Fairmount Hardware - SOW.docx

Statement of Work (SOW) for Fairmount Automation Inc. Products and Repair Services

1.0 INTRODUCTION

1.0.1 The Naval Surface Warfare Center Philadelphia Division (NSWCPD) is a Department of Defense entity responsible for research and development, test and evaluation, engineering and fleet support organization for the Navy’s ships, submarines, military watercraft and unmanned vehicles. This requirement is for NSWCPD Code 545, whose responsibilities include life cycle management of ship hull, mechanical and electrical (HM&E) equipment, Land Based Test Sites and Platforms, as well as test and evaluation (T & E) and in-service engineering support for auxiliary automation machinery systems (Shipboard and land-based). These systems are heavily involved in significant Fleet Maintenance & Modernization initiatives and Alteration Installation Team facilitation.

1.0.2 This contract is for non-personal services. It does not create employment rights with the U.S. Government whether actual, inherent, or implied.

1.0.3 Government/Contractor Relationship

1.0.3.1 The services to be delivered under this Contract are non-personal services and the parties recognize and agree that no employer-employee relationship exists or will exist under the Contract between the Government and the Contractor's personnel. Therefore, it is in the best interest of the Government to provide both parties a full understanding of their respective obligations.

1.0.3.2 The Contractor employees shall identify themselves as Contractor personnel by introducing themselves or being introduced as Contractor personnel and displaying distinguishable badges or other visible identification for meetings with Government personnel. In addition, Contractor personnel shall appropriately identify themselves as Contractor employees in telephone conversations and in formal and informal written correspondence.

1.0.3.3 Contractor personnel under this Contract shall not engage in any of the inherently Governmental functions listed at FAR Subpart 7.5 or DFARS Subpart 207.5.

1.0.4 Employee Relationship:

1.0.4.1 The services to be performed under this Contract do not require the Contractor or its personnel to exercise personal judgment and discretion on behalf of the Government. Rather the Contractor's personnel will act and exercise personal judgment and discretion on behalf of the Contractor.

1.0.4.2 Rules, regulations, directives, and requirements that are issued by the U. S. Navy and NSWCPD under its responsibility for good order, administration, and security are applicable to all personnel who enter a Government installation or who travel on Government transportation. This is not to be construed or interpreted to establish any degree of Government control that is inconsistent with a non-personal services contract.

1.0.4.3 Inapplicability of Employee Benefits: This Contract does not create an employer-employee relationship. Accordingly, entitlements and benefits applicable to such relationships do not apply.

1.0.4.4 It is the Contractor's, as well as the Government's, responsibility to monitor Contract activities and notify the Contracting Officer if the Contractor believes that the intent of this Section has been or may be violated.

1.0.4.4.1 The Contractor shall notify the Contracting Officer in writing via letter or email within three (3) calendar days from the date of any incident that the Contractor considers to constitute a violation of this Section. The notice should include the date, nature, and circumstances of the conduct; the name, function, and activity of each Government employee or Contractor official or employee involved or knowledgeable about such conduct; identify any documents or substance of any oral communication involved in the conduct; and the Contractor's estimated date when, absent a response, cost, schedule or performance will be impacted.

1.0.4.4.2 The Contracting Officer will, within five (5) calendar days after receipt of notice, respond to the notice in writing. In responding, the Contracting Officer will either:

1.1 BACKGROUND

Naval Surface Warfare Center, Philadelphia Division (NSWCPD), Code 545 as the Division's Machinery Engineering Directorate, is the Navy’s agent for the coordination and planning of all the engineering and technical support services for HM&E machinery and systems. Current programs under Code 545’s responsibility includes the Steam Plant Auxiliary Control Systems (SPACS), Electronic Catapult Steam Charging Control System (ECSCCS), Catapult Go/No-Go Indication System (CGNGIS), and the Electronic Automatic Boiler Control (EABC) System. Each of these systems consist of Fairmount Automation Inc. hardware and software that must be groomed, maintained, and updated/upgraded by Code 545.

1.2 SCOPE OF WORK

The Contractor shall provide parts, equipment, and software in support of any Navy system employing Fairmount Automation products as directed by NSWCPD. Each material deliverable shall be represented by a Contract Line Item Number (CLIN) on the material contract. The materials’ value shall be at least ninety percent (90%) of the total value of the contract.

The Contractor shall also provide evaluation and repair services in support of any Navy control system employing Fairmount Automation products as directed by NSWCPD. Support work will be either at Fairmount Automation’s facilities or NSWCPD facilities. Each service deliverable shall be represented by a Contract Line Item Number (CLIN) on the material contract. The services’ value shall be less than ten percent (10%) of the total value of the contract

2.0 APPLICABLE DOCUMENTS

2.1 MIL-HDBK-454B, Standard General Guidelines for Electronic Equipment https://www.dla.mil/Portals/104/documents/landAndMaritime/v/va/pSMC/documents/lM_MIL_HDBK_454B_151030.pdf

2.2 Electrical Workmanship Standards, Portsmouth Naval Shipyard Standard 4855.1 through 4855.6.

2.3 NAVSEA Standard Items https://www.navsea.navy.mil/Portals/103/Documents/SSRAC/NSI/FY%2022/FY%2022%20Orig/FY22%20NAVSEA%20Standard%20Items%2001%20OCT%202020.pdf?ver=0oNSKrP_zCSvnR6K08UTdA%3d%3d

2.4 NAVSEA Information Technology Standard Guidance, Version 99-1, April 99

2.5 ISO-9001 Quality Systems - Model for Quality Assurance in Design, Development, Production, Installation and Servicing

2.6 ISO-9002 Quality Systems - Model for Quality Assurance in Production, Installation and Servicing

2.7 NAVSEA 0948-LP-045-7010, Material Control Standard

The Contractor shall reference and utilize the latest version available when performing tasks within this SOW.

3.0. REQUIREMENTS

3.1 Fairmount Automation Inc. Products and Repair Services:

3.1.1 The contractor shall provide the necessary, equipment, tools, and trained personnel to support the tasks described in this SOW.

3.1.2 The contractor shall provide material to NSWCPD as directed.

3.1.3 The contractor shall provide hardware evaluation on failed equipment from naval ships and NSWCPD lab systems as directed.

3.1.4 The contractor shall provide hardware repair work.

3.2 Reserved

3.23 Manufacturing Phase-Out or Discontinuation of Production, Diminishing Sources, and Obsolete Materials or Components

3.23.1 The contractor shall notify the contracting officer immediately upon determining the unavailability of obsolete materials or components. The contractor may recommend a solution to include the impact on the contract price and delivery. The contractor shall not initiate any item redesign or incur any additional costs without the express, written authorization of the contracting officer.

3.4 Diminishing Manufacturing Sources and Material Shortages Management (DMSMS) Contract Requirements

N/A

3.35 Parts Obsolescence

3.35.1 The contractor shall establish and implement a parts obsolescence program. In the event that manufacturing phase-out or discontinuance of production of such items is contemplated, the contractor is required to notify the contracting officer and publish the discontinuance in the Government-Industry Data Exchange Program (GIDEP), where feasible; and to provide immediate advance notice of production phase-out to NSWCPD Code 545.

4.0 DATA REQUIREMENTS

4.1 Contract Status Report (CDRL 0001)

Contractor shall provide a financial report providing program management, material, when applicable to the services render in paragraph 3.0.

4.2 Hardware Failure Analysis Report (CDRL 0002)

Contractor shall deliver hardware failure analysis report detailing the failure issue of their equipment. The report shall contain the part number and serial number of the unit(s) along with the associated Return Merchandise Authorization (RMA) number. (CDRL 0002 would apply to any piece of failed equipment that we returned to the OEM for analysis.)

4.3 Repair/Modification/Overhaul Report (CDRL 0003)

Contractor shall deliver the repaired hardware unit(s) with a report saying what was repaired. The report shall contain the part number and serial number of the unit(s) along with the associated RMA number. (Items in requirement paragraph 3.3 applies).

4.4 Technical Reports (evaluation reports, as required) (CDRL 0004)

5.0 SECURITY REQUIREMENTS

5.1 SECURITY TRAINING. The Contractor is responsible for completing all required Government mandated training to maintain security and network access to government sites and IT systems to include but not limited to: Antiterrorism Level 1 Awareness; Records Management in the DON: Everyone's Responsibility; Training and Readiness: The Active Shooter; NAVSEA Introduction to Controlled Unclassified Information; Operations Security (OPSEC); NAVSEA Counterintelligence Training; Privacy and Personally Identifiable Information (PII) Awareness Training; NAVSEA Physical Security training and Cybersecurity 101 Training. Certificates of successful completion shall be sent to the COR and as otherwise specified in the contract.

5.1.1 In accordance with the National Industrial Security Program Operating Manual (NISPOM) (37 CFR Part 117), Contractor personnel that require access to Department of Navy (DON) information systems and/or work on-site require an open investigation or favorable adjudicated Tier 3 by the Vetting Risk Operations Center (VROC). An interim clearance is granted by VROC and recorded in the Defense Information System for Security (DISS). An open or closed investigation with a favorable adjudication is required prior to issuance of a badge providing access to NSWCPD buildings. Furthermore, if the Navy Central Adjudication Facility, have made an unfavorable determination access will be denied. For Common Access Card (CAC) you must have an open investigation and/or a favorably adjudicated investigation. Interim security clearance are acceptable for a CAC. Access will be denied for anyone that has eligibility pending in DISS. Vetting through the National Crime Information Center, Sex Offender Registry, and the Terrorist screening database shall be process for a contractor that does not have a favorable adjudicated investigation.

5.2 ON SITE WORK. Contractor personnel that require a badge to work on-site at one of the NSWCPD sites must provide an I-9 form to verify proof of citizenship. The I-9 form should be signed by the company Facility Security Officer or the company Human Resource Department. In addition to the I-9 form, Contractors shall also bring their birth certificate, current United States Passport or naturalization certificate and state issued ID to the NSWCPD Security Officer at the time of badge request to verify citizenship. Any contractor that has unfavorable information that has not been favorably adjudicated, by Department of Defense Central Adjudication Facility (DOD CAF) will not be issued a badge. Finally, contractors shall supply a copy of their OPSEC Training Certificate or other proof that the training has been completed.

Additional information related to the facility clearance process can be obtained by visiting www.dss.mil or http://www.dss.mil/isec/pcl_index.htm.

5.4 OPERATIONS SECURITY (OPSEC)

5.4.1 The Contractor shall protect critical information associated with this contract to prevent unauthorized disclosure. The NSWC Philadelphia Division's (NSWCPD) Critical Information List (CIL)/ CIIL (Critical Indicators and information list) will be provided on site, if warranted. Performance under this contract requires the contractor to adhere to OPSEC requirements, which may include the NSWCPD Contractor OPSEC Plan. When the NSWCPD Contractor OPSEC Plan is required, the contractor shall return acknowledgment of the plan within 15 days of receipt. During the period of this contract, the Contractor may be exposed to, use, or produce, NSWCPD Critical Information (CI) and/or observables and indicators which may lead to discovery of CI. NSWCPD’s CI will not be distributed to unauthorized third parties, including foreign governments, or companies under Foreign Ownership, Control, or Influence (FOCI) unless such FOCI has been appropriately mitigated through measures approved by the Defense Counterintelligence and Security Agency. Questions concerning these requirements shall be directed to the PCO.

5.4.2 CUI correspondence transmitted internally on the contractor's unclassified networks or information systems, and externally, shall be protected per NIST SP-800-171, Protecting Controlled Unclassified Information (CUI) in Non-federal Systems and Organizations.

Assembled large components/systems being transported to and from testing areas, other production or government facilities (whether or not on public roadways) shall be in an enclosed van trailer or covered flatbed trailer. Component/System outside storage, staging, and test areas shall be shielded/obscured from public view wherever physically possible.

5.4.3 NSWCPD’s CI shall not be publicized in corporate wide newsletters, trade magazines, displays, intranet pages or public facing websites. Media requests related to this project shall be directed to the PCO, and the COR who will forward the required to the NSWCPD Public Release Authority for review.

5.4.4 Any attempt by unauthorized third parties to solicit, obtain, photograph, or record, or; incidents of loss/compromise of government Classified or CI, Business Sensitive, Company Proprietary information related to this or other program must be immediately reported to the contractor's Facility Security Officer and Cognizant Security Office and/or the Naval Criminal Investigative Service, and the NSWC PD Security Division (Code 105).

5.5 RECEIPT, STORAGE, AND GENERATION OF CONTROLLED UNCLASSIFIED INFORMATION (CUI) All Controlled Unclassified Information (CUI) associated with this contract must follow the minimum marking requirements of DoDI 5200.48, Section 3, paragraph 3.4.a, and include the acronym "CUI" in the banner and footer of the document. In accordance with DoDI 5200.48, CUI must be safeguarded to prevent Unauthorized Disclosure (UD). CUI export controlled technical information or other scientific, technical, and engineering information must be marked with an export control warning as directed in DoDI 5230.24, DoDD 5230.25, and Part 250 of Title 32, CFR. Nonfederal information systems storing and processing CUI shall be protected per NIST SP-800-171, or subsequent revisions. All transmissions to personal email accounts (AOL, Yahoo, Hotmail, Comcast, etc.) and posting on social media websites (Facebook, Instagram, Twitter, LinkedIn, etc.) are prohibited. Destroy CUI associated with this contract by any of the following approved methods: A cross-cut shredder; a certified commercial destruction vendor; a central destruction facility; incineration; chemical decomposition; pulverizing, disintegration; or methods approved for classified destruction.

5.6 PLANNING, PROGRAMMING, BUDGETING AND EXECUTION (PPBE) DATA.

When contractor employees, in the performance of their duties, are exposed to Planning, Programming, Budgeting and Execution (PPBE) data, a Non-Disclosure Agreement (NDA) with all affected contactor personnel must be executed in coordination with the COR and PCO to ensure safeguarding disclosure of this data.

5.7 U-NNPI SECURITY REQUIREMENTS

N/A

5.8 U-NNPI

N/A

6.0 PLACE OF PERFORMANCE

6.1 The majority of the work will be performed at the contractor’s facility. It is estimated that at least 90% of the work will take place at the contractor’s facility and less than 10% of the work will occur on-site at the NSWCPD facility.

6.1.1 Performance will occur at government sites located in Philadelphia, PA.

6.1.2 Government will provide lab space for up to 3 Contractor personnel under this Contract if required to evaluate Fairmount Automation products on-site.

6.1.3 The specific location(s) will be provided at time of award of the Contract. The Contractor shall provide a list of employees who require access to these areas, including standard security clearance information for each person, to the Contracting Officer Representative (COR) no later than three business days after the date of award. The work space provided to the Contractor personnel shall be identified by the Awardee, with appropriate signage listing the company name and individual Contractor employee name.

6.1.4 Access to Government buildings at Naval Surface Warfare Center Philadelphia Division is from 0600 to 1800 Monday through Friday, except Federal holidays. Normal work hours are from 0600 to 1800, Monday through Friday. Contractor employees shall be under Government oversight at all times. Government oversight requires that a Government employee be present in the same building/facility whenever Contractor employee(s) are performing work under this Contract. Contractor personnel are not allowed to access any Government buildings at NSWCPD outside the hours of 0600 to 1800 without the express approval of the Procuring Contracting Officer (PCO).

6.1.5 Reserved

6.1.6 Early Dismissal and Closure of Government Facilities

6.1.6.1 When a Government facility is closed and/or early dismissal of Federal employees is directed due to severe weather, security threat, or a facility related problem that prevents personnel from working, onsite Contractor personnel regularly assigned to work at that facility should follow the same reporting and/or departure directions given to Government personnel. The Contractor shall not direct charge to the contract for time off, but shall follow its own company policies regarding leave. Non-essential Contractor personnel, who are not required to remain at or report to the facility, shall follow their parent company policy regarding whether they should go/stay home or report to another company facility. Subsequent to an early dismissal and during periods of inclement weather, onsite Contractors should monitor radio and television announcements before departing for work to determine if the facility is closed or operating on a delayed arrival basis.

6.1.6.2 When Federal employees are excused from work due to a holiday or a special event (that is unrelated to severe weather, a security threat, or a facility related problem), on site Contractors will continue working established work hours or take leave in accordance with parent company policy. Those Contractors who take leave shall not direct charge the non-working hours to the Contract. Contractors are responsible for predetermining and disclosing their charging practices for early dismissal, delayed openings, and closings in accordance with the FAR, applicable cost accounting standards, and company policy. Contractors shall follow their disclosed charging practices during the Contract period of performance, and shall not follow any verbal directions to the contrary. The PCO will make the determination of cost allowability for time lost due to facility closure in accordance with FAR, applicable Cost Accounting Standards, and the Contractor's established accounting policy.

6.1.7 The contractor shall ensure that each contractor employee who will be resident at NSWCPD completes the Environmental Management System (EMS) Awareness training within 30 days of commencing performance at NSWCPD. This document is available at: https://navsea.navy.deps.mil/wc/pnbc-code10/Safety/default.aspx

6.1.8 In accordance with C-223-W002, ON-SITE SAFETY REQUIREMENTS (NAVSEA), the contractor shall certify by e-mail to Paul Breeden (paul.breeden.civ@us.navy.mil) that on-site employees have read the “Philadelphia Division Environmental Policy and Commitment” and taken the EMS Awareness training within 30 days of commencing performance at NSWCPD. The e-mail shall include the employee name, work site, and contract number.

7.0 TRAVEL

7.1 The Contractor will not be required to travel from the primary performance locations when supporting this requirement, as their office is local to the Philadelphia Area.

8.0 GOVERNMENT FURNISHED PROPERTY

N/A

9.0 GOVERNMENT FURNISHED INFORMATION

N/A

10.0 PURCHASES

N/A

11.0 COUNTERFEIT MATERIAL PREVENTION

11.1 Electronic End-Items

The contractor planning shall document procedures and processes to minimize the risk of procuring and/or using counterfeit parts and materials, and their process for detecting counterfeit materiel in the event it is procured. This requirement applies to both new/modified and existing mission and safety critical hardware. SAE AS5553 contains information regarding the detection, avoidance, and mitigation of counterfeit electronic components, and may be used as a reference document for the development of the plan.

11.2 Non-Electronic Materiels

11.2.1 Department of the Navy contractors (and their subcontractors at all tiers) who obtain critical or high risk materiel shall implement a risk mitigation process as follows:

11.2.1.1 If the materiel is currently in production or currently available, materiel shall be obtained only from authorized suppliers;

11.2.1.2 If the materiel is not in production or currently available from authorized suppliers, materiel shall be obtained from suppliers that meet appropriate counterfeit avoidance criteria;

11.2.1.3 Contractor shall notify the contracting officer when critical or high risk materiel cannot be obtained from an authorized supplier;

11.2.1.4 Contractor shall take mitigating actions to authenticate the materiel if purchased from an unauthorized supplier;

11.2.1.5 Contractor shall report instances of counterfeit and suspect counterfeit materiel to the contracting officer and the GIDEP as soon as the contractor becomes aware of the issue.

12.0 PERSONNEL

N/A

12.6 DON Cyberspace IT (Information Technology) / Cybersecurity & Information Assurance Functions and Personnel Requirements

N/A

13.0 NSWCPD ELECTRONIC COST REPORTING AND FINANCIAL TRACKING (ECRAFT) SYSTEM

13.1 In addition to the requirements of Clause C-237-W001 “Electronic Cost Reporting and Financial Tracking (eCRAFT) System Reporting (NAVSEA)”, the contractor is required to provide supporting accounting system reports, at the Contracting Officer’s request, based on the review of the invoice documentation submitted to eCRAFT. This documentation will include reports such as the Job Summary Report (or equivalent), Labor Distribution Report (or equivalent), and General Ledger Detail Report (or equivalent). Supporting labor data provided must include unburdened direct labor rates for each employee and labor category. Cost breakdowns for ODCs, Materials, travel and other non-labor costs must be at the transactional level in sufficient detail so the Government can review allocability to the Contract. Indirect costs allocated to direct costs must be shown at the lowest level of detail sufficient to reconcile each indirect rate to the appropriate allocation base.

13.2 On invoices containing subcontractor costs, the prime contractor agrees, at the Contracting Officer’s request, to attach as supporting documentation all invoices received from subcontractors, unless the subcontractor submits invoices directly to the CO and COR. This requirement applies to all subcontract types (Cost, FFP, etc.).

14.0 SPECIAL REQUIREMENTS

14.1 Quality Management System

0. The Contractor shall adhere to the requirements of NAVSEA Technical Specification 9090-310 (series) (Modernization work only).

0. The Contractor shall adhere to the requirements of the latest NAVSEA Standard Items relevant to the requirements of the SOW.

0. The Contractor shall maintain a Quality Management System (QMS) in accordance with ASQ/ANSI/ISO 9001:2015 standards. QMS packages are required to adhere to the requirements of:

· NAVSEA Standard Item 009-04 (series) (Modernization & Non-Modernization work)

· NAVSEA Technical Specification 9090-310 (series) (Modernization work only)

0. The Contractor shall maintain Quality Management System (QMS) acceptance from NAVSEA 09MP in accordance with NAVSEA Technical Specification 9090-310 (series) (Modernization work only).

0. The Contractor shall notify in writing the following when any changes are made to the Quality Management System (QMS) that may affect work:

· NSWCPD’s Quality Department (Modernization & Non-Modernization work)

· NAVSEA 09MP (Modernization work only)

14.2 Risk Management

14.2.1 The contractor shall develop an internal risk management program and work jointly with NSWCPD code 545 to develop an overall risk management program.

14.2.2 The contractor shall assign responsibility for risk mitigation activities, and monitor progress through a formal tracking system.

14.2.3 The contractor shall conduct risk identification and analysis during all phases of the program, including proposal development. Develop appropriate risk mitigation strategies and plans.

14.2.4 The contractor shall capture risks and associated mitigation plans in a risk database and provide status updates to the Government for all documented risks upon request.

14.3 OCONUS Contractor Personnel Travel During COVID-19

N/A

14.4 Software Development Plan (SDP)

In accordance with NAVSEA C-227-H007, Software Development Requirements, the Statement of Work shall describe the Navy's minimum requirements regarding the software development life cycle model proposed for use. The SDP should be modeled after the ISO/IEC/IEEE 12207 standard. The Navy should not specify a specific format but rather allow offerors to select their preferred format for this document. The content of the SDP, however, needs to meet certain criteria as listed above. Within the SOW there shall be a requirement for delivery of a Software Development Plan (SDP) in accordance with a specified CDRL (refer to Section 4 Data Requirements).

NSWCPD 02 Personnel shall assist the technical codes when requirements are being established for software development plans when structuring RFPs and contracts.

Appendix A – Cybersecurity Workforce (CSWF) Label Guidance for the Document Preparer

CSWF Labels are provided below in accordance with SECNAV M-5239.2–

· Identifying the CSWF label will help transitioning to the CSWF requirements when the Navy directs the change

· The proper proficiency level should be chosen for each CSWF label

· IAWF xxx-I = Entry CSWF

· IAWF xxx-II = Intermediate CSWF

· IAWF xxx-III = Advanced CSWF

· Ex: IAM II = Intermediate

· The CSWF designation should be chosen based on the position responsibilities/description. Navy COOL is a quick resource for identifying this: HYPERLINK "https://www.cool.navy.mil/usn/cswf/index.htm"https://www.cool.navy.mil/usn/cswf/index.htm

· It is highly recommended that you cross-check requirements for CSWF designation and proficiency with requirements for the IAWF designation. This will help with transitioning between the programs.

· Ex: An Entry 41 - Customer Service and Technical Support can meet their requirements via A+, Network+ or SSCP. These align directly to someone with an IAWF designation of IAT-I (A+, CCNA-Security, Network+, SSCP)

· IAWF and CSWF requirements do not always align. Do not rely on Navy cool for the most current baseline requirement certification list. NAVIFOR provides in Excel format it as “5239.2 Appendix 4” via its site: HYPERLINK "https://usff.navy.deps.mil/sites/NAVIFOR/manpower/cswf/SitePages/Home.aspx"https://usff.navy.deps.mil/sites/NAVIFOR/manpower/cswf/SitePages/Home.aspx

IAWF Designation Requirement (DOD 8570.01-M) Guidance for the Document Preparer

Approved Baseline Certifications

IAT Level I

IAT Level II

IAT Level III

A+ CE

CCNA-Security

CND

Network+ CE

SSCP

CCNA Security CySA+ **

GICSP

GSEC

Security+ CE

CND

SSCP

CASP+ CE

CCNP Security

CISA

CISSP (or Associate)

GCED

GCIH

IAM Level I

IAM Level II

IAM Level III

CAP

CND

Cloud+

GSLC

Security+ CE

CAP

CASP+ CE

CISM

CISSP (or Associate)

GSLC

CCISO

CISM

CISSP (or Associate)

GSLC

CCISO

IASAE I

IASAE II

IASAE III

CASP+ CE

CISSP (or Associate)

CSSLP

CASP+ CE

CISSP (or Associate)

CSSLP

CISSP-ISSAP

CISSP-ISSEP

CSSP Analyst

CSSP Infrastructure Support

CSSP Incident Responder

CEH

CFR

CCNA Cyber Ops CCNA Security CySA+ **

GCIA

GCIH

GICSP

Cloud+

SCYBER

PenTest+

CEH

CySA+ **

GICSP

SSCP

CHFI

CFR

Cloud+

CND

CEH

CFR

CCNA Cyber Ops CCNA Security

CHFI

CySA+ **

GCFA

GCIH

SCYBER

PenTest+

CSSP Auditor

CSSP Manager

CEH

CySA+ **

CISA

GSNA

CFR

PenTest+

CISM

CISSP-ISSMP

CCISO

· Baseline certification requirements for the IAWF can be found at: HYPERLINK "https://public.cyber.mil/cwmp/dod-approved-8570-baseline-certifications/"https://public.cyber.mil/cwmp/dod-approved-8570-baseline-certifications/

· Higher level IAT/IAM/IASAE certifications satisfy lower level requirements. Certifications listed in Level II or III cells can be used to qualify for Level I. However, Level I certifications cannot be used for Level II or III

· OS/CE Requirements will be determined by systems they need privileged access to. They are required to have an actual certification (not a training certificate) for these systems. You can determine the correct certification based on your needs. The CSWF PM, ISSOs, and ISSM can assist with this as well.

· Information Assurance (IA) Management (IAM)

· Typically personnel in oversight/compliance roles that may:

· Supervise or manage protective or corrective measures when a cybersecurity incident or vulnerability is discovered.

· Ensure that system security configuration guidelines are followed.

· Ensure that IA security requirements are appropriately identified in computer environment operation procedures.

· Ensure that IA inspections, tests, and reviews are coordinated.

· Participate in an IS risk assessment during the Assessment and Authorization (A&A) / Risk Management Framework (RMF) process

· May also carry out IAT duties, as long as they also meet IAT requirements.

· May include information system security officers (ISSOs)

· IA Technicians (IAT)

· Typically system/network/application administrators doing technical work that may include:

· Implement applicable patches to remediate vulnerabilities

· Install, test, maintain, and upgrade CE operating systems software and hardware to comply with cybersecurity requirements

· Implement and maintain perimeter defense systems including, but not limited to, intrusion detection systems, firewalls, grid sensors.

· Schedule and perform regular and special backups on all enclave systems.

· Examine vulnerabilities and determine actions to mitigate them.

· IA System Architects and Engineers (IASAE)

· Typically developers and programmers, work may include:

· Design, develop, and implement security measures that provide confidentiality, integrity, availability, authentication, and on-repudiation for the enclave environment.

· Develop interface specifications for use within the enclave environment.

· Develop cybersecurity architectures and designs for DoD IS to include automated IS applications, enclaves (which include networks), and special purpose environments with platform IT interconnectivity, e.g., weapons systems, sensors, medical technologies, or distribution systems.

· Provide engineering support to security/certification test and evaluation activities.

Additional Guidance for completing Section 12.3 DON Cyberspace IT (Information Technology) / Cybersecurity & Information Assurance Functions and Personnel Requirements

IT levels should be provided for each position.

IT levels are defined in SECNAV M-5510.30 (see chapter 5).

• IT-I – Privileged Access

· IT-I users require a Tier 5 (T5) background investigation (Top Secret eligibility)

· This would typically be used for high-level administrators on centrally managed or cloud-based networks/information systems that connect to the internet or other DoD large networks (e.g., SIPRNet, SDREN)

· Information Systems Security Managers (ISSM), ISSOs, or other positions with responsibility for development and administration of cybersecurity programs, to include direction and control of risk analysis and/or threat assessment.

· Positions that have major responsibility for the direction, planning, design, testing, maintenance, operation, monitoring and/or management of systems hardware and software.

· General rule: IAM-II/III and IAT-III personnel will be here.

· IT-II – Limited Privilege OR sensitive information access

· IT-II users require a Tier 3 (T3) background investigation (Secret eligibility)

· Limited privilege could include privileged access to a stand-alone network or system, or local administrative privileges on a workstation

· (Privilege can also be considered limited if they are under the immediate supervision of an IT-I

· Sensitive information includes sensitive but unclassified (SBU) and controlled unclassified information (CUI). Examples include: Personally Identifiably Information (PII), For Official Use Only (FOUO), Naval Nuclear Propulsion Information (NNPI)

• IT-III – No Privilege AND no sensitive information access

· This category should only be used if personnel will ONLY have access to publically releasable information

Appendix B Sample Statement of Work Language- COUNTERFEIT MATERIAL

Reference: (HYPERLINK "http://www.secnav.navy.mil/rda/Policy/2017%20Policy%20Memoranda/DON%20Counterfeit%20Materiel%20Process%20Guidebook.pdf"COUNTERFEIT MATERIEL PROCESS GUIDEBOOK, Office of the Assistant Secretary of the Navy (Research, Development & Acquisition) Acquisition and Business Management June 2017, Appendix D) The following provides information that should be considered for inclusion into the Statements of Work (SOW) for solicitations or contracts where counterfeit materiel is identified as a risk.

These are only examples and can be used together or separately, and should be modified or otherwise tailored to meet program requirements:

11.1.1 Counterfeit Parts and Materials Planning

The contractor planning shall document procedures and processes to minimize the risk of procuring and/or using counterfeit parts and materials, and their process for detecting counterfeit materiel in the event it is procured. This requirement applies to both new/modified and existing mission and safety critical hardware. SAE AS5553 contains information regarding the detection, avoidance, and mitigation of counterfeit electronic components, and may be used as a reference document for the development of the plan.

11.1.2 Counterfeit Parts and Materials System

System criteria. A counterfeit electronic part detection and avoidance system shall include risk-based policies and procedures that address, at a minimum, the following areas:

· The training of personnel.

· The inspection and testing of electronic parts, including criteria for acceptance and rejection. Tests and inspections shall be performed in accordance with accepted Government- and industry-recognized techniques. Selection of tests and inspections shall be based on minimizing risk to the Government. Determination of risk shall be based on the assessed probability of receiving a counterfeit electronic part; the probability that the inspection or test selected will detect a counterfeit electronic part; and the potential negative consequences of a counterfeit electronic part being installed (e.g., human safety, mission success) where such consequences are made known to the Contractor.

· Processes to abolish counterfeit parts proliferation.

· Risk-based processes that enable tracking of electronic parts from the original manufacturer to product acceptance by the Government, whether the electronic parts are supplied as discrete electronic parts or are contained in assemblies, in accordance with paragraph (c) of the clause at HYPERLINK "http://www.acq.osd.mil/dpap/dars/dfars/html/current/252246.htm" \l "252.246-7008" \t "_parent"252.246-7008, Sources of Electronic Parts (also see paragraph (c)(2) of this clause).

· Use of suppliers in accordance with the clause at HYPERLINK "http://www.acq.osd.mil/dpap/dars/dfars/html/current/252246.htm" \l "252.246-7008" \t "_parent"252.246-7008.

· Reporting and quarantining of counterfeit electronic parts and suspect counterfeit electronic parts. Reporting is required to the Contracting Officer and to the Government-Industry Data Exchange Program (GIDEP) when the Contractor becomes aware of, or has reason to suspect that, any electronic part or end item, component, part, or assembly containing electronic parts purchased by the DoD, or purchased by a Contractor for delivery to, or on behalf of, the DoD, contains counterfeit electronic parts or suspect counterfeit electronic parts. Counterfeit electronic parts and suspect counterfeit electronic parts shall not be returned to the seller or otherwise returned to the supply chain until such time that the parts are determined to be authentic.

· Methodologies to identify suspect counterfeit parts and to rapidly determine if a suspect counterfeit part is, in fact, counterfeit.

· Design, operation, and maintenance of systems to detect and avoid counterfeit electronic parts and suspect counterfeit electronic parts. The Contractor may elect to use current Government- or industry-recognized standards to meet this requirement.

· Flow down of counterfeit detection and avoidance requirements, including applicable system criteria provided herein, to subcontractors at all levels in the supply chain that are responsible for buying or selling electronic parts or assemblies containing electronic parts, or for performing authentication testing.

· Process for keeping continually informed of current counterfeiting information and trends, including detection and avoidance techniques contained in appropriate industry standards, and using such information and techniques for continuously upgrading internal processes.

· Process for screening GIDEP reports and other credible sources of counterfeiting information to avoid the purchase or use of counterfeit electronic parts.

· Control of obsolete electronic parts in order to maximize the availability and use of authentic, originally designed, and qualified electronic parts throughout the product’s life cycle.

11.1.3 Preventing Counterfeit Parts and Materials

The Contractor shall take steps as defined in DFARS 252.246-7007 and herein to minimize the risk of receiving counterfeit parts and materials. The Contractor shall:

• Maximize availability of authentic, originally designed and/or qualified parts throughout the product’s life cycle, including management of parts obsolescence

• Assess potential suppliers to minimize the risk of receiving counterfeit parts or materials

• Maintain a listing of approved suppliers with documented criteria for approval and removal of suppliers from the list

• Have purchasing procedures which require the selection of parts and materials from OM or authorized suppliers whenever possible

• Require a certificate of compliance and supply chain traceability for all electronic part purchases, and provide to the Government upon request

• Use Government or industry services such as GIDEP and other commercially available services to identify part or supplier quality or authenticity problems

• Define minimum inspection and test requirements for parts being procured from unauthorized suppliers, and shall ensure that in-house, third-party, and/or distributor inspection and test procedures and facilities comply with these requirements

• Incorporate procurement clauses which plainly identify quality requirements and liability to all approved suppliers

• Flow the requirements above to affected Subcontractors

SAE AS6174 contains information regarding the detection, avoidance, and mitigation of counterfeit materiel, and may be used as a reference document for meeting the above steps.

Parts and materials shall not be purchased from unauthorized sources (e.g. independent distributor or broker) unless there is no other means for procurement. In isolated cases when an unauthorized supplier is the only possible choice for procurement, an Unauthorized Supplier Purchase Report (CDRL XXXX) shall be provided to the Contracting Officer and program office.

The report shall contain the following information:

• Reason why an authorized supplier or original component manufacturer (OM) could not provide the part or material

• Product certificate of conformance with traceability to the OM, if available

• Verification and authenticity data results (e.g., visual inspection, marking/surface finish permanency, DPA, Scanning Acoustic Microscopy, Energy Dispersive X-Ray Spectroscopy, Fourier Transform Infrared (FTIR) Spectroscopy, Rockwell Hardness Test, etc.) SAE AS5553 contains information regarding the detection, avoidance, and mitigation of counterfeit electronic components, and may be used as a reference document for meeting the above steps.

11.1.4 Counterfeit Parts and Materials

The Contractor shall provide a Counterfeit Prevention Plan (CDRL XXXX) that documents procedures to minimize the risk of procuring and/or using counterfeit parts and materials. This plan shall be in accordance with DFARS 252.246-7007 Contractor Counterfeit Electronic Part Detention and Avoidance. Solicitations and subcontracts for all suppliers shall contain a requirement for procedures to minimize the risk of procuring and/or using counterfeit parts and materials.

11.1.4.1 Preventing Counterfeit Parts and Materials

The Contractor shall implement steps as defined in DFARS 252.246-7007 to minimize the risk of receiving counterfeit parts and materials. Parts and materials shall not be purchased from unauthorized suppliers (e.g. independent distributor or broker) unless there is no other means for procurement. In isolated cases when an unauthorized supplier is the only possible choice for procurement, a Technical Report – Study/Services, Unauthorized Supplier Purchase Report (CDRL XXXX) shall be provided to the contracting officer and the program office. The report shall contain the following information:

• Reason why an authorized supplier or OM could not provide the part or material

• Product certificate of conformance with traceability to the OM, if available

• Verification and authenticity data results (e.g., visual inspection, marking/surface finish permanency, Differential Power Analysis (DPA), Scanning Acoustic Microscopy, Energy Dispersive X-Ray Spectroscopy, Fourier Transform Infrared (FTIR) Spectroscopy, Rockwell Hardness Test, etc.)

SAE AS5553 contains information regarding the detection, avoidance, and mitigation of counterfeit electronic components, and may be used as a reference document for meeting the above steps.

11.1.5 Counterfeit Parts and Materials

The following minimum processes shall be implemented and flowed down by the Contractor to all subcontractors. In order to minimize the risk of use of counterfeit parts in (NAME OF PROGRAM/EQUIPMENT), spare parts and associated equipment.

The contractor shall establish processes to minimize the risk of procuring and using counterfeit parts and materials. The contractor shall document these processes and provide those documented processes to Government representatives upon request.

At a minimum, these processes shall ensure that:

• All components for (NAME OF PROGRAM/EQUIPMENT) electronic assemblies and subassemblies are purchased from Original Manufacturer (OM), authorized suppliers, or franchised distributors; At a minimum, the contractor shall ensure that procurement practices and processes to purchase and install components from OM, authorized suppliers, or franchised distributors are flowed down to subcontractors and suppliers at all tiers

• A counterfeit Prevention Plan shall be generated in accordance with DI-MISC-81832 Counterfeit Prevention Plan, and that the requirements of this DID and AS5553 are flowed down to all subcontractors and suppliers in this effort;

• The Contractor shall maximize the use of authentic, originally designed and/or qualified parts

• The contractor shall assess potential suppliers to minimize the risk of receiving counterfeit parts or materials

• The contractor shall have purchasing procedures which confirm whether a selected supplier is authorized (as defined in SAE AS5553) for each purchase

• The contractor shall define minimum inspection and test requirements for parts being procured and shall ensure that in-house, third-party, and/or supplier inspection and test procedures and facilities comply with the requirements of this section. These minimum inspection and test requirements shall specify appropriate test methods to detect potential counterfeit parts and materials

• The contractor shall require a certificate of conformance (as defined in SAE AS5553) and supply chain traceability for all electronic part purchases

• The contractor shall use government or industry services such as GIDEP and other commercially available services to identify part or supplier quality or authenticity problems. The Contractor shall notify (NAME OF PROGRAM OFFICE) of the occurrence of a confirmed counterfeit part or material and the actions taken to identify, contain, and impound all product from the lot, within 7 working days of confirmation of the counterfeit status. The Contractor shall flow down a requirement for similar notification from Subcontractors or suppliers at any tier to the Contractor. The contractor shall initiate and submit an ALERT to the Government- Industry Data Exchange Program (GIDEP) within 60 days of knowledge of the counterfeit part or material. Counterfeit parts are defined in SAE Aerospace Standard 5553. Counterfeit parts may be electronic or mechanical in nature. Counterfeit electronic parts may typically be used parts which have been refurbished and represented as new. Commonly counterfeited electronic parts include parts such as microcontrollers or specially screened devices, or common parts, which have several pin-compatible versions from multiple manufacturers, such as memory devices and operational amplifiers. Counterfeit mechanical parts are typically improperly made, marked, or treated products. Examples are improper anodization or heat treatments (or falsified data), mismarked parts sold as higher grade steel, or used/fake parts such as valves or circuit breakers.

11.1.6 Data Item Description

Data Item Description (DID) DI-MISC-81832, Counterfeit Prevention Plan: This DID describes the format and content of a contractors “Counterfeit Prevention Plan,” and should be used by the procurement activity when requesting delivery of a counterfeit prevention plan.

11.1.7 Grey Market Statement (For CISCO Equipment)

Reseller and Equipment Qualification: Reseller shall certify that it is a CISCO Authorized Channel Partner as of the date of the submission of their offer, and that it has the certification/specialization level required by the Manufacturer to support both the product sale and product pricing, in accordance with the applicable Manufacturer certification/specialization requirements: Please provide proof of certification level with your quote submission. If proof of certification level is not provided with your quote submission, your quote may be considered non‐responsive. Vendor shall warrant that the products are NEW and in their original UNOPENED box. Only CISCO installed and configured components are acceptable. Installation and / or configuration of third party components, or installation and / or configuration of OM components by any other than CISCO are NOT acceptable. The Vendor confirms to have sourced all Manufacturer products submitted in this offer from Manufacturer or through Manufacturer Authorized Channels only. Vendor shall provide Buyer with a copy of the End User license agreement pre‐award, and shall certify that all Manufacturer software is licensed originally to Buyer as the original licensee authorized to use the Manufacturer Software. Only authentic OM equipment and support services sourced from authorized OM channels are acceptable. Equipment, materials, and services not meeting the above stated qualifications are not acceptable and will be returned to the reseller.

11.1.8 Containing Counterfeit Parts and Materials

Suspect counterfeit parts and materials shall be impounded with all other items from the same lot. The contractor shall identify and locate all potential users or hardware items with the suspect part or material, and contain product which has this suspect product, pending confirmation of the part or material’s authenticity. The OM may be involved at this point in order to verify authenticity. Confirmed counterfeit material shall be contained and provided to investigative agencies for ongoing investigation or prosecution. The counterfeit product shall not be scrapped or otherwise disposed of without approval from investigative authorities or the program office. Confirmed counterfeit product shall not be returned or handled in a way which would allow its resale or reuse. Suspect counterfeit parts or materials whose authenticity (or lack of) cannot be definitively determined, shall be dispositioned via Material Review Board (MRB).

11.1.9 Reporting Counterfeit Parts and Materials

The prime contractor and program office shall be notified of the occurrence of a suspect or confirmed counterfeit part or…