Attachment0001-BASE_PWS_PSS-T.pdf

PERFORMANCE WORK STATEMENT (PWS)

for

Persistent Surveillance Systems - Tethered (PSS-T)

Engineering/Technical, Logistics, and Operations Support

Solicitation Number W56KGY-15-R-0001

Base Contract

Version 1.0

24 September 2015

Product Director (PD) Aerostats 6006 Combat Drive

Aberdeen Proving Ground, MD 21005

PAGE INTENTIONALLY BLANK

Solicitation # W56KGY-15-R-0016 Performance Work Statement (PWS) 24 September 2015 i

Table of Contents

1. Scope

1.1 General

1.2 Contract/Order Type

1.3 Period of Performance (PoP)

1.4 Place of Performance

1.5 Contractor Performance Evaluation

1.6 Intellectual Property

1.7 Government Furnished Property (GFP)

1.8 Inspection and Acceptance / Freight on Board (FOB)

1.9 Security

1.9.1 Security Clearance Requirements

1.9.2 Security Training Requirements

1.9.3 Security Procedures

1.9.4 Operations Security (OPSEC)

1.10 Information Systems (IS)

1.11 System Safety and Health Hazards

1.12 Information Assurance (IA)

1.13 Program Protection Plan (PPP)

2. Applicable Documents

3. General Requirements

3.1 Program Management

3.1.1 Program Management Support

3.1.2 Contract Transition

3.1.3 Reporting

3.1.4 Financial Reporting

3.1.5 Contractor Manpower Reporting

3.1.6 Data Management

3.1.7 Demobilization

3.1.8 Earned Value Management System (EVMS)

3.2 Engineering Services

3.2.1 System Technical Support

3.2.2 Aerostat System Integration Laboratory (SIL)

3.2.3 Contractor System Engineering Management Plan

3.2.4 Configuration Management (CM)

3.2.5 Engineering Change Proposals (ECP)

3.2.6 Product Configuration Documentation

3.2.7 Foreign Military Sales (FMS)

3.2.8 Technical Data Package (TDP)

3.2.9 Quality Control Plan (QCP)/Quality Assurance (QA)

3.2.10 Test and Evaluation

3.3 Logistics

3.3.1 Performance Based Logistics (PBL) Metrics Monitoring and Reporting Requirements

3.3.2 Repair Parts and Spares

3.3.3 Retrograde

3.3.4 Relocation

3.3.5 Shipping and Receiving

3.3.6 Above User-Level Maintenance and Depot Repairs

ii

3.3.7 Reset

3.3.8 Depot Public Private Partnership (P3)

3.3.9 Provisioning

3.3.10 Government-Industry Data Exchange Program (GIDEP)

3.4 Equipment Technical Manuals (TMs)

3.4.1 Effectivity of TMs

3.4.2 Maintenance Concept

3.4.3 Safety Changes

3.4.4 Copyright and Proprietary Material

3.4.5 Repair Parts and Special Tools List (RPSTL)

3.4.6 Reviews

3.4.7 Final Delivery Reviews

3.5 Training

3.6 Operations

3.6.1 Operations Support

3.6.2 Operator/User-Level Maintainers

3.6.3 Trainer/Test System

3.6.4 Operations Reporting

3.7 Drawdown and Surge Operations

3.8 Contract Deliverables

4. Travel or Special Requirements

4.1 CONUS Travel

4.2 OCONUS Travel

1. Scope

This PWS identifies the requirements for PSS-T. The Contractor shall provide engineering, logistics, operations, and program management support to PSS-T aerostats.

The Contractor is responsible for procuring, integrating, and providing all sources of support, as defined within the scope of this PWS and to achieve the PD Aerostats required outcomes.

The current aerostat fleet is comprised of PSS-T medium, developed as Persistent Ground Surveillance System (PGSS); PSS-T large, developed as Persistent Threat Detection System (PTDS); and as-is contingency stock. The PSS-T medium and PSS-T large aerostat systems satisfy many of the same capabilities but were developed independently under different methodologies.

This PWS supports PD Aerostats’ mission requirements to support Combatant Commanders (COCOMs) and joint agency requirements. It requires the Contractor to have a detailed understanding of aerostat technical capabilities and the ability to operate a fleet of aerostats in the continental United States (CONUS) and outside the continental United States (OCONUS).

The PSS-T program of record (PoR) is primarily a stored capability that can be activated, as needed, to support mission operations. These required services shall focus on maximizing operational availability (Ao) and providing quality and reliable data and services 24 hours a day/seven (7) days a week.

This is a performance based acquisition. Specific requirements will be stated in subsequent task orders/delivery orders (TOs/DOs) for this indefinite delivery indefinite quantity (IDIQ) contract.

1.1 General

PSS-T medium and large are aerostats with scalable capabilities, initially developed as quick reaction capability programs. The PSS-T aerostats are capable of persistent, integrated, networked, and multi-sensor information collection by operating for long periods of time at an altitude to maximize the line of sight and field of regard of on-board systems. PSS-T will have the ability to be employed during all phases of joint operations.

PSS-T will be responsive to the ground component of a joint warfighting force by providing weather-dependent, continuous support at operating locations throughout the joint operational area and directly enhancing the commander’s situational understanding.

The following subsystems make up the PSS-T medium system baseline: one (1) aerostat envelope, one (1) mobile mooring platform, one (1) ground control shelter (GCS) (S-280), three (3) 15kW generators, one (1) 20 foot office shelter, one (1) 20 foot support container and one (1) 10 foot consumables container.

The following subsystems make up the PSS-T large system baseline: one (1) aerostat envelope, one (1) mobile mooring platform, one (1) 20 foot GCS, three (3) 20 foot support containers, three (3) 60kW generators, one (1) power distribution platform, one (1) Sellick 120 forklift and one (1) boom lift.

Both the PSS-T medium and PSS-T large are fielded with: two (2) MX-series cameras, one (1) unattended transient acoustic measurement and signature intelligence system, and one (1) high antenna for radio communications system.

The PSS-T medium and PSS-T large may also be fielded with additional authorized list (AAL) payloads that provide capability sets above and beyond the baseline. AAL payloads are deployed as mission requirements dictate. These AAL items include: two (2) dismounted and ground moving target indicator radar systems, wide area surveillance and wide area motion indicator sensors, full motion video and coded laser designator sensors, which provide laser designating capability and a tactical data communications link, which provides video broadcast capability. Other AAL items include a tactical maintenance office shelter, expendable unattended ground sensors and support utility vehicles (gator). The PSS-T medium and PSS-T large may also be fielded with intelligence, surveillance, and reconnaissance and/or chemical, biological, radiological, and nuclear sensor equipment as specified at the TO/DO level. The PD Aerostats systems are baselined with communications platforms and transmitters; navigation systems; reconnaissance, surveillance, and target acquisition systems. The systems are capable of detecting hostile fire, providing target coordinates to appropriate command and control/fire control centers, and capable of marking ground targets for rapid reaction forces for engagement. In addition to baseline systems, as-is contingency stock may be relocated and/or configured to meet mission requirements.

1.2 Contract/Order Type

The PSS-T contract will be a single award IDIQ contract, with cost reimbursement and fixed price TOs/DOs issued as requirements dictate.

This IDIQ contract will include cost-plus-fixed-fee term form (CPFF-TF), cost-no fee, and firm-fixed-price (FFP) line items. Services shall be awarded on a CPFF-TF basis. Key spare parts will be awarded on a FFP basis. Travel, other direct costs (ODCs) and material shall be proposed on a cost-no fee basis, in accordance with (IAW) Federal Acquisition Regulation (FAR) 16.302. The contract type(s) will be specified in each individual TO/DO. Orders may include options as defined in FAR Subpart 17.2 - Options and further defined or supplemented in Defense Federal Acquisition Regulation Supplement (DFARS) Subpart 217.2 and Army Federal Acquisition Regulation Supplement (AFARS) Subpart 5117.2.

1.3 Period of Performance (PoP)

The effective period of the PSS-T IDIQ shall be 48 months, as defined in the contract schedule. TOs may be awarded during the effective period of the PSS-T IDIQ. Individual TOs/DOs will be defined when the TO/DO is issued.

1.4 Place of Performance

Performance locations may include, but shall not be limited to, Government and Contractor facilities located throughout the following areas of responsibility (AORs): US Central Command (CENTCOM); US Africa Command (AFRICOM); US European Command (EUCOM); US Pacific Command (PACOM); US Southern Command

(SOUTHCOM); US Northern Command (NORTHCOM); and other CONUS/OCONUS locations. Place of performance will be defined in individual TOs/DOs.

1.5 Contractor Performance Evaluation

The Government will evaluate the Contractor’s performance under this contract IAW the Government’s quality assurance surveillance plan (QASP).

1.6 Intellectual Property

The Government's rights in non-commercial technical data and software deliverables shall be governed by DFARS 252.227-7013 and DFARS 252.227-7014, respectively. The Government's rights in commercial technical data shall be governed by DFARS 252.227- 7015. Because the Government's rights in commercial software are governed by the licensor's commercial software license agreements (unless the license terms are inconsistent with Federal procurement law or do not otherwise satisfy user needs), the Offeror's proposal shall include all applicable commercial software license agreements related to commercial software deliverables.

1.7 Government Furnished Property (GFP)

The Government will provide property to the successful offeror for execution of the contract. This property may include but is not limited to: Government owned Contractor operated (GOCO) equipment; items to be repaired, maintained or overhauled; the parts to execute repairs; tooling/test equipment; and items or materials consumed in the production or manufacturing process. Accordingly, the Government will furnish and the Contractor shall be responsible for a Defense Contract Management Agency (DCMA) approved methodology for accountability and tracking of all GFP. The Contractor GFP responsibilities shall be in accordance with FAR 52.245-1, Department of Defense Government Furnished Property Operations Manual, and other relevant clauses, terms, and conditions incorporated in the contract. At a minimum, the Contractor shall be required to report all GFP (including items received for repair, modification, and/or upgrade), consistent with DFARS 252.211-7007, by 1) each serially managed item, without regard to dollar value and 2) all non-serially managed material items (receipt only).

Individual TOs/DOs shall specify items designated by the Government as serially managed. All items subject to Department of Defense Instruction (DoDI) 5000.64 are considered serially managed, e.g., special tooling and test equipment.

GFP reporting includes the following events: receipt of property; delivery or shipment from the Contractor’s facility (unless to a Subcontractor); consumed or expended; disposal of property; and transferred to a follow-on or other contract.

Electronic receipt acknowledgement is crucial and required for all GFP items. The receipt of GFP items must be reported by the Contractor to the item unique identification (IUID) Registry in one (1) of three (3) ways: through WAWF; by using the Defense Logistics Agency (DLA) IUID Registry website; and/or via direct submission to the IUID Registry through electronic files (if the item has a UII and was previously registered). The

Contractor GFP responsibilities shall be IAW FAR 52.245-1, Department of Defense Government Furnished Property Operations Manual, and other relevant clauses, terms, and conditions incorporated in the contract. The Contractor shall request, and be given Government authorization, through the Procuring Contracting Officer (PCO) or Administrative Contracting Officer (ACO) to receive and ship non-program GFP.

The Contractor is authorized to perform selective interchange (remove serviceable parts from one (1) item of property in order to install them on another item of property) for sensors, unique support property, and components of PSS-T end items with Government approval. The Contractor shall contact the PCO, or authorized delegate, if the selective interchange will result in an unserviceable item requiring disposition. Disposal of GFP shall be reported through the DCMA eTool plant clearance automated reutilization screening system.

The Government will furnish the Contractor with the following Government furnished information (GFI) and the following consumable materials:

a) Access to auto scan tracking system (ASTS);

b) PSS-T training program of instruction (POI);

c) PSS-T operator and maintenance manuals;

d) Access to non-proprietary PSS-T engineering drawings;

e) Helium;

f) Shore/grid power where available at Government installations; and

g) Fuel (where available at OCONUS locations; Contractor shall plan to supply fuel for CONUS operations).

1.8 Inspection and Acceptance / Freight on Board (FOB)

Inspection and acceptance of systems shall be at the Contractor’s facility and witnessed by the DCMA and/or the contracting officer’s representative (COR). Final acceptance via WAWF shall be at the source pending successful demonstration except for repairs where inspection and acceptance can be done by the COR or delegated to DCMA. Materials required in support of activities shall be FOB destination at Tobyhanna Army Depot (TYAD), PA unless otherwise directed by the Government.

1.9 Security

1.9.1 Security Clearance Requirements

The Contractor shall be required to have a TOP SECRET facility clearance with SECRET safeguarding capability. The Contractor shall require access to sensitive compartmented information (SCI), Non-SCI, and For Official Use Only (FOUO) information. Electronic processing of SCI will be required on a Government-owned system for integration of future signal intelligence sensor capability. The Contractor shall access SCI only at the Government facility at Aberdeen Proving Ground, MD. The Contractor shall also require access to secret internet protocol router network (SIPRNet) but only at a Government facility. The Contractor will generate and receive classified materials, and have access to classified information at CONUS and OCONUS locations, as defined in paragraph 1.4 of this PWS. The Contractor is authorized to use the Defense Courier Service.

The Contractor shall adhere to security guidelines as found in the Defense Department (DD) Form 254 for this effort and as contained in the security classification guides (SCGs) listed in paragraph 2 of this PWS. The Contractor shall extend all relevant security guidelines to their Subcontractors.

The Contractor shall develop, conduct, and implement an annual security training and awareness program IAW DD Form 254 and the SCGs for guidance for all Contractor personnel with a need to know. The training program will address security objectives and responsibilities for these personnel. The Contractor will require access to North Atlantic Treaty Organization and communications security (COMSEC) information.

1.9.2 Security Training Requirements

All Contractor employees, to include Subcontractor employees, requiring access to Government installations, facilities and controlled access areas shall complete anti-terrorism (AT) level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The Contractor shall submit certificates of completion for each affected Contractor employee and Subcontractor employee, to the COR or to the PCO, if a COR is not assigned, within 30 calendar days after completion of training by all employees and Subcontractor personnel. AT level I awareness training is available at the following website: http://jko.jten.mil.

Contractor personnel traveling OCONUS require overseas AT awareness training. U.S.

based Contractor employees and associated Subcontractor employees shall receive Government provided AOR specific AT awareness training as directed by Army Regulation (AR) 525-13. Specific AOR training content is directed by the combatant commander with the unit antiterrorism officer (ATO) being the local point of contact. US based contractor employees and associated sub-contractor employees will submit an Isolated Personnel Report (ISOPREP) prior to deployment, in accordance with AR 525- 28, Personnel Recovery. The contractor is required to fill out the survey on NIPRNET at https://prmsglobal.prms.af.mil/prmsconv/Profile/Survey/start.aspx prior to deployment.

iWATCH training is required for Contractor employees with an area of performance within an Army controlled installation, facility or area. The Contractor and all associated subcontractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR no later than (NLT) 30 calendar days after contract award.

Per AR 381-12, Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2-4b of

AR 381-12.

1.9.3 Security Procedures

Contractor employees with an area of performance within an Army controlled installation, facility or area must adhere to access and general protection/security policy and procedures. Contractor and all associated Subcontractor employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by Government representative). The Contractor and all associated Subcontractor employees shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation provost marshal office, Director of emergency services or security office. Contractor workforce must comply with all personal identity verification requirements (FAR 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by Department of Defense (DoD), Headquarters Department of Army (HQDA), and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the force protection condition at any individual facility or installation change, the Government may require changes in Contractor security matters or processes.

For TOs/DOs that require handling or access to classified information, the Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “CONFIDENTIAL,” “SECRET,” or “TOP SECRET” (to include SCI).

The Contractor shall comply with the security agreement (DD Form 441), including the national industrial security program operating manual (NISPOM), DoD 5220.22-M, and any revisions to DoD 5220.22-M, notice of which has been furnished to the Contractor.

For TOs/DOs that require handling and access to FOUO information, the Contractor shall have the ability to send and receive electronic information using approved Government encryption methods.

Before CAC issuance, the Contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The Contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or

(3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of six (6) months or more.

At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

Contractor and all associated Subcontractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

For contractors authorized to accompany the force, DFARS Clause 252.225-7040 (DFARS Clause 252-225-7995 for CENTCOM), Contractor Personnel Authorized to Accompany U.S. Armed Forces Deployed Outside the United States. The clause shall be used in solicitations and contracts that authorize contractor personnel to accompany US Armed Forces deployed outside the US in contingency operations; humanitarian or peacekeeping operations; or other military operations or exercises, when designated by the combatant commander. The clause discusses the following AT/OPSEC related topics:

required compliance with laws and regulations, pre-deployment requirements, required training (per combatant command guidance), and personnel data required.

For Contract Requiring Performance or Delivery in a Foreign Country: DFARS Clause 252.225-7043, Antiterrorism/Force Protection for Defense Contractors Outside the US.

The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non-contingency support. The key AT requirement is for non-local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor’s compliance with combatant commander and subordinate task force commander policies and directives.

1.9.4 Operations Security (OPSEC)

The Contractor shall adhere to the PD Aerostats OPSEC Plan dated 26 February 2014.

The Contractor shall develop an OPSEC standard operating procedure (SOP) within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer, IAW contract data requirements list (CDRL) A003, DI- MGMT-80934C, “Operations Security (OPSEC) Plan.” This SOP will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected. The Contractor shall implement OPSEC measures as ordered by the cognizant commander or combatant commander at each place of performance. In addition, the Contractor shall have an identified certified level II OPSEC coordinator per AR 530-1.

Per AR 530-1, “Operations Security,” new Contractor employees must complete level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter. All Contractor employees must complete annual OPSEC awareness training. Level I OPSEC training is available at the following website: http://cdse.edu/catalog/elearning/GS130.html (Duration: 45 minutes).

1.10 Information Systems (IS)

All Contractor employees who require access to Government information systems must be registered in the Army training certification tracking system (ATCTS) at commencement of services, and must successfully complete the DoD IA awareness prior to access to the IS and then annually thereafter.

For IA/information technology (IT) training, all Contractor employees and associated Subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All Contractor employees working IA/IT functions must comply with DoD and Army training requirements in Department of

Defense Directive (DoDD) 8570.01, DoD 8570.01-M and AR 25-2 within six (6) months of appointment to IA/IT functions.

1.11 System Safety and Health Hazards

The Contractor shall identify and evaluate system safety and health hazards, define risk levels, and establish a program that manages the probability and severity of all hazards associated with contractual tasks. Safety and health hazards shall be managed consistently with mission requirements. All inherent hazards shall be identified, evaluated, and either eliminated or controlled to ensure minimum risk to the environment and personnel. Records shall be kept for the life of the contract plus two (2) years. These records shall be made available to the Government upon request. The Contractor shall use the Government and industry standard practice for system safety, MIL-STD-882E, in all developmental and sustaining activities. The Contractor shall integrate the environment, safety, and occupational health risk management strategy into the systems engineering process.

The Contractor shall provide services to ensure proper care of hazardous material (HAZMAT) as delineated in the Environmental Protection Agency (EPA) manual 17. The Contractor shall maintain the material safety data sheets (MSDS) library on every HAZMAT procured, stored, or used within their AOR. The Contractor shall reduce excess hazardous waste disposal by optimizing procedures for reuse of material, rotation of stocks to ensure the use prior to expiration date, and protecting stocks from damage by weather and poor handling. The Contractor shall maintain container labeling and storage labeling throughout its areas of responsibility. The Contractor will ensure they have qualified, licensed/certified personnel familiar with OCONUS requirements, to prepare/package HAZMAT for transport on military airlift IAW Air Force Manual (AFMAN) 24-204. The Contractor shall be required to turn in HAZMAT and associated waste to the installation/site collection points IAW regulations and policies of the sites. A HAZMAT reference list is found in section 2.0(b) of the PWS.

The Contractor shall maintain HAZMAT container labeling and storage labeling throughout its AORs. The Contractor shall transport, store and dispose of HAZMAT and associated waste IAW laws and regulations.

1.12 Information Assurance (IA)

The Contractor shall be compliant with AR 25-2, “Army Information Assurance” IA best business practices, DoD 8500 series of directives and instructions.

The Contractor shall be responsible for maintaining the PSS-T approved hardware/software baseline. It is the Government’s intent to maintain a SIL located at Aberdeen Proving Ground (APG), MD for the purposes of maintaining software builds, implementation of actions required to address all outstanding information assurance vulnerability alerts (IAVAs), and IAVAs issued within 60 days of start of intra-Army interoperability certification (IAIC) at the central technical support facility (CTSF). The Contractor, at the request of the Government, shall provide integration support at the APG SIL either directly or by third party software subject matter experts (SMEs).

Per DoD 8570.01-M, DFARS 252.239.7001 and AR 25-2, all Contractor employees supporting IA functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

Based on the authority to operate expiration date, future accreditation efforts supported by the Contractor may include:

a. Establishing and using an enterprise decision structure for cyber security risk management that includes and integrates DoD mission areas (MAs) pursuant to Department of Defense Directive (DoDD) 8115.01 and the governance process prescribed in this instruction.

b. Managing the cyber security requirements for DoD information technologies through an integrated enterprise-wide risk management framework (RMF) consistent with the principles established in National Institute of Standards and Technology (NIST) special publication (SP) 800-37.

c. Satisfying the RMF requirements of Subchapter III of Chapter 35 of Title 44, United States Code (U.S.C.), also known and referred to in this instruction as the “Federal Information Security Management Act (FISMA) of 2002.” The Contractor must meet or exceed the standards required by the Office of Management and Budget (OMB) and the Secretary of Commerce, pursuant to FISMA and Section 11331 of Title 40, U.S.C.

d. Categorizing all DoD IS and platform information technology (PIT) systems IAW committee on national security systems instruction (CNSSI) 1253, implementing a corresponding set of security controls from NIST SP 800-53, and using DoD-specific assignment values, overlays, implementation guidance, and validation procedures. As supporting reference security control documents are updated, DoD’s implementation of these updates will be coordinated through the RMF technical advisory group (TAG).

e. Supporting identification of resources for implementing the RMF and allocated as part of the Defense planning, programming, budgeting, and execution process.

f. Ensuring all information technologies identified in this PWS, section 1.14, paragraph b, are authorized for operations through enterprise processes for identifying, evaluating, mitigating, and accepting cyber security risks.

g. Supporting validation that all DoD-owned or DoD-controlled IT is under the governance of a DoD component cyber security program IAW DoDI 8500.01. The DoD component cyber security program will be the primary mechanism for ensuring enterprise synchronization of the RMF.

h. Developing and maintaining a plan of action and milestones (POA&M) to record specific measures planned to correct deficiencies and address known deficiencies in the

IS.

i. Providing continuous monitoring capabilities to be implemented to the greatest extent possible.

j. Incorporating the Defense Information Systems Agency’s application security and development security technical implementation guides (STIGs).

1.13 Program Protection Plan (PPP)

The Contractor shall implement and adhere to PPP requirements to control access and protection to critical, classified, and sensitive information. Transmission of classified and/or FOUO materials to and from the Government is to be accomplished via approved methods for transmission of SECRET and/or FOUO material as appropriate.

The Contractor shall provide technical support for the Government PPP process performed IAW DoDI 5000.02, DoDI 5200.39, DoDD 5200.1-M, Defense Acquisition Guidebook, Chapter 13, and key practices and implementation guide for the DoD comprehensive national cyber security initiative supply chain risk management.

The Contractor shall implement countermeasures to mitigate supply chain risks that can be introduced through critical components (CC).

The Contractor shall develop, document and update Table 1, Application of Countermeasures, IAW the table description provided in the Defense Acquisition Guidebook, Chapter 13, PPP, Section 13.7.3. Updates shall be provided to the Government within 60 calendar days of contract award, with updates as required, IAW CDRL C001, DI-ADMN-81306, “Program Protection Implementation Plan.”

Table 1: Application of Countermeasures

Development Process

Software

(CPI & CC)

Static Analysis p/a (%)

Design Inspect

Code Inspect p/a (%)

Common Vulnerabilities and Exposures

(CVE)

p/a (%)

Common Attack Pattern

Enumeration and

Classification

(CAPEC)

p/a (%)

Common Weakness

Enumeration

(CWE)

p/a (%)

Pen Test

Test Coverage p/a (%) CPI software (SW) Level I Critical Component SW

Level II Critical Component SW

Operational System

Failover Multiple Supplier

Redundancy

Fault Isolation

Least Privilege

System Element Isolation

Input Checking / Validation

SW Load Key

CPI SW

Level I Critical Compo-nent SW

Level II Critical Compo-nent SW

Development Environment

SW Products Source Release Testing

Generated Code

Inspection p/a (%)

Original Equipment Manufacturer (OEM) or

Authorized Dealer List the Commercial off the shelf (COTS) products used in the software development environment

Compiler Runtime Libraries Automated Test System Configuration Management System Database Development Environment Access *Note: p is for planned and a is for actual.

As defined in DoDI 5200.44, “Protection of Mission Critical Functions to Achieve Trusted Systems and Networks,” the term ‘supply chain risk’ means the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of a system so as to surveil, deny, disrupt, or otherwise degrade the function, use, or operation of such system.

2. Applicable Documents

a. Army Regulations (AR) o 5-12: Army Management of the Electromagnetic Spectrum o 25-1: Army Knowledge Management and Information Technology o 25-2: Information Assurance (IA) o 25-30: The Army Publishing Program o 190-5: Motor Vehicle Traffic Supervision o 190-13: Army Physical Security Program o 190-16: Physical Security o 190-51: Security of Army Property Unit/Inst. Level o 310-1: Publications, Blank Forms and Printing Mgt.

o 310-25: Dictionary of US Army Terms o 310-50: Authorized Abbreviations, Brevity Codes, and Acronyms o 350-1: Army Training and Leader Development o 385-10: Army Safety Program o 385-11: Safety Color Codes, Markings and Signs o 385-40: Army Accident Investigations and Reporting o 385-55: Prevention of Motor Vehicle Accidents o 420-90: Fire Prevention o 525-13: Antiterrorism o 530-1: Operations Security o 600-55: Motor Vehicle Driver Selection, Testing and Licensing o 700-15: Packaging of Materials o 700-127: Integrated Logistics Support o 715-9: Operational Contract Support Planning and Management o 715-16: Contractor Deployment Guide o 735-5: Policy and Procedures for Property Accountability o 750-1: Army Material Maintenance Concepts and Policies

b. HAZMAT Manuals o Resource Conservation and Recovery Act of 1976 (Public law 95-609) o Code of Federal Regulations, title 40, parts 261, 264, and 265 o AR 200-1: Environnemental Protection and Enhancement o UR 55-4: Joint Transportation of Hazardous Material o DRMO Environmental Customs Assistance Handbook o AFMAN 24-204(I): Preparing Hazardous Materials for Military Air Shipments o Title 49, Code of Federal Regulations (CFR) Transportation

c. Safety Specifications o ACGIH TLV Guide: ACGIH Threshold Limit Values for Chemical

Substances and Physical Agents and Biological Exposure Indices o ANSI C101-1992: Standard for Leakage Current for Appliances o ANSI Z136.1: Safe Use of Lasers o ANSI Z535.4: Product Safety Signs and Labels o ANSI C95.1: IEEE Standard for Safety Levels with Respect to Human

Exposure to Radio Frequency Electromagnetic Fields o DoDI 6055.11: Protection of DoD Personnel from Exposure to Radiofrequency Radiation and Military Exempt Lasers o NFPA 70-02: National Electrical Code o NFPA 780: Lightning Protection Code o UL 969: Standard for Marking and Labeling Systems o UL 61965: Mechanical Safety for Cathode Ray Tubes o UL 60950: Safety for Information Technology Equipment o 21 CFR 1040: Performance Standards for Light Emitting Products o Title 29, CFR, Occupational Safety and Health Administration (OSHA) o Federal Regulation 71-4

d. Department of Defense Regulations o 4500.9-R: Defense Transportation Regulation o DoD 5000 Series o DoD 4000.25-1-M, dated October 2007 o All DoDD 8500 series, IA o All DoDI 8500 series, IA Implementation o DoD 8560.01-M, IA Workforce Improvement Program

e. Military Standards and Handbooks o MIL-HDBK-1222E: Guide to the General Style and Format of U.S. Army

Work Package Technical Manuals o MIL-PRF-32070: Test Program Sets o MIL-PRF-49503: General Style and Format, Test Program Sets for

Automatic Test Equipment o MIL-STD-129: Military Standard, Military Marking Standard Practices o MIL-STD-130: DoD Standard Practice: Identification Marking of US

Military Property o MIL-STD-881C: Work Breakdown Structures for Defense Materiel Items o MIL-STD-882E: System Safety o MIL-STD-961: Defense and Program-Unique Specifications Format and

Content o MIL-STD-1388-2B: DoD Requirements for a Logistic Support Analysis

Record o MIL-STD-2361C: Digital Publications Development o MIL-STD-3046, DoD Standard: Configuration Management o MIL-STD-38784A: Manuals, Technical: General Style and Format

Requirements o MIL-STD-31000A: Technical Data Packages o MIL-STD-40051-2B: DoD Standard Practice: Technical Manuals and

General Assembly of Information

f. Current PTDS/PGSS Documentation (Draft or final version of the below

FOUO documents are available for request per the solicitation instructions) o Software Version Description (SVD), 26 May 2010 o PTDS SCG, 17 September 2012 o Security Classification Guide (SCG) for the Family of Synthetic Aperture

Radars/Ground Moving Target Indicators (SAR/GMTI), December 2013 o PD Aerostats Systems Engineering Plan (SEP), 4 March 2010 or latest approved revision o PD Aerostats Configuration Management Plan, 14 July 2015 o DoD Information Assurance Certification and Accreditation Process

(DIACAP) Package, 5 July 2009 o PGSS SCG, 6 March 2012

g. Current PSS-T Documentation o PSS-T training POI

h. Web Sites o http://iase.disa.mil/ IA Support Environment o https://www.milsuite.mil/wiki/Portal:Army_Information_Assurance Army

IA Best Business Practices o https://ia.signal.army.mil/ IA Training Center

3. General Requirements

The Contractor shall be responsible for complete support of the PSS-T aerostat systems, for up to 58 operational PSS-T systems (29 PSS-T large and 29 PSS-T medium), and up to 17 as-is contingency stock systems, at CONUS and OCONUS locations, as requirements dictate. Specific system quantities will be dictated at the TO level.

The Contractor shall provide or acquire and integrate the services and materials required by individual TOs pursuant to the general requirements specified herein. The Contractor shall provide PSS-T CONUS and OCONUS engineering/technical, logistics, operations, and technical support to operations, as requirements dictate.

3.1 Program Management

3.1.1 Program Management Support

The Contractor shall establish a single management focal point to accomplish the administrative, managerial, and financial aspects of this contract. The Contractor shall submit a risk management plan, which shall identify all actual or potential Contractor organizational conflicts of interest (OCIs), presently and in the future. The OCI risk management plan shall identify the various techniques that are and will be used to avoid, mitigate, or neutralize any OCI, such as: bars on present or future work or structural barriers, internal corporate controls of various types, firewalls, "walled Subcontractors," or any other permissible remedy. Work subject to this mitigation plan requirement includes any work on the PD Aerostats systems. Program management roles and responsibilities shall be defined in the Contractor risk management plan, IAW CDRL A004, DI-MGMT-81808, “Contractor’s Risk Management Plan.”

The Contractor shall conduct program management reviews (PMRs), cost and budget reviews, technical interchange meetings (TIMs), and integrated logistics support management team (ILSMT) meetings as directed in each TO/DO. The agenda for all PMRs shall be coordinated with the Government two (2) weeks prior to the meeting or as requested by the Government. Conference minutes shall be provided seven (7) business days after each PMR IAW CDRL C002, DI-ADMN-81250A, “Conference Minutes.”

The Contractor shall perform those functions and tasks required for effective program management and control, focusing on the proper balance between cost, schedule, and performance to best meet the needs of the Government throughout the end systems life cycle. The Contractor shall provide deployed forward project management support services at worldwide locations. The Contractor shall conduct forward project support actions on behalf of the Government, which includes efforts such as conducting discussions, presenting briefings, and coordinating and overseeing project activities. The contractor shall provide a management plan IAW CDRL A005, DI-MGMT-80004A, “Management Plan," outlining organization, assignment of functions, duties, and responsibilities, management procedures and policies, and reporting requirements for the conduct of contract tasks. The Contractor shall provide a draft management plan with the proposal. The final management plan shall be delivered within 15 days after contract award.

3.1.2 Contract Transition

The Contractor shall provide a contract transition plan that outlines the timing and execution of all efforts that require transition from the incumbents.

The contract transition plan shall provide details of how the Contractor will mitigate interruption in services during the phase-in transition period which may take up to 90 days. The Contractor shall include the contract transition plan as part of the Contractor’s management plan IAW CDRL A005, DI-MGMT-80004A, “Management Plan."

The contract transition plan shall identify how the transition will minimize the impact on current mission/activities, while ensuring the completeness of the transition. It shall also identify who / what is impacted by the transition, the activities that need to be accomplished in order to successfully effect the transition, the impact on the organization, and the roles and responsibilities of all who participate in the transition. It shall include the detailed schedule to be followed in order to successfully effect the transition and how any issues or discrepancies will be resolved.

The plan shall also detail how to furnish phase-out to another contractor for up to 90 days before work may be ceased. The Contractor must complete phase-out transition within 90 days. The Contractor shall ensure continuity of operations for all fielded PSS-T systems throughout the PoP.

The overall transition strategy shall be built around maintaining the mission with minimal impact to not only the timeliness of the process but also to ensure that critical data and knowledge transfer occurs. At a minimum, the following areas shall be addressed:

GFP transfer and accountability methodology Systems engineering strategy Reachback support strategy Technical data management strategy Knowledge and information/data transfer methodology Identify projected risk, impact, and mitigation strategy Schedule

The Contractor shall not disrupt official Government business or in any way interfere with the assigned duties of the predecessor Contractor’s employees. The Contractor may notify the predecessor Contractor’s employees that the Contractor will be assuming services upon the contract start date. The Contractor shall not interview, recruit, schedule interviews, or conduct extensive discussions with the current Contractor’s employees while they are on duty.

The Contractor shall provide weekly updates to the COR for each effort being transitioned until the effort has reached 100% transition, IAW CDRL A006, DI-MGMT-80368A, “Status Report / Weekly Status Report.”

3.1.3 Reporting

The Contractor shall submit a monthly contract performance report in accordance with (IAW) CDRL A001, DI-MGMT-81928, “Contractor’s Progress and Status Report.”

The Contractor shall submit a work breakdown structure (WBS) monthly, IAW CDRL A002, DI-MGMT-81334D, “Contract Work Breakdown Structure.” The WBS shall go down to a level that will define the Government approved discrete tasks. Discrete tasks include, but are not limited to: major engineering/technical, logistics, engineering change proposals (ECPs), equipment reset, and analyses and studies. The Contractor shall use MIL-STD-881C, dated 3 October 2011, as guidance in developing the WBS.

3.1.4 Financial Reporting

The Contractor shall provide financial/resource reporting by TO/DO contract line item number (CLIN), sub-contract line item number (SLIN), and WBS to segregate costs incurred under each TO/DO monthly, IAW CDRL B001, DI-FNCL-80331A, “Funds and Man-Hours Expenditure Report.” The Contractor shall submit invoices (including supporting documentation) in wide area workflow (WAWF).

Travel and ODC CLINs: The Contractor shall provide detailed cost information including but not limited to: traveler name(s), dates of travel, destination, and purpose for travel;

item/name, description, unit cost, number of units, extended costs for ODCs/material, financial status of cost CLINs (funding applied, expenses incurred during current reporting period, total expenses to date, amount remaining) and forecast of funds depletion by CLIN type based on known requirements, monthly, IAW CDRL B001, DI-FNCL-80331A, “Funds and Man-Hours Expenditure Report.”

Services CLINs: The Contractor shall provide detailed cost information including but not limited to: employee name, labor category, rate, current and cumulative hours (both straight time and overtime) and costs), financial status of cost CLINs (funding applied, expenses incurred during current reporting period, total expenses to date, amount remaining) and forecast of funds depletion by CLIN type based on known requirements, monthly, IAW CDRL B001, DI-FNCL-80331A, “Funds and Man-Hours Expenditure Report.”

The Contractor shall provide Subcontractor financial information and copies of their invoices in the manner prescribed in the preceding paragraphs.

The Contractor must have a Government-approved accounting system as directed by DFARS 252.242-7006(a)(1).

3.1.5 Contractor Manpower Reporting

The Contractor shall report all Contractor labor hours (including Subcontractor labor hours) required for performance of services provided under this contract for PD Aerostats via a secure data collection site. The Contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs 01 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year, beginning with 2016 Contractors may direct questions to the help desk at http://www.ecmra.mil/. Reference CDRL B001, DI-FNCL-80331A, “Funds and Man-Hours Expenditure Report.”

The Contractor shall provide manpower information IAW CDRL K001, DI-MISC-81419, “Personnel Report,” as required by the Government, including changes in overall manpower structure, personnel responsibilities, and manpower cost information.

3.1.6 Data Management

During the PoP of this IDIQ contract, it is expected that a large amount of data will be created. The Contractor shall develop a data management strategy to be submitted with the proposal, and a data management plan to be submitted within 30 days after contract award, IAW CDRL A005, DI-MGMT-80004A, “Management Plan.” The strategy and plan shall cover content regarding management, configuration control, automated work flows, protection of third party intellectual property, and integration into the PD Aerostats enterprise. The Government requires online access to all data (released, work in process, archive) in near real time. Online access would be limited to maximum level of FOUO and the system would be required to meet all security and IA requirements for hosting of Government data.

The Government will also provide access to an operational database that will be used by the operators for archiving of: trouble reports, maintenance data, usage data, and other logistical data for the purpose of analysis and investigation, product improvement, and spares forecasting.

3.1.7 Demobilization

The Government may specify demobilization requirements up until the last day of the IDIQ ordering period. The PoP of the contract may be extended due to this demobilization effort, IAW FAR 52.216-22. The demobilization period for this contract will be 90 days.

The Contractor shall transition GFP/Government furnished equipment (GFE) inventories, employees, data, information, and perform any other actions required to ensure continuity of operations. The Contractor shall return all or part of its workforce to their originating location, upon Government authorized demobilization orders. The Contractor shall also return all or part of the PSS-T equipment under its control to the Government at the direction of the PCO.

The Contractor shall submit a demobilization plan to the PCO for approval a minimum of 120 calendar days prior to the end of the current contract performance period or as otherwise directed by the PCO, IAW DFARS class deviation 2013-O0017 and CDRL A012, DI-MGMT-81837, “Mobilization Plan.”

3.1.8 Earned Value Management System (EVMS)

The Contractor shall reference the DoD EVMS implementation guide to develop an EVMS process. Since a great deal of the efforts will not be defined at the time of the contract award, the Government expects the Contractor(s) to submit an EVMS plan, which defines work packages (WPs) as required, and execute EVMS as appropriate. Thirty (30) days after award of a TO, the Contractor shall submit an integrated master plan consisting of a WBS and integrated master schedule (IMS) framework. The Contractor shall include all discrete tasks that can be defined at that time. The Government expects that a large amount of the budget will be held in summary level tasks such as “sensor integration” until WPs can be added as subtasks with a budget allocated to each subtask. Budgets against summary tasks can be moved as required for the program with approval from the Government.

The Contractor shall develop, update and otherwise maintain an IMS based on the approved WBS, IAW CDRL A007, DI-MGMT-81861, “Integrated Program Management Report (IPMR).” The IMS shall be updated as WPs are opened and approved by the…