Statement of Work.docx

Statement of Work (SOW) NSWCPD Code 515 LHD/A & Aegis Ashore MCS HM&E Engineering Support Services

1.0 INTRODUCTION

1.0.1 The Naval Surface Warfare Center Philadelphia Division (NSWCPD) is a Department of Defense entity responsible for research and development, software development, test and evaluation, engineering and fleet support organization for the Navy’s ships, submarines, military watercraft and unmanned vehicles. This requirement is for NSWCPD Code 515, which supports acquisition and life cycle support on the LHD_A Amphibious Assault, CG Surface Combatant Class ships and Aegis Ashore. With respect to the Aegis Ashore program, all references herein to “ship” or “shipboard” are used interchangeably with the mission-critical systems at Aegis Ashore sites.

1.0.2 This contract is for non-personal services. It does not create employment rights with the U.S. Government whether actual, inherent, or implied.

1.0.3 Government/Contractor Relationship

1.0.3.1 The services to be delivered under this Task Order are non-personal services and the parties recognize and agree that no employer-employee relationship exists or will exist under the Task Order between the Government and the Contractor's personnel. Therefore, it is in the best interest of the Government to provide both parties a full understanding of their respective obligations.

1.0.3.2 The Contractor employees shall identify themselves as Contractor personnel by introducing themselves or being introduced as Contractor personnel and displaying distinguishable badges or other visible identification for meetings with Government personnel. In addition, Contractor personnel shall appropriately identify themselves as Contractor employees in telephone conversations and in formal and informal written correspondence.

1.0.3.3 Contractor personnel under this Task Order shall not engage in any of the inherently governmental functions listed at FAR Subpart 7.5 or DFARS Subpart 207.5.

1.0.4 Employee Relationship:

1.0.4.1 The services to be performed under this Task Order do not require the Contractor or its personnel to exercise personal judgment and discretion on behalf of the Government. Rather the Contractor's personnel will act and exercise personal judgment and discretion on behalf of the Contractor.

1.0.4.2 Rules, regulations, directives, and requirements that are issued by the U. S. Navy and NSWCPD under its responsibility for good order, administration, and security are applicable to all personnel who enter a Government installation or who travel on Government transportation. This is not to be construed or interpreted to establish any degree of Government control that is inconsistent with a non-personal services contract.

1.0.4.3 Inapplicability of Employee Benefits: This Task Order does not create an employer-employee relationship. Accordingly, entitlements and benefits applicable to such relationships do not apply.

1.0.4.4 It is the Contractor's, as well as the Government's, responsibility to monitor Task Order activities and notify the Contracting Officer if the Contractor believes that the intent of this Section has been or may be violated.

1.0.4.4.1 The Contractor shall notify the Contracting Officer in writing via letter or email within three (3) calendar days from the date of any incident that the Contractor considers to constitute a violation of this Section. The notice should include the date, nature, and circumstances of the conduct; the name, function, and activity of each Government employee or Contractor official or employee involved or knowledgeable about such conduct; identify any documents or substance of any oral communication involved in the conduct; and the Contractor's estimated date when, absent a response, cost, schedule or performance will be impacted.

1.0.4.4.2 The Contracting Officer will, within five (5) calendar days after receipt of notice, respond to the notice in writing. In responding, the Contracting Officer will either:

1.1 BACKGROUND

The Cyber secure Hull, Mechanical, & Electrical (HM&E) Control Systems & Networks Department (NSWCPD Department 50) supports US Navy HM&E Controls, Navigation, Casualty Control, Conditioned-Based Maintenance, and Network Systems on all US Navy Surface Combatant, Amphibious, and Aircraft Carrier ships.

The MCS (LHD/A, CG47 and Aegis Ashore Branch Code 515) provides Acquisition, Modernization, life cycle maintenance of MCS and provide In Service Engineering Agent (ISEA) and Software Support Agent (SSA) support for the machinery control systems assigned to our branch. Support provided includes the software and hardware design development, prototyping and implementation of Hull, Mechanical and Electrical (HM&E) modernization, acquisition programs and in-service initiatives at the land based testing facility and onboard U.S Navy vessels. The work to be performed includes all activities associated with various Control Systems, computer program development, testing, equipment harvesting and installation on both in-service and new-ship-construction.

Tasks include performing systems engineering analysis in order to interface control systems with other new or modified shipboard systems; troubleshooting control system hardware issues at the Land Based Engineering Site/Test Facilities in Philadelphia, PA as well as sustainment and fleet modernization efforts around the world; upgrading the cyber security features of the existing and future Control System (CS/IS) variants; addressing obsolete hardware with the most cost effective solutions possible.

1.2 SCOPE OF WORK

1.2.1. The contractor shall provide cybersecurity support to US Navy equipment and MCS within LHD/A, Aegis Ashore, CG47 Surface ships platforms. Tasking includes, but not limited to the following:

1.2.1.1 Cybersecurity posture sustainment tasks related to new and existing MCS software and hardware. The tasking will be in relation to Risk Management Framework (RMF) packages, cyber posture maintenance of the land based test environment, also known as ashore, and afloat RMF packages for the Controls Systems on New Acquisition Ships and In-Service Ships.

1.2.1.2. Development of RMF deliverables, testing, equipment scanning, answering cybersecurity controls, and applying cybersecurity controls to equipment contained in RMF package. Systems to support include MCS for LHD, LHA and CG (in-service & new acquisition ships) and Aegis Ashore Platforms. Support will also include program /tasking review meetings.

1.2.1.3 Control System testing related to new and existing MCS software to include program management, logistics and technical support. Tasking will be in relation to direct ship support efforts to the fleet as well as lab design, testing, and setup.

1.2.1.4. Development of Ship Change Documents (SCD), Engineering Change Requests (ECR), Design Decision Memorandums (DDM), Problem Reports (PR), Change Requests (CR) and Alteration Work Instruction (AWI) for ship system alterations including review of technical documentation, procedure development and implementation, as well as equipment and parts procurement assistance for planned modernization projects; develop, update and review logistical documentation associated with Hull, Mechanical and Electrical (HM&E) systems and equipment; data collection and technical support for Naval Surface Warfare Center Philadelphia Division (NSWCPD).

1.2.1.5. Provide onsite support for LHD 8, LHA 6, LHA 7 and CG Class and Aegis Ashore assessments, troubleshooting and emergent fleet support of ECS issues and failures. Support consists of, but not limited to; testing, design validation, integrated logistic support validation, training and/or operational validation.

1.2.1.6. Manage and maintain all aspect of NSWCPD System Engineering Process (SEP) while conducting ship changes.

1.2.1.7. Technical support to the Ship Design Manager (SDM), Technical Warrant Holder, Navy Technical Authorities (NTA), TYCOM and Program Office in the area of In service and Acquisition activities. The Contractor shall support the review and assessment of detailed design and construction drawings, reports, deviation/waiver requests, emergent issues in Continuous Observation & Risk Evaluation (CORE) activities and hull specific events such as Acceptance Trials (AT), Final Contract Trials (FCT), Combat Support System Onboard Testing (CSSOT), Dock Trials (DT), Builder Trials (BT), and various other events; and support will also include administration support for program / tasking review meetings.

1.2.1.8 The Contractor shall provide acquisition and life cycle engineering and technical services support required for the design, development, fabrication, test, repair, and fleet implementation of Machinery Control System on the LHD/A, Aegis Ashore, CG47 Surface ships. Naval surface ships require modernization-engineering, life cycle in- service engineering support. This effort is to help ensure readiness and safety criteria are met. The work to be performed includes all activities associated with LHD 8, LHA 6, LHA 7, LHA 8 and LHA 9 amphibious Assault, CG Surface Combatant, and Aegis Ashore Machinery Control Systems, computer program development, systems engineering, testing, equipment harvesting, reviewing new acquisition ship CDRL, waterfront support and installation for new ship construction and in service ships.

The Contractor shall provide Code 515 deliverables that may include performing cybersecurity analysis and systems engineering analysis. Software development experience is required in order to interface control systems with other new or modified shipboard systems; troubleshooting control systems hardware and software issues. Work will be conducted at the Land Based Engineering Site/Test Facilities in Philadelphia, PA and aboard US naval vessels, as well as sustainment efforts around the world; upgrading the cyber security features of the existing and future control system variants; and addressing obsolete hardware with the most cost effective solutions possible. This is required to support the control systems design, software and hardware development, fabrication, test, repair, DMS support and fleet implementation to Machinery Control Systems.

2.0 APPLICABLE DOCUMENTS

The Contractor shall reference and utilize the latest version available when performing tasks within this PWS.

3.0. REQUIREMENTS

3.1 Machinery Control System (MCS) Computer Program Development and Engineering Services for LHDA MCS and Aegis Ashore Program Engineering Services: To ensure the readiness and Safety of Navy Surface ships, NSWCPD is responsible for the software development, prototyping and acquisition/lifecycle support of the CS/IS computer programs development and engineering services at the Land Based Test Facility (LBTF), shipboard and support of the Aegis Ashore Missile Defense Test Complex (AAMDTC) and LHD 8, LHA 6 and LHA 7 Machinery Control Systems. In support of this mission, the Contractor shall:

3.1.19 Troubleshoot issues that come up during testing and identify root cause and solutions to issues to enable testing to continue.

3.2 LHD 8, LHA MCS and AAMDTC CS/IS Systems Testing and Integration Engineering Services. The contractor shall provide the following services:

3.2.6 Assist onsite engineering support at the AAMDTC related the installation and troubleshooting of BAS,

3.2.7 Assist technical distance support related to troubleshooting of the AAMDTC BAS, PCMS, and PQMS.

3.3 LHD 8, LHA MCS and AAMDTC LBES/TF Equipment Integration Support: The LBES/TF (Land Based System) offers cost effective, risk mitigation solutions to test and provide integrated systems for operational effectiveness for Surface Combatant vessels. In support of this mission, the Contractor shall:

3.4 LHD/A MCS Shipboard and Aegis Ashore Missile Defense Test Complex Troubleshooting, Test, and Installation. The contractor shall provide the following services:

3.4.20 Assist onsite training support for the operations and maintenance of the AAMDTC BAS, PCMS, and PQMS

3.4.20 Assist onsite validation support following all BAS, PCMS, and PQMS system changes.

3.5 LHD 8, LHA MCS and AAMDTC Algorithm/ Software Development and Implementation The contractor shall provide the following services:

3.6 LHD 8, LHA MCS and AAMDTC Cybersecurity and Information Assurance (IA). The contractor shall provide the following services:

3.7 LHD 8, LHA MCS and AAMDTC Material and Asset Support

3.8.2 Troubleshooting problems on deployed operation systems and systems in the development phase.

3.10 Obsolescence Support. As Navy Surface ships age, obsolescence management is needed to keep the ships in working order. The obsolescence program identifies systems that are at or near end of life and develops solutions for them. In order to support this mission, contractors shall perform the following:

3.10.1 General CS/IS Support Services

3.10.1.1 Lifecycle support of the supervisory control systems/information systems.

3.10.1.2 Troubleshooting problems on deployed operation systems and systems in the development phase.

3.10.1.3 Review of technical documentation related to all variants of deployed systems and systems in the development phase.

3.10.1.4 Provide technical input to the design of CS during the development phase.

3.10.1.5 Develop test procedures to exercise requirements of fielded systems and future fielded systems.

3.10.2 Obsolescence Project Management

3.10.2.1 Support obsolescence projects from identification to solution.

3.10.2.2 Assist in managing the business and engineering obsolescence concerns of various stakeholders.

3.10.2.3 Develop solutions to difficult problems with regard to balancing cost, need date, integration into existing systems, conflicting stakeholder desires, and other factors.

3.10.2.4 Develop technical plans and solutions for complex obsolescence problems. Update and maintain plan as project progresses.

3.10.2.5 Develop budget estimates for project material and manpower needs. Update and maintain budget as project progresses.

3.10.2.6 Develop time estimates and schedules for projects. Update and maintain schedule as project progresses.

3.10.3 Obsolescence Project Tasking Skills

3.10.3.1 Identify obsolescence issues through proactive expert knowledge of the systems situations by working with other groups and departments, and by using available data and reports.

3.10.3.2 Create, review, update, and execute test procedures.

3.10.3.3 Create, review, and update technical documentation.

3.11 Cybersecurity and Information Assurance (IA). The contractor shall provide the following services:

3.11.1 Provide technical services in support of delivering cyber-secure systems and solutions including the development and submittal of Risk Management Framework (RMF) risk assessments, implementation of DoD secure system configuration and hardening requirements identified in Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs), Assured Compliance Assessment Solution (ACAS) vulnerability assessments, anti-virus (AV) scanning, Standard Engineering Process (SEP) artifacts, and other supporting documentation required for certifying and maintaining afloat, RDT&E, and/or enterprise platforms.

3.11.2 Develop RMF Assess & Authorize (A&A) package documentation in accordance with DoD/NAVSEA directives, which includes the following components: PIT Determination package documentation, System Categorization Form, Information System Continuous Monitoring Strategy (ISCM), Security Plan (SP), Step Concurrence forms, Plan of Actions and Milestones (POA&M), Security Assessment Plan (SAP), Security Assessment Report (SAR), Risk Assessment Report (RAR), Security Authorization Package, CYBERSAFE Certification, Package Endorsement Letters, and any additional administrative/technical resources required for submission.

3.11.3 Ensure RMF A&A package is submitted to the certification authority (CA) in sufficient time for review and operational cybersecurity risk recommendation to obtain Designated Accrediting Authority (DAA) authorization decision prior to operations or tests on a live network (i.e. LBES or shipboard).

3.11.4 The contractor shall develop, maintain, and execute all IA related tasks and duties in accordance with regulations to include the development and execution of DIACAP/RMF Program to Plan of Action and Milestone (POA&M) or Security Technical Implementation Guide (STIG).

3.11.5 In accordance with DIACAP/RMF, the contractor shall monitor and maintain the security posture of IT systems to include patching, implementing STIGs, analyzing network traffic, and applying new physical security measures.

3.11.6 Develop and/or test new and existing security features to be implemented into the CS/IS operating environment and/or software.

3.12 Project and Administrative Management Support

3.12.1 Participate in technical meetings and program reviews to provide action-item-tracking support and to draft meeting minutes.

3.12.2 Develop Plan of Actions and Milestones (POA&Ms) for initiatives, and provide status on the progress of those milestones.

3.12.3 Generate project plans, concepts of operation, and management outlines.

3.13 Logistics Specialist Support – Logistics Specialists shall:

3.13.1 Perform Test Plans.

3.13.2 Prepare Test Reports.

3.13.3 Perform Data Collection and Statistical Analyses.

3.13.4 Interpret Command and Department Guidance.

3.13.5 Perform financial analysis and track man-hours/time related data.

3.13.6 Enter shipping requests into Navy ERP (Enterprise Resource Planning).

3.14 Configuration Management Support – The contractor shall provide the following services:

3.14.1 In accordance with locally established Quality Assurance (QA) configuration control practices, the contractor will be required to implement and maintain proper configuration management of equipment, software, and documentation using processes compliant with Capability Maturity Model Integration (CMMI) Level 3.

3.14.2 The contractor shall implement configuration version control practices and processes (checkout/check-in, version number control, system/software baselines, merge, build, testing, and release) to software, hardware, requirements, firmware, images, technical manuals, test procedures, and support documentation.

3.14.3 The contractor shall provide configuration version control using locally established forms, templates, databases, and applications (GIT, Telelogic DOORS, SharePoint, Excel, Word, Access, and Project).

3.15 Manufacturing Phase-Out or Discontinuation of Production, Diminishing Sources, and Obsolete Materials or Components

3.15.1 The contractor shall notify the contracting officer immediately upon determining the unavailability of obsolete materials or components. The contractor may recommend a solution to include the impact on the contract price and delivery. The contractor shall not initiate any item redesign or incur any additional costs without the express, written authorization of the contracting officer.

4.0 DATA REQUIREMENTS

4.1 Contract Status Report (CDRL A001)

4.1.1 This report shall reflect both prime and Subcontractor data if applicable at the same level of detail.

4.1.2 The CDRL shall be delivered electronically, unless otherwise stated. Approval of contractor format is required from the COR.

4.2 Travel Report (CDRL A002)

4.2.1 This report shall reflect both prime and subcontractor data if applicable at the same level of detail.

4.2.2 The CDRL shall be delivered electronically, unless otherwise stated, and while Contractor’s format is acceptable, Government’s approval is required from the COR.

4.2.3 The Contractor may be required to travel in performance of this task order. The numbers of trips and types of personnel traveling shall be limited to the minimum required to accomplish work requirements and shall be coordinated with the COR. All travel shall be conducted in accordance with FAR 31.205-46 Travel Costs and the Federal Travel Regulations (FTR) and shall be pre-approved by the COR. The Contractor shall submit travel reports in accordance with DI-MGMT-81943 (CDRL A002).

4.3 Contractor’s Personnel Roster (CDRL A003)

4.3.1 The CDRL shall be delivered electronically, unless otherwise stated, and while Contractor’s format is acceptable, Government’s approval is required from the COR. This report shall reflect both prime and subcontractor data if applicable at the same level of detail.

4.3.2 The CDRL shall be delivered electronically, unless otherwise stated, and while Contractor’s format is acceptable, Government’s approval is required from the COR.

4.4 CSWF Training and Certification (A022)

4.4.1 This item shall reflect both prime and subcontract data if applicable at the same level of detail. This item is documentation of the completion of training and certifications related to NSWCPD Cyber Security Work Force (CSWF) requirements.

4.5.2 The CDRL shall be delivered electronically, unless otherwise stated, and while Contractor’s format is acceptable, Government’s approval is required from the COR.

5.0 SECURITY REQUIREMENTS

5.1 SECURITY TRAINING. The Contractor is responsible for completing all required Government mandated training to maintain security and network access to government sites and IT systems to include but not limited to: Antiterrorism Level 1 Awareness; Records Management in the DON: Everyone's Responsibility; Training and Readiness: The Active Shooter; NAVSEA Introduction to Controlled Unclassified Information; Operations Security (OPSEC); NAVSEA Counterintelligence Training; Privacy and Personally Identifiable Information (PII) Awareness Training; NAVSEA Physical Security training and Cybersecurity 101 Training. Certificates of successful completion shall be sent to the COR and as otherwise specified in the contract.

5.1.1 In accordance with the National Industrial Security Program Operating Manual (NISPOM) (37 CFR Part 117), Contractor personnel that require access to Department of Navy (DON) information systems and/or work on-site require an open investigation or favorable adjudicated Tier 3 by the Vetting Risk Operations Center (VROC). An interim clearance is granted by VROC and recorded in the Defense Information System for Security (DISS). An open or closed investigation with a favorable adjudication is required prior to issuance of a badge providing access to NSWCPD buildings. Furthermore, if the Navy Central Adjudication Facility, have made an unfavorable determination access will be denied. For Common Access Card (CAC) you must have an open investigation and/or a favorably adjudicated investigation. Interim security clearance are acceptable for a CAC. Access will be denied for anyone that has eligibility pending in DISS. Vetting through the National Crime Information Center, Sex Offender Registry, and the Terrorist screening database shall be process for a contractor that does not have a favorable adjudicated investigation.

5.1.2 Within 30 days after contract award, the contractor shall submit a list of all contractor personnel, including subcontractor employees, who will have access to DON information systems and/or work on-site at one of the NSWCPD sites to the appointed Contracting Officer Representative (COR) via email. The contractor shall provide each employee's first name, last name, contract number, the NSWCPD technical code, work location, whether or not the employee has a CAC and or Standard Access Control Badge (SACB), the systems the employee can access (i.e., NMCI, RDT&E), and the name of the Contractor's local point of contact, phone number and email address. Throughout the period of performance of the contract, the Contractor shall immediately provide any updated information to the COR when any Contractor personnel changes occur including substitutions or departures.

5.2 ON SITE WORK. Contractor personnel that require a badge to work on-site at one of the NSWCPD sites must provide an I-9 form to verify proof of citizenship. The I-9 form should be signed by the company Facility Security Officer or the company Human Resource Department. In addition to the I-9 form, Contractors shall also bring their birth certificate, current United States Passport or naturalization certificate and state issued ID to the NSWCPD Security Officer at the time of badge request to verify citizenship. Any contractor that has unfavorable information that has not been favorably adjudicated, by Department of Defense Central Adjudication Facility (DOD CAF) will not be issued a badge. Finally, contractors shall supply a copy of their OPSEC Training Certificate or other proof that the training has been completed.

5.2.1 In accordance with NSWCPD security protocol, contractor employees who hold dual citizenship will not be granted security clearance to our facilities.

5.3 DD254 REQUIREMENT. This effort may require access to classified information up to the SECRET level. No classified data will be generated or stored by the Contractor. The Contractor is required to have and maintain a SECRET clearance. The requirements of the attached DD Form 254 apply.

5.3.1 The contractor is required to maintain a Facility Security Clearance (FCL) in accordance with the DD254 to perform certain work under the contract. Although it is not required at time of award, it shall be obtained within 7 after award. Otherwise the government will have no obligation to continue ordering work under the contract and may not exercise any of the available options.

5.3.2 The Contractor shall appoint a Facility Security Officer (FSO), who shall (1) be responsible for all security aspects of the work performed under this contract, (2) assure compliance with the National Industrial Security Program Operating Manual (NISPOM) (32 CFR Part 117), and (3) assure compliance with any written instructions from the NSWCPD, Security Office.

5.3.3 The contractor shall forward signed copies of DD254s provided to subcontractors to the Naval Surface Warfare Center Philadelphia Division (NSWCPD), ATTN: Security.

5.3.4 The contractor shall direct the subcontractor to obtain approval, through the prime Contractor, for the public release of information received or generated by the sub through the prime Contractor.

5.3.5 The contractor shall submit the subcontractor request for public release through the technical point of contact identified on the DD 254.

5.4 OPERATIONS SECURITY (OPSEC)

5.4.1 The Contractor shall protect critical information associated with this contract to prevent unauthorized disclosure. The NSWC Philadelphia Division's (NSWCPD) Critical Information List (CIL)/ CIIL (Critical Indicators and information list) will be provided on site, if warranted. Performance under this contract requires the contractor to adhere to OPSEC requirements. The Contractor may not impose OPSEC requirements on its subcontractors unless NSWCPD approves the OPSEC requirements. During the period of this contract, the Contractor may be exposed to, use, or produce, NSWCPD Critical Information (CI) and/or observables and indicators which may lead to discovery of CI. NSWCPD’s CI will not be distributed to unauthorized third parties, including foreign governments, or companies under Foreign Ownership, Control, or Influence (FOCI) unless such FOCI has been appropriately mitigated through measures approved by the Defense Counterintelligence and Security Agency. Questions concerning these requirements shall be directed to the PCO.

5.4.2 CUI correspondence transmitted internally on the contractor's unclassified networks or information systems, and externally, shall be protected per NIST SP-800-171, Protecting Controlled Unclassified Information (CUI) in Non-federal Systems and Organizations.

Assembled large components/systems being transported to and from testing areas, other production or government facilities (whether or not on public roadways) shall be in an enclosed van trailer or covered flatbed trailer. Component/System outside storage, staging, and test areas shall be shielded/obscured from public view wherever physically possible.

5.4.3 NSWCPD’s CI shall not be publicized in corporate wide newsletters, trade magazines, displays, intranet pages or public facing websites. Media requests related to this project shall be directed to the PCO, and the COR who will forward the required to the NSWCPD Public Release Authority for review.

5.4.4 Any attempt by unauthorized third parties to solicit, obtain, photograph, or record, or; incidents of loss/compromise of government Classified or CI, Business Sensitive, Company Proprietary information related to this or other program must be immediately reported to the contractor's Facility Security Officer and Cognizant Security Office and/or the Naval Criminal Investigative Service, and the NSWC PD Security Division (Code 105).

5.5 RECEIPT, STORAGE, AND GENERATION OF CONTROLLED UNCLASSIFIED INFORMATION (CUI) All Controlled Unclassified Information (CUI) associated with this contract must follow the minimum marking requirements of DoDI 5200.48, Section 3, paragraph 3.4.a, and include the acronym "CUI" in the banner and footer of the document. In accordance with DoDI 5200.48, CUI must be safeguarded to prevent Unauthorized Disclosure (UD). CUI export controlled technical information or other scientific, technical, and engineering information must be marked with an export control warning as directed in DoDI 5230.24, DoDD 5230.25, and Part 250 of Title 32, CFR. Nonfederal information systems storing and processing CUI shall be protected per NIST SP-800-171, or subsequent revisions. All transmissions to personal email accounts (AOL, Yahoo, Hotmail, Comcast, etc.) and posting on social media websites (Facebook, Instagram, Twitter, LinkedIn, etc.) are prohibited. Destroy CUI associated with this contract by any of the following approved methods: A cross-cut shredder; a certified commercial destruction vendor; a central destruction facility; incineration; chemical decomposition; pulverizing, disintegration; or methods approved for classified destruction.

5.6 PLANNING, PROGRAMMING, BUDGETING AND EXECUTION (PPBE) DATA.

When contractor employees, in the performance of their duties, are exposed to Planning, Programming, Budgeting and Execution (PPBE) data, a Non-Disclosure Agreement (NDA) with all affected contactor personnel must be executed in coordination with the COR and PCO to ensure safeguarding disclosure of this data.

5.7 U-NNPI SECURITY REQUIREMENTS

5.7.1 Security Classification Guidance is as follows of portions of the tasking on this contract when invoked in the task order statement of work:

5.7.1.1 Contractor requires access to information and equipment classified at the Confidential National Security Information (NSI) level in order to provide industrial support services within facilities that actively supports the Navy Nuclear Propulsion Program (NNPP).

5.7.1.2 All contractor personnel accessing classified information or classified material associated with the performance of work related to the resultant contract must be United States citizens, and shall have and maintain at a minimum Confidential security clearance.

5.7.1.3 The Contractor is responsible for completing all required government mandated training to maintain security and network access to government sites and IT systems, as necessary to support.

5.8 U-NNPI

5.8.1 Purpose The Contractor hereby agrees that when provided documents (specifications, drawings, etc.) that are marked as containing NOFORN sensitive information that must be controlled pursuant to Federal law, the information contained therein and generated as part of the inquiry shall be used only for the purpose stated in the contract and shall in no case be transmitted outside the company (unless such transmittals comply with the detailed guidance of the contract) or to any foreign national within the company. While in use, the documents shall be protected from unauthorized observation and shall be kept secure so as to preclude access by anyone not having a legitimate need to view them. The documents shall not be copied unless done in conformance with the detailed guidance of the contract. All the documents shall be promptly returned in their entirety, unless authorized for proper disposal or retention, following completion of the contract.

5.8.2 Specific Requirements for Protecting U-NNPI

a) Only U.S. citizens who have a need to know required to execute the contract shall be allowed access to U-NNPI.

b) When not in direct control of an authorized individual, U-NNPI must be secured in a locked container (e.g., file cabinet, desk, safe). Access to the container must be such that only authorized persons can access it, and compromise of the container would be obvious at sight. Containers should have no labels that indicate the contents. If removed from the site, U-NNPI must remain in the personal possession of the individual. At no time should U-NNPI be left unsecured (e.g., in a home or automobile, or unattended in a motel room or sent with baggage).

c) U-NNPI documents will have the word NOFORN at the top and bottom of each page. The cover sheet will have the warning statement shown below. Documents originated in the course of work that reproduce, expand or modify marked information shall be marked and controlled in the same way as the original. Media such as video tapes, disks, etc., must be marked and controlled similar to the markings on the original information.

d) U-NNPI may not be processed on networked computers with outside access unless approved by CNO (N00N). If desired, the company may submit a proposal for processing NNPI on company computer systems. Personally owned computing systems, such as personal computers, laptops, personal digital assistants, and other portable electronic devices are not authorized for processing NNPI. Exceptions require the specific approval of the cognizant DAA and CNO (N00N).

e) U-NNPI may be faxed within the continental United States and Hawaii provided there is an authorized individual waiting to receive the document and properly control it. U-NNPI may not be faxed to facilities outside the continental United States, including military installations, unless encrypted by means approved by CNO (N00N).

f) U-NNPI may be sent within the continental United States and Hawaii via first class mail in a single opaque envelope that has no markings indicating the nature of the contents.

g) Documents containing U-NNPI shall be disposed of as classified material.

h) Report any attempts to elicit U-NNPI by unauthorized persons to the appropriate security personnel.

i) Report any compromises of U-NNPI to the appropriate security personnel. This includes intentional or unintentional public release via such methods as theft, improper disposal (e.g., material not shredded, disks lost), placement on Web site, transmission via email, or violation of the information system containing U-NNPI.

j) The only approved storage for U-NNPI is CDMS NOFORN.

5.9 The contract company shall ensure each employee…