47QFPA22R0009_D.1_PWS_Rev. 1_040622 (1).pdf

47QFPA22R0009 Attachment 1_PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

Defense Personnel and Security Research Center Support Services

In Support of:

Defense Human Resources Activity Office of People Analytics

GSA R9 FAS AAS Acquisition ID: 47QFPA21K0005

Version dated 04/06/2022

47QFPA22R0009 – PERSONNEL AND SECURITY RESEARCH CENTER (PERSEREC) SUPPORT SERVICES

1.0 DEFENSE PERSONNEL AND SECURITY RESEARCH CENTER (PERSEREC)

PERFORMANCE WORK STATEMENT (PWS)

2.0 INTRODUCTION

The Defense Personnel and Security Research Center (PERSEREC), a division of the Office of People Analytics (OPA), a component of the Defense Human Resources Activity (DHRA), requires support for a research and development program dedicated to improving the effectiveness, efficiency, and fairness of Federal- and DoD-level security, suitability, and credentialing (SSC), reliability, counter-insider threat, and other risk management programs.

Program activities include use of social and behavioral science (SBS) methods to (1) conduct operational research and development efforts; (2) develop innovative systems, tools, trainings, and job aids for policymakers, practitioners, and the workforce at large; and (3) generate and communicate action-oriented research findings for stakeholders and project sponsors.

3.0 BACKGROUND

3.1 PERSONNEL AND SECURITY RESEARCH CENTER (PERSEREC)

The Defense Personnel and Security Research Center (PERSEREC) has been conducting social and behavioral science research in support of Federal- and DoD-level personnel security, suitability, credentialing and reliability programs since 1986. PERSEREC focuses its efforts on solving some of the most difficult challenges facing DoD and other Federal agencies to include operational research efforts aimed at modernizing personnel vetting under Trusted Workforce 2.0. The following is a partial list of PERSEREC’s security, suitability and credentialing and reliability program research areas to demonstrate our diverse portfolio:

a) Background Investigation Process Improvement (e.g., program evaluation)

b) Adjudication Process Improvement (e.g., adjudication quality review)

c) Social Media and Publicly Accessible Electronic Information (PAEI) Vetting

d) Vetting for Special Populations (e.g., Legal Permanent Residents [LPRs])

e) Continuous Vetting (CV) and Automated Record Checks (ARCs)

f) Reporting Behaviors of Concern

g) eAdjudication (i.e., automated clean case adjudication processing system)

h) Mental Health Vetting

i) Human Reliability Program Evaluation (e.g., under DoE)

Research focusing on security, suitability, and credentialing (SSC) programs has been a cornerstone of Personnel and Readiness (P&R’s) mission for many years. More recently, workplace violence and insider threat-related issues have risen to the forefront. In support of these goals, PERSEREC has been conducting social and behavioral science research, program evaluation, policy analysis, outreach, and training in support of DoD violence prevention, intervention, and postvention programs since 2014.

PERSEREC efforts in this area include removing barriers to help seeking; identifying interpersonal, situational and organizational risk factors; and identifying risk management strategies and empirically based best practices. PERSEREC has also developed tools and interventions to improve individual outreach and support to reduce risks of violence, self-harm, and acts or threats of aggression in both physical and virtual workplace environments.

PERSEREC also created The Threat Lab in 2018 to fulfill the DoD Counter-Insider Threat Program Director’s vision to incorporate SBS into the mission space. Since then, The Threat Lab has scaled rapidly to meet the growing research, professionalization, and communication needs of both DoD and the National Insider Threat Task Force (NITTF). The Threat Lab is responsible for establishing and executing SBS research priorities, the results of which are meant to advance stakeholders’ efforts to prevent, detect, and mitigate both intentional and unintentional insider threat incidents. The Threat Lab is responsible for sharing its work product with stakeholders around the world and requires expertise in strategic communications and marketing.

As threats to national security, technology, and the workforce more broadly continue to evolve, it is as important as ever to ensure policy makers and other leadership personnel have empirically based knowledge, metrics, and tools to support their decision-making needs.

PERSEREC’s applied research, development, and communication activities—as depicted across the previously-listed broad pillars of programmatic study—are directed to achieve the following:

a) Programs that are efficient and cost-effective (e.g., automated programs) that deliver fair, equitable, and timely decisions regarding employment status and eligibility to access classified information.

b) Programs that encourage use of risk management principles and maximize use of information technology and databases to expedite investigative and adjudicative processes.

c) Programs that reduce labor-intensive tasks and lessen the workload of both applicants and government personnel (e.g., promoting reciprocal investigation and adjudication processes across Federal agencies).

d) Programs that enforce the selection of a trusted population of military, civilian, and industrial employees who are fully aware of their security responsibilities and potential threats (e.g., foreign intelligence threats) that could impact their lives, work, or combat mission.

e) Programs that promote a resilient and ready military, civilian, and industrial workforce.

3.2 OBJECTIVE

The contractor shall provide services to perform the research, development, and communication services detailed within this PWS and subsequent task orders.

3.3 PLACE OF PERFORMANCE

Contractor personnel shall work at their discretion either onsite at the DoD Center in Seaside, CA, or remotely.

3.4 HOURS OF OPERATION

The Contractor shall provide support and coverage between the core hours of 0830-1700 Pacific Time, Monday through Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government-directed facility closings.

3.5 GOVERNMENT HOLIDAYS

The following Government holidays are normally observed by Government personnel: New Year’s Day, Martin Luther King’s Birthday, Presidential Inauguration Day (metropolitan DC area only), President’s Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day, Christmas Day, any other day designated by Federal Statute, Executive Order, and/or Presidential Proclamation, or any other kind of administrative leave such as acts of God (i.e. hurricanes, snow storms, tornadoes, etc.), Presidential funerals, or any other unexpected Government closures.

3.6 PERIOD OF PERFORMANCE

The period of performance is as stated in the solicitation/contract.

3.7 PAYMENT FOR AUTHORIZED WORK

No payments will be made for any unauthorized supplies and/or services or for any unauthorized changes to the work specified herein. This includes any services performed by the Contractor of their own volition or at the request of an individual other than a duly appointed Contracting Officer.

Only a duly appointed Contracting Officer is authorized to change the specifications, terms, and conditions under this effort.

4.0 SCOPE

The Contractor shall provide contracting support to the PERSEREC program in five specific areas.

This includes the following:

PROGRAM MANAGEMENT SUPPORT

SECURITY, SUITABILITY, AND CREDENTIALING (SSC) AND RELIABILITY PROGRAMS

COUNTER-INSIDER THREAT PROGRAMS

WORKPLACE RISK MANAGEMENT AND MITIGATION

DATA DISCOVERY, COLLECTION, ANALYSIS, MANAGEMENT AND PRESENTATION

5.0 REQUIREMENTS

5.1 TASK 1 PROGRAM MANAGEMENT SUPPORT

The contractor shall provide program management and project management support under this Contract. This includes the management and oversight of all activities performed by contractor personnel, including subcontractors, to satisfy the requirements identified in this Performance Work Statement (PWS). The contractor shall identify, by name, a Program Manager (PM), who shall provide management, direction, administration, quality control, and leadership of the execution of this contract. The contractor shall schedule meetings and provide deliverables in accordance with (IAW) Section D.1.16

5.1.1 SUBTASK 1 – PREPARE A MONTHLY STATUS REPORT (MSR)

The Contractor PM shall develop and provide an MSR using Microsoft (MS) Office Suite applications, by the 10th of each month via electronic mail to the GSA PM, Contracting Officer’s Representative (COR) and the CO. The MSR shall summarize for each contract line item:

Financial Review/Expenses, accomplishments during the period, problems met or anticipated, activities anticipated during the next reporting period, and utilization of personnel. The MSR shall include the following:

(1) Activities during reporting period, by task order/ project (include: on-going activities, new activities, activities completed; progress to date on all above mentioned activities). Start each section with a brief description of the task.

(2) Problems and corrective actions taken. Also include issues or concerns and proposed resolutions to address them

(3) Personnel gains, losses, and status (security clearance, etc)

(4) Government actions required

(5) Schedule (show major tasks, milestones, and deliverables; planned and actual start and completion dates for each)

(6) Summary of trips taken, conferences attended, etc. (attach trip reports to the MSR for the relevant reporting period.

(7) Accumulated invoiced cost for each CLIN up to the previous months

(8) Projected cost of each CLIN for the current month

(9) Badging roster or updates per PWS section 13.1

5.1.2 SUBTASK 2 – CONVENE SENIOR MANAGEMENT REVIEW (SMR) MEETINGS

The Contractor PM shall convene a monthly Senior Management Review (SMR) and contract activity meeting with the COR, and other vital Government stakeholders. The purpose of this meeting is to ensure all stakeholders are informed of the monthly activities and MSR, provide opportunities to identify other activities and establish priorities, and coordinate resolution of identified problems or opportunities. The Contractor PM shall provide minutes of these meetings, including attendance, issues discussed, decisions made, and action items assigned, to the COR following the meeting. The monthly SMR report shall summarize for each contract line item:

Financial Review/Expenses, accomplishments during the period, problems met or anticipated, activities anticipated during the next reporting period, and utilization of personnel.

5.1.3 SUBTASK 3 – PREPARE A PROJECT MANAGEMENT PLAN (PMP)

The Contractor shall document all support requirements in a PMP. The PMP shall:

(1) Describe the proposed management report

(2) Contain detailed Standard Operating Procedures (SOPs) for all tasks/projects.

(3) Include milestones, tasks, subtasks, and projects required by this Contractor

(4) Provide for an overall Work Breakdown Structure (WBS) and associated responsibilities and partnerships between Government organizations.

5.1.3.1 The Contractor shall provide the Government with a draft PMP at time of proposal, upon which the Government will accept the PMP virtue of contract award and provide comments at the kick-off meeting.

5.1.3.2 The Final PMP shall incorporate the Government’s comments within the timeframe specified in section 6.0. The PMP is a living document that shall be updated annually at a minimum. The Contractor shall work from the latest Government accepted version of the PMP at time of award.

5.1.4 SUBTASK 4 – QUALITY CONTROL PLAN (QCP)

The contractor shall provide a detailed draft (QCP) that is applicable to the contract and in consideration of all requirements. The QCP should detail how the contractor intends to monitor, inspect, and correct deficiencies for the requirements of the PWS. At a minimum, the plan shall provide methods to be used to achieve the Government’s objective within acceptable levels of quality as outlined in the Performance Requirements Summary (PRS) (13.0). The plan should address:

(1) Type, level of frequency of Contractor’s Quality Control actions, including remediation, if necessary

(2) Inspection checklists and records

(3) Deficiencies reported to COR

(4) Reports

(5) Meetings

5.1.4.1 QUALITY CONTROL PLAN (QCP) REPORTING

Concurrent with submission of the invoice, the contractor will create a Deliverable Post Award Collaboration (PAC) under the basic contract number in ASSIST for the contractor to upload the MSR with a QC Plan Surveillance Summary Report (PWS Attachment F Monthly QCP Surveillance Summary).

The QC Plan surveillance is a chart that the contractor must fill out and deliver with its monthly status report to summarize performance results for each element in the Performance Requirement Summary section of the PWS (13.0). This report includes surveillance results at the contract level, including all active task orders. The contractor must fill in the appropriate lot size and the number of unacceptable deliverables within each lot size. Lot size for each PRS element is described in the Government’s Quality Assurance Surveillance Plan (QASP).

The contractor will select the GSA Contracting Officer, GSA Program Manager, and Client COR / A-COR as the Responsible person in ASSIST when creating the PAC. When loading documents into the PAC, the contractor shall select “report” with the submission to ensure the documentation is auto-filed in Tab 47, “Surveillance” in the Contract File (CF).

5.1.5 SUBTASK 5 – UPDATE QUALITY CONTROL PLAN

The Contractor shall update the QCP submitted with their proposal and provide a final QCP as specified in section 6.0. The Contractor shall periodically update the QCP, as specified in 6.0, as changes in program processes are identified.

5.1.6 SUBTASK 6 – PREPARE TRIP REPORTS

The Government will identify the need for a Trip Report when the request for travel is submitted.

The contractor shall keep a summary of all long-distance travel including, but not limited to, the name of the employee, location of travel, duration of trip, and point of contact (POC) at travel location. If a Trip Authorization requirement is identified by the Government, the contractor shall provide a Travel Authorization Request (PWS Attachment 5) within five days after trip completion.

5.1.7 SUBTASK 7 – STAFFING PLAN

The Contractor shall submit a Staffing Plan that describes the understanding and requirements and details the number of personnel by skill level/ labor category needed to satisfy the objectives and requirements of the contract and demonstrates that it will possess available staff with the requisite education/experience/skills to successfully perform the contract requirements. The Staffing plan must provide at a minimum:

(1) A detailed discussion of the methods and approach that will be taken to acquire and/or retain a skilled staff that will meet or exceed the contract requirements.

(2) A discussion of the offeror’s approach to effectively communicate and coordinate with the Government.

5.1.8 SUBTASK 8 – LEGACY TASK ORDER TRANSITION

At time of award the Government will assess the status of any active orders under the legacy IDIQ contract for transition to the follow-on contractor. The outgoing contractor may be required to provide transitional phase out services under the contract terms or the continuity of services clause, as applicable.

5.1.8.1 - PHASE IN

To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the Contractor must have a transition plan per section 6.0 that will ensure requirements will continue with minimal disruption to PERSEREC. During the phase in period, the Contractor must become familiar with performance requirements in order to commence full performance of services on the contract start date. The Contractor must submit requests for physical and network access at performance locations. The Contractor must provide to PERSEREC information on all transition tasks. The Contractor must establish procedures with the predecessor to ensure transition of provided services without any degradation of service.

5.1.8.2 – TRANSITION

The Contractor must begin the process of transitioning personnel in coordination with the Contracting Officer’s Representative (COR) and user organizations immediately following completion of all security requirements. The Contractor shall be required to adhere to PERSEREC’s Contractor in/out processing requirements. Full Contractor performance begins upon completion of all transition activities with incumbent for up to one hundred eighty (180) days of contract award, or sooner as directed by the Government. Task Orders may specify a more specific transition period. The Contractor must complete the transition of its workforce within one hundred eighty (180) days of contract award.

5.1.8.3 – TRANSITION PLAN

The Contractor must provide a detailed transition plan with associated timelines for tasks that addresses both phase-in and phase-out for the contract. This plan must be submitted with the Contractor’s proposal and should be updated as required.

5.1.8.4 – PHASE-IN ACTIVITIES

The Contractor must include in its transition plan and perform, at a minimum, the following activities during the phase-in period:

(1) Submit requests for physical and network access at performance locations

(2) The Contractor must provide PERSEREC with information on all transition tasks.

(3) Establish procedures with the predecessor to ensure transition of provided services without any degradation of service.

(4) The Contractor shall identify how it will coordinate with the incoming contractor and/or

Government personnel to transfer knowledge regarding the following:

a. Project management processes

b. Points of contact

c. Location of technical and project management documentation

d. Status of ongoing technical initiatives

e. Appropriate contractor-to-contractor coordination to ensure a seamless transition.

f. Schedules and milestones

g. Actions required of the government

h. The Contractor shall also establish and maintain effective communication with the incoming incumbent contractor/Government personnel for the period of the transition via weekly status meetings.

5.1.8.5 – PHASE-OUT ACTIVITIES

The Contractor must include in its transition plan and perform, at a minimum, the following activities during the phase-out period:

(1) Ensure all services and performance objectives required by the PWS and contract are met throughout the phase-out period.

(2) The Contractor must provide PERSEREC with information on all transition tasks

(3) The Contractor must establish procedures with the successor to ensure transition of provided services without a degradation of service.

(4) The Contractor must provide copies of all instructions, records, databases, contract performance metric data, vendor points of contact, and all other procedures developed by the Contractor or in the performance of this contract successor.

5.2 TASK 2 SECURITY, SUITABILITY, AND CREDENTIALING (SSC) AND RELIABILITY

PROGRAMS

5.2.1 The contractor shall provide research and analysis support and subject matter expertise across the following domains:

a) Qualitative research design, methods, and analytic techniques to include participant observation, interviews, focus groups, user experience tests, questionnaires, and discourse analysis.

b) Quantitative research design, methods, and analytic techniques to include descriptive statistics, inferential statistics, data mining, and machine learning.

c) Policy and regulation review to include coverage at the Federal- and DoD-level.

d) Operational initiatives to build trainings, tools, videos, websites, web-based and mobile applications, and databases informed by research and made viable for use in the SSC and reliability program community.

5.3 TASK 3 COUNTER-INSIDER THREAT PROGRAMS

5.3.1 The contractor shall perform qualitative research tasks including:

a) data collection using participant observation, interviews, focus groups, user experience questionnaires, and discourse analysis.

b) generate both written reports and oral presentations, to include, for example, conference briefings, sponsor meetings, and webinars.

5.3.2 The contractor shall perform quantitative research tasks including:

a) calculating descriptive statistics on quantitative data

b) conducting analyses using inferential statistics

c) data mining analyses

d) machine learning analyses

5.3.3 The contractor shall provide subject matter expertise in the following areas:

a) national- and DoD-level insider threat policies, authorities, and processes, to include knowledge of how and why executive agencies’ policies, authorities, and processes differ.

b) policy analysis as a method to understand how and why relevant policies (e.g., workplace violence, insider threat, information security, etc) have evolved since Executive Order 13587 was signed.

c) foundational theories of human behavior at the micro-, meso-, and macro-levels across several disciplines including, but not limited to, psychology, sociology, criminology, communications, economics, public health, user experience/design, and business.

5.3.4 The contractor shall design training and professionalization materials for the counter-insider threat analyst field that encompass visual, physical, aural, verbal, logical, social, and solitary learning styles, to include:

a) skill-based and task-based training materials across a variety of platforms (e.g., virtual, in-person);

b) the full life cycle of a professional certification program, including the accreditation process and a robust professional development unit management system;

c) tradecraft materials that enable counter-insider threat analysts and behavioral threat assessors to test, apply, and expand their knowledge; and

d) graduate-level curriculum design and delivery for both in-person synchronous learning and online asynchronous and synchronous learning.

5.3.5 The contractor shall create and execute a strategic communication/marketing plan that enhances the Threat Lab’s growth, brand, and reputation.

5.4 TASK 4 WORKPLACE RISK MANAGEMENT AND MITIGATION

5.4.1 The contractor shall provide expertise in both quantitative and qualitative research design, methods, and analysis. Qualitative methods and analysis techniques include participant observation, interviews, focus groups, user experience tests, questionnaires, program evaluation, policy analysis, and discourse analysis. Quantitative methods and analysis techniques include descriptive statistics, inferential statistics, data mining, natural language processing, and machine learning.

5.4.32 The contractor shall provide subject matter expertise in national- and DoD-level workplace and school violence, harassment, sexual assault, and suicide prevention and management policies, authorities, and processes, to include knowledge of how and why executive agencies’ policies, authorities, and processes differ.

5.4.43 The contractor shall demonstrate expertise in policy analysis as a method to understand how and why relevant policies have been modified. The contractor shall be expected to articulate its policy expertise both in written reports and oral presentations, to include briefings, sponsor meetings, and webinars.

5.4.54 The contractor shall provide subject matter expertise in foundational theories of violent behavior at the micro-, meso-, and macro-levels across several disciplines including, but not limited to, psychology, clinical psychology, sociology, criminology, communications, education, economics, public health, user experience/design, and business.

5.4.5 The contractor shall provide expertise in the creative design and delivery of workplace risk management and mitigation training and outreach materials including but not limited to the development and delivery of videos, toolkits, webinars, podcasts, interactive presentations, posters, web-based and mobile applications, facilitated and computer-based learning modules.

5.5 TASK 5 DATA DISCOVERY, COLLECTION, ANALYSIS, MANAGEMENT AND

PRESENTATION

5.5.1 Data Discovery and Evaluation

5.5.1.1 The contractor shall examine existing and emerging data sources, including PAEI, automated electronic databases, and non-automated information sources, and assess their value for (a) SSC and reliability programs; (b) counter-insider threat programs; and (c) workplace risk management and mitigation.

5.5.1.2 Specific requirements include: (a) evaluating new electronic records sources as well as other automated and non-automated sources of information; (b) developing, testing, and refining business rules and algorithms for identifying personnel security, safety, or suitability risk using electronic records and other information sources; (c) identifying sources of PAEI with the potential to reduce cost and improve the quality and efficiency of SSC background investigations, continuous evaluation, continuous vetting, counterintelligence, and efforts to mitigate threats to national security; (d) evaluating tools for authenticating PAEI and other information to ensure it pertains to personnel under investigation; (e) identifying contextual information that decision-makers need to evaluate PAEI and other data sources;

and (f) identifying legal and privacy policies that govern the use of PAEI and other electronic and non-automated data sources in security and personnel management; (g) improving human-based reporting of security, insider threat, and other workplace-related concerns; (h) developing metrics and prototype mechanisms for monitoring quality, efficiency, effectiveness, and fairness of programs related to SSC, reliability, counter-insider threat, and workplace risk management and mitigation; (i) estimating cost/benefit impacts of Courses of Action (COAs); and (j) developing and assessing new methods of collecting information regarding personal, organizational, behavioral/non-behavioral, and community factors to improve risk-based personnel management.

5.5.2 Data Collection, Transformation and Management

5.5.2.1 The contractor shall provide support in all aspects of survey research, including (a) developing research questions and hypotheses; (b) sampling; (c) data collection technologies; (d) survey design, construction, administration, and support; (e) SME interview and focus group planning, administration, and analysis; (f) development of coding schemes; (g) data validation and quality assurance; and (h) operational issues.

5.5.2.2 The contractor shall provide programming and other information system technical support to (a) extract, transform, load, and merge data; (b) create automated routines for data processing; (c) perform data quality control for identity resolution, data deduplication, missing data, and data integrity; (d) create automated routines for data standardization and categorization; (e) create, test, modify, and maintain relational databases and data entry applications used for automated and manual data collection; (f) perform manual data coding and transformation, where not automatable; (g) conduct data quality assurance on manually coded data; (h) perform troubleshooting of software and hardware systems; and

(i) create procedural documentation, including user’s guides, software installation procedures, and other such documents.

5.5.3 Data Analysis, Predictive Modeling, and Advanced Analytics

5.5.3.1 The contractor shall analyze data from SSC, reliability, counter-insider threat, and other workplace management programs to generate descriptive analysis, develop predictive models, and support decision-makers and researchers in those programs with actionable information.

5.5.3.2 Specific requirements include conducting analyses using (a) basic descriptive statistics; (b) statistical correlation; (c) significance testing; (d) predictive modeling including standard forms of regression; (e) experimental design; (f) classification; (g) machine learning; and (h) text analysis and language processing.

5.5.4 Research and Analysis Results Presentation

5.5.4.1 The contractor shall demonstrate expertise presenting results in written and oral form.

5.5.4.2 Specific requirements include (a) writing standard research reports; (b) authoring briefing slides;

(c) delivering oral briefings; (d) displaying quantitative results in a wide variety of data visualizations; (e) displaying qualitative data in a variety of graphical formats, including flowcharts; (f) providing technical reviews and technical and grammar editing; and (g) generating user manuals, data dictionaries, and other documentation.

5.5.5 Technology Expertise

5.5.5.1 The contractor shall have expertise in the following technologies:

● SPSS

● R/R-Studio

● Python

● Microsoft Office suite

● Microsoft Access

● MS Project

● Visual Basic

● SQL, Relational databases

● Oracle database administration

● NVIVO

● SAS

● Tableau

5.5.5.2 Expertise with the following technologies would be beneficial:

● QLIK

● DataBricks

● DataRobot

6.0 DELIVERABLES

All deliverables and reports shall be submitted through the Post Award Collaboration (PAC) under the Basic Contract number in ASSIST. The Contractor will select the GSA Contracting Officer, GSA Project Manager and Client COR / A-COR as the Responsible person in ASSIST when creating the PAC. When loading documents into the PAC, the Contractor shall select “report” with the submission to ensure the documentation is auto-filed in Tab 47, “Surveillance” in the Contract File (CF). The contractor shall submit the deliverables listed in the following table:

In addition to the following deliverables, each task order will identify additional required deliverable for each order awarded.

PROJECT

DELIVERABLE /

CONTRACT

DELIVERABLE

MILESTONE/DELIVERABLE PWS

REFEREN

CE

PLANNED /COMPLETION

DATE

Contract Deliverable

Monthly Status Report (Unclassified)

5.1.1 Monthly (10th calendar day of the

next month)

Contract Deliverable

Senior Management Review (SMR) (Unclassified)

5.1.2 15th Calendar day of each month

Contract Deliverable

Project Management Plan – Draft (Unclassified)

5.1.3 Considered draft and accepted

at time of contract award.

Contract Deliverable

Project Management Plan – Final (Unclassified)

5.1.3 10 workdays after receipt of Government comments on accepted Project Management Plan

Contract Deliverable

Quality Control Plan (QCP) (Unclassified)

5.1.4 The QCP submitted with the

offerors proposal will be accepted by the Government by virtue of the award.

Updates shall be submitted, as necessary, during the life of the contract.

Contract Deliverable

Final Quality Control Plan (Unclassified)

5.1.4 10 workdays after receipt of Government comments on accepted Quality Control Plan

Project Deliverable

Trip Report (Unclassified) 5.1.6 5 days after Trip Completion

Contract Deliverable

Transition Plan (Unclassified) 5.1.8.3 At time of proposal submission

Contract Deliverable

Service Contract Reporting (eCMRA Reporting) (Unclassified)

7.0 NLT 31 October of each

calendar year

Contract Deliverable

Non Disclosure Agreement Unclassified)

8.1.7 As necessary.

7.0 SERVICE CONTRACT REPORTING

Contractor Inventory. In accordance with FAR CLAUSE 52.204-15 and Section 8108 of Public Law 112-10 of the Department of Defense and Full-Year Continuing Appropriations Action, 2011. The contractor shall report all labor hours required for performance of services provided under this task order via the secure SAM.gov data collection site. The contractor is required to completely fill in all required data fields at www.sam.gov. Reporting inputs shall be for the labor executed during the period of performance for each

Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported anytime during the FY, all data shall be reported no later than 31 October of each calendar year. The contractor may direct questions to the Federal Service Desk help desk (by telephone at 866-606-8220 (U.S.). The prime contractor is responsible to ensure all subcontractor data is reported.

8.0 SECURITY

8.1 Security Clearances

Personnel requiring access to classified information shall obtain the appropriate Secret or Top Secret clearance in accordance with the DD-254, Contract Security Classification Specification. The Contractor must possess or obtain a facility security clearance at the level of Top Secret prior to contract award. The Contractor shall register and request security clearances through the National Industrial Security Program Central Access Information Security System (NCAISS) (https://www.dss.mil/is/ncaiss/). Contractor shall provide personnel already vetted or able to undergo a background investigation (BI) according to Department of Defense (DoD) regulations. The BI must meet or exceed the sensitivity designated by the Government. Contractor personnel shall have appropriate clearances prior to contract award unless otherwise approved in writing by the Contracting Officer (CO). If subcontractors are utilized in performance of a classified contract, the Prime Contractor shall create a Subcontract DD 254 in the National Industrial Security Program Contract Classification System (NCCS). The Prime Contractor shall ensure that any teaming partners or subcontractors have the appropriate security clearances prior to contract award. Security Clearance Requirements:

8.1.1 All Contractor personnel requiring access to classified information will need to obtain the appropriate security clearance prior to beginning work on this contract.

8.1.2 DHRA is not responsible for processing contractor personnel for national security clearance (Secret and Top Secret).

8.1.3 The contractor must comply with required DHRA personnel security requirements as specified by the DHRA Enterprise Operations Center (DEOC).

8.1.4 Interim Clearances (e.g., Interim-Top Secret, Interim-Secret) will be reviewed by DEOC.

8.1.5 It is the responsibility of the contractor FSO to notify DEOC and DPAC/PERSEREC immediately if there is a change in clearance eligibility or access.

8.1.6 If at any time, any contractor person is unable to obtain or maintain eligibility for access to classified information, the contractor FSO shall immediately notify DEOC, PERSEREC, and DMDC Cybersecurity Division and remove such person from work under this contract.

8.1.7 The Contractor shall ensure that a Non-Disclosure Agreement is signed by all staff assigned to or performing on this contract before performing any work, including all subcontractors and consultants. The Contractor shall ensure that all staff understand and adhere to the terms of the non-disclosure statement, protecting the procurement sensitive information of the Government and the proprietary information of other contractors. (PWS Attachment 4 – Non-Disclosure Agreement).

8.2 Access to Sensitive Information

8.2.1 To the extent that the work under this contract requires the Contractor to have access to DoD sensitive information the Contractor shall after receipt thereof, treat such information as confidential and safeguard such information from unauthorized use and disclosure. The Contractor agrees not to appropriate such information for its own use or to disclose such information to third parties unless specifically authorized by the Government in writing.

8.2.2 The Contractor shall allow access only to those employees who need the sensitive information to perform services under this contract and agrees that sensitive information shall be used solely for the purpose of performing services under this contract. The Contractor shall ensure that its employees will not https://www.dss.mil/is/ncaiss/ discuss, divulge, or disclose any such sensitive information to any person or entity except those persons within the Contractor’s organization directly concerned with the performance of the contract.

8.3 Position of Trust Requirements

All Contractor personnel with access to DHRA systems or data must comply with the DOD Personnel Security Program. All persons on this contract will be designated in a Critical-Sensitive, or Non-Critical Sensitive position (IT-I or IT-II) as determined by the Government per position responsibilities.

8.3.1 All contractor personnel requiring access to IT-II level information systems, including e-mail, shall have at a minimum a favorable Tier 3 background investigation (formerly known as NACLC).

8.3.2 All contractor personnel requiring access to IT-I level information systems as determined by the Government per position responsibilities, must have a favorable Tier 5 investigation (formerly known as

SSBI).

8.3.3 Prior to beginning work on this contract, the contractor will complete all required personnel security requirements as specified by DHRA Personnel Security Office.

8.3.3.1 Complete and submit a vetting application (Standard Form [SF] 86 National Security Questionnaire through e-QIP, fingerprints and proof of US citizenship) that is favorably accepted by the Defense Counterintelligence and Security Agency (DCSA) for all employees under this contract requesting a position of trust determination.

8.3.4 It is the responsibility on the contractor to ensure their employees and sub-contractors (if applicable) comply with DHRA personnel security requirements.

8.4 Listing of Employees & Clearance Documentation

The Contractor shall maintain a current listing of employees. Within 10 calendar days of contract award, the Contractor shall provide the COR a list with the names, location of performance, and clearance status of all company employees assigned to this effort. The list shall be validated and signed by the company and DHRA Personnel Security. An updated listing shall be provided monthly and when an employee's status or information changes.

8.5 Controlled/Restricted Areas

The Contractor shall be compliant with local procedures for entry to DHRA controlled/restricted areas where Contractor personnel will work.

8.6 Physical Security

The Contractor shall safeguard all Government property and controlled forms provided for Contractor use and adhere to the Government property requirements contained in this contract. At the end of each workday, all Government facilities, equipment, and materials shall be secured.

8.7 Pass and Identification Items

The Contractor shall ensure the pass and identification items required for contract performance are obtained for employees and non-government owned vehicles.

8.7.1 Comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the Common Access Card (CAC). Be responsible for obtaining CAC or PIV ready status prior to contract start. Contractor personnel shall be immediately CAC ready prior to requesting access to DHRA networks/Information systems/IT Systems.

8.7.1.1 All Contractor personnel must obtain/maintain a favorable FBI National Criminal History Check (fingerprint check).

8.7.1.2 Provide two forms of identification (I-9 document).

8.7.1.3 Personnel must be citizens of the United States

8.7.1.4 Obtaining CAC or PIV ready status is the responsibility of the contractor. It is the responsibility of the contractor to notify DHRA Security and/or DMDC Cybersecurity Division when complete.

8.8 Retrieving Identification Media.

The Contractor shall retrieve all identification media, including name badges and vehicle passes, from employees who depart for any reason before the contract expires (e.g., terminated for cause, retirement, etc.)

8.9 Weapons, Firearms, and Ammunition.

Contractor employees are prohibited from possessing weapons, firearms, or ammunition on themselves or within their contractor-owned vehicle or privately-owned vehicle while on all DHRA installations.

8.10 Controlled Unclassified Information Requirements for DoD Contractors.

The following procedures will be used to protect Controlled Unclassified Information (CUI) documents and materials:

8.10.1 Handling. Access to CUI material shall be limited to those employees needing the material to perform their duties. The CUI marking is assigned to documents and material created by a DoD User Agency. CUI is not a classification but requires extra precautions to ensure it is properly safeguarded and disseminated and is not released to the public without government authorization.

8.10.2 Marking. Mark unclassified documents containing CUI “CUI" at the top and bottom of each page, include the CUI warning box, and the CUI Designation Indicator Block as required in DoDI 5200.48. In a classified document:

8.10.2.1 Mark individual paragraph containing only CUI, but not classified material, by placing “(CUI)" at the beginning of the portion.

8.10.2.2 Mark top and bottom of each page with classified material with the highest security classification of the material on the page.

8.10.2.3 If the document or material contains CUI under the category of Controlled Technical Information (CTI), use of distribution statements is required. See DoDI 5200.48.

8.10.2.4 If a classified document contains CUI material or if the classified material becomes CUI when declassified, place the following statement on the bottom of the cover or the first page under the classification marking: “NOTE: If declassified, review the document to make sure the material is not still CUI. If it is, then it must have the appropriate safeguarding, dissemination controls, and CUI markings applied.”

8.10.2.5 Mark other records such as computer print outs, photographs, films, tapes, or slides in accordance with DoDI 5200.48 so the receiver or viewer knows it contains CUI material.

8.10.2.6 Mark a message containing material in accordance with DoDI 5200.48. Unclassified messages containing CUI material must show the abbreviation (CUI) before the text begins.

8.10.2.7 Ensure documents transmitting CUI material call attention to any attachments containing

CUI.

8.10.2.8 CUI material released to a contractor by a DoD user agency must have the following statement on the front page or cover:

THIS DOCUMENT CONTAINS CUI MATERIAL AND MUST BE REVIEWED BY A GOVERNMENT

REPRESENTATIVE UNDER THE REQUIREMENTS OF DODI 5200.48, DODI 5230.09, and DODI 5230.29.

8.10.3 Storage. During normal duty hours, place CUI material in an out-of-sight location if your work area is accessible to persons who do not have an authorized government purpose for access to the material.

After normal duty hours, store CUI material to prevent unauthorized access. File with other unclassified records in unlocked files or desks when internal building security is provided, and the file is marked as CUI. When there is no internal security, locked buildings or rooms usually provide adequate after-hours protection. For additional protection, store CUI material in locked containers such as file cabinets, desks, or bookcases. Expenditure of funds for security containers or closed areas solely for the protection of CUI material is prohibited.

8.10.4 Transmission. CUI documents and materials may be transmitted via first class mail, parcel post, or for bulky shipments-fourth class mail. Within the CONUS, discussion of CUI material on the telephone is authorized if necessary for the performance of the contract and no alternative is available. Electronic transmission of CUI (e.g., voice, data, or facsimile) should be by approved secure communications systems whenever practical. If there is a fax transmission, the sender must ensure the intended receiver is available to receive it or a cover sheet will be used to allow carrying it to the final recipient to avoid unauthorized disclosure of the CUI.

8.10.5 Release. CUI material shall not be released outside of the contractor’s facility except to the representative of DoD or DHRA.

8.10.6 Destruction. When the CUI material no longer meets the threshold for safeguarding and dissemination, it shall be immediately decontrolled, be processed through the records management process, and destroyed by the approved methods identified in DoDI 5200.48 precluding its disclosure to unauthorized individuals by rendering it unreadable, indecipherable, and irrecoverable.

8.11 Reporting Requirements

Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware that may pose a threat to the security of DOD personnel, Contractor personnel, resources, and classified or unclassified defense information.

8.12 Key Control/Access Badge Control

The Contractor shall establish and implement methods of making sure all keys/badges issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The Contractor shall not duplicate any keys issued by the Government.

8.12.1 Prohibited Use. The Contractor shall prohibit a) the use of keys issued by the Government by any persons other than the Contractor’s employees, and b) the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in performance of contract work requirements in those areas.

8.13 Lock Combinations

The Contractor shall control access to all government-provided lock combinations to preclude unauthorized entry. The Contractor is not authorized to record lock combinations without written approval by the COR. Records with written combinations to authorized secure storage containers, secure storage rooms, or certified vaults shall be marked and safeguarded at the highest classification level as the classified material maintained inside the approved containers.

8.14 Government Furnished Equipment (GFE)

While GFE per FAR 45 will not be provided under this IDIQ or any forthcoming task order issued against the IDIQ, the Contractor shall establish and implement procedures to ensure all GFE to include laptops and other data processing devices issued to the Contractor by the Government are not lost or misplaced, are not used by unauthorized persons, or are not subject to unauthorized external devices.

The Contractor shall immediately report to the COR any occurrences of lost GFE within two (2) hours of discovery of occurrence. In the event that GFE is lost, the Contractor may be required, upon written direction of the CO, to replace the equipment at no additional cost to the Government. The Government may replace the equipment and deduct the cost of such from the monthly payment due the Contractor.

8.15 Conduct while on Government Installation

The CO may direct the contractor to remove an employee(s) from an assignment under this contract for reasons of security or misconduct. Where the reasons for the removal request is due solely for security or misconduct by the employee(s), the replacement shall be at the contractor’s expense and not chargeable to the government.

8.16 Information System Security

The Contractor shall implement Information System (IS) security protections and ensure the protections are appropriate to the confidentiality, integrity, and availability needs of the Government. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data.

8.17 Risk Management Framework

All Information Systems (IS), Platform Information Technology (PIT), and Information Technology (IT) Services or Products under this requirement that receive, transmit, store, or process nonpublic government data must be accredited in accordance with DOD Instruction (DoDI) 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT) and comply with annual Federal Information Security Management Act (FISMA) security control testing. IS and PIT systems must: be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

8.17.1 All systems subject to RMF must present evidence of authorization in the System Security Plan (SSP), Security Assessment Report (SAR) Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD Risk Management Framework (RMF) or equivalent DoD Component PIT system accreditation decision that is current within 3 years. Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) or, if acceptable to the Government, an Interim Authority to Operate (IATO) by contract award.

8.18 Information Security Continuous Monitoring (ISCM)

ISCM is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. ISCM is a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur. The Contractor shall maintain ongoing monitoring, analysis, and incident response procedures for all IS and PIT systems under this requirement in accordance with NIST SP 800-137.

8.19 Cybersecurity Service Provider (CSSP)

The Contractor shall perform CSSP services in accordance with DoDI 8530.01, Cybersecurity Activities Support to the DoD Information Network Operations, Change 1, July 25, 2017.

8.20 Cyber Incident Reporting

Within one (1) hour of discovery of any cyber incident the Contractor shall notify the DMDC Incident Response (IR) team by emailing an Initial cyber incident report to the following organizational box:

dodhra.dodc-mb.dmdc.list.ir-team@mail.mil, with subsequent reporting every 24 hours until the incident is closed. The Contractor shall also notify the COR and CO at the time the incident is reported to DMDC/IR.

8.21 NIST SP 800-171 & NIST SP 800-171A Compliance

The Contractor shall support independent on-site government assessment of compliance of NIST SP 800-171 and NIST SP 800-171A.

8.21.1 The Contractor shall rapidly (within 72 hours) report cyber incidents to the DoD at…