PWS_Cloud Support_Draft.docx

PERFORMANCE WORK STATEMENT (PWS)

Award

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title. Enterprise End-to-End Engineering and Platforms Analysis Support (E4PAS)

3. Background. DISA Enterprise Engineering (OE) performs mission critical engineering analyses, application and network monitoring, system prototyping and software development. This work depends on platforms with provisioned a mixture of on-premises and cloud-based classified and unclassified Linux and Windows based instances, workstations and servers hosting unique software tools. The environments support end-users conducting mission partner critical network traffic analyses, capacity planning, building ad-hoc reports/dashboards, rapid project prototyping, developing in-house applications, and performing system integration. These are provided through the Unclassified but Sensitive Internet Protocol Router Network (NIPRNET) and Secret Internet Protocol Router Network (SIPRNET) supporting the DISA user communities. OE2 staff also manages the Information Assurance (IA) policies for environments provisioned with privileged access.

This contract shall implement, maintain and enhance the directorate IT infrastructures and services that support the OE personnel with modelling and simulation tasks, system analyses, tool development, network studies, application diagnostics and support analyses, and software integration. Successful performance of the required tasks requires in-depth understanding of both the on-premise and cloud-based environments to include but not limited to system configuration, Public Key Infrastructure (PKI) frameworks, system authentication, end-to-end ingress and egress traffic, multi-level security environments, various Government Cloud environments, network infrastructure and services, monitoring tools, virtual private clouds, cloud storage, and DoD IA practices such as updating Authorizations to Connect for systems in development or upgrade. This contract also includes a significant requirement for end user support. The contractor support, as described in this document, provides IT services to operate and maintain the hybrid (on-premises and cloud) information systems infrastructure for OE2 in support of the DISA OE missions.

4. Objectives: This effort shall provide IT critical services/services-based solutions in support of OE2 administering and managing NIPRNET and SIPRNET, Users, Servers, and Client resources for both the on-premises and cloud-based environments to support DISA missions. Additionally, the objective of this PWS is to provide program support services for on-going development efforts and new efforts as described within this PWS.

5. Scope. The general scope of IT services and IT service-based solutions to be done is within the following Performance Areas:

· Task Area 1 – Contract-Level and Task Order (TO) Management

· Task Area 2 – Infrastructure Engineering and System Administration Support

· Task Area 3 – Infrastructure and System Security Support

· Task Area 4 – User Community Engineering and System Administration Support

· Task Area 5 – Cyber Threat Security Plan and Supply Chain Risk Management (SCRM) Plan Delivery

· Task Area 6 – Network Optimization and System Administration for GovCloud and Legacy Systems (Optional)

· Task Area 7 – Proactive Network Management and Enhanced End-to-End Network Connectivity Support (Optional)

· Task Area 8 – Development and Integration of Custom Monitoring Dashboards for Enhanced System Visibility, Automated Monitoring and Alerting System (Optional)

The Contractor shall comply with the appropriate DoD-approved architectures, programs, standards and guidelines, to include but not limited to Defense Information Infrastructure (DII) Strategic Technical Guidance, DII Common Operating Environment, Shared Data Environment, Mission Assurance Category III, and DoD Architecture Framework.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 10% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

6. Performance Requirements.

6.1 Task 1 - Contract-Level and Task Order (TO) Management

The contractor shall focus on providing TO management support to the COR. TO support includes various tasks related to planning, executing, tracking and documenting TO activities.

6.1.1 Subtask 1 – Task Order Integration Management Control Planning.

The contractor shall provide the technical (TO level) and functional activities needed for the program management of this PWS, including productivity and management methods such as quality assurance, progress/status reporting, work performance, project scheduling, project milestones, and program reviews. Provide the centralized administrative, clerical, documentation and related functions.

6.1.2 Subtask 2 - Task Order Management Plan (TOMP).

The contractor shall prepare TOMP describing the technical approach, organizational resources and management controls to be employed to meet the contract cost, performance and schedule requirements throughout TO execution. Provide a monthly status report monitoring the quality assurance, performance progress, status reporting, project scheduling, project milestones, and program reviews applicable to the TO.

Deliverables:

Final Copy is No later than 30 days before the end of TO

1 Electronic Copy to COR/ ACOR Monthly, on 20th workday

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.2 Task 2 - Infrastructure Engineering and System Administration Support (GovCloud environments, on-premises enclaves, and network infrastructures) The contractor shall follow guidance from the Government task lead to ensure NIPR and SIPR GovCloud environments, on-premises enclaves, cross-domain activities, and network traffics are fully and successfully operational. Network & Systems Engineers with strong expertise in design, implementation, and maintenance of secure and reliable network infrastructures as well as system services for the GovCloud environments is a must. The contractor shall possess excellent performance of network services and system operations, extensive experience in system monitoring and troubleshooting tools. The contractor shall operate systems compliant with the DoD Information Assurance (IA) policies and regulations.

6.2.1 Subtask 1- System Administration Support for the Existing and New Systems:

The designated contractor serves as Network & Systems Engineers to support the design, implementation, and maintenance of secure and reliable network infrastructures and system services within various Government service Cloud environments as well as for on-premises enclaves. The contractor shall possess extensive engineering and system administration experiences to support end-to-end GovCloud network connectivity, system authentication, system services, cyber security best practices, network and system monitoring/troubleshooting tools. This effort shall include the following but not limited to:

Network Engineering:

The contractor shall provide comprehensive network engineering support, encompassing the design, implementation, maintenance, security, and connectivity of the network infrastructure across on-premises and various government cloud environments. This includes, but is not limited to, designing and maintaining a scalable network architecture to accommodate future growth, ensuring secure and seamless end-to-end connectivity across all environments, implementing robust security controls specific to each environment, monitoring performance, troubleshooting network issues, and meticulously documenting all network-related activities. The primary goal is to maintain a secure and reliable network infrastructure facilitating secure and controlled access to system resources.

Systems Engineering:

The contractor shall provide systems engineering expertise to ensure the robust design, deployment, and management of servers across on-premises and various government cloud environments, prioritizing high availability and fault tolerance in each. This includes, but is not limited to, designing and implementing cloud infrastructure within designated government cloud environments, configuring data backup and recovery mechanisms appropriate for each environment, developing and maintaining system automation tools, and ensuring optimal system scalability and performance. The contractor will focus on building and maintaining resilient and efficient systems across all operational environments.

System Administration and Maintenance:

The contractor shall provide comprehensive system administration and maintenance services to ensure the smooth operation of all systems across both on-premises and various government cloud environments. This includes, but is not limited to, managing user accounts and access, performing system patching and updates tailored to each environment, troubleshooting system problems, implementing environment-specific monitoring tools, and maintaining comprehensive system documentation, including architecture diagrams, Concept of Operations (CONOPS), and network topologies that reflect the hybrid nature of these systems. The contractor will proactively address system issues and maintain accurate records of system configurations and activities across all environments.

Security and Compliance:

The contractor shall ensure the on-premises and GovCloud systems adhere to all applicable DoD IA Standards and cybersecurity regulations across on-premises and various government cloud environments. This includes, but is not limited to, implementing and maintaining security controls specific to each environment, conducting regular vulnerability assessments, and supporting all necessary administrative and technical requirements to meet DISA security standards in each environment. The contractor will actively collaborate with other technical teams, including network, security, database, and applications teams to ensure a comprehensive and robust security posture for systems across all operational environments.

Other Engineering Support:

The contractor shall provide additional engineering support as required, encompassing software installation and management, data storage management tailored to the specific requirements of on-premises and cloud environments, and adherence to all relevant security policies and regulations applicable to each. This includes, but is not limited to, leveraging appropriate tools and technologies to ensure system availability, integrity, and confidentiality across all environments, demonstrating expertise in cloud and virtualization technologies, and maintaining compliance with DoD 8570.01 IA certification requirements.

Document Deliverables:

The contractor shall deliver comprehensive documentation detailing network and system designs, security implementations, connectivity solutions, and regular status reports that specifically address on-premises and each government cloud environment. This includes, but is not limited to, diagrams, configurations, implementation plans, security policies and procedures, assessment reports, updates on network and system performance, After Actions Reports (AARs), security posture for ongoing and new projects. This thorough documentation will ensure transparency and facilitate ongoing management and maintenance of all systems across various operational environments.

Deliverables:

Electronic Copy to COR/ ACOR Weekly and as necessary (for unscheduled emergency activities)

Final Copy is No later than 30 days before the end of TO

Final Copy is No later than 30 days before the end of TO

Final Copy is No later than 30 days before the end of TO

Final Copy is No later than 30 days before the end of TO

Final Copy is No later than 30 days before the end of TO

Final Copy is No later than 30 days before the end of TO

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.3. Task 3 – Infrastructure Security Support

The contractor shall work with the designated government Information System Security Officers (ISSO) to ensure all IA related requirements are in compliance for both on-premise and cloud-based environments including, but not limited to supporting the system Accredit To Operate (ATO) interim processes (Interim Authorized to Test (IATT)-Not Connected, IATT-Connected, pre-staged IPv6 transitioning), completing IA/Security tasks by suspense dates, making sure all reportable unclassified and classified environments are in compliance with IA policies per DoDI 8500.02, assisting OE2 staffs with various security document write-ups and updates, supporting OE2 staffs maintaining periodic ATO approvals, developing and maintaining Plan of Action and Milestones (POAMs) to resolve open vulnerability findings, performing annual security reviews, security test control and contingency plans to implement an countermeasure maintaining security and operational accreditations.

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.4. Task 4 – User Community Engineering and System Administration Support for both on-premises and cloud- based environments:

The contractor shall provide the following support:

· Create, maintain, record, and delete classified and unclassified user accounts

· Provide user training for workstations and network services as necessary.

· Coordinate security, hardware, software installation and maintenance for user community.

· Troubleshoot ad-hoc user-related issues reported by the user community.

· Support ad-hoc user requests based upon requirement scopes and use case studies.

· Utilize OE2 issue tracking system to document troubleshooting activities and provide management analytics.

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.5 Task 5. Cyber Threat Security Plan and Supply Chain Risk Management (SCRM) Plan Delivery.

The contractor shall develop, submit, and implement upon approval a Cyber Threat Security Plan.

The contractor shall submit the plan 30 days after the contract award to the COR for acceptance. The COR shall have 10 working days to provide an acceptance or feedback to the contractor. If no written acceptance is received within the 10 working days, then the contractor can consider the plan accepted. If the contractor receives feedback within the 10 working days, then the contractor has 10 working days to provide the COR an updated plan based on comments provided by the Government.

This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract. This plan shall contain the following:

(a) Vulnerability Management: evaluate network components, security procedures, and processes for potential exploitation from attacks.

(b) Cyber Threat Intelligence: provide policy enforcement and end-point protection against unwarranted attacks on the network.

(c) Analytics Monitoring: provide scalable analytics solutions capable of combining potential risk indicators and developing leads.

(d) Mitigation and Response: provide the process on how the threat will be mitigated and responded to upon discovery.

(e) Lessons Learned and Action Plan: provide lessons learned and an action plan that will help all interested parties avoid repeated and similar attacks.

(f) Subcontractors: explain how your subcontractors will be required to implement this requirement within their processes in support of this task.

Annually, on the anniversary date of acceptance of the plan, the contractor shall submit verification to the COR that the plan remains valid.

Final Copy is No later than 50 days after start of TO

Annual verification of valid plan.

Final Copy is No later than 120 days after start of TO

No later than the 5th work date for updates regarding changes affects Committee on National Security Systems Instructions (CNSSI) 1253 Security Controls

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.6 Task 6. Network Optimization and System Administration for GovCloud and Legacy Systems (Optional) This optional task provides enhanced support and optimization for both the GovCloud environments and on-premises legacy systems, encompassing network improvements, system engineering, and system administration activities. The Contractor shall perform activities to include but not limited to Network Enhancement to Analyze and optimize network performance; System Engineering Support to conduct system analysis and design reviews, develop technical documentation, and provide technical guidance to include implementing solutions for secure cross-domain capabilities; System Administration Support to perform system administration tasks, develop and maintain system documentation, including standard operating procedures and troubleshooting guides, proactively identify and resolve issues to ensure system operations; Cross-Platform Integration to facilitate seamless integration among GovCloud platforms, ensuring data consistency and interoperability; this includes addressing the complexities of cross-domain capabilities while adhering to security policies and regulations, and Security Hardening to implement security hardening measures for both GovCloud and on-premises systems to protect against cyber threats.

This optional task will be performed as directed by the Contracting Officer's Representative (COR) and will be subject to available funding. The Contractor shall provide regular status reports to the COR detailing the progress and accomplishments achieved under this task.

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.7 Task 7. Proactive Network Management and Enhanced End-to-End Network Connectivity Support (Optional) This optional task provides enhanced end-to-end network connectivity support, encompassing proactive monitoring, troubleshooting, optimization, and security enhancements. The Contractor shall perform activities such as Proactive Network Monitoring to implement and maintain comprehensive network monitoring tools and processes to proactively identify and address potential network connectivity issues; Advanced Troubleshooting to quickly resolve complex network connectivity problems; Network Optimization to analyze and optimize network performance to ensure optimal bandwidth utilization, low latency, and high availability; Security Enhancements to implement and maintain robust security measures to protect network connectivity from cyber threats; Connectivity Expansion and Upgrades to support the expansion and upgrade of network infrastructure to accommodate increasing bandwidth demands and evolving use case;, Documentation and Reporting to maintain comprehensive documentation of network infrastructure, configurations, and troubleshooting procedures.

This optional task will be performed as directed by the Contracting Officer's Representative (COR) and will be subject to available funding. The Contractor shall provide regular status reports to the COR detailing the progress and accomplishments achieved under this task.

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.8 Task 8. Development and Integration of Custom Monitoring Dashboards for Enhanced System Visibility, Automated Monitoring and Alerting System (Optional) This optional task provides the implementation and maintenance of automated monitoring capabilities, leveraging system-generated or developing custom dashboards to visualize key system and network metrics. The Contractor shall perform activities such as, but not limited to Automated Monitoring Implementation to design, develop, and implement automated monitoring tools for designated systems and network infrastructure; Dashboard Development to create customized dashboards that provide real-time visibility into system and network performance; Alerting and Notification to configure automated alerts and notifications based on predefined system thresholds and criteria; Metric Collection and Analysis to define and collect relevant system and network metrics to provide comprehensive insights about system performance and availability; Integration and Customization to integrate the automated monitoring solution with existing system management tools and platforms; Documentation and Training to develop and maintain comprehensive documentation for the automated monitoring system, as well as provide trainings to designated personnel on how to use the dashboards and reporting tools.

This optional task will be performed as directed by the Contracting Officer's Representative (COR) and will be subject to available funding. The Contractor shall provide regular status reports to the COR detailing the progress and accomplishments achieved under this task.

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

7. Performance Standards.

All User requests should receive a response within a timeline defined by the Information System Security Officer (ISSO) not to exceed business 7 days.

Government inspection of all deliverables by COR / ACOR.

Government inspection of all deliverables by COR / ACOR.

8. Incentives. For both outstanding and negative performances, ratings shall be recorded in the Contractor Performance Assessment Reporting System (CPARS).

When unacceptable performance occurs, the Government will withhold payment for services until corrective action is taken. Upon Government acceptance of the corrected services the contractor will be permitted to invoice.

9. Place of Performance. The place of performance shall be DISA Headquarters (HQs), 6910 Cooper Ave, Ft. Meade, MD. There are available seats for contractor support located at Ft. Meade. Contractor program management and administrative work shall be performed offsite at the contractor’s facilities. SIPRNET task order performance is restricted to DISA HQs located in Fort Meade, Maryland

Mission Location: DISA Headquarters located at Ft. Meade MD.

Place of Performance: DISA Headquarters (HQs), 6910 Cooper Ave, Ft. Meade, MD 20755.

Alternative work sites allow for regular telework or remote work flexibilities. Regardless of where work is performed, the Contractor shall ensure that work is completed effectively and that mission needs and requirements are met, without degradation of services. Also, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. The Contractor shall propose on-site rates for all work performed at an alternative work site. Incidental charges incurred while working at an alternative work site (e.g., electricity, internet) are not allocable to the contract and shall not be billed to the government.

Local travel to and around the mission location (or place of performance if the PWS does not include a list of places of performance), (add mission location such as DISA HQ Ft. Meade include contractor’s facility as well if that is part of the place of performance) may be required throughout the period of performance; this travel will not be reimbursed. Long distance travel within CONUS may be required to support the requirements of this PWS. Long distance travel within CONUS must be pre-approved in writing by the COR prior to the Contractor incurring the cost in support of this contract.

Maximum number of government seats available for this effort is 2 (space waiver tracking #OC-16 for Government use only). For other government site locations, the maximum number of government seats may be provided if desired by the mission partner, but the space waiver log number would not be applicable.

a.) Local Travel: Local travel to and around the mission location (or place of performance if the PWS does not include a list of places of performance), (add mission location such as DISA HQ Ft. Meade include contractor’s facility as well if that is part of the place of performance) may be required throughout the period of performance; this travel will not be reimbursed. Long distance travel within CONUS may be required to support the requirements of this PWS. Long distance travel within CONUS must be pre-approved in writing by the COR prior to the Contractor incurring the cost in support of this contract.

b.) TDY Travel. Travel outside the local area may be required. If required it must be approved, in advance, by the Government Contracting Officer’s Representative (COR). Site visits may be required to Government and industry facilities in CONUS. Travel will be in accordance with FAR 31.205-46 and the Joint Travel Regulation and its prevailing rates.

Secondary Place of Performance – Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at a secondary place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather). Additionally, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

10. Period of Performance. The period of performance for this task order is a 12- month base period with four 12 month option periods.

Base period is from: 16 Jan 2026 to 15 Jan 2027 OY1 is from: 16 Jan 2027 to 15 Jan 2028 OY2 is from: 16 Jan 2028 to 15 Jan 2029 OY3 is from: 16 Jan 2029 to 15 Jan 2030 OY4 is from: 16 Jan 2030 to 15 Jan 2031

As directed by the COR, the contractor shall continue performance in emergency conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

Recognized Federal Holidays: The contractor is not required to perform services on Federal Holidays (as specified on the U.S. Office of Personnel Management website), unless otherwise specified by the COR.

Unplanned Federal Government Closure: In the event an authorized official, by either executive or legislative order, declares Federal offices closed (treated as a holiday for pay and leave purposes), the order only applies to Federal employees (unless otherwise stated in the order).

11. Security Requirements.

This PWS is unclassified. Access to information and documents produced under this contract shall range from UNCLASSIFIED up to and including TOP SECRET.

The contractor shall coordinate site visits with site Point of Contact (POC) at least 72 hours prior to requiring any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by Government personnel who are cleared.

This section shall be considered a supplement to Block 13 of the Government provided DD Form 254, DoD Contract Security Classification Specification. The following security requirements shall apply to this effort.

References:

a. DISA Form 786, DISA Statement of Information System Use and Acknowledgement of User Responsibilities

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-36, Personnel Security

e. DISA Instruction 240-110-38, Industrial Security

f. DISA Instruction 240-110-43, Insider Threat Program

g. DISA Instruction 630-230-19, Cybersecurity

h. DoDM 5200.01, Vol 1-4 Information Security Program, 24 February 2012

i. DOD 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

j. DOD 5220.22-M, National Industrial Security Program Operating Manual, February 2006 Incorporating Change 02 May 2016

11.1 Facility Security Clearance. The work to be performed under this contract is up to the Top Secret level. Therefore, the company must have a final Top Secret Facility Clearance from the Defense Counterintelligence and Security Agency.

11.2 Security Clearance and IT Level. All personnel performing on or supporting a DISA contract in any way shall be U.S. citizens. The personnel security requirements for this contract cover the individuals supporting the Task Areas. All contractor personnel must possess an interim or final security clearance and interim or final IT-level I eligibility when performance starts.

11.2.1 Individuals supporting all PWS Tasks / Subtasks that require a minimum interim Top Secret security clearance and an interim or a final IT-I (privileged level systems access) will, immediately upon hire, require access eligibility adjudicated by the DoD Consolidated Adjudication Facility or other federal adjudications facility to perform their duties.

The following types of positions require a minimum interim Top Secret security clearance and interim IT-I eligibility when performance starts:

11.3 Investigation Requirements. All personnel requiring IT-I access under this contract shall undergo a favorably adjudicated Tier 5 investigation (formerly known as a Single Scope Background Investigation (SSBI)) as a minimum requirement. The T 5 will be maintained current within 5-years and requests for Tier 5 reinvestigation (T5R formerly known as Single Scope Background Period Reinvestigation (SBPR) or Phased Periodic Reinvestigation (PPR)) will be initiated prior to the 5-year anniversary date of the previous Tier 5.

11.3.1 All personnel requiring Top Secret or IT-II access under this contract shall undergo a favorably adjudicated Tier 5 (T5) Investigation formerly known as a Single Scope Background Investigation (SSBI) as a minimum requirement and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. The Tier 5 Investigation will be maintained current within 5-years and requests for Top Secret Periodic Reinvestigations will be initiated by submitting a Tier 5R investigation prior to the 5-year anniversary date of the previous Tier 5 Investigation.

11.3.2 The contractor is required to have personnel cleared with an interim or final Top Secret/IT-I or Top Secret/IT-II as specified in section 11.2 at contract start date. If contractor personnel is replaced during performance of the contract, replacement personnel should also have interim or final clearance Top Secret/IT-I or Top Secret/IT-II as specified in section 11.2.

11.4 Adjudication for IT-I access. Favorable Adjudication of any previous T5, T5R, SSBI, SBPR or PPR by any of the DoD Central Adjudication Facility or other federal adjudications facilities within a five-year period will be automatically accepted for final IT-I access.

11.4.1 Prior to granting interim IT-I authorization, the supporting security manager will forward a written request for interim IT-I authorization to DISA Personnel Security Officer (PSO) for approval. The request for SSBI Electronic Questionnaires for Investigations Processing (e-QIP), Federal Bureau of Investigation) (FBI) name and fingerprint check) must be submitted by DISA PSO to the Office of Personnel Management (OPM).

11.5 Visit Authorization Letters (VAL). Visit requests shall be processed and verified through the Joint Personnel Adjudication System (JPAS) to SMO DKABAA10 (DISA HQ VAR Center, Level 6). JPAS visits for contracts/orders are identified as “Other” or “TAD/TDY” and will include the Contract/Order Number and ADP/IT-Access level of the contract/order in the Additional Information section. Contractors that do not have access to JPAS may submit visit authorizations by e-mail in a password protected .pdf to the COR or ACOR specified in Section 1.0.

If JPAS is not available, the VAL must contain the following information on company letterhead

· Company name, address, telephone number, facility security clearance

· CAGE CODE

· Contract/Order Number

· Name, SSN, date and place of birth, and citizenship of the employee intending to visit

· Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date, adjudication date & agency, and IT access level)

· Name of COR/Alt COR

· Dates or period the VAL is to be valid

11.6 Security Contacts. DISA Security Personnel can be contacted for Industrial or Personnel Security related issues at (301) 225-1235 or via mail at:

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

Name: Stasist Scott Phone Number: 667-891-4909 E-mail: stasist.a.scott.civ@mail.mil

11.7 Information Security and other miscellaneous requirements.

11.7.1 Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the government facility.

11.7.2 Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be caused for removal and the contractor will not be able to provide service on this contract.

11.7.3 Contractor employees with an incident report in JPAS who have had their access to classified suspended will not be permitted to fill positions requiring access to classified information on a DISA contract.

11.7.4 The Contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

11.7.5 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

11.7.6 Contractor personnel will generate or handle documents that contain For Official Use Only information at the Government facility. Contractor personnel will have access to, generate, and handle classified material up to Top Secret only at the location(s) listed in the place of performance section of this document. All contractor deliverables shall be marked in accordance with DoDM 5200.01, Vol. 3, Vol. 4, Information Security, DoDM 5400.07, Freedom of Information Act Program, unless otherwise directed by the Government. The contractor shall comply with the provisions of the DoD Industrial Security Manual for handling classified material and producing deliverables. The contractor shall comply with DISA Instruction 630-230-19, Cybersecurity.

11.7.7 The Contractor shall afford the Government access to the contractor’s facilities, installations, operations, documentation, databases and personnel used in performance of the contract/order. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of data or to the function of information technology systems operated on behalf of DISA or DoD, and to preserve evidence of computer crime.

12. Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government-Furnished Information (GFI). The Government will provide necessary equipment for on-site support, including office space, telephones, computers, and various tools. The Government will also provide software licenses for Riverbed, The Government will retain title to all GFI. Additionally, the Government will place restrictions on the use of the GFI pursuant to the Defense Federal Acquisition Regulation Supplement (DFARS) 252.227-7025.

A GFP will be provided for this contract as indicated in the GFP attachment included at solicitation, distributed at award and incorporated via the GFP Module in PIEE. GFP shall be managed IAW the terms of FAR 52.245-1, corresponding GFP DFARS clauses and additional DITCO Instructions incorporated in award.

Contractors shall accept and/or report provided GFP via the Shipping and Receiving document in the GFP module upon acceptance and/or IAW Additional DITCO Instruction H9. Serially managed items are provided to the contractor by DoD and require all events identified in DFARS 252.245-7005 (and/or any subsequent DFARS or Agency GFP reporting requirements) to be reported by the contractor.

Contractors in possession of GFP shall provide the COR or PA an annual report of all GFP in its possession to include the item description, make, model, serial number, IUID, and last inventory date; the report should be minimally provided on an annual basis and 30 days prior to the expiration of any performance period (base and options) IAW with Additional DITCO Instruction H9.

Deliverable:

*Standard Distribution: 1 copy of the transmittal letter with the deliverable to the Primary COR.

13. Other Pertinent Information or Special Considerations.

a. Identification of Possible Follow-on Work. Not Applicable.

b. Identification of Potential Conflicts of Interest (COI). Not Applicable.

c.…