Solicitation_N6600126R0002_3-19-2026 Final.pdf

SECTION

15A. NAME AND

ADDRESS

OF OFFEROR

SOLICITATION, OFFER, AND AWARD 1. This Contract is a Rated Order under the Defense Priorities and Allocations System (DPAS) - Code of Federal Regulations - at 15 CFR 700.

RATING PAGE OF PAGES

2. CONTRACT NUMBER 3. SOLICITATION NUMBER 4. TYPE OF SOLICITATION 5. DATE ISSUED 6. REQUISITION/PURCHASE NUMBER

CODE7. ISSUED BY 8. ADDRESS OFFER TO (If other than item 7)

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

SOLICITATION

9. Sealed offers in original and copies for furnishings the supplies or services in the Schedule will be received at the place specified in item 8, or if hand carried, in the depository located in until local time

CAUTION - LATE Submissions, Modifications, and Withdrawals: See Section L, Provision Number 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR

INFORMATION

CALL:

A. NAME B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER EXTENSION

C. EMAIL ADDRESS

11. TABLE OF CONTENTS

(X) DESCRIPTION PAGE(S) (X) SECTION PAGE(S)DESCRIPTION

A B C D E F G H

I

J

K

L

M EVALUATION FACTORS FOR AWARD

INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

REPRESENTATIONS, CERTIFICATIONS AND OTHER

STATEMENTS OF OFFERORS

PART IV - REPRESENTATIONS AND INSTRUCTIONS

LIST OF ATTACHMENTS

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

CONTRACT CLAUSESSOLICITATION/CONTRACT FORM

SUPPLIES OR SERVICES AND PRICES/COSTS

DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

PACKAGING AND MARKING

INSPECTION AND ACCEPTANCE

DELIVERIES OR PERFORMANCE

CONTRACT ADMINISTRATION DATA

SPECIAL CONTRACT REQUIREMENTS

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

OFFER (Must be fully completed by offeror)

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause Number 52.232-8)

14. ACKNOWLEDGMENT OF AMENDMENTS

(The offeror acknowledges receipt of amendments to the SOLICITATION for offerors and related documents numbered and dated):

10 CALENDAR DAYS (%) 20 CALENDAR DAYS (%) 30 CALENDAR DAYS (%) CALENDAR DAYS (%)

DATEAMENDMENT NUMBERAMENDMENT NUMBER DATE

CODE FACILITY 16. NAME AND THE TITLE OF PERSON AUTHORIZED TO SIGN OFFER

(Type or print)

15B. TELEPHONE NUMBER

AREA CODE NUMBER EXTENSION

15C. CHECK IF REMITTANCE ADDRESS IS

DIFFERENT FROM ABOVE - ENTER

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE 18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT 21. ACCOUNTING AND APPROPRIATION

22. AUTHORITY FOR USING OTHER THAN FULL OPEN COMPETITION UNDER THE

UNITED STATES CODE AT:

10 U.S.C. 3204(a) ( )41 U.S.C. 3304(a)

24. ADMINISTERED BY (If other than Item 7)

26. NAME OF CONTRACTING OFFICER (Type or print)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition is unusable

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

25. PAYMENT WILL BE MADE BY

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

CODE

ITEM

STANDARD FORM 33 (REV. 12/2022)

Prescribed by GSA - FAR (48 CFR) 53.214 (c)

SEALED BID (IFB) INVITATION FOR BID

NEGOTIATED (RFP) REQUEST FOR

PROPOSAL

(Hour) (Date)

PART I - THE SCHEDULE PART II - CONTRACT CLAUSES

Section A - Solicitation/Contract Form

Cyberspace Science, Research, Engineering and Technology Integration Small Business Multiple Award Contract (MAC)

N6600126R0002

Section B - Supplies or Services & Prices or Costs

Additional Information/Notes

CONTRACT CEILING

The Overall/Combined ceiling for all awardees is $50,000,000.00. The Base Period ceiling for all awardees is $34,317,000.00. The Option Period ceiling for all awardees is $15,683,000.00.

Labor costs will be on a CPFF basis and Other Direct Costs (e.g., travel, materials, equipment) will be on a Cost (no fee) basis. During the Base Period, it is estimated that approximately $2,800,000.00 of the Overall/Combined ceiling will be allotted towards ODCs for travel, materials, and equipment. During the Option Period, it is estimated that approximately $1,300,000.00 of the Overall/Combined ceiling will be allotted towards ODCs for travel, materials, and equipment. However, these amounts are not guaranteed. The costs will be separated accordingly by line item at the task order level.

During the life of this contract, the total maximum dollar amount available for placement under task orders is cumulative with each option exercise, and unexpended balances may be used in succeeding option years.

Item Supplies/Service Estimated Quantity

Unit Unit Price Amount

Base Period (5 Years). Engineering Services. Provide services in accordance with the Statement of Work, Section C, as specified in individual task orders.

Pricing Arrangement: Cost Plus Fixed Fee

1 Lot

Base Period (5 Years). Other Direct Costs (ODC). ODCs including but not limited to travel, materials, and equipment in support of CLIN 0001.

Pricing Arrangement: Cost No Fee

1 Lot

0003 Base Period (5 Years). Data.

Pricing Arrangement: Cost No Fee

1 Lot

Option Line Item

Option Period (2 Years). Engineering Services. Provide services in accordance with the Statement of Work, Section C, as specified in individual task orders.

Pricing Arrangement: Cost Plus Fixed Fee

1 Lot

Option Line Item

Option Period (2 Years). Other Direct Costs (ODC). ODCs including but not limited to travel, materials, and equipment in support of CLIN 1001.

Pricing Arrangement: Cost No Fee

1 Lot

Option Line Item

Option Period (2 Years). Data.

Pricing Arrangement: Cost No Fee

1 Lot

Additional Regulation or Supplemental Clauses Incorporated by Full Text

B-216-PAC002 Contract Minimum-Maximum Supplies and Services (Feb 2025)

As referred to in paragraph (b) of the FAR 52.216-22 "Indefinite Quantity" of this contract, the contract minimum quantity is a total of $25,000.00 split equally among the multiple award contract (MAC) awardees. The maximum quantity is the total estimated value of the contract. The maximum quantity is not to be exceeded without prior approval of the Procuring Contracting Officer.

B-216-PAC003 Allotment of Funds (Feb 2025)

**To be used in incrementally funded task orders.**

(a) This contract is incrementally funded with respect to both cost and fee.

(b) The amounts presently available and allotted to this contract for the payment of fee, in accordance with FAR 52.216-8 "Fixed Fee," are as follows:

[under "Items" insert the contract line item number that are incrementally funded and under "Allotted to Fixed Fee" insert the amount of incremental funding allocated to fixed fee]

ITEM(S) ALLOTTED TO FIXED FEE

(c) The amounts presently available and allotted to this contract for payment of cost, in accordance with FAR 52.232-22 "Limitation of Funds," the items covered thereby and the period of performance which it is estimated the allotted amount will cover are as follows:

[under "Items" insert the contract line item numbers that are incrementally funded, under "Allotment of Cost" insert the amount of incremental funding allocated to the total estimated cost, and under "Period of Performance" insert the date that the funding is expected to cover]

ITEM(S) ALLOTTED TO COST PERIOD OF PERFORMANCE

(d) The parties contemplate that the Government will allot additional amounts to this contract from time to time by unilateral contract modification, and any such modification shall state separately the amounts allotted for cost and for fee, the items covered thereby, and the period of performance the amounts are expected to cover.

B-216-PAC005 Payment of Fixed Fee (Completion Type) (Feb 2025)

^To be used in Completion Task Orders^

FIXED FEE: *. The Government shall make payment to the contractor when requested as work progresses, but no more frequently than biweekly, on account of the fixed fee, equal to ** percent of the amounts invoiced by the contractor under the "Allowable Cost and Payment" clause hereof for the related period, subject to the withholding provisions of paragraph (b) of the "Fixed Fee" clause. In the event of discontinuance of the work in accordance with the clause of this contract entitled "Limitation of ***," the fixed fee shall be re-determined by mutual agreement equitably to reflect the diminution of the work performed; the amount by which such fixed fee is less than, or exceeds payments previously made on account of fee, shall be paid, or repaid by, the contractor, as the case may be.

*To be determined at the task order level.

**The Fixed Fee rate for orders issued under this contract is capped at 8.0%. Notwithstanding this amount, an offeror may propose a more competitive fixed fee amount.

*** "Cost" or "Funds", as determined at the task order level.

B-216-PAC001 Level of Effort--Fee Adjustment Formula (Feb 2025)

**The Fixed Fee rate for task orders issued under this contract is capped at 8.0%. Notwithstanding this amount, an offeror may propose a more competitive fixed fee amount.**

**To be used in Term (Level-of-effort) Task orders.**

(a) Subject to the provisions of the "Limitation of Cost" or "Limitation of Funds" clause (whichever is applicable to this contract), it is hereby understood and agreed that the fixed fee is based upon the contractor providing the below listed number of staff-hours of direct labor, hereinafter referred to as X, at the estimated cost and during the term of this contract specified elsewhere herein:

[insert number of estimated direct labor staff hours]

CLIN Total Staff-hours of Direct Labor (X)

The contractor agrees to provide the total level of effort specified above in performance of work described in Sections "B" and "C" of this contract. The total staff-hours of direct labor shall include subcontractor direct labor hours for those subcontractors identified in the contractor's proposal as having hours included in the proposed level of effort.

(b) Of the total staff-hours of direct labor set forth above, it is estimated that [insert number of estimated direct staff hours identified as competitive (uncompensated overtime) hours] staff-hours are competitive time (uncompensated overtime). Competitive time (uncompensated overtime) is defined as hours provided by personnel in excess of 40 hours per week without additional compensation for such excess work. All other effort is defined as compensated effort. If no amount is indicated in the first sentence of this paragraph, competitive time (uncompensated overtime) effort performed by the contractor shall not be counted in fulfillment of the level of effort obligations under this contract.

(c) Effort performed in fulfilling the total level of effort obligations specified above shall only include effort performed in direct support of this contract and shall not include time and effort expended on such things as local travel from an employee's residence to their usual work location, uncompensated effort while on travel status, truncated lunch periods, or other time and effort which does not have a specific and direct contribution to the tasks described in Section B.

(d) It is understood and agreed that various conditions may exist prior to or upon expiration of the term of the contract, with regard to the expenditure of labor staff-hours and/or costs thereunder which may require adjustment to the aggregate fixed fee. The following actions shall be dictated by the existence of said conditions:

(1) If the contractor has provided not more than [insert percentage (usually 105%)]% of X or not less than [insert percentage (usually 95%)]% of X, within the estimated cost, and at the term of the contract, then the fee shall remain as set forth in Section B.

(2) If the contractor has provided X-staff-hours, within the term, and has not exceeded the estimated cost then the Contracting Officer may require the contractor to continue performance until the expiration of the term, or until the expenditure of the estimated cost of the contract except that, in the case of any items or tasks funded with O&MN funds, except the "term" of performance shall not exceed a 12 month period.

In no event shall the contractor be required to provide more than [insert percentage (same as first percentage in subparagraph (d)(1)]% of X within the term and estimated cost of this contract. The fee shall remain as set forth in Section B.

(3) If the contractor expends the estimated cost of the contract, during the term of the contract and has provided less than X staff-hours, the Government may require the contractor to continue performance, by providing cost growth funding, without adjusting the fixed fee, until such time as the contractor has provided X staff-hours.

(4) If the Contracting Officer does not elect to exercise the Government's rights as set forth in paragraph (d)(2) and (d)(3) above, and the contractor has not expended more than [insert percentage (same as second percentage in subparagraph (d)(1)]% of X staff-hours, the fixed fee shall be equitably adjusted downward to reflect the diminution of work.

(5) Nothing herein contained shall, in any way, abrogate the contractor's responsibilities, and/or the Government's rights within the terms of the contract provision entitled "Limitation of Cost" or "Limitation of Funds" as they shall apply throughout the term of the contract, based upon the total amount of funding allotted to the contract during its specified term.

(e) Within 45 days after completion of the work under each separately identified period of performance hereunder, the contractor shall submit the following information in writing to the Contracting Officer with copies to the cognizant Contract Administration Office and DCAA office to which vouchers are submitted:

(1) The total number of staff-hours of direct labor expended during the applicable period.

(2) A breakdown of this total showing the number of staff-hours expended in each direct labor classification and associated direct and indirect costs.

(3) A breakdown of other costs incurred.

(4) The contractor's estimate of the total allowable cost incurred under the contract for the period.

In the case of a cost under-run, the contractor shall submit the following information in addition to that required above:

(5) The amount by which the estimated cost of this contract may be reduced to recover excess funds and the total amount of staff-hours not expended, if any.

(6) A calculation of the appropriate fee reduction in accordance with this text.

All submissions required by this paragraph shall include subcontractor information, if any.

(f) SPECIAL INSTRUCTION TO THE PAYING OFFICE REGARDING WITHHELD FEE

Fees withheld pursuant to the provisions of this contract, such as the withholding provided by the "Allowable Cost and Payment" and "Fixed Fee" clauses, shall not be paid until the contract has been modified to reduce the fixed fee in accordance with paragraph (d) above, except that no such action is required if the total level of effort provided falls within the limits established in paragraph (d) above.

B-231-PAC001 Reimbursement of Travel Costs (Feb 2025)

(a) Contractor Request and Government Approval of Travel

Any travel under this contract must be specifically requested in writing, by the contractor prior to incurring any travel costs. If this contract is an indefinite-delivery contract, then the written Government authorization will be by task/delivery orders issued by the Ordering Officer or by a modification to an issued task/delivery order. If this contract i an indefinite-delivery contract, then the written Government authorization will be by written notice of approval from the Contracting Officer's Representative (COR). The request shall, at a minimum, include:

(1) Contract number

(2) Date, time, and place of proposed travel

(3) Purpose of travel and how it relates to the contract

(4) Contractor's estimated cost of travel

(5) Name(s) of individual(s) traveling and;

(6) A breakdown of estimated travel and per diem charges.

(b) General

(1) The costs for travel, subsistence, and lodging shall be reimbursed to the contractor only to the extent that it is necessary and authorized for performance of the work under this contract. The costs for travel, subsistence, and lodging shall be reimbursed to the contractor in accordance with the Federal Acquisition Regulation (FAR) 31.205-46, which is incorporated by reference into this contract. As specified in FAR 31.205-46(a) (2), reimbursement for the costs incurred for lodging, meals and incidental expenses (as defined in the travel regulations cited subparagraphs (b)(1)(i) through (b)(1)(iii) below) shall be considered to be reasonable and allowable only to the extent that they do not exceed on a daily basis the maximum per diem rates in effect at the time of travel as set forth in the following:

(i) Federal Travel Regulation prescribed by the General Services Administration for travel in the contiguous 48 United States;

(ii) Joint Travel Regulation, Volume 2, DoD Civilian Personnel, Appendix A, prescribed by the Department of Defense for travel in Alaska, Hawaii, The Commonwealth of Puerto Rico, and the territories and possessions of the United States; or

(iii) Standardized Regulations, (Government Civilians, Foreign Areas), Section 925, "Maximum Travel Per Diem Allowances in Foreign Areas" prescribed by the Department of State, for travel in areas not covered in the travel regulations cited in subparagraphs (b)(1)(i) and (b)(1)(ii) above.

(2) Personnel in travel status from and to the contractor's place of business and designated work site or vice versa, shall be considered to be performing work under the contract, and contractor shall bill such travel time at the straight (regular) time rate;

however, such billing shall not exceed eight hours per person for any one person while in travel status during one calendar day.

(c) Per Diem

(1) The contractor shall not be paid per diem for contractor personnel who reside in the metropolitan area in which the tasks are being performed. Per diem shall not be paid on services performed at contractor's home facility and at any facility required by the contract, or at any location within a radius of 50 miles from the contractor's home facility and any facility required by this contract.

(2) Costs for subsistence and lodging shall be paid to the contractor only to the extent that overnight stay is necessary and authorized in writing by the Government for performance of the work under this contract per paragraph (a). When authorized, per diem shall be paid by the contractor to its employees at a rate not to exceed the rate specified in the travel regulations cited in FAR

31.205-46(a)(2) and authorized in writing by the Government. The authorized per diem rate shall be the same as the prevailing locality per diem rate.

(3) Reimbursement to the contractor for per diem shall be limited to payments to employees not to exceed the authorized per diem and as authorized in writing by the Government per paragraph (a). Fractional parts of a day shall be payable on a prorated basis for purposes of billing for per diem charges attributed to subsistence on days of travel. The departure day from the Permanent Duty Station (PDS) and return day to the PDS shall be 75% of the applicable per diem rate. The contractor shall retain supporting documentation for per diem paid to employees as evidence of actual payments.

(d) Transportation

(1) The contractor shall be paid on the basis of actual amounts paid to the extent that such transportation is necessary for the performance of work under the contract and is authorized in writing by the Government per paragraph (a).

(2) The contractor agrees, in the performance of necessary travel, to use the lowest cost mode commensurate with the requirements of the mission and in accordance with good traffic management principles. When it is necessary to use air or rail travel, the contractor agrees to use coach, tourist class or similar accommodations to the extent consistent with the successful and economical accomplishment of the mission for which the travel is being performed. Documentation must be provided to substantiate non-availability of coach or tourist if business or first class is proposed to accomplish travel requirements.

(3) When transportation by privately owned conveyance (POC) is authorized, the contractor shall be paid on a mileage basis not to exceed the applicable Government transportation rate specified in the travel regulations cited in FAR 31.205-46(a)(2) and is authorized in writing by the Government per paragraph (a).

(4) When transportation by privately owned (motor) vehicle (POV) is authorized, required travel of contractor personnel, that is not commuting travel, may be paid to the extent that it exceeds the normal commuting mileage of such employee. When an employee's POV is used for travel between an employee's residence or the Permanent Duty Station and one or more alternate work sites within the local area, the employee shall be paid mileage for the distance that exceeds the employee's commuting distance.

(5) When transportation by a rental automobile, other special conveyance or public conveyance is authorized, the contractor shall be paid the rental and/or hiring charge and operating expenses incurred on official business (if not included in the rental or hiring charge). When the operating expenses are included in the rental or hiring charge, there should be a record of those expenses available to submit with the receipt. Examples of such operating expenses include hiring charge (bus, streetcar or subway fares), gasoline and oil, parking, and tunnel tolls.

(6) Definitions:

(i) "Permanent Duty Station" (PDS) is the location of the employee's permanent work assignment (i.e., the building or other place where the employee regularly reports for work.

(ii) "Privately Owned Conveyance" (POC) is any transportation mode used for the movement of persons from place to place, other than a Government conveyance or common carrier, including a conveyance loaned for a charge to, or rented at personal expense by, an employee for transportation while on travel when such rental conveyance has not been authorized/approved as a Special Conveyance.

(iii) "Privately Owned (Motor) Vehicle (POV)" is any motor vehicle (including an automobile, light truck, van or pickup truck) owned by, or on a long-term lease (12 or more months) to, an employee or that employee's dependent for the primary purpose of providing personal transportation, that:

(a) is self-propelled and licensed to travel on the public highways;

(b) is designed to carry passengers or goods; and

(c) has four or more wheels or is a motorcycle or moped.

(iv) "Special Conveyance" is commercially rented or hired vehicles other than a POC and other than those owned or under contract to an agency.

(v) "Public Conveyance" is local public transportation (e.g., bus, streetcar, subway, etc.) or taxicab.

(iv) "Residence" is the fixed or permanent domicile of a person that can be reasonably justified as a bona fide residence.

EXAMPLE 1: Employee's one way commuting distance to regular place of work is 7 miles. Employee drives from residence to an alternate work site, a distance of 18 miles. Upon completion of work, employee returns to residence, a distance of 18 miles.

In this case, the employee is entitled to be reimbursed for the distance that exceeds the normal round trip commuting distance (14 miles). The employee is reimbursed for 22 miles (18 + 18 - 14 = 22).

EXAMPLE 2: Employee's one way commuting distance to regular place of work is 15 miles. Employee drives from residence to an alternate work site, a distance of 5 miles. Upon completion of work, employee returns to residence, a distance of 5 miles.

In this case, the employee is not entitled to be reimbursed for the travel performed (10 miles), since the distance traveled is less than the commuting distance (30 miles) to the regular place of work.

EXAMPLE 3: Employee's one way commuting distance to regular place of work is 15 miles. Employee drives to regular place of work. Employee is required to travel to an alternate work site, a distance of 30 miles. Upon completion of work, employee returns to residence, a distance of 15 miles.

In this case, the employee is entitled to be reimbursed for the distance that exceeds the normal round trip commuting distance (30 miles). The employee is reimbursed for 30 miles (15 + 30 + 15 - 30 = 30).

EXAMPLE 4: Employee's one way commuting distance to regular place of work is 12 miles. In the morning, the employee drives to an alternate work site (45 miles). In the afternoon, the employee returns to the regular place of work (67 miles). After completion of work, employee returns to residence, a distance of 12 miles.

In this case, the employee is entitled to be reimbursed for the distance that exceeds the normal round trip commuting distance (24 miles). The employee is reimbursed for 100 miles (45 + 67 + 12 - 24 = 100).

EXAMPLE 5: Employee's one way commuting distance to regular place of work is 35 miles. Employee drives to the regular place of work (35 miles). Later, the employee drives to alternate work site #1 (50 miles) and then to alternate work site #2 (25 miles).

Employee then drives to residence (10 miles).

In this case, the employee is entitled to be reimbursed for the distance that exceeds the normal commuting distance (70 miles). The employee is reimbursed for 50 miles (35 + 50 + 25 + 10 - 70 = 50).

EXAMPLE 6: Employee's one way commuting distance to regular place of work is 20 miles. Employee drives to the regular place of work (20 miles). Later, the employee drives to alternate work site #1 (10 miles) and then to alternate work site #2 (5 miles). Employee then drives to residence (2 miles).

In this case, the employee is not entitled to be reimbursed for the travel performed (37 miles), since the distance traveled is less than the commuting distance (40 miles) to the regular place of work.

B-240-PAC001 Counterfeit or Grey Market Information Technology Products (Feb 2025)

^To be used in task orders with incidental Information Technology products to be procured for incorporation into the Government System.^

The statement below applies to CLIN(s) *TBD at order level when applicable*.

The contractor certifies that the product(s) being delivered are new and in their original packaging. The subject product(s) are eligible for all manufacturer warranties and other ancillary services or options provided by the original manufacturers, authorized suppliers, or suppliers that obtain parts from the manufacturer or its authorized supplier.

The contractor further certifies that it is authorized by the manufacturer to sell the product(s) and that it has provided documentation identifying its supply chain for the product(s) as required in the solicitation provisions. The contractor certifies that it accurately identified the country of manufacture in its proposal/quote and that the information provided remains the same.

The contractor assumes responsibility for authenticity. Costs of counterfeit parts are unallowable unless the conditions set forth in DFARS 231.205-71(b) are met.

By entering into this contract, the contractor acknowledges that a full or partial termination for default/cause for non-compliant awarded items may occur if any of the products provided are not recognized or acknowledged by the manufacturer as new products eligible for warranties and all other ancillary services or options provided by the manufacturer, or the offeror was not authorized by the manufacturer to sell the product in the U.S.

Section C - Description/Specifications/Statement of Work

Requirements Cyberspace Science, Research, Engineering and Technology Integration Small Business Multiple Award Contract (MAC).

Perform work in accordance with Attachment 1 - Statement of Work.

Additional Regulation or Supplemental Clauses Incorporated by Full Text

C-204-PAC004 Electronic Cost Reporting and Financial Tracking (eCRAFT) (Feb 2025)

The contractor shall submit the eCRAFT Report in accordance with the DD Form 1423.

C-204-PAC005 Contract Data Requirements List (CDRL) Tool (Feb 2025)

All non-classified CDRL deliverable documents/copies shall be submitted electronically via an upload by the contractor into the Acquisition Management System (AMS) CDRL Tool:

https://ams.navair.navy.mil/CDRL/Pages/Default.aspx

AMS CDRL Tool resources and training are located at:

https://ams.navair.navy.mil/home

Both contractor CAC or "Soft-Cert" Access and the "Contractor" Role within the AMS CDRL Tool are required. The contractor shall be responsible for delivering all data.

C-204-PAC002 Safeguarding Covered Defense Information and Cyber Incident Reporting (Feb 2025)

1. System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews

a) Within thirty (30) days of contract award, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the contractor's facility. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government's review of the SSPs at the Contractor's facility.

b) If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the

Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

c) Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor's facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

d) The Government may, in its sole discretion, conduct subsequent reviews at the Contractor's site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days' notice to the Contractor.

2. Compliance to NIST 800-171

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-

171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

N6600126R0002 https://ams.navair.navy.mil/CDRL/Pages/Default.aspx https://ams.navair.navy.mil/home

(1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

(4) Audit user privileges on at least an annual basis;

(5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple

DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

(6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

(7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government

Program Manager for risk to the program.

3. Cyber Incident Response:

a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

b) Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.

mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

c) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

4. Naval Criminal Investigative Service (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies.

5. NCIS/Industry Monitoring

a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval

Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.

C-204-PAC001 Cybersecurity (Feb 2025)

N6600126R0002 https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program

Cybersecurity (which replaced the term Information Assurance (IA)) is defined as prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation. Contractor personnel shall perform tasks to ensure Navy applications, systems, and networks satisfy Federal/DoD /DON/Navy cybersecurity requirements.

Cyber IT and Cybersecurity Personnel

(a) The Cyberspace workforce elements addressed include contractors performing functions in designated Cyber IT positions and Cybersecurity positions. In accordance with DFARS Subpart 239.71, DoDD 8140.01, SECNAVINST 5239.20A, and SECNAV M- 5239.2, contractor personnel performing cybersecurity functions shall meet all cybersecurity training, certification, and tracking requirements as cited in DoD 8570.01-M prior to accessing DoD information systems. Proposed contractor Cyber IT and cybersecurity personnel shall be appropriately qualified prior to the start of the contract performance period or before assignment to the contract during the course of the performance period.

(b) The contractor shall be responsible for identifying, tracking and reporting cybersecurity personnel, also known as Cybersecurity Workforce (CSWF) and Cyber IT workforce personnel. Although the minimum frequency of reporting is monthly, the task order can require additional updates at any time.

(c) Contractors that access Navy IT shall also follow guidelines and provisions documented in Navy Telecommunications Directive (NTD 10-11) and are required to complete a System Authorization Access Request (SAAR) - Navy form as documented in para 8.2.2.4 (b).

When a contractor requires logical access to a government IT system or resource (directly or indirectly), the required CAC will have a Public Key Infrastructure (PKI). A hardware solution and software (e.g., ActiveGold) is required to securely read the card via a personal computer. Pursuant to DoDM 1000.13-M-V1, CAC PKI certificates will be associated with an official government issued e-mail address (e.g., .mil, .gov, .edu). Prior to receipt of a CAC with PKI, contractor personnel shall complete the mandatory Cybersecurity Awareness training and submit a signed System Authorization Access Request Navy (SAAR-N) form to the contract's specified COR. Note: In order for personnel to maintain a CAC with PKI, each contractor employee shall complete annual cybersecurity training. The following guidance for training and form submittal is provided; however, contractors shall seek latest guidance from their appointed company Security Officer and the NIWC Pacific Information Assurance Management (IAM) office:

1. For annual DoD Cybersecurity/IA Awareness training, contractors shall use this site: https://twms.nmci.navy.mil/.

For those contractors requiring initial training and do not have a CAC, contact the NIWC Pacific IAM office. Training can be taken at the IAM office or online at http://iase.disa.mil/index2.html.

2. For SAAR-N form, the contractor shall use OPNAV 5239/14 (Rev 9/2011). Contractors can obtain a form from the NIWC Pacific IAM office or from the website: https://navalforms.documentservices.dla.mil/.

(d) Contractor personnel with privileged access will be required to acknowledge special responsibilities with a Privileged Access Agreement (PAA) IAW SECNAVINST 5239.20A.

Design, Integration, Configuration or Installation of Hardware and Software

The contractor shall ensure any equipment/system installed or integrated into Navy platform will meet the cybersecurity requirements as specified under DoDI 8500.01. The contractor shall ensure that any design change, integration change, configuration change, or installation of hardware and software is in accordance with established DoD/DON/Navy cyber directives and does not violate the terms and conditions of the accreditation/authorization issued by the appropriate Accreditation/Authorization official. Contractors that access Navy IT are also required to follow the provisions contained in DON CIO Memorandum:

Acceptable Use of Department of the Navy Information Technology (IT) dated 12 Feb 16. Use of blacklisted software is specifically prohibited and only software that is registered in DON Application and Database Management System (DADMS) and is Functional Area Manager (FAM) approved can be used as documented in para 5.2.2. Procurement and installation of software governed by DON Enterprise License Agreements (ELAs) - Microsoft, Oracle, Cisco, Axway, Symantec, ActivIdentity, VMware, Red Hat, NetApp, and EMC shall be in accordance with DON CIO Policy and DON ELAs awarded.

Cybersecurity Workforce (CSWF) Report

DoD 8570.01-M and DFARS PGI 239.7102-3 have promulgated that contractor personnel shall have documented current cybersecurity certification status within their contract. The contractor shall develop, maintain, and submit a CSWF Report as applicable at the task order level. IAW DFARS clause 252.239-7001, if cybersecurity support is provided, the contractor shall provide a Cybersecurity Workforce (CSWF) list that identifies those individuals who are IA trained and certified. Utilizing the format provided at the task order level, the prime contractor shall be responsible for collecting, integrating, and reporting all subcontractor personnel.

N6600126R0002 https://twms.nmci.navy.mil/ https://navalforms.documentservices.dla.mil/

See applicable DD Form 1423 for additional reporting details and distribution instructions. Contractor shall verify with the COR or other government representative the proper labor category cybersecurity designation and certification requirements.

Information Technology (IT) Services Requirements

This paragraph only applies to IT contracts. Information Technology (IT) is defined as any equipment or interconnected system(s) or subsystem(s) of equipment that is used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data of information by the agency. IT includes computers, ancillary equipment, peripherals, input, output, and storage devices necessary for security and surveillance. Electronic and Information technology (EIT) is IT that is used in the creation, conversion, or duplication of data or information. EIT includes:

telecommunication products, such as telephones; information kiosks; transaction machines; World Wide Web sites; multimedia (including videotapes); and office equipment, such as copiers and fax machines.

Information Technology (IT) General Requirements

When applicable, the contractor shall be responsible for the following:

Ensure that no production systems are operational on any RDT&E network.

Follow DoDI 8510.01 of 12 Mar 2014 when deploying, integrating, and implementing IT capabilities.

Migrate all Navy Ashore production systems to the NMCI environment where available.

Work with government personnel to ensure compliance with all current Navy IT & cybersecurity policies, including those pertaining to Cyber Asset Reduction and Security (CARS).

Follow SECNAVINST 5239.3B of 17 June 2009 & DoDI 8510.01 of 12 Mar 2014 prior to integration and implementation of IT solutions or systems.

Register any contractor-owned or contractor-maintained IT systems utilized on contract in the Department of Defense IT Portfolio Registry (DITPR)-DON.

Only perform work specified within the limitations of the task order.

Acquisition of Commercial Software Products, hardware, and Related Services

This paragraph only applies to the purchasing/hosting of commercial software. Contractors recommending or purchasing commercial software products, hardware, and related services supporting Navy programs and projects shall ensure they recommend or procure items from approved sources in accordance with the latest DoN and DoD policies.

DON Enterprise Licensing Agreement/DOD Enterprise Software Initiative Program

Pursuant to DoN Memorandum - Mandatory use of DoN Enterprise Licensing Agreement (ELA) dated 22 Feb 12, contractors that are authorized to use Government supply sources per FAR 51.101 shall verify if the product is attainable through DoN ELAs and if so, procure that item in accordance with appropriate ELA procedures. If an item is not attainable through the DoN ELA program, contractors shall then utilize DoD Enterprise Software Initiative (ESI) program (see DFARS 208.74) and government-wide SmartBuy program (see DoD memo dated 22 Dec 05). The contractor shall ensure any items purchased outside these programs have the required approved waivers as applicable to the program. Software requirements will be specified at the task order level.

DON Application and Database Management System

The contractor shall ensure that no Functional Area Manager (FAM) disapproved applications are integrated, installed or operational on Navy networks. The contractor shall ensure that all databases that use database management systems (DBMS) designed, implemented, and/or hosted on servers and/or mainframes supporting Navy applications and systems be registered in DoN Application and Database Management System (DADMS) and are FAM approved. All integrated, installed, or operational applications hosted on Navy networks must also be registered in DADMS and approved by the FAM. No operational systems or applications will be integrated, installed, or operational on the RDT&E network.

Section 508 Compliance

This paragraph only applies to IT contracts. The contractor shall ensure that all software recommended, procured, and/or developed is compliant with Section 508 of the Rehabilitation Act of 1973, 26 CFR Part 1194 and pursuant to SPAWARINST 5721.1B of 17 Nov

2009. In accordance with FAR 39.204, this requirement does not apply to contractor acquired software that is incidental to the task, software procured/developed to support a program or system designated as a National Security System (NSS) or if the product is located in spaces frequented only by service personnel for maintenance, repair or occasional monitoring of equipment.

Software Development/Modernization and Hosting

This paragraph only applies to software development and modernization. The contractor shall ensure all programs utilizing this contract for software development/ modernization (DEV/MOD), including the development of IT tools to automate NIWC Pacific business processes are compliant with DON Information Management/Information Technology (DON IM/IT) Investment Review Process Guidance requirements. Contractors shall neither host nor develop IT tools to automate NIWC Pacific business processes unless specifically tasked within the task order or contract. The contractor shall ensure IT tools developed to automate NIWC Pacific business processes will be delivered with full documentation and source code, as specified at the task order level, to allow non-proprietary operation and maintenance by any source. The contractor shall ensure all programs are submitted with proof of completed DEV/MOD certification approval from the appropriate authority in accordance with DON policy prior to task order award. *Note must be listed on Investment Review Board (IRB) approved list.

Information Security

Pursuant to DoDM 5200.01 and DoD 5200.48, the contractor shall provide adequate security for all CUI and unclassified DoD information passing through non-DoD information systems, including all subcontractor information systems utilized on contract. If the contractor originates, adds, or changes any of the DoD information, it must be marked in accordance with DODI 5200.48 and handled properly. The contractor shall disseminate CUI and unclassified DoD information within the scope of assigned duties and with a clear expectation that confidentiality is preserved. Examples of such information include the following: non-public information provided to the contractor, information developed during the course of the contract, and privileged contract information (e.g., program schedules, contract-related tracking).

IT Level Designations

Pursuant to DoDI 8500.01, DoD 8570.01-M, SECNAVINST 5510.30C, SECNAV M-5239.2, DON CIO Memo, "IT Level Designation on DD Form 2875 System Authorization Access Request" dated 8 Sep 2020, and applicable to unclassified DoD information systems, as a standardized approach, DON organizations are to use the information below to determine the level of access and to determine the minimum background investigation.

Per SECNAVINST 5510.30C, page 7, Section 8.b of enclosure (4), the Information Systems Security Manager is responsible for establishing, implementing and maintaining the DON information system and information assurance program and is responsible to the Commanding Officer for developing, maintaining, and directing the implementation of the IA program within the command. The IT Level Designation are:

T5 or T5R; equivalent (SSBI, etc.) (IT Level I) - For domain/root level administrator accounts.

T3 or T3R; equivalent (ANAC/ANACI) (IT Level II) - For administrator accounts - enhanced User and Core User.

T1; equivalent or higher (Level III) - For regular access accounts.

C-211-PAC002 Key Personnel (Feb 2025)

^May be used at the task order level.^

(a) The offeror agrees to…