E2FDS_W56HZV-15-R-0221_0004.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. Contract ID Code Page Of

2. Amendment/Modification No.

3. Effective Date

4. Requisition/Purchase Req No.

5. Project No. (If applicable)

6. Issued By Code 7. Administered By (If other than Item 6) Code

8. Name And Address Of Contractor (No., Street, City, County, State and Zip Code)

9A. Amendment Of Solicitation No.

9B. Dated (See Item 11)

10A. Modification Of Contract/Order No.

10B. Dated (See Item 13) Code Facility Code

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in item 14. The hour and date specified for receipt of Offers is extended, is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing items 8 and 15, and returning ____________ copies of the amendments: (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. Accounting And Appropriation Data (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATIONS OF CONTRACTS/ORDERS

It Modifies The Contract/Order No. As Described In Item 14.

A. This Change Order is Issued Pursuant To: The Changes Set Forth In Item 14 Are Made In

The Contract/Order No. In Item 10A.

B. The Above Numbered Contract/Order Is Modified To Reflect The Administrative Changes (such as changes in paying office, appropriation data, etc.) Set

Forth In Item 14, Pursuant To The Authority of FAR 43.103(b).

C. This Supplemental Agreement Is Entered Into Pursuant To Authority Of:

D. Other (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return _______________ copies to the Issuing Office.

14. Description Of Amendment/Modification (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Except as provided herein, all terms and conditions of the document referenced in item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. Name And Title Of Signer (Type or print)

16A. Name And Title Of Contracting Officer (Type or print)

15B. Contractor/Offeror 15C. Date Signed 16B. United States Of America 16C. Date Signed

By (Signature of person authorized to sign) (Signature of Contracting Officer)

NSN 7540-01-152-8070

PREVIOUS EDITIONS UNUSABLE

30-105-02 STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA FAR (48 CFR) 53.243

SEE SCHEDULE

X

Firm Fixed Price

0004 2016MAR18

W56HZV

U.S. ARMY CONTRACTING COMMAND

WARREN, MICHIGAN 48397-5000

MICHAEL G. IVKOV

EMAIL: MICHAEL.G.IVKOV.CIV@MAIL.MIL

W56HZV-15-R-0221

2016FEB01

X

X 2016MAR28 01:00pm

/SIGNED/

2 signed

SEE SECOND PAGE FOR DESCRIPTION

1 36

CONTINUATION SHEET

Reference No. of Document Being Continued Page of

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

SECTION A - SUPPLEMENTAL INFORMATION

Buyer Name: MICHAEL G. IVKOV

Buyer Office Symbol/Telephone Number: CCTA-HCP-A/(586)282-2644

Type of Contract 1: Firm Fixed Price

Kind of Contract: System Acquisition Contracts

*** End of Narrative A0000 ***

The purpose of Amendment 0004 to Solicitation W56HZV-15-R-0221 is as follows:

1. The proposal response date has been EXTENDED from 1:00PM Local Warren, Michigan time, 25 March 2016 to 1:00PM Local Warren, Michgan time, 28 March 2016.

2. Section C:

a. Section C.5.1.1

PREVIOUS:

Delivery of EMD PRS. The contractor shall deliver one EMD PRS IAW (ATPD 2417 section 3.3.1.5.4) to include two C2M IAW

(ATPD 2417 section 3.3.5) and the combination of all the major components and equipment required to achieve 5-mile capability of fluid distribution. Also, included as part of the EMD PRS, the contractor shall deliver additional components for testing to include only the number of automated pumps in a 5-mile set IAW (ATPD 2417 section 3.3.1.5.4), two additional automated pumps IAW

(ATPD 2417 section 3.3.4), two additional ERS IAW (ATPD 2417 section 3.3.3), one gap crossing kit IAW (ATPD 2417 section

3.3.2.22.3), one set of adapters IAW (ATPD 2417 section 3.5.11) and one mile of additional hose IAW (ATPD 2417 section 3.3.2).

The EMD PRS must be delivered IAW section F.

REVISED:

Delivery of EMD PRS. The contractor shall deliver one EMD PRS IAW (ATPD 2417 section 3.3.1.5.4) to include two C2M IAW

(ATPD 2417 section 3.3.5) and the combination of all the major components and equipment required to achieve 5-mile capability of fluid distribution. Also, included as part of the EMD PRS, the contractor shall deliver additional components for testing to include only the number of automated pumps in a 5-mile set IAW (ATPD 2417 section 3.3.1.5.4), two additional automated pumps IAW

(ATPD 2417 section 3.3.4), two additional ERS IAW (ATPD 2417 section 3.3.3), one gap crossing kit IAW (ATPD 2417 section

3.3.2.14.3), one set of adapters IAW (ATPD 2417 section 3.5.11) and one mile of additional hose IAW (ATPD 2417 section 3.3.2).

The EMD PRS must be delivered IAW section F.

b. Section C.5.2.1.3

PREVIOUS:

Hose Assembly. Model depicting hose assembly, component attributes, and all associated parts lists.

REVISED:

Hose Assembly. Isometric model depicting hose assembly, component attributes, and all associated parts lists.

c. Section C.5.2.1.4

PREVIOUS:

Hose Employment and Retrieval System. Models depicting ERS to include power source and all additional major components, length of hose stored per unit, system weights, quantity of units stored per ISO TEU, and all associated parts lists.

REVISED:

Hose Employment and Retrieval System. Isometric Models depicting ERS to include power source and all additional major components, length of hose stored per unit, system weights, quantity of units stored per ISO TEU, and all associated parts lists.

3. Section J:

a. Update Attachment 0031, Price Evaluation Sheet as of 14 March 2016. (Note: "Offeror" and "CAGE Code" cells on "Ordering Period 2" tab are now unlocked.)

2 36

W56HZV-15-R-0221 0004

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

b. Update Attachment 0032, Ordering Period 2 PES as of 14 March 2016. (Note: "Offeror" and "CAGE Code" cells on "ordering Period 2

(P&D Phase)" tab are now unlocked.)

*** END OF NARRATIVE A0005 ***

3 36

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 SCOPE

C.1.1 Introduction

This Statement of Work (SOW) encompasses the Engineering, Manufacturing, and Development (EMD) and Production & Deployment (P&D) phases of the Early Entry Fluid Distribution System (E2FDS) acquisition program. The E2FDS compliments the Inland Petroleum Distribution

System (IPDS) by providing an early entry bulk fuel and raw water distribution capability. The E2FDS can throughput up to 850,000 gallons of petroleum or 650,000 gallons of non-potable water per day, and can be deployed at 25 miles per day and retrieved at 10 miles per day. The E2FDS is comprised of five mile sets capable of being configured into a 50 mile trace. These five mile sets include

Automated Pump Stations, Employment & Retrieval System (ERS), and five miles of flexible hose with Hose Support Equipment. The E2FDS also includes a Command and Control Module (C2M) and a Trace Planning Tool (Trace Planning Tool will be provided by the Government).

The initially acquired five mile sets will contain the above referenced components, including the C2M. Subsequent five mile sets will not include the C2M, but can be connected with the initial sets to achieve a 50-mile system.

C.1.2 Background

The E2FDS requirements are fully described in the E2FDS Purchase Description, Attachment 0001 - ATPD 2417. The E2FDS shall be developed, designed, modeled, simulated, fabricated, tested, and delivered to maximize performance.

C.1.3 Calendar

All contract references to days shall be recognized as calendar days, unless specifically identified as workdays.

C.1.4 General Requirements

All EMD references identified in this SOW shall pertain to the EMD Phase and all production references shall pertain to the P&D Phase unless specifically stated otherwise. The MEETINGS/CONFERENCES/PROGRAM REVIEWS and INFORMATION ASSURANCE (IA)/CYBERSECURTIY/PROGRAM

PROTECTION sections of the SOW will cover tasks that relate to both the EMD and P&D phases.

C.2 APPLICABLE DOCUMENTS

a) American Society for Nondestructive Testing Recommended Practice No. SNT-TC-1A

b) American Welding Society (AWS) Codes

c) Army Pamphlet (DA PAM) 700-60

d) Army Pamphlet (DA PAM 700-21-1)

e) Army Regulation 700-127

f) Army Regulation 25-2

g) Army Regulation 350-1

h) Army Regulation 702-7

i) Army Supply Catalog (SC)

j) ASME/ISO/ASQ Q9001-2000

k) ATPD 2417 (E2FDS Purchase Description)

l) Automotive Industry Action Group (AIAG)

m) Canadian Standards Association (CSA) Standard W 178.2 Certification of Welding Inspectors

n) Code of Federal Regulations (Title 10, Part 40)

o) Code of Federal Regulations (Title 29, Title 40 and Title 49)

p) Corrosion Prevention and Control Planning Guidebook for Military Systems and Equipment (Spiral 4)

q) CWE/SANS top 25 most dangerous software errors (http://cwe.mitre.org/top25/index.html)

r) DISA Application Security and Development Security Technical Implementation Guide (STIG)

s) DoD Instruction (DoDI) 8500.01 (Cybersecurity)

t) DODI 8510.01

u) DoDI 8551.1 (Ports, Protocols and Services Management (PPSM))

v) FED-STD-313, Section 3.2

w) Exhibit A, Contract Data Requirements List (CDRL)

x) International Air Transport Association (IATA) Dangerous Goods Regulations

y) International Maritime Dangerous Goods Code (IMDG)

z) International Organization for Standards (ISO 10007)

aa) International Organization for Standards (ISO/IEC 15434)

ab) International Organization for Standards (ISO/IEC 15418)

ac) International Organization for Standards (ISO 6346)

ad) International Organization for Standards (ISO 9001:2008)

ae) International Organization for Standards (ISO 10007

af) Joint Service Regulation AFJMAN24-204(I)

ag) MIL-DTL-53072

ah) MIL-HDBK-138

ai) MIL-HDBK-1222

4 36

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

aj) MIL-HDBK-2361

ak) MIL-STD-1472

al) MIL-STD-1474

am) MIL-STD-882E

an) MIL-STD-2073-1E

ao) MIL-STD-2073-1D

ap) MIL-STD-129

aq) MIL-STD-130

ar) MIL-STD-2361

as) MIL-STD-40051

at) National Consensus Standard for Configuration Management (EIA-649, EIA-649-1)

au) National Institute of Standards and Technology (NIST) 800-30

av) National Institute of Standards and Technology (NIST) SP 800-53, Rev 4

aw) Reliability Program Standard for Systems Design, Development, and Manufacturing (GEIA-STD-0009)

ax) Secure design patterns (www.cert.org/archive/pdf/09tr010.pdf - 2009-10-23)

ay) Top 10 secure coding practices: https://www.securecoding.cert.org/confluence/display/seccode/Top+10+Secure+Coding+Practices

az) TRADOC Regulation 350-70

ba) DoD Directive 8190.3 Smart Card Technology

bb) DoD Instruction 8520.2, Public Key Infrastructure (PKI) and Public Key (PK) Enabling

bc) Attachments 0001 through 0032 as listed in Section J

bd) Contract Line Item Requirements (CDRLs) A001 through A089 as listed in Section J

be) DOD-STD-480A Configuration Control Engineering Changes, Deviations and Waivers

C.2.1 SPECIFICATIONS AND STANDARDS

C.2.1.1 To the extent that this statement of work references industry and Government standards and specifications, such standards and specifications are incorporated by reference.

C.2.1.2 Exhibit A, Contract Data Requirements List (CDRL), contains references to Government Data Item Descriptions and other documents.

These documents are available at: https://assist.dla.mil/online/start/. This web site provides an on-line registration process by which contractors may obtain a password.

C.3 MEETINGS/CONFERENCES/PROGRAM REVIEWS

C.3.1 Objective. The contractor and Government shall have meetings and reviews during this contract's performance period as outlined below. The objectives of these meetings are to review progress and provide guidance on contractual, technical, logistics, or other issues that are critical to successful contract performance.

C.3.1.1 Agenda. The contractor shall provide a draft agenda for Government review prior to each meeting/conference/review IAW CDRL A001.

C.3.1.2 Meeting Minutes. The contractor shall take minutes for all meetings, conferences, and reviews, and submit them to the

Government for review and approval IAW CDRL A002. The contractor shall summarize the meeting and identify all action items assigned for both parties to accomplish, along with a completion date for each action item, and all actions requiring Procuring Contracting Officer

(PCO) approval. The contractor shall provide the Government draft minutes no later than two days after the completion of the meeting and shall submit approved minutes no later than one day after receipt of government comments.

C.3.1.3 Integrated Program Management Report (IPMR). The contractor shall develop and deliver a detailed IPMR for the E2FDS IAW CDRL

A003 and Attachment 0025 Integrated Master Schedule. The IPMR defines the contractor's organizational roles, staffing (prime and sub-contractor), and the program in terms of cost, schedule, and performance.

C.3.2 Internet-Based Collaboration

C.3.2.1 Collaboration tools. The following Internet-based collaboration tools shall be used to facilitate information sharing and collaboration within a secure Government server environment that provides controlled, distributed access to E2FDS program information.

The Government will host all Internet-based collaboration environments.

C.3.2.1.1 The contractor shall participate in Government internet conferencing (web meetings) using Government approved systems.

C.3.2.1.2 The contractor shall use VISION Digital Library System (VDLS) to access Test Incident Reports (TIRs), and unclassified data from Government testing. A list of contractor personnel requiring VDLS access shall be provided to the Government (60) days prior to the Test Readiness Review (TRR).

C.3.2.1.3 Details on specific collaboration tools, requirements for access, and approach for use will be discussed at the Start of Work

Meeting (SOWM). The Government will sponsor Army Knowledge Online (AKO), VDLS, and other required accounts. The Government can only sponsor accounts for U.S. Citizens. The contractor shall provide names, contact information, level of access (upload or download), and

5 36

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

training required for personnel requiring access to these tools at the SOWM meeting (for all systems except VDLS).

C.3.2.1.4 In order to access these systems, the contractor shall have or obtain External Certification Authority (ECA) Certificates and/or DoD Common Access Cards (CAC) for appropriate personnel. The contractor shall designate an IA Officer to work with the

Government IA Manager in order to obtain and implement usage of the ECA and/or CAC program in compliance with DoD Directive 8190.3 Smart

Card Technology, and DoD Instruction 8520.2, Public Key Infrastructure (PKI) and Public Key (PK) Enabling.

C.3.2.1.5 The contractor shall notify appropriate Government personnel via e-mail when new or updated documents are posted to a collaboration environment. The notification email shall include a hyperlink to the location of the posted content.

C.3.3 Start of Work Meeting (SOWM)

C.3.3.1 Thirty (30) days after contract award the contractor shall attend a SOWM held at the Detroit Arsenal. This meeting will focus on contract terms and conditions, a review of all data requirements, required specifications, program schedule, test requirements, software development, IA/Cybersecurity requirements, and logistics requirements to ensure a complete understanding of the requirements.

The objective of the SOWM is to confirm a full and mutual understanding of Government requirements, program obligations, objectives, and responsibilities, and to conduct an overall review of the projected contractor approach, general assumptions, schedule, anticipated level of effort, and any other areas needing clarification.

C.3.3.2 The contractor shall make available key personnel (prime and sub-contractor) to include: contract administration personnel, management, engineers, logistics support personnel, IA/Cybersecurity managers, and other personnel involved with producing and supporting the E2FDS.

C.3.3.3 Follow-on SOWM. The Government will schedule a follow-on SOWM to be conducted at the contractor's facility between the

Government and contractor's teams, ten business days after the award of delivery order 0002, to review publication and logistical contractual requirements, establish lines of communications, and answer all publications and provisioning related questions.

C.3.3.4 Limited User Test Readiness Review. Concurrent with the follow-on SOWM the Government will conduct a Limited User Test (LUT) readiness review with the contractor, at the contractor's facility, to provide status of current system for user testing. The

Government will conduct a review of Engineering Development Test (EDT) test issues/resolution, support package shipment/readiness, contractor support for Familiarization training, and EMD Production Representative System (PRS) operational readiness with the contractor in preparation for LUT testing.

C.3.4 Integrated Product Team (IPT)

C.3.4.1 For purposes of this Contract, any joint deliberative or task-focused body, regardless of its formal or informal title, (e.g., "Working Group," "Integrated Design Team", etc.) shall be considered an IPT. The Government IPT Points of Contact are detailed in

Attachment 0022 IPT Matrix. The contractor's personnel shall be assigned to IPTs in the areas of contract and program management, engineering, software, IPS, test, cost, and production. Whenever practical, the contractor shall enable Government approved videoconference or teleconference and net-meeting connections to remote attendees. The contractor shall facilitate communications with the Government and any sub-contractors.

C.3.4.2 IPT meetings shall be held bi-weekly. The contractor shall allow dial-in access to the Government for all contractor IPT meetings following both SOWM events, in order to allow mutual understanding and maintain the program direction.

C.3.5 Program Status Reviews (PSRs)

C.3.5.1 The contractor shall conduct quarterly PSRs at the contractor's facility, with senior-level program management participation.

The contractor shall present schedule, performance, supportability, and risk status at each PSR and be prepared to discuss details with the Government. PSRs shall be held in conjunction with Technical Reviews, provisioning conferences, and publication reviews when feasible to limit meetings.

C.3.5.2 The contractor shall schedule and attend a minimum of three publications PSRs. Frequency shall be coordinated with the

Contracting Officer Representative (COR). The contractor shall be prepared to answer questions from the Government regarding publications work processes, Quality Assurance (QA) reviews, and work samples. If additional PSRs are required due to poor contractor performance as determined by the Government, they will be at no cost to the Government. PSRs will be conducted at the contractor's facility.

C.3.6 Provisioning Conferences. An initial provisioning conference shall be held at the contractor's facility 60 days after the follow-on SOWM to include any sub-contractors hired for logistics support. Follow-on Provisioning conferences shall be held as required until the provisioning effort is complete. Each provisioning conference will cover no more than 1500 items presented for review and will include the data from the following CDRLs: A005 Prescribed Load List (PLL), A030 Support Tools and Test Equipment (STTE) , A031

Authorized Stockage List (ASL), A032 National Maintenance Work Requirements (NMWR) Candidate List, A038 Long Lead Time Items (LLTI), A039 Basic Issue Items (BII), A040 Expendable and Durable Items List (EDIL), A041 Component of End Item (COEI), A042 Pre-Procurement

Screening (PPS), A043 Provisioning Parts List (PPL), and A078 Engineering Data for Provisioning (EDFP).

6 36

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

C.3.7 Risk Management. The contractor shall identify, monitor, manage and mitigate all program risks. The contractor shall provide a

Risk Management Status Report IAW CDRL A081. The contractor shall continue to track and manage risk elements until Government acceptance of mitigated risk. The contractor shall implement risk management and rework procedures with each sub-contractor and partners to address component and integration problems early in the development process to ensure timely delivery of the E2FDS. The contractor shall incorporate all risks as identified by either the contractor or the Government. Resolved risks shall be archived on the report after Government approval.

C.4 INFORMATION ASSURANCE/CYBERSECURTIY/PROGRAM PROTECTION

C.4.1 E2FDS Cybersecurity Strategy

C.4.1.1 The contractor shall develop a Cybersecurity Strategy IAW CDRL A067 that addresses the contractor's Software Development, Software Assurance, Hardware Validation, Supply Chain Risk Management, Testing (Architecture and Configuration), Vulnerability

Management, Patch Management, Release Management and Configuration Management efforts for the E2FDS System. This strategy will be used to validate the systems cybersecurity posture throughout contract period of performance.

C.4.1.2 The contractor shall provide a copy of its Cybersecurity Strategy in accordance with (IAW) CDRL A067 which will be incorporated into the program's Cybersecurity Strategy. The contractor shall execute the Cybersecurity Strategy which includes: analyzing system security requirements derived from the requirements of this contract; designing a system and the security architecture; developing detailed system security design; developing security test strategy; and developing a report that outlines the system risk for the proposed architecture IAW CDRL A068, System Security Design and Risk Assessment. The contractor shall support IA/cyber certification and accreditation of the system by providing Cybersecurity Accreditation Artifacts Package IAW CDRL A066. This information shall be available to the Government and discussed at IPT meetings and technical reviews.

C.4.1.3 The contractor shall comply with the latest version, as of the time of solicitation, of Army and DoD Information Assurance /

Cybersecurity policies to include Army Regulation 25-2, Information Assurance (IA), associated Best Business Practices, Security

Technical Implementation Guides, Department of Defense (DoD) policy to include DoD Instruction (DoDI) 8500.01 Cybersecurity, National

Institute of Standards and Technology (NIST) standards, including Federal Information Processing Standards (FIPS) publications. The contractor shall provide the IA documentation needed for accreditation as outlined in DODI 8510.01 and conform to IA controls outlined in NIST SP 800-53 Rev 4, Recommended Security Controls for Federal Information Systems and Organizations. The contractor shall conform to DoDI 8551.1, Ports, Protocols and Services Management (PPSM). In addition as part of CDRL A046 the contractor shall list all PPSM being used in E2FDS System software and associate those PPSM to the modules and functions where they are used.

C.4.2 Cybersecurity Risk Assessments. The contractor shall evaluate the system's security posture, both physical and logical, identifying weaknesses and potential exposures, and providing countermeasures and controls available to mitigate risk. This assessment shall be conducted and reported IAW the NIST 800-30 framework using the Common Vulnerabilities and Exposures (CVE) dictionary identifiers, and shall identify assets that need additional security, protection, or have vulnerabilities. The contractor shall also evaluate the security of the E2FDS against the Common Attack Pattern Enumeration and Classification (CAPEC) catalog of common attack patterns and identify assets that need additional security protection against these common attack patterns. The contractor shall develop a set of recommendations to eliminate or mitigate those threats and submit it to the Government IAW CDRL A068, System Security

Design and Risk Assessment. This information shall be made available to the Government and discussed at IPT meetings and technical reviews. The System Security Design and Risk Assessment shall include:

a) A Security Architecture for the Design

b) System risks for the proposed architecture

c) A Security Test Strategy to validate Design

d) Weaknesses and potential exposures with countermeasures and controls available to mitigate risk

e) Assessment against the CVE dictionary identifiers

f) Assessment against CAPEC catalog of common attack patterns

g) Recommendations to eliminate or mitigate possible threats

C.4.2.1 The report shall contain a five by five matrix to identify risks to Security. A vertical axis shall indicate the Likelihood and the horizontal axis shall indicate the Consequence of a root cause occurrence. The level of risk for each root cause shall be identified as green low, yellow for moderate, or red for high.

C.4.2.2 The report shall contain a narrative briefly describing the risk, title, root cause, current mitigations, and planned mitigations efforts identified, along with critical dates (risk reduction milestones).

7 36

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

C.4.3 Cybersecurity Accreditation Artifact Package. The contractor shall develop a Cybersecurity Accreditation Artifact Package (CDRL

A066). The information used to create the deliverable for CDRL A066, shall be available to the Government and discussed at IPT meetings and technical reviews. The Cybersecurity Accreditation Artifact Package shall include the following items:

a) Systems Security Plan (SSP) - provide an overview of the security requirements of the system and describe the controls in place or planned for meeting those requirements. Also, delineates responsibilities and expected behavior of all individuals who access the system.

b) Evidence of applied Best Business Practices (BBPs) and STIGs as applicable based on architecture and software.

c) Data Flow Diagram

d) Architecture (topology) Diagram

e) Hardware and Software List (included vendors, versions)

f) Ports Protocols and Services List and how each impacts the function of the system.

g) System backup and restoration procedures

h) Account management procedures

i) Roles based access permission description

j) Products undergoing cryptographic certification, status and evaluating organization

k) Products undergoing IA and IA enabled product certification, status and evaluating organization

l) Other artifacts as needed to meet risk management framework documentation requirements

C.4.4 Cybersecurity and Software Scans

C.4.4.1 The contractor shall provide the Government access to the software source code repositories for all E2FDS software (excluding closed source Commercial Off-The-Shelf (COTS) for Software Code Scans). The contractor shall provide a plan for managing the software code library as part of CDRL A067.

C.4.4.2 The contractor shall allow the Government to conduct software assurance scans on the contractor's software to determine if there are any vulnerabilities in the system software code. The contractor shall resolve any vulnerabilities discovered in CAT I or CAT II critical functions as defined in the DISA Application Security and Development STIG as a result of the baseline software analysis and

Government scans. Mitigation information shall be delivered IAW CDRL A068 (System Security Design and Risk Assessment. Mitigation information shall be discussed at IPT meetings. The contractor shall ensure each source code repository can accept the Government's

Hewlett Packard (HP) Fortify 360 Suite Static Code Analyzer scanning software tool.

C.4.4.3 The contractor shall conduct Cybersecurity vulnerability scans on the E2FDS System architecture utilizing an approved Security

Content Automation Protocol (SCAP) scanner to determine if there are any vulnerabilities or non-conformance to the STIG in the system.

The contractor shall provide the Government a report of the cybersecurity vulnerability scans completed on the E2FDS System IAW the

Cybersecurity Vulnerability Scanning Report, CDRL A069. The report shall address root cause determination, corrective action development and implementation, process control improvement, and scan results. Scan schedule and plans (and results when available), shall be available to the Government and discussed at IPT meetings and at technical reviews.

C.4.4.4 The contractor shall conduct an Initial Baseline Cybersecurity vulnerability scan 15 days prior to TRR. A second Cybersecurity scan shall be conducted at Production Readiness Review (PRR) on the final configuration managed software build that has gone through a pre-software qualification test by the contractor.

C.4.5 Cyber Security Testing. The contractor shall attend and provide security information and answer any questions prior to and during

Cybersecurity (Adversarial Assessment). Cybersecurity readiness testing will be conducted during all EDT and P&D Initial Operation Test and Evaluation (IOT&E) events.

C.4.6 Cyber Security Vulnerability Management. The contractor shall establish an Information Assurance Vulnerability Management (IAVM)

Program for the E2FDS program that is consistent with DoD IA guidelines, critical patches shall be provided to the government within 7 days of identification, all other patches will be provided to the government within 21 days of identification. The contractor shall monitor Government, vendor, and industry releases by subscribing to vulnerability notification services and reviewing other data available to identify vulnerabilities in software and hardware used in the E2FDS Systems. The contractor shall subscribe to the

Government email notifications from the IAVM notification system, currently hosted at https://iavm.csd.disa.mil/. The contractor shall ensure that all applicable patches have been applied within 7 days of Information Assurance Vulnerability Alert (IAVA) release. The

8 36

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

contractor shall provide installation software and instruction for Government installation of these applicable security patches to previously delivered E2FDS systems IAW CDRL A066. If a patch to an applicable IAVA cannot be applied, the contractor shall document the risk assessment and justification in CDRL A068, System Security Design and Risk Assessment.

C.4.7 Program Protection

C.4.7.1 The contractor shall develop, update, and deliver mission criticality analysis(-es), vulnerability assessment(s), risk assessments(s), and identification and counter measurement implementation(s) for E2FDS Mission-Critical Functions, the failure of which would result in either Level I (Catastrophic) or Level II (Critical) compromise of mission capability IAW CDRL A068 and Attachment 0021

Program Protection.

C.4.7.2 Adapting the MIL-STD-882 (System Safety) definitions of criticality to mission criticality, the contractor shall apply the following criticality levels:

a) Level I (Catastrophic) protection failure that results in total compromise of mission capability

b) Level II (Critical) protection failure that results in unacceptable compromise of mission capability or significant mission degradation

c) Level III (Marginal) protection failure that results in partial compromise of mission capability or partial mission degradation

d) Level IV (Negligible) protection failure that results in little or no compromise of mission capability.

C.4.7.3 For each Level I and Level II Mission-Critical Function identified by the contractor in the criticality analysis, the contractor shall identify the associated E2FDS logic-bearing system components (e.g., hardware, firmware, and software) that implement, protect, or introduce vulnerability, to that function (hereafter referred to collectively as the critical components).

C.4.7.4 The contractor shall plan for and provide risk mitigation of foreign intelligence or foreign influence, technology exploitation, supply chain and battlefield threats, and vulnerabilities that result in Level I and Level II protection failures of the E2FDS.

C.4.7.5 The contractor shall develop a set of secure coding standards and secure design features to use with all E2FDS Level I Mission-

Critical Function components using the following as a guide: the top 10 secure coding practices

(https://www.securecoding.cert.org/confluence/display/seccode/Top+10+Secure+Coding+Practices), the CWE/SANS top 25 most dangerous software errors (http://cwe.mitre.org/top25/index.html), and the secure design patterns (www.cert.org/archive/pdf/09tr010.pdf - 2009-10-

23). The contractor shall document these standards IAW CDRL A026, Software Development Plan.

C.4.7.6 For the P&D phase, the contractor shall develop an E2FDS Program Protection Implementation Plan (PPIP) IAW CDRL A082. The contractor shall submit the PPIP that addresses the following sections of the Program Protection Plan (PPP) outline and example:

a) Section 2 Identifying what to protect

b) Section 4 Vulnerabilities

c) Section 5 Countermeasures

d) Section 7 Program Protection Risks

e) Section 8 Managing and Implementing PPP

f) Section 9 --Process for Management and Implementation of PPP

g) Section 10 Process for Monitoring and Reporting Compromises

h) Appendix C: Criticality Analysis

C.4.8 Additional Security Requirements.

C.4.8.1 Controlled Unclassified Information (CUI). CUI is unclassified information requiring application of access, distribution controls, and protective measures which meets the standards for safeguarding and dissemination controls pursuant to statute, and government-wide policies under Executive Order (EO) 13556. The types of information considered CUI for the program are technical data and information marked Unclassified//For Official Use Only (U//FOUO) by the U.S. Government. Examples of technical data consist of research and engineering data, engineering drawings, associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and computer software documentation. The Contractor shall adhere to the below guidelines for handling U//FOUO information accompanied by DoDM 5200.01-V4, DoD Information Security Program: Controlled Unclassified Information

(CUI), Army Regulation (AR) 25-55, The Department of the Army Freedom of Information Act Program, AR 25-2, Information Assurance and AR

9 36

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

25-1, Army Information Technology.

C.4.8.1.1 Definition of U//FOUO Information. Information that has not been given a security classification pursuant to the criteria of an EO, but which may be withheld from the public for one or more of the reasons cited in Freedom of Information Act (FOIA) Exemptions 2 through 9, shall be considered as being U//FOUO.

C.4.8.1.2 Identification of Markings. The U//FOUO marking is assigned to information at the time of its creation in a DoD User Agency.

It is not authorized as a substitute for a security classification marking but is used on official government information that may be withheld from the public as listed above. An unclassified document containing U//FOUO information shall be marked UNCLASSIFIED//FOR

OFFICIAL USE ONLY or U//FOUO in bold letters IAW DoDM 5200.01-V4.

C.4.8.1.3 Dissemination and Transmission of U//FOUO Information. No person may have access to information designated as U//FOUO unless that person has been determined to have a valid need for such access in connection with the accomplishment of a lawful and authorized

Government purpose. Until U//FOUO status is terminated, the U//FOUO information may be disseminated within DoD Components and between officials of DoD Components and DoD contractors to conduct official business for the Department of Defense, provided that dissemination is consistent with any further controls imposed by a distribution statement. Recipients shall be made aware of the status of such information, and transmission shall be by means that preclude unauthorized public disclosure. Transmittal documents shall call attention to the presence of U//FOUO attachments. Removal of the U//FOUO marking can only be accomplished by the originator or other competent authority IAW DoDM 5200.01-V4.

C.4.8.1.4 Transporting U//FOUO Information. Records containing U//FOUO information shall be transported in a manner that precludes disclosure of the contents. When not commingled with classified information, U//FOUO information may be sent via first-class mail or parcel post. Bulky shipments, such as distributions of U//FOUO directives or testing materials, that otherwise qualify under postal regulations may be sent by fourth-class mail. When material marked U//FOUO is removed from storage, the Contractor shall attach DA

Label 87 (For Official Use Only Cover Sheet).

C.4.8.1.5 Electronically Transmitted Messages. The Contractor shall not transmit U//FOUO information electronically over the Internet unless it is encrypted by Federal Information Processing Standard (FIPS) 140-2 standard. All messages shall be transmitted in accordance with (IAW) AR 25-1. Documents containing U//FOUO shall not be posted on websites available to the public.

C.4.8.1.6 Telephone Usage. U//FOUO information may be discussed over the telephone lines with DoD Components and between officials of

DoD Components and DoD contractors to conduct official business for the Department of Defense.

C.4.8.1.7 Storage of U//FOUO Information During Duty Hours. Records and or data determined to be U//FOUO shall be placed in an out-of-sight location if the work area is accessible to persons who do not have a need for access to this information.

C.4.8.1.8 Storage of U//FOUO Information During Non-Duty Hours. At the close of business, U//FOUO records shall be stored so as to preclude unauthorized access. Filing such material with other unclassified records in unlocked files or desks is adequate when U.S.

Government or government-contractor internal building security is provided during non-duty hours. When such internal security control is not exercised, locked buildings or rooms normally provide adequate after-hours protection. If such protection is not considered adequate, U//FOUO material shall be stored in locked receptacles such as file cabinets, desks, or bookcases.

C.4.8.1.9 Termination. The originator or other competent authority, e.g., appellate authorities, shall terminate U//FOUO markings or status when circumstances indicate the information no longer requires protection from public disclosure.

C.4.8.1.10 Disposal. Documents containing U//FOUO shall be destroyed by shredding. When a mechanical automatic shredder is not available, non-record copies of U//FOUO materials may be destroyed by tearing each copy into pieces to preclude reconstructing, and placing them in regular trash containers. CD-ROM/DVD copies of U//FOUO documents shall be destroyed by breaking the CD media into pieces or placing into a mechanical shredder that can accommodate destruction of CDs.

C.4.8.1.11 Unauthorized Disclosure. The Contractor shall ensure there is no unauthorized disclosures of U//FOUO information. If an unauthorized disclosure does occur, the respective DoD Component that originated the U//FOUO information shall be informed of its unauthorized disclosure.

C.4.8.1.12 Distribution Statements. Marking of Technical Data shall be IAW the corresponding distribution statement provided in the

Security Classification Guide. If the contents of the technical document require more than one distribution statement, the Contractor shall apply the most restrictive statement. This does not preclude additional mandated markings that may be contractually required.

C.4.8.2 Training.

C.4.8.2.1 All Contractor personnel performing services in the execution of this task order shall complete the following training IAW respective security clauses as referenced in this contract: iWATCH and Antiterrorism Level I training. The Government reserves the right to request completion notification from the Contractor.

C.5 ENGINEERING AND MANUFACTURING DEVELOPMENT (EMD) PHASE

10 36

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

This section of the SOW encompasses the Engineering, Manufacturing, and Development (EMD) phase of the E2FDS acquisition program. All references identified in the EMD section shall pertain to only the EMD phase unless specifically stated otherwise.

C.5.1 Hardware Deliverables.

C.5.1.1 Delivery of EMD PRS. The contractor shall deliver one EMD PRS IAW (ATPD 2417 section 3.3.1.5.4) to include two C2M IAW (ATPD

2417 section 3.3.5) and the combination of all the major components and equipment required to achieve 5-mile capability of fluid distribution. Also, included as part of the EMD PRS, the contractor shall deliver additional components for testing to include only the number of automated pumps in a 5-mile set IAW (ATPD 2417 section 3.3.1.5.4), two additional automated pumps IAW (ATPD 2417 section

3.3.4), two additional ERS IAW (ATPD 2417 section 3.3.3), one gap crossing kit IAW (ATPD 2417 section 3.3.2.14.3), one set of adapters

IAW (ATPD 2417 section 3.5.11) and one mile of additional hose IAW (ATPD 2417 section 3.3.2). The EMD PRS must be delivered IAW section F.

C.5.2 Systems Engineering

C.5.2.1 Developmental Drawings. The contractor shall provide the following drawings to the Government for review prior to the System

Preliminary Design Review (PDR) and Critical Design Review (CDR) (CDRL A009) identifying:

C.5.2.1.1 System Level. Isometric models depicting total ISO Twenty Foot Equivalent Units (TEU) estimate, all container pack variations in a 5-mile set and outside of the 5-mile set (C2M, gap crossing, and adapters, etc.), the contents of each unique container pack and all associated parts lists.

C.5.2.1.2 Pump Assembly. Isometric models depicting frame, pump, engine, C2M components, and all additional components, assembly details, component attributes and all associated parts lists.

C.5.2.1.3 Hose Assembly. Isometric model depicting hose assembly, component attributes, and all associated parts lists.

C.5.2.1.4 Hose Employment and Retrieval System. Isometric models depicting ERS to include power source and all additional major components, length of hose stored per unit, system weights, quantity of units stored per ISO TEU, and all associated parts lists.

C.5.2.1.5 Command and Control Module. Communications network drawing (C2M to each pump station), network routing diagram, electrical/physical interface diagrams, and communications equipment drawings.

C.5.2.1.6 Software. Source Lines of Code (SLOC)

C.5.2.2 Production Change Package. The EMD Contractor shall submit a Production Change Package that includes a list of all changes proposed for the production phase to include a performance and manufacturing risk assessment (CDRL A004).

C.5.2.3 System Requirements Compliance Matrix. The contractor shall develop a requirements compliance matrix that tracks the current compliance with all ATPD 2417 requirements, Attachment 0001 ATPD 2417. This matrix shall be developed using analysis and shall be updated to reflect actual performance as development and test progresses. The matrix shall follow the sequence of ATPD 2417 and clearly depict if the data is an estimate or actual performance. The supporting documentation used to populate the requirements compliance matrix shall be provided to the Government IAW CDRL A006 (System Requirements Matrix). The supporting documentation shall be discussed at PSRs as well as technical reviews.

C.5.2.4 Technical Reviews. The contractor shall provide evidence IAW CDRL A007 (Technical Review Criteria) that all entrance criteria have been met before each of the following technical reviews per Attachment 0023 Technical Review Criteria. The technical reviews will not be considered complete until all exit criteria have been met and approved by the Government.

C.5.2.4.1 Preliminary Design Review (PDR) (EMD). The contractor shall conduct a PDR at the contractor's facility with Government attendance no later than 90 days after the SOWM to conduct a technical review of the allocated baseline to ensure the system can meet the requirements of ATPD 2417, Attachment 0001 ATPD 2417, before proceeding to a more detailed design. The contractor shall present preliminary designs to include the Developmental Drawings and System Requirements Compliance Matrix (CDRL A006) for the EMD PRS systems.

C.5.2.4.2 Critical Design Review (CDR) (EMD). The contractor shall conduct a CDR at the contractor's facility with Government attendance no later than 90 days after PDR to conduct a technical review of the product baseline to ensure the system can meet the requirements of ATPD 2417, Attachment 0001 ATPD 2417, before finalizing design. The contractor shall present its designs to include the Developmental Drawings and System Requirements Compliance Matrix (CDRL A006) for the EMD PRS systems. The CDR shall be conducted prior to initiation of fabrication/build. Any fabrication/build to be initiated prior to CDR shall require written approval from the

PCO.

C.5.2.4.3 Test Readiness Review (TRR) (EMD). The contractor shall conduct a TRR at the contractor's production facility with

Government attendance No-Later-Than (NLT) 30 days before delivery of the EMD PRS. The purpose of the TRR is to provide the Government validation that the test requirements can be performed within the stated schedule.

11 36

Name of Offeror or Contractor:

PIIN/SIIN MOD/AMD

C.5.3 Configuration Management (CM)

C.5.3.1 CM Program

C.5.3.1.1 The contractor shall implement configuration control methods and procedures that maintain the integrity and traceability of the established configuration baselines, and identify interfaces (e.g., external, internal, physical, performance, data, and software) with other configuration items. The contractor shall notify the Government of any proposed changes to the established baseline.

Changes shall be identified to the affected assembly serial number and/or part number, or if not part of an assembly, to the affected equipment serial number. All change notifications submitted shall be assessed for the total life-cycle impact to include cost, schedule, performance and logistics. All configuration changes shall be maintained by the contractor.

C.5.3.1.2 Configuration Management Plan (CMP). The contractor shall have an established CMP IAW National Consensus Standard for

Configuration Management; EIA-649, EIA-649-1 and International Organization for Standards; ISO 10007. The CMP shall describe the contractor's CM program and the methods, procedures, and controls used for effective configuration identification, control, status accounting, verification, and audits of the total configuration, including hardware, software and firmware. The CMP shall be updated as required and available as requested to the Government.

C.5.3.1.3 Supplier/Sub-contractor Configuration Management. The contractor shall flow down configuration management polices/requirements to their suppliers and sub-contractors. The configuration disciplines required of supplier/sub-contractor shall include configuration identification, configuration control, configuration status accounting, and configuration audits. The supplier/sub-contractor shall impose applicable configuration management requirements on its sub-tier suppliers required to support its configuration management system and the production configuration.

C.5.3.2 Data Management. The contractor shall possess an authoritative product data, engineering or configuration management system and the processes to effectively manage, securely store, release, validate, and track multiple versions and iterations of the E2FDS Product

Baseline. The contractor's data management system shall include management of product structures, product definition documents/data, contractor test and analysis data, Government Furnished Information (GFI) and other related technical documents.

C.5.3.3 Product and Enterprise Identifiers.

C.5.3.3.1 The contractor shall adhere to the requirements for product and enterprise identifiers for all E2FDS products and Product

Configuration Documentation (PCD). The product identifier is the Part or Identifying Number (PIN) and is synonymous with part number.

The enterprise identifier is the Commercial and Government Entity (CAGE) code. The contractor shall convert all non-conforming product and enterprise identifiers to conforming product and enterprise identifiers IAW these requirements. IAW DFARS Clause 252.227-7017, Identification and Assertion of Use, Release, Or Disclosure Restrictions, provide a separate lists of commercial and non-commercial items

C.5.3.3.2 Modified Products. The contractor shall adhere to the product and enterprise identifier requirements to identify new and modified products. The contractor shall not prepare an altered item PIN or drawing when altering an existing product from the same design activity. The contractor shall not prepare a modification PIN or drawing as a substitute for revising an existing product. When products are modified to the point they are no longer interchangeable with the existing product, the contractor shall also create new next higher assemblies and subsequent higher assemblies, and apply the appropriate identifiers, until interchangeability is re-established. The contractor shall maintain internal configuration records to crosswalk, link or otherwise retain history of the original

PIN and CAGE code to the new PIN and CAGE code, and include this…