4.02 N0018924QR066 released.pdf

SEE ADDENDUM

(No Collect Calls)

N0018924QR066 10-Jun-2024

b. TELEPHONE NUMBER

717-605-3406

8. OFFER DUE DATE/LOCAL TIME

12:00 PM 21 Jun 2024

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

N001899. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

RAYMOND E. THOMPSON

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

1301163468

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED ORX

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

NAVSUP FLC NORFOLK CONTRACTING

MECHANCISBURG OFFICE

ATTN: RAYMOND THOMPSON

5450 CARLISLE PIKE

MECHANICSBURG PA 17050

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE N00367 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

NAVSUP BSC

CATHRYN STONE

5450 CARLISLE PIKE, SUITE 409

MECHANICSBURG PA 17050-2411

TEL: 564 230 2913 FAX:

FAX:

TEL: 717-605-3406 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$15,000,000

NAICS:

611430

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF78

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

N0018924QR066

Section SF 1449 - CONTINUATION SHEET

JOINT VENTURE LANGUAGE

“A small business joint venture offeror must submit, with its offer, the representation required in paragraph (c) of FAR solicitation provision 52.212-3, Offeror Representations and Certifications-Commercial Products and Commercial Services, and paragraph (c) of FAR solicitation provision 52.219-1, Small Business Program Representations, in accordance with 52.204-8(d) and 52.212-3(b) for the following categories:

(A) Small business;

(B) Service-disabled veteran-owned small business;

(C) Women-owned small business (WOSB) under the WOSB Program;

(D) Economically disadvantaged women-owned small business under the WOSB Program; or

(E) Historically underutilized business zone small business.”

52.212-1 ADDENDUM

Note: The quoter shall complete FAR provision 52.204-24 and provide a completed copy of the provision along with a quote and requested supporting price information, as specified in FAR provision 52.212-2, in response to the solicitation.

This solicitation is for a NAVSUP BSC requirement of Project Management curriculum as outlined in the Project Management Institute’s (PMI) “A Guide to the Project Management Body of Knowledge” (PMBOK Guide) 7th edition.

REQUIREMENTS

Contractors that provide a quote shall adhere to the particulars of this solicitation, with a keen focus on the Performance Work Statement (PWS). Quoters shall provide a detailed plan as to how they will meet the needs of NAVSUP BSC’s requirements as outlined in the PWS.

(end of addendum)

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 8 Each Project Management Training

FFP

Project Management Training for the base period in accordance with the PWS.

FOB: Destination

PURCHASE REQUEST NUMBER: 1301163468

PSC CD: U012

NET AMT

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

1001 8 Each OPTION Project Management Training

FFP

Project Management Training for the first option period in accordance with the

PWS

FOB: Destination

PSC CD: U012

NET AMT

PERFORMANCE WORK STATEMENT

Performance Work Statement (PWS) for Project Management

Curriculum

1.0 Introduction:

NAVSUP Business Systems Center (BSC) Contractor Support Services (CSS) needs under this task order include Project Management Curriculum and classroom training on the five phases and ten knowledge areas of project management contained within the Project management Institute’s (PMI) “A Guide to the Project Management Body of Knowledge” (PMBOK), 7th edition. This training is in support of Navy, DOD, and multinational logistics and readiness applications and processes.

2.0 Background:

2.1 Requiring Organization:

The organization requiring the services outlined in the Performance Work Statement (PWS) is:

NAVSUP Business Systems Center 5450 Carlisle Pike Suite 409 Mechanicsburg PA 17050-2411

2.2 Project Description:

The purpose of this PWS is to obtain contract services for the training of project managers to provide the support necessary to deliver NAVSUP BSC Information Technology (IT), Information Management (IM), large scale System Integration (SI) and Information Systems (IS) mission described in the Introduction paragraph of this PWS.

3.0 Scope:

The goal of this PWS is to obtain contractor support services to provide the following:

Project Management Curriculum and training with multiple courses held monthly, with no more than 8 courses over a year’s time covering the topics below.

o Leadership o Project Communication o Managing Projects o Requirements o Risks o Scheduling o Cost Management o Contracts o Quality

The topics will focus on Agile Project Management more than Waterfall style, wherever possible.

4.0 Directives:

The contractor shall comply with the following directives, and any updated/future versions as they are released:

Federal Information Security Modernization Act of 2014

(“FISMA”)

Common Criteria for Information Technology Security Evaluation, Part 3: Security Assurance Components, April 2017, Version 3.1, Revision 5, CCMB-2017-04-003

DoDI O-2000.16-V1, DoD Antiterrorism Program Implementation, 17 November 2016 (incorporating Change 3, 7 May 2021)

DoDD 5205.02E, OPSEC, 20 June 2012 (incorporating Change 2, 20 August 2020)

SECNAV 3070.2A, Navy OPSEC, 9 May 2019

SECNAVINST 5500.35, Navy Physical Security Program, 22 February 2022

NAVSUPINST F5500.3, Insider Threat, 17 August 2020 DoD Instruction 5400.11, DoD Privacy and Civil Liberties

Programs, 29 January 2019 (incorporating Change 1, 8 December 2020)

DoD Directive 8000.01, Management of the DoD Information Enterprise, 17 March 2016 (incorporating Change 1 July 2017)

DoD Directive 8140.01, Cyberspace Workforce Management, 5 October 2020

DoD Instruction 4161.02, Accountability and Management of Government Contract Property, 27 April 2012 (incorporating Change 2, 31 August 2018)

DoD Instruction 8320.07, Implementing the Sharing of Data, Information, and Information Technology (IT) Services in the Department of Defense, 3 August 2015 (incorporating Change 1, 5 December 2017)

DoD Instruction 8500.01, Cybersecurity, 14 March 2014, Change 1, 7 October 2019

DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Systems, 19 July 2022

DoD Instruction 8582.01, Security of Non-DoD Information Systems Processing Unclassified Nonpublic DoD Information, 9 December 2019

SECNAVINST 5510.36B, DoN Information Security Program, 12 July 2019

DoDM 8140.03, Cyberspace Workforce Qualification and Management Program, 15 February 2023

SECNAV Instruction 5211.5F, Department of the Navy Privacy Program, 20 May 2019

SECNAV Instruction 5239.3C, DON Cybersecurity Policy, 2 May

OPNAVINST 5239.1D, U.S. Navy Cybersecurity Program, 18 July

OPNAVINST 5239.4, Chief of Naval Operations Cybersecurity Safety Program, 14 September 2018

SECNAV Manual M-5239.2, DON Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual, 27 June 2016

SECNAV M-5239.3, Department of the Navy Cybersecurity Manual, April 2022

SECNAV Manual M-5510.30C, Department of the Navy Personnel Security Program, 24 January 2020

CJCSI 6211.02D, Defense Information Systems Network (DISN) Responsibilities, 24 January 2012

DoD Public Key Infrastructure (https://cyber.mil/pki-pke) ISO/IEC/IEEE 12207:2017 Systems and Software Engineering –

Software Life Cycle Processes ANSI/EIA 649C-2019 – Configuration Management Standard ANSI/EIA 836B-2015 – Configuration Management Data Exchange and Interoperability Federal Risk and Authorization Management Program

(“FedRAMP”) Department of Defense Cloud Computing Security Requirements

Guide, Version 1, Release 4, dated 14 January 2022 All applicable Security Requirements Guides, Security

Technical Implementation Guides, and National Security Agency security configuration guides when assessment and authorization is required

NIST SP 800-37 Revision 2, Risk Management Framework for Information Systems and Organizations, December 2018

U.S. Navy Risk Management Framework Process Guide, Version 3.3, 28 October 2021

NIST SP 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations, September 2020, includes updates as of 10 December 2020

NIST SP 800-53A Revision 5, Assessing Security and Privacy Controls in Information Systems and Organizations, January

NIST SP 800-171 Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, February 2020

NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information, June 2018

NAVSUPINST 5239.5, Cybersecurity and Defensive Cyberspace Operations Policy, 25 March 2019

ISO/IEC 19770-1:2017 – Information Technology – IT Asset Management – Part 1: IT Asset Management Systems - Requirements

ISO/IEC 19770-2:2015 - Information Technology -- Software Asset Management -- Part 2: Software Identification Tag

ISO/IEC 19770 Series - Information Technology – IT Asset Management

A Guide to the Project Management Body of Knowledge (PMBOK® Guide) - Seventh Edition

Section 508 of the Rehabilitation Act of 1973 (amended by the Workforce Investment Act of 1998, 7 August 1998)

SECNAVINST 5720.44C - DON Public Affairs Policy and Regulations, 21 February 2012, Change 2 10 April 2019 (specifically, Chapter 7: Public Communication on the Internet)

SECNAVINST 5510.30C, Department of Navy Personnel Security Program, 24 January 2020

Homeland Security Presidential Directive (HSPD)12, Policy for a Common Identification Standard for Federal Employees and Contractors, 27 August 2004

DoD Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP), 3 April 2017

DoD Manual 5200.08-R, Physical Security Program, 27 May 2009, 3 April 2017

DoD Instruction 5200.48, Controlled Unclassified Information (CUI), March 6, 2020

NSAMECHINST 5530.1C CH-1, Naval Support Activity Mechanicsburg Installation Access Control, 23 August 2019

DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting” from the memorandum Updated Implementation of “the DIB Memo” dated 06 Sep 2019

SECNAVINST 5200.43A, Government Furnished Property, Accountability and Management, 10 September 2021, Change 1 4 August 2022

5.0 Requirements/Tasks: The contractor shall be obligated

contractually to perform every requirement in this performance work statement. Not every performance requirement has a related standard expressed in this document. In such cases the performance standard is either inherent in the requirement or performance is to be in accordance with standard commercial practice.

Per DFARS 211.106, contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence.

5.1 Project Management Curriculum. The contractor shall be

responsible for providing course content. In the class students will learn the five phases of project management and the ten knowledge areas contained within the Project Management Institute’s (PMI) “A Guide to the Project Management Body of Knowledge” (PMBOK Guide) 7th edition. The course content must cover the following areas:

Leadership Project Communication Managing Projects Requirements Risks Scheduling Cost Management Contracts Quality

The program will be broken up into separate classes and run non-concurrently with no more than 8 courses held once monthly over a 12-month period.

The topics will focus on Agile Project Management more than Waterfall style, wherever possible.

Each individual course will be no longer than 3 days.

Courses must include group exercises and training materials that support learning through case studies.

Courses must be initiated with an assessment to determine the needs of the participants and include validation of understanding via quizzes or testing throughout and/or at the end of courses.

Courses will be led by an instructor on site, not virtual, but with the option to have attendees participate via Microsoft Teams.

It is intended that the program will be run within one year with the option to repeat the program over a second year if the government determines they have a need for additional training.

Performance Standard: Courses must be provided during the dates agreed upon and include group exercises, quizzes and/or tests. Certificates of completion for each course must be provided. If a student completes the entire curriculum, a Master’s Certificate in Project Management with a Concentration in IT Project Management must be provided.

Assessment Method: Technical Assistant (TA) will review training materials, student feedback and training certificate to determine if the vendor’s instruction was found to be acceptable.

5.2 Training Provider Requirements

The training provided must qualify students for PMI’s Professional Development Units (PDUs) and/or the training education provider must be a Project Management Institute (PMI) Authorized Training Partner.

Performance Standard: Provide documentation showing the education provider courses as broken out into the PMI Talent Triangle skill areas: Ways of Working, Power Skills, and Business Acumen have been accepted by PMI for PDUs or documentation showing the provider is a PMI Authorized Training Partner.

Assessment Method: Technical Assistant (TA) will review provided documentation to ensure the education provider has had the course accepted for PDUs by PMI and/or is a PMI Authorized Training Partner.

5.3 Instructor Requirements

The instructor must have a Master’s Degree and/or certification as a PMI Project Management Professional

(PMP).

Performance Standard: Provide proof of a Master’s Degree and/or PMI’s PMP certification.

Assessment Method: Technical Assistant (TA) will review provided info for accuracy.

6.0 Deliverables: All deliverables must meet the format

requirements specified by the Contracting Officer’s Representative. Documentation related to these services shall be made available electronically. The following list details the contract deliverables:

6.1 Status Reports. Status reports shall be sent

electronically to the Technical Assistant (TA) and Contracting Officer’s Representative (COR) within seven (7) days following the end of each training course documenting the performance on the task order.

The status report shall include the following elements:

o Trainer Name o Trainees Names o Training Dates o Description of skill/knowledge area o Test(s) and/or quizzes given to students

6.2 Class Materials. PMI’s PMBOK Guide V7 training

hardcopy training books and/or e-downloads should be provided to the students. Registration material and class information should be delivered to the training POC at least one week before the schedule start time of the classroom training.

6.3 Training Provider Requirements.

Provide proof that provider courses as broken out into the PMI Talent Triangle skill areas: Ways of Working, Power Skills, and Business Acumen have been accepted by PMI for PDUs or documentation showing the provider is a PMI Authorized Training Partner.

6.4 Instructor Requirements.

Provide proof of Master’s Degree and/or certification as a PMI Project Management Professional (PMP)

6.5 Cyberspace Workforce (CWF) DoDM 8140.03 requirements

are specified in 10.0

Unless stated otherwise, the following instructions apply to all deliverables:

o All versions of the deliverables required by the TO shall be delivered electronically to the COR and/or his/her designee and shall be subject to Government review and approval.

o Deliverable due dates shall take into account the review periods described below.

O Draft deliverables will be reviewed and feedback and/or requested changes provided within 7 business days (unless otherwise specified).

o Government reserves the right to request a formal review session with the contractor during these timeframes and may request that the contractor make changes to any version of a deliverable.

o Government will review and approve or reject all final versions of all deliverables within 7 business days of receipt (unless otherwise specified).

o If any deliverable is rejected, the contractor will be notified within the specified time periods and will have 7 calendar days within which to rework the deliverable and resubmit for Government approval. All changes to any version of a deliverable and/or deliverable outline shall be approved by the COR. If more than the specified number of calendar days is required for Government review and approval, the COR will inform the contractor of the need for an extension within the initial review period.

o Contractor shall prepare and submit the deliverables on or before the required due date to the COR or designee via email. For deliverables that are not documents the contractor shall submit a description of the deliverable and any associated documentation or descriptive information. In no case shall any deliverable be received by the Government less than 21 calendar days prior to the end of the Period of Performance.

o Rejection of any deliverable by the Government does not excuse the contractor from meeting the baseline due dates for any other deliverables.

7.0 Period of Performance:

Training shall be given in-person and on-site.

Base Period- 1 September 2024 through 31 August 2025 Option Period One- 1 September 2025 through 31

August 2026

NOTE: Within six months of a new PMBOK version being published, the new version shall be taught. Any fee for requested customization of course content shall be included in the cost of the course(s); it will not be paid separately.

8.0 Place of Performance:

The NAVSUP BSC, Mechanicsburg PA is the primary site for performance.

No contractor services shall be performed on Saturdays, Sundays, Government Holidays or during base closures. The contractor shall follow appropriate local base policy for reporting to work during severe weather and base closure. The contractor is not authorized to begin work until both the Visit Authorization Request (VAR) and System Authorization Access Request DD 2875 forms have been successfully processed and base and system access have been granted. Overseas Travel is not required.

9.0 Travel:

Contractor travel will not be separately reimbursed.

10.0 Security:

ON-BOARDING PROCESS

All contractor resource onboarding documents must be submitted via the prime contractor. An employee is considered to be “productive” upon completion of the following items:

a. OF-306 signed by contractor employee

b. FD-258 fingerprint card (Contingent upon availability of electronic fingerprinting submission)

c. Completed NBIS – SF 86 (Electronic Investigation) within 20 days after contract award

d. All contractor resource(s) must have an active Defense

Information System for Security (DISS) profile within 20 days after contract award

e. Common Access Card (CAC)(including CAC renewals)

f. System Authorization Access Request DD 2875

g. Cyber Awareness Training Certification

h. Information Assurance (IA) certification (if applicable)

i. User Access Request (UAR) Only applies when contractor requires access to ERP/SAP (Contractor does not require this access.)

j. TWMS profile for each contractor (IA/Security training compliance System of Record)

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services. Travel for onboarding and CAC appointments and renewals is not reimbursable.

Note (2): Dual Citizenship and Foreign Nationals are not allowed access to the functional/system side of ERP/SAP.

Contractor and subcontractor employees performing under this task order are required to sign a Non-disclosure Agreement (NDA) as part of their onboarding process. Refer to DFARS 252.204-7000, Disclosure of Information, and DFARS 252.204-7003, Control of Government Personnel Work Product.

See SUPTXT204-9400(4-22) Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information (DEC 2018)

This local text does not apply to non-U.S. Nationals (foreign nationals) who are contactor employees performing work overseas.

The local text is applicable to the United States Nationals living in the U.S. or overseas who are performing work on a Navy contract.

The investigation of a non-U.S. national at a foreign location must be consistent with a NACI, to the extent possible, and include a fingerprint check against the FBI criminal history database, an FBI investigations file (name check) search, and a name check against the terrorist screening database.

Also, the above cited reference notes that Foreign Nationals may not be granted CAC Credentials until completion of their investigation and not in the interim.

Per DoD 5200.2-R, DoD Components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location. The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S.

and its allies or agency agreements with the host country.

(1) SUPTXT204-9400(4-22) CONTRACTOR UNCLASSIFIED ACCESS TO

FEDERALLY CONTROLLED FACILITIES, SENSITIVE INFORMATION,

INFORMATION TECHNOLOGY SYSTEMS OR PROTECTED HEALTH INFORMATION

The security text does not apply in cases where the contractor/vendor does not have access to Navy Marine Corps Intranet (NMCI) computers, is not issued a Common Access Card (CAC) and is involved in training or other short-term duties of less than 30 days duration that allow for the use of a visitor request. In these cases, the government employee must submit a Visitor Access Request (VAR) to the main gate or applicable processing entity for your facility and assume responsibility to escort those without CAC Credentials.

This text does not apply to non-United States (U.S.) Nationals (foreign nationals) who are contactor employees performing work overseas. This text is applicable to the U.S. Nationals living in the U.S. or overseas who are performing work on a Navy contract.

The investigation of a non-U.S. national at a foreign location must be consistent with a National Agency Check with Written Inquiries (NACI), to the extent possible and include a fingerprint check against the Federal Bureau of Investigation (FBI) criminal history database, an FBI investigations file (name check) search and a name check against the terrorist screening database. Also, the above cited reference notes that Foreign Nationals may not be granted CAC credentials until completion of their investigation and not in the interim.

Per Department of Defense Memorandum (DoDM) 5200.2, Department of Defense (DoD) components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location.

The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S. and its allies or agency agreements with the host country.

CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED

FACILITIES, SENSITIVE INFORMATION, IT SYSTEMS OR PROTECTED

HEALTH INFORMATION

Executive Order 13467, Reforming Processes Related to Suitability for Government Employee, Fitness for Contractor Employees and Eligibility for Access to Classified National Security Information, Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 Part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense (OSD), the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy command under this contract is required to obtain a DoD CAC.

Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below. If at any time, any contractor employee requiring a CAC is unable to possess/maintain the required adjudicated background investigation, the contractor shall immediately notify the NAVSUP COR to coordinate removal of such a person from work under this contract.

ACCESS TO FEDERAL FACILITIES

Definition. As used in this clause - Military installation means a base, camp, post, station, yard, center, or other activity under the jurisdiction of the Secretary of a military department or, in the case of an activity in a foreign country, under the operational control of the Secretary of a military department or the Secretary of Defense (see 10 U.S.C. 2801(c)(4)).

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager (CSM) upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

Training. Contractor employees who require routine physical access to a Federally controlled facility or military installation shall complete “Level I Antiterrorism Awareness Training” prior to gaining access to a facility and annually thereafter in accordance with DoDI O-2000.16 Vol I. In accordance with Department of Defense Instruction O-2000.16 Volume 1, DoD Antiterrorism (AT) Program Implementation: DoD AT Standards, Level I Antiterrorism Awareness Training shall be completed by:

1. Completion of “Level I Antiterrorism Awareness Training” available at https://jkodirect.jten.mil/pdf/atl1/launch.html; or

2. Under the instruction of a qualified Level I Antiterrorism Awareness instructor; or

3. Providing a training certificate for “Level I Antiterrorism Awareness Training” training showing completion within the last calendar year in accordance with DoDI O-2000.16 Vol I.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the COR or to the contracting officer, if a COR is not assigned, prior to being granted access to a Federally controlled facility or military installation.

Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (d), in subcontracts, including subcontracts for commercial items, when subcontractor performance requires routine physical access to a Federally-controlled facility or military installation.

OPERATION SECURITY (OPSEC)

It is DoD policy according to DoD Directive 5205.02E, “DoD Operations Security (OPSEC) Program,” June 20, 2012, as amended to establish and maintain OPSEC programs to ensure national security-related missions and functions are protected.

Training: Contractor employees shall comply with all DoD OPSEC requirements and complete “OPSEC Awareness for Military Members, DoD Employees and Contractor” training within 30 days of onboarding the contract and annual refresher training thereafter. Training shall be completed through a DoD sponsored and certified computer or web-based learning instruction available at https://securityawareness.usalearning.gov/opsec/index.htm.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after training is completed by all employees and subcontractor personnel.

ACCESS TO DOD INFORMATION TECHNOLOGY (IT) SYSTEM

In Accordance With (IAW) DON CIO Memorandum (IT LEVEL

DESIGNATION ON DD FORM 2875 SYSTEM AUTHORIZATION ACCESS REQUEST)

08 September 2020, contractor employees who require access to Department of the Navy (DoN) or DoD networks are categorized as Privileged, Enhanced, or Authorized users. All user level accesses may include positions which require access to Controlled Unclassified Information (CUI). CUI includes sensitive information protected under the Privacy Act, to include PHI. System Levels are determined by the requiring activity's Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring Privileged access, (when specified by the terms of the contract) require a Tier 5 (T5) or T5R equivalent investigation, which is a higher-level investigation than the Tier 3 (T3) and T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance (IA) Technical Level 1, and must be trained and certified on the Operating System (OS) or Computing Environment (CE) they are required to maintain.

Contractors requiring Enhanced access, (when specified by the terms of the contract) require a T3, T3R, or equivalent investigation, which is a higher-level investigation than the Tier 1 (T1) described below. Due to the enhanced system access, an investigation suitable for Moderate Risk national security positions is required.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy CSM and ISSM/IAM manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request DD 2875 form is required for all individuals accessing Navy IT resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the DD 2875; therefore, the government employee with knowledge of the system/network access required or the Contracting Officers Representative (COR) shall sign the DD 2875 as the supervisor.

The DD 2875 shall be forwarded to the CSM upon the contractor employee acquiring a Common Access Card (CAC) credential.

Failure to obtain a CAC credential may result in delaying the individual's start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all contractor employees requiring access complete annual Cyber Awareness training, and maintain a current requisite background investigation. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

INTERIM ACCESS

The CSM may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

ACCESS TO CONTROLLED UNCLASSIFIED INFORMATION

Safeguarding sensitive unclassified information is critical to achieve NAVSUP Modernization efforts and deliver cutting-edge and uncompromised capabilities. The Secretary of Defense’s operations security (OPSEC) campaign plan stresses the importance of protecting controlled unclassified information (CUI). CUI encompasses OPSEC, critical technology, intelligence, and personally identifiable information that, if not properly identified, marked, and controlled, could impair NAVSUP’s ability to conduct its mission. Contractor employees with access to Controlled Unclassified Information (CUI) shall comply with DoDI 5200.48 - Controlled Unclassified Information (CUI) and complete DoD approved initial and annual refresher CUI training.

a. Whenever Government provides CUI to, or CUI is generated by, non-DoD entities, all CUI records must be handled as required by the approved mandatory disposition authority.

b. All CUI records must follow the approved mandatory disposition authority whenever the Government provides CUI to, or CUI is generated by, non-DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and the DoDI 5200.48.

c. Contractor employees shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

d. Contractor employees shall submit unclassified government information for review and approval for release in accordance with the Standard DoD Component Processes, DoDI 5230.09, and DoDM 5205.07, Volume 1

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the contractor's security representative. Within three (3) work days after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the contractor's security representative. The contractor's security representative shall be the primary point of contact on any security matter. The contractor's security representative shall not be replaced or removed without prior notice to the Contracting Officer and CSM.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL

PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS

OR PERFORMING SENSITIVE DUTIES

At minimum, all contractor employees must possess/maintain the required background investigation as determined by the PDT and/or IT access user level. This requirement is critical in order to access the government data base systems It is the contractor’s responsibility to ensure that 100% of the contractor employees have the ability to acquire a favorably adjudicated background investigation.

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are at a minimum are recognized as Non-Critical Sensitive positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. If the IT system user level is determined to be Enhanced, at a minimum, each contractor employee must be a US citizen and have a favorably completed T3, T3R, or equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or Enhanced position. The investigation consists of a standard National Agency Check and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or Enhanced position is required to complete:

• SF-86 Questionnaire for National Security Positions (or equivalent Office of Personnel Management (OPM) investigative product)

• Two FD-258 Applicant Fingerprint Cards or electronic fingerprint submission (preferred)

• Original Signed Release Statements

Failure to provide the required documentation at least thirty

(30) days prior to the individual's start date shall result in delaying the individual's start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than five (5) years) throughout the contract performance period. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements, all contractor employees shall in-process with the CSM upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy command's ISSM/IAM. Completion and approval of a DD 2875 form is required for all individuals accessing Navy IT resources. The DD 2875 shall be forwarded to the CSM upon the contractor employee acquiring a Common Access Card (CAC) credential. Failure to obtain a CAC credential or provide the required documentation shall result in delaying the individual's start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Cyber Awareness training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the CSM.

The CSM will review the submitted documentation for completeness prior to submitting it to the OPM; Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The CSM will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DCSA Consolidated Adjudication Services (CAS) for a determination.

For classified contracts, if the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Access Request via the Defense Information Security System (DISS). If the contractor employee does not have a current favorably adjudicated investigation, the contractor shall wait to submit the Visit Access Request in DISS until the contractor employee has at a minimum an interim clearance. If the contract only requires access to unclassified information, even if the contractor takes a DISS “owning” role over the contractor employee, the Navy command will also take a DISS “owning” role over the contractor employee during the hiring process and for the duration of assignment under that contract. If the contract requires access to classified information, the contractor’s Facility Security Office (FSO) will take a DISS “ownership” role and the Navy command will take a DISS “servicing” role during the hiring process and the duration of assignment under that contract. All Visit Access Requests requires annual renewal for the duration of the employee's performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL

PROCESS FOR CONTRACTORS ASSIGNED TO OR PERFORMING NON-SENSITIVE

DUTIES

Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc...) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

• Must be either a U.S. citizen or a U.S. permanent resident with a minimum of 3 years of legal residency in the U.S. (as required by the Deputy Secretary of Defense DTM 08-006 or its subsequent DoD Instruction (INST)) and

• Must have a favorably completed T1 investigation or equivalent including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the CSR must submit for all employees each of the following:

• SF-85 Questionnaire for Non-Sensitive Positions

• Two FD-258 Applicant Fingerprint Cards (or the preferred method - electronic fingerprint submission)

• Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably T1 or equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM.

Failure to provide the required documentation at least thirty

(30) days prior to the individual's start date may result in delaying the individual's start date.

* Consult with your CSM and ISSM/IAM for local policy when IT- III (non-sensitive) access is required for non-U.S. citizens outside the U.S.*

DoDM 8140.03 Cyberspace Workforce Qualification and Management Program.

The contractor shall have Cyberspace Workforce (CWF) Program certificates for Cybersecurity positions. See the Information Assurance Support Environment (IASE) website for DoD Approved

8140.03 Baseline Certifications: https://cyber.mil/cw/cwmp/dod-approved-8570-baseline-certifications/

Contractor Role/Job Title/Labor Category (specify/list all LCATs that apply – you may need to include multiple sections like this for all LCATs if they require different IA Certifications):

__X___- No Additional IA Certification Required ____- Information Assurance DoDM 8140.03 Required IA Certification Level: _____________ Baseline Certification: _____________ Substitutes for Baseline Certification: ____________ Computing Environment Certification: ________________ Privileged system access is/is not required for these LCAT(s).

Contractor Role/Job Title/Labor Category (specify/list all LCATs that apply):

__X__- No Additional IA Certification Required _____- Information Assurance DoDM 8140.03 Required

If the individual contractor is required to have privileged access to a Government system, then a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation is required instead of the NACLC referenced above. A DD254 Contract Security Classification is not required.

Privileged Access. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1. They must also be trained and certified on the Operating System or Computing Environment they are required to maintain. They must have IT-I security designation. A person with privileged access must have a T5 or equivalent investigation initiated with favorable fingerprint results.

The COR will ensure that contractor personnel accessing DoD information systems have the appropriate and current information assurance baseline certification to perform information assurance functions in accordance with DoDM 8140.03, Cyberspace Workforce Qualification and Management Program. Prior to being engaged and upon request by the Government, the Contractor shall provide documentation supporting the information assurance baseline certification status of personnel performing information assurance functions to the contracting officer. Contractor personnel who do not provide appropriate and current baseline certifications shall be deemed unauthorized to access DoD information systems.

The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoDM 8140.03 Cyberspace Workforce Qualification and Management Program. The Contractor shall meet the applicable information assurance certification requirements, including-

(1) DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoDM 8140.03.

(2) Appropriate operating system certification for information assurance technical positions as required by DoDM 8140.03.

(a) Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

(b) Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

Proof of the above indicated IA baseline certification is to be provided for all contractor personnel prior to time of engagement. In addition to the IA certificate, active enrollment and participation in the certification maintenance program must be established prior to contract award to ensure the appropriate access can be secured by contractor resources.

All required IA baseline certifications must be current at the contract period start date; there is no “grace” period to obtain these certifications. The required IA baseline certifications must be provided to the Technical Assistant (TA) and Contracting Officer’s Representative (COR). The Computing environment certification must be current no later than six (6) months after start. The required Computing Environment certification must be provided to the Technical Assistant (TA) and Contracting Officer’s Representative (COR) upon completion. Questions and additional information requirements may be addressed by contacting the NAVSUP Business Systems Center Cyberspace Workforce (CWF) Program Manager.

Certification shall be forwarded to:

Greg Anderson, Code 9412 NAVSUP Business Systems Center 5450 Carlisle Pike Suite 409 Mechanicsburg, PA 17050 Email: gregory.s.anderson10.civ@us.navy.mil

Language used to supplement DFARS Clause 252.204-7012 entitled, “Safeguarding Covered Defense Information and Cyber Incident Reporting” from the memorandum Updated Implementation of “the DIB Memo” dated 06 Sep 2019:

1. System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews

a) Within thirty (30) days of contract award, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for…