Draft PWS SIS-Helpdesk Recompete .docx

Spectrum Information Systems (SIS) Helpdesk Spectrum Information Systems (SIS) Helpdesk

PERFORMANCE WORK STATEMENT (PWS)

Award

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title. Spectrum Information Systems (SIS) Helpdesk

3. Background. The Defense Information Systems Agency (DISA) Spectrum Information Systems (SIS) Helpdesk provides support for the warfighter and facilitates the spectrum management community’s business processes. The SIS Helpdesk provides Tier II technical, administrative, and Electromagnetic Spectrum (EMS) operational support at the basic and advanced level for capabilities within the Global Electromagnetic Spectrum Information System (GEMSIS) program portfolio of applications on Secret Internet Protocol Routing network (SIPRNet) and Non-Classified Internet Protocol Routing network (NIPRNet). The GEMSIS portfolio includes Spectrum Twenty-One (SXXI), End to End Supportability System (E2ESS), Joint Spectrum Data Repository (JSDR), Joint Spectrum Interference Resolution Online (JSIRO), and JSDR Strategic Planning and Analysis Dashboard Extensions (JSPADE). Many of these tools are accessed via the Integrated Spectrum Desktop (ISD) landing page which provides access to federated spectrum services. Users of GEMSIS products and services initially seek technical and administrative assistance through DISA Global Service Desk (GSD) Tier I Helpdesk. Support requests that cannot be satisfied by GSD Tier I Helpdesk are escalated to the SIS Tier II Helpdesk. Similarly, Tier II requests that cannot be satisfied with the SIS Helpdesk are elevated to Tier III provided by the application developer. All tiers utilize the points of contact (POCs) identified in SIS literature (e.g., SIS webpage, brochures) which are then routed to the SIS Helpdesk for Tier II support.

These disparate efforts call for personnel with experience with the SIS GEMSIS portfolio of applications to provide Tier II support for all spectrum operations, elevate unresolved issues to the next level of support (Tier III), and track the progress of Tier II/Tier III trouble tickets utilizing the DISA GSD IT Service Management Plus (GSD ITSM+) request and incident management system and provide feedback to the users. GEMSIS applications include:

E2ESS – Provides spectrum supportability services to enable DoD equipment spectrum certification process and host nation coordination. It facilitates warfighter deployment and communications by providing worldwide visibility of host nation RF spectrum dependent systems (SDS) supportability status.

JSDR – Provides a comprehensive repository of trusted DoD, national, and international spectrum-related information for equipment parametric, tactical, space, certification, assignment, Electronic Order of Battle (EOB), and spectrum license data up to the Secret level.

JSPADE – Provides a dashboard for visualization and strategic EMSO analysis.

SXXI – Provides frequency managers with a single information system that addresses spectrum management automation requirements. Supports DOD planning and operations with frequency management workflow capabilities, Radio Frequency (RF) engineering analyses, data validation, regulatory compliance checks and visualization tools.

GEMSIS applications are fielded on NIPRNet and SIPRNet although not all applications are installed on both networks. The approximate number of users varies by application and security domain. Table 1 provides a monthly estimate of user accounts and helpdesk requests by tier.

Table 1- Approximate Monthly Support Requests

4. Objectives: The objective of this contract/task order is to provide SIS Tier II Helpdesk technical, administrative, EMS operational support at the basic and advanced level for capabilities within the GEMSIS portfolio of applications on SIPRNet and NIPRNet. Support shall be provided between core hours with personnel located at the place or places of performance as specified in section 9. SIS Tier II Helpdesk personnel shall coordinate with DISA GSD Tier I team and software application development personnel to support Tier III problem resolution and document support requests using the existing DISA GSD ITSM+ request and incident management system. Performance measurements shall meet the metrics established in the Quality Assurance Surveillance Plan (QASP).

5. Scope. The contractor shall provide Tier II technical, administrative, and EMS operational support for the GEMSIS portfolio of applications according to the following task areas requirements described within this PWS. The task areas are as follows:

· Task Area 1 – Transition Phase-in / Phase-out Plan

· Task Area 2 – Task Order Management

· Task Area 3 – Spectrum Tools Support

· Task Area 4 – Frequency Resource Record System (FRRS) Transactions

The contractor shall provide Technical Tier II and Subject Matter Expert (SME) personnel to support operational spectrum management capabilities to support GEMSIS capabilities and any modernized/extended versions of these capabilities using the DISA ITSM+ request and incident management system.

The contractor shall provide support for FRRS transactions process of frequency assignment records/transactions in coordination with the National Telecommunication and Information Administration (NTIA) to support the management of FRRS and Government Master File (GMF) frequency record assignment databases.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 10% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

6. Performance Requirements. Successful completion of the tasks and delivery of the associated deliverables defined in this PWS are critical to meeting the Government's objectives. This Performance Requirements section details the tasks and the associated deliverables with due dates by which the Contractor's deliverables will be judged.

6.1 Task 1 – Transition Phase-in / Phase-out Plan (O&M, FFP)

The contractor shall provide a Transition Phase Plan, which should include transition phase-in plan and transition phase-out plan as part of their proposal, detailing contractor tasks, task dependencies, methodologies, and milestones during the seven (7) day transition phase-in period. The transition phase-in plan shall include a description of the overall cutover strategy, call management and other IT activities being conducted by the contractor, and target dates for attaining contractor staffing levels that shall be capable of supporting SIS operations. During the last two months of this task order, the contractor shall Phase-Out according to their “Transition Phase-Out Plan” to ensure the services required under this contract are continued without interruption and maintained at the required level of proficiency.

To perform under 6.1 Task 1, the contractor shall be qualified to perform duties aligning with an identified Cybersecurity Work Role as defined in DoDD 8140.01 and DoD 8140.03. To meet baseline qualification requirements for the assigned work role (e.g., as an IAT Level II equivalent), the contractor must possess and maintain a DoD-approved baseline certification in accordance with DoD 8140 policy. At a minimum, this requires a current and valid CompTIA Security+ CE certification, or an equivalent DoD-approved certification as outlined in the DoD 8140 Workforce Framework.

6.1.1 Subtask 1 Transition Phase-in Plan

The transition phase-in plan shall include a description of the overall cutover strategy, call management and other IT activities being conducted by the contractor, and target dates for attaining contractor staffing levels that shall be capable of supporting SIS operations.

6.1.2 Subtask 2 Transition Phase-out Plan

The contractor shall take all actions necessary to ensure there is no break in service during the transition between the incumbent contractor and any successor contractor during the phase out. The transition shall be handled with minimal disruption to the customer.

6.1.3 Subtask 3 Contract Records Transfer

The contractor shall electronically transfer to the successor contractor any contract records to include historical information that may assist the successor contract in a smooth transition.

Deliverables:

Table 2- Deliverables Task-1

PWS

Task#

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.2 Task 2 – Task Order Management (O&M, FFP)

The successful execution of this PWS hinges on effective staffing and program management. The Contractor shall proactively manage all aspects of the program, including planning, execution, monitoring, controlling, and closure, in accordance with industry best practices. This includes, but is not limited to, providing oversight, establishing and maintaining adequate level of support, actively managing risks and issues, tracking progress against defined metrics and deliverables, ensuring effective communication with all stakeholders, and adhering to the highest standards of quality. Regular progress reporting, participation in program reviews, and proactive problem-solving are essential for ensuring the successful and timely completion of work.

The contractor shall participate in a Program Orientation and Kickoff Meeting within 15 working days of award. The Government will conduct the meeting to review and discuss items such as task order administration, Government Furnished Information (GFI), onboarding personnel, and invoicing. The Contractor shall prepare a presentation that addresses transition, introduces personnel, transition risks, and areas where Government support may be necessary.

The contractor shall staff this task order with an appropriate number of qualified resources to satisfy the contract/task order objectives. Personnel should be organized to efficiently share the workload, promote effective communications and knowledge transfer. The following Key Personnel are required in addition to personnel the contractor deems necessary to provide quality support. The contractor shall fill key positions with individuals who meet or exceed the qualifications specified in this PWS. Resumes are required for key personnel as part of their Technical/Management Proposal. The contractor may provide the resumes of additional candidates proposed to start on day one of the contract. The following Government-determined Key Personnel positions, one of which must be designated as the site lead, are deemed critical to perform successfully on this contract/task order:

· SME – FRRS Transactions

The contractor shall keep one additional employee cross trained in FRRS Transations All key personnel/key positions must be onboard at start of the performance period. Overall, if other personnel are proposed 50 percent of total staffing must be completed within two weeks of the start of the performance period and 100 percent within 30 days.

Due to the nature of services to be provided it is necessary that personnel be experienced and knowledgeable in the field of spectrum management tools operational support and incident management. At a minimum, the personnel shall possess the following education and/or experience requirements based on position description.

6.2.1 Subtask 1

Contractor shall prepare a Task Order Management Plan describing the technical approach; spend plan, organizational resources and management controls to be employed to meet the cost, performance and schedule requirements throughout contract execution.

6.2.2 Subtask 2

Contractor shall provide a monthly status report monitoring the quality assurance, progress/status reporting and program reviews applied to the contract/task order. The monthly status report shall cover all aspects of quality, resource utilization, and funding/invoicing. The contractor shall make COR requested changes to the monthly status report within five business days. All changes to the monthly status report must be finalized and approved by the Government prior to conducting the monthly status report. The contractor shall document all issues and risks in the monthly status report that could cause problems with the operational support, or the operational availability of the web applications. Issues and risks shall include probability, consequences, and mitigation approach information. Non-Disclosure Agreements (NDAs) shall be required by all personnel performing on all awarded task orders. The contractor is responsible for identifying that all personnel, to include any new personnel on the contract and task orders, have executed the DISA provided NDA as early as possible or before personnel have access to any contract related information. The contractor shall track and provide an updated list of NDAs for every monthly status report. The contractor shall report on the status of staff completion of DISA mandatory training. This shall support all tasks in this effort.

Deliverables:

Table 3- Deliverables Task-2

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.3 Task 3 - Spectrum Tools Support (O&M, FFP)

Contractor shall provide subject matter expertise, Tier II technical support, validate operational issues with system requirements, provide on-the-spot training/assistance and test support as required for the SIS GEMSIS spectrum management tools including SXXI, E2ESS, JSIRO, JSDR, and ISD. If contractor personnel are unable to correct the issue, they shall elevate the incidents to the appropriate system administrator within the SIS GEMSIS program office to take further action for Tier III technical support and notify the Government program managers and users as such. If contractor personnel receive requests unrelated to GEMSIS applications, they shall redirect the customer to the appropriate point of contact or notify the Government program office. Under 6.3 Task 3, the contractor shall:

· Create a monthly incident report or matrix and update Tier II incident tickets utilizing the DISA ITSM+ request and incident management system as required. The ITSM+ system is provided by the Government through DISA Global Service Desk (GSD) program management office. The monthly incident report or matrix shall include information as indicated in table 4 below. The report content is subject to change as Government requirements evolve though the content should not change significantly.

· Forward unresolved issues/incidents as necessary to the next appropriate level

· Update and close incident tickets as issues are resolved and notify the users as such

· Provide support to DISA GSD Tier I team for SIS Helpdesk incident management process improvement, SOPs, metrics, education, and training as needed.

· Prepare and Practice Continuity of Operations Plan (COOP) procedures in the event spectrum tools support operations need to be relocated to an undisclosed location. Plan for one (1), five (5) day COOP event per contract year at a location within a three (3) hour drive distance from primary place of performance.

· Identify requirements and procedures necessary to COOP to an undisclosed location.

· Document processes to COOP to an undisclosed location.

· Provide spectrum tools support within three (2) business days of arriving at COOP location.

To perform under 6.3 Task 3, the contractor shall be qualified to perform duties aligning with an identified Cybersecurity Work Role as defined in DoDD 8140.01 and DoD 8140.03. To meet baseline qualification requirements for the assigned work role (e.g., as an IAT Level II equivalent), the contractor must possess and maintain a DoD-approved baseline certification in accordance with DoD 8140 policy. At a minimum, this requires a current and valid CompTIA Security+ CE certification, or an equivalent DoD-approved certification as outlined in the DoD 8140 Workforce Framework.

Note: Government will provide initial tools capabilities training to ensure contractor personnel is equipped with specific skillset to provide Tier II support under this task for any new spectrum tools added to the contract. The schedule, training material, training format, and duration of training will be decided upon by the Government at the time of contract award.

Table 4 – Monthly Incident Report/Matrix

Deliverables:

Table 5- Deliverables Task-3

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.4 Task 4 – FRRS Transactions (O&M, FFP)

Contractor shall update and process the FRRS frequency assignment data for the Armed Services which includes the Army, Navy, Air Force, Marines, as well as the US Coast Guard. The contractor shall process approximately 4,000 – 10,000 frequency assignment transactions per month for FRRS users. In addition, the contractor shall transfer data that requires approval from the National Telecommunications and Information Agency (NTIA) within one working day. Contractor shall support the detailed account of daily frequency assignment transaction processing required; prepare and practice COOP procedures as:

· Convert incoming data to NTIA format, and forward proposals to NTIA for processing

· Transfer Frequency Assignment Subcommittee (FAS) proposal voting status data from NTIA and update the FRRS proposals with the latest status

· Transfer FAS agenda records from NTIA and update the FRRS

· Export Directives from the FRRS and transfer them to NTIA for processing

· Transfer assignments from NTIA and process data to the DoD master Frequency Assignment database.

· Coordinate with FRRS users to resolve data input problems

· Maintain the status of transactions through automated and manual logs to ensure data record accountability during the processing cycle

· Prepare and Practice COOP procedures in the event FRRS transactions need to be relocated to an undisclosed location. Plan for one (1), five (5) day COOP event per contract year at a location within a three (3) hour driving distance from the primary place of performance.

· Identify requirements and procedures necessary to COOP to an undisclosed location

· Document processes to COOP to an undisclosed location

· Process FRRS transactions within three (3) business days of arriving at COOP location to perform under Task 5, contractor shall be IA designated personnel at IAT Level II and is required to maintain DoD 8140 Information Assurance (IA) baseline certification active. At the minimum, contractor shall have Security+ CE.

Deliverables:

Table 6- Deliverables Task-4

PWS

Task#

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

7. Performance Standards.

The primary method of surveillance for deliverables will be in accordance with table 7-Performance Standards. Quality Assurance Surveillance Plan (QASP) will be used by the COR to ensure that the contractor’s performance is effectively monitored and documented, and that contractor complies with contractual requirements. All reports shall meet the following criteria:

Table 7- Performance Standards

6.1 Task 1 -

Transition Phase –In/ Transition Phase – Out Plan

Target Criteria:

100% of all deliverables provided by the date specified in the task order.

Deliverables are submitted with zero defects, omissions, and mistakes.

Minimum Acceptable:

>/= 95% of all deliverables be delivered on time.

Deliverables are submitted with 5% or less defects in completeness.

Required revisions are resolved within one week and accepted by the COR.

Periodic Inspection.

The total number of deliverables provided In Accordance With (IAW) the PWS listed date divided by the total number of deliverables due under task order.

6.2 Task 2 –

Task Order Management Target Criteria:

Deliverables are submitted with zero defects, omissions, and mistakes.

Minimum Acceptable:

>/= 95% of all deliverables be delivered on time.

Deliverables are submitted with 5% or less defects in completeness.

Required revisions are resolved within one week and accepted by the COR.

The total number of deliverables provided In Accordance With (IAW) the PWS listed date divided by the total number of deliverables due under task order.

6.3 Task 3 -

Spectrum Tools Support

Target Criteria:

Deliverables are submitted with zero defects, omissions, and mistakes. This Target Criteria also applies to spectrum tools support provided to the customer. The due dates of customer support will be contingent upon the level of support needed.

Minimum Acceptable:

>/= 95% of all deliverables be delivered on time.

Deliverables are submitted with 5% or less defects in completeness.

Required revisions are resolved within one week and accepted by the COR.

Periodic Inspection of monthly incident reports for accuracy and completeness.

Customer Feedback based on the spectrum tools support provided by the contractor.

The total number of deliverables provided In Accordance With (IAW) the PWS listed date divided by the total number of deliverables due under task order. This applies to monthly incident reports/matrix.

6.4 Task 4 -

FRRS Transactions

Target Criteria:

Deliverables are submitted with zero defects, omissions, and mistakes. This Target Criteria also applies to customer support provided for FRRS transactions. The due dates of customer support will be contingent upon the level of support needed.

Minimum Acceptable:

>/= 95% of all deliverables be delivered on time.

Deliverables are submitted with 5% or less defects in completeness.

Required revisions are resolved within one week and accepted by the COR Periodic Inspection of monthly FRRS reports which shall include monthly FRRS transactions processed categorized by the military department/s.

Customer Feedback.

The total number of deliverables provided In Accordance With (IAW) the PWS listed date divided by the total number of deliverables due under task order.

8. Incentives.

This contract is a Firm-Fixed-Price (FFP) requirement. Performance will be documented in the Contractor Performance Assessment Reporting System (CPARS).

· Positive Incentives:

· Exercise of contract option period(s).

· Quality services accepted by the Government, allowing the contractor to invoice for services rendered.

· Positive CPARS.

· Negative Incentives:

· Negative CPARS.

· If overall performance is unacceptable, the Government will not exercise the remaining contract option period(s).

· Letters of concern, show cause letters, cure notices, and contract termination.

· When unacceptable performance occurs, withholding of payment for services until corrective action is taken.

· As a part of the closeout process, the contractor shall, within seven (7) days before the final day of performance, turn over all equipment, reports, and data, either received or generated during the performance of the contract. Failure to meet at this requirement at contract closeout assesses a 10% withholding of final payment until this action is completed.

9. Place of Performance.

Work is to be performed on-site at the specified mission location listed below, at an alternate work site, at the contractor’s facilities, or at any other designated location(s). Unclassified work may be performed at both the contractor and Government facilities. Classified work shall be performed at the Government facilities.

Government Facilities (Mission Locations):

1. PEO Spectrum 2004 Turbot Landing, Annapolis, MD 21402

2. DISA Headquarters 6910 Cooper Ave, Ft. George G. Meade, MD 20755

Alternative work sites allow for regular telework or remote work flexibilities and may be applicable. Regardless of where work is performed, the contractor shall ensure that work is completed effectively and that mission needs and requirements are met, without degradation of services. Also, the contractor may be required to account for the physical location of their personnel should this information be requested. The contractor shall propose Government site rates for all work performed at an alternative work site. Incidental charges incurred while working at an alternative work site (e.g., electricity, internet) are not allocable to the contract and associated task orders and shall not be billed to the Government.

All local travel is defined as travel within fifty miles of the contractor’s primary place of performance. Local travel will not be reimbursed. Long distance travel within Continental United States (CONUS) may be required to support the requirements of this PWS. Long-distance travel within CONUS shall be planned and conducted in support of the individual tasks contained in the contract. Long distance travel must be pre-approved in writing by the COR prior to the contractor incurring the cost in support of the applicable task order.

Secondary Place of Performance – Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at a secondary place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather). Additionally, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

10. Period of Performance.

The period of performance for this contract is one 12-month base period plus four one-year option periods, excluding any potential extension under FAR 52.217-8.

Base Period: Award +364

Recognized Federal Holidays: The contractor is not required to perform services on Federal Holidays (as specified on the U.S. Office of Personnel Management website), unless otherwise specified by the COR.

Unplanned Federal Government Closure: In the event an authorized official, by either executive or legislative order, declares Federal offices closed (treated as a holiday for pay and leave purposes), the order only applies to Federal employees (unless otherwise stated in the order).

11. Security Requirements.

This section supplements Block 13 of the Government provided DD Form 254, Contract Security Classification Specification. The following security requirements shall apply to this effort.

The contractor shall coordinate visits with site Point of Contract (POC)s providing at least a 72-hour notice (or according to each site security requirements) prior to any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by cleared DISA personnel (civilian, military, or contractor).

References:

a. DISA End User Access Agreement

b. DISA Instruction 240-240-01, External Peripheral Devices Authorized for Network Connectivity

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-34, Controlled Unclassified Information (CUI)

e. DISA Instruction 240-110-36, Personnel Security

f. DISA Instruction 240-110-38, Industrial Security

g. DISA Instruction 240-110-43, Counterintelligence

h. DISA Instruction 240-110-43, Insider Threat Program

i. DISA Instruction 630-230-19, Cybersecurity

j. DoD Manual 5200.01, Vol. 1 and 3, DoD Information Security Program, 17 January 2025

k. DoD Manual 5200.01, Vol. 2, DoD Information Security Program, 28 July 2020

l. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

m. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP), 3 April 2017, Change 1, 29 October 2020

n. 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM), 24 February 2021

o. DoD Directive 5240.06, Counterintelligence Awareness and Reporting (CIAR), 17 May 2011, Change 3, 31 August 2020

p. DoD Instruction O-5240.24, Counterintelligence (CI) Activities Supporting Research, Development, and Acquisition (RDA), 8 June 2011, Change 2, 15 July 2020

q. DoD Instruction 5205.16, “The DoD Insider Threat Program,” December 20, 2024

r. DoD Instruction 5230.24, Distribution Statements for DoD Technical Information, 10 January 2023

s. DoD Instruction 8510.01, Risk Management Framework for DoD Systems, 19 July 2022

t. DoD Manuel 5400.07, DoD Freedom of Information Act (FOIA) Program, 25 January 2017

u. Security Executive Agent Directive 3 (SEAD 3) Reporting Requirements for Personnel With Access To Classified Information or Who Hold Sensitive Position, 12 June 2017

v. Security Executive Agent Directive 4 (SEAD 4), National Security Adjudicative Guidelines, 8 June 2017

w. DISA Instruction 240-15-4 United States Security Authority for North Atlantic Treaty Organization Affairs

x. DoD Manual 5205.07 Special Access Program Security Manual, 17 January 2025

11.1 Facility Security Clearance. Work performed under this contract/order is up to the Secret level. Therefore, the company must have a final Secret Facility Clearance from the Defense Counterintelligence and Security Agency (DCSA) Facility Clearance Branch.

11.1.2 Invalidated Facility Clearance. Companies with invalidated facility clearances (including those in partnerships, subcontracts, and Joint Ventures) are not eligible to bid on or be awarded any new or additional DISA classified contracts, subcontracts, or receive additional classified information except for information necessary for the completion of your current classified contracts. In addition, those companies with invalidated facility clearances will not be permitted access to all DISA networks. Performance on any DISA classified contracts, at any location, will not be authorized until it has been granted a Facility Security Clearance (FCL) at the appropriate level by DCSA.

11.2 Security Clearance. All personnel performing on or supporting a DISA contract/order in any way shall be United States citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance eligibility delineated in the table below when performance starts.

6.1 Task 1

6.2 Task 2

6.3 Task 3

6.4 Task 4

Security clearance levels required:

(6) SECRET

6.2 Task 2: Access to NIPRNet is required to support administrative functions such as monthly status reports, invoices submission, contract management reviews, and upload of mandatory training certificates.

6.3 Task 3: Access up to and including NATO SECRET is required to perform under this task because PEO Services’ databases include NATO information. The access is required to manage and document trouble/incident tickets with regards to EMS tools and generate incident matrix reports for the Government.

6.4 Task 4: Access up to and including NATO SECRET is required to provide EMS tools subject matter expertise and senior database administration support to process Frequency Resource Records Management (FRRS) transactions with the NTIA.

11.3.1 Investigation Requirements. All personnel requiring Secret access under this contract/order shall undergo a favorably adjudicated Tier 3 (T3) Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. Enrollment into Continuous Evaluation current within 5 years and, reflected in DISS, would meet the requirement for current PR.

11.3.2 The contractor is required to have personnel cleared with an interim or final Secret (as specified in the table located in section 11.2) at contract start date. If contractor personnel are replaced during performance of the contract, replacement personnel should also have interim or final clearance Secret (as specified in the table located in section 11.2).

11.4 Visit Authorization. Visit requests shall be processed and verified through the DISS to the Security Management Office (SMO) DKABAA10 for DISA HQs and DKAUAA – JOINT SPECT CTR-123 for the DISA PEO Services. DISS visits for contracts/orders are identified as “Other” or “Temporary Additional Duty (TAD)/Temporary Duty (TDY)” and will include the Contract/Order Number of the contract/order in the Additional Information section. Contractors that do not have access to DISS may submit visit authorizations by e-mail in a password protected portable document format file (.pdf) to the COR/ACOR specified in PWS/SOW Section 1.0.

*Prior coordination with the DISA COR should be made via email to ensure the Visit Authorization Letter (VAL)/ Visit Authorization Request (VAR)/ Visit Termination Notification (VTN) process is agreed upon and properly secure.

11.4.1 VAR Package. VAR Centers must receive VAR packages from the Security Manager (via email and require pre-approval from the assigned DISA COR) at a minimum of five business days in advance of the initial report date or renewal. For option years, VARs should be renewed 30-90 days prior to the expiration date unless modified sooner for changes such as name, COR/sponsor, contract modification, etc. As an option, a VAR can be approved for up to a maximum of three (3) years within the POP for contractors. The VAL/VAR/VTN should be sent via email to the appropriate COR. The VAL/VAR/VTN should be sent using in a locked “Zip” file in one e-mail and then followed up by another e-mail with the password to unlock the Zipped file, because it contains sensitive information covered by the Privacy Act.

Documents to include in the VAR Package (DISA Field Sites may have site specific VAR requirements):

1. Inter-office Memorandum (IOM)

2. DD Form 254 Prime and/or Sub (Good Standing approval emails for current option year)

3. PWS/SOW/Sub Memo

4. DISS verification of Visit Authorization by Security Manager

5. (Optional: see NOTE below) Contractor VAL signed by the Contractor Facility Security Officer (FSO)

NOTE: If DISS is not available, the VAL must contain the following information on company letterhead:

· Company name, address, telephone number, facility security clearance

· Commercial and Government Entity Code (CAGE CODE)

· Contract/Order Number

· Name, Social Security Number (SSN), date and place of birth, and citizenship of the employee intending to visit, email address, and phone number

· Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date and adjudication date & agency)

· Name of COR/Alt COR

· Dates or period the VAL is to be valid (i.e., Start date / End date)

11.4.2 VTN Package. The Contractor FSO will forward a VTN letter to the DISA COR identified in the PWS/TO/Sub for all employees leaving the contract/task order/subcontract.

11.4.2.1 In addition, the DISA CORs and security managers shall inform the DISA Security Office when contractor personnel are removed for cause from a contract supporting DISA. This step is to identify contractor personnel removed for security related issues in case of a return to DISA without appropriate vetting. This step will also provide security with pertinent information to make an informed decision regarding potential contractor employees’ access to secure facilities and sensitive information. “For Cause” is information regarding an individual that falls into one or more of the actions or incidents that are within one of the 13 adjudicative guidelines as cited in the Security Executive Agent Directive (SEAD) 4:

a. Allegiance to the United States

b. Foreign Influence

c. Foreign Preference

d. Sexual Behavior

e. Personal Conduct

f. Financial Considerations

g. Alcohol Consumption

h. Drug Involvement and Substance Misuse

i. Psychological Conditions

j. Criminal Conduct

k. Handling Protected Information

l. Outside Activities

m. Use of Information Technology Other actions:

• Incidents involving violence in the workplace or harassment.

• Misuse of time.

• Inspector General or General Counsel related inquiries.

• Failure to comply with security policies and procedures.

• Other reasons that prompted removal of a contractor.

The VTN must contain the following information on company letterhead:

· Company name, address, telephone number, facility security clearance

· CAGE CODE

· Contract/Order Number

· Name, SSN, date and place of birth, and citizenship of the employee, email address, phone number

· Date contractor Common Access Card (CAC) was collected

· Name of COR/Alt COR

· Termination Date

· Reason for Termination: <insert reason from the 13 adjudicative guidelines, other actions, or type “No longer working on contract”>

*Any VAL/VAR submitted without the above information will be denied.*

11.5 Security Contacts. DISA Security Personnel can be contacted for Industrial or Personnel Security related issues at the following:

Defense Information Systems Agency

Defense Information Systems Agency

ATTN: J-16, Industrial Security

ATTN: J-16, Personnel Security

Command Building

Command Building

6910 Cooper Ave.

6910 Cooper Ave.

Fort Meade, MD 20755-7088

Fort Meade, MD 20755-7088 disa.meade.j1.mbx.mp6-industrial-security@mail.mil disa.meade.j-1.list.mp6-personnel-security@mail.mil

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

Name: Michael Wilson Phone Number: (410) 919-2712 E-mail: michael.wilson99.civ@mail.mil

11.6 Information Security and other miscellaneous requirements.

11.6.1 Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the Government facility.

11.6.2 Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract/order.

11.6.3. Contractor employees with an incident report in DISS who have had their access to classified suspended will not be permitted to fill positions requiring access to classified information on a DISA contract/order.

11.6.4 The Contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

11.6.5 The authority for the contractor personnel to regain access must be granted by DISA Chief of Security.

11.6.5.1 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

11.6.5.2 DISA retains the right to revoke access to DISA facilities and networks from contractor personnel who violate one or more of the National Security Adjudicative Guidelines, harassment, insider threat, counterintelligence, or violence in the workplace while assigned to a contract clearly conflict with the interest of the Government.

11.6.5.3 If contractor employee is accused of violating state or federal laws and/or Government professional conduct policies or regulations, then the Government may require that such contractor employee be removed from Government premises and/or that such contractor employee be removed from supporting this contract, pending the duration and outcome of a Government investigation if the Contracting Officer finds that the conduct or violation alleged has the potential to negatively interfere with contract performance or operations at a Government facility. Only the Contracting Officer can make such a request on behalf of the Government. Removal of contractor employees shall not negatively impact contract performance.

11.6.6 Contractor personnel will generate or handle documents that contain Unclassified or Controlled Unclassified Information (CUI) at the Government and/or contractor facility. Contractor personnel will generate or handle documents that contain Proprietary, Contract Sensitive, or similarly designated information at the Government and/or contractor facility. Contractor personnel will have access to, generate, and handle classified material up to SECRET level only at the Government location(s) (Ref: Block 8 Place of Performance on DD254) and listed in the place of performance section of this document. All contractor deliverables shall be marked in accordance with DoDM 5200.01, Vol. 2, DoD Information Security Program: Marking of Information; DoDI 5200.48, Controlled Unclassified Information (CUI); and DoDM 5400.07, Freedom of Information Act Program, unless otherwise directed by the Government. The contractor shall comply with the provisions of 32 CFR Part 117, “National Industrial Security Program Operating Manual (NISPOM)” for handling classified material and producing deliverables. The contractor shall comply with DISA Instruction 630-230-19, Cybersecurity.

11.6.7 The Contractor shall afford the Government access to the contractor’s facilities, installations, operations, documentation, databases and personnel used in performance of the contract/order. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of data or to the function of information technology systems operated on behalf of DISA or DoD, and to preserve evidence of computer crime.

11.6.8 Foreign Travel Requirements: DISA Contractors are required to submit their official and unofficial foreign travel and foreign contacts via the Corporate Management Information Systems (CMIS) which may require a dual reporting requirement in accordance with DISA Instruction 240-110-35; DISA Instruction 240-110-43; Security Executive Agent Directive 3 (SEAD 3) Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position.

11.6.9 Mandatory Security Training. All DISA Contractors are required to complete the DoD initial and annual security training for the following in accordance with (IAW) 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM):

· Security Awareness

· Level I Antiterrorism Awareness

· Derivative Classification

· Controlled Unclassified Information (CUI)

· Operational Security (OPSEC) Awareness for Military Members, DoD Employees, and Contractors

· DISA Counterintelligence and Awareness Reporting (CIAR) training IAW DISA Instruction 240-110-43 Counterintelligence; DoDD 5240.06 Counterintelligence Awareness and Reporting (CIAR); and DoDI O-5240.24 Counterintelligence (CI) Activities Supporting Research, Development, and Acquisition (RDA).

· DISA Insider Threat Awareness: Contractors supporting DISA are required to complete the DISA Annual Insider Threat Awareness Training through the DISA Virtual Campus IAW the standards in DoD Instruction 5205.16, “The DoD Insider Threat Program,” December 20, 2024, regardless of insider threat awareness training provided by their employer.

11.6.9.1 Contractors supporting DISA onsite are required to complete the DoD initial or annual training through the DISA mandatory training system.

11.6.9.2 Contractors supporting DISA offsite are required to meet the DoD initial or annual training requirement through their employers who are to provide this training and maintain training documentation. The contractor supervisor needs to certify in writing and email completion certificates to the COR and DISA Security Manager that off-site contractors completed the training before receiving credit. The DISA Security Manager will update CMIS records, if available.

12. Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government-Furnished Information (GFI).

A. GFP will be provided for this contract as indicated in the GFP attachment included at solicitation, distributed at award and incorporated via the GFP Module in PIEE. GFP shall be managed IAW the terms of FAR 52.245-1, corresponding GFP Defense Federal Acquisition Regulation Supplement (DFARS) clauses and additional DITCO Instructions incorporated in award.

Contractors shall accept and/or report provided GFP via the Shipping and Receiving document in the GFP module upon acceptance and/or IAW Additional DITCO Instruction H9. Serially managed items are provided to the contractor by DoD and require all events identified in DFARS 252.245-7005 (and/or any subsequent DFARS or Agency GFP reporting requirements) to be reported by the contractor.

Contractors in possession of GFP shall provide the COR or PA an annual report of all GFP in its possession to include the item description, make, model, serial number, IUID, and last inventory date; the report should be minimally provided on an annual basis and 30 days prior to the expiration of any performance period (base and options) IAW with Additional DITCO Instruction H9.

Deliverable:

*Standard Distribution: 1 copy of the transmittal letter with…