SCI MAC RFP Draft v1.pdf

CODE

(Hour)

PAGE(S)

until local time

X

A X B X C X D

EX

X

G F 74 - 90

91 - 97 X H 98 - 100

RATING PAGE OF PAGES

7. ISSUED BY

(Date)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

Previous Edition is Unusable 33-134 STANDARD FORM 33 (REV. 9-97)

Prescribed by GSA FAR (48 CFR) 53.214(c)

1 100

(If other than Item 7)

15A. NAME 16. NAME AND TITLE OF PERSON AUTHORIZED TO

AND

ADDRESS

SIGN OFFER (Type or print)

OF

OFFEROR

AMENDMENT NO. DATE

15B. TELEPHONE NO (Include area code) 17. SIGNATURE15C. CHECK IF REMITTANCE ADDRESS

IS DIFFERENT FROM ABOVE - ENTER

SUCH ADDRESS IN SCHEDULE.

18. OFFER DATE

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

2. CONTRACT NO.

N00421 8. ADDRESS OFFER TO

See Item 7

9. Sealed offers in original and 1 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in

CAUTION - LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and

See Item 7 conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME (NO COLLECT CALLS)

11. TABLE OF CONTENTS

SOLICITATION/ CONTRACT FORM

SUPPLIES OR SERVICES AND PRICES/ COSTS

1 - 2 3 - 5

X I CONTRACT CLAUSES

DESCRIPTION/ SPECS./ WORK STATEMENT X

PACKAGING AND MARKING

6 - 28 29 - 30

J LIST OF ATTACHMENTS

INSPECTION AND ACCEPTANCE

DELIVERIES OR PERFORMANCE

31 - 32 33 - 34

X K

REPRESENTATIONS, CERTIFICATIONS AND

OTHER STATEMENTS OF OFFERORS

CONTRACT ADMINISTRATION DATA 35 - 43 X

SPECIAL CONTRACT REQUIREMENTS

OFFER (Must be fully completed by offeror) 44 - 53 X M

L INSTRS., CONDS., AND NOTICES TO OFFERORS

EVALUATION FACTORS FOR AWARD

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52.232-8)

14. ACKNOWLEDGMENT OF AMENDMENTS

(The offeror acknowledges receipt of amendments

AMENDMENT NO. DATE

to the SOLICITATION for offerors and related documents numbered and dated):

FACILITY

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period

SOLICITATION, OFFER AND AWARD

X

(X) SEC. DESCRIPTION (X) SEC. DESCRIPTION PAGE(S)

PART I - THE SCHEDULE

26. NAME OF CONTRACTING OFFICER (Type or print) 27. UNITED STATES OF AMERICA 28. AWARD DATE

EMAIL:TEL: (Signature of Contracting Officer)

CODE CODE

B. TELEPHONE (Include area code) C. E-MAIL ADDRESS

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT 21. ACCOUNTING AND APPROPRIATION

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

10 U.S.C. 2304(c)( ) 41 U.S.C. 253(c)( ) (4 copies unless otherwise specified)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN ITEM

24. ADMINISTERED BY (If other than Item 7) CODE 25. PAYMENT WILL BE MADE BY CODE

PART IV - REPRESENTATIONS AND INSTRUCTIONS

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

54 - 72

PART II - CONTRACT CLAUSES

NAWCAD PROCUREMENT GROUP

21983 BUNDY ROAD, BLDG 441

PATUXENT RIVER MD 20670

FAX:

TEL:

FAX:

TEL:

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

SOLICITATION

6. REQUISITION/PURCHASE NO.5. DATE ISSUED4. TYPE OF SOLICITATION

SEALED BID (IFB)

NEGOTIATED (RFP)

[ X ]

3. SOLICITATION NO.

N0042123R0077

Section A - Solicitation/Contract Form

1A. NOTICE TO OFFERORS

A.1 NOTICES TO OFFERORS

a) This is the DRAFT solicitation, or Request for Proposal (RFP), for the Naval Air Warfare Center Aircraft Division (NAWC-AD) Sensitive Compartment Information (SCI) Multiple Award Contract (MAC).

b) Throughout this document, this procurement will be referred to as “SCI MAC”.

c) Offerors shall follow the instructions set forth in this RFP to be considered for award. Any amendment(s) to this RFP will be posted to Procurement Integrated Enterprise Environment (PIEE)/ https://piee.eb.mil.

A.1.1 SOLICITATION (RFP) FORM

a) Offerors shall submit the Standard Form (SF) 33, Solicitation, Offer and Award, posted as page 1 of this RFP, located at https://www.fbo.gov.

b) Offerors shall fill out blocks 12 through 18 as the Official Legal Entity.

c) The Government may reject any proposal that is incomplete or does not comply with the instructions set forth in Section L of this RFP. Rejected proposals will not be evaluated by the Government.

A.1.2 SOLICITATION (RFP) NOTICE

a) The SCI MAC is a group of Indefinite Delivery, Indefinite Quantity (IDIQ) NAWC-AD-wide contracts. The Government Subject Matter Experts (SME) understand that the security requirements to execute the work under this MAC can be addressed by both large and small businesses. Based on the inability to pre-define exact platforms, systems and areas of service performance, and magnitude across all potential future requirements, this RFP will result in award to a single pool of large and small businesses. The set-aside status of each order will be defined at the individual order level.

b) This RFP’s Small Business Size Standard is $47,000,00 and covers the North American Industry Classification System (NAICS) code 541330.

c) The Product Service Codes (PSCs) for this procurement is R425 – Support Professional Engineering/Technical

d) This RFP utilizes Class Deviation (2018-O0006, dated 13 DEC 2017) which permits Multiple Award Contracts (MACs) to exclude price/cost as an evaluation factor under certain conditions.

A.1.3 GENERAL INFORMATION

a) Offerors and/or interested parties shall address ALL communication via e-mail to the SCI MAC Acquisition Cell at: SCIMACAcquisition.fct@navy.mil .

b) Acknowledgement of receipt of questions will not be made.

c) Questions not submitted via SCIMACAcquisition.fct@navy.mil will not be answered.

d) Questions will be answered under an amendment and posted at Procurement Integrated Enterprise Environment (PIEE)/https://piee.eb.mil website.

e) Please thoroughly review the entire RFP, including all the attachments in Section J, prior to submitting questions.

Section B - Supplies or Services and Prices

BACKGROUND

B.1 CONTRACT TYPE AND APPROPRIATION

a) This SCI MAC allows for various Contract Line Item Number (CLIN) types at the Delivery Order/Task Order (DO/TO) level, including Cost-Reimbursement (all types) and Fixed-Price (all types). DO/TOs may also combine more than one CLIN type (e.g., Fixed Price/Cost). Additionally, DO/TOs may include incentives, performance based measures, and option periods. Appropriation Type will be determined at the DO/TO Level.

The Government intends to utilize the following CLIN numbering scheme at the individual DO/TO Level:

CLIN “ABCD” where:

“A” represents the Period of Performance Identifier. “0” – Base Year, “1” – Option Period 1, and so forth.

“B” represents the Program / Project Identifier for segregation of funds. “1” – Project 1, “2” Project 2, and so forth

“C” represents the different Appropriation Type.

“D” references the basic contract CLIN from which the CLIN is derived. “1” – Labor, “2” – Travel, and so forth.

B.2 MINIMUM GUARANTEE AND MAXIMUM CEILING

a) The minimum guarantee of $1,000.00 will be provided to each Contractor that does not competitively attain a DO/TO award for the five (5) year base ordering period of this SCI MAC.

b) The maximum dollar ceiling for each individual DO/TO placed under this SCI MAC is $249,000,000.00.

c) An unlimited number of DO/TOs may be placed under this SCI MAC until the Government’s Not-to-Exceed (NTE) Ceiling amount of $249,000,000 is reached for the term of the contract. This NTE Ceiling amount will be the shared ceiling on each awardee’s IDIQ Contract. The pricing contained within Section B is to establish the shared ceiling, inclusive of all CLINs, at the basic MAC.

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 Lot Labor - In support of SOW

CPFF

Services in accordance with Section C, Statement of Work (SOW) FOB: Destination

PSC CD: R425

ESTIMATED COST

FIXED FEE

TOTAL EST COST + FEE

0002 Lot ODC - Travel

COST

ODC Travel in support of CLIN 0001 in accordance with Section C.

PSC CD: R425

0003 Lot ODC – Material in Support of Section C

COST

ODC Material in support of CLIN 0001 in accordance with Section C

Data

Not Separately Priced Technical Data in support of Labor and ODC CLINs. NSP Data in support of

SOW.

NET AMT

CLAUSES INCORPORATED BY FULL TEXT

5252.211-9503 LEVEL OF EFFORT (COST REIMBURSEMENT) (NAVAIR)(DEC 2012)

(a) The level of effort estimated to be ordered during the term of this contract is [Insert man-hours] man-hours of direct labor including authorized subcontract labor, if any. The contractor shall not, under any circumstances, exceed one hundred (100%) percent of the total level of effort specified in this basic contract. The estimated composition of the total man-hours of direct labor by classification is as follows:

Labor Category Man-hours Total Man-hours (insert the man-hours per labor category) ”To be defined at the individual DO/TO level”.

(Also list Options Man-hours if applicable) Totals

* denotes Key Personnel labor categories

(b) FAR Clause 52.232-20, "Limitation of Cost" applies to fully funded orders and FAR Clause 52.232-22, "Limitation of Funds" applies to incrementally funded orders. Nothing in this clause amends the rights or responsibilities of the parties hereto under either of those two clauses. In addition, the notifications required by this clause are separate and distinct from any specified in either FAR Clause 52.232-20 or FAR Clause 52.232-22.

(c) In the event that less than one hundred (100%) percent of the established level of effort of the contract/order is actually expended by the end of the performance period, the Government shall have the option of:

(1) Requiring the Contractor to continue performance, subject to the provisions of the FAR Clause 52.232-20 or 52.232-22, as applicable, until the effort expended equals 100% of the established Level of Effort; or

(2) Effecting a reduction in the fixed fee by the percentage by which the total expended man-hours is less than one hundred (100%) percent of the established Level of Effort.

(d) The contractor agrees that effort performed in fulfillment of level of effort obligations under this contract shall include only verifiable effort in direct support of the work specified. It shall not include efforts such as work performed in transit to or from an employee's usual workplace, work during lunchtime activities, or effort performed at other non-work locations.

(e) In performing the contract/order, the contractor may use any reasonable combination of hours for the labor categories in support of section C of this contract/order.

Section C - Descriptions and Specifications

STATEMENT OF WORK

1.0 INTRODUCTION

1.1 BACKGROUND

The Intelligence Division of the Naval Air Warfare Center Aircraft Division (NAWCAD) provides a broad spectrum of intelligence and threat support across the Naval Air Systems Command (NAVAIR) and the NAVAIR-supported Program Executive Offices. The NAWCAD Intelligence Division provides analysis and fusion of finished multi-intelligence products from the U.S. Intelligence Community. The NAVAIR and NAWCAD require contractor support services across all aspects of the Acquisition Life Cycle of various platforms and systems, as well as intelligence and threat support to numerous research, development, test, and evaluation activities. This contract vehicle is intended to provide general contractor support services access to intelligence and threat information at various levels of classification to enable NAVAIR, subordinate Commands, Program Executive Offices, and subordinate Programs to execute their mission.

1.2 SCOPE

This contract vehicle will permit specific task orders to be issued based on the general tasks outlined. The contractor will work in a highly integrated team environment with government customers supporting the NAVAIR enterprise and Program Executive Offices. The contractor will provide analytical, technical, and managerial efforts in the areas of acquisition, analysis, research and engineering, test and evaluation, logistics, training, program management, and procurement. The contractor will engage with a wide range of customers across the U.S.

Department of Defense. This contract will not provide any hardware or software deliverables.

1.3 ISSUANCE of ORDERS

This contract vehicle is a Multiple Award Contract (MAC) with a single vendor pool consisting of both large and small business participants. Requirements of an estimated total annual value of less than $3.0M value, or less than 15 positions will be set aside for small business unless otherwise determined through a sources sought conducted within the MAC pool of an unacceptable level of risk or ability to achieve adequate competition. Size status eligibility for all set asides will be at time of proposal submission for each task order solicitation/award. The Government reserves the right to issue non-competitive task orders on a sole source basis in accordance with FAR 16.505.

2.0 APPLICABLE DOCUMENTS

The following documents are applicable to the SOW as specified herein. This list is not all inclusive. This list is for reference only and defines the most common documents, policies, specifications that may be applicable in the performance of the duties defined within this SOW.

New instructions, supplements, amendments, or revisions to documents may be issued during the term of the contract, and shall be in full force and effective immediately upon receipt by the Contractor. In the case of an inconsistency between the industry standards referenced herein and the Government documents referenced below, the Navy/DoD standard will always take precedence.

2.1 REFERENCED DOCUMENTS

2.1.1 FEDERAL/DOD/MILITARY DOCUMENTS

Joint Travel Regulation (JTR) DODM 5200.01 – DoD Information Security Program: Controlled Unclassified Information

(CUI)

National Industrial Security Program Operating Manual (NISPOM) DODD 5230.24 – Distribution Statements on Technical Documents

NAVY DOCUMENTS

EKMS-1b - Electronic Key Management System (EKMS) Policy and Procedures For Navy EKMS Tiers 2 & 3 NASPAXRIVINST 5100.35D – Safety and Occupational Health Manual NASPAXRIVINST 12610.7H – Employee Reporting Procedures During Emergencies NAVADMIN 259/23 SAAR – System Authorization Access Request (SAAR) OPNAVINST 3440.17A – Navy Installation Emergency Management Program OPNAVINST 5239.1D- US Navy Cybersecurity Program NASPAXRIV 5510.15Q- Base Access Regulation SECNAVINST 5100.13E – Navy Tobacco Policy SECNAV M-5510.30 – Personnel Security Program SECNAV M-5510.36 – Information Security Program SECNAVINST 5510.36- DoN Information Security Program (ISP) Regulation OPNAVINST 5530.14E - Navy Physical Security and Law Enforcement Program OPNAVINST 3710.7U - NATOPS General Flight and Operating Instruction NASPAXRIVINST 3440.17A- Installation Emergency Management Program NASINST 5100.35C - Occupational Safety and Health Manual NASINST 11320.1N - Fire Bill NAVAIR 3710.1G – Contractor’s Flight and Ground Operations NAVAIR 3710.8E - Authority for Personnel to Pilot or Fly in Aircraft Under the Controlling Custody of Naval Air Systems Command to Include the Authority for Naval Air Systems Command Personnel to Participate in (Pilot or Fly In) Commercial Aircraft Conducting Public Aircraft Operations in Support of Test and Evaluation

3.0 REQUIREMENTS

3.1 COMPATIBILITY

The Contractor shall maintain the capability to prepare documents and software packages compatible with the Government IT environment. The current operating environment required for this contract includes:

• Microsoft Windows 10

• Microsoft Project 2016

• Microsoft Office Professional Plus 2016

• Microsoft SharePoint 2016

• Adobe Acrobat XI (reader)

• Internet access The Contractor shall maintain the ability to interface with and transfer data to and from requiring office software applications and their upgraded versions. For contract administrative or indirect functions performed at the Contractor site, the Contractor shall ensure that all media delivered to the Government are virus free when delivered. The Contractor shall be capable of Internet and LAN communications with the Government. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with the Government during working hours whether at Contractor work site or on travel.

3.1.2 WORK LOCATION AND FACILITIES

3.1.2.1 The Contractor may perform work at the Contractor’s facility, a Government facility, or other location identified by the Government inclusive of situational telework, at the DO/TO (Delivery Order / Task Order) level. The Contractor may be required to perform work in hazardous locations including theaters of operations, combat zones, and Partner Nations. The Contractor may be required to attend DoD training prior to traveling and working in OCONUS locations. Access to Sensitive Compartmented Information will be at SCI accredited facilities only. Place of performance shall be at: Patuxent River, MD; China Lake, CA; Point Mugu, CA;

Lakehurst, NJ; Orlando, FL; Arlington, VA; and St. Inigoes, MD. Contractor's facility and other facilities as designated by the COR.

3.1.2.2 Government onsite support does not include temporary and ad-hoc support performed away from NAVAIR/NAWCAD facilities. Contractors performing on-site support will be provided access to workspaces, telephones, printers, facsimile machines, copy machines, shredders, computers, network access including web servers, tooling, and applications necessary to carry out assigned tasks.

3.1.3 CONTRACT STATUS REPORTING

At the Task Order Level

3.1.3.1 MONTHLY FINANCIAL STATUS REPORT

The Contractor shall provide a financial status report in accordance with the Contract Data Requirement List (CDRL) A001. The report shall provide an overall contract summary of awarded ceiling, funded ceiling, unfunded committed ceiling from unexercised priced options, obligations not expensed, and expenditures for the contract. The report shall include an itemized breakout of ALL include work accomplished since submittal of the last report, both monthly and cumulative man-hours executed and associated labor costs expended by CLIN, labor category, material and travel costs. The report shall also provide an order financial health projection based on average labor burn rates. The report shall include a summary table of the average proposed and actual in execution the hourly fully burdened rate across by labor category, skill level, and location (Government site and Contractor site).

3.1.3.2 MONTHLY PROGRESS REPORT

The Contractor shall provide a monthly progress report in accordance with CDRL A002. This report shall list the monthly accomplishments, risks with mitigation plans, action items, and upcoming task order / project objectives for each task order/ project and each identified financially tracked project task. Trips and significant event shall also be addressed. The report shall be organized by project, then by financially tracked task, as applicable.

3.1.3.3 PERSONNEL LOCATOR REPORT

The Contractor shall provide a monthly personnel locator report in accordance with CDRL A005. This report identifies all Contractor and subcontractor personnel working under this contract as of the date of the CDRL, and identifies those that have been added or removed since the previous submission. The report shall include name, labor category, employed by, designated cyber security work force position (yes/no), security clearance level, security clearance verification date, assigned project team, start date, separation date and location of performance. The personnel names shall be the exact same format and detail as used in the payroll report to allow for cross-referencing.

3.1.3.4 ADDITIONAL STATUS REPORTING

Additional status reporting may be defined at the individual task order level.

3.1.4 WORK SCHEDULE TO INCLUDE COMPRESSED WORK SCHEDULE (CWS),

OVERTIME, HOLIDAYS AND INSTALLATION CLOSURE

This section applies to work performed at the Government facilities.

3.1.4.1 WORK SCHEDULE

The Contractor shall provide the required services and staffing coverage during normal working hours. Normal working hours are usually 8.5 hours (including a 30-minute lunch break), from 0730 to 1600 each Monday through Friday (except on the legal holidays specified below). Some supported Government offices have flexibility to start as early as 0600 and end as late as 1800, Monday–Friday. If different hours are needed by a Government team or the Contractor (e.g., individual groups or locations may allow or require different hours) on a long term basis, they will be coordinated through the Technical Point of Contact (TPOC) associated with that work and approved by the Contracting Officer Representative (COR).

The compressed work schedule (CWS) is an alternative work schedule to the traditional five 8.5-hour workdays (which includes a 30-minute lunch) worked per week. Under a CWS schedule, an employee completes the following schedule within a two-week period: eight weekdays are worked at 9.5 hours each (which includes a 30-minute lunch), one Friday is alternately worked as 8.5 hours (which includes a 30-minute lunch) and one Friday is not worked by the employee.

The result is 80 hours worked every two weeks, with 44 work hours one week and 36 work hours the other.

The Contractor may allow its employees to work a CWS schedule. The CWS schedule shall not prevent Contractor from providing necessary staffing and services coverage as required by the contract and individual Task Orders. If the Contractor chooses to allow its employees to work a CWS schedule in support of this contract, any additional costs associated with the implementation of the CWS schedule vice the standard schedule are unallowable costs under this contract and will not be reimbursed by the Government.

3.1.4.2 HOLIDAYS

The Government observes the Federal holidays identified on the Office of Personnel Management (OPM) website: https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview. Except for the events in section 3.1.4.5 below, the Contractor is permitted to observe Federal holidays IAW its corporate policy.y

3.1.4.3 OVERTIME (OT)

Overtime as defined in this contract refers to hours worked by a Contractor employee in excess of the employee’s normal workweek. When support requirements outside of normal working hours occur, the Contractor shall ensure qualified personnel are available to support the requirements through overtime. Overtime is authorized under this contract to the extent specified in individual Task Orders, provided COR approval is obtained in advance. The COR may provide concurrence for overtime on a task, event, program, project, or general function basis. The total cost for overtime over the life of the contract cannot exceed the amount specified in clause 52.222-2 Payment for Overtime Premiums unless first approved in writing by the Procuring Contracting Officer (PCO).

3.1.4.4 TRAVEL/TEMPORARY DUTY (TDY)

When personnel are temporarily deployed offsite, the Contractor shall modify the traveler’s working hours to best support the assigned tasking and minimize overtime.

3.1.4.5 GENERAL FACILITY ACCESS

When Federal facilities are closed by the Government or when Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility-related problem that prevents Federal personnel from working at the Government facility, contractor personnel assigned to work at that facility in support of such Federal employees shall follow their parent company’s policies.

While generally, contractor personnel may not perform work on-site at a Government facility without oversight from Federal personnel, in very limited circumstances, work being performed by contractor personnel may be deemed mission essential and performance of such mission essential work may be authorized to continue at the Government facility despite the facility being otherwise closed for normal operations. The circumstances permitting work being performed by contractor personnel to be deemed mission essential are extremely limited and generally only apply to performance of efforts related to public health, safety, or matters related to national security. The cognizant Contracting Officer (KO) must concur with any determination that work being performed by contractor personnel is mission essential.

3.1.5 OTHER DIRECT COSTS

3.1.5.1 TRAVEL: Travel may include general and administrative expenses, but shall not include profit. All travel shall be approved and reimbursed in accordance with CTXT.232-9509

TRAVEL APPROVAL AND REIMBURSEMENT PROCEDURES (NAVAIR) (OCT 2013).

Temporary travel to other locations in support of program tasking is required. If required, temporary travel locations include all Navy and Marine Corps facilities and bases, various commercial facilities, other Contractor facilities, Navy facilities and ships, DoD facilities/installations, other Government agency offices (e.g. test ranges, operational activities, project/program offices, and support activities), including travel OCONUS. This list is not all inclusive as locations may change over the life of the contract.

3.1.5.2 MATERIAL:

Incidental material will be required in the performance of this Contact, and all incidental material purchases shall be IAW C-TXT-242.9520 Procedures and Approvals Required Prior to Incurring Direct Material Costs (April 2022).All materials not depleted during the performance of this contract shall become Government property upon completion of this contract. The contractor shall transfer all materials not depleted to the COR by way of Material Inspection and Receiving Report (DD Form 250). Material costs may include general and administrative expenses but shall not include profit/fee.

3.1.6 SUBCONTRACTORS

All Subcontractor personnel working on this contract are viewed by the Government as part of the Prime’s workforce. As such, there shall be no processes, requests, approvals, or other documents or procedures that are presented to the Government from the Subcontractor. All Subcontractors shall conform to the same processes and documentation as the Prime when interfacing with the Government. Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this contract. All provisions of this SOW shall flow down to subcontractors providing support under this contract.

3.1.7 MANAGEMENT OF CONTRACTOR PERSONNEL

The Government will neither supervise contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual contractor employees. The Contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services.

3.1.8 NON-DISCLOSURE AGREEMENTS (NDA)

In the performance of the contract, the Contractor may have access to non-public proprietary information. The Contractor shall require that any employee performing services under the contract execute a NDA satisfactory to the Contracting Officer. The NDA shall acknowledge the Contractor and employees’ duties with respect to non-public information, and promise to comply with those obligations. A copy of the executed NDAs shall be provided to the Contracting Officer Representative upon request.

3.1.8 AIRCRAFT RELATED ACTIVITIES

In the performance of the contract, the Contractor may have access to aircraft hangars, flight lines, maintenance areas, mobile and fixed ground control stations, and aircraft. All Contractor personnel shall follow the local instructions, policies and procedures in regards to physical access, foreign object damage, tool control, and reporting requirements.

During performance of this contract, at the individual order level the COR may determine that Contractor personnel shall be required to fly as Project Specialists as defined in NAVAIRINST 3710.8E. The Contractor has the discretion to assign the individuals to meet this requirement.

These employees shall be required to support the Government by monitoring installed system equipment, supporting aircraft operators test, training, and gathering data during flight, and accompanying expeditionary MMS systems on military transport flights for deployment. These duties will be adjunct with regular day-to-day functions. These employees shall be qualified in accordance with NAVAIRINST 3710.1G, NAVAIRINST 3710.8E and OPNAVINST 3710.7U.

Point-to-point transportation is not authorized. Project Specialists are not responsible for normal aircrew duties. Authority to waive Naval Aviation Survival Training Program (NASTP) requirements for Project Specialists is delegated to COMNAVAIRSYSCOM for aircraft under its control. Decisions to waive shall be based on the risks identified through a thorough Operational Risk Management (ORM) analysis. Under no circumstances shall NASTP ejection seat training requirements be waived. Prior to first flight the contractor must have a Government approved Ground and Flight Operations Procedures, tailored to Project Specialist requirements alone, in compliance with NAVAIRINST 3710.1G. (CDRL A004)

3.2 SECURITY

The Contractor shall provide personnel who possess the authorization/clearance to access, view, possess, transport, process or use classified information, information systems and workspaces as required. Certain Contractor personnel must possess and maintain a TOP SECRET//SENSITIVE COMPARTMENTED INFORMATION (SCI) Security Clearance. In addition, certain Contractor personnel must possess TOP SECRET//SENSITIVE COMPARTMENTED INFORMATION security clearance access and/or be eligible for immediate adjudication by the cognizant security authority upon award of contract tasking. Designated individuals requiring access to NSA-Net require a successful Counterintelligence (CI) Polygraph.

3.2.1 CITIZENSHIP REQUIREMENT

Only U.S. citizens may perform under this contract.

3.2.2 INVESTIGATION REQUIREMENTS

All Contractor personnel shall maintain security clearance eligibility commensurate with the level of classification of the work performed as annotated in the Contract's DD-254, Contract Security Classification Specification Form.

Contractor personnel shall require access to classified information in performance of this contract up to and including TOP SECRET//SENSITIVE COMPARTMENTED

INFORMATION. The Contractor is responsible for ensuring that all personnel receive the requisite investigation and are favorably adjudicated.

The contractor shall comply with security requirements specified in the DD-254 attached to this contract. Information or data that the contractor accesses shall be handled at the appropriate classification level. Unclassified information shall be handled in accordance with the appropriate designation (Controlled Unclassified Information; Covered Defense Information). Distribution is authorized to the Requiring Office's Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the TPOC/COR of this contract for approval.

All DoN Contractors with SCI access must be briefed into NATO Secret access, in accordance with Director of National Intelligence Memorandum 5 May 2017, Access to North Atlantic Treaty Organization (NATO) Information by Intelligence Community (IC) Personnel and Naval Intelligence Security Policy Directive 17-008 Revision, Mandate for North Atlantic Treaty Organization (NATO) information by Intelligence Community (IC) Personnel.

Contractor safeguarding requirements will be defined at the individual order level.

3.2.3 COMMON ACCESS CARD (CAC) PKI, SAAR-N

3.2.3.1 SAAR

All Contractor personnel requiring access to Government IT systems shall access and operate IT systems and networks IAW NAVADMIN 259/23 and CTXT.204-9505 SYSTEM

AUTHORIZATION ACCESS REQUEST NAVY (SAAR) REQUIREMENTS FOR

INFORMATION TECHNOLOGY (IT) (NAVAIR) (JAN 2024) have an approved SAAR – System Authorization Access Request form on file, and complete required Annual Information Awareness/Cyber Security Training. New employees must submit their SAAR forms within thirty (30) days of their first day of work.

3.2.3.2 CAC / LOCAL BADGES

Contractor CACs and facility specific identification badges will be issued by the Government to on-site Contractor personnel and shall be visible at all times while personnel are at the Government site. The Contractor shall furnish all requested information required to facilitate issuance of identification badges. All CACs and identification badges issued to Contractor employees shall be returned to the Government Security Department at the Government site following completion of the contract, relocation or termination of an employee, or upon request from the COR. The Government will provide the Contractor access to Government facilities, as required, for performance of tasks under this contract.

3.2.3.3 DD-254

The Contractor shall comply with security requirements as specified in the DD-254 of this contract. Information or data that the Contractor accesses shall be handled at the appropriate classification level, unclassified information shall be handled as “Controlled Unclassified Information (CUI)”. Distribution is authorized to the Requiring Office’s Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the COR of this contract for approval.

3.2.3.4 OTHER BADGING

Badges to special, classified, limited access, and/or commercial facility (e.g. Prime Contractor for a project or platform) areas may be required by the Contractor based on location and tasking.

The Contractor shall adhere to the rules governing the issuance of those badges.

3.2.4 Information Security

If work is performed at the Contractor’s facility, the Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and CUI and to control distribution of CUI IAW the National Industrial Security Program Operating Manual (NISPOM) codifying 32 Code of Federal Regulation Part 117, NIPSOM Rule, and SECNAV M-5510.36B – Information Security Program. If the work is performed at the Government’s facility, the Contractor shall comply with instructions/guidance required by that facility

Information at the TS//SCI level will be protected in accordance with DoDI 5200.01 DoD Information Security Program and Protection of Sensitive Compartmented Information (SCI).

All contractor facilities shall provide an appropriate means of storage for CUI and materials. All CUI including legacy FOUO information and Covered Defense Information (CDI) (meeting the definition DFARS Clause 252.204–7012, Safeguarding Covered Defense Information and Cyber Incident Reporting) generated and/or provided under this Contract shall be marked and safeguarded as specified in DoD Instruction 5200.48, Controlled Unclassified Information (CUI) available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF.

3.2.4.1 MARKING

All information generated by the Contractor shall be properly marked. Controlled Unclassified Information including Covered Defense Information (meeting the definition of 48 CFR 252.204– 7012(a)) generated and/or provided under this contract shall be marked and safeguarded as specified in DoD Instruction 5200.48, Controlled Unclassified Information (CUI) available at https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/520048p.PDF. Information shall also be marked with appropriate Distribution Statements and Export Control warnings IAW National Industrial Security Program Operating Manual (NISPOM), SECNAV M-5510.36 – Information Security Program, and program Security Classification Guidance. Any product containing Covered Defense Information shall be assigned a distribution statement (distribution statements B through F) using the criteria set forth in DoDI 5230.24 (Distribution Statements on Technical Documents); and have this statement displayed per DoDI 5230.24, Enclosure 3.

3.2.4.2 PUBLIC RELEASE

No information pertaining to this contract shall be released for public dissemination, including posting to any social media sites such as Facebook or Twitter, unless it has been approved for public release by the appropriate U.S. Government authority. Proposed public releases shall be submitted to the COR for initial approval and awareness. Upon initial approval, the Contractor shall submit proposed public releases for approval prior to release through the NAWCAD Procuring Contracting Officer, and through;

Public Affairs Office

NAVAIR

navairpao@us.navy.mil 301-757-1487

3.2.4.3 LOSS, COMPROMISE, OR SPILLAGE

Loss, Compromise and/or Electronic Spillage of Classified or Controlled Unclassified Information: The COR, TPOC, and Government Security Office, concerning instances of possible loss, compromise, and electronic spillage of classified or controlled unclassified information shall be notified immediately upon discovery and/or no later than 24 hours of discovery.

3.2.4.4 COMPLIANCE TO NIST 800-171:

a. The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b. Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

4) Audit user privileges on at least an annual basis;

5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a

POAM for implementation which shall be evaluated by the Navy for risk acceptance.

7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program

3.2.5 OPERATIONAL SECURITY (OPSEC)

The Contractor shall comply with activity OPSEC program instructions, guidance and contribute to organization-level OPSEC efforts. The Contractor will include OPSEC as part of its ongoing security awareness program and take all required activity OPSEC training. The Contractor will protect identified critical information, sensitive unclassified information and activities, which, if divulged, could further compromise classified or sensitive information or operations, or degrade the planning and execution of operations performed by the RO and Contractor in support of the mission.

While performing aboard NAVAIR or NAVAIR sites, the Contractor shall: (1) comply with facility OPSEC program instructions and contribute to organization-level OPSEC efforts; (2) include OPSEC as part of its ongoing security awareness program and take all required Agency training; (3) be responsive to the Supporting OPSEC Manager on a non-interference basis; and (4) protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of operations performed by the Requiring Office and Contractor in support of the mission.

As required at the order level for performance at the Contractor site, the Contractor shall develop, implement, and maintain an OPSEC plan (CDRL A003) to protect classified and sensitive information to be used at a Contractor's and subcontractor's facilities during the performance of this contract. The Contractor is responsible for subcontractor implementation of the OPSEC program requirements for this contract.

3.2.6 ANTI-TERRORISM FORCE PROTECTION AND EMERGENCY MANAGEMENT

The work performed on this contract is not Emergency Essential. Contractor personnel shall comply with all Government Emergency Management, Antiterrorism and/or Continuity of Operations Plans and directives. Contractor personnel shall not report for work at Government facilities in any event or emergency where Government official’s direct curtailment of operations to “Restricted Access” or “Mission Essential Only”. All Contractor personnel assigned to a Government facility shall complete annual Antiterrorism (Level One) and Active Shooter training.

3.2.7 COMMUNICATIONS SECURITY (COMSEC)

The Contractor shall be required to access COMSEC material. The Contractor shall follow the guidance for handling COMSEC material as identified in EKMS-1B – Electronic Key Management System (EKMS) Policy and Procedures for Navy EKMS Tiers 2 & 3, 06 Feb 2015.

3.2.8 CYBER INCIDENT RESPONSE:

The Contractor shall, within fifteen (15) days of discovering the cyber incident on a Contractor owned and operated IT environment (inclusive of the 72-hour reporting period, reference https://dibnet.dod.mil/portal/intranet/), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3). Reference https://www.dc3.mil/Organizations/DIB-Cybersecurity/DIB- Cybersecurity-DCISE/

In delivery of the incident data, the Contractor shall, to the extent practical, remove Contractor-owned information from Government covered defense information.

If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

3.2.9 NAVAL CRIMINAL INVESTIGATIVE SERVICE (NCIS)/INDUSTRY

MONITORING:

In the event of a cyber-incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with NCIS and associated law enforcement agencies, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, Subcontractor, or vendor logs that show network activity, including any additional logs the Contractor, Subcontractor, or vendor agrees to initiate as a result of the cyber incident or notice of actual, or potential, vulnerability.

If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor shall cooperate with the NCIS to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets.

The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.

3.3 Detailed Requirements

The Contractor shall provide Engineering, Technical, Scientific, and Programmatic Support Services as defined at the individual Task Order Level.

3.4 CONTRACT DELIVERABLE REQUIREMENTS LIST

CDRL form DD1423 will be provided at the individual Task Order level. Additional CDRLS may be defined at the individual Task Order level. To enable electronic data harvesting and cross-checking, personnel names and labor categories shall be EXACTLY the same across all CDRLs that use them and be consistent with the descriptions in basic contract Section 3.5 or as established at the TO level.

3.5 Minimum Personnel Qualifications

The Contractor shall be responsible for employing personnel having at least the minimum level of education and training, and experience (including specialized experience) as stated under each labor category specified herein. Additional specialized categories that are derivative of the requirements defined by the SOW may be defined at the individual TO level.

3.5.1 College Degree

When a labor category requires a specific degree for a particular program, only degrees from an accredited college or university as recognized by the U.S. Department of Education will be considered as meeting this requirement. (https://www.ed.gov/accreditation). This includes Associates, Bachelor’s, Master’s, or Doctorate degrees. Accreditation is not required when using degrees to substitute for years of experience.

3.5.2 Disciplines:

3.5.2.1 Business or Business Discipline. When used in relation to educational or work experience requirements, “business discipline” shall mean any of the following specific subjects, disciplines, or areas of work experience only: Business Administration, Business Management, Project Management, Economics, Finance, Accounting, Data Analytics / Management, or related derivative degrees.

3.5.2.2 Engineering or Engineering Discipline. When used in relation to educational or work experience requirements, "engineering discipline” shall mean any of the following specific subjects, disciplines, or areas of work experience only: Aerospace, Computer, Electrical, Electronic, Mechanical, Software, Network, Cyber Security, Systems Engineering, or related derivative Engineering degrees.

3.5.2.3 Scientific Disciplines. When used in relation to educational or work experience requirements, “scientific discipline” shall mean a degree in the fields of Computer Science, Engineering, Information Technology, Mathematics, Data Science, Physics or related derivative degrees.

3.5.2.4 Technical Disciplines. When used in relation to educational or work experience requirements, “technical discipline” shall mean a degree in the fields of Engineering Technology, Cyber Security, Computer Science, Engineering, Mathematics, Operations Research or related derivative degrees

3.5.3 Years of experience

Years of experience shall mean full, productive years of participation. Productive years mean fifty-two (52) weeks of work reduced by reasonable amounts of time for holidays, annual, and sick leave. If participation was part-time, or if less than one-half of the standard workweek was spent performing qualifying functions, the actual time spent performing qualifying functions may be accumulated to arrive at equivalent full years of experience.

3.5.4 Cyber Security Work Force Qualification

At the individual order level, specific positions may be designated as part of the Navy’s Cybersecurity Workforce (CSWF). All labor categories with identified CSWF qualification requirements must be qualified by Education OR Training OR Certification, at the indicated level in at least one relevant Cybersecurity specialty area as defined by each category. The “On The Job Training” (OJT) element as defined by the COOL site is waived for qualification. Post initial qualification, Continuous Learning IAW with the subject specialty area is required. Key Personnel must be qualified at time of proposal. At the TO level, positions requiring systems “privileged Access” must be qualified prior to performance start.

Non-Key Personnel shall be qualified as follows:

• ENTRY / BASIC: no later than 180 days after performance start

• INTERMEDIATE: no later than 60 days from performance start

• ADVANCED: no later than 30 days from performance start

Positions requiring systems “Privileged Access” must be qualified prior to performance start.

Requirement for privileged access includes: One of the following IA certifications: CCNA Security, CySA+ **, GICSP, GSEC, Security+ CE, SSCP in addition to the OS/CE Certification/Qualification(s) Achieved as defined in the TO.

In the course of execution, other CSWF specialty areas may be proposed and substituted, upon written request and…