22F0072_P00014_PWS_2025_0611_Redacted.pdf

Performance Work Statement Defense Counterintelligence and Security Agency (DCSA)

DoD Insider Threat Management and Analysis Center (DITMAC) DITMAC Support Services

May 16, 2025

Part 1 General Information

1. General: This is a non-personal services contract to provide the Defense Insider Threat Management and Analysis Center (DITMAC) Support Services. The Government shall not exercise direct supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1. Description of Services/Introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and services necessary to perform DITMAC Support Services as defined in this Performance Work Statement (PWS) except for those items specified as Government furnished property and services. The Contractor shall perform to the standards in this contract.

1.2. Background: In December 2014, the Defense Counterintelligence and Security Agency (DCSA) was appointed by the Secretary of Defense to incubate the DITMAC program, affirmed in January 2017 via DoD Directive 5205.16, Change 1. The mission of the DITMAC is to enable information sharing, collaboration, analysis, and risk mitigation across the DoD Components to address current and emerging threats to DoD personnel, assets, and information by insiders. It fills a critical gap within the DoD by empowering and entrusting a single senior Defense official with the task of working with all DoD Component Insider Threat (InT) programs to promote best practices, drive innovation, promulgate a fundamental set of standards, and provide resource and policy advocacy to senior decision makers, and through an enterprise-level analytic function, close seams between Components that are potentially exploitable by insiders. DCSA is made up of multiple mission centers. One of those is DITMAC. DITMAC was created as a result of the tragic shootings at the Washington Navy Yard and Fort Hood. The mission of the DITMAC is to provide the DoD enterprise a capability to identify, assess and mitigate risk from insiders, to oversee and manage unauthorized disclosures, and to integrate, manage, mature and professionalize insider threat capabilities. In order to execute this InT mission, additional support services are required to support the strategic planning and daily operations of the core DITMAC Team.

1.3. Objectives: The primary objective of this contract/task order is to provide support services required to enable the strategic planning and daily operations of the DITMAC Team. The primary objective is to improve productivity and effectiveness of DITMAC in the following four (4) areas:

• Human Resources (HR)

• Facilities Management

• Executive Operations

• Information Technology (IT) Systems Analysis

1.4. Scope: The contractor shall provide non-personal services support to enable improved strategic planning and daily operations for the DITMAC Team. Services provided under this contract/task order include delivery of personnel with specialized expertise in the areas of human resources, facilities management, executive operations, and IT Systems Analysis. Through this support the Contractor shall enable the DITMAC Team to:

• Adequately staff the DITMAC organization;

• Affect an orderly move transition, and maintain efficient space management at all DITMAC locations;

• Improve the management of DITMAC executive-level operations; and

• Improve the DITMAC contributions for all IT Systems that DITMAC has development and sustainment equities in.

1.5. Period of Performance: The period of performance shall be for a one-year base period plus four one-year option periods (if exercised)

Base Year: 09/28/2022 – 09/27/2023 Option Year 1: 09/28/2023 – 09/27/2024 Option Year 2: 09/28/2024 – 09/27/2025 Option Year 3: 09/28/2025 – 09/27/2026

Option Year 4: 09/28/2026 – 09/27/2027

1.6. General Information:

1.6.1. Quality Control: The Contractor shall develop and maintain an effective quality control program, including a Quality Control Plan (QCP), to ensure services are performed in accordance with this performance work statement.

The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s quality control program is the means by which they assure themselves that their work complies with the requirement of the contract. The Contractor shall develop and deliver the QCP to the Government within 30 days after contract award. Three copies of a comprehensive written QCP shall be submitted to the Contracting Officer (KO) and Contracting Officer’s Representative (COR) within 5 working days when changes are made thereafter. After acceptance of the QCP, the contractor shall obtain the KO acceptance in writing of any proposed changes to its QCP.

1.6.2. Quality Assurance: The Government shall evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3. On-Site Working Conditions, Holidays, and other Closures:

1.6.3.1. DCSA facilities are smoking restricted workplaces. Due to the nature of the work, facilities, and requirements, Contractor staff may only smoke outside in designated smoking areas.

1.6.3.2. The Government expects the Contractor will establish normal operating hours under this contract between 8:00 a.m. to 4:30 p.m. Eastern Time (ET) Monday through Friday. The Contractor’s Program Manager (PM) and the Governments COR shall consult and coordinate on any proposed alternate work schedules that may be arranged depending on the operational tempo/needs of the mission.

1.6.3.3. Government personnel observe the following days as holidays and the Government facilities will be closed and unavailable to Contractor personnel on the following days:

New Year’s Day January 1st*

Martin Luther King’s Birthday Third Monday in January President’s Day Third Monday in February Memorial Day Last Monday in May

Independence Day July 4th* Juneteenth National Independence Day June 19*

Labor Day First Monday in September Columbus Day Second Monday in October

Veterans Day November 11th* Thanksgiving Day Fourth Thursday in November Christmas Day December 25th*

*If the date falls on a Saturday, the Government holiday is the preceding Friday. If the date falls on a Sunday, the Government holiday is the following Monday.

1.6.3.4. In addition to the days designated as holidays, the Government observes the following days:

All cleared contractors supporting the Department of Defense or select Executive Branch departments and agencies, and operating under the auspices of Department of Defense Directive (DoDD) 5105.42, the National Industrial Security Program (NISP) and Title 32 CFR, Part 117, are required to report possible threats and vulnerabilities identified in the National Industrial Security Program Operating Manual (NISPOM) and Title 32 CFR, Part 117; the reportable incident must be entered into the Defense Information System for Security (DISS).

1.6.7.1. Physical Security: The Contractor shall be responsible for safeguarding all Government equipment, information and property provided for Contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured.

1.6.7.2. Key Control. The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the KO.

1.6.7.2.1. In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the KO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.6.7.2.2. The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the KO.

1.6.7.3. Lock Combinations: The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s QCP.

1.6.8. Special Qualifications: The following training is required for onsite contractor personnel:

1. DoD Cyber Awareness Challenge (CAC) Training: All contractor personnel, to include subcontractor personnel, requiring access to DoD Information Technology (IT) resources shall complete the DoD CAC training in accordance with DoDD 8140.01.

2. Operations Security (OPSEC) Awareness Training: All contractor personnel shall complete OPSEC Awareness training in accordance with DoDM 5205.02.

3. Intelligence Oversight Awareness Training: All contractor personnel working in DoD facilities shall complete Intelligence Oversight training in accordance with DoDD 5148.13 and DCSAI 19-1.

4. Insider Threat Awareness Training: Contractor personnel granted eligibility for access to classified information or eligibility to hold a sensitive position shall complete this training in accordance with DoDD 5205.16.

5. Privacy Act and Personally Identifiable Information (PII) Training: Contractor personnel performing activities associated with maintaining a system of records on behalf of a DoD component shall complete PII training in accordance with DoDI 5400.11, DoD 5400.11-R, and OMB Circular A-130.

6. Unauthorized Disclosure of Classified Information Training: DoD contractor personnel requiring access to classified information shall complete Unauthorized Disclosure of Classified Information training in accordance with DoDD 5210.50.

7. Information Security Training: DoD Contractor personnel with access to classified information who work at a DoD facility shall complete Information Security training in accordance with DoDM 5200.01, Volume 3.

8. Preventing Workplace Violence Training: Contractor personnel shall complete Preventing Workplace Violence training in accordance with DoDI 1438.06 and DSSR 11-851.

9. Derivative Classification Training: Contractor personnel with access to classified information shall complete Derivative Classification training in accordance with Under Secretary of Defense for Intelligence (USDI) Memorandum Subject: Derivative Classification Training dated 31 Jan 2019.

10. Cybersecurity Training and Certification: Contractor personnel performing cybersecurity functions as defined in DoDD 8140.01 shall complete Cybersecurity training and obtain certifications prior to commencement of duties in accordance with DoDM 8140.03 and DFARS 252.239-7001 Information Assurance Contractor Training and Certification. Delivery method is https://public.cyber.mil or as specified by the COR, if/when cybersecurity training is applicable.

11. Antiterrorism Level I Training: Contractors requiring routine physical access to a Federally-controlled facility or military installation shall complete Antiterrorism Level I training in accordance with DoDI O-2000.16, Volume 1 and DFARS 252.204-7004 Antiterrorism Awareness Training for Contractors.

12. DoD Mandatory Controlled Unclassified Information (CUI) Training: Contractor personnel with access to controlled unclassified information shall complete CUI training in accordance with DoDI 5200.48.

13. Counterintelligence Awareness and Reporting (CIAR) Training: All DCSA contractor personnel shall complete CIAR training in accordance with DoDD 5240.06.

14. Prevention of Sexual Harassment Training (Highly recommended; Not required): To facilitate and ensure compliance with DCSAI 08-14, Contractor personnel may complete Prevention of Sexual Harassment training in accordance with DoDI 1020.04.

15. No Fear Act/Whistleblower Protection Training: Contractor personnel are required to complete No Fear Act/Whistleblower Protection training in accordance with the Notification and Federal Employee Antidiscrimination and Retaliation Act (No FEAR Act) of 2002 (Public Law No. 107-174).

The Contractor shall submit certificates of completion for each affected Contractor employee and subcontractor employee, to the COR or to the KO. This training shall be completed and reported to the COR within 30 calendar days of contract assignment and annual refresher training for the remaining contract duration, except for the No Fear Act/Whistleblower Protection Training which is required every two years. The Cybersecurity Training and Certification is the only training exempt from the 30 days and annual refresher requirements as it is a one-time certification prior to commencement of duties.

1.6.9. Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR subpart 42.5. The KO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings, the KO will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced.

Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.6.10. Contracting Officer’s Representative: The COR will be identified by a separate, appointment letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the KO and Contractor of any deficiencies; coordinate availability of Government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.11. Non-Key Personnel: The Contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the Contractor when the manager is absent shall be designated in writing to the KO. The contract manager or alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 8:00 a.m. to 4:30p.m., Monday thru Friday except Federal holidays or when the Government facility is closed for administrative reasons. Qualifications for all non-key personnel are listed below:

Task 5.2. RESERVED Task 5.3. RESERVED Task 5.4. RESERVED

Task 5.5. IT Analysis Specialist

• Must have TOP SECRET with SCI eligibility; security clearance/eligibility determination based on a favorably adjudicated T5 or T5R with SCI eligibility; be within investigation scope and/or currently enrolled in Continuous Evaluation (CE) / Continuous Vetting (CV) at the time of contract award and throughout the life of the contract to include all potential option years identified in this PWS Requires Bachelor’s degree (in Computer Science or a related field) or equivalent,

• 5 – 7 years of related experience.

• Must have a working knowledge of classified and unclassified systems and Government/Industry standards/requirements.

• Ability to advise non-IT professionals on Department of Defense network standards to facilitate the effective deployment of insider threat tools.

• Strong coordination skills to work with a wide-range of organizations and promote technical solutions which are not common to facilitate mission requirements.

1.6.12. Contractor Manpower Reporting: The Contractor shall report ALL Contractor labor hours (including Subcontractor labor hours) required for performance of services provided under this contract for the DCSA via a secure data collection site. The Contractor is required to completely fill in all required data fields using the following web address: https://www.sam.gov. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk at: https://www.sam.gov (see FAR Clause 52.204-14 – Service Contract Reporting Requirements).

1.6.13. Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their Contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed. Additionally, all Contractor employees will be required to obtain DCSA/DITMAC facility badges in accordance with agency policy.

1.6.14. Contractor Travel: Contractor will periodically be required to travel within the Washington Local Commuting Area during the performance of this contract to attend meetings, conferences, and training. All travel within the Washington Local Commuting Area (IAW DoDI 4515.14) is included in the price of this contract.

FROM TO DURATION # of TRIPS DITMAC, Arlington, VA Pentagon 2-3 hours 2 times per month DITMAC, Arlington, VA Quantico, VA 3-4 hours 3-4 times per month DITMAC, Arlington, VA Fort Meade, MD 3-4 hours 1-2 times a year

1.6.15. Other Direct Costs: Not applicable.

1.6.16. Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR subpart 9.5. The Contractor shall notify the KO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the KO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the KO and in the event the KO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.6.17. Phase In/Phase Out Period: Not applicable.

Part 2 Definitions and Acronyms

2. Definitions and Acronyms:

2.1. Definitions:

2.1.1. Contractor. An offeror, supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.2. Contracting Officer. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

2.1.3. Contracting Officer’s Representative. An employee of the U.S. Government appointed by the Contracting Officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4. Defective Service. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.5. Deliverable. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.6. Physical Security. Actions that prevent the loss or damage of Government property.

2.1.7. Quality Assurance. The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.8. Quality Assurance Surveillance Plan. An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

2.1.9. Quality Control. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.10. Subcontractor. One that enters into a contract with a prime Contractor. The Government does not have privity of contract with the Subcontractor.

2.1.11. Work Day. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.12. Work Week. Monday through Friday, unless specified otherwise.

2.2. Acronyms:

AT Anti-terrorism CAC Common Access Card CATMS Correspondence and Task Management System CFR Code of Federal Regulations CI Counterintelligence KO Contracting Officer CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTS Commercial-Off-the-Shelf CUI Covered Unclassified Information DCSA Defense Counterintelligence and Security Agency DD254 Department of Defense Contract Security Requirement List DFARS Defense Federal Acquisition Regulation Supplement DISS Defense Information Security System DITMAC Defense Insider Threat Management and Analysis Center DMDC Defense Manpower Data Center DOD Department of Defense DSSR Defense Security Service Regulation EO Executive Order FAR Federal Acquisition Regulation FY Fiscal Year HR Human Resources IC Intelligence Community ICD Intelligence Community Directive InT Insider Threat IT Information Technology MSR Monthly Status Report NCR National Capital Region NCCS National Contracts Classification System NISP National Industrial Security Program OCI Organizational Conflict of Interest OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs OMB Office of Management and Budget OPSEC Operational Security PAEI Publicly Available Electronic Information PIPO Phase In/Phase Out PM Program Manager POC Point of Contact PPD Presidential Policy Directive PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program SOP Standard Operating Procedures TE Technical Exhibit TS//SCI Top Secret/ Sensitive Compartmented Information UAM User Activity Monitoring USD(I) Under Secretary of Defense for Intelligence

Part 3 Government Furnished Property, Equipment and Services

3. Government Furnished Items and Services: The Government will provide the property, material, equipment, and/or services listed below solely for the purpose of performance under this contract:

3.1. Services: The Government will provide access to personnel and information necessary to satisfy the terms of the contract.

3.2. Facilities: The Government will provide all facilities and the necessary workspace for the Contractor staff to provide the support outlined in the performance work statement to include desk space for all five contractor employees listed in Part 5 of this PWS.

3.3. Utilities: The Contractor shall instruct employees in utilities conservation practices. The Contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the reasonable amount.

3.4. Equipment: In addition to the facilities listed in Section 3.2, the Government will provide the following equipment:

• All contractor staff:

o Laptop o Accessories such as: monitor, keyboard, mouse, headset o Cellphone o System Access Tokens

• On-site Contractor staff:

o Access to common use equipment such as: scanners, printers, fax machines etc.

o Contractor personnel will take and appropriately document any necessary training related to the use of Government equipment.

Replacement, Modernization, Modification: During the term of the contract the Government may replace, modify, or improve equipment systems at the Government's expense and by means not associated with this contract. All replaced, improved, updated, or modernized, equipment and systems shall be operated by the Contractor at no additional cost to the Government unless such changes result in an increase or decrease in contract requirements.

3.5. Materials: The Government will provide access to required regulations, policies, procedures, standard operating procedures, and other Government information necessary for Contractor performance upon request.

3.6 Information: All Contractor personnel shall sign the DCSA "Consent to Monitoring" form. Initial familiarization/orientation shall be provided by DCSA at the DITMAC facility located at

Part 4 Contractor Furnished Items and Services

4. Contractor Furnished Items and Responsibilities:

4.1. General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Section 3 of this performance work statement. While the work performed by the Human Resources Specialists, Facilities Management Specialist, Executive Operations Specialist, and Information Technology (IT) Systems Analysis Specialist will be conducted at a Government location, indirect tasks such as corporate oversight and management will be performed at a Contractor location.

4.2. Materials: The Contractor shall furnish materials, supplies, and equipment necessary to perform corporate oversight and management functions identified in this contract.

4.3. Equipment: The Contractor shall furnish materials, supplies, and equipment necessary to perform corporate oversight and management functions identified in this contract.

Part 5 Specific Tasks

5. Specific Tasks:

5.1. Basic Services: The Contractor shall provide non-personal support services to enable improved strategic planning and daily operations for the DITMAC Team. Services provided under this contract/task order include delivery of personnel with specialized expertise in the areas of human resources, facilities management, executive operations, and IT Systems Analysis.

5.2 RESERVED

5.2.1. RESERVED

5.2.2. RESERVED

5.2.3. RESERVED

5.2.4. RESERVED

5.2.5. RESERVED

5.2.6. RESERVED

5.2.7. RESERVED

5.3. RESERVED

5.3.1. RESERVED

5.3.2. RESERVED

5.4. RESERVED

5.4.1. RESERVED

5.4.2. RESERVED

5.5. IT Analysis Specialist Support

5.5.1. The Contractor shall provide IT Support services in development and execution of unclassified and classified User Activity Monitoring (UAM) Program and Publicly Available Electronic Information (PAEI) Program. This task includes the following:

• Formulate and define UAM and PAEI systems scope and objectives.

• Analyze business and user needs, document requirements, and translate needs into proper system requirement specifications.

• Develop and evaluate comprehensive program requirements, including technical and cybersecurity requirements.

• Document UAM and PAEI functional requirements.

• Support DCSA development, implementation, and communication activities for UAM and PAEI.

• Assist the Government in designing a management and oversight process for UAM and PAEI.

5.5.2. The Contractor shall provide additional technical and management IT systems support services to include:

• Develop policies and procedures to address information system issues.

• Provide comprehensive analysis of business and user IT needs.

• Develop process flows, training materials, and project documentation for DITMAC.

• Conduct IT/system related training sessions.

• Provide IT/system project management support services and technical support as requested.

• Deliver IT/system related user training.

5.6. Reports. The Contractor shall provide a monthly status report (MSR) to the COR within 10 calendar days after the end of each month. At a minimum, this MSR shall address the following:

• Monthly Highlights.

• Changes, Risks, and Recommendations.

• Activities Completed the previous month.

• Activities planned for the next month.

• Summary of deliverables provided in the previous month.

• Project Financials

• Measurement of actual performance against requirements and thresholds as listed in Technical

Exhibit 1

Part 6 Applicable Publications

6. Applicable Publications (Current Editions):

DoD 5400.11-R

Department of Defense Privacy Program

Issuance Date: May 14, 2007

DoDD 5148.13 Intelligence Oversight Issuance Date: April 26, 2017 DoDD 5205.16 The DoD Insider Threat Program Issuance Date: September 30, Change Date: August 28, 2017

DoDD 5210.50 Management of Serious Security Incidents Involving Classified Information

Issuance Date: October 27, 2014 Change Date: September 18, 2020

DoDD 5240.06 Counterintelligence Awareness and Reporting (CIAR)

Issuance Date: May 17, 2011 Change Date: August 31, 2020

DoDD 8140.01 Cyberspace Workforce Management

Issuance Date: October 5, 2020

DoDI 1020.04 Harassment Prevention and Responses for DoD Civilian Employees

Issuance Date: June 30, 2020

DoDI 1438.06 DoD Workplace Violence Prevention and Response Policy

Issuance Date: January 16, 2014 Change Date: May 4, 2020

DoDI 5200.48 Controlled Unclassified Information (CUI)

Issuance Date: March 6, 2020

DODI 5400.11 DoD Privacy and Civil Liberties Programs

Issuance Date: January 29, 2019 Change Date: December 8, 2020

DoDI O-2000.16, Volume 1 DoD Antiterrorism Program Implementation: DoD Antiterrorism Standards

Issuance Date: November 17,2016 Change Date: May 7, 2021

DODM 5200.01, Volume 3 DoD Information Security Program: Protection of Classified Information

Issuance Date: February 24, 2012 Change Date: July 28, 2020

DoDM 5205.02 DoD Operations Security (OPSEC) Program Manual

Issuance Date: November 3, 2008 Change Date: October 29, 2020

DoDM 8140.03 Cyberspace Workforce Qualification and Management Program

Issuance Date: February 15, 2023

OMB Circular A-130 Managing Information as a Strategic Resource

Issuance Date: December 1985 Change Date: July 28, 2016

DCSAI 08-14* Workplace Harassment Prevention and Response

Issuance Date: April 22, 2022 Change Date: April 26, 2023

DCSAI 19-1* Intelligence Oversight Program Issuance Date: April 20, 2023 DSSR 11-851* Workplace Violence Prevention and Response Issuance Date: January 10, 2017

Under Secretary of Defense for Intelligence (USDI) Memorandum, Subject: Derivative Classification Training

January 31, 2019

DODM 5220.22-M Issuance Date: February 28, 2006. Change Date: May 18, National Industrial Security Program Operating Manual

DSSR 18-9 Issuance Date: September 3, 2010 Defense Security Service Regulation (DSSR) - Intelligence Oversight Program

DCSA 21-30 Issuance Date: December 15, DCSA Regulation “Acceptable Use of Information Technology Resources,”

ICD 120 Issuance Date: April 29, 2016 Intelligence Community Directive (ICD) Intelligence Community Whistleblower Protection

PPD-19 Issuance Date: October 10, 2012 Presidential Policy Directive (PPD) Protecting Whistleblowers with Access to Classified Information

Memo January 31, 2019 Under Secretary of Defense for Intelligence (USDI) Memorandum Subject: Derivative Classification Training

Executive Order August 1995 Executive Order 12968, “Access to Classified Information”

Executive Order January 2017 Executive Order 13764, “Amending the Civil Service Rules, Executive Order 13488, and Executive Order 13467 To Modernize the Executive Branch-Wide Governance Structure and Processes for Security Clearances, Suitability and Fitness for Employment, and Credentialing, and Related Matters”

Executive Order February 1960 Executive Order 10865, “Safeguarding Classified Information within Industry,” as amended

Executive Order December 1993 Executive Order 12829, “National Industrial Security Program”

Policy March 2020 DCSA Information System User Agreement

*All non-publicly available DCSA references will be provided to the interested party upon request.

6.1. The Contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures.

Part 7 Technical Exhibit Listing

7. Technical Exhibit List:

7.1. Technical Exhibit 1 – Performance Requirements Summary

7.2. Technical Exhibit 2 – Deliverables Schedule

7.3. Technical Exhibit 3 – Estimated Workload Data

system requirement specifications.

• Develop and evaluate comprehensive program requirements, including technical and cybersecurity requirements.

• Document UAM and PAEI functional requirements.

• Support DCSA development, implementation, and communication activities for UAM and PAEI.

• Assist the Government in designing a management and oversight process for UAM and PAEI.

• All artifacts support and are in full compliance with Information Systems, regulation, policy, and best practices (e.g., Clinger-Cohen Act, etc.).

• All implementation and communication activities are tracked in real time, and the contractor is able to provide an update to the Government within 2 hours after request.

• Any UAM or PAEI issues that cannot be resolved at the contractor level are raised to the Government within 2 business days.

• Real time status of all appropriate resources is available to the government within 2 hours after request errors to include grammar, spelling, formatting errors, and are resolved within one business day

PRS13 5.5.2 The Contractor shall provide additional technical and management IT systems support services to include:

• Development of policies and procedures to address information system issues

• Provide comprehensive analysis of business and user IT needs

• Develop process flows, training materials, and project documentation for DITMAC

• Conduct IT/system related training sessions

• Provide IT/system project management support services and technical support as requested

• Conduct user training

• Policies and procedures developed adequately translate IT system requirements/processes in a way that easily understandable to the non-technical user.

• Users and businesses needs are fully documented and comprehensive

• Business process flow artifacts accurately reflect the proper steps needed for each business activity

• Training and project documentation is understandable to all users

• Training sessions are conducted at leadership request.

• All support requests are cataloged, and support is given within 2 business days of request.

• Routine IT operation issues are resolved at the contractor level.

Issues that cannot be resolved are raised to the government within 1 business day of being identified.

• Routine tasks are completed timely and meet required suspense dates.

• Contractor maintains real time status of all issues and is available to provide update to government within 2 hours of request.

• Routine project management support tasks are completed within 2 days of request.

• The Contractor shall not miss more than 2 suspense dates in the current period of performance, and delays shall not exceed 1 business day

• All training, project, and procedural documentation require no more than 2 revisions after review by leadership

• Submitted deliverables contain no more than 3 errors to include grammar, spelling, formatting errors, and are resolved within one business day

• Periodic inspection by the COR.

• Customer Input/ Feedback

5.6. Reports

5.6. Monthly Status

Report (MSR)

Provided within 10 calendar days after the end of each month.

Submitted via email in MS Word Format.

Submitted via email to the COR.