DRAFT PWS Cardstock Warehousing and Logistical Support.pdf

Performance Work Statement (PWS) Defense Manpower Data Center (DMDC)

Cardstock Warehousing and Logistical Support

The Defense Manpower Data Center (DMDC) requires cardstock and consumables logistical support to maintain the Department of Defense (DoD) Identity Credential Management program.

2.0 BACKGROUND

DMDC is the component organization within the DoD to implement smartcard technology and the DoD’s Department-wide credentialing program as directed by the Deputy Secretary of Defense. Since the initial Common Access Card (CAC) implementation, the Department has expanded the CAC program to select Federally-affiliated organizations. In addition to CAC production, the DMDC’s program implementation requires logistical support to include: The Uniformed Services Identification (USID), the Alternate Token (Alt Token), the warehousing and card and consumables distribution, and the card return processing.

The DoD Identity Credential solution is accepted by more than 20 DoD and non-DoD agencies in compliance with HSPD-12 with approximately 11 million cards currently in circulation with an additional average of 350,000 cards issued monthly. DMDC is required to ensure that cardstock is available and distributed to approximately 1,900 Real-time Automated Personnel Identification System (RAPIDS) sites worldwide. DMDC also centrally manages cardstock for all non-CAC populations such as military retirees, family members, inactive reserve members and others which qualify for the credential. These are referred to as Uniformed Services Identification (USID) cards. DMDC anticipates minimal shipping support of the Alternate Tokens with an estimate of less than 50K annually. The collective requirement for CACs, USIDs, and Alt Tokens is referred in this document as the “cardstock program.”

3.0 SCOPE

The scope of this acquisition is to provide cardstock warehousing and logistical support for the cardstock program to effectively and efficiently maintain the DoD cardstock solution for DoD and other Federal agencies. Attachment A lists the dimensions of the items for the scope of the requirement. The scope includes supporting the program by warehousing, distributing, shipping, processing, and storing associated cardstock and consumable products:

Cardstock - (CAC/Alt Token/USID)

Sleeves - (CAC only)

Consumables - (CAC and USID)

INTRODUCTION1.0

1 Ver: Nov 2023

4.0 REQUIREMENTS The Contractor shall:

Shipping Cardstock and Consumables and Warehousing The Contractor shall ship emergency shipments of cardstock to RAPIDS sites as directed by the government. The Contractor shall notify the government of any unforeseen surge in emergency requests. Cardstock releases in support of DMDC’s cardstock program are routinely processed directly by the card manufacturers from their vaults under separate contracts. For emergency shipments, the Contractor shall manage inventory cardstock by card type, card vendor, and stack identification (ID) number via the Inventory Logistics System (ILS) used to track cardstock and consumables for inventory and shipments. Cardstock is packaged in “stacks” of 100 cards each. A CAC is required to access the Inventory Logistics System (ILS). Contractors that require access to the Inventory Logistic Portal (ILP) must be eligible to obtain a CAC. ILS includes the database, background services and ancillary infrastructure used to store data process input via ILP. The ILP is the user interface (determined by role) to input data and process transactions. The government will furnish the Contractor with CAC and USID card readers to use with their own (contractor) computers to enter the information into the ILP.

The Government will provide the consumable printer supplies and sleeves used in card production to the Contractor. Examples of printer consumables include color ribbons, front and back laminates, retransfer film, test cardstock, and cleaning kits.

The Contractor shall maintain an adequate supply of consumables and cardstock to support the daily shipping requirements. The Contractor shall notify the Government with a 30-day advance notice for the replenishment of supplies to ensure timely delivery.

The Contractor shall utilize the First In, First Out (FIFO) distribution method to avoid shelf-life expiration unless otherwise requested by the Government. For planning purposes, the consumables and cardstock materials require well-ventilated storage areas to comply with Occupational Safety and Health Administration (OSHA) standards. The Contractor shall reimburse the government for any cardstock and consumables that are damaged or expired as a result of non-compliance with DMDC FIFO requirements or mismanagement. A coordinated Government and warehouse wall to wall inventory and assessment of cardstock and consumables is required upon Government request.

WAREHOUSE - The Contractor shall provide a storage facility that is ISO 9001-2015 certified. The storage facility should be able to hold approximately 400K unissued cardstock, approximately 200k returned cardstock, approximately 170k returned cardstock palletized for destruction, approximately 5k failed cardstock, 24 pallets of consumables. There is no U.S. continental geographical restriction to warehouse location.

1.

2.

3.

4.

2 Ver: Nov 2023

The Contractor shall provide distribution and warehousing for consumables. All supply orders are automated and generated by the ILS and/or from the RAPIDS sites to the Contractor. Requests for re-supply are received via standard mail, e-mail, FAX and regular automated reorders generated via the ILS. All emergency shipments of orders shall be processed and ready (for commercial pick-up) the same business day of receipt of order, unless it is received too late in the day to process for same day shipping, then it will be processed the next day. The Contractor shall process emergency shipment orders the same day as requested by the government. The Contractor shall keep a register of all boxes shipped via commercial carrier using the Monthly Government Shipping + Return Account Usage Report, Attachment D. All routine shipments of orders shall be processed and ready (for commercial pick-up) within two (2) business days of receipt of order.

For any consumables that are returned to the Contractor in error, the Contractor shall notify the government within 24 hours as to what was returned, how many, used or unused.

For the unused consumables, they will be put into inventory for reuse for new shipments. The used transfer film and ribbon consumables will be kept at the Contractor’s location until the end of the performance period for shredding. The Contractor shall provide the government with the following information to provide the shredding service: number of boxes of used consumables, dimensions of the boxes, and approximate weight. The government will provide the shredding service.

The Contractor shall provide a Daily Cardstock and Consumable Order Report, Attachment R to DMDC upon request to facilitate the required approvals including the current inventory on-hand at the support center of individual cards/tokens brands and types. The Daily Cardstock and Consumable Order Report captures all orders emailed/faxed to the support center/DMDC.

The government provides the Contractor with directions for shipment releases. The Contractor shall then package the individual site's re-supply of cardstock and/or consumables for shipment and capture the associated shipment tracking data listed below. The Contractor shall link the appropriate cardstock and/or consumables in the ILP within 24 hours after the shipments have been made. For reporting requirements, the inventory released and shipment tracking data is entered into Attachment C - Cardstock and Consumables Shipping Report for the respective sites that will receive the shipments. On a monthly basis, the Contractor shall submit the DMDC Cardstock and Consumable Shipping Report, Attachment C. This reports the cumulative of all orders to include auto-generated and emergency manual orders.

The Contractor shall ship cardstock and consumables using a reimbursable shipping account reference in section 4.2. The Contractor shall provide all packaging and shipping materials however, the Contractor shall use commercial shipping suppliers free packaging materials to the extent possible. The Contractor shall order shipping supplies from the shipping suppliers' website as necessary to support the daily shipments. The Contractor is responsible for keeping a record of all tracking numbers, site name, RAPIDS Site ID, carrier, shipment date, exact shipment contents, shipment weight and costs for all outgoing cardstock and consumables. The Contactor shall comply with all local customs requirements, particularly for shipment outside the contiguous United States (OCONUS), for shipping of cardstock, tokens

3 Ver: Nov 2023 and consumables. The Contractor shall provide the cumulative shipping data for the fiscal year electronically on a weekly basis. The Contractor shall use the weekly information to create the monthly deliverable government Monthly Government Shipping Account Usage Report, Attachment D. The Contractor shall ship cardstock orders and the required consumables at the same time per government’s instructions. The Contractor shall review all shipments through the ILP. The Contractor shall deliver the report: Cardstock and Consumable Inventory, Attachment B for the weekly report of the current inventory on hand and the weekly shipments of cardstock and consumables.

SHIPPING SOLUTION - The Contractor shall utilize a single, centralized electronic shipping solution to coordinate and account for all shipping activities. All shipments related to cardstock and consumables will be tracked. The solution must include the following requirements:

The shipping solution shall create shipments and necessary documentation, get quotes, generate shipping labels, generate packing slips, provide proof of delivery, signature information and scan details from carriers, schedule pick-ups, export and import shipment data, track and monitor shipments, manage shipments, manage contacts and address books, create reports and provide administrative controls and account security.

Access should extend to many authorized personnel. Authorized personnel may include RAPIDS/DEERS site personnel, cardstock manufacturing facilities, DSC Warehouse personnel, and other authorized DMDC personnel. Account profiles will be tailored to the needs of the authorized personnel and must be approved by DMDC.

Reporting must include billing, shipment and delivery information. This information includes but is not limited to:

Description of exact shipment contents, originating site information, destination information, size and weight of shipment, estimated delivery date, actual date delivered, carrier, shipment cost, tracking numbers, shipment labels generated but not mailed, site ID, DEERS site ID, shipment date, any additional fees.

The shipping solution should allow for individual shipment feedback to allow recipient to provide information such as condition of package, if the shipment was packed in accordance with requirements, if there were any significant delays, etc.

Contractor shall provide trend analysis data quarterly.

DMDC shall approve the recommended shipping solution prior to implementation

Shipping CLIN (Cost Reimbursable):

The Contractor shall be responsible for shipping all cardstock and consumables. The following are the types of shipments that are expected under this CLIN:

4 Ver: Nov 2023

Cards and PIN shipments from the Central Issuance Facility (CIF) are shipped from DMDC locations. Shipments are daily and consist of envelopes and boxes.

Cardstock and consumable shipments from the DSC warehouse to RAPIDS sites

Cardstock returned from RAPIDS sites to DSC warehouse

Cardstock shipped from cardstock manufacturers to RAPIDS sites, warehouse and DMDC

Returned cardstock shipped from the DSC warehouse to NSA/CMC

Adhoc shipments which may be shipped to/from areas not covered in the above.

Annual shipment quantities are estimated at the following:

7500 cardstock and consumable shipments are anticipated annually from warehouse.

Attachment C is provided to show a year of historical data to provide information as to prior frequencies and size of shipments for both cardstock and consumables shipments. This attachment is provided for statistical analysis to show past frequencies and size of shipments.

4460 return card shipments are anticipated annually from RAPIDS sites

CIF annual shipments are approximately 1050 envelopes and 2450 boxes

60 cardstock manufacturers' shipments are anticipated annually from the manufacturer to the warehouse

5400 cardstock manufacturers’ shipments are anticipated annually from the manufacturer to the RAPIDS sites

Returned cards to NSA/CMC are shipped every month

Priority Mail Large Flat Rate Box with no weight limit addressed to APO/FPO destination is estimated at 75 packages.

Priority Mail Medium Flat Rate Box with no weight limit addressed to APO/FPO destination is estimated at 75 packages.

Adhoc shipments of cardstock or consumables. Estimate is under 50 shipments annually

The Contractor shall obtain the necessary account from the Next Generation Delivery Service (NGDS) to utilize the TRANSCOM Blanket Purchase Agreement (BPA). The NGDS contract provides express small package delivery services for international packages and United States domestic express and ground small package delivery services. The Contractor shall follow the guidelines provided in the GHS Shipper’s Guide located at: https://ww2.ustranscom.mil/commair/ngds.cfm.

The Contractor will obtain necessary account from the Global Heavyweight Service (GHS) 5 Ver: Nov 2023 to utilize the TRANSCOM BPA. The GHS contract provides for freight shipping over 150 lbs. The Contractor shall follow the guidelines provided in the GHS Shipper’s Guide located at: https://ww2.ustranscom.mil/commair/ghs.cfm.

The Contractor shall provide shipping to Army Post Office (APO) and Fleet Post Office (FPO) sites utilizing the United States Postal Service (USPS)

USPS shipments are used to accommodate OCONUS shipping to APO/FPO address.

Shipments are sent using large and medium flat rate boxes. Customs form documentation is required.

APO/FPO shipping is considered domestic shipping in relation to USPS costs. No international shipping is permitted.

For any undeliverable shipments, the contractor shall contact the Government for further instructions. This may result in changes to the address and reshipping.

Lost or damaged shipment

Work with shipping contractor for damage to or loss of cargo occurring from and after the time it takes possession until delivered to the consignee.

Claims must be filed by the shipper within 30 calendar days after delivery, planned delivery, or from the time the carrier declares the package/shipment is lost

The Government will be informed of any lost or damaged shipment

Returned Cardstock and Consumables and Warehousing World-wide RAPIDS sites are instructed to return all cardstock that are used, expired, replaced or encountered production issues to the Contractor’s location IAW the RAPIDS user’s guide. Average cardstock return rate is approximately 170,000 each month.

For all returned cardstock, the Contractor shall:

Track shipping tracking numbers, Site name, Site ID, Shipment Date, Carrier Type, Receipt Date, Card Type and Quantity received (Attachment D - Monthly Government Shipping+Return Account Usage Report)

This information shall be provided in the electronic Monthly Government Shipping Account and Usage Report, Attachment D. The Contractor shall report any sites that are non-compliant with the required packaging to the COR immediately.

Inspect all returned cardstock boxes to determine whether they were double-packaged when mailed to DMDC, as required by the Privacy Act of 1974. The Contractor shall notify the COR of any non-compliance with this requirement within 48 hours.

6 Ver: Nov 2023

Sort all returned cardstock based on failure reason/code. Occasionally cardstock is returned with no failure codes attached, which will be marked was “U1” unknown.

Using a government furnished reader, the Contractor shall scan all returned cards (hand-entering when damage prevents scanning) to record the Card Unique Identifier/Card Identification Number (CUID/CIN) number and the error code from the sorted cardstock. The generated files from scanning and error codes are consolidated and sent to DMDC at the end of each month.

Track and report the number of returned cards received and the number of returned card processed each month.

The monthly consolidated cardstock return process report, Attachment D - Monthly Government Shipping+Return Account Usage Report, is used to update the ILS to account for all returned cardstock and to ensure the cards are terminated in ILP to remove them from the RAPIDS site inventory. All cardstock delivered to the warehouse must be processed within 30 days to ensure ILS/ILP records are at most 30 days out of date.

The scanned files are used to update the ILS to account for all returned cardstock and to ensure the cards are terminated in ILP to remove them from the RAPIDS site inventory. All cardstock delivered to the warehouse must be processed within 30 days to ensure ILS/ILP records are at most 30 days out of date.

The Contractor shall perform all requirements under Section 4.3 within 30 days of receipt of the returned cardstock to the Contractor.

Returned Cardstock Shipping for Destruction and Analysis The Contractor shall follow the provided procedures to return cards for proper destruction as required to adequately support the cardstock program and use the shipping return process outlined in– Cardstock Return Card Overview, Attachment F. Deviating from NSA instructions poses great risk of continued use of NSA’s cardstock destruction support. The Contractor shall ensure the first package includes a large envelope or box with a Privacy Act Data Cover Sheet, which identifies the cardstock as containing Personally Identifiable Information (PII) data. The second outer package shall be a box from a third-party courier or from the Contractor’s site that has the words “For Official Government Use Only” stated on it. The first package shall be inserted into the second outer package for return shipment using the Federal Express account provided by DMDC. Shipments to NSA are every month. However, certain error code cards will require a monthly shipment to the third-party vendor for further analysis per the government’s instructions.

The government will provide instructions for shipments to the Contractor upon award. The Contractor shall send the shipments to a designated third party for analysis or destruction. The Contractor shall ensure all required documents are included with shipping. All shipments must include a DD Form 2923, Privacy Act Data Cover Sheet. Third party documentation requirements for shipping may vary. The Government will provide complete instructions/guidance. An example of a current

7 Ver: Nov 2023 requirement is that a document listing the contents must be included for each shipment of cards sent for destruction/analysis. In another example, the documentation requires the inclusion of a self-addressed envelope for validation of receipt. The Contactor shall print the Privacy Act Data Cover Sheet in color.

The Contractor shall inspect the outer box to ensure that it is in good condition and can be properly sealed and ensure that the box for shipping can withstand the weight of the cardstock and will not break when in transit. If a box breaks or opens in transit, Privacy Act data contained on the returned ID cards is at risk of being exposed. The Contractor shall follow the instructions in the DMDC and NSA Return Card Overview, Attachment F, for shipping the returned cards that have been processed to NSA for final destruction. The Contractor shall also follow the CMC Required Procedures, Attachment G when processing each shipment of the returned cards to NSA. The Contractor shall verify and complete the CMC Receipt for Destruction of Classified Materials, Attachment H from the NSA Website https://www.nsa.gov/Portals/70/documents/news-features/initiatives/classified-materiel-conversion/cmc_receipt.pdf?ver=2018-08-07-110456-643 to ensure it is still a valid form, then complete the form for each shipment to NSA. The Contractor shall complete the Contractor Approval Form for the Destruction of Classified Material at NSA/CMC facility, Attachment I annually and forward to the COR for review and signature then submit to NSA after it has been signed by the COR. CAC Return Instructions – Informational, Attachment E explains how RAPIDS sites return the cardstock to the Contractor/DMDC.

Senior Management Review Report (SMR).

The Contractor shall provide a Senior Management Review (SMR) Report monthly. See

SMR template, Attachment J for required content and format. The Contractor shall meet and participate in a monthly SMR and will change to quarterly when requested by the government. There will be no travel required. The purpose of the SMR is to provide a monthly program review including any issues requiring government escalation.

Reports These are working documents that the Government and the contractor can coordinate to update during the life of the contract.

Transition In A smooth transition between the incumbent Cardstock and Consumables Support Center

Contractor and the successor Contractor is necessary to ensure there is no disruption to vital Government business. The Contractor shall cooperate fully in the transition.

There will be a thirty (30) day transition period for a new contractor.

During this 30-day period, the Contractor shall be responsible for:

Attending the kick-off meeting with Government POCs

Ordering shipping supplies from FedEx

8 Ver: Nov 2023 https://www.nsa.gov/Portals/70/documents/news-features/initiatives/classified-materiel-conversion/cmc_receipt.pdf?ver=2018-08-07-110456-643 https://www.nsa.gov/Portals/70/documents/news-features/initiatives/classified-materiel-conversion/cmc_receipt.pdf?ver=2018-08-07-110456-643

Obtaining necessary CAC cards for employees

Communication with NSA to obtain contract information to prepare shipments of returned cards for final disposition

Preparing warehouse space with inventory received from the Government

Preparing contractor forms for DMDC to review and sign for NSA returns

Conduct services required to connect to the Government network with the Contractor’s computer/s

Receive consumables/inventory from the Government

Conduct inventory of all Government furnished equipment, supplies and consumables

The government will be responsible for transferring all inventory, and card readers, and supplying any inventory of packaging supplies to the Contractor during this transition period. The government will provide the Contractor with the FedEx information so that the Contractor can obtain necessary supplies from FedEx. A joint inventory will be agreed upon between the Contractor and the government. The COR shall coordinate all transition activities. The COR is responsible for providing information needed by the Contractor to have a successful transition.

Transition Out The Contractor shall submit a transition plan within 60 days prior to the end of the final performance period, addressing the following, at a minimum:

Transition of the DMDC initiatives to ensure a smooth transition from performance

Proposed sequence of transition tasks, which should be accomplished to progress from the start of the transition to the successor Contractor’s control of tasks, as specified in the PWS

Maintain DMDC’s schedule, specifically in the transition of existing, on-going efforts and working concurrently with the successor Contractor on existing efforts

Follow the proposed process for the GFE/GFP/GFI transfers to the government

Identification of associated risks and issues

Identify risks and road blocks

Propose risk mitigation strategies to address any issues

Provide additional resources, if any, required for the transition

Plan how the transition will be implemented and managed

9 Ver: Nov 2023

Participate in transition planning for order close-out.

DMDC will coordinate with the Contractor to conduct a joint inventory

4.9 Participate in a Post-Award Conference

This meeting shall provide an introduction between the Contractor personnel and Government personnel who will be involved with the contract. The meeting shall provide the opportunity to discuss technical, management and security issues. The Post Award Conference will aid both the Government and Contractor in achieving a clear and mutual understanding of all requirements, and identify and resolve any potential issues. The Contractor shall be prepared to discuss any items requiring clarification and gather information as necessary to support each deliverable.

The Contractor shall provide deliverable(s) in a format mutually agreed upon by the Government and the Contractor. All deliverables will be reviewed for timeliness, accuracy and format. If a deliverable due date falls on a weekend or holiday, the Contractor shall submit the deliverable on the last work day prior to the due date. In fulfillment of this effort, the Contractor shall provide the following deliverables to the COR.

Deliverable PWS Reference Due Date Cardstock and Consumable Shipment Ready for Pick-Up

Within 2 business days of receipt of order

Cardstock and Consumable Inventory Report

Within 5 business days following the previous month

Cardstock and Consumables Shipping Report

Within 5 business days following the previous month

Government Shipping+Return Account Usage Report

Within 5 business days following the previous month

Cardstock and Consumables Order Report

Within 5 business days following the previous month

Senior Management Review

(SMR)

Within 5 business days following the previous month

SMR Minutes Within 5 business days following the SMR meeting

Quality Control Plan Within 30 days after award

5.1 The contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via the System for Award Management (SAM) (https://sam.gov) in accordance with DFARS 252.204-7023.

6.0 CONTRACTOR TRAVEL

DELIVERABLES5.0

10 Ver: Nov 2023 https://sam.gov/

Travel is not anticipated for this requirement. Should travel become necessary, a proposal will be requested and the contract modified to reflect travel.

7.0 RECORDS MANAGEMENT

7.1 Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

7.2 In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

7.3 In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law.

Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

7.4 Defense Human Resources Activity and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of Defense Human Resources Activity or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Contracting Officer’s Representative (COR). Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to the COR and the Defense Human Resources Activity Component Records Management Officer at dodhra.mc-alex.dhra-hq.mbx.records@mail.mil so DHRA may report promptly to NARA in accordance with 36 CFR 1230.

7.5 The Contractor shall immediately notify the COR upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment.

Disclosure of non-public information is limited to authorized personnel with a need-to-know in accordance with all applicable privacy, security, and information protection policies. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the COR.

11 Ver: Nov 2023 mailto:dodhra.mc-alex.dhra-hq.mbx.records@mail.mil mailto:dodhra.mc-alex.dhra-hq.mbx.records@mail.mil

When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to DHRA control or the Contractor must hold it until otherwise directed.

Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the COR. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (7.4).

7.6 The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts.

The Contractor (and any sub-contractor) is required to abide by Government and Defense Human Resources Activity guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7.7 The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with Defense Human Resources Activity policy.

7.8 The Contractor shall not create or maintain any records containing any non-public Defense Human Resources Activity information that are not specifically tied to or authorized by the contract.

7.9 The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

7.10 The Defense Human Resources Activity owns the rights to all data and records produced as part of this contract. The contractor shall not include any contractor markings on deliverables created under the contract. All deliverables under the contract are the property of the U.S.

Government for which Defense Human Resources Activity shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

The contractor shall not use or disclose any data or deliverables under this contract for any purposes other than performing the contract, unless expressly approved by the Government.

8.0 SECURITY

8.1 Personnel Security. Overarching security requirements are UNCLASSIFIED. Contractor and subcontractor personnel require unclassified access to DoD network(s), Information Technology (IT) systems, and Government Furnished Equipment (GFE). Contractor and subcontractor personnel must obtain DoD credentials (also known as the Common Access Card (CAC)) for physical and logical access to federally controlled facilities and DoD Information Systems (IS) containing Personally Identifiable Information (PII) or Controlled Unclassified Information (CUI).

8.1.1 All Contractor personnel assigned to this contract are required to obtain and maintain the appropriate background investigation (BI) and adjudication or suitability determination in accordance with DODI 5200.02-DoD Personnel Security Program (PSP).

8.1.2 The contractor/subcontractor personnel on this contract will be designated performing in

12 Ver: Nov 2023

Non-Sensitive positions for Unclassified access in accordance with Defense Counterintelligence and Security Agency (DCSA) and the Office of Personnel Management (OPM) investigative alignment, and DoDI 5200.02, DoDM 5200.02 and 32 C.F.R. Part 117.

8.1.3 No employee may perform under this contract or have access to information or systems under this contract until they have completed a Tier 1 (T1) or higher background investigation (BI) that meets the requirement or be in the process of a Personnel Security Investigation (PSI) with a minimum of interim eligibility.

8.3 Staffing. The personnel supporting this contract who require a DHRA sponsored CAC, access to DoD network(s), DoD information systems with CUI/PII data, or DoD IT/Information Systems must be Citizens of the United States. The citizenship requirement also applies to personnel assigned or working on the contract at any remote sites.

8.4 Onboarding. Prior to requesting access to DHRA sponsored resources (e.g., DoD credential(s), Network(s), IT systems, Information Systems (IS) or facility), the contractor must provide an official request via DHRA’s onboarding system(s)/encrypted email/DoD SAFE accompanied by a complete Defense Logistics Agency Headquarters (DLAH) Form 1728 - Request for HQC Contractor Badge and/or Information Technology (IT) Access. The DHRA Security and the Defense Logistics Agency (DLA) Personnel Security (PERSEC) will validate the contractor meet the requirement.

8.5 Listing of Employees & Clearance Documentation. The Contractor shall maintain a current listing of employees. Within 10 calendar days of contract award, the Contractor shall provide the COR a list of all company employees assigned to this effort. The employee list should include the following information: Contract number, employee information (full legal names), DHRA center/office, location of performance, clearance level needed (Position of Trust for unclassified access), IT access level needed (other). The list shall be validated by the company and DHRA Personnel Security (PERSEC). The Contractor shall provide the COR with an updated listing when any employee’s status or information changes.

8.6 Access to Sensitive Information. To the extent that the work under this contract requires the Contractor to have access to DoD sensitive information the Contractor shall after receipt thereof, treat such information as confidential and safeguard such information from unauthorized use and disclosure. The Contractor shall not appropriate such information for its own use or disclose such information to third parties unless specifically authorized by the Government in writing.

8.6.1 The Contractor shall allow access only to those employees who need the sensitive information to perform services under this contract and who have acknowledge that sensitive information shall be used solely for the purpose of performing services under this contract. The Contractor shall prevent its employees from discussing, divulging, or disclosing any such information to any person or entity except those persons within the Contractor’s organization directly performing the contract.

13 Ver: Nov 2023

8.7 Information Technology (IT) Level Investigation Requirements. The contractor/subcontractor personnel supporting this contract will require Other (Low) access to DHRA IT & Information.

8.7.1 Contractor personnel, who perform work on sensitive networks, IT systems or applications, must possess and maintain the appropriate investigation and adjudication determination. The Contractor shall assure that individuals assigned to the contract undergo the respective BI and have obtained the proper eligibility, based on job function or tasks performed, before performing any work or accessing any systems or information under the contract.

8.7.2 IT-Level position category designation does not imply or convey authorization to access classified information.

8.7.3 The IT Level will determine the access level needed to perform work on the DoD IT Systems/Networks. The IT access level is designated based on the IT system/network requirements according to the DoD Cyber, Security Technical Implementation Guides (STIGs) https://public.cyber.mil/stigs/.

8.7.4 It is the responsibility of the contractor to ensure the employees meet the appropriate Tier investigation prior to requesting IT access.

8.7.5 Other – Low Risk: All other non-sensitive determined low-risk positions involved in computer activities. Positions designated by the Agency head that involve a degree of access to a system that creates minimum to low damage less than that in Authorize positions. Other, designations require at least a favorable Tier 1 (T1), or higher BI.

8.8 Personal Identifiable Information (PII) and Tier Investigations. All personnel supporting this contract must protect PII data according to the Privacy Act of 1974. Personnel requiring access to Information Technology (IT) or access to DoD Information Systems that contain military active duty, guard, or reservists’ PII or information pertaining to Service members that are otherwise protected from disclosure where such access has the potential to cause serious damage to national security, must be vetted accordingly and protect the data. BI levels required for each job function or necessary access, include, but are not limited to, the following:

8.8.1 Tier 1 for Non-Sensitive – Low Risk: All Personnel whose access to military PII is limited to data entry or singular search capability require, a minimum, a favorably adjudicated Tier-1

(T1) BI.

8.8.2 The Contractor shall report immediately to the DHRA Privacy Office and secondly to the COR discovery of any Privacy breach.

8.9 Controlled Unclassified Information Requirements for DoD Contractors. The following procedures will be used to protect Controlled Unclassified Information (CUI) documents and materials:

14 Ver: Nov 2023 https://public.cyber.mil/stigs/

8.9.1 HANDLING: Access to CUI material shall be limited to those employees needing the material to perform their duties. The CUI marking is assigned to documents and material created by a DoD User Agency. CUI is not a classification, but requires extra precautions to ensure it is properly safeguarded and disseminated and is not released to the public without government authorization.

8.9.2 MARKING: The Contractor shall mark unclassified documents containing CUI as follows: “CUI" at the top and bottom of each page, include the CUI warning box, and the CUI Designation Indicator Block as required in DoDI 5200.48.

8.9.2.1 Mark other records such as computer print outs, photographs, films, tapes, or slides in accordance with DoDI 5200.48 so the receiver or viewer knows that it contains CUI material.

8.9.2.2 Mark a message containing material in accordance with DoDI 5200.48. Unclassified messages containing CUI material must show the abbreviation (CUI) before the text begins.

8.9.2.3 Ensure documents transmitting CUI material call attention to any attachments containing CUI.

8.9.2.4 CUI material released to a contractor by a DoD user agency must have the following statement on the front page or cover:

THIS DOCUMENT CONTAINS CUI MATERIAL AND MUST BE REVIEWED BY A

GOVERNMENT REPRESENTATIVE UNDER THE REQUIREMENTS OF DODI

5200.48, DODI 5230.09, and DODI 5230.29.

8.9.3 STORAGE: The Contractor shall, place CUI material in an out-of-sight location during normal work hours, if the work area is accessible to persons who do not have an authorized government purpose for access to the material. After normal duty hours, the Contractor shall store CUI material to prevent unauthorized access by filing it with other unclassified records in unlocked files or desks when internal building security is provided and the file is marked as CUI.

When there is no internal security, locked buildings or rooms usually provide adequate after hours protection. For additional protection, store CUI material in locked containers such as file cabinets, desks, or bookcases.

8.9.4 TRANSMISSION: CUI documents and materials may be transmitted via first class mail, parcel post or, for bulky shipments,-fourth class mail. Within the CONUS discussion of CUI material on the telephone is authorized if necessary for the performance of the contract and no alternative is available. Electronic transmission of CUI (voice, data, or facsimile) should be by approved secure communications systems whenever practical. If there is a fax transmission, the sender must ensure the intended receiver is available to receive it or a cover sheet will be used to allow carrying it to the final recipient to avoid unauthorized disclosure of the CUI.

8.9.5 RELEASE: CUI material shall not be released outside of the contractor’s facility except to the representative of DoD or DHRA.

15 Ver: Nov 2023

8.9.6 DESTRUCTION: When the CUI material no longer meets the threshold for safeguarding and dissemination, the Contractor shall immediately decontrol it, process it through the records management process, and destroyed by the approved methods identified in DoDI 5200.48 to preclude its disclosure to unauthorized individuals by rendering it unreadable, indecipherable, and irrecoverable.

8.10 Position of Trust (POT) Requirements. DCSA and OPM offers the Tier background investigations, Tier 1 (T1) – Tier 5 (T5) for Position of Trust determination. The T5 being the most stringent investigation and T1 being the least stringent.

8.10.1 The Government is responsible for the cost of POT or sponsor a DoD-determined equivalent background check for unclassified access.

8.10.2 The Position of Trust BI process requires the DoD Government Security Office to review each request and establish the BI sponsorship. Submit a request and list of personnel for security investigation to the DHRA Security Office point of contact(s) to be provided by the COR- NLT five (5) business days after contract award.

8.10.3 Per DCSA a T1 or T1 Reinvestigation (T1R) meets the requirement for a Non-Sensitive position. A new application for a DoD T1/T1R BI for Position of Trust determination requires FBI fingerprints check, proof of US Citizenship and a Personnel Security Questionnaire (PSQ) on the Standard Form (SF) 85 using the National Background Investigation Services – electronic Application (NBIS/eApp). The Contractor employees shall provide all requested information pursuant to the Privacy Act of 1974 when requested by the Government. The Government Security Office will provide instructions according to the individual case and Tier BI to access the eApp system. For information visit NBIS at https://www.dcsa.mil/is/nbis/

8.10.4 Reciprocity. The DHRA and DLA PERSEC will use reciprocity to the extent possible and if necessary will request re-adjudication by the DoD Consolidated Adjudications Facility (CAF) or DCSA Consolidated Adjudication Services (CAS) to support the DoD standards per Executive Order E.O 13467.

8.10.4.1 A BI equivalency will be according to the investigative alignments offered by the OPM and the DCSA here, https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/Position_Designation_Investigation_ Type_Chart_Sept_2017.pdf

8.10.4.2 Reciprocity consideration includes verifying break in service longer than 24 months as a US Military, US Civilian or US Contractor from the last favorable investigation.

8.10.5 A new Position of Trust applicant under this contract must obtain at a minimum interim eligibility from DLA Security prior to the assignment and performance of their duties in support of the Government in this contract.

16 Ver: Nov 2023 https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/Position_Designation_Investigation_Type_Chart_Sept_2017.pdf https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/Position_Designation_Investigation_Type_Chart_Sept_2017.pdf

8.10.6 DHRA’s interim Position of Trust eligibility is sponsored by DHRA Security and approved by DLA PERSEC.

8.10.7 Eligible interim Position of Trust personnel expectations include, but are not limited to:

8.10.7.1 Comply with all personnel security requirements as specified by DHRA and DLA

PERSEC;

8.10.7.2 Attain and maintain favorable FBI fingerprint results;

8.10.7.3 Comply with all investigative and adjudicative requirements, which includes responsiveness to time-sensitive requests (e.g., interview(s), additional information or clarification) from the DLA PERSEC, investigator or the adjudicative agency (DoD CAF/CAS);

8.10.7.4 Attain and maintain favorable eligibility to the designated BI.

8.11 Controlled/Restricted Areas. The Contractor shall comply with local procedures for entry to DoD/DHRA controlled/restricted areas where Contractor personnel will work.

8.12 Physical Security. The Contractor shall safeguard all Government property and controlled forms provided for Contractor use and adhere to the Government property requirements contained in this contract. At the end of each work day, all Government facilities, equipment and materials shall be secured.

8.13 Pass and Identification Items. The Contractor shall ensure the pass and identification items required for contract performance are obtained for employees and non-government owned vehicles.

8.14 DoD Credentials/Common Access Card (CAC). Contractor personnel must obtain a DoD credential or CAC if they are assigned to perform work under this contract requiring access to DoD network(s), CUI/PII data, IT/Information Systems, DoD Facilities or non-DoD federally controlled facilities on behalf of the DoD on a recurring basis per DODM 1000.13, DoD Identification (ID) Cards: ID Card Life-Cycle.

8.14.1 Comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements. Be responsible for obtaining a CAC or PIV and be in ready status prior to requesting access to DoD resources such as DoD Facilities, DoD IT/Information Systems (IS).

8.14.2 CAC Applicant supporting this contract will need to meet the following requirements:

8.14.2.1 Execute, obtain/maintain a favorable FBI National Criminal History Check (fingerprint check);

8.14.2.2 Have an open Tier 1 or equivalent BI to meet Non-Sensitive role;

17 Ver: Nov 2023

8.14.2.3 Be ready to provide two forms of identification (I-9 document);

8.14.2.4 Provide proof of U.S Citizenship.

8.15 Retrieving Identification Media. The Contractor shall retrieve all identification media, including vehicle passes from employees, including those who depart for any reason before the contract expires; e.g. terminated for cause, retirement, etc.

8.16 Key Control/Access Badge Control. The Contractor shall establish and implement methods of making sure all keys/badges issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The Contractor shall not duplicate any keys issued by the Government.

8.16.1 Prohibited Use. The Contractor shall prohibit the use of keys, issued by the Government, by any persons other than the Contractor’s employees and the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in performance of contract work requirements in those areas.

8.17 Conduct while on Government Installation. The Contractor shall not assign work or direct its employees to access government information, systems, or installations unless the employees have and maintain the required background investigation, clearances, and authorizations.

8.18 Weapons, Firearms, and Ammunition. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their contractor-owned vehicle or privately-owned vehicle while on all government installations.

8.19 Reporting Requirements. Contractor personnel shall report to an appropriate authority any information or circumstance of which they are aware that may pose a threat to the security of government or contractor personnel, resources, or information.

8.20 Government Furnished Equipment (GFE). The Contractor shall establish and implement procedures to ensure all GFE to include laptops and other data processing devices, issued to the Contractor by the Government are not lost or misplaced, are not used by unauthorized persons, and are not subject to unauthorized external devices. The Contractor shall immediately report to the COR any lost GFE within two (2) hours of discovery of occurrence. In the event that GFE is lost, the Contractor may be required, upon written direction of the Contracting Officer, to replace the equipment at no additional cost to the Government. The Government may replace the equipment and deduct the cost from the monthly payment due the Contractor.

8.21 Offboarding. Upon completion of the contract, an employee’s relocation or termination of an employee, or upon request from the COR in accordance with DHRA centers or offices security policies coordinate the employees removal from work under this contract with the COR.

18 Ver: Nov 2023

8.21.1 If at any time, any Contractor personnel supporting this contract are unable to obtain/maintain an adjudicated T1 BI, the Contractor shall immediately notify the COR and coordinate removal of such a…