Attachment 1 - Statement of Work_REV.pdf

STATEMENT OF WORK

FOR TRUSTED WORKFORCE 2.0 IMPLEMENTATION AND SECURITY

SUPPORT SERVICES

1.0 BACKGROUND

Federal Mediation and Conciliation Service (FMCS) is an independent agency of the Federal Government responsible for promoting the development of sound and stable labor-management relationships, preventing, or minimizing work stoppages by assisting labor and management to settle their disputes through mediation, and advocating collective bargaining, mediation and voluntary arbitration as the preferred process for settling issues between employers and representatives of employees. In addition, the FMCS mission includes developing the art, science and practice of conflict resolution, and fostering the establishment and maintenance of constructive joint processes to improve labor-management relationships, employment security and organizational effectiveness.

Trusted Workforce 2.0 was launched in 2018 to modernize and transform the Federal personnel vetting system to meet current and future needs. Before the launch of this program, the federal government was faced with outdated and inefficient procedures, resulting in backlogs and delays.

This initiative aims to reduce the time required to onboard new hires, simplify workforce mobility, and enhance risk management by identifying potentially problematic behavior sooner.

The TW 2.0 reforms seek to streamline policy and tailor personnel vetting activity to an individual’s circumstances. TW 2.0 is being implemented in two phases. Phase One addressed the sizeable background investigation inventory and timeliness of investigations. Phase Two focuses on transforming personnel vetting from the ground up. Phase 2a establishes a new personnel vetting framework. Phase 2b implements transitional states of continuous vetting for the national security sensitive population to deliver early results while progress is made on finalizing policies and building new capabilities to support the new framework. Phase 2c involves full implementation of the TW 2.0 future state.

2.0 PURPOSE

The purpose of this requirement is to enlist contractor support for the development and implementation of FMCS’ personnel security (PerSec) and operational security (OpSec) programs for the Office of Security and Continuity of Operations (OSCO). Areas of support will include the establishment of a trusted workforce program, the development of an insider threat program, badging support services (HSPD-12), business process mapping and analysis, drafting system of records notices (SORN), and the establishment of an operations security program in accordance with NSPM-28. Additionally, there will be other obligations to be fulfilled by contractor(s) such as the development of security program documents, leveraging agency network tools (SharePoint) to enhance business workflows for transitioning to trusted workforce (TW) 2.0, updating current security processes, and the implementation and administration of FMCS trusted workforce program.

It is expressly agreed and understood that this is a non-personal services contract as defined in Federal Acquisition Regulation 37.101, under which the services performed by the contractor are rendered in its capacity as an independent contractor. The Government will evaluate the quality of the service provided but retains no control over the contractor’s employees or agents. The contractor is solely liable for, and expressly agrees to indemnify the Government with respect to any liability producing acts or omissions by it or by its employees or agents.

3.0 OBJECTIVE

The objective of this requirement is to obtain security support services for the FMCS Office of Security and Continuity of Operations from program specialists in the areas of personnel security (with TW2.0 transition experience), Business analytics (with on-boarding workflow experience), and SharePoint (designing and implementing workflow systems that integrate TW2.0 and onboarding business processes).

4.0 PERSONNEL REQUIREMENTS

4.1 The contractor shall have working knowledge of applicable laws and security guidance (e.g., 5 CFR, OMB, FISMA, SEAD’s 1-9, Executive Orders, Presidential Directives, executive branch guidelines, and Federal Personnel Vetting Core Doctrine, Engagement, and Performance Management Guidelines and Standards).

4.2 The contractor shall have demonstrated experience with existing and emerging TW2.0 policies and performance management implementation guidance (PMIG).

4.3 The contractor shall have demonstrated implementation experience with existing and emerging designated shared services (e.g., NBIS/eApp) and other relevant federal vetting systems and systems of record (e.g., CVS, DISS, PIPS, NBIS, USAccess).

4.4 The contractor shall have demonstrated experience implementing, executing, and managing personnel vetting and operational security reform initiatives for federal agencies.

4.5 The contractor shall have demonstrated experience designing TW2.0 Performance

Management Implementation Guidance (PMIG) tailored to specific agency needs and requirements.

4.6 The contractor shall have demonstrated experience revising current federal agency five tiered investigative standards and processes to implement the new investigative standards and scenarios.

4.7 The contractor shall have demonstrated experience training existing workforces, supporting organizational change management, and associated strategic communications in alignment with TW2.0 policy requirement and internal agency adoption activities.

4.8 The contractor shall have demonstrated experience applying business analytics for identifying gaps, deficiencies, or any problems with established personnel security policies and procedures.

4.9 The contractor shall have demonstrated experience applying qualitative and quantitative techniques to analyze and measure the effectiveness and efficiency of procedures and practices that support personnel security and TW2.0 implementation and maintenance.

4.10 The contractor shall meet all security and confidentiality requirements in Section

12.0.

5.0 TASKS

The contractor shall be responsible for providing a technically qualified individual who meets the requirements of Section 4.0 to perform security support services to include the following tasks:

5.1 Draft agency policies, directives, memorandums, and procedures in support of Security Programs.

5.2 Identify which federal regulations, presidential directives, OMB memos, NIST Special Publications, and D/A policies should be considered to ensure compliance and/or require updating for security operations.

5.3 Identify and recommend systems/processes to accommodate the new Investigative Standards and the PMIG Metrics Template.

5.4 Support OSCO’s preparation for and implementation of the new Investigative Standards.

5.5 Support FMCS transition into TW2.0 and new investigative categories.

5.6 Support validated CV Alerts with Subordinate Metrics for PMIG.

5.7 Support implementation and compliance activities with agency’s Investigative Service Provider (DCSA) program requirements.

5.8 Review, draft, and provide comments to FMCS’ Office of Security and Continuity of Operations Directives for consideration and action.

5.9 Review documented security procedures to ensure that they are comprehensive and up-to-date and coordinate revisions within FMCS Security Program, as necessary.

5.10 Identify security program implications of new and existing technologies or technology upgrades.

5.11 Assist with the creation of Standard Operating Procedures, reference manuals, and information sources, as well as the development of information that addresses personnel security program implications.

5.12 Assist with defining, interpreting, and updating security training programs related to Federal requirements and translating/tailoring training into a format that is clearly understood by a variety of audiences.

5.13 Identify compliance gaps and collaborate with FMCS’ Office of Security and Continuity of Operations to help resolve gaps.

5.14 Identify and develop training for supervisors and contracting officer representatives to better understand and comply with security standards.

6.0 DELIVERABLES

Bi-weekly status reports on progress of assigned tasks and activities performed under the task order are due to the Contracting Officer’s Representative (COR), showing the status of all active tasks. Additional deliverables may be requested in writing to the contractor by the Contracting Officer or COR, as appropriate.

7.0 PERIOD OF PERFORMANCE

The Period of Performance (PoP) shall be twelve (12) months.

8.0 PLACE OF PERFORMANCE AND HOURS OF OPERATION

8.1 The contractor shall provide up to forty (40) hours per week, per contractor, of remote support to the Security and Continuity of Operations, who is located at the FMCS Headquarters in Washington, D.C.

8.2 The operating hours consist of an eight-hour daily work schedule, which can begin not earlier than 0700 and end not later than 1800, Monday through Friday.

The core operating hours in which the contractor must be present are 0800 through 1630.

8.3 The Contractor is not required to provide service on the following U.S. Federal holidays: New Year’s Day, Martin Luther King Jr. Day, President’s Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, and Christmas day.

8.4 Work performed on holidays and other non-work time is not billable unless it is specifically requested by the COR or the Contracting Officer and approved in advance.

9.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT

FMCS will provide the contractor personnel with computers, mobile phones, software and network access necessary to perform the work requirements.

All materials provided by the Government during the course of this task order will remain the property of the Government and will be returned on completion of the task order. The contractor or their designated representative shall sign the required Government tracking document for the necessary supplied equipment.

10.0 ACCESS TO INFORMATION TECHNOLOGY SYSTEMS

All contractors and contractor personnel shall be subject to the same Federal laws, regulations, standards and FMCS policies as FMCS, and FMCS personnel, regarding information and information systems security. Contractors must follow policies and procedures outlined in FMCS IT Security Program to ensure appropriate security controls are in place.

A contractor shall request logical (technical) and/or physical access to FMCS information and FMCS information systems for employees, subcontractors, and affiliates only to the extent necessary: (1) to perform the services specified in the task order, (2) to perform necessary maintenance functions for electronic storage or transmission media necessary for performance of the task order, and (3) individuals must satisfy the same conditions, requirements and restrictions comparable to FMCS employees in order to access the same type of FMCS information.

11.0 FMCS INFORMATION CUSTODIAL REQUIREMENTS

Information made available to the contractor by FMCS for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the Contracting Officer.

FMCS information shall not be co-mingled with any other data on the contractor’s/ subcontractor’s information systems/media storage systems in order to ensure FMCS requirements related to data protection and media sanitization can be met. FMCS also reserves the right to conduct IT resource inspections to ensure data separation and on-site inspection of information destruction/media sanitization or disposal procedures to ensure they are in compliance with FMCS policy requirements.

Prior to termination or completion of this contract, the contractor shall not destroy information received from FMCS or gathered or created by the contractor in the course of performing this contract without prior written approval by the FMCS Contracting Officer. Any data destruction done on behalf of FMCS by a contractor must be done in accordance with National Archives and Records Administration (NARA) requirements.

The contractor shall receive, gather, store, back-up, maintain, use, disclose and dispose of FMCS information only in compliance with the terms of the contract and applicable Federal and FMCS information confidentiality and security laws, regulations and policies. Applicable Federal information security regulations include all Federal Information Processing Standards (FIPS) and Special Publications (SP) issued by the National Institute of Standards and Technology (NIST).

If Federal or FMCS information confidentiality and security laws, regulations and policies become applicable to the FMCS information or information systems after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies, including FIPS or SP, in the contract.

The contractor shall not make copies of FMCS information except as necessary to perform the terms of the agreement or to preserve electronic information stored on contractor electronic storage media for restoration in case any electronic equipment or data used by the contractor needs to be restored to an operating state.

If FMCS determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for FMCS to terminate the contract for default or terminate for cause under Federal Acquisition Regulation Part 12.

12.0 SECURITY AND CONFIDENTIALITY

All key personnel must 1) be a US citizen or have Legal Permanent Resident status; 2) sign a Non-Disclosure Agreement (NDA); and 3) either have a completed and active background investigation at the Tier 1 low risk level (formerly NACI) with a favorable adjudication prior to starting work or be able to pass a background investigation at the Tier 2 moderate risk level (formerly NACI) with a favorable adjudication within ninety (90) days of award.

13.0 PERSONNEL CONFLICTS OF INTEREST

The term "personal conflict of interest" means that a contractor employee assigned to the task order has interests which (i) may diminish his/her capacity to give impartial, technically sound, objective assistance and advice in performing this task order, (ii) may otherwise result in a biased work product under this task order, or (iii) may result in an unfair competitive advantage.

A contractor employee shall not participate (i.e., recommend, influence, or decide) in any particular matters that:

• will have a direct and predictable effect on the financial interests of that employee, his/her spouse or minor child, or organization in which he/she serves as officer, director, trustee, general partner or employee,

• will have a direct and predictable effect on the financial interests of or any person or organization with whom he/she is negotiating or has an arrangement concerning prospective employment, or

• may otherwise cause a reasonable person to question his/her impartiality.