivity to satisfy day-to-day alert and operational communications requirements to Government senior leadership. The primary components of the existing Northstar Network infrastructure consist of two SGOCs, 21 GEPs in support of digital services, not to include analog.

· Performance Area 1 – SGOCs

· Performance Area 2 - GEPs

· Performance Area 3 – GEP Maintenance

· Performance Area 4 – Long-Haul Circuits

· Performance Area 5 – Digital Communications

· Performance Area 6 – Network Technology Refresh Proposals

· Performance Area 7 – Quarterly Meetings

· Performance Area 8 – Network Trouble, Interference, and Usage Reports

6. Performance Requirements. The performance requirements under this PWS relate to the overall requirement to provide continuous telecommunications services to Government senior leadership. The quality of service must be at a level that will not compromise throughput, data integrity, and/or security. The following sections provide the technical requirements for the overall Northstar Network infrastructure.

6.1 Task 1 - SGOCs

6.1.1 Subtask 1 Communications service delivery shall be provided and monitored via at least two (2) SGOCs which will serve as hubs of the Northstar Network. The two SGOCs shall be geographically separated to eliminate Radio Frequency (RF) interference and ensure mission survivability.

6.1.2 Subtask 2 Each SGOC shall be capable of remotely accessing any given GEP. The SGOC shall have the capability to select the desired radio frequency channel, and choose the correct radio equipment that will be used to provide service to a user. The SGOCs will monitor radio frequencies used by an aircraft flying within range of the GEPs and de-conflict any potential interference issues.

6.1.3 Subtask 3 The Network shall provide a digital communications link between the E-6B aircraft and the GEPs/SGOCs. The GEPs shall provide optimum Omni- directional coverage to an aircraft operating at 25,000 feet, except for those providing additional coverage for aircraft on the ground. Through the Northstar Network, aircraft shall have the ability to gain access to Department of Defense Information Networks (DoDIN) such as SIPRNet, NIPRNet, EACN, and various other secure and non-secure networks. Maintenance support shall be accomplished by on-call technicians who are available 24/7/365. The Contractor shall respond within two hours of notification of an operational problem.

6.1.4 Subtask 4 The Contractor shall provide RF spectrum monitoring and containment for the GEPs. Frequencies and bandwidth separations shall be maintained, monitored, and controlled.

6.1.5 Subtask 5 In the event of a commercial power failure, the Contractor shall provide and maintain a backup power system that is capable of fully supporting the Northstar Network for a minimum of 72 hours.

6.1.6 Subtask 6 The GEP/SGOC locations shall have controlled access and the security alarms at the GEPs/SGOCs shall be monitored.

6.1.7 Subtask 7 Service shall be delivered in full digital mode. Service delivered in full digital mode shall be full duplex end-to-end with a minimum data rate of 768 kilobits per second (kbps) within a 500 kilohertz (kHz) channel. Error detection shall be utilized. The GEPs/SGOCs shall be capable of maintaining a minimum of 6Mb/s network bandwidth. The GEPs shall be controllable and monitored remotely.

6.1.8 Subtask 8 The link with an aircraft shall be via Ultra High Frequency radio utilizing military frequencies, which are designated by the Government.

6.1.9 Subtask 9 A suitable digital waveform contained within a 500 kHz or 1.2 MHz channel as assigned, shall be used for the digital transmission. When operating in digital mode, the output power to the transmit antenna shall be a maximum of 500 watts.

6.1.10 Subtask 10 Communications with an aircraft on the ground shall be via UHF radio or telephone call.

Deliverable:

6.2 Task 2 Ground Entry Points (GEPs)

6.2.1 Subtask 1 The Contractor shall provide a network of GEPs capable of providing RF communications service equal to the current coverage. (See Appendix C, Northstar GEP Coverage Map).

6.2.2 Subtask 2 Whenever possible, GEPs shall be located at elevated sites to provide optimum UHF line-of-sight (LOS) coverage. The nominal GEP configuration provides approximately 180 nautical miles (nmi) of Omni-directional coverage to an aircraft flying at 25,000 feet above sea level. Actual LOS coverage varies at different locations based on terrain, aircraft altitude, distance, and interfering transmission sources. Whenever possible, GEP LOS coverage to the aircraft users shall overlap for adjacent GEPs. Locations where overlap is not possible shall be noted in system documentation. In the event that any GEP is disabled, communications traffic shall be routed to the next available GEP.

6.2.3 Subtask 3 When operating in digital mode, the link with an aircraft shall be via Ultra High Frequency radio utilizing military frequencies designated by the Government. Digital waveform will be contained within a 500 kHz or 1.2 MHz channel. The output power from the radio and High Power Amplifier to the antenna will be 100 watts minimum peak envelope power (PEP) power for digital.

6.2.4 Subtask 4 Communications with an aircraft on the ground shall be via UHF radio or telephone call.

6.2.5 Subtask 5All of the GEPs shall be configured for dual operations. During dual operations, a GEP must be capable of supporting two aircraft with digital services simultaneously. Dual operations mean that each GEP has at least two radios, and capacity of 6Mb/s.

6.3 Task 3 GEP Maintenance

6.3.1 Subtask 1 The contractor shall complete all preventative maintenance and unscheduled repairs of the Northstar Network to provide the required level of performance as stated in Section 7. The Contractor shall support a Network Operations Control Center that is capable of isolating and resolving communication problems.

6.3.2 Subtask 2 Maintenance support shall be on call and be available 24/7/365. The Contractor shall immediately respond upon identification of an operational issue with a GEP, SGOC, and/or data circuits and shall provide a resolution update within 72 hours.

6.3.3 Subtask 3 The Contractor shall perform GEP and SGOC preventive maintenance as needed to preserve the communications throughput and performance of the network. The Contractor shall document the procedures and provide updates to the procedures as needed. The Contractor shall deliver a copy of the preventive maintenance procedures to the government.

Deliverable:

6.4 Task 3 Long-Haul Circuits

6.4.1 Subtask 1 Each SGOC shall be connected via multiple circuits to each GEP to minimize a single point of failure in any GEP coverage area. The origination and routing of each circuit shall provide for overall redundancy in the network connectivity. The Contractor shall provide service in digital mode to support voice video and data communications. The trunk minimum T-1 path between the aircraft and the network must be full duplex end-to-end, capable of supporting 768kbps data rates.

6.5 Task 5 Digital Communications

6.5.1 Subtask 1 Each GEP shall have at least 1.544 Mbs dedicated for digital operations. A minimum data rate of 768 Kbps in digital mode must be supported. Error detection shall be utilized on every circuit. The Contractor shall develop and utilize a database to trace and troubleshoot circuits and deliver a circuit connectivity drawing for each circuit in the network.

6.5.2 Subtask 2 The Contractor shall ensure, whether operating in full digital mode, the link with an aircraft shall be via UHF radio.

6.6 Task 6 Network Technology Refresh Proposals

6.6.1 Subtask 1 The Contractor shall notify the Government when a technology refresh is deemed necessary. The Contractor may submit unsolicited technology insertion proposals as technology evolves and to shift their focus to commercial electronics using commercial off-the-shelf (COTS) components.

6.7 Task 7 Quarterly Meetings

6.7.1 Subtask 1 The Contractor shall participate in quarterly Ground Entry Point Working Group (GEPWG) meeting coordinated by Strategic Communications Wing ONE. These meetings will normally be held via microsoft teams and/or SVTC should classified topics require discussion. The Government will notify the Contractor of the exact date approximately 60 days prior to the meetings. The Contractor will not be held responsible for inability to attend based upon difficulties or limitation issues encountered with attending via remote means.

6.7.2 Subtask 2 Contractor shall conduct a monthly Program Management Review (PMR) of the Northstar Network. The Contractor shall provide the following in each PMR: Network metrics such as usage, degradation, program management information in addition to planning and implementation activities. Additionally, the Contractor shall address all other tasks performed during the month. The Contractor shall address contractor conformance to Government-approved schedules and milestones and shall report on foreseeable delays and associated schedule recovery actions. The Contractor shall analyze all Government questions, comments, and concerns raised during these reviews and report the results of these analyses to the Government.

Deliverable:

6.8 Task 8 Network Trouble, Interference and Usage Reports

6.8.1 Subtask 1 The Contractor shall provide monthly reports on the status of the Northstar Network, to include but not limited to: maintenance actions, interference issues, and individual GEP usage reports. Interference reports on an as needed basis.

Deliverable:

7. Performance Standards.

Service shall be delivered in full digital mode. Service delivered in full digital mode shall be full duplex end-to-end with a minimum data rate of 768 kilobits per second (kbps) within a 500 kilohertz (kHz) channel. Error detection shall be utilized. The GEPs/SGOCs shall be capable of maintaining a minimum bandwidth of 6 Mb/s. Maintain 99% system availability for each requested mission.

Performance occurs when each SGOC is capable of remotely accessing any given GEP. The SGOC shall have the capability to select the desired radio frequency channel, and choose the correct radio equipment that will be used to provide service to a user. Maintain 99% system availability for each requested mission.

Customer input;

Contractor provides Verification Requirements Testing Matrix (VRTM) Monthly Trouble/ Usage reports

Customer input;

Contractor provides VRTM Monthly Trouble/ Usage reports

Contractor provides VRTM Monthly Trouble/ Usage reports

Monthly Trouble/ Usage reports

8. Incentives. None.

9. Place of Performance.

Mission Location: Offutt AFB NE and Waldorf MD

Place of Performance: The Contractor shall have technical teams located in the SGOCs to support telecommunications operations which include: connectivity, continuity of operations and real-time equipment and data circuit trouble shooting.

Local travel to and around the mission location or place of performance, mission location such as DISA HQ Ft. Meade include contractor’s facility as well if that is part of the place of performance may be required throughout the period of performance; this travel will not be reimbursed. Long distance travel within CONUS may be required to support the requirements of this PWS. Long distance travel within CONUS must be pre-approved in writing by the COR prior to the Contractor incurring the cost in support of this contract.

Secondary Place of Performance – Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at a secondary place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather). Additionally, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

10. Period of Performance. The period of performance shall consist of a one-year base period with two (2) one-year option periods.

Unplanned Federal Government Closure: In the event an authorized official, by either executive or legislative order, declares Federal offices closed (treated as a holiday for pay and leave purposes), the order only applies to Federal employees (unless otherwise stated in the order).

11. Security Requirements. This section supplements Block 13 of the Government provided DD Form 254, Contract Security Classification Specification. The following security requirements shall apply to this effort.

The contractor shall coordinate visits with site Point of Contract (POC)s providing at least a 72-hour notice (or according to each site security requirements) prior to any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by cleared DISA personnel (civilian, military, or contractor).

References:

a. DISA End User Access Agreement

b. DISA Instruction 240-240-01, External Peripheral Devices Authorized for Network Connectivity

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-34, Controlled Unclassified Information (CUI)

e. DISA Instruction 240-110-36, Personnel Security

f. DISA Instruction 240-110-38, Industrial Security

g. DISA Instruction 240-110-43, Counterintelligence

h. DISA Instruction 240-110-43, Insider Threat Program

i. DISA Instruction 630-230-19, Cybersecurity

j. DoD Manual 5200.01, Vol. 1 and 3, DoD Information Security Program, 17 January 2025

k. DoD Manual 5200.01, Vol. 2, DoD Information Security Program, 28 July 2020

l. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

m. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP), 3 April 2017, Change 1, 29 October 2020

n. 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM), 24 February 2021

o. DoD Directive 5240.06, Counterintelligence Awareness and Reporting (CIAR), 17 May 2011, Change 3, 31 August 2020

p. DoD Instruction O-5240.24, Counterintelligence (CI) Activities Supporting Research, Development, and Acquisition (RDA), 8 June 2011, Change 2, 15 July 2020

q. DoD Instruction 5205.16, “The DoD Insider Threat Program,” December 20, 2024

r. DoD Instruction 5230.24, Distribution Statements for DoD Technical Information, 10 January 2023

s. DoD Instruction 8510.01, Risk Management Framework for DoD Systems, 19 July 2022

t. DoD Manuel 5400.07, DoD Freedom of Information Act (FOIA) Program, 25 January 2017

u. Security Executive Agent Directive 3 (SEAD 3) Reporting Requirements for Personnel With Access To Classified Information or Who Hold Sensitive Position, 12 June 2017

v. Security Executive Agent Directive 4 (SEAD 4), National Security Adjudicative Guidelines, 8 June 2017

w. DISA Instruction 240-15-4 United States Security Authority for North Atlantic Treaty Organization Affairs.

11.1 Facility Security Clearance. Work performed under this contract/order is up to the Top Secret level. Therefore, the company must have a final Top Secret Facility Clearance from the Defense Counterintelligence and Security Agency (DCSA) Facility Clearance Branch.

11.1.2 Invalidated Facility Clearance. Companies with invalidated facility clearances (including those in partnerships, subcontracts, and Joint Ventures) are not eligible to bid on or be awarded any new or additional DISA classified contracts, subcontracts, or receive additional classified information except for information necessary for the completion of your current classified contracts. In addition, those companies with invalidated facility clearances will not be permitted access to all DISA networks. Performance on any DISA classified contracts, at any location, will not be authorized until it has been granted a Facility Security Clearance (FCL) at the appropriate level by DCSA.

11.2 Security Clearance. All personnel performing on or supporting a DISA contract/order in any way shall be United States citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance eligibility delineated in the table below when performance starts.

Performance Area 1 – SGOCs

Performance Area 4 – Long-Haul Circuits

11.3 Investigation Requirements. All personnel requiring Final Top Secret access under this contract/order shall undergo a favorably adjudicated Tier 5 (T5) investigation (formerly known as a Single Scope Background Investigation (SSBI)) as a minimum requirement. Enrollment into Continuous Evaluation current within 5 years and reflected in Defense Information System for Security (DISS), would meet the requirement for a current Periodic Reinvestigation (PR).

11.3.1 The contractor is required to have personnel cleared with an interim or final Top Secret at contract start date. If contractor personnel are replaced during performance of the contract, replacement personnel should also have interim or final clearance Top Secret.

11.4 Visit Authorization . Visit requests shall be processed and verified through the DISS to the Security Management Office (SMO) N555755. DISS visits for contracts/orders are identified as “Other” or “Temporary Additional Duty (TAD)/Temporary Duty (TDY)” and will include the Contract/Order Number of the contract/order in the Additional Information section. Contractors that do not have access to DISS may submit visit authorizations by e-mail in a password protected portable document format file (.pdf) to the COR/ACOR specified in PWS/SOW Section 1.0.

11.4.1 VAR Package. VAR Centers must receive VAR packages from the Security Manager (via email and require pre-approval from the assigned DISA COR) at a minimum of five business days in advance of the initial report date or renewal. For option years, VARs should be renewed 30-90 days prior to the expiration date unless modified sooner for changes such as name, COR/sponsor, contract modification, etc. As an option, a VAR can be approved for up to a maximum of three (3) years within the POP for contractors. The VAL/VAR/VTN should be sent via email to the appropriate COR. The VAL/VAR/VTN should be sent using in a locked “Zip” file in one e-mail and then followed up by another e-mail with the password to unlock the Zipped file, because it contains sensitive information covered by the Privacy Act.

Documents to include in the VAR Package (DISA Field Sites may have site specific VAR requirements):

1. Inter-office Memorandum (IOM)

2. DD Form 254 Prime and/or Sub (Good Standing approval emails for current option year)

3. PWS/SOW/Sub Memo

4. DISS verification of Visit Authorization by Security Manager

5. (Optional: see NOTE below) Contractor VAL signed by the Contractor Facility Security Officer (FSO)

NOTE: If DISS is not available, the VAL must contain the following information on company letterhead:

· Company name, address, telephone number, facility security clearance

· Commercial and Government Entity Code (CAGE CODE)

· Contract/Order Number

· Name, Social Security Number (SSN), date and place of birth, and citizenship of the employee intending to visit, email address, and phone number

· Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date and adjudication date & agency)

· Name of COR/Alt COR

· Dates or period the VAL is to be valid (i.e., Start date / End date)

11.4.2 VTN Package. The Contractor FSO will forward a VTN letter to the DISA COR identified in the PWS/TO/Sub for all employees leaving the contract/task order/subcontract.

11.4.2.1 In addition, the DISA CORs and security managers shall inform the DISA Security Office when contractor personnel are removed for cause from a contract supporting DISA. This step is to identify contractor personnel removed for security related issues in case of a return to DISA without appropriate vetting.. This step will also provide security with pertinent information to make an informed decision regarding potential contractor employees’ access to secure facilities and sensitive information. “For Cause” is information regarding an individual that falls into one or more of the actions or incidents that are within one of the 13 adjudicative guidelines as cited in the Security Executive Agent Directive (SEAD) 4:

a. Allegiance to the United States

b. Foreign Influence

c. Foreign Preference

d. Sexual Behavior

e. Personal Conduct

f. Financial Considerations

g. Alcohol Consumption

h. Drug Involvement and Substance Misuse

i. Psychological Conditions

j. Criminal Conduct

k. Handling Protected Information

l. Outside Activities

m. Use of Information Technology Other actions:

• Incidents involving violence in the workplace or harassment.

• Misuse of time.

• Inspector General or General Counsel related inquiries.

• Failure to comply with security policies and procedures.

• Other reasons that prompted removal of a contractor.

The VTN must contain the following information on company letterhead:

· Company name, address, telephone number, facility security clearance

· CAGE CODE

· Contract/Order Number

· Name, SSN, date and place of birth, and citizenship of the employee, email address, phone number

· Date contractor Common Access Card (CAC) was collected

· Name of COR/Alt COR

· Termination Date

· Reason for Termination: <insert reason from the 13 adjudicative guidelines, other actions, or type “No longer working on contract”>

*Any VAL/VAR submitted without the above information will be denied.*

11.5 Security Contacts. DISA Security Personnel can be contacted for Industrial or Personnel Security related issues at the following:

Defense Information Systems Agency

Defense Information Systems Agency

ATTN: J-16, Industrial Security

ATTN: J-16, Personnel Security

Command Building

Command Building

6910 Cooper Ave.

6910 Cooper Ave.

Fort Meade, MD 20755-7088

Fort Meade, MD 20755-7088 disa.meade.j1.mbx.mp6-industrial-security@mail.mil disa.meade.j-1.list.mp6-personnel-security@mail.mil

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

Name: SCW-1 Security Manager Phone Number: (405)739-5796 E-mail: Wing_Security_Manager@us.navy.mil

11.6 Information Security and other miscellaneous requirements.

11.6.1 Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the Government facility.

11.6.2 Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract/order.

11.6.3. Contractor employees with an incident report in DISS who have had their access to classified suspended will not be permitted to fill positions requiring access to classified information on a DISA contract/order.

11.6.4 The Contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

11.6.5 The authority for the contractor personnel to regain access must be granted by DISA Chief of Security.

11.6.5.1 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

11.6.5.2 DISA retains the right to revoke access to DISA facilities and networks from contractor personnel who violate one or more of the National Security Adjudicative Guidelines, harassment, insider threat, counterintelligence, or violence in the workplace while assigned to a contract clearly conflict with the interest of the Government.

11.6.5.3 If contractor employee is accused of violating state or federal laws and/or Government professional conduct policies or regulations, then the Government may require that such contractor employee be removed from Government premises and/or that such contractor employee be removed from supporting this contract, pending the duration and outcome of a Government investigation if the Contracting Officer finds that the conduct or violation alleged has the potential to negatively interfere with contract performance or operations at a Government facility. Only the Contracting Officer can make such a request on behalf of the Government. Removal of contractor employee shall not negatively impact contract performance.

11.6.6 Contractor personnel will generate or handle documents that contain Unclassified or Controlled Unclassified Information (CUI) at the Government and/or contractor facility. Contractor personnel will generate or handle documents that contain Proprietary, Contract Sensitive, or similarly designated information at the Government and/or contractor facility. Contractor personnel will have access to, generate, and handle classified material up to TOP SECRET level only at the Government and/or contractor location(s) (Ref: Block 8 Place of Performance on DD254) and listed in the place of performance section of this document. All contractor deliverables shall be marked in accordance with DoDM 5200.01, Vol. 2, DoD Information Security Program: Marking of Information; DoDI 5200.48, Controlled Unclassified Information (CUI); and DoDM 5400.07, Freedom of Information Act Program, unless otherwise directed by the Government. The contractor shall comply with the provisions of 32 CFR Part 117, “National Industrial Security Program Operating Manual (NISPOM)” for handling classified material and producing deliverables. The contractor shall comply with DISA Instruction 630-230-19, Cybersecurity.

11.6.7 The Contractor shall afford the Government access to the contractor’s facilities, installations, operations, documentation, databases and personnel used in performance of the contract/order. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of data or to the function of information technology systems operated on behalf of DISA or DoD, and to preserve evidence of computer crime.

11.6.8 Foreign Travel Requirements: DISA Contractors are required to submit their official and unofficial foreign travel and foreign contacts via the Corporate Management Information Systems (CMIS) which may require a dual reporting requirement in accordance with DISA Instruction 240-110-35; DISA Instruction 240-110-43; Security Executive Agent Directive 3 (SEAD 3) Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position.

11.6.9 Mandatory Security Training. All DISA Contractors are required to complete the DoD initial and annual security training for the following in accordance with (IAW) 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM):

· Security Awareness

· Level I Antiterrorism Awareness

· Derivative Classification

· Controlled Unclassified Information (CUI)

· Operational Security (OPSEC) Awareness for Military Members, DoD Employees, and Contractors

· DISA Counterintelligence and Awareness Reporting (CIAR) training IAW DISA Instruction 240-110-43 Counterintelligence; DoDD 5240.06 Counterintelligence Awareness and Reporting (CIAR); and DoDI O-5240.24 Counterintelligence (CI) Activities Supporting Research, Development, and Acquisition (RDA).

· DISA Insider Threat Awareness: Contractors supporting DISA are required to complete the DISA Annual Insider Threat Awareness Training through the DISA Virtual Campus IAW the standards in DoD Instruction 5205.16, “The DoD Insider Threat Program,” December 20, 2024, regardless of insider threat awareness training provided by their employer.

11.6.9.1 Contractors supporting DISA onsite are required to complete the DoD initial or annual training through the DISA mandatory training system.

11.6.9.2 Contractors supporting DISA offsite are required to meet the DoD initial or annual training requirement through their employers who are to provide this training and maintain training documentation. The contractor supervisor needs to certify in writing and email completion certificates to the COR and DISA Security Manager that off-site contractors completed the training before receiving credit. The DISA Security Manager will update CMIS records, if available.

12. Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government-Furnished Information (GFI). None.

13. Other Pertinent Information or Special Considerations.

a. Identification of Possible Follow-on Work. None.

b. Identification of Potential Conflicts of Interest (COI). None.

c. Identification of Non-Disclosure Requirements. The contractor shall obtain and maintain Non-Disclosure Agreements (NDA) for each employee assigned to the contract. Initial NDAs shall be signed within one week of contract award, and NDAs shall be kept current through the entirety of the period of performance as employee turnover occurs. The contractor shall ensure that all employees assigned to the contract have executed NDAs on file as of the date of the Monthly NDA Status Report, which shall include names and NDA status of all current employees assigned to the contract.

Deliverable:

d. Packaging, Packing and Shipping Instructions. None.

e. Inspection and Acceptance Criteria. None.

f. Property Accountability. None.

g. Transitioning.

1. Transition-In (Phase In). All key personnel/key positions must be onboard at start of the period of performance. 50 percent total staffing must be complete within two weeks of the start of the PoP and 100 percent within 30 days.

2. Transition-Out (Phase Out). After contract expiration occurs, the Contractor will have 60 days to remove any contractor-furnished equipment from government sites.

h. Supply Chain Risk Management (SCRM).

This contract and its associated delivery/task orders are subject to the Federal SCRM policies and regulations including DFARS 252.239-7017 Notice of Supply Chain Risk, 252.239-7018 Supply Chain Risk, DoD Instruction 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks, Section 806 of the FY2011 NDAA Requirements for Information Relating to Supply Chain Risk, and internal DISA SCRM Processes and Procedures. Each individual delivery and/or task order will submit a SCRM Plan as part of the technical proposal, which addresses, at a minimum, Supply Chain Security Controls as specified in the delivery/task order and described in the Committee on National Security Systems Instruction (CNSSI) 1253 Appendix D (companion publication to National Institute of Standards and Technology (NIST) Special Publication (SP)).

This contract and its associated delivery/task orders are subject to the Federal SCRM policies and regulations including DFARS 252.239-7017 Notice of Supply Chain Risk, DFARS 252.239-7018 Supply Chain Risk, DoD Instruction 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks, Section 806 of theFY2011 NDAA Requirements for Information Relating to Supply Chain Risk, and internal DISA SCRM Processes and Procedures.

The contractor shall submit a SCRM plan as part of its technical proposal that describes how the contractor will reduce and mitigate Supply Chain Risk using the security controls outlined below (further described in CNSSI 1253, Appendix D and NIST SP 800-53), as applicable to your contract.

Control Enhancement Name

DELIVERABLES:

SUPPLY CHAIN RISK MANAGEMENT PLAN UPDATE: The contractor shall provide an updated SCRM Plan to the COR and Program Manager within five (5) business days whenever there is a change that affects one or more security controls as described in the Committee on National Security Systems Instructions (CNSSI) 1253 Appendix D (companion publication to National Institute of Standards and Technology (NIST) Special Publication (SP)). At a minimum, the following events will require a SCRM Update: changes in company ownership, changes in senior company leadership, supplier changes, subcontractor changes, and Information and Communications Technology (ICT) supply chain compromises.

i. Training. Contractor employees may be required to take periodic mandatory training courses provided through the agency, such as records management training, Controlled Unclassified Information (CUI) training, and other training required by statute, regulation, DoD, or DISA policy. No other training of contractor personnel shall be provided by the Government unless authorized by the Contracting Officer.

j. Requirement to Inform Employees of Whistleblower Rights. None.

14. Section 508 Accessibility Standards.

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities.

Item that contains ICT: Northstar Network Communications Services

Northstar Network Communications Services

E202 General Exceptions

E202.4 Federal Contracts. ICT acquired by a contractor incidental to a contract shall not be required to conform to the Revised 508 Standards.

E206 Hardware

E206.1 General. Where components of ICT are hardware and transmit information or have a user interface, such components shall conform to the requirements in Chapter 4.

E208 Support Documentation and Services

E208.1 General. Where an agency provides support documentation or services for ICT, such documentation and services shall conform to the requirements in Chapter 6.

E302 Functional Performance Criteria

302.1 Without Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that does not require user vision.

302.2 With Limited Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited vision.

302.3 Without Perception of Color. Where a visual mode of operation is provided, ICT shall provide at least one visual mode of operation that does not require user perception of color.

302.4 Without Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that does not require user hearing.

302.5 With Limited Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited hearing.

302.6 Without Speech. Where speech is used for input, control, or operation, ICT shall provide at least one mode of operation that does not require user speech.

302.7 With Limited Manipulation. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that does not require fine motor control or simultaneous manual operations.

302.8 With Limited Reach and Strength. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that is operable with limited reach and limited strength.

302.9 With Limited Language, Cognitive, and Learning Abilities. ICT shall provide features making its use by individuals with limited cognitive, language, and learning abilities simpler and easier.

602 Support Documentation

602.1 General. Documentation that supports the use of ICT shall conform to 602.

603 Support Services

603.1 General. ICT support services including, but not limited to, help desks, call centers, training services, and automated self-service technical support, shall conform to 603.

603.2 Information on Accessibility and Compatibility Features. ICT support services shall include information on the accessibility and compatibility features required by 602.2.

603.3 Accommodation of Communication Needs. Support services shall be provided directly to the user or through a referral to a point of contact. Such ICT support services shall accommodate the communication needs of individuals with disabilities.

15. Cybersecurity Maturity Model Certification (CMMC)

This contract and its associated delivery/task orders are subject to the Federal CMMC policies and regulations including DFARS 204.75 Cybersecurity Maturity Model Certification, DFARS 252.204-7021 Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements, and 32 CFR §170, Cybersecurity Maturity Model Certification (CMMC) Program. The CMMC Program is designed to ensure implementation of cybersecurity practices for defense contractors and to provide DoD with increased assurance that Federal Contract Information (FCI) and CUI will be adequately safeguarded when residing on or transiting contractor information systems.

The Program Management Office/COR has determined that CMMC Level 3 (DIBCAC) is required for this contract. In accordance with CMMC policy codified at 32 CFR §170, Contractor compliance with CMMC Level 3 (DIBCAC) must be met at time of award, and continued compliance with the requirements of 32 CFR §170 is necessary for the life of the contract.

Page 1 of 17 Pages Controlled By: SCW-1 Controlled By: N6 CUI Category: SP-CONTRACT Distribution/Dissemination Control: FEDCON POC: LT John Glamm, john.d.glamm.mil@us.navy.mil

Page 2 of 17 Pages