2.04 20RQ008 Solicitation- DRAFT.pdf

SEE ADDENDUM

(No Collect Calls)

N0018920RQ008 30-Apr-2020

b. TELEPHONE NUMBER

717-605-5572

8. OFFER DUE DATE/LOCAL TIME

05:00 PM 18 May 2020

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

N001899. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

JESSICA A. DANIELS

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

N0018920RC8AMAC

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

NAVSUP FLC NORFOLK CONTRACTING

MECHANICSBURG OFFICE

JESSICA DANIELS

5450 CARLISLE PIKE, SUITE 407-WSD10

MECHANICSBURG PA 17050-2411

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE N00367 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

NAVSUP BUSINESS SYSTEMS CENTER

CRAIG LAWRENCE

5450 CARLISLE PIKE BUILDING 409

MECHANICSBURG PA 17050-2411

TEL: (717) 605-2508 FAX:

717-605-1951FAX:

TEL: 717-605-5572 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

X 8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$30,000,000

NAICS:

541511

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF80

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

Section SF 1449 - CONTINUATION SHEET

PERFORMANCE WORK STATEMENT

Performance Work Statement (PWS) Naval Supply Systems Command (NAVSUP) Business Systems Center (BSC) Program Support Services for IT, Supply Chain and Logistics

1.0 Introduction

The Naval Supply Systems Command (NAVSUP) Business Systems Center (BSC) has the need for contractor support services to support a variety of initiatives to improve overall organizational effectiveness and operational efficiency. Support services are required for emergent program support needs, in the areas of information technology, supply chain and logistics areas.

2.0 Background:

NAVSUP BSC works closely with their stakeholders to provide information systems and program support through its Business Systems Center. NAVSUP BSC is the Navy's premier Information Technology provider of choice with responsibility to design, develop, and maintain information systems supporting numerous activities in the functional areas of logistics, supply chain management, transportation, finance and accounting.

2.1 Requiring Organization

The organization requiring the services outlined in the Performance Work Statement (PWS) is:

NAVSUP Business Systems Center 5450 Carlisle Pike Bldg. 409 Mechanicsburg, PA 17055

2.2 Project Description

NAVSUP BSC must collaborate with their stakeholders on a wide range of mission and business challenges so that the services, processes, and policies of NAVSUP are enabled by information systems that are efficient, effective, and affordable. NAVSUP BSC and their stakeholders both rely on the ability to bring together a superior workforce to accomplish their shared mission through a combination of Government and contractor personnel and delivery teams. This Performance Work Statement (PWS) sets the parameters for obtaining contractor support under an IDIQ contract for services that are intended to benefit both the stakeholders and NAVSUP BSC.

It is anticipated that individual task orders will be formalized around specific tasks supporting ongoing or upcoming project requirements included in the scope of work defined in the PWS. Specific details of task assignments, deliverables, documentation and applicable standards will be provided in awarded task orders.

3.0 Scope

The scope of this Indefinite Delivery Indefinite Quantity (IDIQ) contract is to provide the necessary level of professional and technical support required to facilitate shared objectives of stakeholders and NAVSUP BSC.

The goal of this PWS is to obtain contractor support services to provide program support services to the NAVSUP BSC staff in the areas of IT, business support services and analysis positions to be introduced in the requirements sections of this document and fully within individual task orders.

4.0 Directives

The contractor shall comply with the following directives, and any updated/future versions as they are released, and consider them in developing their technical proposal and management plan:

Federal Information Security Modernization Act of 2014 (“FISMA”) DoD Instruction 5400.11, DoD Privacy and Civil Liberties Programs, 29 January 2019 DoD Directive 8000.01, Management of the DoD Information Enterprise, 17 March 2016 (incorporating

Change 1 July 2017) DoD Directive 8140.01, Cyberspace Workforce Management, 11 August 2015 (incorporating Change 1, 31

July 2017) DoD Instruction 4161.02, Accountability and Management of Government Contract Property, 27 April

2012 (incorporating Change 2, 31 August 2018) DoD Instruction 8320.07, Implementing the Sharing of Data, Information, and Information Technology

(IT) Services in the Department of Defense, 3 August 2015 (incorporating Change 1, 5 December 2017) DoD Instruction 8500.01, Cybersecurity, 14 March 2014, Change 1, 7 October 2019 DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology, 12

March 2014 (incorporating Change 2, 28 July 2017)

DoD Instruction 8582.01, Security of Non-DoD Information Systems Processing Unclassified Nonpublic DoD Information, 9 December 2019

SECNAVINST 5510.36B, DoN Information Security Program, 12 July 2019 DoD 5400.11-R, Department of Defense Privacy Program, 14 May 2007 DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19 December 2005

(incorporating Change 4, 10 November 2015) SECNAV Instruction 5211.5F, Department of the Navy Privacy Program, 20 May 2019 SECNAV Instruction 5239.3C, DON Cybersecurity Policy, 2 May 2016 SECNAV M-5239.1, DoN Information Assurance Manual, November 2005 OPNAVINST 5239.1D, U.S. Navy Cybersecurity Program, 18 July 2018 OPNAVINST 5239.4, Chief of Naval Operations Cybersecurity Safety Program, 14 September 2018 SECNAV Manual M-5239.2, DON Cyberspace Information Technology and Cybersecurity Workforce

Management and Qualification Manual, 27 June 2016 SECNAV Manual M-5510.30, Department of the Navy Personnel Security Program, 1 June 2006 CJCSI 6211.02D, Defense Information Systems Network (DISN) Responsibilities, 24 January 2012

DoD Public Key Infrastructure (https://cyber.mil/pki-pke) ISO/IEC/IEEE 12207:2017 Systems and Software Engineering – Software Life Cycle Processes ANSI/EIA 649C-2019 – Configuration Management Standard ANSI/EIA 836B-2015 – Configuration Management Data Exchange and Interoperability Federal Risk and Authorization Management Program (“FedRAMP”) Department of Defense Cloud Computing Security Requirements Guide, Version 1, Release 3, dated 6

March 2017 All applicable Security Requirements Guides, Security Technical Implementation Guides, and National

Security Agency security configuration guides when assessment and authorization is required Common Criteria for Information Technology Security Evaluation, Part 3: Security Assurance

Components, April 2017, Version 3.1, Revision 5, CCMB-2017-04-003 NIST SP 800-37 Revision 2, Risk Management Framework for Information Systems and Organizations, December 2018 U.S. Navy Risk Management Framework Process Guide, Version 3.1, 3 February 2020 NIST SP 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and

Organizations, April 2013, includes updates as of 22 January 2015 NIST SP 800-53A Revision 4, Assessing Security and Privacy Controls in Federal Information Systems and Organizations, December 2014, includes updates as of 18 December 2014 NIST SP 800-171 Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and

Organizations, February 2020 NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information, June 2018 NAVSUPINST 5239.5, Cybersecurity and Defensive Cyberspace Operations Policy, 25 March 2019 ISO/IEC 19770-1:2017 – Information Technology – IT Asset Management – Part 1: IT Asset Management

Systems - Requirements ISO/IEC 19770-2:2015 - Information Technology -- Software Asset Management -- Part 2: Software

Identification Tag ISO/IEC 19770 Series - Information Technology – IT Asset Management A Guide to the Project Management Body of Knowledge (PMBOK® Guide) - Sixth Edition Section 508 of the Rehabilitation Act of 1973 (amended by the Workforce Investment Act of 1998, 7

August 1998)

SECNAVINST 5720.44C - Department of the Navy Policy for Content of Publically Accessible World Wide Web Sites, 21 February 2012 (incorporating Change 1, 14 October 2014)

SECNAVINST 5510.30C, Department of Navy Personnel Security Program, 24 January 2020 Homeland Security Presidential Directive (HSPD)12, Policy for a Common Identification Standard for

Federal Employees and Contractors, 27 August 2004 DoD Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP), 3 April 2017 DoD Manual 5200.08-R, Physical Security Program, 27 May 2009, 3 April 2017

NTTP 3-13.3, Operations Security (OPSEC), September 2017 DoD Instruction 5200.48, Controlled Unclassified Information (CUI), March 6, 2020 NSAMECHINST 5530.1C CH-1, Naval Support Activity Mechanicsburg Installation Access Control, 23

August 2019 The following Directives are only applicable for classified Task Orders (Secret or higher clearance required):

Executive Order 13467 as amended, Establish the Roles and Responsibilities of the National Background Investigations Bureau and Related Matters, 30 June 2008

Executive Order 13526, Original Classification Authority, 29 December 2009 DoD 5220.22-M, National Industrial Security Program Operating Manual, 18 May 2016 DoD 5220.22, Volume 2, National Industrial Security Program: Security Procedures for Government

Activities Operating Manual, 1 August 2018 DoDM 5200.01 Volume 1, DoD Information Security Program: Overview, Classification, and

Declassification, 4 May 2018 DoDM 5200.01 Volume 2, DoD Information Security Program: Marking of Information, 14 May 2019 DoDM 5200.01 Volume 3, DoD Information Security Program: Protection of Classified Information, 19

March 2013

5.0 Requirements/Tasks

Not every performance requirement has a related performance standard or assessment measure expressed in this document. In such cases, the performance standard or performance measure is either inherent in the requirement or performance is to be in accordance with NAVSUP BSC standards which will be provided upon award.

Per DFARS 211.106, contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence.

5.1 Requirements Group 1 - Software Development Services

5.1.1 IT Software Engineering

The contractor shall provide IT software engineering support including:

analyzing and refining systems requirements;

translating systems requirements into applications prototypes;

planning and designing systems architecture;

writing, debugging, and maintaining code;

determining and designing applications architecture;

determining output media/formats;

designing user interfaces;

working with customers to test applications;

assuring software and systems quality and functionality;

integrating hardware and software components;

writing and maintaining program documentation;

evaluating new applications software technologies; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices to the delivery of application software services.

5.1.2 IT Internet Development

The contractor shall provide IT internet development support including:

determining overall technical design and structure of Internet services;

monitoring functionality, security, and integrity of Internet services;

troubleshooting and resolving technical problems with the design and delivery of Internet services;

collecting and analyzing Internet services usage and performance statistics;

evaluating new Internet services and technologies;

providing technical advice to Internet content providers; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices in the delivery of Internet services.

5.1.3 IT Systems Analysis

The contractor shall provide IT systems analysis support including:

performing needs analyses to define opportunities for new or improved business process solutions;

consulting with customers to identify and specify requirements;

developing overall functional and systems requirements and specifications;

conducting business process reengineering;

conducting feasibility studies and trade-off analyses;

preparing business cases for the application of IT solutions;

defining systems scope and objectives;

developing cost estimates for new or modified systems;

ensuring the integration of all systems components; e.g., procedures, databases, policies, software, and hardware;

planning systems implementation; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices to the systems analysis process.

5.2 Requirements Group 2 – Administration Services

5.2.1 IT Customer Support

The contractor shall provide IT customer support including:

diagnosing and resolving problems in response to customer reported incidents;

researching, evaluating, and providing feedback on problematic trends and patterns in customer support requirements;

developing and maintaining problem tracking and resolution databases;

installing, configuring, troubleshooting, and maintaining customer hardware and software;

developing recommendations for customer service performance requirements;

developing recommendations for customer support policies, procedures, and standards;

providing customer training; and ensuring the rigorous application of information security/information assurance policies, principles, and practices in the delivery of customer support services.

5.2.2 IT Systems Administration

The contractor shall provide IT systems administration support including:

planning and scheduling the installation of new or modified hardware and operating systems and applications software;

managing accounts, network rights, and access to systems and equipment;

managing systems resources including performance, capacity, availability, serviceability, and recoverability;

implementing security procedures and tools;

developing and documenting systems administration standard operating procedures;

resolving hardware/software interface and interoperability problems;

ensuring systems availability, functionality, integrity, and efficiency;

maintaining systems configuration;

managing the installation and integration of systems fixes, updates, and enhancements; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices in the delivery of systems administration services.

5.2.3 IT Operating Systems

The contractor shall provide IT operating systems support including:

analyzing systems requirements in response to business requirements, risks, and costs;

evaluating, recommending, verifying, and validating the systems software environment;

evaluating, recommending, and installing compilers, assemblers, and utilities;

integrating hardware and software components within the systems environment;

monitoring and fine-tuning performance of the systems environment;

evaluating new systems engineering technologies and their effect on the operating environment; and ensuring that information security/information assurance policies, principles, and practices are an integral element of the operating environment.

5.2.4 IT Network

The contractor shall provide IT network support including:

analyzing and defining network requirements;

defining and maintaining network architecture and infrastructure;

configuring and optimizing network servers, hubs, routers, and switches;

analyzing network workload;

monitoring network capacity and performance;

diagnosing and resolving network problems;

developing network backup and recovery procedures;

installing, testing, maintaining, and upgrading network operating systems software; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices in the delivery of network services.

5.2.5 IT Information Security

The contractor shall provide IT Information Security support including:

developing recommendations for policies and procedures to ensure information systems reliability and accessibility and to prevent and defend against unauthorized access to systems, networks, and data;

conducting risk and vulnerability assessments of planned and installed information systems to identify vulnerabilities, risks, and protection needs;

promoting awareness of security issues among management and ensuring sound security principles are reflected in organizations’ visions and goals;

conducting systems security evaluations, audits, and reviews;

developing systems security contingency plans and disaster recovery procedures;

developing and implementing programs to ensure that systems, network, and data users are aware of, understand, and adhere to systems security policies and procedures;

participating in network and systems design to ensure implementation of appropriate systems security policies;

facilitating the gathering, analysis, and preservation of evidence used in the prosecution of computer crimes;

assessing security events to determine impact and implementing corrective actions; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices in the delivery of all IT services.

5.3 Requirements Group 3 – Data and Analysis Services

5.3.1 IT Data Management

The contractor shall provide IT data management support including:

analyzing and defining data requirements and specifications;

designing, normalizing, developing, installing, and implementing databases;

maintaining, monitoring, performance tuning, backup, and recovery of databases;

installing, configuring, and maintaining database management systems software;

analyzing and planning for anticipated changes in data capacity requirements;

developing and administering data standards, policies, and procedures;

developing and implementing data mining and data warehousing programs;

evaluating and providing recommendations on new database technologies and architectures; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices in the delivery of data management services.

5.3.2 Operations Research and Analysis

The contractor shall provide operations research and analysis support including:

Provide statistical analysis, stochastic modeling, network analysis and optimization, as well as modeling and simulation, and decision support

Methods Development and Assessment – applying expert knowledge of particular classes of problems and the ability to develop associated problem solving methods;

Problem Solving –working directly to correct deficiencies or improve the performance of systems, processes, or operations;

Problem Definition – utilizing/framing “what if” questions in the formulation of problem statements;

Model Development – representing the important factors of the problem and their relationships to selected features of the real world;

Hypothesis Testing and Investigation –Successive integration of analogies, patterns, and relationships, and usually involves feedback and further restructuring; and Predictions/Explanations – Predicting future events or explain past events, recommendation of the best alternatives, and presentation of relevant tradeoffs and limitations to decision makers.

5.3.3 Supply Systems Analysis

The contractor shall provide supply systems analysis support including:

initiating, developing, installing, or administering a supply program;

coordinating with customers and overseeing the implementation of actions involving requirements determination, acquisition of supplies and materials, managing property accountability systems, and assuring that property is in place where and when needed;

developing and issuing supply handbooks and other publications for agency and/or industry use;

sponsoring and developing training programs, conferences and seminars;

conducting surveys and studies of supply operations to determine proper application of improved supply methods or approved industry techniques;

providing technical advice, guidance, and assistance on supply operations to agency personnel;

developing, installing, or advising on financial or other management control programs for supply operations for such purposes as controlling operations, determining supply costs, planning and budgeting, and evaluating supply management performance;

developing design specifications, reviewing data processing systems that support supply programs, and documenting additions, changes, or deletions;

monitoring and making recommendations to modify inventory control systems for subordinate and regional level programs;

evaluating storage and distribution systems for potential introduction of automated controls and systems of data flow and reports; and other combinations of work that involve program management, or review, analysis, and recommending improvements in operations, programs, automated systems, methods, or procedures.

Performance Measurement Criteria: Task success will be evaluated by the success of contractor at meeting imposed due dates for deliverables and documentation. This effort includes providing qualified personnel following industry accepted methodologies and other pertinent practices. The effort is further characterized by always operating with the Government’s best interest in mind, using efficient and effective methods and demonstrating sound cost control. The government reserves the right to periodically review personnel qualifications and certification of personnel working on this contrat and ask for the removal of any person not maintaining their qualifications or certifications. Performance Standards and Assessment Methods will be further defined at the task order level.

6.0 Deliverables: All deliverables must meet the format requirements specified by the individual task orders.

Documentation related to these services shall be made available electronically. The following list details the contract deliverables:

6.1 Monthly Status Report. Status reports shall be sent electronically to the TA and COR within seven (7) days following the end of the monthly period documenting the performance on the task order. The monthly status report shall include the following elements:

Resources by name Date project/task received Status of work with accomplishments documented Percentage of project/task completed Estimated date of project/task completion Issues/problems encountered or possible and recommended solutions Changes to the Project Management Plan (PMP) to include roles and responsibilities and schedule changes Identify any Government dependencies that are overdue which impact schedule or performance Evaluate performance and determine adequacy of staffing.

6.2 Trip reports

• Monthly (if applicable) Travel Reports

• This deliverable, using the TA approved format, shall be submitted as generated in electronic format to the TA or COR monthly or as directed at the Task Order level.

6.3 Contractor’s Quality Assurance Plan. The contractor shall develop and maintain a quality assurance plan.

This QA Plan should detail the methodology to be used by the contractor to monitor and ensure that all support services are provided and individual qualifications and certifications remain current. The contractor shall provide the Initial Quality Assurance Plan to the COR and TA not later than ten (10) days after contractor award. Unless stated otherwise, the following instructions apply to all deliverables:

All versions of the deliverables required by the task order shall be delivered electronically to the COR and/or his/her designee and shall be subject to Government review and approval.

Deliverable due dates shall take into account the review periods described below.

Draft deliverables will be reviewed and feedback and/or requested changes provided within 7 business days

(unless otherwise specified).

Government reserves the right to request a formal review session with the contractor during these timeframes and can request that the contractor make changes to any version of a deliverable.

Government will review and approve or reject all final versions of all deliverables within 7 business days of receipt (unless otherwise specified).

If any deliverable is rejected, the contractor will be notified within the specified time periods and will have

7 calendar days within which to rework the deliverable and resubmit for Government approval. All changes to any version of a deliverable and/or deliverable outline shall be approved by the COR. If more than the specified number of calendar days is required for Government review and approval, the COR will inform the contractor of the need for an extension within the initial review period.

Contractor shall prepare and submit the deliverables on or before the required due date to the COR or designee via email. For deliverables that are not documents the contractor shall submit a description of the deliverable and any associated documentation or descriptive information. In no case shall any deliverable be received by the Government less than 21 calendar days prior to the end of the task order Period of Performance.

Rejection of any deliverable by the Government does not excuse the contractor from meeting the baseline due dates for any other deliverables.

7.0 Period of Performance

The ordering period will be from July 15, 2020 through July 14, 2025 (or up to six months later not to exceed 15 January 2026 if 52.217-8 option(s) exercised).

8.0 Places of Performance

The primary place of performance will be Mechanicsburg, PA 17055. Additional on-site support may be required at other CONUS locations, OCONUS locations to include Hawaii, or off-site locations to be determined by each task order.

9.0 Travel

Specific travel requirements will be addressed as required at the task order level. If not the primary place of performance, travel may be expected to be accomplished to other locations (including international) in support of projects when pre-approved by the TA and COR. Obtaining a passport will be the responsibility of the traveler/company to include all costs to obtain passports. It is not anticipated that there will be a requirement for contractor to travel for any conference attendance.

If the contractor is required to travel to other locations, such travel shall be in accordance with FAR 31.205-46. All travel must be pre-approved in writing by the TA and COR prior to the actual travel and all travel must be funded in the contract prior to any travel expenses being incurred. No travel shall occur outside of the period of performance dates of the contract. Travel 12 hours or less, per diem does not apply.

If travel is required, the contractor is responsible for making all needed arrangements for their personnel.

9.1 Travel Policy. The Government will reimburse the contractor for allowable travel costs incurred by the contractor in performance of this PWS and determined to be in accordance with FAR subpart 31.2, subject to the following provisions:

Travel required for tasks assigned under this contract shall be governed in accordance with rules set forth for temporary duty travel in FAR 31.205-46.

Unallowable travel costs: Change or cancellation fees for travel.

9.2 Travel other. Travel, subsistence, and associated labor charges for travel time are authorized whenever a task assignment requires work to be accomplished at a temporary alternate worksite. Travel performed for personal convenience will not be reimbursed.

9.3 Air/Rail Travel. In rendering the services, the contractor shall be reimbursed for the actual costs of transportation incurred by its personnel not to exceed the cost of economy class rail, or plane fare, to the extent that such transportation is necessary for the performance of the services hereunder and is authorized by the Contracting Officer’s Representative (COR). Such authorization by the COR shall be indicated in the order or in some other suitable written form.

10.0 Security

All positions are classified as noncritical-sensitive. Future task orders may require a security clearance for requirements (DD254 may be required at the task order level). Per SECNAV M-5510.30C (Department of the Navy Personnel Security Program Program) and DOD 5220.22-M (National Industry Security Program Operating Manual), only U.S. Citizens are eligible for security clearances.

This clause does not apply to non-U.S. Nationals (foreign nationals) who are contactor employees performing work overseas.

The clause is applicable to the United States Nationals living in the U.S. or overseas who are performing work on a Navy contract.

The investigation of a non-U.S. national at a foreign location must be consistent with a NACI, to the extent possible, and include a fingerprint check against the FBI criminal history database, an FBI investigations file (name check) search, and a name check against the terrorist screening database.

Also, the above cited reference notes that Foreign Nationals may not be granted CAC Credentials until completion of their investigation and not in the interim.

Per DoD 5200.2-R, DoD Components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location. The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S. and its allies or agency agreements with the host country.

SUPTXT204-9400(7-18) Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information (JUN 2018) Executive Order 13467, Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information, and Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this text will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

START-UP PERIOD

All contractor resource onboarding documents must be submitted via the prime contractor. The prime contractor shall make all necessary preparations to assume full responsibility for productive performance as of the performance start date.

Definition of “productive”:

a. Visit Authorization Request (VAR)

b. Contractor Information Sheet (CIS)

c. FD-258 fingerprint card

d. Completed EQIP (Electronic Investigation)

e. All contractor resource(s) must have an active JPAS profile

f. Common Access Card (CAC)

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services, and no reimbursement will be paid by the Government for efforts expended during the start-up period.

Note (2): Dual Citizenship and Foreign Nationals are not allowed access to the functional/system side of Enterprise Resource Planning (ERP).

ACCESS TO DOD IT SYSTEMS

In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to sensitive information. Sensitive information includes information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information System Security Manager (ISSM)/Information Assurance Manager (IAM) upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources.

The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the “supervisor”.

The SAAR-N shall be forwarded to the Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Cyber Awareness) training, and maintain a current requisite background investigation. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

INTERIM ACCESS

The Command's Security Manager may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this text including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this text in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR’S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor’s Security Representative. Within three work days after contract award, the contractor shall provide to the requiring activity’s Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor’s Security Representative. The Contractor’s Security Representative shall be the primary point of contact on any security matter. The Contractor’s Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR

CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE

DUTIES Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non- Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

•SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product) •Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission) •Original Signed Release Statements Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the Command’s Security Manager upon arrival to the command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy Command’s Information Systems Security Manager (ISSM)/Information Assurance Manager (IAM)Manager. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Cyber Awareness training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the Command Security Manager. The Command’s Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM); Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Command’s Security Manager will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) or a hard copy VAR directly from the contractor’s Security Representative. Although the contractor will take JPAS “Owning” role over the contractor employee, the Navy Command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT

Position Category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee’s performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR

CONTRACTORS ASSIGNED TO OR PERFORMING NON-SENSITIVE DUTIES

Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc. ...) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

• Must be either a US citizen or a US permanent resident with a minimum of 3 years legal residency in the United States (as required by The Deputy Secretary of Defense DTM 08-006 or its subsequent DoD instruction) and

• Must have a favorably completed National Agency Check with Written Inquiries (NACI) or T1 investigation equivalent including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the Contractor’s Security Representative must submit for all employees each of the following:

• SF-85 Questionnaire for Non-Sensitive Positions

• Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

• Original Signed Release Statements The contractor shall ensure each individual employee has a current favorably completed National Agency Check with Written Inquiries (NACI) or T1 equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

* Consult with your Command Security Manager and Information Systems Security Manager (ISSM)/Information Assurance Manager (IAM) for local policy when IT-III (non-sensitive) access is required for non-US citizens outside the United States.

DoD 8570.01-M Information Assurance Workforce Improvement Program.

_____ No Additional IA Certification Required ____X_ Information Assurance DoD 8570.01-M Required:

IA Certification Level: If additional IA Cert is required, it will be detailed at the task order level.

Per NAVADMIN 003/19 contractors are governed by DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19 December 2005, Change 4, 10 November 2015.

Computing Environment Certification: If Comp Environment Certification is required, it will be detailed at the task order level.

Privileged system access may be required and detailed at the task order level.

The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program. The Contractor shall meet the applicable information assurance certification requirements, including-

(1) DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M.

(2) Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M.

(a) Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

(b) Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

Proof of the above-indicated IA baseline certification is to be provided for all contractor personnel prior to time of engagement. In addition to the IA certificate, active enrollment and participation in the certification maintenance program must be established prior to contract award to ensure the appropriate access can be secured by contractor resources. All required IA baseline certifications must be current at the contract period start date; there is no “grace” period to obtain these certifications. Computing environment certification must be current no later than six (6) months after start. Questions and additional information requirements may be addressed by contacting the NAVSUP Business Systems Center Information System Security Manager (ISSM).

Certification shall be forwarded to:

Jacquelin Jamison, Code 94 NAVSUP Business Systems Center ISSM 5450 Carlisle Pike, Bldg. 409 Mechanicsburg, PA 17055 Email: Jacquelin.jamison@navy.mil

11.0 Government Furnished Equipment / Information / Materials Work is expected to be performed at the government site or offsite, depending on the task…