RFI - PWS NAVSUP_OTS.pdf

Performance Work Statement (PWS) for One Touch Support

Versatilist Developer Support

1.0 Introduction:

Naval Supply Systems Command (NAVSUP) Business Systems Center (BSC) is to obtain technical support services for the NAVSUP One Touch Support (OTS) system to explore and implement the engineering, modernization, quality assurance testing, integration testing, documentation, and maintenance of NAVSUP OTS and to provide enhanced Supply Logistics related capabilities across all warfare Enterprises.

2.0 Background:

NAVSUP BSC utilizes web-based logistical and inventory management tools, as well as provides critical “real time” worldwide supply logistics visibility. NAVSUP OTS not only improves and simplifies day-to-day supply logistics management;

it also gives our warfighters in the Fleet and on the front lines a critical tool to help them prevail in combat.

2.1 Requiring Organization:

NAVSUP Business Systems Center 5450 Carlisle Pike Suite 409 Mechanicsburg PA 17050-2411

2.2 Project Description:

The purpose of this PWS is to obtain contractor support services to continue the sustainment, maintenance, and enhancement of the NAVSUP OTS functional and technical capabilities, and to provide continued worldwide fleet support. Current legacy software acquisition and development practices in the Department of Defense do not provide the agility to deploy new software “at the speed of operations.” Support services are also required to move from legacy software development to industry best practices for rapid, secure software development, specifically using Agile Scrum practices. NAVSUP OTS Program Management Office (PMO)/Project Manager desires development of the NAVSUP OTS solution to include software development, test and evaluation, information assurance, and test support. The Contractor shall evolve NAVSUP OTS capabilities to support Government prioritized features. While forecasted features and requirements will be provided, consistent with Agile- and Sprint-based development, the features and requirements are subject to change based on Sprint planning during the period of the contract. The forecasted features may be accelerated, changed, or interchanged within the scope as determined in program increment or sprint planning.

NAVSUP OTS is a Navy hosted web application that reduces the cost of logistics by acting as a broker between multiple IT systems that process material requisitions. The system provides the war fighter with a single point-of-entry to access a portfolio of DoD and Navy supply systems, expanding their visibility of end-to-end supply chain data. NAVSUP OTS centralizes the capability to perform supply functions against multiple systems, while providing real time supply and logistics information that supports data driven decisions.

The system offers a variety of features that allows the over 29,000 Navy, Marine Corps and other DoD users to manage the end-to-end process of acquiring repair parts and consumables, which sustain the operating forces and the activities that directly and indirectly support them. Using NAVSUP OTS allows them to do this faster and more efficiently, which reduces cost and increases readiness. Features provided to the customer include the ability to perform stock queries, input requisitions, check requisition status, and track requisition shipment status.

NAVSUP OTS interfaces with roughly two dozen Navy and Defense Logistics Agency (DLA) systems to exchange the data necessary to support these capabilities. The NAVSUP OTS system increases supply logistics capabilities by leveraging web services to integrate with other supply systems without duplicating their functionality.

3.0 Scope: The goal of this PWS is to obtain contractor support services to provide the following:

• Agile Software Support o Agile Release Teams overseen by NAVSUP Government

Product Owner and Scrum Master o Versatilist - Software Engineering and Developing with

Functional Analysis

• Cybersecurity Support

• Mentoring and Knowledge Transfer Services

• Transition Support

NOTE: Versatilist is someone who can be a specialist for a particular discipline, while at the same time be able to change to another role with the same ease, i.e., Software Engineer/Developer with Functional Analytical skills.

4.0 Directives:

The contractor shall comply with the following directives, and any updated/future versions as they are released:

• Federal Information Security Modernization Act of 2014

(“FISMA”)

• Common Criteria for Information Technology Security Evaluation, Part 3: Security Assurance Components, April 2017, Version 3.1, Revision 5, CCMB-2017-04-003

• DoDI O-2000.16-V1, DoD Antiterrorism Program Implementation, 17 November 2016 (incorporating Change 3, 7 May 2021)

• DoDD 5205.02E, OPSEC, 20 June 2012 (incorporating Change 2, 20 August 2020)

• SECNAV 3070.2A, Navy OPSEC, 9 May 2019

• SECNAVINST 5500.35, Navy Physical Security Program, 22

February 2022

• NAVSUPINST F5500.3, Insider Threat, 17 August 2020

• DoD Instruction 5400.11, DoD Privacy and Civil Liberties

Programs, 29 January 2019 (incorporating Change 1, 8 December 2020)

• DoD Directive 8000.01, Management of the DoD Information Enterprise, 17 March 2016 (incorporating Change 1 July 2017)

• DoD Directive 8140.01, Cyberspace Workforce Management, 5 October 2020

• DoD Instruction 4161.02, Accountability and Management of Government Contract Property, 27 April 2012 (incorporating Change 2, 31 August 2018)

• DoD Instruction 8320.07, Implementing the Sharing of Data, Information, and Information Technology (IT) Services in the Department of Defense, 3 August 2015 (incorporating Change 1, 5 December 2017)

• DoD Instruction 8500.01, Cybersecurity, 14 March 2014, Change 1, 7 October 2019

• DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Systems, 19 July 2022

• DoD Instruction 8582.01, Security of Non-DoD Information Systems Processing Unclassified Nonpublic DoD Information, 9 December 2019

• DTM 24-001, DoD Cybersecurity Activities Performed for Cloud Service Offerings, 27 February 2024

• SECNAVINST 5510.36B, DoN Information Security Program, 12 July 2019

• 252.239-7001 Information Assurance Contractor Training and Certification (Please note that contractors are still held to DoD 8570 until DFARS is updated.)

• DoDM 8140.03, Cyberspace Workforce Qualification and Management Program, 15 February 2023

• DoD 8570.01-M Information Assurance Workforce Improvement Program, December 19, 2005, Incorporating Change 3, January 24, 2012

• SECNAV Instruction 5211.5F, Department of the Navy Privacy Program, 20 May 2019

• SECNAV Instruction 5239.3C, DON Cybersecurity Policy, 2 May

• OPNAVINST 5239.1D, U.S. Navy Cybersecurity Program, 18 July

• OPNAVINST 5239.4, Chief of Naval Operations Cybersecurity Safety Program, 14 September 2018

• SECNAV Manual M-5239.2, DON Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual, 27 June 2016

• SECNAV M-5239.3, Department of the Navy Cybersecurity Manual, April 2022

• SECNAV Manual M-5510.30C, Department of the Navy Personnel Security Program, 24 January 2020

• CJCSI 6211.02D, Defense Information Systems Network (DISN) Responsibilities, 24 January 2012

• DoD Public Key Infrastructure (https://cyber.mil/pki-pke)

• ISO/IEC/IEEE 12207:2017 Systems and Software Engineering –

Software Life Cycle Processes

• ANSI/EIA 649C-2019 – Configuration Management Standard

• ANSI/EIA 836B-2015 – Configuration Management Data Exchange and Interoperability

• Federal Risk and Authorization Management Program

(“FedRAMP”)

• Department of Defense Cloud Computing Security Requirements

Guide, Version 1, Release 4, dated 14 January 2022

• All applicable Security Requirements Guides, Security

Technical Implementation Guides, and National Security Agency security configuration guides when assessment and authorization is required

• NIST SP 800-37 Revision 2, Risk Management Framework for Information Systems and Organizations, December 2018

• U.S. Navy Risk Management Framework Process Guide, Version 4.0, 5 March 2024

• NIST SP 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations, September 2020, includes updates as of 10 December 2020

• NIST SP 800-53A Revision 5, Assessing Security and Privacy Controls in Information Systems and Organizations, January

• NIST SP 800-171r3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, May

• NIST SP 800-171Ar3, Assessing Security Requirements for Controlled Unclassified Information, May 2024

• NAVSUPINST 5239.5, Cybersecurity and Defensive Cyberspace Operations Policy, 25 March 2019

• ISO/IEC 19770-1:2017 – Information Technology – IT Asset Management – Part 1: IT Asset Management Systems - Requirements

• ISO/IEC 19770-2:2015 - Information Technology -- Software Asset Management -- Part 2: Software Identification Tag

• ISO/IEC 19770 Series - Information Technology – IT Asset Management

• A Guide to the Project Management Body of Knowledge (PMBOK® Guide) - Seventh Edition

• Section 508 of the Rehabilitation Act of 1973 (amended by the Workforce Investment Act of 1998, 7 August 1998)

• SECNAVINST 5720.44C - DON Public Affairs Policy and Regulations, 21 February 2012, Change 2 10 April 2019 (specifically, Chapter 7: Public Communication on the Internet)

• SECNAVINST 5510.30C, Department of Navy Personnel Security Program, 24 January 2020

• Homeland Security Presidential Directive (HSPD)12, Policy for a Common Identification Standard for Federal Employees and Contractors, 27 August 2004

• DoD Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP), 3 April 2017

• DoD Manual 5200.08-R, Physical Security Program, 27 May 2009, 3 April 2017

• DoD Instruction 5200.48, Controlled Unclassified Information (CUI), March 6, 2020

• NSAMECHINST 5530.1C CH-1, Naval Support Activity Mechanicsburg Installation Access Control, 23 August 2019

• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting” from the memorandum Updated Implementation of “the DIB Memo” dated 06 Sep 2019

• SECNAVINST 5200.43A, Government Furnished Property, Accountability and Management, 10 September 2021, Change 1 4 August 2022

5.0 Requirements/Tasks: The contractor shall perform every

requirement in this performance work statement, except for the roles specifically for the NAVSUP Government Product Owner and NAVSUP Government Scrum Master specified in Tasks

5.1 and 5.2. Those roles are described in this PWS to delineate how the contractor will work with these Agile roles since the contractor is part of the Agile Release Team. The contractor will work in a team-based Agile environment. The Government Product Owner will specify high-level requirements/capabilities to the Agile team. As in typical Scrum-based Agile processes, the Government Product Owner and Government Scrum Master will work together with the team to develop and estimate user stories and establish acceptance criteria. These acceptance criteria will specify expected functionality for a user story, as well as any non-functional requirements that must be met in the development of the story. The Government Product Owner and Government Scrum Master, supported by subject matter experts and business analysts, will determine whether or not acceptance criteria have been satisfied. Sections 5.1 and 5.2 detail out the role of the NAVSUP Government Product Owner and NAVSUP Government Scrum Master and how they will work with the Agile Release Team.

Not every performance requirement has a related standard expressed in this document or in the Quality Assurance Surveillance Plan (QASP). In such cases, the performance standard is either inherent in the requirement or performance is to be in accordance with standard commercial practice.

Per DFARS 211.106, contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence.

5.1 NAVSUP Government Product Owner. The Government Product

Owner shall be responsible for:

5.1.1 Defining and prioritizing user stories via backlogs.

5.1.2 Working with the Agile Release Teams to estimate the

story points for each user story in the Product backlog.

5.1.3 Working with stakeholders to regularly groom the

product backlog to ensure the work is clearly defined, in priority order, and is accompanied by reasonable estimates.

5.1.4 Collaborating with business stakeholders and NAVSUP

OTS PMO/Project Manager to develop a high-level strategic plan to guide organizational vision and align expectations for future development.

5.1.5 Identifying and mitigating risks impacting delivery

and overall success.

5.1.6 Briefing customers, Program/Project team, and

management on project status, strategies, software solutions, etc.

5.2 NAVSUP Government Scrum Master. The Government Scrum Master is responsible for facilitating Agile ceremonies and discussions among development, Agile Release Team, and Mission Partner team members. The Government Scrum Master is responsible for coaching the team on the Scrum processes and removes impediments for the team. The Government Scrum Master, working with the Agile Release Team, shall be responsible for:

5.2.1 Facilitating Scrum Meetings: The Government Scrum

Master coordinates and facilitates Scrum meetings, such as Sprint planning, Backlog Refinement, Sprint Reviews, and Sprint Retrospectives, and provides sufficient records.

5.2.2 Defining Team Performance Metrics: The Government

Scrum Master works with product leadership and the Agile Release Team to define and deliver relevant metrics that are formulated and utilized for meeting project objectives.

5.2.3 Delivering Team Performance Metrics: The Government

Scrum Master works with product leadership and the Agile Release Team to deliver relevant metrics that are formulated and utilized for meeting project objectives.

Examples include release burnup, sprint burndown, planned vs accepted story points, escaped defects, and velocity.

NAVSUP BSC expects these metrics to evolve over time. The Versatilist - Software Engineer/Developer with Functional

Analysis can expect a maximum of 10 metrics per team.

5.2.4 Planning and Coordinating Team Training: When

appropriate, the Government Scrum Master shall plan and coordinate training for the Agile Release Team on the Scrum processes. The Government Scrum Master also helps to remove team roadblocks.

5.2.5 Supporting the adoption of Agile principles and

practices: Work with the Program/Project Manager, Product Owner(s), Scrum Master(s), Agile Release Teams, and others as needed to address issues related to Agile process implementation or performance.

5.3 Agile Release Teams. The Versatilist - Software

Engineer/Developer with Functional Analysis is a key player on the Agile Release Teams to support NAVSUP OTS PMO/Project Manager by completing product backlog items called stories. A story represents any unit of measurable work that provides value to the NAVSUP OTS PMO/Project Manager and will serve as a deliverable. The Agile Release Teams can work on any system backlog for a new or existing system or application that requires the use of the current NAVSUP OTS Technical Landscape or an evolution of the Technical Landscape. In collaboration with the Government Product Owner, the Agile Release Team shall provide stories with the requisite information to complete the work. No story can be started by a team until approved by the Government Product Owner and contain acceptance criteria and a definition of done. Story approval occurs at the sprint planning event and shall be documented in Azure DevOps Services (ADS). Story acceptance occurs at the sprint review event and shall be documented in the ADS. At the sprint review, the delivered user stories shall be compared against the Definition of Done and acceptance criteria defined at sprint planning to determine the quality of the deliverable (story). The story shall meet all requirements defined in the sprint Definition of Done and story Acceptance Criteria to be accepted. The Contractor shall:

5.3.1 Ensuring complete transparency and logging all

activities in the Enterprise Platform, Azure DevOps Services (ADS) and shall be kept current within 5 business days.

5.3.2 Adhering to Scrum best practices and performing

recommended Scrum Events and Artifacts in accordance with the 2017 Scrum Guide:

https://www.scrumguides.org/index.html, or utilize Agile Kanban practices, or any other Agile or Scrum best practices approved by the Government Product Owner and Government Scrum Master.

5.3.3 Providing the full range of System/Software

Development Lifecycle activities to include requirements, analysis, design, development, test, security and deployment.

5.3.4 Coordinating all activities (analysis, design, development, testing and deployment) required to complete each story as defined in the Acceptance Criteria and Definition of Done.

5.3.5 Working with the Government Product Owner to decompose

each story down to the level that is achievable within a sprint (i.e., generally requiring less than 10-15 business days to complete) and identify the Acceptance Criteria for each story and define the sprint Definition of Done.

5.3.6 Identify all tasks required to successfully complete

each story and document in ADS.

5.3.7 Showing traceability and dependencies between

requirements (Epics, Themes, Stories, and Tasks) and systems in ADS.

5.3.8 Effectively facilitating scrum and Agile events and

practices.

5.3.9 Proposing a Minimal Viable Product (MVP) solution

containing features that provide initial capability to the end-user while also encouraging end-users to provide feedback to influence future development sprints.

5.3.10 Working closely with the Government to ensure that the Product Backlog, stored in ADS, is continually and regularly maintained in alignment with the Agile cadence so that the necessary Release and Sprint Backlog items (epics and user stories) are defined with acceptance criteria and prioritized by the Government prior to the start of each release and sprint. The contractor shall prioritize development in accordance with the Program Backlog.

5.3.11 Working with the Government Product Owner and

Government Scrum Master, define and deliver relevant metrics that are formulated and utilized for meeting project objectives.

5.4 Software Engineering with Functional Analysis. The

Versatilist - Software Engineer/Developer with Functional Analysis shall:

5.4.1 Perform functions relating to design, software

engineering/programming (create/maintain source code) and unit testing, and maintenance of assigned NAVSUP OTS applications/modules.

5.4.2 Analyze/refine systems requirements, determine and

design system/application architecture, write/debug/maintain code (using the NAVSUP OTS defined software development processes), and develop/maintain system/application documentation.

5.4.3 Provide application engineering perspective when

interfacing with Mission Partners/users and NAVSUP OTS teams, including the environment.

5.4.4 Perform evaluation of new technology

tools/methodologies, supporting application engineering, and provide technical advice to NAVSUP OTS team, management, and Mission Partners/users.

5.4.5 Recommend the use of recognized standard system

engineering best practices, resulting in improved supportability, survivability, reliability, and maintainability of program code.

5.4.6 Perform required testing based upon Acceptance

Criteria and Definition of Done, assuring software and systems quality and functionality.

5.4.7 Determine the feasibility of design alternatives, translate systems requirements into application prototypes, and develop problem resolutions.

5.4.8 Providing functional authority and functional

knowledge expertise for assigned applications and performing assigned tasks for assigned applications.

5.4.9 Obtaining requirements from Mission Partners/users.

5.4.10 Identifying, defining, or modifying interfaces with

other systems/applications, ensuring agreements are, formally, documented with the interfacing system/application.

5.4.11 Providing pre-implementation training resources to

Mission Partners/users.

5.4.12 Developing documentation based upon Agile Scrum best

practices and the NAVSUP BSC Service Delivery Model (SDM).

5.4.13 Supporting NAVSUP OTS Production outages, as required.

5.4.14 Providing support to the development of the release

packages.

5.4.15 Creating and updating work items in Azure DevOps

Services (ADS).

5.4.16 Analyzing system requirements, converting functional

design to detailed logic for coding into computer language for the assigned software systems, to include but not limited to, the NAVSUP OTS Modules and Components.

5.4.17 Reviewing each module as well as the system as a whole for design validity. This includes, but is not limited to, validation of record input, data elements and output reports.

5.4.18 Compiling and submitting the executables for the

assigned system in accordance with established standards.

5.5 Cybersecurity. The Versatilist - Software

Engineer/Developer with Functional Analysis shall:

5.5.1 Be responsible for meeting and maintaining the CYBER

certification and accreditation requirements. This support includes researching, testing and providing technical information for obtaining the CYBER accreditation.

5.5.2 Ensure the team’s technical information/support is in

accordance with the Federal Information Security Management Act (FISMA).

5.5.3 Ensure software scanning for security vulnerabilities.

5.5.4 Monitor Security Technical Implementation Guide

(STIG)/Patches, Assured Compliance Assessment Solutions (ACAS) scans, End of Life software, End of Life hardware, contingency/control tests, Information Assurance Vulnerability Alerts (IAVAs), Information Assurance Vulnerability Bulletins (IAVBs), Information Assurance Vulnerability Tests (IAVTs).

5.6 Mentoring and Knowledge Transfer. The Versatilist -

Software Engineer/Developer with Functional Analysis shall provide a comprehensive application Transfer of Knowledge and mentoring to NAVSUP OTS personnel.

5.7 Transition Support. The Contractor shall:

5.7.1 Transition - Phase In. The contractor shall

participate in transition-in phase tasks to orderly and efficiently transition as responsible party. The transition-in phase shall be considered the first seven (7) days of the contract performance period. The transition phase shall consist of phase-out training from the incumbent and transition of all Government Furnished Information (GFI) relevant to the tasks specified herein.

This transition-in phase shall not in any way hinder the performance of the contractor's normal instructional duties required by this contract. The incoming contractor shall provide a designated point of contact, and a detailed

Transition Plan for the migration of government data, functions and services from the incumbent. The Transition Plan shall provide a timeline for support personnel, transition and sufficient detail to ensure that no break in services is experienced. The contractor shall submit a Resource Allocation Plan to the TA within 2 days of award.

This plan shall detail how the contractor will accomplish the receipt of the following phase in tasks:

• The contractor will provide master copies of the transition plan to the TA and NAVSUP BSC COR. The accomplishment of this plan requires close coordination between the contractor and all Government representatives to ensure that all tasks are accomplished prior to end of the transition period.

Should the contractor determine that all of the requisite items have been accomplished prior to the 7 day deadline; the contractor may advise the Contracting Officer accordingly.

• The contractor will receive technical expertise and experience contributing to the goals of the PWS applications.

The contractor may satisfy the requirements of the transition phase on or before the 7 day deadline. When the contractor determines that all of the phase in requirements have been fulfilled, he/she should advise the Contracting Officer. Upon review, verification, and acceptance by the TA, the contractor shall commence service execution of the contract.

5.7.2 Transition - Phase Out. At the end of the period of

performance, as the incumbent, the Contractor shall provide a designated point of contact at least 60 days prior to the end of the period of performance, and provide advice, knowledge transfer and support in the timeline and transition plans of government data, functions and services to the new awardee and/or the Government.

Performance Standard: All work associated with the tasks described in Section 5.3, 5.4, 5.5, 5.6, and 5.7 above will be consistent with industry best practices and following Enterprise and Project specific standards including software development and version control. All software released will follow the government Configuration Management process and management controls.

Assessment Method: All documents will be vetted and reviewed with the Government and all identified stakeholders within five

(5) business days.

6.0 Deliverables: All deliverables must meet the format

requirements specified by the Contracting Officer’s Representative (COR) or Technical Assistant (TA).

Documentation related to these services shall be made available electronically. The following list details the contract deliverables:

Deliverable Delivery Timing

5.3 User Stories and Product Backlog Entries As directed

5.3.11 Team Performance Metrics As directed

5.4.2 Lifecycle System Documentation As directed

5.4.6 Test Plans/Results As directed

5.4.11 Training As directed

5.4.12 Functional/Software Engineering

Documentation – Agile and NAVSUP BSC SDM

As directed

5.4.14 Release Packages As directed

5.4.18 Program executables As directed

5.5.1 Cyber Security Workforce Baseline

Certification

Proof at Time of Award

5.6.1 Mentoring/Knowledge Transfer

documentation

As directed

5.7 Transition Plan and documentation Transition –

Phase in and Phase out

6.1 Monthly Status Report. The contractor shall send

status reports electronically to the Technical Assistant (TA) and Contracting Officer’s Representative (COR) on a monthly basis (due by 1700ET on the 10th day of every month) documenting the performance on the order. The status report shall include the following elements:

o Resources by name o Status of work with accomplishments documented, including mentoring accomplished o Team metrics o Any issues/problems encountered or possible and recommended solutions o Changes to roles and responsibilities and schedule changes o Identify any Government dependencies that are overdue which impact schedule or performance o Evaluate performance and determine adequacy of staffing o Staffing changes and onboarding status of resources

6.2 Mentoring/Knowledge Transfer documentation, lesson

plans, and mentoring reports. The mentoring report shall include:

o Trainer Name o Trainee Name o Date Knowledge Transfer began o Date Knowledge Transfer completed o Description of skill/knowledge area

6.3 Transition Documentation

6.4 Monthly Payment Request. The contractor shall submit a

monthly payment request (invoice) electronically using Wide Area Workflow (WAWF) by the 10th day of each month in accordance with the WAWF routing table specified in the contract. WAWF is available on the internet at https://piee.eb.mil.

The Period of Performance (POP) for each invoice shall be for one month. Included with the invoice shall be support documentation such as, but not limited to, travel authorizations (if applicable) and a monthly status report. Invoices received without the support documentation (in the correct format) will be rejected.

The contractor shall submit a final invoice or zero cost invoice to properly close out the contract.

6.5 Mandatory Annual Training: The contractor shall

participate in DoD/DoN mandatory annual training when announced by the Government. The contractor shall complete the mandatory annual training by the announced due dates.

Contractors are required to complete the following mandatory training, and any updated/future mandatory training courses as released:

1) DoD Cyber Awareness Challenge. The contractor shall complete DoD Cyber Awareness Challenge mandatory training one (1) business day after contract award.

https://piee.eb.mil/

2) Operations Security (OPSEC)

3) Training and Readiness – the Active Shooter Part 1 (Per

OPNAVINST F3300.53D this training is required within 90 days of start date)

4) Training and Readiness – the Active Shooter Part 2

5) Combating Trafficking in Persons

6) NAVSUP BSC Annual Security Refresher

7) DoD Mandatory Controlled Unclassified Information (CUI)

8) DoN Level 1 Antiterrorism (AT) Awareness (required annually for the first 3 years and then triennially thereafter)

6.6 Cyberspace Workforce (CWF) DoD 8570.01-M requirements

are specified in 10.0

Unless stated otherwise, the following instructions apply to all deliverables 6.1 to 6.5:

• All versions of the deliverables required by the TO shall be delivered electronically to the COR and/or his/her designee and shall be subject to Government review and approval.

• Deliverable due dates shall take into account the review periods described below.

o Draft deliverables will be reviewed and feedback and/or requested changes provided within 7 business days (unless otherwise specified).

o Government reserves the right to request a formal review session with the contractor during these timeframes and may request that the contractor make changes to any version of a deliverable.

o Government will review and approve or reject all final versions of all deliverables within 7 business days of receipt (unless otherwise specified).

o If any deliverable is rejected, the contractor will be notified within the specified time periods and will have 7 calendar days within which to rework the deliverable and resubmit for Government approval. All changes to any version of a deliverable and/or deliverable outline shall be approved by the COR or TA. If more than the specified number of calendar days is required for Government review and approval, the COR or TA will inform the contractor of the need for an extension within the initial review period.

o Contractor shall prepare and submit the deliverables on or before the required due date to the COR or designee via email.

For deliverables that are not documents the contractor shall submit a description of the deliverable and any associated documentation or descriptive information. In no case shall any deliverable be received by the Government less than 21 calendar days prior to the end of the Period of Performance.

o Rejection of any deliverable by the Government does not excuse the contractor from meeting the baseline due dates for any other deliverables.

7.0 Period of Performance:

Work shall be performed from the period of performance start date for one (1) year with four (4) additional one (1) year option periods, and the option to extend services up to 6 months with the inclusion of FAR 52.217-8. The anticipated periods of performance if options are exercised are: Base Year, 22 September 2026 – 21 September 2027; Option Year 1, 22 September 2027 – 21 September 2028; Option Year 2, 22 September 2028 – 21 September 2029; Option Year 3, 22 September 2029 – 21 September 2030; Option Year 4, 22 September 2030 – 21 September 2031; and, FAR 52.217-8 22 September 2031 – 21 March 2032. Some flexibility in daily hours is permitted with the TA’s approval.

8.0 Place of Performance:

The NAVSUP BSC, Mechanicsburg PA is the primary site for performance.

No contractor services shall be performed on Saturdays, Sundays, Government Holidays or during base closures. The contractor shall follow appropriate local base policy for reporting to work during severe weather and base closure. The contractor is not authorized to begin work until both the Visit Authorization Request (VAR) and System Authorization Access Request DD 2875 forms have been successfully processed and base and system access have been granted. Remote work is authorized with the coordination and approval of the COR or TA. Overseas Travel is not required.

9.0 Travel:

No Travel is required for this Order.

10.0 Security:

ON-BOARDING PROCESS

All contractor resource onboarding documents must be submitted via the prime contractor. An employee is considered to be “productive” upon completion of the following items:

a. OF-306 signed by contractor employee

b. FD-258 fingerprint card (Contingent upon availability of electronic fingerprinting submission)

c. Completed NBIS – SF 86 (Electronic Investigation) within 20 days after contract award

d. All contractor resource(s) must have an active Defense

Information System for Security (DISS) profile within 20 days after contract award

e. Complete Mission Partner (MP) Identity, Credential, and Access Management (ICAM) registration for the Common Access Card (CAC)/(including CAC renewals)

f. System Authorization Access Request DD 2875

g. Cyber Awareness Training Certification

h. Information Assurance (IA) certification (if applicable)

i. User Access Request (UAR) Only applies when contractor requires access to ERP/SAP (Contractor does not require this access.)

j. TWMS profile for each contractor (IA/Security training compliance System of Record)

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services. Travel for onboarding and CAC appointments and renewals is not reimbursable.

Note (2): Dual Citizenship and Foreign Nationals are not allowed access to the functional/system side of ERP/SAP.

Contractor and subcontractor employees performing under this task order are required to sign a Non-disclosure Agreement (NDA) as part of their onboarding process. Refer to DFARS 252.204-7000, Disclosure of Information, and DFARS 252.204-7003, Control of Government Personnel Work Product.

See SUPTXT204-9400(4-22) Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information (DEC 2018)

This local text does not apply to non-U.S. Nationals (foreign nationals) who are contactor employees performing work overseas.

The local text is applicable to the United States Nationals living in the U.S. or overseas who are performing work on a Navy contract.

The investigation of a non-U.S. national at a foreign location must be consistent with a NACI, to the extent possible, and include a fingerprint check against the FBI criminal history database, an FBI investigations file (name check) search, and a name check against the terrorist screening database.

Also, the above cited reference notes that Foreign Nationals may not be granted CAC Credentials until completion of their investigation and not in the interim.

Per DoD 5200.2-R, DoD Components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location. The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S.

and its allies or agency agreements with the host country.

(1) SUPTXT204-9400(4-22) CONTRACTOR UNCLASSIFIED ACCESS TO

FEDERALLY CONTROLLED FACILITIES, SENSITIVE INFORMATION,

INFORMATION TECHNOLOGY SYSTEMS OR PROTECTED HEALTH INFORMATION

The security text does not apply in cases where the contractor/vendor does not have access to Navy Marine Corps Intranet (NMCI) computers, is not issued a Common Access Card (CAC) and is involved in training or other short term duties of less than 30 days duration that allow for the use of a visitor request. In these cases, the government employee must submit a Visitor Access Request (VAR) to the main gate or applicable processing entity for your facility and assume responsibility to escort those without CAC Credentials.

This text does not apply to non-United States (U.S.) Nationals (foreign nationals) who are contactor employees performing work overseas. This text is applicable to the U.S. Nationals living in the U.S. or overseas who are performing work on a Navy contract.

The investigation of a non-U.S. national at a foreign location must be consistent with a National Agency Check with Written Inquiries (NACI), to the extent possible and include a fingerprint check against the Federal Bureau of Investigation (FBI) criminal history database, an FBI investigations file (name check) search and a name check against the terrorist screening database. Also, the above cited reference notes that Foreign Nationals may not be granted CAC credentials until completion of their investigation and not in the interim.

Per Department of Defense Memorandum (DoDM) 5200.2, Department of Defense (DoD) components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location.

The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S. and its allies or agency agreements with the host country.

CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED

FACILITIES, SENSITIVE INFORMATION, IT SYSTEMS OR PROTECTED

HEALTH INFORMATION

Executive Order 13467, Reforming Processes Related to Suitability for Government Employee, Fitness for Contractor Employees and Eligibility for Access to Classified National Security Information, Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 Part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense (OSD), the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy command under this contract is required to obtain a DoD CAC.

Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below. If at any time, any contractor employee requiring a CAC is unable to possess/maintain the required adjudicated background investigation, the contractor shall immediately notify the NAVSUP COR to coordinate removal of such a person from work under this contract.

ACCESS TO FEDERAL FACILITIES

Definition. As used in this clause - Military installation means a base, camp, post, station, yard, center, or other activity under the jurisdiction of the Secretary of a military department or, in the case of an activity in a foreign country, under the operational control of the Secretary of a military department or the Secretary of Defense (see 10 U.S.C. 2801(c)(4)).

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager (CSM) upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

Training. Contractor employees who require routine physical access to a Federally controlled facility or military installation shall complete “Level I Antiterrorism Awareness Training” prior to gaining access to a facility and annually thereafter in accordance with DoDI O-2000.16 Vol I. In accordance with Department of Defense Instruction O-2000.16 Volume 1, DoD Antiterrorism (AT) Program Implementation: DoD AT Standards, Level I Antiterrorism Awareness Training shall be completed by:

1. Completion of “Level I Antiterrorism Awareness Training” available at https://jkodirect.jten.mil/pdf/atl1/launch.html; or

2. Under the instruction of a qualified Level I Antiterrorism Awareness instructor; or

3. Providing a training certificate for “Level I Antiterrorism Awareness Training” training showing completion within the last calendar year in accordance with DoDI O-2000.16 Vol I.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the COR or to the contracting officer, if a COR is not assigned, prior to being granted access to a Federally controlled facility or military installation.

Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (d), in subcontracts, including subcontracts for commercial items, when subcontractor performance requires routine physical access to a Federally-controlled facility or military installation.

OPERATION SECURITY (OPSEC)

It is DoD policy according to DoD Directive 5205.02E, “DoD Operations Security (OPSEC) Program,” June 20, 2012, as amended to establish and maintain OPSEC programs to ensure national security-related missions and functions are protected.

Training: Contractor employees shall comply with all DoD OPSEC requirements and complete “OPSEC Awareness for Military Members, DoD Employees and Contractor” training within 30 days of onboarding the contract and annual refresher training thereafter. Training shall be completed through a DoD sponsored and certified computer or web-based learning instruction available at https://securityawareness.usalearning.gov/opsec/index.htm.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after training is completed by all employees and subcontractor personnel.

ACCESS TO DOD INFORMATION TECHNOLOGY (IT) SYSTEM

In Accordance With (IAW) DON CIO Memorandum (IT LEVEL

DESIGNATION ON DD FORM 2875 SYSTEM AUTHORIZATION ACCESS REQUEST)

08 September 2020, contractor employees who require access to Department of the Navy (DoN) or DoD networks are categorized as Privileged, Enhanced, or Authorized users. All user level accesses may include positions which require access to Controlled Unclassified Information (CUI). CUI includes sensitive information protected under the Privacy Act, to include PHI. System Levels are determined by the requiring activity's Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring Privileged access,(when specified by the terms of the contract) require a Tier 5 (T5) or T5R equivalent investigation, which is a higher level investigation than the Tier 3 (T3) and T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance (IA) Technical Level 1, and must be trained and certified on the Operating System (OS) or Computing Environment (CE) they are required to maintain.

Contractors requiring Enhanced access, (when specified by the terms of the contract) require a T3, T3R, or equivalent investigation, which is a higher level investigation than the Tier 1 (T1) described below. Due to the enhanced system access, an investigation suitable for Moderate Risk national security positions is required.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy CSM and ISSM/IAM manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request DD 2875 form is required for all individuals accessing Navy IT resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the DD 2875; therefore, the government employee with knowledge of the system/network access required or the Contracting Officers Representative (COR) shall sign the DD 2875 as the supervisor.

The DD 2875 shall be forwarded to the CSM upon the contractor employee acquiring a Common Access Card (CAC) credential.

Failure to obtain a CAC credential may result in delaying the individual's start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all contractor employees requiring access complete annual Cyber Awareness training, and maintain a current requisite background investigation. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

INTERIM ACCESS

The CSM may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

ACCESS TO CONTROLLED UNCLASSIFIED INFORMATION

Safeguarding sensitive unclassified information is critical to achieve NAVSUP Modernization efforts and deliver cutting-edge and uncompromised capabilities. The Secretary of Defense’s operations security (OPSEC) campaign plan stresses the importance of protecting controlled unclassified information (CUI). CUI encompasses OPSEC, critical technology, intelligence, and personally identifiable information that, if not properly identified, marked, and controlled, could impair NAVSUP’s ability to conduct its mission. Contractor employees with access to Controlled Unclassified Information (CUI) shall comply with DoDI 5200.48 - Controlled Unclassified Information (CUI) and complete DoD approved initial and annual refresher CUI training.

a. Whenever Government provides CUI to, or CUI is generated by, non-DoD entities, all CUI records must be handled as required by the approved mandatory disposition authority.

b. All CUI records must follow the approved mandatory disposition authority whenever the Government provides CUI to, or CUI is generated by, non-DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and the DoDI 5200.48.

c. Contractor employees shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

d. Contractor employees shall submit unclassified government information for review and approval for release in accordance with the Standard DoD Component Processes, DoDI 5230.09, and DoDM 5205.07, Volume 1

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the contractor's security representative. Within three (3) work days after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the contractor's security representative. The contractor's security representative shall be the primary point of contact on any security matter. The contractor's security representative shall not be replaced or removed without prior notice to the Contracting Officer and CSM.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL

PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS

OR PERFORMING SENSITIVE DUTIES

At minimum, all contractor employees must possess/maintain the required background investigation as determined by the PDT and/or IT access user level. This requirement is critical in order to access the government data base systems It is the contractor’s responsibility to ensure that 100% of the contractor employees have the ability to acquire a favorably adjudicated background investigation.

Navy security policy requires that all positions be given a sensitivity value based…