832571592 GTI PWS.pdf

HC102822F0532

PERFORMANCE WORK STATEMENT (PWS)

Award/Mod Effective Version Date Award

Contract Number: TBD Task Order Number: TBD Contractor Name TBD Tracking Number: TBD Follow-on to Previous Contract and Task Order Number:

NNG15SD80B/HC102822F0532

1. Contracting Officer’s Representative (COR).

a. Primary COR.

Name: David A. Holland Organization: Department of Defense (DOD) Cyber Defense Command

(DCDC)

Department of Defense Activity Address Code (DODAAC): HC1047

Address: 6910 Cooper Avenue Fort Meade, Maryland 20775 Phone Number: 301-225-2453 Fax Number: Not applicable (N/A) E-Mail Address: david.a.holland3.civ@mail.mil

b. Alternate COR.

Name: Felix W. Penn Organization: DCDC/JH4 DODAAC: Hc1047 Address: 6910 Cooper Avenue Fort Meade, MD 20755 Phone Number: 301-225-0813 Fax Number:

E-Mail Address: felix.w.penn.civ@mail.mil

c. Property Administrator.

Name: Jesse Collins Organization: DCDC/JH6

DODAAC: HC1047

Address: 6910 Cooper Avenue Fort Meade, MD 20755 Phone Number: 301-225-0832 Fax Number:

E-Mail Address: Jesse.r.collinsi.civ@mail.mil

2. Contract or Task Order Title: JFHQ-DODIN FireEye.

3. Background.

mailto:david.a.holland3.civ@mail.mil

The Department of Defense (DOD) Cyber Defense Command (DCDC) -Department of Defense Information Networks (DODIN) exercises command and control of DODIN operations and defensive cyber operations-internal defense measures (DCO-IDM) globally to synchronize the protection of Department of Defense (DoD) component capabilities and to enable power projection and freedom of action across all warfighting domains. The Command ensures a unity of command between United States Cyber Command and subordinate headquarters, and unity of effort with all other organizations conducting DODIN operations and DCO-IDM. JFHQ-DODIN improves the DoD’s Operational Effectiveness through leading unified actions that reduce vulnerabilities, eliminate threats, and defeat, deny, and disrupt attacks against the DODIN.

4. Objectives:

The objective of this requirement is to provide knowledgeable and skilled support for the Command’s cyber threat intelligence subscription with FireEye Inc. The goal is to obtain professional expert services that will ensure DCDC is efficient and utilizes the analysis to its full potential as it secures, protects and defends the DODIN.

5. Scope.

The scope of this requirement is to support the capability as acquired. The contractor shall integrate and coordinate all work requirements in this PWS. The contractor shall also be fully responsible and accountable for the quality and responsive support services accomplished whether performed by its own personnel or subcontractors. This support includes operating and maintaining functionality of the cyber threat intelligence subscriptions procured.

Under this effort, the contractor shall provide the Government with high-quality services in areas identified below.

The contractor shall support all DCDC Intelligence and Operation functions as necessary with Google Threat Intelligence (GTI) to include support to all subordinate units with information sharing.

6. Performance Requirements.

Top Secret, Top Secret SCI, NIPRNet SCI, SIPRNet, NON-SCI Intelligence information accesses are required to support:

Support will be required integrating data that resides both on NIPRNet, SIPRNet, and. Collaboration with Intelligence Agencies sharing information that contributes to the DCDC mission.

6.1 Task 1 - Intelligence Enablement Manager

6.1.1 Subtask 1 – The contractor shall provide dedicated on-site support to review the system for DCDC and DODIN Stakeholders-specific requests.

6.1.2 Subtask 2 – The contractor shall provide support to collect industry-specific analysis, such as case studies describing recent incidents at similar organizations, targeting trends across the industry, and new or expanded descriptions of FireEye’s knowledge of threat actors specifically targeting the DODand DODIN Stakeholders.

6.1.3 Subtask 3 – The contractor shall provide support to create threat analysis reports describing new or evolving threats tied to DODIN's and DODIN Stakeholders area of operations, partners, products, and services.

6.1.4 Subtask 4 - The contractor shall provide DCDC and DODIN Stakeholders support to develop threat landscape briefings providing situational awareness of current advanced persistent threat, financial, and hacktivists groups.

6.1.5 Subtask 5 - The contractor shall access and apply Google’s knowledge base to improve and enhance the DCDC's and DODIN Stakeholders threat intelligence.

6.1.6 Subtask 6 – The contractor shall respond to at least 10 requests for information per quarter, which will be submitted DCDC and DODIN Stakeholders, to request specific information from subject matter experts.

6.1.7 Subtask 7 - The contractor shall analyze daily Domain Name Server (DNS) activity passing through the DISA T1 boundary and provide additional insights into those domains based on their proprietary holdings.

6.1.8 Subtask 8 - The contractor shall provide Top Secret (TS) cleared personnel with Sensitive Compartmented Information (SCI) eligibility and favorably adjudicated Single Scope Background Investigations (SSBIs) at the time of the contract start date.

6.1.9 Subtask 9 – The contractor shall provide 24/7 Help Desk support at contractor’s facility.

6.1.10 Subtask 10 - The contractor shall provide unique insights, such as identifying anomalies and activities that have been previously unseen, provide understanding into the attacker’s tactics, techniques, and possible ongoing activity of the attacker, and information captured from incident responders from worldwide attacks that fuse the detection techniques from the company’s native data holdings; accessible on work site at DCDC.

6.1.11 Subtask 11 The contractor shall provide on-site support that covers Threat Intelligence Fusion, Threat Intelligence Fusion Limited Disclosure, Support Intelligence Coordination Limited Disclosure, and Advanced Intelligence Access.

Josephs, Matthew J CIV JFHQ-DODIN J3 (USA) I’m not sure what this means, not sure we need it

Deliverables:

PWS

Task#

Deliverable Title

Format Due Date Distribution/Copies Frequency and Remarks

6.1.1 Dedicated

On-site Support.

Government Determined Format.

90 calendar days after contract award.

Standard Distribution*.

Quarterly.

6.1.2 Industry

Specific Analysis.

Government Determined Format.

90 calendar days after contract award.

Standard Distribution*.

Quarterly.

6.1.3 Threat

Analysis Reports.

Government Determined Format.

90 calendar days after contract award.

Standard Distribution*.

Quarterly.

6.1.4 Threat

Landscape Briefings.

Government Determined Format.

90 calendar days after contract award.

Standard Distribution*.

Quarterly.

6.1.6 Request for

Information

Government Determined Format

90 calendar days after contract award.

Standard Distribution*.

Quarterly.

6.1.7 Analyze

Daily DNS Activity.

Government Determined Format.

30 calendar days after contract award.

Standard Distribution*.

Daily.

*Standard Distribution: One (1) copy of the transmittal letter without the deliverable to the Contracting Officer;

one (1) copy of the transmittal letter with the deliverable to the Primary COR.

6.2 Task 2 - Training

6.2.1 Subtask 1 - The contractor shall provide foundational training based on CTI tool/capability.

6.2.2 Subtask 2 - The contractor shall provide advanced training based on CTI tool/capability.

6.2.3 Subtask 3 - The contractor shall provide training opportunities to Government personnel at DCDC.

6.2.4 Subtask 4 - The contractor shall provide updated training to Government personnel at DCDC on tools and capabilities within 60 calendar days of new/updated tools and capabilities.

6.2.5 Subtask 5 - The contractor shall provide training to Government personnel at DCDC as needed.

Deliverables:

Deliverable Title

Format Due Date Distribution/Copies Frequency and Remarks

6.2.1 Foundationa

l Training.

Government Deter-mined Format.

90 calendar days after contract award.

Standard Distribution*.

Quarterly.

6.2.2 Advanced

Training.

Government Deter-mined Format.

90 calendar days after contract award.

Standard Distribution*.

Quarterly.

6.2.4 Updated

Training on Tools and Capabilities.

Government Deter-mined Format.

90 calendar days after contract award.

Standard Distribution*.

Quarterly.

*Standard Distribution: One (1) copy of the transmittal letter without the deliverable to the Contracting Officer;

one (1) copy of the transmittal letter with the deliverable to the Primary COR.

7. Performance Standards.

Performance Standard Acceptable Quality Level (AQL) Methods of Calculation

6.1 Task 1 Intelligence

Enablement Manager

90% of all survey respondents are Satisfied. More Than Satisfied, or Very Satisfied

Minimum Acceptable:

> 85% of all survey respondents are Satisfied, More Than Satisfied, or Very Satisfied with contractor delivery management of all IT Services.

Calculation:

The number of users who were Satisfied, More Than Satisfied, or Very Satisfied divided by the total number of completed surveys returned.

At least three (3) Government personnel must complete and return surveys for the results to have at least a 90% confidence factor with a five (5) percent error rate.

6.2 Task 2 Training 90% of all survey respondents are

Satisfied. More Than Satisfied, or Very Satisfied

Minimum Acceptable:

> 85% of all survey respondents are Satisfied, More Than Satisfied, or Very Satisfied with contractor delivery management of all IT Services.

Calculation:

The number of users who were Satisfied, More Than Satisfied, or Very Satisfied divided by the total number of completed surveys returned.

At least three (3) Government personnel must complete and return surveys for the results to have at least a 90% confidence factor with a five (5) percent error rate.

8. Incentives. N/A

9. Place of Performance. The primary place of performance will be the DISA Headquarters/DCDC located at 6910 Cooper Ave Fort Meade, MD 20755. Maximum number of Contractor seats available for this effort is 1 (space waiver tracking #TBD for Government use only)

*Classified or unclassified work may be performed at the Government locations.

Alternate Place of Performance - Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at an alternate place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, Government closure due to inclement weather, etc.).

Additionally, the contractor shall be required to account for the whereabouts of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed Government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources.

10. Period of Performance.

Base Period: MAY 13, 2026-MAY 12, 2027

OY1: MAY 13, 2027-MAY 12, 2028

OY2: MAY 13, 2028-MAY 12, 2029

OY3: MAY 13, 2029-MAY 12, 2030

One six-month extension, if exercised per FAR 52.217-8 dates: from <May 13, 2030> to <November 12, 2030>

11. Security Requirements.

This section supplements Block 13 of the Government provided DD Form 254, Contract Security Classification Specification. The following security requirements shall apply to this effort.

The contractor shall coordinate visits with site Point of Contract (POC)s providing at least a 72-hour notice (or according to each site security requirements) prior to any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by cleared DISA personnel (civilian, military, or contractor).

Josephs, Matthew J CIV JFHQ-DODIN J3 (USA) We no longer allow telework, so the provided analyst needs to be onsight and therefore we need to find a desk for them within the J32 section

References:

a. DISA End User Access Agreement, 11 February 2021

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-36, Personnel Security

e. DISA Instruction 240-110-38, Industrial Security

f. DISA Instruction 240-110-43, Insider Threat Program

g. DISA Instruction 630-230-19, Cybersecurity

h. DoD Manual 5200.01, Vol 1-3 Information Security Program, 24 February 2012

i. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

j. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

k. 32 CFR Part 117, “National Industrial Security Program Operating Manual (NISPOM)”, 24 February 2021

l. Security Executive Agent Directive 4, National Security Adjudicative Guidelines, 8 June 2017

m. DoDM 5400.07, Freedom of Information Act Program

n. DoDI 5230.24, “Distribution Statements for DoD Technical Information,” January 10, 2023

o. DoD Instruction 8510.01, “Risk Management Framework for DoD Systems,” July 19, 2022

p. DoD Manual 5105.21 Sensitive Compartmented Information Administrative Security Manual: Administration of Information and

Information Systems Security.

11.1 Facility Security Clearance. Work performed under this contract/order is up to the [Top Secret]level and will require Sensitive Compartmented Information (SCI) access eligibility for some personnel. Therefore, the company must have a final [Top Secret] Facility Clearance from the Defense Counterintelligence and Security Agency (DCSA) Facility Clearance Branch.

11.1.2 Invalidated Facility Clearance. Companies with invalidated facility clearances (including those in partnerships, subcontracts, and Joint Ventures) are not eligible to bid on or be awarded any new or additional DISA classified contracts, subcontracts, or receive additional classified information except for information necessary for the completion of your current classified contracts. In addition, those companies with invalidated facility clearances will not be permitted access to all DISA networks. Performance on any DISA classified contracts, at any location, will not be authorized until it has been granted a Facility Security Clearance (FCL) at the appropriate level by DCSA.

11.2 Security Clearance. All personnel performing on or supporting a DISA contract/order in any way shall be U.S. citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance eligibility delineated in the table below when performance starts.

PWS Task /

Subtask Clearance

Level Access Justification for Access to Classified

All Task Top Secret/ Top Secret

SCI

NIPRNet SCI, SIPRNet, NON- SCI Intelligence information

Top Secret, Top Secret SCI, NIPRNet SCI, SIPRNet, NON-SCI Intelligence information accesses are required to support: Support will be required integrating data that resides both on NIPRNet, SIPRNet, and. Collaboration with Intelligence Agencies sharing information that contributes to the JFHQ- DODIN mission.

11.2.1 Individuals supporting PWS Tasks / Subtasks that require(s) a final Top Secret security clearance will, immediately upon hire, require SCI access eligibility adjudicated by the Department of Defense (DoD) Consolidated Adjudication Facility or other federal adjudications facility to perform their duties. Processing for SCI eligibility will be coordinated with the supporting Government Security Manager and will begin immediately upon start of duty performance under this contract/order.

All SCI* work under this contract/order will be monitored by the COR/ACOR.

*The COR/ACOR must be indoctrinated into SCI to monitor the work.

11.3 Investigation Requirements. All personnel requiring Top Secret and SCI access under this contract/order shall undergo a favorably adjudicated Tier 5 (T5) investigation(formerly known as a Single Scope Background Investigation (SSBI)) as a minimum requirement. Enrollment into Continuous Evaluation current within 5 years and reflected in Defense Information System for Security (DISS), would meet the requirement for a current Periodic Reinvestigation

(PR).

11.3.2 The contractor is required to have personnel cleared with a final Top Secret (as specified in the table located in section 11.2) at contract start date. If contractor personnel are replaced during performance of the contract, replacement personnel should also have interim or final clearance Top Secret (as specified in the table located in section 11.2).

11.4 Visit Authorization . Visit requests shall be processed and verified through the DISS to Security Management Office (SMO) DKABAA10. (Include other DISS SMO codes as applicable. A complete list of DISA DISS SMO codes can be found at https://dod365.sharepoint-mil.us/Sites/DISA-Security/SitePages/Industrial-Security.aspx). DISS visits for contracts/orders are identified as “Other” or “TAD/TDY” and will include the Contract/Order Number of the contract/order in the Additional Information section.

Contractors that do not have access to DISS may submit visit authorizations by e-mail in a password protected .pdf to the COR/ACOR specified in PWS/SOW Section 1.0.

*Prior coordination with the DISA COR should be made via email to ensure the Visit Authorization Letter (VAL)/ Visit Authorization Request (VAR)/ Visit Termination Notification (VTN) process is agreed upon and properly secure.

11.4.1 VAR Package. VARs must be received via email and require pre-approval from the assigned DISA COR five business days in advance of the report date. The VAL/VAR/VTN should be sent via email to the appropriate COR. The VAL/VAR/VTN should be sent using in a locked “Zip” file in one e-mail and then followed-up by another e-mail with the password to unlock the Zipped file, because it contains sensitive information covered by the Privacy Act.

Documents to include in the VAR Package:

1. Inter-office Memorandum (IOM)

2. DD Form 254 Prime and/or Sub (Good Standing approval emails for current option year)

3. DISS verification of Visit Authorization by Security Manager

4. (Optional: see NOTE below) Contractor VAL signed by the Contractor Facility Security Officer (FSO)

NOTE: If DISS is not available, the VAL must contain the following information on company letterhead

• Company name, address, telephone number, facility security clearance

• CAGE CODE

• Contract/Order Number

• Name, SSN, date and place of birth, and citizenship of the employee intending to visit, email address, and phone number

• Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date and adjudication date & agency)

• Name of COR/Alt COR

• Dates or period the VAL is to be valid (i.e., Start date / End date)

11.4.2 VTN Package. The Contractor FSO will forward a VTN letter to the DISA COR identified in the PWS/TO/Sub for all employees leaving the contract/task order/subcontract.

11.4.2.1 In addition, the DISA CORs and security managers shall inform the DISA Security Office when contractor personnel are removed for cause from a contract supporting DISA. This step is being added to prevent contractor personnel removed for security related issues from returning to DISA without appropriate vetting.

This step will also provide security with pertinent information to make an informed decision regarding potential contractor employees’ access to secure facilities and sensitive information. “For Cause” is information regarding an individual that falls into one or more of the actions or incidents that are within one of the 13 adjudicative guidelines as cited in the Security Executive Agent Directive (SEAD) 4:

a. Allegiance to the United States

b. Foreign Influence

c. Foreign Preference

d. Sexual Behavior

e. Personal Conduct

f. Financial Considerations

g. Alcohol Consumption

h. Drug Involvement and Substance Misuse

i. Psychological Conditions

j. Criminal Conduct

k. Handling Protected Information

l. Outside Activities

m. Use of Information Technology

Other actions:

• Incidents involving violence in the workplace or harassment.

• Misuse of time.

• Inspector General or General Counsel related inquiries.

• Failure to comply with security policies and procedures.

• Other reasons that prompted removal of a contractor.

The VTN must contain the following information on company letterhead

• Company name, address, telephone number, facility security clearance

• CAGE CODE

• Contract/Order Number

• Name, SSN, date and place of birth, and citizenship of the employee, email address, phone number

• Date contractor CAC was collected

• Name of COR/Alt COR

• Termination Date

• Reason for Termination:

*Any VAL/VAR submitted without the above information will be denied.*

11.5 Security Contacts. DISA Security Personnel can be contacted for Industrial or Personnel Security related issues at (301) 225-4039 or via mail at:

Defense Information Systems Agency Defense Information Systems Agency ATTN: J-16, Industrial Security ATTN: J-16, Personnel Security Command Building Command Building 6910 Cooper Ave. 6910 Cooper Ave.

Fort Meade, MD 20755-7088 Fort Meade, MD 20755-7088

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

Name: Tim Rhodes Phone Number: 301-225-0901 E-mail: timothy.k.rhodes.civ@mail.mil

11.6 Information Security and other miscellaneous requirements.

11.6.1 Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the Government facility.

11.6.2 Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan;

furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract/order.

11.6.3. Contractor employees with an incident report in DISS who have had their access to classified suspended will not be permitted to fill positions requiring access to classified information on a DISA contract/order.

11.6.4 The Contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

11.6.5 The authority for the contractor personnel to regain access must be granted by DISA Chief of Security.

11.6.5.1 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

11.6.5.2 DISA retains the right to revoke contractor personnel access to DISA facilities and networks, who violates one or more of Security Personnel Adjudicative guidelines, harassment or violence in the workplace while assigned to a contract clearly conflict with the interest of the Government.

11.6.5.3 If contractor employee is accused of violating state or federal laws and/or Government professional conduct policies or regulations, then the Government may require that such contractor employee be removed from Government premises and/or that such contractor employee be removed from supporting this contract, pending the duration and outcome of a Government investigation if the Contracting Officer finds that the conduct or violation alleged has the potential to negatively interfere with contract performance or operations at a Government facility. Only the Contracting Officer can make such a request on behalf of the Government. Removal of contractor employee shall not negatively impact contract performance.

11.6.6 Contractor personnel will generate or handle documents that contain Controlled Unclassified Information (CUI) at the [Government] facility. Contractor personnel will generate or handle documents that contain Proprietary, Contract Sensitive, or similarly designated information at the [Government] facility.) Contractor personnel will have access to, generate, and handle classified material up to/TOP SECRET SCI level only at the [Government] location(s) (Ref: Block 8 Place of Performance on DD254) and listed in the place of performance section of this document. All contractor deliverables shall be marked in accordance with DoDM 5200.01, Vol. 1, DoD Information Security Program: Overview, Classification, and Declassification; DoDM 5200.01, Vol. 2, DoD Information Security Program:

Marking of Information; DoDM 5200.01, Vol. 3, DoD Information Security Program: Protection of Classified Information; DoDI 5200.48, Controlled Unclassified Information (CUI); and DoDM 5400.07, Freedom of Information Act Program, unless otherwise directed by the Government. The contractor shall comply with the provisions of the DoD Industrial Security Manual for handling classified material and producing deliverables. The contractor shall comply with DISA Instruction 630-230-19, Cybersecurity.

11.6.7 The Contractor shall afford the Government access to the contractor’s facilities, installations, operations, documentation, databases and personnel used in performance of the contract/order. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of data or to the function of information technology systems operated on behalf of DISA or DoD, and to preserve evidence of computer crime.

mailto:timothy.k.rhodes.civ@mail.mil

11.7 INTELLIGENCE ACTIVITIES. All work or services to be performed hereunder shall be in compliance with EO 12333, “United States Intelligence Activities,” the procedures contained in DoD 5240.1-R, “ Procedures Governing the Activities of DoD Intelligence Components that affect United States Persons” and DoD Manual 5240.01, “Procedures Governing the Conduct of DoD Intelligence Activities,” and DoD Directive 5148.13, “Intelligence Oversight.” The contractor shall ensure that all contractor employees receive annual intelligence oversight training and comply with all DoD and DIA instructions, directives, regulations, manuals, and policies with respect to intelligence oversight and the conduct of intelligence or intelligence-related activities. The contractor shall ensure that contractor personnel report any questionable intelligence activity (QIA) or significant or highly sensitive matter (S/HSM) to the contracting officer, the contracting officer’s representative (COR), USCYBERCOM’s Intelligence Oversight Program Management Office, and any other appropriate Government official(s) identified in this contract.”

Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government-Furnished Information (GFI).

Attachment 4, 832015824 GFP.xlsx

Include if GFP will be provided to the Contractor on this contract/order:

A. GFP will be provided for this contract as indicated in the GFP attachment included at solicitation, distributed at award and incorporated via the GFP Module in PIEE. GFP shall be managed IAW the terms of FAR 52.245-1, corresponding GFP DFARS clauses and additional DITCO Instructions incorporated in award.

Contractors shall accept and/or report provided GFP via the Shipping and Receiving document in the GFP module upon acceptance and/or IAW Additional DITCO Instruction H9. Serially managed items are provided to the contractor by DoD and require all events identified in DFARS 252.245-7005 (and/or any subsequent DFARS or Agency GFP reporting requirements) to be reported by the contractor.

Contractors in possession of GFP shall provide the COR or PA an annual report of all GFP in its possession to include the item description, make, model, serial number, IUID, and last inventory date; the report should be minimally provided on an annual basis and 30 days prior to the expiration of any performance period (base and options) IAW with Additional DITCO Instruction H9.

Deliverable:

Deliverable Title Format Due Date Distribution/Copies Frequency and Remarks

12 GFP Inventory MS Excel spreadsheet

30 days prior to the end of the POP.

Standard Distribution*

Annually

H9 Property Management Plan

Provided template

10 days after award.

COR and PA At award

H9 Final GFP Disposition Notification

Contractor provided format

On or prior to the last day of the end of the POP.

COR, PA, CS At end of contract/ order

*Standard Distribution: 1 copy of the transmittal letter with the deliverable to the Primary COR.

Include the below if IP will be provided:

B. IP will be made available, and hand receipted to the contractor for use during the performance of the contract. Below is an estimated list of IP, this estimate is not considered a comprehensive list and more or less IP maybe provided in performance of the contract. IP shall be managed IAW the terms of H8, Defense Information System Agency Incidental Property Management (Apr 2021) or subsequent updates.

Estimated IP to be provided:

13. Other Pertinent Information or Special Considerations.

a. Identification of Possible Follow-on Work: N/A

b. Identification of Potential Conflicts of Interest (COI):

The contractor must identify any actual or potential organizational COI and its plan to avoid, neutralize or mitigate such conflicts in accordance with DARS 52.209-9000. The contractor shall be directed, managed, and supervised at all times by the management personnel of the contractor. The contractor shall ensure that employees properly comply with the performance standards outlined in the PWS. The contractor shall ensure that employees will perform their duties independent of, and without the supervision of, any Government official or other defense contractor. The tasks, duties, and responsibilities set forth in the PWS shall not be interpreted or implemented in any manner that results in any contractor employee creating or modifying Federal policy, obligating the appropriated fund of the United States Government, overseeing the work of Federal employees, providing direct personal services to any Federal employee, or otherwise violating the prohibitions set forth in FAR Subparts 7.5 and 37.1.

Changes/Deviations. Changes to task content, schedules, and deliverables shall be documented by a revision/modification to the task order. Only the KO may authorize changes to this task order. Identification of Potential Conflicts of Interest (COI). The contractor shall identify any potential conflicts of interest and provide documentation as to their remediation strategy. Due to the nature of the DoD IA Program, Organizational Conflict of Interest (OCI) issues are a significant concern as they hold the potential to disrupt the performance of this contract and other contracts awarded and administered by DISA.

As such, OCI will also be evaluated as part of the management practices sub factor for proposal risk in terms of your company’s approach to identifying and mitigating potential OCIs for both you and any teammates.

This is the case whether an OCI mitigation plan is required or not and is a consideration above and beyond the acceptability of the OCI mitigation approach IAW FAR Subpart 9.5.

DISA would like to remind companies deciding to pursue proposing on this effort in any prime, subcontractor, or teaming arrangement capacity of their responsibility to ensure they address, and take steps to avoid and/or mitigate, any potential OCI issues. This is especially important for companies supporting Government entities that will be involved in providing support activities for this effort. Guidance is found in the FAR Part

9. Such companies shall examine any support contracts it has in place with the Government for provisions addressing OCI issues. A company finding it has a potential OCI situation must submit and have approved a mitigation plan prior to the Government’s consideration of any proposal for award. Since the approval process can be lengthy and approval of any plan is not assured, it is highly recommended that potential OCI identification and resolution processes begin as soon in this pre-award phase as possible. An OCI may result in the canceling of an order or determining an offeror ineligible for award.

• OCI Policies and Programs: Each plan shall describe any OCI policies or programs currently in effect or planned for each offeror team member as appropriate, such as:

• In-house OCI Training for new and existing employees

• OCI Certification Statements

• OCI Enforcement Policies

• Employee OCI reporting requirements

• Consequences for OCI violations

• Disclosure of violations to the Government

• OCI policies related to employee transfer; separation; and compensation

• Use Nondisclosure Agreements / Transfer of Information Agreements (include models drafts where appropriate).

As part of the proposal, the contractor’s team shall provide an OCI Plan. Additionally, any OCI identified during the performance of the effort, not already mitigated, shall be brought to the attention of the Contracting Officer within 24 hours of finding. The contractor shall be responsible for providing a mitigation plan to the Contracting Officer for any OCI’s identified throughout performance of this effort for consideration.

c.Identification of Non-Disclosure Requirements. (Mandatory for DISA services contracts regardless of award amount. NDA can be tailored for use with Non-DISA service contracts if desired. Provide embedded NDA below as an attachment to the PWS.) The contractor shall obtain and maintain Non-Disclosure Agreements (NDA) for each employee assigned to the contract/TO. Initial NDAs shall be signed within one week of contract/TO award, and NDAs shall be kept current through the entirety of the period of performance as employee turnover occurs. The contractor shall ensure that all employees assigned to the contract have executed NDAs on file as of the date of the Monthly NDA Status Report, which shall include names and NDA status of all current employees assigned to the contract.

Blanket NDA.pdf

Deliverable Title

Format Due Date Distribution/Copies Frequency and Remarks

13c. Monthly NDA Status Report

Contractor determined format

No later than end of the 1st week of each month

Standard Distribution* Monthly (NDA status as of the end of the previous month)

*Standard Distribution: 1 copy of the transmittal letter with the deliverable to the Primary COR.

d. Packaging, Packing and Shipping Instructions.

Packaging and marking of all deliverables shall be in accordance with the best commercial practice necessary to ensure safe and timely delivery in accordance with applicable security requirements. All data and correspondence submitted to the KO and COR shall reference: the contract number, task order number, the names of the KO and COR. All deliverables which include software source code, executables, files, libraries, headers, scripts, or other computer product end items meant for installation on a computer shall be delivered in electronic media that is compatible with DISANet standards.

e. Inspection and Acceptance Criteria.

Inspection and acceptance criteria will be provided via the Quality Assurance Surveillance Plan

(QASP).

f. Property Accountability ”) The contractor shall submit the Consolidated Product Listing for IGCE/RFQ/EPL/MI&RR (see below) in addition to complying with all requirements of DFARS 252.211-7003. See DITCO Additional Text H2, Requirement to Submit an Electronic Product List for additional information.

g. Transitioning.

1. Transition-In (Phase In). All key personnel/key positions must be onboard at start of the period of performance. 50 percent total staffing must be complete within two weeks of the start of the PoP and 100 percent within 30 days.

2 . Transition-Out (Phase Out). You will need to collaborate with the MP at least 120 days or sooner, prior to the end of the contract, to develop a transition-out plan IAW FAR 52.237-3.

h. Supply Chain Risk Management (SCRM).

This contract and its associated delivery/task orders are subject to the Federal SCRM policies and regulations including the Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7017 Notice of Supply Chain Risk, 252.239-7018 Supply Chain Risk, DoD Instruction 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks, Section 806 of the FY2011 NDAA Requirements for Information Relating to Supply Chain Risk, and internal DISA SCRM Processes and Procedures. Each individual delivery and/or task order will submit a SCRM Plan as part of the technical proposal, which addresses, at a minimum, Supply Chain Security Controls as specified in the delivery/task order and described in the Committee on National Security Systems Instruction (CNSSI) 1253 Appendix D (companion publication to National Institute of Standards and Technology (NIST) Special Publication (SP)).

This contract and its associated delivery/task orders are subject to the Federal SCRM policies and regulations including the Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7017 Notice of Supply Chain Risk, DFARS 252.239-7018 Supply Chain Risk, DoD Instruction 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks, Section 806 of theFY2011 NDAA Requirements for Information Relating to Supply Chain Risk, and internal DISA SCRM Processes and Procedures.

The contractor shall submit a SCRM plan as part of its technical proposal that describes how the contractor will reduce and mitigate Supply Chain Risk using the security controls outlined below (further described in CNSSI 1253, Appendix D and NIST SP 800-53), as applicable to your contract notification was provided to Contractor employees and the forum/means in which the written notification was provided (e.g., posted in hallways, cubicle spaces, common room spaces, email correspondence).

Task#

Deliverable Title

Format Due Date Distribution/ Copies

Frequency and Remarks

13j. Affirmation of Requirement to Inform Employees of Whistleblower Rights

Written - Contractor determined format

No later than 60 days prior to expiration of the period of performance

Standard Distribution*

Annually

The written affirmation must include the forum/means in which employees were notified

*Standard Distribution: 1 copy of the transmittal letter with the deliverable to the Primary COR.

14. Section 508 Accessibility Standards.