SOW.pdf

NSWCPD SOW-PWS Template Rev 45

Statement of Work (SOW) for DDG-51 MCS LBES EPS-HIL Adapter Boards

1.0 INTRODUCTION

1.0.1 The Naval Surface Warfare Center Philadelphia Division (NSWCPD) is a Department of Defense entity responsible for research and development, test and evaluation, engineering and fleet support organization for the Navy’s ships, submarines, military watercraft and unmanned vehicles. This requirement is for NSWCPD Code 555, which is responsible for The DDG-51 Machinery Control Systems (MCS) Land Based Engineering Site (LBES).

1.0.2 This contract is for non-personal services. It does not create employment rights with the U.S. Government whether actual, inherent, or implied

1.0.3 Government/Contractor Relationship

1.0.3.1 The services to be delivered under this Contract/Task Order are non-personal services and the parties recognize and agree that no employer-employee relationship exists or will exist under the Contract/Task Order between the Government and the Contractor's personnel.

Therefore, it is in the best interest of the Government to provide both parties a full understanding of their respective obligations.

1.0.3.2 The Contractor employees shall identify themselves as Contractor personnel by introducing themselves or being introduced as Contractor personnel and displaying distinguishable badges or other visible identification for meetings with Government personnel. In addition, Contractor personnel shall appropriately identify themselves as Contractor employees in telephone conversations and in formal and informal written correspondence.

1.0.3.3 Contractor personnel under this Contract/Task Order shall not engage in any of the inherently Governmental functions listed at FAR Subpart 7.5 or DFARS Subpart 207.5.

1.0.4 Employee Relationship:

1.0.4.1 The services to be performed under this Contract/Task Order do not require the Contractor or its personnel to exercise personal judgment and discretion on behalf of the Government. Rather the Contractor's personnel will act and exercise personal judgment and discretion on behalf of the Contractor.

1.0.4.2 Rules, regulations, directives, and requirements that are issued by the U. S. Navy and NSWCPD under its responsibility for good order, administration, and security are applicable to all personnel who enter a Government installation or who travel on Government transportation.

This is not to be construed or interpreted to establish any degree of Government control that is inconsistent with a non-personal services contract.

1.0.4.3 Inapplicability of Employee Benefits: This Contract/Task Order does not create an employer-employee relationship. Accordingly, entitlements and benefits applicable to such relationships do not apply.

1.0.4.4 It is the Contractor's, as well as the Government's, responsibility to monitor Contract/Task Order activities and notify the Contracting Officer if the Contractor believes that the intent of this Section has been or may be violated.

1.0.4.4.1 The Contractor shall notify the Contracting Officer in writing via letter or email within three (3) calendar days from the date of any incident that the Contractor considers to constitute a violation of this Section. The notice should include the date, nature, and circumstances of the conduct; the name, function, and activity of each Government employee or Contractor official or employee involved or knowledgeable about such conduct; identify any documents or substance of any oral communication involved in the conduct; and the Contractor's estimated date when, absent a response, cost, schedule or performance will be impacted.

1.0.4.4.2 The Contracting Officer will, within five (5) calendar days after receipt of notice, respond to the notice in writing. In responding, the Contracting Officer will either:

(i) Confirm the conduct is in violation and when necessary direct the mode of further performance,

(ii) Countermand any communication regarded as a violation,

(iii) Deny that the conduct constitutes a violation and when necessary direct the mode of further performance, or

(iv) In the event the notice is inadequate to make a decision, advise the Contractor what additional information is required, and establish the date by which it should be furnished by the Contractor.

1.1 BACKGROUND

NSWCPD Code 555, is responsible for designing, building, and maintaining simulator systems for LBES. This SOW is for custom Printed Circuit Boards (PCBs) Assemblies for a High Voltage Bus simulator. The PCBs are unique to our application and no Commercial Off The Shelf (COTS) equipment is available to meet our requirements, therefore we design the PCBs assemblies internally within Code 555. We do not have the capability to build or manufacture these PCB assemblies internally, so this SOW defines the design and requirements in order to have an external company build the PCB assemblies.

1.2 SCOPE OF WORK

The Contractor shall provide hardware to meet or exceed the specifications found in section 3.

2.0 APPLICABLE DOCUMENTS

File Description

2.0.1 NS18204 DI 24V Relay Adapter

-reva.zip

PWB Manufacturing Data. Includes Vendor BOM.

2.0.2 NS18212 DO 24V Adapter -

reva.zip

PWB Manufacturing Data. Includes Vendor BOM.

2.0.3 NS220801 UEI DNX-DIO-448

DI Cable Adapter -reva.zip

PWB Manufacturing Data. Includes Vendor BOM.

2.0.4 NS220802 UEI DNX-DIO-630

DO Cable Adapter -reva.zip

PWB Manufacturing Data. Includes Vendor BOM.

2.0.5 NS220803 UEI AO Cable

Adapter -reva.zip

PWB Manufacturing Data. Includes Vendor BOM.

2.0.6 NS24074 UEI AI Adapter -

reva.zip

PWB Manufacturing Data. Includes Vendor BOM.

The Contractor shall reference and utilize the latest version available when performing tasks within this PWS.

3.0. REQUIREMENTS

3.1.1. Quantity 5 NS18204 DI 24V Relay Adapter CCA fabricated according to files in

REF-1.

3.1.1.1. 8 Position Phoenix Connector terminal plugs installed (Schematic Value

TERM BLOCK PLUG 8POS 5.08MM)

3.1.1.2. 4 Position Phoenix Connector terminal plug installed (Schematic Value

PHX 1792265)

3.1.1.3. Jumper shunts not installed, provided separately. (Schematic Value

JUMPER 100MIL)

3.1.2. Quantity 5 NS18212 DO 24V Adapter CCA fabricated according to files in REF-2 supplied with these Vendor BOM items:

3.1.2.1. 8 Position Phoenix Connector terminal plugs installed (Schematic Value 8 Pin 200 mil Header Plug)

3.1.2.2. 2 Position Phoenix Connector terminal plug installed (Schematic Value

PHX 1792757)

3.1.2.3. Jumper shunts not installed, provided separately. (Schematic Value

JUMPER 100MIL)

3.1.3. Quantity 3 NS24071 UEI DNX-DIO-448 DI Cable Adapter CCA fabricated according to files in REF-3 supplied with these Vendor BOM items included but not assembled:

3.1.3.1. Jumper shunts not installed, provided separately. (Schematic Value

JUMPER 100MIL)

3.1.4. Quantity 5 NS24072 UEI DNX-DIO-630 DO Cable Adapter CCA fabricated according to files in REF-4 supplied with these Vendor BOM items:

3.1.4.1. 2 Position Phoenix Connector terminal plug installed (Schematic Value

COMBI-02-VP)

3.1.4.2. 3 Position Phoenix Connector terminal plugs installed (Schematic Value

COMBI-03-VP)

3.1.4.3. Jumper shunts not installed, provided separately. (Schematic Value

JUMPER 100MIL)

3.1.5. Quantity 3 NS24073 UEI AO Cable Adapter CCA fabricated according to files in

REF-5.

3.1.5.1. 2 Position Phoenix Connector terminal plug installed (Schematic Value

COMBI-02-VP)

3.1.5.2. 3 Position Phoenix Connector terminal plugs installed (Schematic Value

COMBI-03-VP)

3.1.5.3. Jumper shunts not installed, provided separately. (Schematic Value

JUMPER 100MIL)

3.1.6. Quantity 2 NS24074 UEI AI Adapter CCA fabricated according to files in REF-1.

3.1.6.1. 8 Position Phoenix Connector terminal plugs installed (Schematic Value

TERM BLOCK PLUG 8POS 5.08MM)

3.1.6.2. Jumper shunts not installed, provided separately. (Schematic Value

JUMPER 100MIL)

3.1.7. Fabrication notes. Applicable to all items 3.1.1. through 3.1.6.

3.1.7.1. THESE ARE CLASS 2 PWB PER IPC 2221 & IPC 2222

3.1.7.2. FINISHED BOARD SHALL MEET REQUIREMENTS OF IPC-A-600.

3.1.8. Fabrication Requirements. Applicable to all items 3.1.1. through 3.1.6.

3.1.8.1. BOARD MATERIAL SHALL CONFORM TO TYPE GFN PER MIL-P-

13949/4C. BONDING MATERIAL SHALL CONFORM TO TYPE PCGF PER

MIL-P-13949/12.

3.1.8.2. LAYER-TO-LAYER REGISTRATION MUST BE CONTROLLED TO

THE EXTENT NECESSARY TO MEET THE MINIMUM ANNULAR RING

REQUIREMENTS SPECIFIED IN PARAGRAPH 3.8.8.3 AND 3.10.2.6,

IPC-ML-950C, CLASS 2.

3.1.8.3. HOLES SHALL BE LOCATED WITHIN .005” RADIUS OF CENTER

OF PAD.

3.1.8.4. HOLE TOLERANCE IS +/- 0.005". HOLES TO BE PLATED THRU

AFTER ETCHBACK HAS BEEN PERFORMED. DIMENSIONS IN HOLE

CHART, AND HOLE TOLERANCES SPECIFIED, ARE FOR FINISHED

PLATED THRU HOLES OR FOR UNPLATED HOLES.

3.1.8.5. MINIMUM FINISHED ETCHED WIDTH OF TRACES TO BE .008”

3.1.8.6. MINIMUM ALLOWABLE CLEARANCE BETWEEN CONDUCTORS

IS 0.008”.

3.1.8.7. RADIUS IS ACCEPTABLE ON INSIDE CORNERS AND CUTOUTS.

MAXIMUM RADIUS OF .06” IS ACCEPTABLE FOR TRIMMING.

3.1.8.8. APPLY SOLDER MASK TO APPLICABLE SIDE OF BOARD OVER

BARE COPPER IAW IPC-SM-840, TYPE A OR B, CLASS 3. EXPOSED

TRACES ARE NOT ACCEPTABLE. THICKNESS SHALL NOT EXCEED

.0025”. MASK COLOR SHALL BE DARK GREEN GLOSS.

3.1.8.9. FINAL COMPOSITE THICKNESS OF THE PWB SHALL BE .062” +/-

.007” INCLUDING ETCH.

3.1.8.10. APPLY SILK SCREEN MARKINGS TO BOTH SIDES OF THE

BOARD USING A WHITE NON-CONDUCTIVE INK EQUAL TO WOR-

NOW-CAT-L-INK 50-10R.

3.1.8.11. RUBBER STAMP OR HAND MARK APPLICABLE

TRACEABILITY MARKINGS, DATE AND MANUFACTURER’S CAGE

CODE USING A CONTRASTING COLOR, NON-CONDUCTIVE INK.

3.1.9. IT SHALL BE THE SOLE RESPONSIBILITY OF THE PWB VENDOR TO

VERIFY THE DATA CONTAINED IN PLOT FILES AND TO PRODUCE A

FINISHED BOARD THAT FULLY COMPLIES WITH ALL REQUIREMENTS OF

THIS DRAWING AND ARTWORK POSITIVES AND NEGATIVES.

3.1.10. Fast turn-around time is not needed. Delivery within 90 days is acceptable.

3.3 Manufacturing Phase-Out or Discontinuation of Production, Diminishing Sources, and Obsolete Materials or Components

3.3.1 The contractor shall notify the contracting officer immediately upon determining the unavailability of obsolete materials or components. The contractor may recommend a solution to include the impact on the contract price and delivery. The contractor shall not initiate any item redesign or incur any additional costs without the express, written authorization of the contracting officer.

3.4 Diminishing Manufacturing Sources and Material Shortages Management (DMSMS) Contract Requirements

3.5 Parts Obsolescence

4.0 DATA REQUIREMENTS

5.0 SECURITY REQUIREMENTS

5.1 SECURITY TRAINING.

5.2 ON SITE WORK.

5.2.1 RESERVED

5.5 RECEIPT, STORAGE, AND GENERATION OF CONTROLLED UNCLASSIFIED

INFORMATION (CUI) (REQUIRED to be included for all SOWS) All Controlled Unclassified Information (CUI) associated with this contract must follow the minimum marking requirements of DoDI 5200.48, Section 3, paragraph 3.4.a, and include the acronym "CUI" in the banner and footer of the document. In accordance with DoDI 5200.48, CUI must be safeguarded to prevent Unauthorized Disclosure (UD). CUI export controlled technical information or other scientific, technical, and engineering information must be marked with an export control warning as directed in DoDI 5230.24, DoDD 5230.25, and Part 250 of Title 32, CFR. Nonfederal information systems storing and processing CUI shall be protected per NIST SP-800-171, or subsequent revisions. All transmissions to personal email accounts (AOL, Yahoo, Hotmail, Comcast, etc.) and posting on social media websites (Facebook, Instagram, Twitter, LinkedIn, etc.) are prohibited. Destroy CUI associated with this contract by any of the following approved methods: A cross-cut shredder; a certified commercial destruction vendor; a central destruction facility; incineration; chemical decomposition; pulverizing, disintegration; or methods approved for classified destruction.

8.2 Shipping Notification

FAR 52.245-1 requires the Contractor to report when GFP is returned to the Government.

DFARS 252.245-7005 “Management and Reporting of Government Property” requires this notification be in the form of a shipment through the GFP Module in PIEE.

8.3 Inventory Reporting

FAR 52.245-1 requires the Contractor to periodically perform, record, and disclose physical inventory results. While the FAR clause does not define “periodically,” SECNAVINST 5200.43A requires on-hand inventory count reports to support property type specific inventory requirements as set forth in their respective governing instructions. The contractor shall provide an inventory report in accordance with CDRL X. The Government Property Inventory Report outlines the frequency of reporting based on property type per contract needs. If the contractor does not possess any GFP, the Government Property Inventory Report shall reflect no GFP on-hand as required on the reporting schedule.

The Contractor shall provide support within a reasonable time after the Government’s written request to support any Government audit in which GFP, or its related documentation, is requested as part of normal audit processes.

8.4 Lost, Damaged or Stolen GFP Reporting

FAR clause 52.245-1 requires the Contractor to investigate and report to the Government all incidents of property loss as soon as the facts become known. DFARS 252.245-7005 “Management and Reporting of Government Property” further requires the Contractor to report lost, damaged or stolen Government property using the Property Loss functionality within the PIEE GFP Module. The Contractor shall support the Government’s process to assign liability and document loss in support of lost, damaged or stolen GFP.

8.5 Excess Property Reporting

Per FAR 52.245-1, the Contractor shall promptly disclose and report Government property in its possession that is excess to contract performance.

8.6 Property Disposition

Government Property Distribution shall be in line with FAR 52.245-1(j) and DFARS 252.245- 7005 “Management and Reporting of Government Property". The contractor shall provide a written notice to the Contracting Officer when property held under this contract has not been used in 100 calendar days. All General Equipment/assets provided as GFP shall be returned to the Government for disposition at the completion of its use unless otherwise directed in writing by the Contacting Officer or the Accountable Property Officer (dependent on who is administering the contract). The Contractor shall complete the plant clearance inventory schedule using the plant clearance capability of the GFP module of the PIEE to generate an electronic equivalent of the SF 1428, Inventory Disposal Schedule.

The contractor shall obtain PCO or plant clearance officer approval (dependent on who is administering the contract) prior to disposal of excess GFP/CAP after the contractor completes the plant clearance inventory schedule.

8.6.1 Property Disposition Instructions

8.6.2 Issuance of the DD 1149 “Requisition and Invoice/Shipping Document”

The contractor must obtain a DD1149 before removing any Government Furnished Property, including Plant, Property, and Equipment (PP&E) from NSWCPD premises for general use. For situations where the contractor picks up/replaces NSWCPD property for maintenance purposes, the contractor shall provide an equipment receipt, showing Manufacturer, Model/Part Number, Serial Number and Asset Number/Barcode, on their company letterhead to the COR. Any and all GFP returned to the Government shall include a DD 1149 to document transfer of liability back to the Government.

8.7 Property Closeout. IAW FAR 52.245-1, the Contractor shall promptly perform and report to the PCO or plant clearance officer (dependent on who is administering the contract) contract property closeout to include reporting, investigating and securing closure of all loss of Government property cases; physically inventorying all property upon termination or completion of this Contract/TO; and disposing of items at the time they are determined to be excess to contractual needs.

8.8 Property Tagging:

The contractor can either tag issued equipment or use the provided NSWCPD Plant property barcodes, or NMCI asset tags. If the contractor chooses to use their own tag, it shall not cover the NSWCPD barcode, or NMCI asset tag. The NSWCPD barcode, and or NMCI asset tag number, when provided shall be used on contractor inventory reports.

9.0 GOVERNMENT FURNISHED INFORMATION

9.1 GFI is for informational purposes and that use by the Contractor is optional

10.0 PURCHASES

10.1 Only items directly used and incidental to the services for this Contract/Task Order and for work within the scope of the Statement of Work/Performance Work Statement, shall be purchased under the Other Direct Cost (ODC) line items. Purchases of an individual item that is valued above $10,000 shall be approved by the Contracting Officer prior to purchase by the Contractor.

The purchase request and supporting documentation shall be submitted via email to the Contracting Officer and the Contracting Officer's Representative (COR) it shall be itemized and contain the cost or price analysis performed by the Contractor to determine the reasonableness of the pricing. Provide copies of price estimates from at least 2 vendors.

10.2 Information Technology (IT) equipment, or services must be approved by the proper approval authority. All IT requirements, regardless of dollar amount, submitted under this Contract/Task Order shall be submitted to the PCO for review and approval prior to purchase. The definition of information technology is identical to that of the Clinger-Cohen Act, that is, any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. Information technology includes computers, ancillary equipment, software, firmware and similar procedures, services (including support services), and related resources.

11.0 COUNTERFEIT MATERIAL PREVENTION

11.1 Electronic End-Items

11.1.15.1 For Subcontractors, Contract Manufacturers, and Authorized Distributors - Only new and authentic materiel are to be used in products delivered to Buyer. No counterfeit or suspect counterfeit materiel is to be contained within the delivered product. Materiel shall be purchased directly from the OMs, or through the OMs Authorized Distributor. Documentation must be available that authenticates traceability to the applicable OM. Independent Distributors (Brokers) shall not be used without written consent from Buyer

11.2 Non-Electronic Materiels

11.2.1 Department of the Navy contractors (and their subcontractors at all tiers) who obtain critical or high risk materiel shall implement a risk mitigation process as follows:

11.2.1.1 If the materiel is currently in production or currently available, materiel shall be obtained only from authorized suppliers

11.2.1.2 If the materiel is not in production or currently available from authorized suppliers, materiel shall be obtained from suppliers that meet appropriate counterfeit avoidance criteria

11.2.1.3 Contractor shall notify the contracting officer when critical or high risk materiel cannot be obtained from an authorized supplier;

11.2.1.4 Contractor shall take mitigating actions to authenticate the materiel if purchased from an unauthorized supplier

11.2.1.5 Contractor shall report instances of counterfeit and suspect counterfeit materiel to the contracting officer and the GIDEP as soon as the contractor becomes aware of the issue.

Appendix A – Cybersecurity Workforce (CSWF) Label Guidance for the Document Preparer

CSWF Labels are provided below in accordance with SECNAV M-5239.2–

• Identifying the CSWF label will help transitioning to the CSWF requirements when the Navy directs the change

• The proper proficiency level should be chosen for each CSWF label o IAWF xxx-I = Entry CSWF o IAWF xxx-II = Intermediate CSWF o IAWF xxx-III = Advanced CSWF o Ex: IAM II = Intermediate

• The CSWF designation should be chosen based on the position responsibilities/description. Navy COOL is a quick resource for identifying this:

https://www.cool.navy.mil/usn/cswf/index.htm

• It is highly recommended that you cross-check requirements for CSWF designation and proficiency with requirements for the IAWF designation. This will help with transitioning between the programs.

o Ex: An Entry 41 - Customer Service and Technical Support can meet their requirements via A+, Network+ or SSCP. These align directly to someone with an IAWF designation of IAT-I (A+, CCNA-Security, Network+, SSCP) o IAWF and CSWF requirements do not always align. Do not rely on Navy cool for the most current baseline requirement certification list. NAVIFOR provides in Excel format it as “5239.2 Appendix 4” via its site:

https://usff.navy.deps.mil/sites/NAVIFOR/manpower/cswf/SitePages/Home.a spx

IAWF Designation Requirement (DOD 8570.01-M) Guidance for the Document Preparer

Approved Baseline Certifications IAT Level I IAT Level II IAT Level III

A+ CE

CCNA-Security

CND

Network+ CE

SSCP

CCNA Security CySA+ **

GICSP

GSEC

Security+ CE

CND

SSCP

CASP+ CE

CCNP Security

CISA

CISSP (or Associate)

GCED

GCIH

IAM Level I IAM Level II IAM Level III

CAP

CND

Cloud+

GSLC

Security+ CE

CAP

CASP+ CE

CISM

CISSP (or Associate)

GSLC

CCISO

CISM

CISSP (or Associate)

GSLC

CCISO

IASAE I IASAE II IASAE III

CASP+ CE

CISSP (or Associate)

CSSLP

CASP+ CE

CISSP (or Associate)

CSSLP

CISSP-ISSAP

CISSP-ISSEP

CSSP Analyst CSSP Infrastructure Support

CSSP Incident Responder

CEH

CFR

CCNA Cyber Ops CCNA Security CySA+ **

GCIA

GCIH

GICSP

Cloud+

SCYBER

PenTest+

CEH

CySA+ **

GICSP

SSCP

CHFI

CFR

Cloud+

CND

CEH

CFR

CCNA Cyber Ops CCNA Security

CHFI

CySA+ **

GCFA

GCIH

SCYBER

PenTest+

CSSP Auditor CSSP Manager

CEH

CySA+ **

CISA

GSNA

CFR

PenTest+

CISM

CISSP-ISSMP

CCISO

• Baseline certification requirements for the IAWF can be found at:

https://public.cyber.mil/cwmp/dod-approved-8570-baseline-certifications/

• Higher level IAT/IAM/IASAE certifications satisfy lower level requirements.

Certifications listed in Level II or III cells can be used to qualify for Level I.

However, Level I certifications cannot be used for Level II or III

• OS/CE Requirements will be determined by systems they need privileged access

to. They are required to have an actual certification (not a training certificate) for these systems. You can determine the correct certification based on your needs.

The CSWF PM, ISSOs, and ISSM can assist with this as well.

• Information Assurance (IA) Management (IAM) o Typically personnel in oversight/compliance roles that may:

Supervise or manage protective or corrective measures when a cybersecurity incident or vulnerability is discovered.

Ensure that system security configuration guidelines are followed.

Ensure that IA security requirements are appropriately identified in computer environment operation procedures.

Ensure that IA inspections, tests, and reviews are coordinated.

Participate in an IS risk assessment during the Assessment and

Authorization (A&A) / Risk Management Framework (RMF) process o May also carry out IAT duties, as long as they also meet IAT requirements.

o May include information system security officers (ISSOs)

• IA Technicians (IAT) o Typically system/network/application administrators doing technical work that may include:

Implement applicable patches to remediate vulnerabilities Install, test, maintain, and upgrade CE operating systems software and hardware to comply with cybersecurity requirements Implement and maintain perimeter defense systems including, but not limited to, intrusion detection systems, firewalls, grid sensors.

Schedule and perform regular and special backups on all enclave systems.

Examine vulnerabilities and determine actions to mitigate them.

• IA System Architects and Engineers (IASAE) o Typically developers and programmers, work may include:

Design, develop, and implement security measures that provide confidentiality, integrity, availability, authentication, and on-repudiation for the enclave environment.

Develop interface specifications for use within the enclave environment.

Develop cybersecurity architectures and designs for DoD IS to include automated IS applications, enclaves (which include networks), and special purpose environments with platform IT interconnectivity, e.g., weapons systems, sensors, medical technologies, or distribution systems.

Provide engineering support to security/certification test and evaluation activities.

Additional Guidance for completing Section 12.6 DON Cyberspace IT (Information Technology) / Cybersecurity & Information Assurance Functions and Personnel Requirements

IT levels should be provided for each position.

IT levels are defined in SECNAV M-5510.30 (see chapter 5).

• IT-I – Privileged Access

• IT-I users require a Tier 5 (T5) background investigation (Top Secret eligibility)

• This would typically be used for high-level administrators on centrally managed or cloud-based networks/information systems that connect to the internet or other DoD large networks (e.g., SIPRNet, SDREN)

• Information Systems Security Managers (ISSM), ISSOs, or other positions with responsibility for development and administration of cybersecurity programs, to include direction and control of risk analysis and/or threat assessment.

• Positions that have major responsibility for the direction, planning, design, testing, maintenance, operation, monitoring and/or management of systems hardware and software.

• General rule: IAM-II/III and IAT-III personnel will be here.

• IT-II – Limited Privilege OR sensitive information access

• IT-II users require a Tier 3 (T3) background investigation (Secret eligibility)

• Limited privilege could include privileged access to a stand-alone network or system, or local administrative privileges on a workstation

• (Privilege can also be considered limited if they are under the immediate supervision of an IT-I

• Sensitive information includes sensitive but unclassified (SBU) and controlled unclassified information (CUI). Examples include: Personally Identifiably Information (PII), For Official Use Only (FOUO), Naval Nuclear Propulsion Information (NNPI)

• IT-III – No Privilege AND no sensitive information access

• This category should only be used if personnel will ONLY have access to publically releasable information

Appendix B Sample Statement of Work Language- COUNTERFEIT MATERIAL

Reference: (COUNTERFEIT MATERIEL PROCESS GUIDEBOOK, Office of the Assistant Secretary of the Navy (Research, Development & Acquisition) Acquisition and Business Management June 2017, Appendix D) The following provides information that should be considered for inclusion into the Statements of Work (SOW) for solicitations or contracts where counterfeit materiel is identified as a risk.

These are only examples and can be used together or separately, and should be modified or otherwise tailored to meet program requirements:

11.1.1 Counterfeit Parts and Materials Planning

The contractor planning shall document procedures and processes to minimize the risk of procuring and/or using counterfeit parts and materials, and their process for detecting counterfeit materiel in the event it is procured. This requirement applies to both new/modified and existing mission and safety critical hardware. SAE AS5553 contains information regarding the detection, avoidance, and mitigation of counterfeit electronic components, and may be used as a reference document for the development of the plan.

11.1.2 Counterfeit Parts and Materials System

System criteria. A counterfeit electronic part detection and avoidance system shall include risk-based policies and procedures that address, at a minimum, the following areas:

• The training of personnel.

• The inspection and testing of electronic parts, including criteria for acceptance and rejection.

Tests and inspections shall be performed in accordance with accepted Government- and industry-recognized techniques. Selection of tests and inspections shall be based on minimizing risk to the Government. Determination of risk shall be based on the assessed probability of receiving a counterfeit electronic part; the probability that the inspection or test selected will detect a counterfeit electronic part; and the potential negative consequences of a counterfeit electronic part being installed (e.g., human safety, mission success) where such consequences are made known to the Contractor.

• Processes to abolish counterfeit parts proliferation.

• Risk-based processes that enable tracking of electronic parts from the original manufacturer to product acceptance by the Government, whether the electronic parts are supplied as discrete electronic parts or are contained in assemblies, in accordance with paragraph (c) of the clause at 252.246-7008, Sources of Electronic Parts (also see paragraph (c)(2) of this clause).

• Use of suppliers in accordance with the clause at 252.246-7008.

• Reporting and quarantining of counterfeit electronic parts and suspect counterfeit electronic parts. Reporting is required to the Contracting Officer and to the Government-Industry Data Exchange Program (GIDEP) when the Contractor becomes aware of, or has reason to suspect that, any electronic part or end item, component, part, or assembly containing electronic parts purchased by the DoD, or purchased by a Contractor for delivery to, or on behalf of, the DoD, contains counterfeit electronic parts or suspect counterfeit electronic parts. Counterfeit electronic parts and suspect counterfeit electronic parts shall not be returned to the seller or otherwise returned to the supply chain until such time that the parts are determined to be authentic.

• Methodologies to identify suspect counterfeit parts and to rapidly determine if a suspect counterfeit part is, in fact, counterfeit.

• Design, operation, and maintenance of systems to detect and avoid counterfeit electronic parts and suspect counterfeit electronic parts. The Contractor may elect to use current Government- or industry-recognized standards to meet this requirement.

• Flow down of counterfeit detection and avoidance requirements, including applicable system criteria provided herein, to subcontractors at all levels in the supply chain that are responsible for buying or selling electronic parts or assemblies containing electronic parts, or for performing authentication testing.

• Process for keeping continually informed of current counterfeiting information and trends, including detection and avoidance techniques contained in appropriate industry standards, and using such information and techniques for continuously upgrading internal processes.

• Process for screening GIDEP reports and other credible sources of counterfeiting information to avoid the purchase or use of counterfeit electronic parts.

• Control of obsolete electronic parts in order to maximize the availability and use of authentic, originally designed, and qualified electronic parts throughout the product’s life cycle.

11.1.3 Preventing Counterfeit Parts and Materials

The Contractor shall take steps as defined in DFARS 252.246-7007 and herein to minimize the risk of receiving counterfeit parts and materials. The Contractor shall:

• Maximize availability of authentic, originally designed and/or qualified parts throughout the product’s life cycle, including management of parts obsolescence

• Assess potential suppliers to minimize the risk of receiving counterfeit parts or materials

• Maintain a listing of approved suppliers with documented criteria for approval and removal of suppliers from the list

• Have purchasing procedures which require the selection of parts and materials from OM or authorized suppliers whenever possible

• Require a certificate of compliance and supply chain traceability for all electronic part purchases, and provide to the Government upon request

• Use Government or industry services such as GIDEP and other commercially available services to identify part or supplier quality or authenticity problems

• Define minimum inspection and test requirements for parts being procured from unauthorized suppliers, and shall ensure that in-house, third-party, and/or distributor inspection and test procedures and facilities comply with these requirements

• Incorporate procurement clauses which plainly identify quality requirements and liability to all approved suppliers

• Flow the requirements above to affected Subcontractors

SAE AS6174 contains information regarding the detection, avoidance, and mitigation of counterfeit materiel, and may be used as a reference document for meeting the above steps.

Parts and materials shall not be purchased from unauthorized sources (e.g. independent distributor or broker) unless there is no other means for procurement. In isolated cases when an unauthorized supplier is the only possible choice for procurement, an Unauthorized Supplier Purchase Report (CDRL XXXX) shall be provided to the Contracting Officer and program office.

The report shall contain the following information:

• Reason why an authorized supplier or original component manufacturer (OM) could not provide the part or material

• Product certificate of conformance with traceability to the OM, if available

• Verification and authenticity data results (e.g., visual inspection, marking/surface finish permanency, DPA, Scanning Acoustic Microscopy, Energy Dispersive X-Ray Spectroscopy, Fourier Transform Infrared (FTIR) Spectroscopy, Rockwell Hardness Test, etc.) SAE AS5553 contains information regarding the detection, avoidance, and mitigation of counterfeit electronic components, and may be used as a reference document for meeting the above steps.

11.1.4 Counterfeit Parts and Materials

The Contractor shall provide a Counterfeit Prevention Plan (CDRL XXXX) that documents procedures to minimize the risk of procuring and/or using counterfeit parts and materials. This plan shall be in accordance with DFARS 252.246-7007 Contractor Counterfeit Electronic Part Detention and Avoidance. Solicitations and subcontracts for all suppliers shall contain a requirement for procedures to minimize the risk of procuring and/or using counterfeit parts and materials.

11.1.4.1 Preventing Counterfeit Parts and Materials

The Contractor shall implement steps as defined in DFARS 252.246-7007 to minimize the risk of receiving counterfeit parts and materials. Parts and materials shall not be purchased from unauthorized suppliers (e.g. independent distributor or broker) unless there is no other means for procurement. In isolated cases when an unauthorized supplier is the only possible choice for procurement, a Technical Report – Study/Services, Unauthorized Supplier Purchase Report (CDRL XXXX) shall be provided to the contracting officer and the program office. The report shall contain the following information: • Reason why an authorized supplier or OM could not provide the part or material • Product certificate of conformance with traceability to the OM, if available • Verification and authenticity data results (e.g., visual inspection, marking/surface finish permanency, Differential Power Analysis (DPA), Scanning Acoustic Microscopy, Energy Dispersive X-Ray Spectroscopy, Fourier Transform Infrared (FTIR) Spectroscopy, Rockwell Hardness Test, etc.)

SAE AS5553 contains information regarding the detection, avoidance, and mitigation of counterfeit electronic components, and may be used as a reference document for meeting the above steps.

11.1.5 Counterfeit Parts and Materials

The following minimum processes shall be implemented and flowed down by the Contractor to all subcontractors. In order to minimize the risk of use of counterfeit parts in (NAME OF PROGRAM/EQUIPMENT), spare parts and associated equipment.

The contractor shall establish processes to minimize the risk of procuring and using counterfeit parts and materials. The contractor shall document these processes and provide those documented processes to Government representatives upon request.

At a minimum, these processes shall ensure that: • All components for (NAME OF PROGRAM/EQUIPMENT) electronic assemblies and subassemblies are purchased from Original Manufacturer (OM), authorized suppliers, or franchised distributors; At a minimum, the contractor shall ensure that procurement practices and processes to purchase and install components from OM, authorized suppliers, or franchised distributors are flowed down to subcontractors and suppliers at all tiers • A counterfeit Prevention Plan shall be generated in accordance with DI-MISC-81832 Counterfeit Prevention Plan, and that the requirements of this DID and AS5553 are flowed down to all subcontractors and suppliers in this effort; • The Contractor shall maximize the use of authentic, originally designed and/or qualified parts • The contractor shall assess potential suppliers to minimize the risk of receiving counterfeit parts or materials • The contractor shall have purchasing procedures which confirm whether a selected supplier is authorized (as defined in SAE AS5553) for each purchase • The contractor shall define minimum inspection and test requirements for parts being procured and shall ensure that in-house, third-party, and/or supplier inspection and test procedures and facilities comply with the requirements of this section. These minimum inspection and test requirements shall specify appropriate test methods to detect potential counterfeit parts and materials • The contractor shall require a certificate of conformance (as defined in SAE AS5553) and supply chain traceability for all electronic part purchases • The contractor shall use government or industry services such as GIDEP and other commercially available services to identify part or supplier quality or authenticity problems. The Contractor shall notify (NAME OF PROGRAM OFFICE) of the occurrence of a confirmed counterfeit part or material and the actions taken to identify, contain, and impound all product from the lot, within 7 working days of confirmation of the counterfeit status. The Contractor shall flow down a requirement for similar notification from Subcontractors or suppliers at any tier to the Contractor. The contractor shall initiate and submit an ALERT to the Government- Industry Data Exchange Program (GIDEP) within 60 days of knowledge of the counterfeit part or material. Counterfeit parts are defined in SAE Aerospace Standard 5553. Counterfeit parts may be electronic or mechanical in nature. Counterfeit electronic parts may typically be used parts which have been refurbished and represented as new. Commonly counterfeited electronic parts include parts such as microcontrollers or specially screened devices, or common parts, which have several pin-compatible versions from multiple manufacturers, such as memory devices and operational amplifiers. Counterfeit mechanical parts are typically improperly made, marked, or treated products. Examples are improper anodization or heat treatments (or falsified data), mismarked parts sold as higher grade steel, or used/fake parts such as valves or circuit breakers.

11.1.6 Data Item Description

Data Item Description (DID) DI-MISC-81832, Counterfeit Prevention Plan: This DID describes the format and content of a contractors “Counterfeit Prevention Plan,” and should be used by the procurement activity when requesting delivery of a counterfeit prevention plan.

11.1.7 Grey Market Statement (For CISCO Equipment)

Reseller and Equipment Qualification: Reseller shall certify that it is a CISCO Authorized Channel Partner as of the date of the submission of their offer, and that it has the certification/specialization level required by the Manufacturer to support both the product sale and product pricing, in accordance with the applicable Manufacturer certification/specialization requirements: Please provide proof of certification level with your quote submission. If proof of certification level is not provided with your quote submission, your quote may be considered non-responsive. Vendor shall warrant that the products are NEW and in their original UNOPENED box. Only CISCO installed and configured components are acceptable. Installation and / or configuration of third party components, or installation and / or configuration of OM components by any other than CISCO are NOT acceptable. The Vendor confirms to have sourced all Manufacturer products submitted in this offer from Manufacturer or through Manufacturer Authorized Channels only. Vendor shall provide Buyer with a copy of the End User license agreement pre-award, and shall certify that all Manufacturer software is licensed originally to Buyer as the original licensee authorized to use the Manufacturer Software. Only authentic OM equipment and support services sourced from authorized OM channels are acceptable. Equipment, materials, and services not meeting the above stated qualifications are not acceptable and will be returned to the reseller.

11.1.8 Containing Counterfeit Parts and Materials

Suspect counterfeit parts and materials shall be impounded with all other items from the same lot. The contractor shall identify and locate all potential users or hardware items with the suspect part or material, and contain product which has this suspect product, pending confirmation of the part or material’s authenticity. The OM may be involved at this point in order to verify authenticity. Confirmed counterfeit material shall be contained and provided to investigative agencies for ongoing investigation or prosecution. The counterfeit product shall not be scrapped or otherwise disposed of without approval from investigative authorities or the program office.

Confirmed counterfeit product shall not be returned or handled in a way which would allow its resale or reuse. Suspect counterfeit parts or materials whose authenticity (or lack of) cannot be definitively determined, shall be dispositioned via Material Review Board (MRB).

11.1.9 Reporting Counterfeit Parts and Materials

The prime contractor and program office shall be notified of the occurrence of a suspect or confirmed counterfeit part or material, and the actions taken to identify, contain, and impound all product from the lot. The contractor shall also contact the OM, and supplier if applicable. The contractor shall initiate and submit an ALERT to the Government-Industry Data Exchange Program (GIDEP) within 60 days of knowledge of the counterfeit part or material. The contractor shall notify the appropriate parties to document the case for legal action if required (e.g., contracting officer, DOD Office of Inspector General).

11.1.10 Nonconforming Material and Parts

Electrical components which fail during production or acceptance testing shall be assessed to determine if the supplier of the part was an authorized supplier for the manufacturer. Analysis of these failures shall include assessment of part authenticity (potential of being counterfeit or fraudulent).

11.1.11 Warranty “Counterfeit”

11.1.11.1 Seller warrants the goods delivered pursuant to this Contract, unless specifically stated otherwise in this Contract, shall (i) be new (ii) be free from defects in workmanship, materials, and design and (iii) be in accordance with all the requirements of this Contract. Seller further warrants that the performance of work and services shall conform with the requirements of this Contract and to high professional standards. All warranties in this Contract shall survive inspection, test, final acceptance and payment of goods and services.

11.1.12.1 Unless Buyer expressly identifies the goods that are procured under this Contract as nontechnical and for Buyer’s internal use only, Seller warrants without limitation as to time that the goods delivered pursuant to this Contract shall (i) be and only contain materials obtained directly from the OM or an authorized OM reseller or distributor (collectively, an Authorized Distributor); (ii) not be or contain Counterfeit Items or Suspect Counterfeit Items, as defined below; and (iii) contain only authentic, unaltered OM labels and other markings. Seller shall obtain and retain all documentation required to fully trace the distribution and sale of the goods delivered hereunder back to the relevant OM, and, on request of Buyer, shall provide such authenticating documentation. Counterfeit Item means an unlawful or unauthorized reproduction, substitution, alteration, or the false identification of grade, serial number, lot number, date code, or performance characteristic, that has been knowingly mismarked, misidentified, or otherwise misrepresented to be an authentic, unmodified item from the OM, an Authorized Distributor, or an Aftermarket Manufacturer as defined in SAE AS5553 “Counterfeit Electronic Parts;

Avoidance, Detection, Mitigation, and Disposition” (Authorized Aftermarket Manufacturer). A Suspect Counterfeit Item means an item for which credible evidence (including, but not limited to, visual inspection or testing) provides reasonable doubt that the item is authentic. Seller warrants that it will not act as or engage an independent distributor, non-authorized distributor, non-franchised distributor, non-authorized supplier, or non-authorized reseller (collectively, Broker), to assist it in delivering goods pursuant to this Contract unless the Buyer provides prior written approval to do so. Any Seller request to procure from a Broker shall include complete and compelling support for such request and shall include all actions completed by Seller to ensure the goods thus procured are not Counterfeit Items. Seller’s supporting documentation shall include: (i) results of authentication test and analysis conducted (reference SAE AS5553 ),

(ii) traceability with identification of all supply chain intermediaries wherever such traceability exists, and (iii) identification of and traceability to the source for any remarked or resurfaced material. Seller shall include the substance of this Section in any agreement between Seller and Seller’s lower tier subcontractors, including in any agreement between Seller and Seller’s Broker, and Seller shall cause Seller’s lower tier subcontractors and Seller’s Broker to include the substance of this Section in all agreements with any of their lower tier subcontractors.

11.1.12.2 Unless Buyer expressly identifies the goods that are procured under this Contract as nontechnical and for Buyer’s internal use only, Seller, as OM, Authorized Distributor, Authorized Aftermarket Manufacturer or Broker approved by Buyer, further warrants that it has and shall maintain a Counterfeit Item risk mitigation process, internally and with its suppliers, (reference SAE AS5553), for goods delivered hereunder, and in accordance with the standards or instructions set forth in any Buyer’s specifications and other required provisions and specifications incorporated into this Contract. Buyer shall have the right to audit, inspect, and / or approve the processes at any time before or after delivery of the goods ordered hereunder. Seller shall provide evidence of the Seller’s risk mitigation process to Buyer upon request. Buyer shall have the right to require changes to the processes to conform with Buyer’s defined standards, if any. Seller and Seller's lower-tier subcontractors that are allowed access to the US Government Industry Data Exchange Program (GIDEP) shall participate in monitoring GIDEP reports and Seller shall act on GIDEP reports that affect product delivered to Buyer. Seller shall immediately notify Buyer with the pertinent facts if Seller becomes aware of or suspects that items delivered for the Contract are, or contain, suspect or confirmed counterfeit items. Failure of the Seller or any of its lower-tier subcontractors to conform its processes with Buyer’s defined standards may result in the termination of this Contract in accordance with the termination provisions set forth herein. If, during Buyer’s inspection procedures, a good delivered hereunder is discovered to be a Counterfeit Item or Suspect Counterfeit Item, Buyer shall have the right to quarantine the good for further investigation of its authenticity. Buyer’s investigation may include the participation of third parties or governmental investigative agencies as required by law or regulations by Buyer’s customer, or by Buyer, in its sole discretion. The Seller and/or the Seller’s lower-tier subcontractors shall cooperate in good faith with any investigation conducted by Buyer, including, but not limited to, cooperation by Seller’s or Seller’s lower-tier subcontractor’s staffs responsible for the maintenance and disclosure of all design, development, manufacturing, and traceability records with respect to the good in possession of Seller or Seller’s lower-tier subcontractor. Upon Buyer’s request, Seller shall provide Buyer certificates of conformance with respect to the goods delivered. Buyer shall not be required to return the good to the Seller during the investigation process or thereafter. Buyer shall not be liable for payment to Seller of the price of any Suspect Counterfeit Items under investigation. When so authorized by Buyer, Seller shall be responsible for counterfeit risk mitigation testing and providing traceability identifiers (i.e.

Date Code / Lot Code, Serial number) for Broker procured parts, and identifying items delivered to Buyer that contain such parts. If Buyer determines in its sole discretion that there is credible evidence after visual inspection, testing, or other information that a good delivered under this Contract may have been misrepresented by the Seller or Seller’s lower-tier subcontractor and constitutes a Counterfeit Item or Suspect Counterfeit Item, Seller, or its lower-tier subcontractor, shall, if directed by Buyer to do so, issue a GIDEP alert and shall ensure suspect or confirmed Counterfeit Items are not delivered to Buyer. Buyer reserves its right hereunder, to issue its own GIDEP alert if, after investigation, Buyer concludes, in its sole estimation, that a good is a Counterfeit Item or Suspect Counterfeit Item.