W15QKN22R0029 Amendment 0005.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. Contract ID Code Page Of

2. Amendment/Modification No.

3. Effective Date

4. Requisition/Purchase Req No.

5. Project No. (If applicable)

6. Issued By Code 7. Administered By (If other than Item 6) Code

8. Name And Address Of Contractor (No., Street, City, County, State and Zip Code)

9A. Amendment Of Solicitation No.

9B. Dated (See Item 11)

10A. Modification Of Contract/Order No.

10B. Dated (See Item 13) Code Facility Code

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in item 14. The hour and date specified for receipt of Offers is extended, is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing items 8 and 15, and returning ____________ copies of the amendments: (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. Accounting And Appropriation Data (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATIONS OF CONTRACTS/ORDERS

It Modifies The Contract/Order No. As Described In Item 14.

A. This Change Order is Issued Pursuant To: The Changes Set Forth In Item 14 Are Made In

The Contract/Order No. In Item 10A.

B. The Above Numbered Contract/Order Is Modified To Reflect The Administrative Changes (such as changes in paying office, appropriation data, etc.) Set

Forth In Item 14, Pursuant To The Authority of FAR 43.103(b).

C. This Supplemental Agreement Is Entered Into Pursuant To Authority Of:

D. Other (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return _______________ copies to the Issuing Office.

14. Description Of Amendment/Modification (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Except as provided herein, all terms and conditions of the document referenced in item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. Name And Title Of Signer (Type or print)

16A. Name And Title Of Contracting Officer (Type or print)

15B. Contractor/Offeror 15C. Date Signed 16B. United States Of America 16C. Date Signed

By (Signature of person authorized to sign) (Signature of Contracting Officer)

NSN 7540-01-152-8070

PREVIOUS EDITIONS UNUSABLE

30-105-02 STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA FAR (48 CFR) 53.243

SEE SCHEDULE

X

Firm Fixed Price

0005 2022APR07

W15QKN

ARMY CONTRACTING COMMAND - NJ

PICATINNY ARSENAL, NJ 07806-5000

BRIANNE DODD

EMAIL: BRIANNE.A.DODD.CIV@ARMY.MIL

W15QKN-22-R-0029

2022FEB11

X

X

/SIGNED/

2 signed

SEE SECOND PAGE FOR DESCRIPTION

1 10

CONTINUATION SHEET

Reference No. of Document Being Continued Page of

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

SECTION A - SUPPLEMENTAL INFORMATION

Buyer Name: BRIANNE DODD

Buyer Office Symbol/Telephone Number: CCNJ-JA/(973)724-0919

Type of Contract 1: Firm Fixed Price

Kind of Contract: Supply Contracts and Priced Orders

*** End of Narrative A0000 ***

The purpose of Amendment 0005 is to provide answers to questions from industry, update the Statement of Work (SOW) in Section C paragraphs 2.1 and 4.1, as well as, update Attachment 0001 NGATS Spares Price Matrix.

Q&A for NGATS Spares - Amendment 0005

Q1: Item 0024, Eyebolts (Floor) has a NIIN number of 012066819 and is identified as O-Ring in Publog versus Eyebolt. Please clarify.

A1: Item 0024 does not have a NIIN number. The Vendor Part Number is FDA1658M-6. Attachment 0001 NGATS Spares Price Matrix has been updated to reflect this change. The revised Attachment 0001 has been uploaded along with this amendment.

Q2: Item 0030, Connector, Receptacle NIIN number of 145649675 is not available on Publog. Please clarify.

A2: Cage code for Item 0030 is F6162.

Q3: Unable to identify component Item 0053, Universal Mini Test Clip.

A3: Cage code for Item 0053 is 16654.

Q4: Unable to identify component Item 0121, Removal Tool.

A4: Cage code for Item 0121 is 16654.

Q5: Item 0194, PCM Adapter (TTL I/O) appears to be obsolete without a replacement. Please clarify.

A5: Item 0194 is no longer required. Attachment 0001 NGATS Spares Price Matrix has been updated to remove this item listed as

Intentionally left blank to minimize renumbering. The revised Attachment 0001 has been uploaded along with this amendment.

Q6: Unable to identify component Item 0211, Add on Shelf Assembly.

A6: Cage code for Item 0211 is 19207.

Q7: Unable to identify component Item 0266, Holding/Alignment Display Assy, 13494700T1.

A7: Cage code for Item 0266 is 26916.

Q8: Item 0267, Temperature/Humidity Monitor appears to be obsolete without a replacement. Please clarify.

A8: Cage code for Item 0267 is 89536.

Q9: Unable to identify component Item 0302, Case Assembly.

A9: Cage code for Item 0302 is 19207.

Q10: Unable to identify component Item 0322, Printer, Laserjet.

A10: Cage code for Item 0322 is 18876.

Q11: Unable to identify component Item 0348, Case Assembly M1A2SEP ASU No. 1.

A11: Cage code for Item 0348 is 19207.

Q12: Unable to identify component Item 0370, Case Assy BA3/ODS SA No. 1.

A12: Cage code for Item 0370 is 19207.

2 10

W15QKN-22-R-0029

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

Q13: Item 0412, Case, Plastic is identified as Electronic Test Set" in Publog vs "Plastic Case. Please clarify.

A13: Item 0412 was deleted from the requirement. See Amendment 002. Attachment 0001 NGATS Spares Price Matrix was updated to remove this item listed as Intentionally left blank to minimize renumbering.

Q14: Item 0426, AV-MSD has the same NIIN number as Item 0026. This item description does not match.

A14: Item 0026 has the correct NIIN. Item 0426 updated part number is F107055. Attachment 0001 NGATS Spares Price Matrix was updated to include this corrected part number on Amendment 002.

Q15: Unable to identify component Item 0437, Display Assy Alignment Fixture, 13494700T2.

A15: Cage code for Item 0437 is 19207.

Q16: Unable to identify component Item 0485, FIXTURE, HOLDING BICU.

A16: Cage code for Item 0485 is 19207.

Q17: Please provide missing drawing 13716083 in order to quote the Air Transport Stop Assembly (P/N: 13716082).

A17: The Government has the drawing to provide for this. If an offeror has already provided the required technical data forms (DD Form

2345, Non-Disclosure Agreements, and an AMSTA-AR-1350) to the undersigned, please email the Contract Specialist and Contracting Officer for distribution of additional drawings which will again be done through DoD SAFE.

Q18: Please provide missing drawing 13007400. According to the PID/MFG Information, this is one that the US Army has under their control.

A18: The Government has the drawing to provide for this. If an offeror has already provided the required technical data forms (DD Form

2345, Non-Disclosure Agreements, and an AMSTA-AR-1350) to the undersigned, please email the Contract Specialist and Contracting Officer for distribution of additional drawings which will again be done through DoD SAFE.

Q19: If the small business offerors lack the full drawing package, then their only choice is to order products from the large company that controls the TDP. That is, essentially, a sole source situation that allows the large company to order commercial off the shelf products for delivery back to the small business. This could result in the Government paying significantly more than necessary for the final products. To remove barriers that could prevent small businesses from submitting competitive offers, and to obtain the best cost/price value, the Government could make available the full drawing package to facilitate much more competition. Previous sources sought for the NGATS solicitation identified the drawings for most of these cable assemblies. While the top-level drawings are Northrop property, the assemblies are made up of other piece parts. Once this information is provided, the offerors will have the vendor control documents that are needed to purchase from the correct vendor. Please provide the above information that would allow small business offerors to directly order the products from the OEMs.

A19: Publog contains the information for the required items. The Government requires parts to come from qualified/approved sources. At this time, the Government does not have the resources to qualify additional sources for the items required. For clarification, Section C

Statement of Work paragraphs 2.1 and 4.1 in the RFP have been revised.

Q20: Do bidders have the ability to provide items from any source or do they need to be an approved source?

A20: Please refer to Q1 posted on Amendment 0002. The only parts accepted will be from qualified/approved sources.

-If new sources are identified for parts, they must be qualified/approved before the parts will be accepted.

-The drawings that have been provided are all the drawings the Government intends to provide. All others parts can be obtained through vendors.

*** END OF NARRATIVE A0007 ***

3 10

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

Statement of Work (SOW) for

Acquisition of Next Generation Automated Test Station (NGATS) Parts/Modules

1. SCOPE

1.1 The items involved in this Statement of Work (SOW) defines the efforts to sustain and replenish the Next Generation Automated Test

Station (NGATS) parts/modules required by this contract and in accordance with the metrics listed in this SOW. This SOW consists of the Contractor provided support, in the areas of the management of the required spare parts, modules and hardware, and shall include the warranty of parts, and the return to depot stock.

2. BACKGROUND

2.1 The Automated Test Systems Division (ATSD) (designated as Product Support Integrator (PSI) for NGATS), in conjunction with the

Product Director Test Measurement and Diagnostic Equipment (PD TMDE) , is responsible for providing diagnostic and maintenance capabilities for all of the fielded NGATS for parts/modules. ATSD and PD TMDE require the necessary spare parts/modules to provide support to the NGATS systems, which are critical to keeping the systems at a high state of readiness. The Contractor, as the total

Product System Provider (PSP) is tasked with the responsibility for timely and efficient acquisition and delivery of qualified spare parts/modules obtained from NGATS/Direct Support Electrical System Test SET (DSESTS) qualified/approved sources. These are required to maintain and sustain NGATS to an Operational Availability (Ao) of 95% as required by the Users.

3. APPLICABLE DOCUMENTS

Parts and Components List, Attachment 0001

MIL-STD-130N - Department of Defense (DoD) Standard Practice for Identification Marking of United States (U.S.) Military Property

MIL-STD-1472G Department of Defense Design Criteria Standard Human Engineering, 11 January 2012

Department of Defense Instruction 5000.64 - Accountability and Management of DoD-Owned Equipment and Other Accountable Property, 11/02/06

DoD 4140.1-01 DoD Supply Chain Materiel Management Regulation

DFARS Clause 252.211-7003 Item Identification and Valuation, June 2016

4. REQUIREMENTS

4.1 The Contractor shall be responsible for the acquisition and delivery of all the parts and components from NGATS/DSESTS qualified/approved sources listed in Attachment 0001. All work performed by the Contractor shall be accomplished In Accordance With

(IAW) this SOW. All items delivered from the Contractor shall be the exact form, fit, and function of those identified in Attachment

0001. All warranty parts and components returned from the Contractor shall be the exact form, fit, function of those identified in

Attachment 0001. All parts and components shall be correctly labeled and delivered in the appropriate commercial packaging and in the authorized quantities according to the delivery location for individual components.

4.2 The Contractor shall be responsible for the supply of spare NGATS parts/modules to support supply Turn-Around -Time (TAT) of parts listed in Attachment 0001. In the event that the item is not an exact match, the part shall have the same functional capabilities of the item that was ordered and must be approved by the Government before delivery. The Contractor shall ensure that the Government is provided with documentation citing the acceptable use of the replacement part.

4.3 Intentionally left blank.

4.4 STATUS REPORT

4.4.1 Status Reports shall be provided (DI-MGMT-80368A). Status reports shall include all items, items currently on order, expected order dates of items not on order, delivery status, expected delivery dates, schedule slips, and any issues with the acquisition and delivery of the required items. In addition, the Contractor shall submit with each report the source, TAT for each item. The Status

Report shall include also include a warranty report and warranty tracking section.

4.5 MARKINGS

4.5.1 Item Unique Identification (IUID) Requirements

4 10

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

4.5.2 The Contractor shall implement specific Unique Identification Number (UID) markings as defined in MIL-STD-130N, DoD Instruction

5000.64, DoD 4140.1-01, and DFARS clause 252.211-7003 where applicable.

4.5.3 The two-dimensional IUID data matrix shall be machine-readable with scanning devices and shall be accompanied by the corresponding human readable markings.

4.5.4 All 2D data matrix markings shall be permanently affixed or engraved and have the ability to withstand and perform within the same environmental conditions as the system.

4.5.5 Whenever practical, the location of the markings on the item shall ensure its readability. The Contractor shall use the design criteria in MIL-STD-1472G paragraph 5.4 (Labeling) as guidance. Proposed size and location of Unique Identification Number (UID) markings shall be presented to the Government for approval.

4.5.6 All end items, spare parts, and components that exceed $5,000 when purchased separately shall also be marked with the UID prior to delivery to the Government.

4.6 WARRANTY

4.6.1 All parts/modules shall be supplied with a one (1) year warranty. The warranty shall start from the day the Government accepts the part/module into the supply system.

4.7 POST-AWARD MEETING

4.7.1 The Contractor shall conduct a Post-Award meeting with the Government Integrated Product Team (IPT). This meeting shall be scheduled within ten (10) days of contract award in order to expedite the performance of the contract. The purpose of the meeting is to ensure mutual understanding of the contract requirements and proposed work, review general approaches, schedule and level of effort, and to provide any necessary clarification. The Contractor shall maintain minutes and action items from this meeting. Action items and meeting minutes shall be distributed within one (1) day of the end of the meeting (DI-ADMN-81505).

4.8 QUALITY SYSTEM

4.8.1 The Contractor shall establish/maintain a system for the final inspection of all items. This system shall ensure that all items comply with contract acquisition and delivery requirements.

4.8.2 The Contractor shall maintain adequate records of inspections to demonstrate that the final replaced product satisfies contract requirements, to be included in the monthly status report (DI-MGMT-80368A).

4.8.3 The Contractor shall promptly act to correct nonconforming materials and conditions to satisfy contract or order requirements and prevent the recurrence of this problem.

4.8.4 The Contractor shall control the shipping to ensure the items are delivered to the appropriate facility. The delivery location for individual components is listed in Attachment 0001.

4.8.5 The Contractor shall establish/maintain a system to support all warranty items. This system shall ensure that all items returned from warranty issued are repaired and not replaced. If the warranted item requires a replacement, the Contractor shall ensure that the

Government is provided with documentation citing the acceptable use of the replacement part.

4.9 METRIC: TURN-AROUND-TIME (TAT)

4.9.1 Supply TAT measurement shall start from the time the ordered item is awarded to the Contractor and is received and accepted at the

Government receiving point.

4.9.2 If it is determined that the TAT will not be met, the Contractor shall notify the Government as soon as possible via e-mail to the

Technical Representative identified in SOW Paragraph 5.5 prior to the TAT deadline. When a delay is identified, the Contractor shall provide the reason for the delay and the estimated date for shipment. Subsequent delays shall also follow notification procedure (DI-

MISC-80508B).

4.10 Test and Evaluation Master Plan (TEMP)

4.10.1 The Contractor shall develop a TEMP to verify that all hardware conforms to the requirements of the SOW. The Government will use the TEMP to perform Validation and Verification (V&V) and Acceptance Testing (DI-QCIC-80553A).

5. GENERAL INFORMATION

5.1 The period of performance for this contract will be five (5) years from date of contract award (FY22-27) with five (5) one-year ordering periods.

5 10

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

5.2 Place of Performance Contractor facility. The Contractors facility will be determined at contract award.

5.3 Travel No travel is required.

5.4. Government Furnished Items (GFI) Not Provided

5.5 Technical Representative Joseph Mokay, joseph.j.mokay.civ@army.mil

6. COMBATING TRAFFICKING IN PERSONS

6.1 The Contractor shall establish policies and procedures for ensuring its employees do not engage in or support trafficking in persons or use forced labor in the performance of this contract.

7. SECURITY

7.1 THIS EFFORT IS UNCLASSIFIED.

7.2 Antiterrorism (AT) Level I Training. All Contractor employees, including subcontractor employees, requiring access to Department of

Defense (DoD) installations, facilities, or controlled access areas shall complete AT Level I awareness training within forty five (45) calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever applies and within twelve (12) months prior to travel outside of the United States (US), then annually thereafter (DI-MISC-80678). The Contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the Contracting Officers

Representative (COR), (or to the contracting officer, if a COR is not assigned) within fourteen (14) calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at http://jkodirect.jten.mil/

7.3 Access and General Protection/Security Policy and Procedures. All Contractor employees, including subcontractor employees, shall comply with all installation and facility access and local security policies and procedures (provided by the Government representative), and security/emergency management exercises. The Contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of Emergency Services, or

Security Office. Contractor workforce must comply with all personal identity verification requirements (CFR clause 52.204-9, Personal

Identity Verification of Contract Personnel) as directed by DoD, Headquarters Department of Army (HQDA) and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor security matters or processes. During

FPCONs Charlie and Delta, services/installation access may be discontinued/postponed due to higher threat. Services will resume when

FPCON level and or threat is reduced to an acceptable level as determined by the Installation Commander. Contractor personnel working on an installation are required to participate in the Installation Random Antiterrorism Measures Program as directed. Contractors may be subject to and must comply with vehicle searches, wearing of Identification (ID) badges, etc. Failure to comply with policies and procedures could result in barred access onto the installation.

7.4 iWATCH (See Something, Say Something) Training. All Contractor employees, including subcontractor employees, shall receive training and participate in the local iWATCH program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR.

This training shall be completed within forty five (45) calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever applies, and then annually thereafter (DI-MISC-80678). The Contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR (or to the contracting officer, if a COR is not assigned) within fourteen (14) calendar days after completion of training by all employees and subcontractor personnel.

Slides available to COR at https://www.milsuite.mil/book/docs/DOC-284984

7.5 For Contractors requiring Common Access Card. Before CAC issuance, the contractor employee requires, at a minimum,a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-

05. The Contractor employee will be issued a CAC only if duties involve one of the following: (1) both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of six (6) months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled National Awareness Check With Inquiries

(NACI) at the Office of Personnel Management.

7.6 For Contractors that do not require CAC, but require access to a DoD facility or installation. Contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate

Identification Index (NCIC-III) and Terrorist Screening Database (Army Directive

2014-05/AR 190-13); applicable installation, facility and area commander installation and facility access and local security policies and procedures (provided by Government representative); or, at OCONUS locations, in accordance with status-of-forces agreements and other theater regulations.

7.7 Employees Who Require Access to Government Information Systems. All Contractor employees, including subcontractor employees, with access to a Government information system must be registered in the Army Training Certification Tracking System (ATCTS) at commencement

6 10

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

of services and must successfully complete the DoD Cyber Awareness training prior to access to the information system and then annually thereafter.

7.8 Government Furnished Items. All Contractor employees, including subcontractor employees, will return all issued U.S. Government owned equipment which includes travel laptops, mobile devices, Common Access Cards, installation badges, and/or access passes to the COR when the contract is completed or when a contractor employee no longer requires access to the installation or facility.

7.9 Information Management Army Information Technology /IA: The Contractor shall be capable of accessing, handling, receiving, and storing UNCLASSIFIED documents, equipment, hardware, and test items, using the applicable standards of FOUO information. Controlled

Unclassified Information (documents designated as FOR OFFICIAL USE ONLY and/or

LIMITED DISTRIBUTION) shall be submitted by a controlled means using United States Postal Service (USPS) mail, Safe Access File Exchange

(SAFE) website and/ or DoD Army approved encryption software as per AR 25-1.

7.10 Export Control Laws/International Traffic in Arms Regulation. DFARS Clause 252.225-7048, Export-Controlled Items applies to this effort. All documents determined to contain export controlled technical data will be marked with the following notice: WARNING: - This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., App. 2401 et seq.

Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive

5230.25.

7.11 For Official Use Only Information (FOUO) and Controlled Unclassified Information (CUI): Contract personnel shall be capable of accessing, handling, receiving, and storing UNCLASSIFIED documents, equipment, hardware, and test items, using the applicable standards of FOUO and CUI. DFARS Clause 252.204-7012, Safeguarding Covered Defense

Information and Cyber Incident Reporting applies to this effort.

7.12 Development of an Operations Security (OPSEC) Standing Operating Procedure/Plan. The Contractor shall develop an OPSEC Standing

Operating Procedure (SOP)/Plan, DI-MGMT-80934C, within ninety (90) calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer, per AR 530-1, Operations Security. This SOP/Plan will specify the projects critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. In addition, the Contractor shall identify an individual who will be an OPSEC Coordinator. The Contractor will ensure that this individual becomes OPSEC Level II certified per AR 530-1. CCDC Armaments Center OPSEC POC email: usarmy.pica.ccdc-ac.mbx.ardec-opsec@mail.mil

7.13 OPSEC Training. Per AR 530-1 (or DoDM 5205.02-M), new Contractor employees, including subcontractor employees, must complete initial (Level I) OPSEC training within thirty (30) calendar days of reporting for duty and must also complete annual OPSEC awareness training as provided by the appropriately designated OPSEC level II trained OPSEC Officer/Coordinator (DI-MISC-80678). The COR or

Agreements Officer Representative (AOR) can request CCDC Armaments Center OPSEC training from CCDC Armaments Center OPSEC POC e-mail:

"mailto:usarmy.pica.ccdc-ac.mbx.ardec-opsec@mail.mil " ._____________________________________________________________

7.14 Public Release of Information. Per AR 530-1 (or DoDM 5205.02-M), an OPSEC review is required prior to all public releases. All

Government information intended for public release by a Contractor will undergo a Government OPSEC review prior to release.

7.15 Controlled Unclassified Information (CUI) OR Critical Program Information (CPI). System Security Plan and Plans of Action and

Milestones (SSP/POAM) Reviews:

(a) Within thirty (30) calendar days of contract award, unless otherwise notified by the Government, the Contractor shall make its

System Security Plan(s) (SSP(s)) for its covered Contractor information system(s) available for review by the Government at the

Contractor's facility. The SSP(s) shall describe how the National Institute of Standards and Technology (NIST) Special Publication (SP)

800-171 security requirements are implemented as required by Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-

7012, which is included in this contract, and identify all applicable Commercial and Government Entity Code codes affected. The

Contractor shall fully cooperate in the Government's review of the SSPs at the Contractor's facility.

(b) If the Government determines that the SSP(s) does not adequately describe how the NIST SP 800-171 security requirements are implemented, then the Government will notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) calendar days of notification by the Government. The Contracting Officer may provide for a correction period longer than thirty (30) calendar days and, in such a case, may require the Contractor to submit a Plan of Action and Milestones

(POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the Contracting Officer of any failure or anticipated failure to meet a milestone in such a POAM.

(c) Upon conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor's facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

(d) The Government may, in its sole discretion or in response to a cyber incident, conduct subsequent reviews at the Contractor's site to verify the information in the SSP(s). The Government may conduct reviews at any time upon thirty (30) calendar days' notice to the

Contractor.

7.16 Controlled Unclassified Information (CUI) OR Critical Program Information (CPI). Compliance to NIST SP 800-171:

(a) The Contractor shall fully implement the Controlled Unclassified Information (CUI) Security Requirements (Requirements) in NIST SP

800-171 in effect at the time the solicitation is issued or as authorized by the Contracting Officer, or establish a SSP(s) and POAMs) that varies from NIST SP 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered Contractor information systems

7 10

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

affecting this contract.

(b) Notwithstanding the allowance for such variation, the Contractor shall identify in any SSP and POAM their plans to implement the following, at a minimum:Aug 2016

(1) Implement Requirement 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Requirement 3.1.5 (least privilege) and associated Requirements, and identify practices that the Contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Requirement 3.1.12 (monitoring and control remote access sessions)-Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods;

(4) Audit user privileges on at least an annual basis;

(5) Implement Requirement 3.13.11 (Federal Information Processing Standards (FIPS) 140-2 validated cryptology or implementation of

National Security Agency- or NIST-approved algorithms (i.e., FIPS 140-2 Annex A: Advanced Encryption Standard (AES) Or Triple Data

Encryption Standard (DES) or compensating controls as documented in a SSP and POAM));

(6) Implement Requirement 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which can be evaluated by the Government Program Manager for risk to the program;

(7) Implement Requirement 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

7.17 Controlled Unclassified Information (CUI) OR Critical Program Information (CPI). Army Counterintelligence (CI) Outreach: The

Contractor shall engage, whenever practicable, with Army Cl industry outreach efforts and consider recommendations for hardening of covered Contractor information systems affecting Army programs and technologies; and make Contractor personnel available for threat briefings specific to foreign intelligence threats to Army programs and technologies.

7.18 Controlled Unclassified Information (CUI) OR Critical Program Information (CPI). Cyber Incident Response:

(a) The Contractor shall, within fifteen (15) calendar days of discovering the cyber incident (inclusive of the seventy two (72)-hour reporting period in DFARS clause 252.204-7012), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact. Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/lnstructions_for_Submitting_Media.docx . In delivery of the incident data, the

Contractor shall, to the extent practical, remove Contractor-owned information from Government covered defense information.

(b) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the Contracting Officer in writing and shall deliver the incident data within ten (10) calendar days of identification. In such a case, the Contractor may request a delivery date later than ten (10) calendar days after identification. The Contracting Officer will approve or disapprove the request after coordination with DC3.

7.19 Controlled Unclassified Information (CUI) OR Critical Program Information (CPI). Army CI/Industry Monitoring:

(a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the

Contractor shall cooperate with the Army Cl, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor, or vendor logs that show network activity, including any additional logs the Contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

(b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor shall coordinate with Army Cl to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by the Army Cl, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an Army Cl network device shall be the subject of a separate agreement negotiated between Army Cl and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by Army Cl. Use of this alternative approach shall also be the subject of a separate agreement negotiated between Army Cl and the Contractor.

(c) In all cases, the collection or provision of data and any activities associated with this PWS shall be in accordance with federal, state, and non-U.S. la

8. NON-U.S. CITIZEN EMPLOYEE REQUIREMENT

8.1 US citizens are authorized to work on this contract. Non-US citizens will not be allowed to perform work on contracts or subcontracts involving access (or possible access) to sensitive data, software, or equipment without prior approval from Headquarters, Army Futures Command.

8 10

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

*** END OF NARRATIVE C0001 ***

9 10

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

SECTION J - LIST OF ATTACHMENTS

List of Number List of Number

Addenda Title Date of Pages Transmitted By Addenda Title Date of Pages Transmitted By________________ ____________________________________________________________ _______________ ____________ _______________________________ ____________________________________________________________ _______________ ____________ _______________

Attachment 0001 NGATS SPARES PRICE MATRIX 06-APR-2022 001 EMAIL

10 10