(U) TBMCS 2.0 PWS 10 Jan 25 Rev9.pdf

Performance Work Statement (PWS)

Table of Contents

1.0 SCOPE

Background

2.0 APPLICABLE DOCUMENTS

2.1 Government Documents

2.2 Non-Government Documents

2.3 Business Relations

3.0 REQUIREMENTS

3.1 Program Management/Data Requirements

3.1.1 Contract Data

3.1.2 Program Management

3.1.2.1 Post Award Conference

3.1.2.2 Integrated Master Schedule (IMS)

3.1.2.3 Contractor Meeting Facilities

3.1.2.4 Contractor Participation in Meetings

3.1.2.4.1 Program Status Update Teleconferences

3.1.2.4.2 In-Process Review (IPR)

3.1.2.4.3 Technical Interchange Meeting (TIM)

3.1.2.4.4 Cybersecurity Adjudication Meeting (CAM)

3.1.2.4.5 Configuration Control Board (CCB)

3.1.2.4.6 Software/System Change Review Board (SCRB)

3.1.2.4.7 Discrepancy Test Review Group (DTRG)

3.1.2.5 Configuration Management (CM)

3.1.2.6 Quality Assurance

3.1.2.7 Data Management

3.1.2.8 Government Furnished Property (GFP)

3.1.2.8.1 Disposal of GFP

3.1.2.8.2 Logistics - Financial Improvement and Audit Readiness (FIAR)

3.1.2.8.3 Logistics - Packaging, Handling, Storage, and Transportation

3.1.2.8.4 Logistics - Hazardous Material Shipment

3.1.2.8.5 Logistics - Item Unique Identification

3.1.2.8.6 Logistics - ECP Kitting & Shipment

3.1.2.8.7 Logistics – Technical Documentation

3.1.2.8.8 Logistics - USMC TBMCS Help Desk Support

3.1.2.9 Laboratory Environment

3.2 Security Clearance and Access Requirements

3.2.1 Secret Facility Clearance

3.2.2 Common Access Cards (CACs)

3.2.3 Marine Corps Enterprise Network (MCEN) Computer Access

3.2.4 MCEN Official E-mail usage

3.2.5 Magnetic Hard Drive Storage Devices

3.3 Engineering

3.3.1 Technical Reviews

3.3.1.1 Requirements Validation Review

3.3.1.1.2 Test Readiness Review (TRR)

3.3.1.1.3 Production Readiness Review (PRR)

3.3.2 Software Engineering

3.3.2.1 Software Build Plan

3.3.2.2 Capability Maturity Model Integration Level (CMMI)

3.3.2.3 Cybersecurity Maturity Model Certification (CMMC)

3.3.2.4 Software Product Package

3.3.2.5 Software Configuration Control

3.3.2.6 Data Rights

3.3.2.7 Test Program

3.3.2.7.1 Test Plan

3.3.2.7.2 Test Procedures

3.3.2.7.3 Contractor Test Readiness Reviews

3.3.2.7.4 Contractor Developmental Test

3.3.2.7.5 Government Test Readiness Reviews

3.3.2.8 Contractor Support to Government Testing

3.3.2.9 Government Acceptance Test Outcomes

3.3.2.10 Other Government Support

3.3.2.11 Systems Integration Lab

3.3.3 Cybersecurity Program and Requirements

3.3.3.1 Cybersecurity Assessment & Authorization Process Support

3.3.3.2 Cybersecurity Testing

3.3.3.3 Systems Security Plan (SSP)

3.3.3.4 Cyber Incident Reporting for a Contractor’s Internal Unclassified Information System

3.3.3.5 OPTIONAL TASK - Emergency Fix (EFix)

3.3.3.6 OPTIONAL TASK – External Integration Point

4.0 ANTICIPATED YEARLY TRAVEL

1.0 SCOPE

This Performance Work Statement (PWS) specifies the programmatic, technical, and logistics requirements, for the United States Marine Corps (USMC) Theater Battle Management Core Systems (TBMCS) 2.0 software development and sustainment support effort. This includes the engineering and implementation of solutions for the development and sustainment of the TBMCS 2.0.x.x baseline as identified in this PWS into products fully interoperable with the current joint TBMCS service maintenance release and future maintenance release baselines. The effort under this PWS scope is to continue development on TBMCS 2.0 containerized software and supporting infrastructure that is hardware agnostic, while supporting government acquisition events including Government Decision Testing (GDT), Joint Interoperability Test (JIT), and Field User Evaluation (FUE) leading up to the eventual fielding and long term sustainment of the TBMCS 2.0 software on a quarterly release cycle (90 days) in accordance with (IAW) Department of Defense (DoD) and USMC policy and procedures listed in section 2.0.

Background The TBMCS is a United States Air Force (USAF) led program with Joint interest, serves as the focal point for Joint Air Warfare Command and Control (C2), integrating systems for planning, tasking, intelligence-gathering, and execution into a single, common interface. The TBMCS is the primary system for planning, managing, and executing the air battle; and for feeding real-time, decision-quality information to users in the Joint Forces Air Component Commander (JFACC) the staff at the Air Operations Center (AOC), and to pilots, navigators, and weapons control officers on the battlefield. The TBMCS links the command and control systems for the USAF, United States Navy (USN), and USMC, and integrates with United States Army (USA) ground systems, enabling coordinated, synchronized air battle management. The TBMCS is post Milestone C, in sustainment.

The TBMCS software baseline was developed approximately 20 years ago. As the software requirements changed over time, code was commented out and the segments recompiled;

however, the segments were not rewritten. USMC TBMCS Program office started an effort to refactor the TBMCS software to remove old unused code and rework the code so it would be more efficient but, after the initial review it was determined that a better approach is to rewrite the TBMCS software baseline applications code using modern software development paradigm and coding techniques. This software rewrite effort will maintain the current TBMCS functionality but be in a modern software codebase.

The USMC TBMCS Program is managed by the Program Manager (PM) Marine Air Ground Task Force Command and Control (MAGTF C2) Program Management Office (PMO) under the Program Executive Officer Land Systems (PEO LS), henceforth known as “Government”. The Government is responsible for the refresh and sustainment of USMC software baseline, testing, and associated training and documentation. After release and fielding of the updated software baseline the USMC TBMCS operational software will require specific support activities to include a release every quarter (90 days), to address functional change and that complies with the Government’s Cybersecurity Compliance requirements outlined in section 3.3.2 Cybersecurity Program and Requirements.

2.0 APPLICABLE DOCUMENTS

The following documents form a part of this PWS to the extent specified herein. The most recent revision of the referenced document at the time of contract award shall be used unless otherwise specified in a contract modification. In the event of conflict between the applicable documents and this PWS, the PWS shall take precedence. All second tier and below references cited in mandatory compliance documents shall be considered as guidance only. Nothing in this PWS supersedes applicable laws and regulations unless a specific exemption has been obtained.

The specifications, standards, plans, drawings, data item descriptions, and other pertinent documents cited in this solicitation can be obtained from the online Acquisition Streamlining and Standardization Information System (ASSIST), http://quicksearch.dla.mil/qsSearch.aspx.

Department of Defense (DoD) directives and instructions can be found at:

http://www.esd.whs.mil/Directives/issuances/dodd/.

(Copies of ISO/IEC/IEEE/EIA 12207 and 15289 are available from www.ieee.org or www.iso.org)

2.1 Government Documents

CCMB-2017-04-001 Common Criteria for Information Technology Security Evaluation v3.1 R5

CJCSI 6211.02D Defense Information System Network (DISN) Responsibilities, 24 Jan 12 (current 4 Aug 15)

CJCSI 6510.01F Information Assurance (IA) and Support to Computer Network Defense (CND), dtd 09 Feb 11 (current 9 Jun 15)

CNSSI 1253 Security Categorization and Control Selection for National

Security Systems, dtd 27 Mar 14 CNSSP 11 Committee on National Security Systems Policy - National

Policy Governing the Acquisition of Information Assurance (IA) and IA-Enabled Information Technology Products, dtd 10 Jun 13

CNSSP 22 Committee on National Security Systems Policy (CNSSP) - Policy on Information Assurance Risk Management for National Security Systems, dtd Jan 22

DevSecOps Fundamental Guidebook, dtd September 2021

DISA Container Guide Container Hardening Process Guide, Ver 1 Rel 2, dtd 24 Aug

DoD CIO Memo DoD's Migration to Use of Stronger Cryptographic Algorithms, dtd 14 Oct 10 DoDD 8140.03 Cyberspace Workforce Management, dtd 15 Feb 23 DoDI

5200.01 DoD Information Security Program and Protection

of Sensitive Compartmented Information (SCI), dtd 21 Apr 16 http://www.esd.whs.mil/Directives/issuances/dodd/ http://www.ieee.org/ http://www.iso.org/

DoDI 8140.02 Identification, Tracking, and Reporting of Cyberspace Workspace Requirements, dtd 21 Dec 21

DoDI 8500.01 Cybersecurity, with Ch 1, dtd 07 Oct 19 DoDI 8510.01 Risk Management Framework (RMF) for DoD Systems, dtd 19

Jul 22 DoDI 8520.02 Public Key Infrastructure (PKI) and Public Key (PK) Enabling, dtd 24 May 11 DoDI 8551.01 Ports, Protocols, and Services Management, dtd 31 May 2023 DoDI 8580.1 Information Assurance (IA) in the Defense Acquisition

System, dtd 9 Jul 04 DoDM 5200.01-V1 DoD Information Security Program: Overview, Classification, and Declassification, with Ch 2, dtd 28 Jul 20 DoDM 5200.01-V2 DoD Information Security Program: Marking of Information, with Ch 4, dtd 28 Jul 20 DoDM 5200.01-V3 DoD Information Security Program: Protection of Classified

Information, with Ch 3, dtd 28 Jul 20 DoD 5220.22-M National Industrial Security Program Operating Manual DoDM 8140.03 Cyberspace Workforce Qualification and Management

Program, dtd 15 Feb 23 DoD Playbook DevSecOps Playbook version 2.1, dtd September 2021 ECSM-003 Container and Platform Security Framework, Version 1, dtd

June 2024 ECSM-009 NATO Information Handling on the MCEN, Version 3, dtd 15

Aug 2012 ECSM-010 Unauthorized Disclosures and Spillages, Version 2, dtd 10 Jun

ECSM-012 Marine Corps Enterprise Network Cybersecurity Reference

Architecture (MCEN CRA) Framework, Version 2, dtd 7 Jul

ECSM-013 Public Key Infrastructure (PKI), Version 1, dtd 08 Aug 2018 ECSM-014 Disaster Recovery (DR) and Contingency Planning (CP), Version 1, dtd 16 Feb 2018 ECSM-018 Marine Corps Assessment and Authorization Process

(MCAAP) Version 7, 24 Jan 2024 ECSM-019 Program of Record (POR) Cybersecurity Playbook, Version

2.1, dtd 16 Aug 2024 ECSM-020 Information Assurance Vulnerability Management Program

(IAVM), Version 1, dtd 31 Dec 2013 ECSM-021 Ports, Protocols and Services Management (PPSM), Version 1, dtd 15 May 2012 ECSM-024 Marine Corps Cyberspace Information Technology

/Cybersecurity Workforce Qualification Program (Cyber IT/CSWF QP), Version 2.0, dtd June 2019

EO 14028 Executive Order on Improving the Nation’s Cybersecurity, dtd 12 May 2021

FAR Part 45.505-1 Basic Information FAR Part 52.245.1 Government Property FIPS PUB 140-3 Federal Information Processing Standards Publication –

Security Requirements for Cryptographic Modules, dtd 22 Mar

FIPS PUB 201-3 Personal Identity Verification (PIV) of Federal Employees and Contractors, dtd Jan 22

HSPD-12 Homeland Security Presidential Directive – 12: Policy for a Common Identification Standard for Federal Employees and Contractors, https://www.dhs.gov/homeland-security-presidential-directive-12, dtd 27 Aug 04

MARADMIN 371/13 Requirement for Registration of Ports, Protocols, and Services Operating on the Marine Corps Enterprise Networks, dtd 24 Jul

MARADMIN 051/16 DoD Cybersecurity Scorecard: Updated Policy for Public Key Enablement (PKE) of All Marine Corps Enterprise Network (MCEN) Authorized Users, System Administrators, Privileged Users, and Non-Person Entities, dtd 2 Feb 16

MARADMIN 185/16 Updated Policy for Public Key Enablement (PKE) of all Marine Corps Enterprise Network (MCEN) Authorized Users and Privileged Accounts, dtd 01 Apr 16

MCO 4400.201 Volume 1 Accountability and Responsibility; Vol 2 Department of Defense Activity Address Code; Vol 3 Retail Supply Management; Vol 6 Dispositions, Exchanges, and Return of Marine Corps Property

MIL-HDBK-61B (SE) Configuration Management Guidance, dtd 7 Apr 20 MIL-STD-1472H Department of Defense Design Criteria Standard, Human

Engineering, dtd 17 Jan 19 NIAP National Information Assurance Partnership NISPOM National Industrial Security Program Operating Manual, dtd 19

Aug 21 NIST SP 800-30 R1 Guide for Conducting Risk Assessments, dtd Sep 12 NIST SP 800-53 R4 Recommended Security Controls for Federal Information

Systems and Organizations, dtd 22 Jan 15 NIST SP 800-53A R4 Assessing Security and Privacy Controls in Federal

Information Systems and Organizations: Building Effective Assessment Plans, dtd 18 Dec 14

NIST SP 800-60 Vol.1 R1 Guide for Mapping Types of Information and Information Systems to Security Categories, dtd Aug 08

NIST SP 800-60 Vol.2 R1 Guide for Mapping Types of Information and Information Systems to Security Categories - Appendices, dtd Aug 08

NIST SP 800-78-4 Cryptographic Algorithms and Key Sizes for Personal Identity Verification, dtd May 15

NIST SP 800-147 BIOS Protection Guidelines, dtd Apr 11 NIST SP 800-147B BIOS Protection Guidelines for Servers, dtd Aug 14 NIST SP 800-171 R2 Protecting Controlled Unclassified Information in Nonfederal https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12

Systems and Organizations, dtd 28 Jan 21 NIST SP 800-190 Application Container Security Guide, dtd September 2017 NSA Kubernetes Guide Kubernetes Hardening Guide, Ver 1.2, dtd August 2022 OMB M-11-11 MEMO: Continued Implementation of Homeland Security

Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, dtd 03 Feb 11

PM AC2SN CMP Configuration Management Plan dtd 20 May 22 (TBMCS Addendum)

RAISE Play Book Rapid Assess and Incorporate Software Engineering (RAISE)

2.0 Implementation Guide, Ver 1.0, dtd 1 Nov 2022

SECNAV M-5239.1 Department of the Navy Information Assurance Program Information Assurance Manual, dtd Nov 05

SIAT-HDBK-003 Marine Corps Systems Command Configuration Management Implementation Handbook, dtd 25 Feb 14

TBMCS-FL SCG (CUI) TBMCS-Force Level (FL) Security Classification Guide, dtd 25 Jan 21

TBMCS ISCM Information System Continuous Monitoring Strategy Version 1.1.X, dtd Aug 20

TBMCS_PCR SOP Problem/Change Request (PCR) Standard Operating Procedure (SOP) for the Theater Battle Management Core Systems (TBMCS), dtd 20220617

2.2 Non-Government Documents

ISO/IEC/IEEE 12207:2017(E) International Standard – Systems and Software Engineering

– Software Life Cycle Processes, dtd Nov 17

2.3 Business Relations

The Contractor shall identify all key personnel and their responsibilities for the conduct of activities required under this contract. The Contractor shall assign responsibilities and define clear lines of authority for determining and controlling the resources necessary to deliver the requirements for this contract. The Contractor agrees to assign qualified personnel to the Key Personnel positions. No substitutes shall be made to Key Personnel without prior Government approval in accordance with section G.8. The key personnel positions are listed in section G.8.

3.0 REQUIREMENTS

3.1 Program Management/Data Requirements

3.1.1 Contract Data

The Contractor shall provide data items in accordance with (IAW) the DD1423s, Contract Data Requirements List (CDRLs), identified in the applicable paragraph in this PWS and listed in Section J of the contract.

3.1.2 Program Management

The Contractor shall establish and maintain program management practices throughout the life of this contract. These program management practices shall include, but not be limited to, visibility into the Contractor’s organization and techniques used in management of the program, including subcontractor and data management.

The Contractor shall plan and monitor the execution of all program tasks and shall maintain regular communications to keep the Government apprised of all program issues and status. The Contractor shall be accountable for ensuring all subcontractors are compliant with the terms and conditions of this contract. The Contractor shall submit a Monthly Status Report (MSR), to include the status of all action items from previous In-Process Reviews (IPRs) and/or Technical Interchange Meetings (TIMs) IAW CDRL B001.

CDRL B001, Contractor’s Monthly Status Report (MSR)

3.1.2.1 Post Award Conference

The Contractor shall host a Post Award Conference (PAC) at the Contractor’s facility no later than 30 calendar days after the Contract Award for the base year. Specific time and date for the PAC shall be coordinated with the Contracting Officer. During the PAC, the Contractor shall introduce key personnel, provide a thorough understanding of the schedule, present an understanding of the PWS and CDRLs, and identify areas that require clarification. The Contractor shall provide an agenda prior to the PAC, IAW CDRL B002, prepare briefing material IAW CDRL B003, and provide meeting minutes IAW CDRL B004.

CDRL B002, Conference Agenda CDRL B003, Briefing Material CDRL B004, Meeting Minutes

3.1.2.2 Integrated Master Schedule (IMS)

The Contractor shall maintain and deliver a contract level IMS for all efforts performed under this contract. The Contractor shall provide the IMS, to the Government for review and approval IAW CDRL B005. The IMS shall be baselined no later than 30 calendar days following completion of the PAC. The draft IMS shall be revised and presented at the PAC. The Government will provide key milestones from the Government IMS to the Contractor. After baseline, the IMS will be delivered monthly for Government review in conjunction with the Contractor’s Monthly Status Report. Changes to the Government test and field kit delivery milestones in the baseline IMS will be made only with Contracting Officer Representative (COR) approval. All contract tasking shall be managed using the IMS.

CDRL B005, Integrated Program Management Report, Integrated Master Schedule

(IMS)

3.1.2.3 Contractor Meeting Facilities

The Contractor shall provide CLASSIFIED and UNCLASSIFIED meeting facilities. The meeting facility shall accommodate up to 20 participants, be capable of projecting SECRET briefings, and provide secure storage for laptops, cell phones, and other UNCLASSIFIED electronic devices outside of the CLASSIFIED meeting room. The Contractor shall provide Defense Information Security System (DISS)/Security clearance verification and provide sign-in/attendance roster for all participants.

3.1.2.4 Contractor Participation in Meetings

The Contractor shall host, support, and participate in program status update teleconferences, IPR, TIM, Cyber Adjudication Meeting (CAM), Software Build Status Review, and Software/System Change Review Board (SCRB) meetings. The Contractor shall support and participate in USMC TBMCS Configuration Control Board (CCB), Engineering level IPT, Test Readiness Review (TRR), and Discrepancy Test Review Group (DTRG).

3.1.2.4.1 Program Status Update Teleconferences

The Contractor shall host program status update teleconferences every other week with a planned duration of no longer than one hour and shall provide the necessary phone bridge. The day of the week for the teleconferences will be determined during the PAC. Program status update teleconferences at a minimum shall focus on covering the following items:

1. Programmatic discussion items/topics

2. High level schedule review

3. Contractor risk and issues

4. Software release status

5. Cybersecurity status

6. CDRL status

7. Tier III help desk status

8. Lab/hardware status

3.1.2.4.2 In-Process Review (IPR)

Each IPR shall be held quarterly at dates and locations agreed to in advance by the Government.

The initial IPR shall be conducted at the Contractor’s facility no later than 90 days after PAC.

Subsequent IPRs are anticipated to be conducted equally between the Contractor’s facility and the Government’s designated location. The areas addressed at the IPR shall include, but not be limited to, schedule and performance, management issues, risk (schedule and performance) identification and resolution, opportunities, and Integrated Product Team results. The agenda will be approved by the Government in advance. Additionally, Government representatives will conduct Government-Furnished Property (GFP) inventories during IPR visits to the Contractor facility. The Contractor shall provide a phone bridge capable of accommodating a minimum of 10 users. The Contractor shall provide an agenda prior to each IPR IAW CDRL B002, prepare briefing material IAW CDRL B003, and plan a review of the latest version of the IMS IAW CDRL B005, and provide meeting minutes for each review IAW CDRL B004. The Contractor shall track Action Items in the MSR IAW CDRL B001.

CDRL B003, Briefing Material CDRL B004, Meeting Minutes CDRL B005, Integrated Program Management Report, Integrated Master Schedule

(IMS)

3.1.2.4.3 Technical Interchange Meeting (TIM)

The Contractor shall conduct each TIM quarterly. Each quarterly TIM and IPR shall be held together whenever possible. Meetings may be held at either Contractor or Government designated facilities or may be conducted by telephone. The purpose of a TIM is to discuss specific technical activities, including action items, test plans, test results, solution design, interfaces, technical decisions, cybersecurity, and implementation concerns to ensure continual visibility by the Government into the Contractor’s technical progress. The Contractor shall provide an agenda prior to each TIM IAW CDRL B002, prepare briefing material IAW CDRL B003 (when the topic of discussion is of a complex technical nature per the government), and provide meeting minutes for each meeting IAW CDRL B004. The Contractor shall track Action Items in the MSR IAW CDRL B001.

3.1.2.4.4 Cybersecurity Adjudication Meeting (CAM)

CAMs will be conducted 20 business days after the completion of every Government Security Assessment (SA). At the discretion of the Government, meetings may be held at either Contractor or Government designated facilities at the appropriate classification level per the approved system Security Classification Guide (SCG). The Contractor shall ensure sufficient cybersecurity, development, integration, and engineering, and Subject Expert Matter (SME) support is present to complete meeting objectives. The purpose of the CAM is to review cybersecurity vulnerabilities for resolution and to identify a specific software release for each fix to be applied. The Government shall provide an updated Plan of Action and Milestones (POA&M) no later than 10 business days prior to the CAM. The Contractor shall review the POA&M and provide mitigation statements, comments, and proposed software release for fix to be applied for reviewed during the CAM. Upon completion of each CAM, the Contractor shall deliver to the Government an updated copy of the POA&M IAW CDRL A001.

CDRL A001, Technical Report-Study/Services, Review of POA&M

3.1.2.4.5 Configuration Control Board (CCB)

The Contractor shall support and participate in monthly CCB meetings via teleconferences by providing a non-voting member to the CCB. More frequent CCB meetings may be required for emergent issues that need to be addressed between the scheduled monthly CCB meetings. The Contractor support and contributions to the CCB shall focus on software tickets and change requests originating from an incident that occurred, or problem encountered during testing, system integration, operational use, or as system enhancements and submitted as Problem Change Requests (PCRs) to the CCB. The Contractor shall also support CCB discussions regarding Engineering Change Proposals (ECPs) related to the TBMCS baseline.

3.1.2.4.6 Software/System Change Review Board (SCRB)

The Contractor shall support and participate in a SCRB once per week. The Contractor shall chair the SCRB. The SCRB shall provide visibility and clarity into the project's progress, quality, and risks. The SCRB will address at a minimum the following items:

1. Schedule

2. Gantt for features

3. Burndown list

4. Bug density

5. Scope creep

6. Developer performance

7. Issues

8. Proposed changes to the solution, performance specification or functional baseline.

9. Architecture designs

10. Recommendations or results to analysis conducted

11. Updates to reflect changes based on analysis driven by software changes or ECPs.

12. Updated system and software engineering artifacts

13. Software Product Package Planning, Scope, and status

14. Cybersecurity Process and Status

15. Software, Hardware End of Life/End of Support

The SCRB briefing template will be discussed and formalized at the PAC.

3.1.2.4.7 Discrepancy Test Review Group (DTRG)

The Contractor shall support and participate in a DTRG in conjunction with the conduct of Government Developmental Test (GDT), Validation and Verification (V&V) (Post fielding decision), and subsequent fielding of the TBMCS 2.0 software applications. The Government led DTRG will review and categorize all PCRs generated during a test, assigning category and priority numbers per the PM AC2SN Configuration Management Plan (CMP) and the TBMCS

PCR SOP V2.0.

3.1.2.5 Configuration Management (CM)

The Contractor shall maintain configuration control for TBMCS 2.0.x.x products developed under this contract. The Contractor’s Configuration Management (CM) process shall be implemented in accordance with the Contractor’s CM Plan incorporated by reference. The Contractor’s CM Plan shall align with the PM AC2SN CM Plan, SIAT-HDBK-003, and MIL-HDBK-61A.

The contractor shall support the configuration management database for supported systems and use the data to provide advisories on all hardware issues related warranty repair, safety warnings, manufacturer’s recalls, etc. The contractor shall update and maintain an approved CMP that aligns with the PM AC2SNCMP. The contractor shall support entry of all CM documentation efforts by MCLC for all CM documentation entered in the configuration management database.

3.1.2.6 Quality Assurance

The Contractor shall establish and implement a quality assurance program via CDRL A013 Quality Assurance Program Plan (QAPP) using best commercial practices that ensures quality throughout all areas of performance, to include inspection, test, maintenance, and preparation for delivery and shipping. The Contractor shall describe the Quality Control and Performance Measurement approach, including how proposed performance standards will be monitored, evaluated, and reported. The contractor shall brief their quality assurance program during the PAC. Contractor shall brief on any changes to their QAPP via CDRL B003, prior to implementation. The Performance Requirements Summary Matrix, contained in the Quality Assurance Surveillance Plan (QASP), (Section J Attachment 2), provides performance standards. The Government shall use these standards to determine contractor performance and shall compare contractor performance to the Acceptable Quality Level (AQL).

CDRL A013, Quality Assurance Program Plan (QAPP)

3.1.2.7 Data Management

The Contractor shall maintain and deliver a Data Accession List (DAL) to the Government IAW CDRL B006 quarterly to coincide with CDRL B001, The Contractor shall maintain DAL items and access throughout the life of the contract, to include but not be limited to, all necessary technical data (e.g., requirements, specifications, drawings [conceptual design, development design, product], engineering notebooks, parts lists, etc.), management plans and updates thereto, and delivered CDRLs. The Contractor will mark all media and documentation as US Only.

CDRL B001, Contractor’s Progress, Status and Management Report, Contractor’s Monthly Status Report (MSR

CDRL B006, Data Accession List (DAL)

3.1.2.8 Government Furnished Property (GFP)

The Contractor shall account for all GFP, (Section J Attachment 3), IAW the requirements of the Defense Federal Acquisition Regulation Supplement (DFARS). The Contractor shall obtain and maintain a DoDAAC for the performance of processes related to GFP or Contractor Acquired Materiel IAW MCO 4400.201-Vol 2. The Contractor shall provide accurate accounting for tracking the movement, storage, and reporting of GFP using Procurement Integrated Enterprise Environment (PIEE). The Contractor shall assist the Responsible Officer (RO) / Responsible Individual (RI) with the acquisition, distribution, storage, and management of all GFP related to the TBMCS effort, including maintaining and updating GFP inventory records. All GFP shall be inventoried, inspected, cleaned, stored, and accounted for in the GFP module in Procurement Integrated Enterprise Environment (PIEE) and in a manner consistent with Federal Acquisition Regulation (FAR), clause 52.245-1 (f) (iii).

The Contractor shall conduct a quarterly GFP inventory and report any changes. The contractor shall support an annual physical inventory of all GFP with the Responsible Officer (RO) / Responsible Individual (RI). Preventive maintenance and inspection shall be performed IAW applicable technical manuals (TMs) and/or industry accepted practices. The Contractor shall submit a quarterly GFP report IAW CDRL D001. The GFP report shall contain the information required by the Federal Acquisition Regulation (FAR), clause 52.245-1 (f) (iii). Inventory lists of GFP shall be submitted in separate categories as set forth in the FAR/DFARS, including separate lists for controlled cryptographic equipment items. The Contractor shall identify and report any discrepancies and/or deficiencies, to include associated costs (materials, labor and test, if applicable) for repair of the GFP to the Government and as part of the quarterly GFP report. The Government will be responsible for providing direction on approach for any required repairs.

The Contractor shall use Government property, either furnished or acquired under this contract, only for performing this contract, unless otherwise approved in a separate writing by the Contracting Officer’s Representative (COR).

The Contractor shall coordinate all inventory updates (changes in condition code (refer to MCO 4400.201-V3 for condition codes and definitions), location, configuration status, etc.) with the Program Office in order to update the applicable APSR.

The Contractor shall provide Key Supporting Documentation (KSD) for all GFP, including but not limited to shipping, receiving, integration, and disposal. Examples of KSD’s include the DD- 1348-1, Issue Release/Receipt Document; DD-1149, Requisition and Invoice/Shipping Document; and DD-250, Material Inspection and Receiving Report (MIRR), and Asset Integration Worksheet.

The Contractor shall include on DD 1348s, a listing, by part and serial number, unit cost and quantity for each item delivered to the Fleet Marine Force and/or Supporting Establishments.

The Contractor shall complete Preventive Maintenance Checks and Service (PMCS) and scheduled maintenance for GFP, in accordance with the applicable Technical Manual, to include, but not limited to, inspecting, cleaning, charging batteries, performing operational checks, software /firmware updates, etc. The Contractor shall provide updated GFP condition codes to the RI, if required, upon completion of maintenance actions or when initiating disposal transactions.

The Contractor shall report any discrepancies/deficiencies and will identify if additional funds are required to support GFP maintenance actions (e.g., costs for materials, labor and test). Upon PM MAGTF C2 approval, the Contractor shall conduct the necessary repair actions.

The Contractor shall, within 5 days of delivery of GFP provide PM MAGTF C2 with a signed receipt accepting the GFP (signed DD Form 1149 or 1348). The Contractor shall, within 15 days after receipt of GFP, verify the GFP is functioning according to its performance requirements. In the event it is not performing correctly, the contractor shall immediately notify PM MAGTF C2.

PM MAGTF C2 will either replace the item or direct the Contractor to repair or have the item repaired. When directed, the contractor shall return the GFP to its original condition in accordance with its performance specifications.

PM MAGTF C2 will provide funding to support the maintenance and repair of GFE/GFP to condition code “A” or “B”. PM MAGTF C2 will endeavor to supply all required GFE in condition code “A” or “B”. If GFE is less then condition code “A” or “B”, the Contractor shall perform maintenance and/repair on GFP as directed and funded by PM MAGTF C2.

CDRL C002, Custodian Asset Report (CAR) CDRL D001, Status of Government Furnished Property (GFP) Report, Government

Furnished Property (GFP) Report

3.1.2.8.1 Disposal of GFP

The Contractor shall be responsible for disposal of GFP inventory as prescribed in DFARS 252.245-7004 (Deviation 2022-O0006). The Contractor shall provide disposition recommendations to the COR after conducting reviews of the TBMCS GFP inventory. In the event of a disposition, the Contractor should request direction from the Lead Logistician whether to use the Plant clearance disposition or to utilize DLA’s disposition services.

Upon approval, the Contractor will request documentation for Issue Release/Receipt documentation from the TBMCS Lead Logistician, currently USMC issued DD-1348(s). Upon receipt the Government will schedule a turn-in appointment with the approved Disposition Service. The Contractor shall prepare and affix any documentation requested by the Disposition Service, and the Contractor shall transport the assets to the approved facility at the scheduled date and time. Upon turnover of physical custody of assets, the Contractor will provide the signed DD-1348(s) to the TBMCS Lead Logistician within 3 business days of acceptance by the dispositioning activity.

3.1.2.8.2 Logistics - Financial Improvement and Audit Readiness (FIAR) The Contractor shall provide documentation to the program Logistician upon receipt of any procured items within 14 days or receipt of items by the contractor. Documentation shall be used for Key Supporting Documentation (KSD) and shall be provided for both full kit delivery and partial kit deliveries.

The Contractor shall provide the PM MAGTF C2 KSDs such as but not limited to purchase invoices, packing slips, unit cost breakouts and if available, contracts/delivery orders of the equipment procured. KSDs are required to support individual financial transactions and accounting events to achieve proper financial reporting.

3.1.2.8.3 Logistics - Packaging, Handling, Storage, and Transportation The Contractor shall be responsible for preservation and packaging IAW the best commercial practices of ASTM D3951-98. Items delivered to overseas destinations will be shipped IAW ASTM D3951-98, paragraph 6.1, Export Requirements. Marking for shipment and storage shall be IAW MIL-STD-129P (Change 4). All material shipped from the contractor shall be documented on a DD 1149 / DD 1348 with a copy provided to the appropriate program logistician. Item Unique Identification (IUID) and Radio Frequency Identification (RFID) shall be applied, as required. Guidance supporting RFID application can be found at http://www.acq.osd.mil/dpap/pdi/uid/index.html. Both applications of IUID and RFID are DoD mandatory requirements.

3.1.2.8.4 Logistics - Hazardous Material Shipment

Hazardous material shipments shall be conducted based on the DoD and/or Department of Transportation (DoT) hazard classification, mode of transportation and destination. Hazardous materials shall be prepared for shipment in compliance with the requirements of the United Nations (UN) transport of dangerous goods regulations; CFR Title 29 and CFR Title 49; the ICAO; Technical Instructions for the Safe Transport of Dangerous Goods by Air; and the IMDG Code.

3.1.2.8.5 Logistics - Item Unique Identification

The Contractor shall implement specific IUID marking per DFARS 252.211-7003, as defined in MIL-STD-130, and IAW the applicable program’s IUID Implementation Plan. Additionally, any Integrated equipment components that exceed $5,000, when purchased separately, will be marked with the IUID prior to delivery to the Government. The contractor shall IUID mark all legacy, reused, refurbished, new, spares, and system IUID candidates, if GFP is included in, rework, and/or ECP efforts. Product drawings shall contain the necessary CM details pertaining to IUID marking and location. The Contractor shall upload the virtual Unique Item Identifier (UII) into Wide Area Workflow (WAWF) and the DoD IUID Registry.

3.1.2.8.6 Logistics - ECP Kitting & Shipment

The Contractor shall be responsible packaging newly procured ECP kits IAW the ECP documentation. The kits shall be verified to contain all required components and shall be packed according to the practices of ASTM D3951-98. Items delivered to overseas destinations will be shipped IAW ASTM D3951-98, paragraph 6.1, Export Requirements. Marking for shipment and storage shall be IAW MIL-STD-129P (Change 4). All material shipped from the Contractor shall be documented on a DD 1149 / DD 1348 with a copy provided to the program logistician. Item Unique Identification (IUID) and Radio Frequency Identification (RFID) shall be applied, as http://www.acq.osd.mil/dpap/pdi/uid/index.html required. Guidance supporting RFID application can be found at DoD mandatory requirements.

Both applications of IUID and RFID are DoD mandatory requirements.

3.1.2.8.7 Logistics – Technical Documentation

The Contractor shall provide updates to program technical documentation (SAM, SUM, SVD and Load Guide) to coincide with software releases in accordance with PM MAGTF C2

Portfolio Technical Manual Contract Requirement (TMCR), TMCR 001-22, included in Attachment A. Table 1 Supported Systems. The documentation will support DT, MOT&E, and normal daily operations. Prior to executing documentation updates, the Contractor shall coordinate with the applicable PM MAGTF C2 logistician to address the extent of the update, determine the applicable TMCR support sections for update, and identify additional requirements.

When directed, the Contractor shall develop/update Technical Instructions or “I” Type publications in accordance with Marine Corps Technical Publications Template provided by the Program Logistician

3.1.2.8.8 Logistics - USMC TBMCS Help Desk Support

The Contractor shall provide Tier III support to TBMCS MCTSSA Help Desk (Camp Pendleton, CA), 24 hours a day, 7 days a week, 365 days a year, for the current USMC TBMCS software baseline. On-call support for the current TBMCS software baseline is 24 hours per day, 7 days per week. All calls shall be initially responded to within 60 minutes. Government help desk tickets shall be categorized as Critical, Urgent, or Routine. Critical tickets are defined to be mission critical in which the system cannot perform mission; System operation is at an impaired level and shall be worked evenings/weekends as required, until resolved. Urgent tickets are defined as systems that are still operational but the ability to perform the mission is degraded and shall be worked during the hours of 0800-2000 Eastern time, Monday through Friday, until resolved. Routine tickets are defined to be minor issues or general questions and shall be worked during normal business hours, Monday through Friday, until resolved. All help desk tickets shall have detailed troubleshooting steps documented as part of resolution of the ticket.

When the Contractor receives an escalation notice, they will analyze and determine corrective actions needed to support and resolve the trouble ticket. All relevant corrective actions taken, and their results, will be recorded in the Contractor’s Trouble Report database with exports provided to MCTSSA for entry into MCTSSA’s Test Incident Report (TIR) database on a weekly basis.

The Contractor shall notify the TBMCS MCTSSA Help Desk of all TIR updates and trouble ticket resolution.

If corrective action for the problem indicates a change needed to the TBMCS configuration, the Contractor shall document relevant details and rationale for the change in the Trouble Report in the Contractor’s defect tracking system and presented at the SCRB to enable the Government to process the Trouble Report through the TBMCS CCB.

3.1.2.9 Laboratory Environment

The Contractor shall provide unclassified and classified lab environments IAW the DoD Contract Security Classification Specification (DD Form 254) (Section J Attachment 4) in support of required SSA duties. The Contractor shall maintain representative systems for software and hardware in support of development and testing. Additionally, the contractor will ensure local and remote Cyber Lab assets are configured in approved configurations with appropriate software baselines installed for IA test events. The contractor classified lab facilities shall have a Secure Internet Protocol Router Network (SIPRNET) and Secure Telephone Equipment (STE).

3.2 Security Clearance and Access Requirements

3.2.1 Secret Facility Clearance

This contract will require the contractor to have a Secret Facility Clearance and will require certain contractors to obtain and maintain classified access eligibility. The contractor shall have a valid Secret Facility Clearance and a Secret Safeguarding Level prior to classified performance. The prime contractor and all sub-contractors (through the prime contractor) shall adhere to all aspects of 32 CFR Part 117 NISPOM. All personnel identified to perform on this contract shall maintain compliance with Department of Defense, Department of the Navy, and Marine Corps Information and Personnel Security Policy to include completed background investigations (as required) prior to classified performance. This contract shall include a DoD Contract Security Classification Specification (DD-254) as an attachment. Certain contractors will be required to perform IT-I/II duties that will require favorably adjudicated Tier 5/3 Level investigations. The Defense Counterintelligence and Security Agency (DCSA) will not authorize contractors to submit the necessary Tier Level investigations solely in support of IT level designation requirements but are required to submit investigations for those employees requiring both Secret access and IT-II designation. The Facility Security Officer (FSO) is however required to establish, populate, and own the DISS record of every contractor processed for and/or issued a Common Access Card (CAC) or submitted for IT level duties. The Government Contracting Activity Security Office (GCASO) is required to submit any required investigations in support of IT-I level designations. The contractor is required to provide a roster of prospective contractor employees performing IT-I duties to the MARCORSYSCOM Contracting Officer’s Representative (COR). This roster shall include full names, Social Security Numbers, e-mail address and phone number for each contractor requiring investigations in support of IT Level designations. The COR will verify the IT-I requirements and forward the roster to the GCASO. Contractors found to be lacking required investigations will be contacted by the GCASO.

In accordance with DoDI 5200.48, “Controlled Unclassified Information (CUI),” all contractors supporting MARCORSYSCOM who receive, store, or generate CUI are required to take the DoD Mandatory CUI Training, available on the Security Awareness Hub at:

https://securityawareness.usalearning.gov/cui/index.html. Per DoDI 5200.48 and pursuant to contractual requirements, DoD contractors require initial CUI training and annual CUI refresher training. Additional MARCORSYSCOM specific CUI training and guidance can be attained by contacting the MARCORSYSCOM Security Classification Management Office at 703-432-3141 / 3140 or MCSC_ACSG2_SCMO@usmc.mil.

While performing aboard NAVY/USMC sites, the contractor shall comply with the provisions of DoD Directive 5205.02E, “DoD Operations Security (OPSEC) Program,” SECNAVINST 3070.2A, “Operations Security,” MCSCO 3070.1B, “Operations Security Program,” Marine Corps Order 3070.2A, “The Marine Corps Operations Security (OPSEC) Program,” and the MARCORSYSCOMO P5510.2C, “Security Manual,” at all other sites the contractor shall comply with the local command and/or program OPSEC plan. Contractor personnel shall follow OPSEC concepts and principles in the conduct of this requirement to protect critical information, personnel, facilities, equipment, and operations from compromise. All Contractors (including Subcontractors) shall supplement their current security practices by requiring any personnel involved in executing this contract to complete Government-sponsored and administered OPSEC training.

The FSO’s are responsible for notifying the MARCORSYSCOM Personnel Security (PERSEC) Office at 703-432-3952/3490/3374 if any contractor on this contract receives an unfavorable adjudication. Any issued CAC would need to be Revoked and Retrieved. Due to Insider Threat concerns. The FSO is also requested to notify the PERSEC Office, within 24 hours of any adverse/derogatory information associated with the 13 Adjudicative Guidelines concerning any contractor performing on this contract, if they have been granted an IT designation, issued a CAC and/or a MARCORSYSCOM building badge. The FSO shall notify the Government (written notice) within 24 hours of any contractor personnel added or removed from the contract that have been granted IT designations, issued a CAC and/or a MARCORSYSCOM building badge.

3.2.2 Common Access Cards (CACs)

The COR will identify and only approve those contractor employees performing on this contract that require a CAC in order to perform their job function. In accordance with Headquarters, United States Marine Corps issued guidance relative to Homeland Security Presidential Directive – 12 (HSPD-12), all personnel must meet eligibility criteria to be issued a CAC. In order to meet the eligibility criteria, contractor employees requiring a CAC must obtain and maintain a favorably adjudicated Personnel Security Investigation (PSI). Prior to authorizing a CAC, the employee’s Defense Information System for Security (DISS) record must indicate a completed and favorably adjudicated PSI or (at a minimum) that a PSI has been submitted and accepted (opened). The minimum acceptable investigation is a T-1 or a National Agency Check with Written Inquiries (NACI). If a contractor employee’s open investigation closes and is not favorably adjudicated, the CAC must be immediately retrieved and revoked. CACs are not issued for convenience.

Facility Security Officers (FSOs) are responsible for notifying the MCSC Personnel Security Office (PERSEC Office) at 703-432-3490/3952 if any contractor performing on this contract receives an unfavorable adjudication after being issued a CAC. Due to Insider Threat concerns, the Company is requested to notify the MCSC Personnel Security Office (PERSEC Office) at 703-432-3952/3490/3374, within 24 hours of any adverse/derogatory information associated with the 13 Adjudicative Guidelines concerning any contractor performing on this contract, if they have been issued a CAC and/or a MCSC Building Badge.

Each CAC is issued with a “ctr@usmc.mil” e-mail account that the individual contractor is mailto:ctr@usmc.mil responsible to maintain as active by logging in on a regular basis (at least twice a month), sending an e-mail and clearing any unneeded e-mails. Contractors issued a CAC are prohibited from “auto- forwarding” e-mail from their .mil e-mail account to their .com e-mail account. If the “ctr@usmc.mil” e-mail account is not kept active, G-6 will deactivate the account, and the CAC will also lose its functionality. Contractor employees shall solely use their government furnished “ctr@usmc.mil” e-mail accounts for work supporting the USMC, conducted in fulfillment of this contract, and shall not use a contractor supplied or personal e-mail account to conduct official U.S. government business. The use of a contractor or personal e-mail account for contractor business or personal use is allowed, but only when using cellular or a commercial internet service provider.

If a contractor loses their eligibility for a CAC due to an adverse adjudicative decision, they have also lost their eligibility to perform on MCSC contracts.

3.2.3 Marine Corps Enterprise Network (MCEN) Computer Access

Contractor personnel accessing Marine Corps Systems Command Information Systems must maintain compliance with United States Marine Corps Enterprise Cybersecurity Manual 007 Resource Access Guide. Contractor personnel will submit a DD 2875 and a completion certificate for the CYBERC course located on MarineNet located at https://www.marinenet.usmc.mil. The CYBERC course consists of the DOD Cyber Awareness Challenge and the Department of the Navy Annual Privacy Training (PII). Contractors will have to create a MarineNet account in order to complete the required training.

MCEN IT resources, if provided, are designated for official use only and other limited authorized purposes. DOD military, civilian personnel, consultants, and contractor personnel performing duties on MCEN information systems may be assigned to one of three position sensitivity designations.

1) ADP-I (IT-1): Favorably adjudicated T-5, T5R, (formerly known as Single Scope Background Investigation (SSBI)/SSBI Periodic Reinvestigation (SBPR)/SSBI Phased Periodic Reinvestigation (PPR))

2) ADP-II (IT-2): Favorably adjudicated T-3, T3R, (formerly known as Access

National Agency Check and Inquiries (ANACI)/ National Agency Check with Law and Credit (NACLC)/Secret Periodic Review (S-PR))

3) ADP-III (IT-3): Completed T-1, (formerly known as National Agency Check with Inquiries (NACI))

Privileged users must maintain the baseline Cyberspace Workforce Information Assurance Technical (IAT) or Information Assurance Manager (IAM) relating to the position being filled.

Privileged users are defined as anyone who has privileges over a standard user account as in system administrators, developers, network administrators, code signing specialist and Service Desk technicians.

http://www.marinenet.usmc.mil/ http://www.marinenet.usmc.mil/

All MCEN users must read, understand, and comply with policy and guidance to protect…