RFP N0042120R0099.docx

N0042120R0099

Section A - Solicitation/Contract Form

POINTS OF CONTACT

EMAIL ADDRESS:

sarah.sullivan@navy.mil

EMAIL ADDRESS:

merissa.abell@navy.mil

CONTRACTING OFFICER REPRESENTATIVE:

TBD at Award

(1) This acquisition is a small business set-aside that will result in placement of a Single Award Indefinite Delivery/Indefinite Quantity (IDIQ) contract. NAVAIR clause 5252.211-9503 LEVEL OF EFFORT (COST REIMBURSEMENT) (NAVAIR)(DEC 2012) will be included in Task Orders.

(2) The Product/Service Code (PSC) for this procurement is R408. The NAICS code is 541690, and the small business size standard is $16,500,000 ($16.5M).

(3) The resulting Single Award IDIQ contract will have an ordering period of five (5) years.

(4) This contract has Cost-Plus-Fixed-Fee (CPFF) and Cost Reimbursement (non-fee bearing) line items.

(5) The anticipated award date for this contract is 28 October 2020. Please note that this is an estimated date and is subject to change.

Section B - Supplies or Services and Prices

Lot

Labor

CPFF

Labor IAW Section C, Statement of Work (SOW) FOB: Destination

PSC CD: R408

ESTIMATED COST

FIXED FEE

TOTAL EST COST + FEE

Lot

ODCs

COST

Travel and Material (ODCs) IAW Section C, Statement of Work (SOW)

ESTIMATED COST

Lot

Technical Data

Data IAW DD1423, Exhibit A, Contract Data Requirements List (CDRLs) A001-A010. Not Separately Priced.

ESTIMATED COST

Lot

Contractor Acquired Property

IAW DFARS PGI 245.402-71. Not Separately Priced.

Model: TBD Original Unit Acquisition Cost: TBD Date Placed in Service: TBD

ESTIMATED COST

CLAUSES INCORPORATED BY FULL TEXT

B-1 STREAMLINED ORDERING

B-1 Streamlined Ordering for Cost Plus Fixed Fee Term LOE Orders

LOE Orders will be issued under this contract using the following streamlined ordering procedures:

(1) For each proposed order, the contracting officer will provide the contractor with a Task Order (TO) and an Independent Government Cost Estimate (IGCE). The IGCE is an estimate of labor hours by labor category utilizing the estimated and negotiated Composite Labor rates Table below to calculate the total estimated cost for the proposed TO. The TO fixed fee is calculated using Section H Clause 5252.232-9510 PAYMENT OF FIXED FEE (NAVAIR).

(2) These Composite rates are estimates, and invoicing will be based on actual costs incurred. Ceiling for Other Direct Costs (ODC) will be priced in accordance with the Government estimate. TOs crossing multiple years will be estimated by the Government using the composite rates for each year in proportion to the period of performance of the TO.

(3) Requirements for contractor response:

(i) If the contractor agrees that it can perform the TO within the parameters of the IGCE, the contractor shall sign and return the DD1155 to the contracting officer within three (3) working days of receipt of the TO and IGCE. If the requirement remains valid, a priced order will be issued to the contactor.

(ii) If the contractor does not agree with the TO and/or IGCE, the contractor shall submit a proposal to the contracting officer within five (5) working days of receipt of the TO and IGCE, addressing only the specific areas of difference in labor categories and/or hours in the IGCE. Once the differences are resolved between the contracting officer and the contractor, and the requirement remains valid, a priced order will be issued to the contractor.

(iii) If the contractor fails to respond to the proposed order within five (5) working days of receipt of the TO, the contracting officer may unilaterally issue the TO or extend the deadlines above when in the best interest of the Government.

ESTIMATED AND NEGOTIATED COMPOSITE LABOR RATES

(Regardless of Clearance or Location)

Non-Performance Based (Level of Effort)

Program/Project Analyst, Junior

Program/Project Analyst, Journeyman

*Program/Project Analyst, Senior

Systems Analyst, Junior

Systems Analyst, Journeyman

*Systems Analyst, Senior

Program Protection Security Specialist/Management Analyst, Junior

Program Protection Security Specialist/Management Analyst, Journeyman

*Program Protection Security Specialist/Management Analyst, Senior

Foreign Disclosure Analyst/Management Analysts, Junior

Foreign Disclosure Analyst/Management Analysts, Journeyman

*Foreign Disclosure Analyst/Management Analysts, Senior

Editors, Junior

Editors, Journeyman

*Editors, Senior

Information Security Analysts, Junior

Information Security Analysts, Journeyman

*Information Security Analysts, Senior

Database Administrator, Journeyman

Administrative Assistant/Security Coordinator, Junior

*Denotes Key Labor Category

B-2 Fee:

The composite rates from B-1 will be used to develop the total estimated Cost Plus Fixed Fee. Fixed Fee will be calculated based on fee per hour and in accordance with 5252.232-9510 Payment of Fixed Fee (NAVAIR) (OCT 2005). The fee per hour is the total fee proposed for all periods divided by the total number of hours for all periods (1,135,296). The non-performance based fee per hour is $______ (To be determined at contract award).

Section C - Descriptions and Specifications

CLIN SPECIFICATIONS

Item 0001- The contractor shall provide supplies and services in accordance with (IAW) and within the scope of the basic contract and as detailed in any individual task order’s section C.

Item 0002- The contractor shall provide Travel and Material IAW the NAVAIR Clause 5252.232-9509 and within the scope of the basic contract and as detailed in any individual task order’s section C.

Item 0003- The data to be furnished hereunder shall be IAW the Exhibit A, DD Form 1423, Contract Data Requirements List (CDRLs) and within the scope of the basic contract and as detailed in any individual task order’s section C.

Item 0004- The contractor shall furnish the item IAW the scope of the basic contract and as detailed in any individual task order’s section C.

STATEMENT OF WORK

1.0 Background/Scope

1.1 Background: This Statement of Work (SOW) supports the mission(s) of the Naval Air Systems Commands (NAVAIR), Naval Air Warfare Centers (NAWC) and Commander, Fleet Readiness Centers (COMFRC) Platform Security and related support services initiatives. The NAVAIR Security Team is responsible for providing all Navy program offices with the people, skills, knowledge, and expertise required to provide control measures for protecting classified and controlled unclassified information. Platform Security can be defined as security of a Warfighter platform (including the subsystems and support equipment) against foreign intelligence collection and exploitation against all attack surfaces; collection attacks against the program and associated contractors; cyber-attack against program and contractor networks; cyber-attack against the platform during system operation; supply chain attack; collection via international programs; and reverse engineering attack in case of loss on the battlefield or foreign sale. All of these attacks can yield information, which will allow adversaries to understand U.S. capabilities, understand U.S. sources and methods, develop countermeasures (material or non-material) against the weapon system, transfer technology for their own weapon system development, or utilize knowledge gained to mount a kinetic or cyber-attack against the platform. Additionally, knowledge gained from each type of attack can inform future attacks in the same or other types of attacks. Those protections are based on the application of traditional security disciplines which include Acquisition Security, Information Security, International Programs Security (Foreign Disclosure and foreign national visits), Personnel Security, Industrial Security; Operations Security (OPSEC), Physical Security/Force Protection/Anti-Terrorism/Emergency Management, Communications Security (COMSEC), as well as risks associated with Research Technology Protection & Cyber Security Support services.

Platform Security requires the close integration of multiple security disciplines, and the translation of multiple U.S. Government, Department of Defense (DoD) and Department of the Navy (DON) security-related policies into requirements, specifications, design, development, test, production and sustainment of appropriately secured systems. Over time, each security discipline has evolved mostly independently at the DoD, DON, and SYSCOM levels, each the responsibility of a different office, often under different regulatory authority, utilizing different processes, different terminologies, and producing different products. Within a program, facets of platform security are often the responsibility of multiple Integrated Product Teams (IPTs).

1.2 Scope: The scope of this effort is to provide a full range of Platform Security for NAVAIR, NAWC and COMFRC.

The contractor shall perform all activities related to platform security to include the following:

1. Acquisition Security (ACQSEC) Support

2. Security Modeling

3. Program Security Management - Physical Security, Personnel Security, Information Security, Industrial Security, Communications Security (COMSEC), Operations Security (OPSEC), Security Classifications Guides, Program Protection Plan (PPP), and Incident Response.

4. Trusted Systems and Network (TSN) – Criticality Analysis, Anti-Counterfeiting, Supply Chain Risk Management and Software Assurance.

5. Cybersecurity - Cyber Risk Assessment (CRA) and Risk Management Framework (RMF) processes, System Survivability Key Performance Parameter (KPP) requirements development, CYBERSAFE, and Cyber Testing.

6. International Programs Security Support (Foreign Disclosure and Foreign Visits) - Technology Transfer Policy, Foreign Disclosure, Export Control, Foreign Visits, Foreign Partner security assessments, and End Use Monitoring.

7. Physical Security/Force Protection/Anti-Terrorism/Emergency Management – Not guard services.

8. Administrative Assistant Platform Security Support

2.0 Applicable Documents:

Specific applicable policies, instructions, and regulations will be identified in each task order. Throughout the life of the contract, if any policy, instruction, or regulation in section 2.0 is replaced or superseded, the replacement or superseding version shall be applicable to the requirements defined in the SOW.

2.1 Department of Defense (DoD) Specifications.

2.1.1 DoD 5220.22-M, National Industrial Security Program Operating Manual, (NISPOM), (CH2) 18 May 2016

2.1.2 SECNAVINST 5510.36B, Department of the Navy Information Security Program, 12 Jul 2019

2.1.3 DoDM 5200.01 V1, DoD Information Security Program: Overview, Classification, and Declassification (CH1) 4 May 2018 2.1.3(a) DoDM 5200.01 V2, DoD Information Security Program: Marking of Classified Information (CH3) 14 May 2019 2.1.3(b) DoDM 5200.01 V3, DoD Information Security Program: Protection of Classified Information (CH2) 19 March 2013 2.1.3(c) DoDM 5200.01 V4, DoD Information Security Program: Controlled Unclassified Information (CUI) (CH1) 9 May 2018

2.1.4 DoDI 5230.24, DoD Instruction for Distribution Statements on Technical Documents, (CH3), 15 October 2018.

2.1.5 DoDD 5148.13, Intelligence Oversight, 26 April 2017.

2.1.6 DoDM 5400.07, DoD Freedom of Information Act (FOIA) Program, 25 Jan 2017

2.1.7 DoDI 5230.24, Distribution Statements on Technical Documents, (CH3), 15 Oct 2018

2.1.8 SECNAV M-5510.30B, Personnel Security Program, 1 Jun 2006

2.1.9 OPNAVINST 3440.17A, Navy Installation Emergency Management Program, 1 Aug 2014

2.1.10 SECNAV M-5510.34B, Department of the Navy Foreign Disclosure Manual, 11 Mar 2019

2.1.11 OPNAVINST 3432.1A, Operations Security, 4 Aug 2011

2.1.12 OPNAVINST 5530.14E, Naval Physical Security and Law Enforcement Program (CH3), 20 Nov 2017

2.1.13 DoDI 5200.39, Critical Program Information (CPI) Identification and Protection within Research, Development, Test, and Evaluation (RDT&E), 15 Oct 2018

2.2 Department of Defense Standards.

A comprehensive list of Navy regulatory documents can be found at the DON Chief Information Officer (CIO) website http://www.doncio.navy.mil/.

The Contractor shall be responsible for researching and complying with any additional regulations applicable to the task areas in which they are involved.

2.3 Other Government documents (e.g. NAVAIR Documents).

2.3.1 NAVAIRHQ 5520.1B Access Control Security Policy for the RADM William A. Moffett Building, 28 Jan 2013

2.3.2 NAVAIRHQ 5510.38 Naval Air Systems Command National Security Program, 7 Feb 2013

2.3.3 NAWCAD 5510.1B Naval Air Warfare Center Aircraft Division personnel, information, and industrial security program, 5 Jun 2014

2.3.4 NAWCAD 3432.1C OPERATIONS SECURITY, 22 Sept 2017

2.3.5 NASPAXRIVINST 5510.15Q Regulations Governing Admissions to the Naval Air Station, Patuxent River and Webster Field, Maryland, 07 March 2012

3.0 Requirements

3.1 General Requirements

3.1.1 Compatibility - The Contractor shall maintain the capability to prepare documents and software packages compatible with the Government IT environment through the security classification of Secret. The current operating environment required for this contract includes:

Microsoft Windows 10 Microsoft Project 2010 Microsoft Office Professional Plus 2010 Adobe Acrobat XI (reader) Internet access Others, as required per task order

The Contractor shall maintain the ability to interface with and transfer data to and from requiring office software applications and their upgraded versions. The Contractor shall maintain state-of the-art anti-virus software and ensure that all media are virus free when delivered. The Contractor shall be capable of Internet and LAN communications with the Government customers. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with Government customers during working hours whether at Contractor work site or on travel.

3.1.2 Work Location and Facilities

3.1.2.1 Work location: Approximately 90 percent of work will be performed at Government site and 10 percent of work to be performed at Contractor site. Government site(s) primarily include NAVAIR/NAWCAD/COMFRC Patuxent River, MD. Other site locations include St Inigoes, MD; Lakehurst, NJ; Orlando, FL; China Lake, CA; Point Mugu, CA; North Island, CA; Cherry Point, NC; and, Jacksonville, FL. Contractors performing on-site support will be provided access to workspaces, telephones, printers, facsimile machines, copy machines, shredders, computers, and network access including web servers and applicable databases or other applications necessary to carry out assigned tasks.

3.1.2.2 Meeting support: In support of the tasking outlined in this SOW, the Contractor shall have the capability to host and conduct meetings at the classification levels up to Secret level, with the capacity to support a minimum of 15 persons, have contractor furnished telephone and VTC capability (up to Secret level), as well as sufficient equipment to conduct meetings with presentations including compatible software as required in Paragraph 3.1.1 within six months of contract award. The Contractor shall provide simultaneously connection computer-networking capability to allow meeting attendees access to NAVAIR’s NMCI work environment, if applicable. This support shall be provided within a ten (10) mile driving vicinity of NAVAIR/NAWCAD/COMFRC Patuxent River, MD.

3.1.3 Contract Status reporting. The contractor shall provide the following documentation.

CDRL A001 Monthly Progress and Financial Status Report CDRL A002 Transition Out Plan CDRL A003 Operations Security (OPSEC) Plan CDRL A004 Cybersecurity Implementation Plan CDRL A005 Technical and Management Work Plan CDRL A006 Training Data Products CDRL A007 Security Classification Guide CDRL A008 Supply Chain Risk Management CDRL A009 Operations Security (OPSEC) Plan CDRL A010 Cybersecurity Documentation

3.1.3.1 Monthly Progress and Financial Status Report: The contractor shall provide a progress and financial status report in accordance with the Contract Data Requirement List (CDRL A001). The report shall include work accomplished since submittal of the last report, both monthly and cumulative man-hour labor costs expended by labor category and material and travel costs.

CDRL A001 Monthly Progress and Financial Status Report

3.1.4 Work Schedule to include Compressed Work Schedule (CWS), Overtime, Holidays, and Installation Closure.

3.1.4.1 Work schedule: The Contractor shall provide the required services and staffing coverage during normal working hours. Normal working hours are usually 8.5 hours (including a 30-minute lunch break), from 0800 to 1630 each Monday through Friday (except on the legal holidays specified in paragraph 3.1.4.1.2). Some supported Government offices have flexibility to start as early as 0600/0630 and end as late as 1800, Monday–Friday.

3.1.4.1.1 Compressed Work Schedule (CWS): CWS is an alternative work schedule to the traditional five 8.5 hour workdays (which includes a 30-minute lunch) worked per week. Under a CWS schedule, an employee completes the following schedule within a two-week period of time: Eight weekdays are worked at 9.5 hours each (which includes a 30-minute lunch), one weekday is alternately worked as 8.5 hours (which includes a 30-minute lunch) and one weekday is not worked by the employee. The result is 80 hours worked every two weeks, with 44 work hours one week and 36 work hours the other.

The Contractor may allow its employees to work a CWS schedule provided the requirements of this SOW are met. If the contractor chooses to allow its employees to work a CWS schedule in support of this contract, any additional costs associated with the implementation of the CWS schedule vice the standard schedule are unallowable costs under this contract and will not be reimbursed by the Government. Additionally, the CWS schedule shall not prevent Contractor employees from providing necessary staffing and services coverage as required by the Government to the ACOR/COR.

3.1.4.1.2 Holidays: The Government observes the following holidays:

New Year’s Day, January 1 Martin Luther King’s Birthday, the third Monday in January President’s Birthday, the third Monday in February Memorial Day, the last Monday in May Independence Day, July 4 Labor Day, the first Monday in September Columbus Day, the second Monday in October Veteran’s Day, November 11 Thanksgiving Day, the fourth Thursday in November Christmas Day, December 25

3.1.4.1.3 Installation closure: When Federal facilities are closed by the Government, or when Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility related problem that prevents Federal personnel from working at the Government facility, contractor personnel assigned to work at that facility in support of such Federal employees shall follow their parent company’s policies.

While generally contractor personnel may not perform work on-site at a Government facility without oversight from Federal personnel, in very limited circumstances, work being performed by contractor personnel may be deemed mission essential and performance of such mission essential work may be authorized to continue at the Government facility despite the facility being otherwise closed for normal operations. The circumstances permitting work being performed by contractor personnel to be deemed mission essential are extremely limited and generally only apply to performance of efforts related to public health, safety, or matters related to national security. The cognizant Contracting Officer must concur with any determination that work being performed by contractor personnel is mission essential.

3.1.4.1.4 Overtime: Overtime cannot be charged directly to the contract unless first approved in writing by the Contracting Officer.

3.1.4.1.5 Telework Availability: Telework eligibility will be authorized through individual task orders, both in the Contiguous United States (CONUS) and outside the Contiguous United States (OCONUS), by the COR in conjunction with Technical Point of Contact (TPOC/Alternate Technical Point of Contact (ATPOC). Contractor work schedules shall be coordinated with the TPOC to ensure: 1) coverage during critical periods and critical tasking, 2) coordination of tasks involving other contractors, and 3) security compliance for buildings/areas where access is controlled.

The contractor shall adhere to all applicable federal laws and regulations and individual Department of Defense (DoD) Service guidelines shall be adhered to as well.

3.1.5 Other Direct Costs:

3.1.5.1 Travel: Travel may include general and administrative expenses, but shall not include profit. Temporary travel to other CONUS or OCONUS locations in support of program tasking may be required. All travel request estimates must be approved in accordance with NAVAIR clause 5252.232-9509. The Travel Authorization shall include the estimated cost of all potential travel and submitted 10 days before travel for approval. If required, temporary travel locations include Lakehurst, NJ; Orlando, FL; China Lake, CA; Point Mugu, CA; North Island, CA; Cherry Point, NC; Jacksonville, FL; Australia, United Kingdom, and Japan. This list is not all inclusive as locations may change over the life of the contract. (Utilizing the Travel Authorization Request form that will be attached to applicable Task Orders)

3.1.6 Subcontractors and Consultants: Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this contract. All provisions of this SOW shall flow down to subcontractors providing support under this contract.

3.1.7 Management of Contractor Personnel: The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual contractor employees. The contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services.

3.1.8 Transition Out Strategy

The Contractor’s overall transition out strategy shall be built around maintaining the mission of the Naval Air Systems Command (NAVAIR), Naval Air Warfare Centers (NAWC) and COMFRC Platform Security with minimal impact, not only in terms of timeliness of performance but also to ensure that critical data and knowledge transfer occurs. Upon termination or expiration of the contract, the contractor shall ensure an orderly transition of responsibilities, while minimizing impact to the operation. The contractor shall submit a Transition Out Plan, to include the minimum elements listed below in accordance with CDRL A002.

- Work Turnover. The contractor shall provide a plan of action to effectively transfer tasked work that is in process at the expiration or termination of the contract to the successor company. Establish and maintain effective communication with the incoming contractor or Government personnel for the period of transition via weekly status meetings.

- Quality Assurance. The contractor shall provide a plan of action to ensure continuation of quality review processes during the transition period to the successor company.

- Risk Mitigation Strategies. The contractor shall provide a plan of action to mitigate contract performance risks (quality and schedule) encountered during the transition period.

- Data/Information Transfer. The contractor shall provide a plan of action for the efficient inventory and transfer of program data to the successor company.

CDRL A002 Transition Out Plan

3.1.9 Program Unique Requirements

3.1.9.1 Quality Control:

The Contractor shall maintain an effective quality control program to ensure services are performed in accordance with the SOW and the Contract Surveillance Plan (CSP). The Contractor shall implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Government shall evaluate the Contractor’s performance under this contract in accordance with the CSP, which is included as an attachment to the contract in Section J.

3.2 Security

3.2.1 Citizenship Requirements: Only U.S. citizens may perform under this contract. If the Contractor cannot find qualified U.S. citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office. The waiver request should include:

a. The individual's name, date and place of birth, position title, and current citizenship.

b. A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements.

c. A statement of the unusual expertise possessed by the applicant.

d. A statement that access will be limited to a specific government contract (specify contract number).

e. A statement that the Contractor has obtained an export license for the information required to perform the contract.

3.2.2 Investigative Requirements:

All Contractor personnel shall maintain security clearance eligibility commensurate with the level of classification of the work performed as annotated in the Contract's DD-254, Contract Security Classification Specification Form.

Contractor personnel shall require access to classified information in performance of this contract up to and including Top Secret. Classified information will be accessed via the SIPRNet or standalone network in government facilities and at the contractors facility within six months of contract award. The Contractor is responsible for ensuring that all personnel receive the requisite investigation and are favorably adjudicated in accordance with DoDM 5220.22-M, National Industrial Security Program Operating Manual. Contractor employees who fail to meet security clearance requirements may not access classified information or perform sensitive duties. In such cases, the Contractor employee may not perform on the contract.

The contractor shall comply with security requirements specified in the DD-254 attached to this contract. Information or data that the contractor accesses shall be handled at the appropriate classification level. Unclassified information shall be handled in accordance with the appropriate designation (Controlled Unclassified Information; For Official Use Only; Covered Defense Information). Distribution is authorized to the Requiring Office's Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the TPOC/COR of this contract for approval.

Controlled Unclassified Information including For Official Use Only and Covered Defense Information (meeting the definition of 48 CFR 252.204–7012(a)) generated and/or provided under this contract shall be marked and safeguarded as specified in DoDM 5200.01 (DoD Information Security Program: Controlled Unclassified Information (CUI)) Vol. 4 (enclosure 3 pages 11-18) available at http://www.dtic.mil/whs/directives/corres/pdf/520001_vol4.pdf. Any product containing Covered Defense Information shall be assigned a distribution statement (distribution statements B through F) using the criteria set forth in DoDI 5230.24 (Distribution Statements on Technical Documents); and have this statement displayed per DoDI 5230.24, Enclosure 3.

3.2.3 Common Access Card (CAC)/Public Key Infrastructure (PKI), System Authorization Access Request (SAAR-N).

3.2.3.1 SAAR-N: All contractor personnel shall adhere to the SAAR-N guidance as detailed in paragraph J of the Attachment 1 Cyber Security Plan (CS Plan).

3.2.3.2 Command Access Cards (CAC) / Public Key Infrastructure (PKI): All Contractor personnel shall adhere to the CAC/PKI guidance as detailed in paragraph D and J of the Attachment 1 CS Plan.

3.2.3.3 DD-254: The Contractor shall comply with security requirements specified in the DD-254 attached to this contract. Information or data that the contractor accesses shall be handled at the appropriate classification level, unclassified information shall be handled as “For Official Use Only”. Distribution is authorized to the Requiring Office’s Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the TPOC/COR of this contract for approval.

3.2.4 Information Security. All work shall adhere to the Information Security Requirements as detailed in paragraph L of Attachment 1 CS Plan. If the work is performed at the Contractor's facility, the Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and controlled unclassified information (CUI) and to control distribution of CUI in accordance with DoD 5220.22-M (NISPOM), and SECNAVINST-5510.36B. If the work is performed at the Government's facility, the Contractor shall comply with SECNAVISNT-5510.36B, “DoN Information Security Program.”

3.2.4.1 Marking: All information generated by the Contractor shall be properly marked. Controlled Unclassified Information (CUI) and Classified Military Information (CMI) generated and/or provided under this contract shall be marked in accordance with DoDM 5200.01. Technical information shall also be marked with appropriate Distribution Statements and Export Control warnings in accordance with DoDI 5230.24 and program Security Classification Guidance.

3.2.4.2 Public Release for Classified and Unclassified Information: Any controlled information pertaining to this contract shall not be released for public dissemination, including posting to any social media sites such as Facebook or Twitter, unless it has been approved for public release by appropriate U.S. government authority. Proposed public releases shall be submitted for approval prior to release via the PEO, and through the Public Affairs Office, 47123 Buse Road, RADM William A. Moffett Building, Patuxent River, MD 20670-1547.

3.2.4.3 Loss, Compromise and/or Electronic Spillage of Classified or Controlled Unclassified Information: Performance under this contract shall adhere to the Classified Spillages & Information Leakage as detailed in paragraph N of the Attachment 1 CS Plan.

3.2.5 Operations Security (OPSEC): The Contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified and classified activities, information, equipment, and material used or developed by the Contractor and any subcontractor during performance of the contract. The Contractor shall be responsible for the subcontractor implementation of the OPSEC requirements. This program may include Information Assurance and Communications Security (COMSEC). The OPSEC program shall be in accordance with National Security Decision Directive (NSDD) 298, and at a minimum shall include:

a. Assignment of responsibility for OPSEC direction and implementation.

b. Issuance of procedures and planning guidance for the use of OPSEC techniques to identify vulnerabilities and apply applicable countermeasures.

c. Establishment of OPSEC education and awareness training.

d. Provisions for management, annual review, and evaluation of OPSEC programs.

e. Flow down of OPSEC requirements to subcontractors when applicable.

While performing aboard NAVAIR, NAWC, or COMFRC sites, the contractor shall comply with facility OPSEC program instructions and contribute to organization-level OPSEC efforts. Include OPSEC as part of its ongoing security awareness program and take all required Agency training. Be responsive to the Supporting OPSEC Manager on a non-interference basis. Protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the RO and contractor in support of the mission.

CDRL A003 Operations Security (OPSEC) Plan

3.2.6 Anti-Terrorism Force Protection and Emergency Management: The work performed on this contract is Emergency Essential in accordance with OPNAVINST 3440.17A and Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans. Contractor personnel shall comply with all Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans and directives. Contractor personnel shall report for work at Government facilities upon declaration of Force Protection Condition CHARLIE or in any event or emergency where Government officials direct curtailment of operations to “Mission Essential Only”. All Contractor personnel assigned to a government facility shall complete annual Antiterrorism (Level One) and Active Shooter training.

3.2.7 Program Unique Requirements

3.2.7.1 Physical Security: The Contractor shall be responsible for safeguarding all Government property provided for their use. At the end of each work period, all Government facilities, equipment, and materials shall be secured.

3.2.7.2 Government Furnished Property, Equipment, and Information: The Government reserves the right to provide Government Furnished Property, Equipment, and Information on an as needed basis at the task order level.

3.2.7.3 Non-Disclosure Agreements: In the performance of the contract, the Contractor may have access to non-public proprietary information. If the Government determines that the Contractor will have access to non-public proprietary information at a task order level, then the Contractor shall require that any employee performing services under that task order sign a Non-Disclosure Agreement (NDA). The NDA shall acknowledge the Contractor and employees’ duties and promise to comply with those obligations. A copy of the executed NDA shall be provided to the PCO and Government COR for every person on the contract.

3.2.7.4 Disclosure of Information: Contractor employees shall not discuss nor disclose any information to which they are exposed during the execution of tasks to parties other than the originator of the information, authorized Government investigative personnel, the Contracting Officer, or COR personnel. Improper disclosure of sensitive information may be grounds for removal of contractor personnel.

3.2.7.5 Training. The Contractor shall provide qualified personnel who are capable of assuming their duties at contract award. Training for contractor personnel shall be at the contractor’s expense. In the event the Contractor must attend training, the Contractor must coordinate training dates with the Government to ensure continuity of operations.

3.2.7.6 Intelligence Oversight Policy. As per DoDD 5148.13 contractor personnel involved in intelligence and intelligence-related activities are required to report any significant, highly sensitive matter (S/HSM) or questionable intelligence activities (QIA) to appropriate Government officials. An activity or conduct that qualifies as either a QIA or S/HSM is reportable without waiting for substantiation, completion of an investigation, formal adjudication or final resolution of the issue.

3.2.8 Cybersecurity

3.2.8.1 Cybersecurity Plan (CS Plan)

For Cybersecurity (CS) requirements see the CS Plan, Attachment [1]. Specific mentioned policies in the CS Plan can be accessed via the Cybersecurity Policy Chart at the following link: http://iac.dtic.mil/csiac/ia_policychart.html.

The Contractor shall be required to deliver a Program Cybersecurity Implementation Plan (CSIP) or Annex CSIP to address each of the sections of the CS Plan. The contractor shall demonstrate its understanding of the CS Plan and describe how the requirement of each of the sections of the CS Plan will be achieved by the contractor.

The final Program CSIP shall be in Adobe Acrobat format with a digital signature from the contractor cognizant authority.

If no approved Program CSIP currently exists between the contractor and the Government, then one must be created and submitted. If an approved Program CSIP already exists and sufficiently satisfies the CS Plan requirements for the contract, then no new CSIP delivery is required. In such cases, the Contractor in consultation with the Government shall only submit a Contract Letter to the Government stating that all CS Plan requirements are satisfied by the existing Program CSIP.

If CS Plan requirements are NOT adequately addressed by the existing Program CSIP, then an update to the Program CSIP or a supplemental CSIP document referred to as an “Annex CSIP” shall be created to satisfy the CS Plan requirements. An Annex CSIP shall address unique CS Plan Section "G" Assessment and Authorization requirements if a system is being delivered under the contract and unique Section "Q" Software requirements if software is being delivered. These Program CSIP updates or Annex CSIPs shall be submitted on a semi-annual (twice per year) basis in accordance with CDRL A004 Cybersecurity Implementation Plan.

CDRL A004 Cybersecurity Implementation Plan.

3.3 Program Support Requirements: Appropriation types are Research, Development, Test & Evaluation (RDT&E), Working Capital Fund (WCF), Operations & Maintenance (O&M), Aircraft Procurement (AP), Other Procurement (OP), Weapons Procurement (WP), and Foreign Military Sales (FMS). This section provides the detailed support to be provided by the contractor.

3.3.1 Acquisition Security (ACQSEC) Support: The contractor shall provide ACQSEC support, which includes a holistic approach to technology protection using one, some, or all of the traditional security disciplines. Also known as Program Protection Plan (PPP), the contract will facilitate development support and ensure compliance with Acquisition Security regulations, as well as all other security guidance, as applicable. The contractor shall support NAVAIR ACAT programs and clients with facilitating the identification of CPI.

The contractor shall facilitate the development, coordination, and staffing of PPPs, including all appendices, to support acquisition milestone decisions. The contractor shall coordinate with prime contractors, Milestone Decision Authorities (MDAs), other U.S. Government agencies, and NAVAIR/NAWC Security as required in the development and staffing actions.

The contractor shall update, coordinate, and staff Technology Assessment and Control Plans (TA/CPs) to support acquisition milestone decisions.

The contractor shall attend designated acquisition program meetings, technical interchanges, planning conferences, procurement planning conferences, and various acquisition program protection planning working group meetings with Government personnel. The contractor shall subsequently update reports, which shall include an agenda, significant discussion, action item assignments, and recommendations.

The contractor shall provide program management support for ACQSEC requirements, such as PPP reviews, process development, and short and long-term development of ACQSEC goals and objectives. Specifics of ACQSEC program management support will be provided in individual task orders.

CDRL A005 Technical and Management Work Plan CDRL A006 Training Data Products CDRL A007 Security Classification Guide CDRL A008 Supply Chain Risk Management CDRL A009 Operations Security (OPSEC) Plan

3.3.2 SharePoint Site Collection: The contractor shall manage all aspects of the NAVAIR, NAWC, and COMFRC Security SharePoint site environment, including site and content design, site architecture, site performance, monitoring and user access and security of the portal.

The contractor shall provide technical and administrative support to Physical Security in maintaining the physical security database, the Base Access Security Information Control System (BASICS II) application.

The contractor shall provide technical support to the Command-wide Electronic Fingerprint Process.

CDRL A005 Technical and Management Work Plan CDRL A006 Training Data Products

3.3.3 Cybersecurity: The contractor shall support Cybersecurity efforts for Major Defense Acquisition Programs (MDAPs). This support includes CRA and RMF processes, CYBERSAFE, Cyber Testing, and TSN. The contractor shall update, review, and critique Assessment and Authorization (A&A) documentation in compliance with DoD Cybersecurity policy and agency guidance, including DoD, Interface Control Document (ICD), Committee on National Security Systems (CNSS), and National Institute of Standards and Technology (NIST) special publications. The contractor shall assess program security compliance with security technical implementation guides (STIGs), reviewing automated scans, security test and evaluations (ST&E), vulnerability assessments, computer security responses, and creating and managing RMF packages. The contractor shall work with network monitoring tools for the purpose of identifying deficiencies with approved software.

The Contractor shall coordinate, attend and possibly lead program management level meetings to address Cybersecurity requirements in the area of CRA and RMF processes, CYBERSAFE, Cyber Testing, and TSN. Participate in program and Systems Engineering Technical Reviews (SETR) and analyze procurement specifications and data packages; T&E suitability/ supportability documentation; and provides technical recommendations on Engineering Change Proposals (ECPs) and/or spiral upgrades.

The Contractor shall inform Program Managers and IPT Leads on technical matters involving Cybersecurity, under their cognizance, and serve as a technical expert for the program to various segments of Government, industry, and the DoD in Cybersecurity issues.

CDRL A010 Cybersecurity Documentation

3.3.4 International Programs Security Support (Foreign Disclosure and Foreign Visits): The contractor shall provide comprehensive planning, technical, and management solutions for FMS, International Cooperative Programs, Hybrid FMS/Cooperative Cases, and foreign national IT access. The contractor shall analyze and review program documentation prior to submission to the Government for release to foreign governments and contractors. The contractor will update draft documentation for U.S. Government technology transfer policy, monitor U.S. Government compliance with existing U.S. Government policy and regulations for current programs and draft required documentation for future phases of NAVAIR international programs.

The contractor shall provide support in developing and implementing DoD disclosure and release ability requirements. The contractor shall apply logical analysis and evaluation of programs and policies to provide recommendations for release to a Designated Disclosure Authority (DDA). The contractor shall coordinate with all required stakeholders for appropriate technical review of data for release to foreign nationals and coordinate release requests. The contractor shall assist in resolving releasability questions and issues.

The contractor shall oversee tracking and ensure quality of data reviewed for release to foreign nationals.

The contractor shall provide support for management of foreign national visits.

The contractor shall provide assistance and support in the management of Export Licenses, Technical Assistance Agreements (TAAs) and Committee on Foreign Investment in the United States (CFIUS) cases.

The contractor shall support in the development and presentation of International Programs Security training and awareness.

CDRL A005 Technical and Management Work Plan CDRL A006 Training Data Products

3.3.5 Information Security/Lab Manager/Department (Competency) Security Manager: The contractor shall provide the technical capabilities to support implementation of the NAVAIR Information Security Program in accordance with SECNAVISNT-5510.36B, “DoN Information Security Program.” The Contractor shall safeguard all classified and controlled unclassified information, using appropriate equipment to include storage, handling, marking, transmission, transportation, reproduction, dissemination and destruction. Maintain Secure Area/Lab Standard Operating Procedures (SOP) and ensure currency in accordance with the latest directives, regulations, and guidance. The contractor shall develop, coordinate and staff Security Classification Guidance (SCGs) and updates, to ensure compliance with appropriate regulations and policy. The contractor shall conduct classification reviews of program material in accordance with the appropriate SCG and make recommendations regarding the sensitivity or classification of the material. The contractor shall perform reviews of material requested for public release, as well as Freedom of Information Act (FOIA) requests, and make recommendations regarding the release of the information. The contractor shall support NAVAIR Headquarters, major programs and field activities with the appropriate safeguarding, marking and handling of classified and controlled unclassified information. The contractor shall participate in preliminary inquiries resulting from security incidents. The contractor shall conduct physical inventories of classified material when requested.

The contractor shall support in the development and presentation of Information Security training and awareness.

CDRL A005 Technical and Management Work Plan CDRL A006 Training Data Products CDRL A007 Security Classification Guide

3.3.6 Personnel Security: The contractor shall provide the technical capabilities to support implementation of the NAVAIR Personnel Security Program in accordance with SECNAV M-5510.30B. The contractor shall assist NAVAIR programs and field activities on the determination of the required position sensitivity categories for specific duties. The contractor shall support the management of personnel clearance tracking systems and verification of security clearances.

The contractor shall support in the development and presentation of Personnel Security training and awareness.

CDRL A005 Technical and Management Work Plan CDRL A006 Training Data Products

3.3.7 Industrial Security: The contractor shall provide the technical capabilities to support the management and implementation of the Industrial Security Program for NAVAIR, major programs, and field activities. The contractor shall comply with DoDM 5220.22-M.

The contractor shall support in the development and presentation of Industrial Security awareness and training.

CDRL A005 Technical and Management Work Plan CDRL A006 Training Data Products

3.3.8 Operations Security (OPSEC): The contractor shall provide the technical capabilities to support the management and implementation of the OPSEC Program for NAVAIR, major programs and field activities. The contractor shall comply with OPNAVINST 3432.1A.

The contractor shall develop OPSEC Survey/Assessment Plans, as well as conduct and produce findings of surveys/assessments.

The contractor shall support in the development and presentation of OPSEC awareness and training.

CDRL A005 Technical and Management Work Plan CDRL A006 Training Data Products CDRL…