Statement of Work.docx

STATEMENT OF WORK (SOW)

FOR

FURY PRODUCT SUSTAINMENT AND ENGINEERING

NAVAL AIR WARFARE CENTER WEAPONS DIVISION

CHINA LAKE, CALIFORNIA

CODE DB46200

24 September 2024

Distribution Statement D: Distribution authorized to the Department of Defense and U.S. DoD contractors only, Critical Technology, 18 June 2020. Other requests shall be referred to Naval Air Warfare Center Weapons Division, Code DB46200, 1 Administration Circle, China Lake, CA 93555-6100.

WARNING- EXPORT CONTROLLED: This document contains technical data whose export is restricted by the Arms Export Control Ac t (Title 22, U.S.C., Sec. 2751, et seq.), or the Export Administration Act of 1979 (Title 50, U.S.C., App. 2401 et seq.), as amended. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230

DESTRUCTION NOTICE: The contents of this document are controlled unclassified information (CUI). The federal CUI regulation requires that agencies destroy CUI "in a manner that makes it unreadable, indecipherable, and irrecoverable," (32 CFR 2002.14(f)(2)). It also prescribes National Institute of Standards and Technology (NIST) Special Publication (SP) 800-88, Revision l: Guidelines for Media Sanitization (December 2014) (NIST SP 800-88, rev 1) destruction methods, or any destruction method approved for Classified National Security Information (32 CFR 2001.47), unless the CUI category's authority mandates other destruction methods (CUI Specified categories). Agencies must also use any destruction method specifically required by law, regulation, or Government-wide policy for CUI Specified categories.

PURPOSE

The Aircrew Electronic Warfare Tactical Training Ranges (AEWTTR) Integrated Product Team (IPT) at the Naval Air Warfare Center Weapons Division (NAWCWD), China Lake, CA, is the system support activity (SSA) that provides engineering expertise for the Naval Aviation Training Systems Program Management Air (PMA 205) and Department of Defense (DoD) activities supporting the training and Test & Evaluation (T&E) Ranges. AEWTTR SSA engineering expertise includes oversight over the development, upgrade and life cycle sustainment of FURY products required to provide EW Threat Presentation and operational readiness. All work described in this Statement of Work (SOW) will be performed via delivery orders awarded under an Indefinite-Delivery Indefinite-Quantity (IDIQ) contract.

Training our troops for the next generation of warfare CorNic Technologies provides hardware and software solutions that help modernize today’s training environments.

Efficient vertical integration allows for rapid prototyping as well as fine-tuned solutions.

Background The AEWTTR IPT has been designated, by the Naval Air Systems Command (NAVAIR), to develop, sustain, and upgrade training systems aimed to improve aircrew Operational Readiness. Training systems include the family of FURY systems as reflected in Appendix A.

General Scope The scope of this SOW covers acquisition of products and services associated with FURY systems, supporting DoD and foreign, T&E, and Training Ranges (hereinafter Ranges) engaged in pre-deployment aircrew training and weapons and countermeasures development. The Contractor will be responsible for delivering both new and/or variants of existing FURY products as specified in individual Orders. The scope shall include: research, development, procurement, sustainment, upgrade, technology insertion, integration, testing, networking, cybersecurity, and Configuration and Data management (CM/DM). Appendix A is a representative list of FURY products covered under this acquisition.

APPLICABLE DOCUMENTS

a. Assistant Secretary of Defense (ASD) Networks and Information Integration (NII) Directive-Type Memorandum (DTM) 08-027 – Security of Unclassified DoD Information on Non-DoD Information Systems, 31 July 2009

b. Chief of Naval Operations/Headquarters, United States Marine Corps (CNO N614/HQMC C4) – Navy-Marine Corps Unclassified Trusted Network Protection (UTN-Protect) Policy, Version 1.0, 31 October 2002

c. CJCSI 6250.01F – Department of Defense Satellite Communications, 26 February 2019

d. CMS-1 Department of the Navy (DON) Communications Security (COMSEC) Policy and Procedures Manual, 01 Jul 2019

e. Department of Defense Instruction (DoDI) 5200.02 – Department of Defense Personnel Security Program, 11 May 2018

f. DoDI 8523.01 – Communications Security (COMSEC), 06 January 2021

g. DON Chief Information Officer (CIO) Memo 01-09 Information Assurance Policy for Platform Information Technology, 30 January 2009

h. DON DIACAP Handbook – DoD Information Assurance Certification and Accreditation Process (DIACAP) Handbook, 15 July 2008

i. MIL-STD-31000A – Technology Data Packages, February 2013

j. MIL-HDBK-61A – Configuration Management Guidance, 7 February 2001

k. National Security Telecommunications and Information Systems Security Policy (NSTISSP) No. 11 – Revised Fact Sheet National Information Assurance Acquisition Policy, July 2003

l. National Security Agency Central Security Service NSA/CSS Manual 1-52 Issue Date: 30 September 2013 Revised: 23 May 2014

m. OPNAVINST 2221.5D – Release of Communications Security (COMSEC) Material to U.S. Industrial Firms Under Contract to the U.S. Navy, 15 August 2016

n. Secretary of the Navy Instruction (SECNAVINST) 3070.2A Operations Security, 9 May 2019

o. SECNAVINST 5239.3C – Department of the Navy Information Assurance Policy, 02 May 2016

p. IEEE/EIA Std. 12207, November 2017

q. SECNAV M-5239.2 – Department of the Navy Cybersecurity Manual, 22 April 2022 Software Process Improvement Initiative (SPII) The Contractor shall follow the Software Development Plan (SDP) that they develop and submit in accordance with CDRL A007. The SDP will follow the framework of Institute of Electrical & Electronics Engineers (IEEE)/Electronics Industries Association (EIA) IEEE/EIA Std. 12207 regarding subject content, level of detail, and completeness. The SDP shall serve during contract performance as the benchmark for the Contractor’s software development effort and shall be periodically evaluated and updated as specified in the CDRL, as a part of continuous process improvement subject to Government review and approval.

REQUIREMENTS

The work shall be performed in accordance with individual Task/Delivery Orders (T/DOs) and Integrated Product/Project Baselines (IPBs). The Contractor shall apply systems engineering principles and practices to deliver complete end items, software, components, building blocks, assemblies, instrumentation, equipment, devices, documentation and spare parts associated with FURY. The Contractor shall provide performance specifications, manuals, Technical Data Packages (TDPs), reports, and drawings as specified by T/DOs. (CDRL A00R)

FURY Sustainment and Service Life Extension The Contractor shall maintain, repair, update, modify, test, deliver, and integrate components to the systems listed in Appendix A. Systems that require sustainment or service life extension may include software development and upgrade and/or hardware integration of end items. The Contractor shall maintain the Government-approved system configuration for hardware and software baselines. The Contractor shall conduct Engineering Investigations (EIs) based on failures and Deficiency Reports (DRs) submitted by Ranges. In conducting diagnostics of malfunctions and failures, the Contractor may determine parts to be beyond economical repair, obsolete, or are no longer available. If so, the Contractor shall identify a possible modification or alternate corrective action and provide the Government with an estimated cost to repair or modify, and an estimated completion time for the parts. If the end item configuration requires alteration, prior to conducting changes, the Contractor shall submit a change proposal for approval. The Contractor shall generate failure reports, Requests for Variance (RFVs), System Problem Reports (SPR) to remedy equipment failures. The Contractor shall document all maintenance required to repair the system. All documentation shall be stored in a Government-specified, web accessible, electronic library. System service life extension shall incorporate new modifications and enhancements into hardware/software baselines to extend systems service life. (CDRLs A001, A004, A008, A009, A00B, A00K, A00P, A00Q, A00S, A00X and A00Y).

Studies, Analyses, and Site Surveys The Contractor shall travel to ranges identified in Appendix B, analyze, assess, and provide upgrade solutions to improve functionality of currently fielded systems. Elements that shall be considered are quality, reliability, maintainability, interoperability, foreign threat intelligence data, frequency allocation applications, vulnerability to high-power irradiation, and EW threat presentation capabilities by the Ranges. The Contractor shall deliver the data and results of the analysis that shall include operational risk management (ORM) associated with the operation of FURY peripheral instrumentation, and networks. (CDRL A00N). Note: Appendix A and Appendix B are not all inclusive. Additional ranges, systems and equipment could be identified under individual T/DO.

FURY SSA

The Contractor shall provide engineering, configuration management/data management (CM/DM), and logistics, in support of AEWTTR IPT located at NAWCWD China Lake. The Contractor shall respond to trouble calls from the Ranges and provide corrective actions and inventory status. The Contractor shall provide a response to the requests within 5 business days of received trouble call. (CDRL A00L) Cybersecurity System Accreditation The Contractor shall provide the technical expertise needed to develop and maintain all documentation and testing in support of building cybersecurity authorization package IAW the most current version of Department of Defense processes. The Contractor shall develop and maintain all documentation and testing in support of Interim Authority to Test accreditations in support of new technologies or operational exercise requirements. The Contractor shall prepare and submit appropriate accreditation documentation for any modification to systems that include updated network topologies, hardware and software lists, and any Ports, Protocols, and Services. (CDRL A00N and A00S) Cybersecurity Sustainment

3.4.2.1 Vulnerability Management

The Contractor shall institute a scan– remediate–rescan and validation methodology covering all systems utilizing the DISA Assured Compliance Assessment Solution or other current DoD mandated tool. The Contractor shall, at a minimum, scan systems on a monthly basis to ensure remediation efforts are successfully implemented and provide a list of approved updates. The Contractor shall also ensure all applicable STIGs are applied and remediated. On a quarterly basis the Contractor shall review STIG updates and new STIG issuances and conduct checks on all systems and devices. (CDRL A00N and A00S)

3.4.2.2 Patch Management

The Contractor shall develop documented patch management procedures establishing a methodology for patching and confirming patch management compliance. At minimum, the procedures shall ensure the following: 1) No unresolved Category I findings past 30 days, and no unresolved Category II findings past 120 days; 2) Compliance with Information Assurance Vulnerability Management requirements, and; 3) Timely application of the latest operating system and software security updates and patches. Following the procedures, the Contractor shall provide patching support. The Contractor shall deploy patches and upgrades to systems under task to address information security vulnerabilities after they are reviewed, tested and tailored for appropriate system configuration. The deployment process shall ensure effective mitigation efforts are made to address issues that cannot be remediated with patches or fixes. (CDRL A00N and A00S) Cybersecurity Workforce The Contractor shall ensure that its Cybersecurity Workforce (CSWF) personnel are identified, categorized, certified, qualified and/or otherwise competent for their assigned tasking IAW all applicable DoD directives, instructions, manuals and policies and updates thereto, including the most current version of SECNAV M-5239.2. All identified training certifications will be provided to the COR.

Training The Contractor shall create or modify documentation covering the operational procedures of newly developed or modified FURY products. The Contractor shall provide training for the operation of systems and the preventive field maintenance of systems and components. Training may include hands-on training, classroom training, instruction manuals, or online tutorials. (CDRL A001 and A006)

Future Capabilities The Contractor shall assess new FURY products and their impact on Aircrew Training Systems. The Contractor shall create concepts, engineering models, prototypes, surrogates of production units and integrate into ranges capabilities, combat training systems and readiness. (CDRL A001, A00B, A00C, and A00W) New Capabilities Production and Fielding The contractor shall develop and produce product updates or new capabilities and solutions as required to fill aircrew and ship-board training needs.

FURY User Group/Program Events & Support The contractor shall coordinate and host an annual user group meeting including the AEWTTR IPT to maintain the communication channels, support ongoing issues resolution, discuss future FURY capability needs and other program activities including program management reviews as required as funded at the order level. (CDRL A003) FURY Products The contractor shall deliver products from Exhibit B FURY Products Ordering Schedule as specified in individual delivery orders.

Future FURY Products As the contractor adds products to its product line, the contractor shall provide the Government with sufficient pricing information to allow the Government to conduct a cost/price analysis and potentially add those products to Exhibit B for future ordering under CLIN 0004.

DELIVERABLES

Monthly Status Report The contractor shall submit a status report in accordance with CDRL A00L detailing progress on current tasking, problems encountered and proposed solutions, anticipated changes to delivery dates, financial status (including expenditures by Contract Line Item Number (CLIN), and hours by labor category), and effort to achieve each order’s requirements.

Quality Assurance (QA) The Contractor shall conduct QA in accordance with the T/DO and applicable documents. The Contractor shall deliver QA audits conducted on products and software development processes. QA audits shall cover project initialization, project planning, project execution, project closure, requirements management, CM, subcontracting, metrics collected, material purchases. (CDRL A00Z) Configuration Management The Contractor shall submit a Configuration Management Plan (CMP) in accordance with CDRL A005 to serve, during the contract performance period, as the benchmark for controls to be used for effective software, hardware, and firmware configuration. The CMP shall be periodically evaluated and updated as specified in CDRL A005, as part of continuous process improvement efforts subject to Government review and approval.

Product Delivery Schedule As required by individual T/DOs, the Contractor shall provide a delivery schedule.

Lifecycle Sustainment Plan (LCSP) The contractor shall provide and maintain a Lifecycle Sustainment Plan in accordance with CDRL A00U. The LCSP shall be evaluated and updated as specified in CDRL A00U.

general INFORMATION Ordering Procedures for CLIN 0005 FURY Product and Sustainment Support When the Government identifies services required under paragraphs 3.1 – 3.8 that do not fall under CLINs 0001 and 0003, the requirement will be provided to the Contractor. Upon receipt of the requirement, the Contractor shall provide a proposal to complete the work, which the Government will evaluate for fair and reasonable pricing. The Government may then issue a task order to the Contractor for completion of the work. Examples of such work may include (but is not limited to) troubleshooting, evaluation of hardware for repair, repair of hardware, training and attending meetings with Government personnel.

Government-Furnished Equipment (GFE) The Government will provide threat systems and equipment that will be called out in applicable IPBs applicable to each order. (CDRL A00T) Travel The Contractor shall be required to travel in performance of this contract. The Contractor shall be responsible for all transportation, billeting, and messing for the Contractor personnel except in those cases where Government transportation, billeting, and messing are the only services available. All travel will require prior approval of the Technical Point of Contact (TPOC) and COR. All travel shall be conducted in accordance with the Joint Travel Regulations in force during the term of this contract. (CDRL A003) Facilities The Contractor shall perform the above-delineated requirements at a variety of locations and using a variety of Government and Contractor provided facilities as required by the T/DO.

Contractor Facilities The Contractor shall maintain suitable facilities for the execution of those tasks not requiring specific performance at Government facilities. The Government will not provide facilities unless use of a specific facility at a specific location is necessary to the execution of the T/DO. These facilities shall meet the security requirements as outlined in the applicable DoD Contract Security Classification Specification (DD Form 254, Attachment 2).

DoD/Foreign Facilities The Contractor shall perform specified tasks (such as installation, integration, and testing) at various DoD locations, foreign range locations, or Subcontractor and vendor facilities. Appendix B provides a list of potential range work locations.

Data Rights The contract contains clauses defining the Government’s rights regarding technical data generated under orders issued during the term of the contract. Other than restrictions associated with commercially available products, the Contractor shall not use its own proprietary data or intellectual property in the performance of this contract without prior approval of the Government. The Contractor shall notify the Government of its intent to use any intellectual property with less than unlimited rights prior to responding to a Request for Proposal (RFP) for a new order and shall provide a completed Data Rights Assertion List as required in Defense Federal Acquisition Regulation Supplements (DFARSs) 252.227-7013 and 252.227-7014.

SECURITY

Security Requirements for Classified Programs The security requirements specified herein shall apply to the Contractor and Subcontractors. The Contractor shall safeguard classified information and meet the security requirements and IA/cybersecurity requirements identified in the applicable DoD Contract Security Classification Specification (DD Form 254). The Contractor shall enforce these safeguards throughout the life of the contract.

Personnel Security Requirements The Contractor shall provide personnel with the appropriate personnel security clearance levels for the work to be performed. Access to Secret information is required in the performance of this contract and shall be in accordance with the 32 CFR Part 117, Feb 2021, National Industrial Security Program Operating Manual (NISPOM), applicable DoD personnel security regulations, and DoD Contract Security Classification Specification (DD Form 254). The Contractor shall maintain sufficiently cleared personnel to perform the tasks required by this SOW IAW the DD Form 254 and the contract. All Contractor personnel shall possess the requisite security clearance, accesses, and need-to-know commensurate with the requirements of their positions.

All Contractor personnel with access to unclassified information systems, including e-mail, shall have at a minimum a favorable Tier 3 (T3) investigation.

Operations Security (OPSEC). The Contractor shall comply with the OPSEC requirements outlined within the DD Form 254.

The Contractor shall develop, implement, and maintain an OPSEC program to protect controlled unclassified activities, information, equipment, and material used or developed by the Contractor and any Subcontractor during performance of the contract. The Contractor shall be responsible for the Subcontractor implementation of the OPSEC requirements. The OPSEC program shall be in accordance with DoD and DON operations security (OPSEC) requirements, to include:

1) Assignment of responsibility for OPSEC direction and implementation

2) Planning guidance for the use of the OPSEC Process to identify vulnerabilities and apply applicable countermeasures (Contact NAWCWD Industrial Security Office for a current OPSEC Annex and CI Guide)

3) Establishment of OPSEC education and awareness training

4) Provisions for management, annual review, and evaluation of OPSEC programs

5) Oversight for accountability of OPSEC requirements to Subcontractors

The Contractor shall enforce these safeguards throughout the life of the contract. The Contractor shall prepare an OPSEC plan for Government review in accordance with (CDRL A00M).

Information Security (Access to CUI, For Official Use Only, or Government IT Systems) Direct support Contractor personnel working under the purview of a DON Commanding Officer/Commander shall comply with the local security provisions and the requirements of SECNAV M-5510.36 (series). The Contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of CUI and to control distribution of CUI in accordance with NISPOM 32 CFR Part 117, 24 Feb 2021, and SECNAVISNT 5510.36B (series).

CUI information generated and/or provided under this contract shall be marked and safeguarded as specified in DoDI 5200.48, Controlled Unclassified Information (CUI). Contractor shall not store or transmit CUI on personal information technology systems or via personal e-mail. Unclassified e-mail containing any DoD CUI shall be encrypted. Prior to sending CUI to any non-Navy Marine Corps Internet (NMCI) addressees, the sender must first positively verify all recipients are authorized access to CUI and have need-to-know. Non-NMCI recipients must have a DoD compliant Private Key Infrastructure (PKI) certificate that enables electronic transmission via unclassified networks while protecting the CUI with a digital signature and encryption.

Common Access Cards (CACs) The CAC shall be the principal identity credential for supporting interoperable access to DoD installations, facilities, buildings, and controlled spaces. All Contractor CAC applications will be sent to the appointed NAWCWD COR Trusted Agent(s) to ensure vetting requirements have been met.

Communications Security (COMSEC) The Contractor will require access to COMSEC at Government/Contractor locations. U.S. cryptographic equipment inventory information, as well as the systems and manner in which each particular equipment is used, is for official use only. Publication or release of any related COMSEC information by any means, by the Contractor, without prior written approval of the Contracting Officer is prohibited. The Contractor must be a U.S. citizen, have a final Government security clearance with the appropriate personnel security background investigation for the level of classification involved, have strict need-to-know, have the appropriate COMSEC briefing before access is granted, and granted access only in conformance with procedures established for the particular type of COMSEC information involved. The Contractor shall adhere to the DD Form 254 COMSEC security requirements, facility COMSEC material control and operating procedures, and all applicable COMSEC regulations, instructions, and policies. Prior approval from the Government Contracting Activity is required in order for a prime Contractor to grant COMSEC access to a Subcontractor.

Public Release Disclosure of information is covered by DFARS 252.204-7000 Disclosure of Information, incorporated in Section I of the contract. Concerning subsection (a)(2), “information otherwise in the public domain” is information officially released into the public domain, e.g., via Distribution Statement A, and does not include information in the public domain that has not been officially released. For disclosure of unclassified information that has not been officially released, the Contractor must seek specific approval from the Contracting Officer, with approval from the NAWCWD Public Affairs Office (PAO).

ACRONYMS

QA Quality Assurance

VPN Virtual Private Network

Appendix A FURY Systems and Peripheral Instrumentation

FURY C4ISR Emulator System

FURY System Operation Console

FURY Transmit Site

FURY Receive Site

FURY V Transceiver

FURY Real Radio System

FURY Real Radio System Operation Console

FURY Real Radio Transceiver Site

FEVR System

FEVR System Operation Console

FEVR Receiver Site

FURY Optical Stimulators

Programmable LED Source (PLEDS)

Programmable LED Source Power Supply/Control Unit (PLEDS PS)

Handheld UV Programmable LED Source

Fixed UV Programmable LED Source

FURY Az/El Pedestal Controller (PEDC)

FURY Threat Simulator System

This page intentionally left blank.

A-1 Appendix B

POTENTIAL SITES FOR FURY SYSTEMS WORK

The listed sites are representative of potential work locations but are not intended to be all-inclusive.

Patuxent River, MD

Twenty-nine Palms, CA San Nicolas Island, CA

NAS, North Island, San Diego, CA

San Clemente Island, CA

White Sands Missile Range, NM

Point Mugu, CA

Fort Irwin, CA

NAWCWD,

China Lake, CA

B-2 Appendix C CDRLs

C-2