Solicitation - N6600126R3608.pdf

SECTION

15A. NAME AND

ADDRESS

OF OFFEROR

SOLICITATION, OFFER, AND AWARD 1. This Contract is a Rated Order under the Defense Priorities and Allocations System (DPAS) - Code of Federal Regulations - at 15 CFR 700.

RATING PAGE OF PAGES

2. CONTRACT NUMBER 3. SOLICITATION NUMBER 4. TYPE OF SOLICITATION 5. DATE ISSUED 6. REQUISITION/PURCHASE NUMBER

CODE7. ISSUED BY 8. ADDRESS OFFER TO (If other than item 7)

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

SOLICITATION

9. Sealed offers in original and copies for furnishings the supplies or services in the Schedule will be received at the place specified in item 8, or if hand carried, in the depository located in until local time

CAUTION - LATE Submissions, Modifications, and Withdrawals: See Section L, Provision Number 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR

INFORMATION

CALL:

A. NAME B. TELEPHONE (NO COLLECT CALLS)

AREA CODE NUMBER EXTENSION

C. EMAIL ADDRESS

11. TABLE OF CONTENTS

(X) DESCRIPTION PAGE(S) (X) SECTION PAGE(S)DESCRIPTION

A B C D E F G H

I

J

K

L

M EVALUATION FACTORS FOR AWARD

INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

REPRESENTATIONS, CERTIFICATIONS AND OTHER

STATEMENTS OF OFFERORS

PART IV - REPRESENTATIONS AND INSTRUCTIONS

LIST OF ATTACHMENTS

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

CONTRACT CLAUSESSOLICITATION/CONTRACT FORM

SUPPLIES OR SERVICES AND PRICES/COSTS

DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

PACKAGING AND MARKING

INSPECTION AND ACCEPTANCE

DELIVERIES OR PERFORMANCE

CONTRACT ADMINISTRATION DATA

SPECIAL CONTRACT REQUIREMENTS

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

OFFER (Must be fully completed by offeror)

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause Number 52.232-8)

14. ACKNOWLEDGMENT OF AMENDMENTS

(The offeror acknowledges receipt of amendments to the SOLICITATION for offerors and related documents numbered and dated):

10 CALENDAR DAYS (%) 20 CALENDAR DAYS (%) 30 CALENDAR DAYS (%) CALENDAR DAYS (%)

DATEAMENDMENT NUMBERAMENDMENT NUMBER DATE

CODE FACILITY 16. NAME AND THE TITLE OF PERSON AUTHORIZED TO SIGN OFFER

(Type or print)

15B. TELEPHONE NUMBER

AREA CODE NUMBER EXTENSION

15C. CHECK IF REMITTANCE ADDRESS IS

DIFFERENT FROM ABOVE - ENTER

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE 18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT 21. ACCOUNTING AND APPROPRIATION

22. AUTHORITY FOR USING OTHER THAN FULL OPEN COMPETITION UNDER THE

UNITED STATES CODE AT:

10 U.S.C. 3204(a) ( )41 U.S.C. 3304(a)

24. ADMINISTERED BY (If other than Item 7)

26. NAME OF CONTRACTING OFFICER (Type or print)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition is unusable

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

25. PAYMENT WILL BE MADE BY

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

CODE

ITEM

STANDARD FORM 33 (REV. 12/2022)

Prescribed by GSA - FAR (48 CFR) 53.214 (c)

SEALED BID (IFB) INVITATION FOR BID

NEGOTIATED (RFP) REQUEST FOR

PROPOSAL

(Hour) (Date)

PART I - THE SCHEDULE PART II - CONTRACT CLAUSES

Section A - Solicitation/Contract Form

Command and Control Experimentation (C2X) and Modernization Software Engineering Services for Future Naval Operations

*This requirement is for SEAPORT CONTRACT HOLDERS ONLY. Please include your Seaport Contract Number in any correspondence with the Government.

N6600126R3608

Section B - Supplies or Services & Prices or Costs

Additional Information/Notes

Item Supplies/Service Quantity Unit Unit Price Amount

0001 Base - Services IAW SOW

Pricing Arrangement: Cost Plus Fixed Fee

1 Lot

Base - ODC

Base - CDRLs

Option Line Item

Option Year One - Services IAW SOW

Pricing Arrangement: Cost Plus Fixed Fee

1 Lot

Option Line Item 1002 Option Year One - ODC

Option Line Item

Option Year One - CDRLs

Option Line Item

Option Year Two - Services IAW SOW

Pricing Arrangement: Cost Plus Fixed Fee

1 Lot

Option Line Item 2002 Option Year Two - ODC

Option Line Item 2003 Option Year Two - CDRLs

Option Line Item

Option Year Three - Services IAW SOW

Pricing Arrangement: Cost Plus Fixed Fee

1 Lot

Option Line Item 3002 Option Year Three - ODC

Option Line Item 3003 Option Year Three - CDRLs

Option Line Item

Option Year Four - Services IAW SOW

Pricing Arrangement: Cost Plus Fixed Fee

1 Lot

Option Line Item 4002 Option Year Four - ODC

Option Line Item 4003 Option Year Four - CDRLs

Additional Regulation or Supplemental Clauses Incorporated by Full Text

B-216-PAC003 Allotment of Funds (Feb 2025)

(a) This contract is incrementally funded with respect to both cost and fee.

(b) The amounts presently available and allotted to this contract for the payment of fee, in accordance with FAR 52.216-8 "Fixed Fee," are as follows:

[under "Items" insert the contract line item number that are incrementally funded and under "Allotted to Fixed Fee" insert the amount of incremental funding allocated to fixed fee]

ITEM(S) ALLOTTED TO FIXED FEE

(c) The amounts presently available and allotted to this contract for payment of cost, in accordance with FAR 52.232-22 "Limitation of Funds," the items covered thereby and the period of performance which it is estimated the allotted amount will cover are as follows:

ITEM(S) ALLOTTED TO COST PERIOD OF PERFORMANCE

(d) The parties contemplate that the Government will allot additional amounts to this contract from time to time by unilateral contract modification, and any such modification shall state separately the amounts allotted for cost and for fee, the items covered thereby, and the period of performance the amounts are expected to cover.

B-216-PAC001 Level of Effort--Fee Adjustment Formula (Feb 2025)

(a) Subject to the provisions of the "Limitation of Cost" or "Limitation of Funds" clause (whichever is applicable to this contract), it is hereby understood and agreed that the fixed fee is based upon the contractor providing the below listed number of staff-hours of direct labor, hereinafter referred to as X, at the estimated cost and during the term of this contract specified elsewhere herein:

CLIN Total Staff-hours of Direct Labor (X)

0001(Base) 18,432

1001 (OY1) 18,432

2001 (OY2) 18,432

3001 (OY3) 18,432

4001 (OY4) 18,432

Total Hours: 92,160

The contractor agrees to provide the total level of effort specified above in performance of work described in Sections "B" and "C" of this contract. The total staff-hours of direct labor shall include subcontractor direct labor hours for those subcontractors identified in the contractor's proposal as having hours included in the proposed level of effort.

(b) Of the total staff-hours of direct labor set forth above, it is estimated that zero staff-hours are competitive time (uncompensated overtime). Competitive time (uncompensated overtime) is defined as hours provided by personnel in excess of 40 hours per week without additional compensation for such excess work. All other effort is defined as compensated effort. If no amount is indicated in the first sentence of this paragraph, competitive time (uncompensated overtime) effort performed by the contractor shall not be counted in fulfillment of the level of effort obligations under this contract.

(c) Effort performed in fulfilling the total level of effort obligations specified above shall only include effort performed in direct support of this contract and shall not include time and effort expended on such things as local travel from an employee's residence to their usual work location, uncompensated effort while on travel status, truncated lunch periods, or other time and effort which does not have a specific and direct contribution to the tasks described in Section B.

(d) It is understood and agreed that various conditions may exist prior to or upon expiration of the term of the contract, with regard to the expenditure of labor staff-hours and/or costs thereunder which may require adjustment to the aggregate fixed fee. The following actions shall be dictated by the existence of said conditions:

(1) If the contractor has provided not more than 105% of X or not less than 95% of X, within the estimated cost, and at the term of the contract, then the fee shall remain as set forth in Section B.

(2) If the contractor has provided X-staff-hours, within the term, and has not exceeded the estimated cost then the Contracting Officer may require the contractor to continue performance until the expiration of the term, or until the expenditure of the estimated cost of the contract except that, in the case of any items or tasks funded with O&MN funds, except the "term" of performance shall not exceed a 12 month period.

In no event shall the contractor be required to provide more than 105% of X within the term and estimated cost of this contract. The fee shall remain as set forth in Section B.

(3) If the contractor expends the estimated cost of the contract, during the term of the contract and has provided less than X staff-hours, the Government may require the contractor to continue performance, by providing cost growth funding, without adjusting the fixed fee, until such time as the contractor has provided X staff-hours.

(4) If the Contracting Officer does not elect to exercise the Government's rights as set forth in paragraph (d)(2) and (d)(3) above, and the contractor has not expended more than

105% of X staff-hours, the fixed fee shall be equitably adjusted downward to reflect the diminution of work.

(5) Nothing herein contained shall, in any way, abrogate the contractor's responsibilities, and/or the Government's rights within the terms of the contract provision entitled

"Limitation of Cost" or "Limitation of Funds" as they shall apply throughout the term of the contract, based upon the total amount of funding allotted to the contract during its specified term.

(e) Within 45 days after completion of the work under each separately identified period of performance hereunder, the contractor shall submit the following information in writing to the Contracting Officer with copies to the cognizant Contract Administration Office and DCAA office to which vouchers are submitted:

(1) The total number of staff-hours of direct labor expended during the applicable period.

(2) A breakdown of this total showing the number of staff-hours expended in each direct labor classification and associated direct and indirect costs.

(3) A breakdown of other costs incurred.

(4) The contractor's estimate of the total allowable cost incurred under the contract for the period.

In the case of a cost under-run, the contractor shall submit the following information in addition to that required above:

(5) The amount by which the estimated cost of this contract may be reduced to recover excess funds and the total amount of staff-hours not expended, if any.

(6) A calculation of the appropriate fee reduction in accordance with this text.

All submissions required by this paragraph shall include subcontractor information, if any.

(f) SPECIAL INSTRUCTION TO THE PAYING OFFICE REGARDING WITHHELD FEE

Fees withheld pursuant to the provisions of this contract, such as the withholding provided by the "Allowable Cost and Payment" and "Fixed Fee" clauses, shall not be paid until the contract has been modified to reduce the fixed fee in accordance with paragraph (d) above, except that no such action is required if the total level of effort provided falls within the limits established in paragraph (d) above.

Section C - Description/Specifications/Statement of Work

SECTION C - Description/Specifications/Statement of Work

Work under this task order shall be performed in accordance with:

Attachment 0001 - Statement of Work (SOW) Attachment 2 - Contract Security Classification Specification (DD 254) 000 Exhibit A - Contract Data Requirements List (CDRL)

Requirements Command and Control Experimentation (C2X) and Modernization Software Engineering Services for Future Naval Operations

Additional Regulation or Supplemental Clauses Incorporated by Full Text

C-204-PAC002 Safeguarding Covered Defense Information and Cyber Incident Reporting (Feb 2025)

1. System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews

a) Within thirty (30) days of contract award, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the contractor's facility. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government's review of the SSPs at the Contractor's facility.

b) If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the

Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

c) Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor's facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

d) The Government may, in its sole discretion, conduct subsequent reviews at the Contractor's site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days' notice to the Contractor.

2. Compliance to NIST 800-171

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-

171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

(1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

(4) Audit user privileges on at least an annual basis;

(5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple

DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

(6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

(7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government

Program Manager for risk to the program.

3. Cyber Incident Response:

a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

b) Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.

mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

c) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

4. Naval Criminal Investigative Service (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies.

5. NCIS/Industry Monitoring

a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval

Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.

C-204-PAC001 Cybersecurity (Feb 2025)

Cybersecurity (which replaced the term Information Assurance (IA)) is defined as prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation. Contractor personnel shall perform tasks to ensure Navy applications, systems, and networks satisfy Federal/DoD /DON/Navy cybersecurity requirements.

Cyber IT and Cybersecurity Personnel

(a) The Cyberspace workforce elements addressed include contractors performing functions in designated Cyber IT positions and Cybersecurity positions. In accordance with DFARS Subpart 239.71, DoDD 8140.01, SECNAVINST 5239.20A, and SECNAV M- 5239.2, contractor personnel performing cybersecurity functions shall meet all cybersecurity training, certification, and tracking

N6600126R3608 https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program requirements as cited in DoD 8570.01-M prior to accessing DoD information systems. Proposed contractor Cyber IT and cybersecurity personnel shall be appropriately qualified prior to the start of the contract performance period or before assignment to the contract during the course of the performance period.

(b) The contractor shall be responsible for identifying, tracking and reporting cybersecurity personnel, also known as Cybersecurity Workforce (CSWF) and Cyber IT workforce personnel. Although the minimum frequency of reporting is monthly, the task order can require additional updates at any time.

(c) Contractors that access Navy IT shall also follow guidelines and provisions documented in Navy Telecommunications Directive (NTD 10-11) and are required to complete a System Authorization Access Request (SAAR) - Navy form as documented in para 8.2.2.4 (b).

When a contractor requires logical access to a government IT system or resource (directly or indirectly), the required CAC will have a Public Key Infrastructure (PKI). A hardware solution and software (e.g., ActiveGold) is required to securely read the card via a personal computer. Pursuant to DoDM 1000.13-M-V1, CAC PKI certificates will be associated with an official government issued e-mail address (e.g., .mil, .gov, .edu). Prior to receipt of a CAC with PKI, contractor personnel shall complete the mandatory Cybersecurity Awareness training and submit a signed System Authorization Access Request Navy (SAAR-N) form to the contract's specified COR. Note: In order for personnel to maintain a CAC with PKI, each contractor employee shall complete annual cybersecurity training. The following guidance for training and form submittal is provided; however, contractors shall seek latest guidance from their appointed company Security Officer and the NIWC Pacific Information Assurance Management (IAM) office:

1. For annual DoD Cybersecurity/IA Awareness training, contractors shall use this site: https://twms.nmci.navy.mil/.

For those contractors requiring initial training and do not have a CAC, contact the NIWC Pacific IAM office. Training can be taken at the IAM office or online at http://iase.disa.mil/index2.html.

2. For SAAR-N form, the contractor shall use OPNAV 5239/14 (Rev 9/2011). Contractors can obtain a form from the NIWC Pacific IAM office or from the website: https://navalforms.documentservices.dla.mil/.

(d) Contractor personnel with privileged access will be required to acknowledge special responsibilities with a Privileged Access Agreement (PAA) IAW SECNAVINST 5239.20A.

Design, Integration, Configuration or Installation of Hardware and Software

The contractor shall ensure any equipment/system installed or integrated into Navy platform will meet the cybersecurity requirements as specified under DoDI 8500.01. The contractor shall ensure that any design change, integration change, configuration change, or installation of hardware and software is in accordance with established DoD/DON/Navy cyber directives and does not violate the terms and conditions of the accreditation/authorization issued by the appropriate Accreditation/Authorization official. Contractors that access Navy IT are also required to follow the provisions contained in DON CIO Memorandum:

Acceptable Use of Department of the Navy Information Technology (IT) dated 12 Feb 16. Use of blacklisted software is specifically prohibited and only software that is registered in DON Application and Database Management System (DADMS) and is Functional Area Manager (FAM) approved can be used as documented in para 5.2.2. Procurement and installation of software governed by DON Enterprise License Agreements (ELAs) - Microsoft, Oracle, Cisco, Axway, Symantec, ActivIdentity, VMware, Red Hat, NetApp, and EMC shall be in accordance with DON CIO Policy and DON ELAs awarded.

Cybersecurity Workforce (CSWF) Report

DoD 8570.01-M and DFARS PGI 239.7102-3 have promulgated that contractor personnel shall have documented current cybersecurity certification status within their contract. The contractor shall develop, maintain, and submit a CSWF Report as applicable at the task order level. IAW DFARS clause 252.239-7001, if cybersecurity support is provided, the contractor shall provide a Cybersecurity Workforce (CSWF) list that identifies those individuals who are IA trained and certified. Utilizing the format provided at the task order level, the prime contractor shall be responsible for collecting, integrating, and reporting all subcontractor personnel.

See applicable DD Form 1423 for additional reporting details and distribution instructions. Contractor shall verify with the COR or other government representative the proper labor category cybersecurity designation and certification requirements.

Information Technology (IT) Services Requirements

This paragraph only applies to IT contracts. Information Technology (IT) is defined as any equipment or interconnected system(s) or subsystem(s) of equipment that is used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data of information by the agency. IT includes computers, ancillary equipment, peripherals, input, output, and storage devices necessary for security and surveillance. Electronic and Information technology (EIT) is IT that is used in the creation, conversion, or duplication of data or information. EIT includes:

N6600126R3608 https://twms.nmci.navy.mil/ https://navalforms.documentservices.dla.mil/ telecommunication products, such as telephones; information kiosks; transaction machines; World Wide Web sites; multimedia (including videotapes); and office equipment, such as copiers and fax machines.

Information Technology (IT) General Requirements

When applicable, the contractor shall be responsible for the following:

Ensure that no production systems are operational on any RDT&E network.

Follow DoDI 8510.01 of 12 Mar 2014 when deploying, integrating, and implementing IT capabilities.

Migrate all Navy Ashore production systems to the NMCI environment where available.

Work with government personnel to ensure compliance with all current Navy IT & cybersecurity policies, including those pertaining to Cyber Asset Reduction and Security (CARS).

Follow SECNAVINST 5239.3B of 17 June 2009 & DoDI 8510.01 of 12 Mar 2014 prior to integration and implementation of IT solutions or systems.

Register any contractor-owned or contractor-maintained IT systems utilized on contract in the Department of Defense IT Portfolio Registry (DITPR)-DON.

Only perform work specified within the limitations of the task order.

Acquisition of Commercial Software Products, hardware, and Related Services

This paragraph only applies to the purchasing/hosting of commercial software. Contractors recommending or purchasing commercial software products, hardware, and related services supporting Navy programs and projects shall ensure they recommend or procure items from approved sources in accordance with the latest DoN and DoD policies.

DON Enterprise Licensing Agreement/DOD Enterprise Software Initiative Program

Pursuant to DoN Memorandum - Mandatory use of DoN Enterprise Licensing Agreement (ELA) dated 22 Feb 12, contractors that are authorized to use Government supply sources per FAR 51.101 shall verify if the product is attainable through DoN ELAs and if so, procure that item in accordance with appropriate ELA procedures. If an item is not attainable through the DoN ELA program, contractors shall then utilize DoD Enterprise Software Initiative (ESI) program (see DFARS 208.74) and government-wide SmartBuy program (see DoD memo dated 22 Dec 05). The contractor shall ensure any items purchased outside these programs have the required approved waivers as applicable to the program. Software requirements will be specified at the task order level.

DON Application and Database Management System

The contractor shall ensure that no Functional Area Manager (FAM) disapproved applications are integrated, installed or operational on Navy networks. The contractor shall ensure that all databases that use database management systems (DBMS) designed, implemented, and/or hosted on servers and/or mainframes supporting Navy applications and systems be registered in DoN Application and Database Management System (DADMS) and are FAM approved. All integrated, installed, or operational applications hosted on Navy networks must also be registered in DADMS and approved by the FAM. No operational systems or applications will be integrated, installed, or operational on the RDT&E network.

Section 508 Compliance

This paragraph only applies to IT contracts. The contractor shall ensure that all software recommended, procured, and/or developed is compliant with Section 508 of the Rehabilitation Act of 1973, 26 CFR Part 1194 and pursuant to SPAWARINST 5721.1B of 17 Nov 2009. In accordance with FAR 39.204, this requirement does not apply to contractor acquired software that is incidental to the task, software procured/developed to support a program or system designated as a National Security System (NSS) or if the product is located in spaces frequented only by service personnel for maintenance, repair or occasional monitoring of equipment.

Software Development/Modernization and Hosting

This paragraph only applies to software development and modernization. The contractor shall ensure all programs utilizing this contract for software development/ modernization (DEV/MOD), including the development of IT tools to automate NIWC Pacific business processes are compliant with DON Information Management/Information Technology (DON IM/IT) Investment Review Process Guidance requirements. Contractors shall neither host nor develop IT tools to automate NIWC Pacific business processes unless specifically tasked within the task order or contract. The contractor shall ensure IT tools developed to automate NIWC Pacific business processes will be delivered with full documentation and source code, as specified at the task order level, to allow non-proprietary operation and maintenance by any source. The contractor shall ensure all programs are submitted with proof of completed DEV/MOD certification approval from the appropriate authority in accordance with DON policy prior to task order award. *Note must be listed on Investment Review Board (IRB) approved list.

Information Security

Pursuant to DoDM 5200.01 and DoD 5200.48, the contractor shall provide adequate security for all CUI and unclassified DoD information passing through non-DoD information systems, including all subcontractor information systems utilized on contract. If the contractor originates, adds, or changes any of the DoD information, it must be marked in accordance with DODI 5200.48 and handled properly. The contractor shall disseminate CUI and unclassified DoD information within the scope of assigned duties and with a clear expectation that confidentiality is preserved. Examples of such information include the following: non-public information provided to the contractor, information developed during the course of the contract, and privileged contract information (e.g., program schedules, contract-related tracking).

IT Level Designations

Pursuant to DoDI 8500.01, DoD 8570.01-M, SECNAVINST 5510.30C, SECNAV M-5239.2, DON CIO Memo, "IT Level Designation on DD Form 2875 System Authorization Access Request" dated 8 Sep 2020, and applicable to unclassified DoD information systems, as a standardized approach, DON organizations are to use the information below to determine the level of access and to determine the minimum background investigation.

Per SECNAVINST 5510.30C, page 7, Section 8.b of enclosure (4), the Information Systems Security Manager is responsible for establishing, implementing and maintaining the DON information system and information assurance program and is responsible to the Commanding Officer for developing, maintaining, and directing the implementation of the IA program within the command. The IT Level Designation are:

T5 or T5R; equivalent (SSBI, etc.) (IT Level I) - For domain/root level administrator accounts.

T3 or T3R; equivalent (ANAC/ANACI) (IT Level II) - For administrator accounts - enhanced User and Core User.

T1; equivalent or higher (Level III) - For regular access accounts.

C-204-PAC003 Personnel Security Program Requirements for Unclassified/Position of Trust (POT) Contractors

(Feb 2025)

The U.S. Government conducts Fitness Determination investigations of personnel who are assigned to positions that directly or indirectly affect the operation of unclassified IT resources and systems that process Department of Defense (DoD) information, to include For Official Use Only (FOUO) and other controlled unclassified information (CUI) in accordance with DODM 5220.22 Volume 2 (National Industrial Security Program: Industrial Security Procedures for Government Activities) and for additional guidance refer to DoDI 5200.48.

The United States Office of Personnel Management (OPM), and Defense Counterintelligence and Security Agency (DCSA) process all requests for U.S. Government Fitness Determination investigations. Requirements for these investigations are outlined in NAVWAR M5510.1A, Chapter 5005.4 and NIWCPACINST 5500.1C, Chapter 9.4.4.

I. Procedures for submitting U.S. Government Fitness Determination Investigations:

A Fitness Determination investigation supports a Public Trust position; it does NOT support a National Security Eligibility position.

Only the e-QIP version of the SF 86 are acceptable by OPM-DCSA.

After determining that an individual requires Public Trust Position determination, the FSO will identify the individual to the COR.

The FSO will also provide the following information to the COR so that the NIWC PAC Personnel Security Office can initiate a request thru e-QIP:

Full SSN of the applicant, Full Name, Date of Birth, Place of Birth, Email Address and Phone Number

A contractor worksheet will be provided by Personnel Security for the COR and/or the FSO to complete that includes the above information and any additional information required by the Personnel Security Office.

The Personnel Security Office will send email notification and instructions to the applicant to complete and submit e-QIP expedit iously.

The FSO will take and submit fingerprints via electronic submission. If the FSO does not have the means to submit fingerprints electronically, they will obtain hardcopy fingerprints using SF-87 or FD-258. For immediate fingerprint result, electronic transmission of fingerprints is encouraged. OPM no longer accepts the submission of hard copy fingerprints (SF-87 or FD-258).

If fingerprints are obtained via hardcopy, the hardcopies will be sent to NIWC PAC Personnel Security via USPS Priority mail:

Commanding Officer, NIWC PAC

ATTN: Personnel Security, Code 83310

53560 Hull St

San Diego CA 92152

Contractor Fitness Determinations made by the DOD CAF are maintained in the Defense Information System for Security (DISS).

Favorable Fitness Determinations will support Public Trust positions only and not National Security Eligibility positions. If no issues are discovered, according to respective guidelines, a HSPD-12 Determination will be populated in DISS and will be reciprocal within DoN. If issues are discovered, the DOD CAF will forward the investigation along with all supporting documentation to the NIWC PAC Security Office for local determination. The Command Security Manager will make the local Fitness Determination and your company will be notified of the decision in writing. If an individual receives a negative Fitness Determination, they will be immediately removed from their position of trust, the FSO will be notified, and the company will replace any individual who has received a negative Fitness Determination.

If you require additional assistance with the submission of Public Trust Investigations, you may send an email to NIWC PAC Personnel Security at NIWC_PAC_UNCLASSCTR@NAVY.MIL.

II. Employment Terminations:

The contractor shall:

Immediately notify the COR or TR of the employee's termination.

Send email to NIWC_PAC_UNCLASSCTR@NAVY.MIL, Code 83310 notifying them of the termination.

Fax a termination VAL to Code 83320 at (619) 553-6169.

Return any badge and decal to Commanding Officer, Naval Information Warfare Center Pacific, Attn: Code 83320, 53560 Hull Street, San Diego, CA 92152-5001.

C-204-PAC005 Contract Data Requirements List (CDRL) Tool (Feb 2025)

All non-classified CDRL deliverable documents/copies shall be submitted electronically via an upload by the contractor into the Acquisition Management System (AMS) CDRL Tool:

https://ams.navair.navy.mil/CDRL/Pages/Default.aspx

AMS CDRL Tool resources and training are located at:

https://ams.navair.navy.mil/home

Both contractor CAC or "Soft-Cert" Access and the "Contractor" Role within the AMS CDRL Tool are required. The contractor shall be responsible for delivering all data.

C-204-PAC004 Electronic Cost Reporting and Financial Tracking (eCRAFT) (Feb 2025)

The contractor shall submit the eCRAFT Report in accordance with the DD Form 1423.

C-211-PAC002 Key Personnel (Feb 2025)

N6600126R3608 https://ams.navair.navy.mil/CDRL/Pages/Default.aspx https://ams.navair.navy.mil/home

(a) The offeror agrees to assign to this contract those key personnel listed in paragraph (d) below. No substitutions shall be made except in accordance with this text.

(b) The offeror agrees that during the first 90 days of the contract performance period no personnel substitutions will be permitted unless such substitutions are necessitated by an individual's sudden illness, death or termination of employment. In any of these events, the contractor shall promptly notify the Contracting Officer and provide the information required by paragraph (c) below. After the initial 90 day period, all proposed substitutions must be submitted in writing, at least fifteen (15) days (thirty (30) days if a security clearance is to be obtained) in advance of the proposed substitutions to the contracting officer. These substitution requests shall provide the information required by paragraph (c) below.

(c) All requests for approval of substitutions under this contract must be in writing and provide a detailed explanation of the circumstances necessitating the proposed substitutions. They must contain a complete resume for the proposed substitute or addition, and any other information requested by the Contracting Officer or needed by him to approve or disapprove the proposed substitutions.

All substitutions proposed during the duration of this contract must have qualifications of the person being replaced. The Contracting Officer or authorized representative will evaluate such requests and promptly notify the contractor of approval or disapproval thereof in writing.

(d) List of Key Personnel

[identify key personnel]

NAME CONTRACT LABOR CATEGORY

(e) If the Contracting Officer determines that suitable and timely replacement of key personnel who have been reassigned, terminated or have otherwise become unavailable for the contract work is not reasonably forthcoming or that the resultant reduction of productive effort would be so substantial as to impair the successful completion of the contract or the service order, the contract may be terminated by the Contracting Officer for default or for the convenience of the Government, as appropriate. In addition, if the contractor is found at fault for the condition, the Contracting Officer may elect to equitably decrease the contract price or fixed fee to compensate the Government for any resultant delay, loss or damage.

(f) If the offeror wishes to add personnel to be used in a labor category, it shall employ the procedures outlined in paragraph (c) above.

Adding personnel will only be permitted in the event of an indefinite quantity contract, where the Government has issued a delivery order for labor hours that would exceed a normal forty-hour week if performed only by the number of employees originally proposed.

C-211-PAC001 NIWC Pacific Work Week (Feb 2025)

(a) All or a portion of the effort under this contract will be performed on a Government installation. The normal work week for Government employees at NIWC Pacific is Monday through Thursday 7:15 AM to 4:45 PM and Friday 7:15 AM to 3:45 PM with every other Friday a non-work day. Work at this Government installation, shall be performed by the contractor within the normal work hours at NIWC Pacific unless differing hours are specified on an individual delivery/task order. The contractor is not required to maintain the same hours as Government employees; however, contractor employees performing work at NIWC Pacific must work during the normal workweek. The following is a list of holidays observed by the Government.

Name of Holiday Time of Observance

New Year's Day 1 January

Martin Luther King Jr. Day Third Monday in January

Presidents Day Third Monday in February

Memorial Day Last Monday in May

Juneteenth National Independence Day 19 June

Independence Day 4 July

Labor Day First Monday in September

Columbus Day Second Monday in October

Veteran's Day 11 November

Thanksgiving Day Fourth Thursday in November

Christmas Day 25 December

(b) If any of the above holidays occur on a Saturday or a Sunday, then such holiday shall be observed by the contractor in accordance with the practice as observed by the assigned Government employees at the using activity.

(c) If the contractor is prevented from performance as the result of an Executive Order or an administrative leave determination applying to the using activity, such time may be charged to the contract as direct cost provided such charges are consistent with the contractor's accounting practices.

(d) This contract does not allow for payment of overtime during the normal workweek for employees who are not exempted from the Fair Labor Standards Act unless expressly authorized by the Ordering Officer. Under Federal regulations, the payment of overtime is required only when an employee works more than 40 hours during a week. Therefore, during the NIWC Pacific off-Friday (36-hour) week overtime will not be paid for non-exempt employees. During the work-Friday week (44 hour) the contractor is to schedule work so as not to incur overtime charges during the normal work week unless authorized in writing by the Government to do so. An example of this would be for contractor personnel to work during the hours of 7:15 AM to 4:45 PM Monday through Thursday and 7:

15 AM to 3:45 PM Friday during the work-Friday week. The contractor may also elect to configure the workforce in such a way that no single employee exceeds 40 hours during a normal week even though normal NIWC Pacific hours are maintained both weeks.

(e) NOTICE: All contractor employees who make repeated deliveries to military installations shall obtain the required employee pass via the Defense Biometric Identification System (DBIDS) in order to gain access to the facility. Information about DBIDS may be found at the following website: https://www.cnic.navy.mil/om/dbids.html.

Contractor employees must be able to obtain a DBIDS in accordance with base security requirements. Each employee shall wear the Government issued DBIDS badge over the front of the outer clothing. When an employee leaves the contractor's employ, the employee's DBIDS badge shall be returned to the Contracting Officer's Representative or the base Badge and Pass Office within five

(5) calendar days.

Contractors who do not have a DBIDS or Common Access Card (CAC) must be issued a one-day pass daily at the Badge and Pass Office. Issuance of a CAC requires the need for physical access to the installation and logical access to government owned computer systems.

(f) Periodically, the Government may conduct Anti-Terrorism Force Protection (AT/FP) and/or safety security exercises, which may require the contractor to adjust its work schedule and/or place of performance to accommodate execution of the exercise. The contractor will be required to work with its Government point of contact to adjust work schedules and/or place of performance in the case of an exercise that causes disruption of normally scheduled work hours or disruption of access to a government facility. The contract does not allow for payment of work if schedules cannot be adjusted and/or the work cannot be executed remotely (i.e., the contractor's facility or alternate non-impacted location), during an exercise when government facilities are inaccessible.

C-228-PAC001 Liability Insurance--Cost Type Contracts (Feb 2025)

(a) The following types of insurance are required in accordance with FAR 52.228-7 "Insurance--Liability to Third Persons" and shall be maintained in the minimum amounts shown:

(1) Workers' compensation and employers' liability: minimum of $100,000

(2) Comprehensive general liability: $500,000 per occurrence

(3) Automobile liability: $200,000 per person

$500,000 per occurrence

N6600126R3608 https://www.cnic.navy.mil/om/dbids.html

$20,000 per occurrence for property damage

(b) When requested by the contracting officer, the contractor shall furnish to the Contracting Officer a certificate or written statement of insurance. The written statement of insurance must contain the following information: policy number, policyholder, carrier, amount of coverage, dates of effectiveness (i.e., performance period), and contract number. The contract number shall be cited on the certificate of insurance.

C-240-PAC001 Contractor Furnished Equipment on RDT&E Networks (Feb 2025)

Contractors are prohibited from connecting any non-Government owned equipment to RDT&E networks unless the equipment is specifically identified hereunder. The following contractor owned/provided equipment is permitted to be connected to the RDT&E network, as necessitated by the statement of work, in performance of this contract only:

None

Any changes to this list must be completed via formal contract modification prior to implementation or use on the network. Before connection of any above-listed equipment is made, the Command Information System Security Manager (Code 82400) must be informed via Cybersecurity Exception Request. All other equipment not specifically identified above remains prohibited for use on RDT&E networks.

Per the DON Destruction of Electronic Storage Media Policy, all contractor-provided internal and removable electronic storage media listed above shall become Government property upon the sooner of: equipment end of life, replacement, end of service, or turn-in;

contract completion, or contract termination. The contractor shall work with the Contracting Officer or Contracting Officer's Representative (COR), if applicable, to facilitate the immediate turnover of internal and removable electronic storage media as soon as one of the aforementioned circumstances arise.

Internal and removable electronic storage media includes, but is not limited to, workstations, laptops/notebooks, printers, copiers, scanners, multi-functional devices (MFD), and hand held devices with internal storage devices, removable hard drives, external hard drives, solid state hard drives, flash based storage media such as "thumb" drives and camera memory cards, backup data systems (e.g., DAT, LTO, DLT), and optical storage devices (e.g., CD/DVD).

Section D - Packaging and Marking

SECTION D - Packaging and Marking

All data to be furnished hereunder shall be packaged and marked in accordance with Exhibit A.

All other deliverables shall be packaged and marked in accordance with best commercial practices.

Section E - Inspection and Acceptance

SECTION E - Inspection and Acceptance

Inspection and acceptance shall be made at destination by the Contracting Officer's Representative (COR) or duly authorized representative. Inspection shall be performed in accordance with the applicable inspection clause(s) of the basic contract.

FAR Clauses Incorporated by Reference

Number Title Effective Date

Alternate/ Deviation

Variation Effective Date

52.246-5 Inspection of Services-Cost-Reimbursement. Apr 1984

Section F - Deliveries or Performance

SECTION F - Deliveries or Performance

Dates are anticipated and are subject to change.

If contractor performance is satisfactory, the Government anticipates the period of performance to be from DOA through four

(4) option year periods, if all options are exercised.

Base: December 2026 - December 2027

Option Year One: December 2027 - December 2028

Option Year Two: December 2028 - December 2029

Option Year Three: December 2029 - December 2030

Option Year Four: December 2030 - December 2031

Section G - Contract Administration Data

DFARS Clauses Incorporated by Reference

Number Title Effective Date

Alternate/ Deviation

Variation Effective Date

252.201-7000 Contracting Officer's Representative. Dec 1991 252.204-7006 Billing Instructions-Cost Vouchers May 2023 252.232-7003 Electronic Submission of Payment Requests and Receiving Reports. Dec 2018

DFARS Clauses Incorporated by Full Text