A.02 PWS 29 DEC DRAFT.pdf

DHA PWS Template V13 November 16, 2021

Department of Defense Defense Health Agency

Performance Work Statement

Defense Travel System and Centrally Billed Account Reconciliation Support

Financial Operations Directorate

Accounting Operations Division

Solicitation Number: PANDHA-26-P-0000 032579 Version: 1

Date: 29 December 2025

November 16, 2021

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide the Defense Health Agency (DHA) Financial Operations Division (FOD) with Defense Travel System (DTS) and Centrally Billed Account (CBA) support for the reconciliation of monthly invoices.

1.2 Description of services/introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform DTS and CBA Reconciliation support services as defined in this Performance Work Statement (PWS). Contractor shall perform to the standards in this PWS.

1.3 Background: The purpose for the FOD is to perform operational functions to ensure that the DHA/DTS/CBA Reconciliation Module monthly invoices are paid according to the Prompt Payment Act (PPA). FOD responsibilities include the overall supervision of the DHA/DTS/CBA processing for all military and civilian travel transaction and mission related charges. FOD is accountable for all submissions and responses pertaining to budget execution, corrective actions, and the review and/or influence of the procedures that address known deficiencies or support process improvements where a financial impacts may exist. FOD will leverage the capabilities of both Government personnel and Contractor support in collaboration with any audit policy and guidance that impacts the overall execution of DHA business and system standardization requirements.

1.4 Objectives Provide DTS and CBA Reconciliation support services in support of the Office of the Comptroller to ensure every measure is taken to fulfill and fully execute best business practices in the interest of the Government and public sector to avoid fraud, waste, and abuse of authority pertaining to this program.

1.5 Scope: The Contractor shall provide comprehensive financial support services by executing thorough DTS CBA reconciliations utilizing Citibank data ensuring accurate integration of CBA transactions into the General Fund Enterprise Business System (GFEBS) financial system to standardize efforts for improved efficiencies. The Contractor shall also maintain and manage CBA transactions on a daily basis to evaluate the current program operations and look for areas of improvement as necessary with specialized CBA management experience highly preferred.

1.6 Period of Performance (PoP): One (1) twelve (12) month base year plus four (4) twelve

(12) month option periods.

Base Period: July 30, 2026 - July 29, 2027 Option Period 1: July 30, 2027 - July 29, 2028

November 16, 2021

Option Period 2: July 30, 2028 - July 29, 2029 Option Period 3: July 30, 2029 - July 29, 2030 Option Period 4: July 30, 2030 - July 29, 2031

1.6.1 Transition: Transition-in/transition-out period

1.6.1.1 Transition-in period: Transition-in/Transition Period is defined as the first ten (10) days after contract award and this 10 day period shall run concurrently with the final days of current PoP. During the transition-in period, the Contractor shall prepare to meet all contract requirements and ensure incoming personnel are functionally trained and qualified on the full performance start date except cybersecurity requirements, which must be fully adhered during transition and full performance periods. The remaining incoming personnel shall be trained and qualified within 30 days After Contract Award (ACA). The Contractor shall submit the Tranisition in CDRL with proposal submission. (See Technical Exhibit 1.)

1.6.1.1.1 The Contractor shall comply with transition-in requirements of the DHA, as listed in paragraph 1.11.1, for Contractors needing to be issued Common Access Card (CAC) identification, including Department of Defense (DoD) and DHA-directed training and forms submission, prior to network access.

1.6.1.2 Transition-out period: The transition-out plan shall facilitate the accomplishment of a seamless transition from the incumbent to an incoming Contractor/Government personnel at the expiration of the contract. The Contractor shall submit the Tranisition out CDRL with proposal submission. See Part 7, Technical Exhibit 1.

1.6.1.2.1 The Contractor shall comply with transition-out requirements of the DHA for Contractors who have been issued a CAC or who generate “records”, as defined by DoD (records manual), including DoD-directed disposition of records, and others displayed on the In/Out (I/O) Processing Portal.

1.7 Administrative specifications

1.7.1 Place of performance: The work shall be performed at Defense Health Headquarters (DHHQ), 7700 Arlington Boulevard, Falls Church VA, 22042 or remotely at client site.

1.7.2 Recognized Federal holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

NOTE: The Contractor is not required to perform services on holidays and will not be paid for these agency closings.

1.7.3 Hours of operation: The Contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.7.4 Emergency Services:. On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours.Contracted entity shall establish a Contingency Operation Plan to be included as a deliverable. See Part 7, Technical Exhibit 1.

1.8 Contractor Travel: The Contractor shall be required to travel to provide developmental training in the Continental United States (CONUS).

The Contractor shall be authorized travel expenses consistent with the cost principles and procedures in Federal Acquisition Regulation (FAR) Part 31.2, Travel Costs and the limitations of funds specified in this contract. All travel requires Government approval/authorization and notification to the Contracting Officer Representative (COR).

Contractor staff, upon request will perform no more than eight (8) trips per period of performance.

Arrangements for and costs of all travel, transportation, meals, lodging, and incidentals are the responsibility of the Contractor. Costs for these expenses will be reviewed, certified and approved by the COR.

The Government plans to issue a Priced CLIN in the amount of $5,000.00 for each period of performance.

Estimated travel is indicated below:

From To Round Trip (Y/N)

# of Trips # of People # of Days

National Capitol Region (NCR)

Medical Facility Treatment (MFT)

Y 8 2 4

1.9 Other Direct Costs (ODC): N/A

1.10 Quality

1.10.1 Quality Control (QC): The Contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The Contractor’s QC program is the means by which the work complies with stated requirements. After acceptance of the Quality Control Plan (QCP) the Contractor shall receive theContracting Officer Representative’s (COR) acceptance in writing of any proposed change to his QC system.Contractor (See Part 7, Technical Exhibit 1 - CDRL A001)

1.10.1.1 Quality Control Plan CDRL A001: The Offeror shall submit a draft QCP with its initial offeror with a final QCP submitted no later than ten (10) days after award. At a minimum, the QCP must include a self-inspection plan, an internal staffing plan, and an outline of the procedures that the Contractor will use to maintain quality, timeliness, responsiveness, customer satisfaction, and any other requirements set forth in the solicitation.

1.10.2 Quality assurance (QA): The government will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11 Contractor personnel

1.11.1 CAC requirements: For all Contractors who will work in Government facilities, the Facilities Security Officer (FSO)/Company's Security point of contact (POC) will provide the Government all the required information per the DHA CAC request process current version 2.1, January 2018, or more recent when updated. See process attached at Part 7 Section 7.1.1 of the PWS. A CAC is the standard identification for eligible DoD Contractor personnel.

1.11.1.1 The Contractor shall return all CACs to the COR upon the departure of the Contractor(s).

1.11.2 Contractor onboarding and training. The Contractor shall complete all requirements, training, and forms as prescribed in the following requirements:

1.11.2.1 The DHA’s “Onboarding Checklist for Contractor Employees” is located at the DHA Onboarding and Offboarding Portal at https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx

1.11.2.2 The DHA’s Contractor training instructions embedded at Part 7 Section 7.1.2.

1.11.2.3 The Contractor shall comply with onboarding requirements of the DHA for Contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at:

https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available).

1.11.2.4 The DHA’s new employee handbook at Part 7 Section 7.1.4.

1.11.3 Physical Security: The Contractor shall be responsible for safeguarding all government equipment, information and property provided for Contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.11.4 Key control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx

November 16, 2021 used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas.

The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the CO.

1.11.4.1 In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the CO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor.

In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.11.4.2 The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the CO.

1.11.5 Lock combinations: Reserved

1.12 Key personnel (Contractor): The Contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the Contractor when the manager is absent shall be designated in writing to the CO.

The contract manager or alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 8:00 a.m. to 5:00 p.m., Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons. Qualifications for all key personnel are listed below (See Section Five (5) for specific duties):

• Senior Program Consultant II DTS CBA Subject Matter Expert

• Program Consultant II DTS CBA Subject Matter Expert

• Program Consultant I DTS CBA Subject Matter Expert

1.13 Data rights: N/A

1.14 Reporting

1.14.1 Contractor Manpower Reporting (CMR): RESERVED.

1.14.2 Non-Disclosure Agreement (NDA): All Contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA Contractor NDA (DHA Form 49) prior to beginning work on the subject contract. The Contractor shall execute an NDA on behalf of the company and shall

November 16, 2021 ensure that all staff assigned to, including all subContractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other Contractors. The NDA shall be executed not later than first day of employment and to be renewed upon exercising a contract option period. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the Contractor. The Contractor shall maintain originally signed NDAs of individual employees and provide copy to the COR.

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor Contractor's performance and notifies both the CO and Contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.14.4 Post award conference/periodic progress meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance.

At these meetings the CO will apprise the Contractor of how the government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a Contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All Contractor personnel shall identify themselves as Contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The Contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is Contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is Contractor support personnel.

Include a title block in all emails that states the fact that the person is Contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is Contractor support personnel.

November 16, 2021

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order.

Contractor personnel shall make their Contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a Contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.16.1 FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system. Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The Contractor shall be prepared for this process as it could take two (2) or more weeks. The FSO/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.16.2 Company's FSO/Security POC must notify the Personnel Security Office when the Contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a Contractor's termination from the contract, including the termination date.

1.17 Personnel Security

1.17.1 The Contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM

5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 275-6038.

1.17.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.17.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a Contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

November 16, 2021

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE

PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D- Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R- Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.2 Acronyms:

AIS Automated Information System APL Approved Products List APL AQL Acceptable Quality Level ARRT Acquisition Requirements Roadmap Tool AO Authorizing Official ATO Authority to Operate B2B Business-2-Business CAC Common Access Card CAP Cloud Access Point CBA Centrally Billed Account CCEVS Common Criteria Cybersecurity Evaluation and Validation Scheme

November 16, 2021

CDI Covered Defense Information CDRL Contract Data Requirement List CIO Chief Information Officer CJCSM Chairman of the Joint Chiefs of Staff Manual CMR Contractor Manpower Reporting CO Contracting Officer(s) CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative CSP Cloud Service Provider CUI Controlled Unclassified Information DAD-A Deputy Assistant Director for Acquisition DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DISA Defense Information System Agency DoD Department of Defense DoDD Department of Defense Directive DoDI Department of Defense Instruction DTS Defense Travel System DUA Data Use Agreement eMSM Enhanced Multi-Service Markets EULA End User License Agreement EVM Earned Value Management FAR Federal Acquisition Regulation FCI Federal contract information FedRAMP Federal Risk Authorization and Management Program FISMA Federal Information Security Modernization Act FOD Financial Operations Division FSO Facilities Security Officer HA Health Affairs HIPAA Health Insurance Portability and Accountability Act HCA Head of the Contracting Activity HIT Health Information Technology IGCE Independent Government Cost Estimate IA Information Assurance I/O In/Out Processing Portal IPv Internet Protocol Version IS Information System ISP Internet Service Provider IT Information Technology ISCM Information Security Continuous Monitoring IV&V Independent Verification & Validation MedCOI Medical Community of Interest MHS Military Health System MIL-STD Military Standard MTFs Military Treatment Facilities

November 16, 2021

NCR National Capitol Region NDA Non-Disclosure Agreement NIAP National Information Assurance Partnership NIST National Institute of Standards and Technology OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs OPM Office of Personal Management OSD Office of the Secretary of Defense P-ATO Personal Authorization to Operate P&R Personnel and Readiness PGI Procedures, Guidance and Information PDT Project Delivery Team PHI Protected Health Information PII Personally Identifiable Information PIT Platform Information Technology PK Public Key PKI Public Key Infrastructure POA&M Plan of Action and Milestones POC Point of Contact PMO Program Management Office PoP Period of Performance PP Personal Property PPSM Ports, Protocols, and Services Management PRS Performance Requirements Summary PSP Personnel Security Program PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Plan RMF Risk Management Framework SP Special Publication SPRS Supplier Performance Risk System SRM Sustainment, Restoration and Modernization SRG Security Requirements Guides STIG Security Technical Implementation Guides TOS Terms of Service US United States UFC Unified Facilities Criteria VPN Virtual Private Network XML Extensible Markup Language

2.3 Applicable Publications, DHA Administrative Instructions (AI), etc.

November 16, 2021

Federal Travel Regulation (FTR) OMB Circular A-123 Appendix B DoDI 5154.31, Vol 4 DoDI 6000.11 Patient Movement (PM) GTCC Regulations

November 16, 2021

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

☒ Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Government Furnished Services required in support of this contract/task orders. These Services are described below: provide

3.2 Facilities: The Government:

☒ Will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Facilities in support of this contract/task orders. The Government provided Facilities are described below:

3.3 Utilities: The Government:

☒ Will NOT provide Utilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Utilities in support of this contract/task orders. The Government provided Utilities are described below:

3.4 Equipment: The Government:

☒ Will NOT provide Equipment in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Equipment in support of this contract/task orders. The Government provided Equipment is described below:

November 16, 2021

3.4.1 Procurement Integrated Enterprise (PIEE), GFP Module Application N/A The Contractor shall be responsible for obtaining and maintaining access, training and successful operation of the PIEE/GFP Module application for the entirety of the contract/task order PoP.

The PIEE GFP Module application is located at the following website: https://wawf.eb.mil/piee-landing/. Access to PIEE/GFP Module application training materials and in-depth information applicable to the Contractor’s responsibilities regarding GFP can be found at the following website: https://dodprocurementtoolbox.com/.

Contracting Office Responsibilities:

The Contracting Office shall ensure close coordination and validation of the GFP items with the COR and DHA Accountable Property Officer prior to uploading the GFP Attachment into the PIEE/GFP Module. At the time GFP is anticipated and identified, the Government will upload the GFP Attachment into the PIEE/GFP Module. It is the Contracting Office’s responsibility to prepare, upload and maintain the GFP Attachment in the PIEE/GFP Module in accordance with the GFP Attachment instructions provided at the DoD Procurement Toolbox. The CO and COR shall manage and keep an inventory of any GFP associated with contract/task orders awarded through DHA, in accordance with applicable FAR Part 45, DoD FAR Supplement (DFARS) 245 with respective clauses, DHA AI 095 and PD 45-01 following the change in disposition of items listed on that PIEE/GFP Module Attachment.

The contracting office will also review, acknowledge, reject and/or approve shipment orders provided by the Contractor as appropriate. Functional roles can be determined within the Contracting Office, and requested within the PIEE/GFP Module system.

Contractor Responsibilities:

A key Contractor responsibility is to work with the CO and COR to ensure the PIEE/GFP Module data, to include the PIEE/GFP Attachment, provides a timely, complete and accurate accounting of the GFP applicable to the contract/task order. Contractors are required to report the receipt of any GFP shipped to them, regardless of whether it is listed on the GFP Attachment for their contract. Similarly, Contractors are required to utilize the GFP Module application in conjunction with the shipment of GFP to the Government, or in reporting Property Loss of GFP issued (such as destruction or loss). Discrepancies or disputes regarding property shipped to or shipped from the Contractor must be reported via the GFP Module application, with the CO having authority over final designation of status.

The Contractor shall report semi-annually 100% inventories, reconciliations, and final disposition of GFP provided by the government. Final invoices will not be paid pending GFP reconciliation. Contractors shall be aware of and ensure compliance with applicable FAR Part 45, DFARS 245 and 252.245, Defense Pricing and Contracting Policies, Procurement Integrated Enterprise Environment Standards, DHA Administrative Instruction 094 and DHA Guidance.

3.5 Materials: The Government:

https://wawf.eb.mil/piee-landing/ https://wawf.eb.mil/piee-landing/ https://dodprocurementtoolbox.com/

November 16, 2021

☒ Will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ IS providing Materials in support of this contract/task orders. The Government-provided Materials are described below:

November 16, 2021

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor:

☒ Will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Contractor Furnished Services required in support of this contract/task orders.

These Services are described in Part 5 of this PWS.

4.2 General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work listed under Section 5 of this PWS.

4.3 Secret Facility Clearance: N/A

4.4 Materials: N/A

4.5 Equipment: The Contractor shall

4.6 Facilities: N/A

November 16, 2021

PART 5

5.0 SPECIFIC TASKS

5.1 Financial & Accounting Reconciliation Support: The Contractor shall perform reconciliation of all DHA CBA Balances for various CONUS and OCONUS travel activities to include the Congressionally mandated transfer of Military Treatment Facilities (MTFs) under the DHHQ Direct Reporting Offices (DRO), and Defense Health Networks (DHN).

The Contractor shall be responsible for ensuring all airline and ground transportation to include Commercial Travel Office fees are reconciled within DTS and quality control checked for DHA DTS CBA reconciliation efforts to ensure the financial data, accuracy, timely submission and reconciliation are consistency with applicable accounting principles and standards in accordance with the commands business rules. The Contractor will reconciling CBA transactions and interim invoices, acknowledging, submitting emails to government Travel Credit Card (GTCC) Agency Program Coordinator (APC) for certifying and digitally signing the invoices for payment in a timely manner.

5.1.1 Reconciliation of Travel Transaction Postings: The Contractor should provide professional financial analysis and information on various topics to assist FOD personnel with the reconciliation but not limited to, successful setup, policy, best practices, and workarounds for system problem reports (SPRs) identified with the DTS CBA Reconciliation Module.

5.1.2 Reconciliation of DTS Management & Citibank Accounting Balances: The Contractor shall provide professional advice and assistance in monitoring account balances for variances. This includes monitoring the CBA Reconciliation Module Report and performing analysis between the financial systems and the agency's traveler records. Monitoring and matching the transactions of the CBA account items to include but not limited to generating and viewing various reports, invoices, and transactions, resolving and reconciling open invoices and matching transactions in the Suspended, Held, and Credits Not Received bins, Reviewing and acknowledging invoices prior to submission for certification for DHA GTCC APC.

5.1.3 Identification of Financial Management Problems: The Contractor shall perform financial analysis to identify financial management problems related to Defense Finance Accounting Sservice (DFAS) payment. The Contractor shal review all of the organization’s Charge Card Vendor invoices that are being reconciled outside of DTS. The Contractor shall determine the rough success rate in matching CCV invoice transactions against DTS authorizations and determine the routing status of a DTS document and correct ticket information in travel documents for LOA rejects within established time limits. The Contractor shall analyze invalid transactions and mark the transactions as Disputed to remove the transaction from the invoice while the GTCC APC disputes the transaction with the CCV outside DTS.

The Contractor shall provide professional advice and assistance in identifying financial management problems and implementing solutions for improvement and reporting all system problems to Travel Assistance Center Help Desk and coordinating with external sources such as DFAS, Defense Travel Management Office, DoD PMO and Army/Navy DTS PMO to make

November 16, 2021 recommendations for resolution; Develop and submit monthly and ad hoc status reports on CBA operations to include delinquencies.

5.1.4 CBA Reconciliation, Debt Management and Travel policy: The Contractor shall provide expert knowledge of all applicable regulations and directives to include but not limited to the Joint Travel Regulations (JTR), Defense Travel System Regulations, authorized by DoDI 5154.31, Volume 3, GTCC Regulations, authorized by DoDI 5154.31, Volume 4), in additional DoDI

6000.11 Patient Movement (PM); Contractor shall possess the required knowledge to process authorization and vouchers timely in accordance to the JTR to meet deadlines and maintain DHA CBA database of delinquency issues, status and other appropriate data to track operations while retaining delinquency below 1.5%.

5.1.5 Key Personel Tasks

5.1.6 Senior Program Consultant II DTS CBA Subject Matter Expert: The Senior Program Consultant also serves as the Contract Manager (CM). The Contractor shall lead and support major work segments, as well as the completion of other project work streams and deliverables.

The Contractor shall also lead project modules or work activities as appropriate. The Contractor shall provides services to management personnel to review and evaluate current program operations, assist in developing leadership systems to improve processes, develop and carry out strategic planning activities, and assist in developing goals, processes, and procedures.

Specialized management or consulting experience will preferred. The Contractor shall oversee development of analytical and computational techniques and methodology for problem solutions.

The Contractor shall manage process and data modeling in support of the planning and analysis efforts using both manual and automated tools. The Contractor shall have a minimum of eight

(8) years of experience with at least five (5) years specialized experience demonstrated for a wide variety of business case analysis, risk and feasibility studies and possess management and communication skills

5.1.6 Program Consultant II DTS CBA Subject Matter Expert:

The Contractor shall develop and coordinate plans, policies, resources, and mission as well as goals, visions, and expectations of agency or program. The Contractor shall works with internal and external parties to organize the various components needed to initiate, run, and conclude program activities. The Contractor shall develop cooperative partnerships with community-based organizations and agencies that will enhance the provision of services. The Contractor shall participates in the development of training, program guidance, best practices, and evaluation methods. The Contractor shall have a minimum of eight (8) years of experience with at least five

(5) years specialized experience in demonstrated team leadership and established direction to design, develop and execute on solutions and deliverables.

5.1.7 Program Consultant I DTS CBA Subject Matter Expert:

The Contractor shall develops and coordinate plans and policies, resources, and mission as well as goals, visions, and expectations of agency or program. The Contractor shall work with internal and external parties to organize the various components needed to initiate, run, and conclude program activities. The Contractor shall works with identified partners to enhance and carry out program activities. The Contractor shall participate in the development of training, November 16, 2021 program guidance, best practices, and evaluation methods. The Contractor shall have a minimum of eight (8) years of experience with at least five (5) years specialized experience of demonstrated capability to successfully overseeing complexity change management principles to transformation and process improvement projects.

November 16, 2021

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is unclassified.

6.2 The TIER 1 or TIER 2 levels and position sensitivity designation for positions under this contract is: (Requirement must be checked in order to be a requirement for this PWS.)

6.2.1 TIER II: Non-critical sensitive position

6.3 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements:

6.3.1. Data Sharing Agreements (DSAs): Contractors requiring access to PII, which includes PHI, or access to de-identified data, are subject to the DHA Privacy and Civil Liberties Office (DPCLO) (Privacy Office) Data Sharing Program. This program requires DHA to enter into DSAs with parties outside the MHS who use or create MHS data. A DHA contract may use the term Data Use Agreement (DUA) rather than DSA. DSAs assure that outside parties protect MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a DSA, the Contractor submits a Data Sharing Agreement Application (DSAA) to the DHA DPCLO. The Contractor submits the DSAA even if a subContractor will be the party accessing MHS data.

After review and approval of the DSAA, the Privacy Office provides a DSA to the Contractor for execution.

6.3.2. Processing Procurement Sensitive Information: All individuals shall seek guidance from the CO regarding the coordination of documents, dissemination, and transmission of procurement sensitive information. Procurement sensitive information shall not be transmitted electronically unless encryption is utilized. Depending on a particular procurement, other restrictions may apply.

6.4 Training: RESERVED

6.5 Cybersecurity Requirements for Non-DoD IT or Covered ContractorContractor IS:

(This section 6.5 through 6.5.14 is applicable only for those acquisitions where a non-DoD entity’s non-DoD IT or covered contractor IS, are not part of a DoD IT Service or system operated “on behalf of” the Government as prescribed in the DoDI 8582.01, “Security of Non- DoD Information Systems Processing Unclassified Non-Public DoD Information.” If not replace sections with 6.5 Cybersecurity Requirements for Non-DoD IT or Covered Contractor IS:

Reserved).

6.5.1 The Contractor shall, at time of award, have implemented the security requirements prescribed in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800- 171), in accordance with DFARS clause 252.204-7012.

November 16, 2021

6.5.2 NIST SP 800-171 DoD Assessment Methodology. The DFARS provision 252.204-7019 introduces the “NIST SP 800-171 DoD Assessment Methodology” requirement. This requirement enables a strategic assessment of a Contractor’s implementation of the NIST SP 800-171 requirements as required in DFARS clause 252.204-7012. The DoD Assessment Methodology requirement flows down to subContractors.

6.5.2.1 Basic Assessment: The Contractor shall obtain and maintain access to the Supplier Performance Risk System (SPRS) via the PIEE, (available via the internet at https://www.sprs.csd.disa.mil/)

6.5.2.1.1 The Contractor shall perform a Basic Assessment, using the NIST SP 800-171 DoD Assessment Scoring Template, and enter the results electronically in SPRS for each covered Contractor information system that is relevant to an offer, contract, task order, or delivery order.

See Attachment 2, Deliverable Schedule Table.

6.5.2.1.2 The Contractor shall ensure that applicable subContractors also have their results of a current assessment posted in SPRS prior to awarding a subcontract or other contractual instrument in accordance with DFARS clause 252.204-7020.

6.5.3 The Contractor shall provide the government with access to its facilities, systems, and personnel when necessary to conduct or renew a higher-level (i.e., Medium or High) assessment in accordance with DFARS clause 252.204-7020.

6.5.4 Cybersecurity Maturity Model Certification (CMMC) (When applicable): The CMMC (DFARS clause 252.204-7021) builds upon the NIST SP 800-171 DoD Assessment Methodology by adding a comprehensive and scalable certification element to verify the implementation of processes and practices associated with the achievement of a cybersecurity maturity level. The CMMC is designed to increase assurance to the DoD that federal contract information (FCI) and DoD Controlled Unclassified Information (CUI) is protected at a level commensurate with the risk. The CMMC requirement flows down to subContractors.

6.5.4.1 The Contractor shall have a current (i.e., not more than three years old) CMMC certificate in SPRS issued by an accredited CMMC Third Party Assessment Organization (3PAO) at the required CMMC level. The description of CMMC levels is available at https://www.cmmcab.org/.

6.5.5 The Contractor shall submit requests to vary from NIST SP 800-171 in writing to the CO or COR, for consideration by the DoD Chief Information Officer (CIO). The Contractor need not implement any security requirement adjudicated by an authorized representative of the DoD CIO to be non-applicable or to have an alternative, but equally effective, security measure that may be implemented in its place.

6.5.6 If the DoD CIO has previously adjudicated the Contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the CO or COR when requesting its recognition under this contract.

https://www.sprs.csd.disa.mil/ https://www.cmmcab.org/

6.5.7 Cloud Computing: If the Contractor intends to use an external cloud service provider, on their behalf, to store, process, or transmit any DoD CUI in performance of this contract, the Contractor shall require the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/) and that the cloud service provider complies with requirements in paragraphs 6.5.8 through 6.5.14 for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

6.5.7.1 If the information is DoD CUI-specific (e.g., PII/PHI), then the Contractor shall ensure the external cloud service provider meet the security requirements equivalent to FedRAMP High baseline.

6.5.8 Cyber Incident Reporting Requirement

6.5.8.1 When the Contractor discovers a cyber incident that affects a covered Contractor information system or the covered defense information residing therein, or that affects the Contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall:

6.5.8.1.1 Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered Contractor information system(s) that were part of the cyber incident, as well as other IS on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor’s ability to provide operationally critical support; and

6.5.8.1.2 In accordance with DFARS clause 252.204-7012, rapidly report (within 72 hours) cyber incidents involving DoD CUI to DoD Cyber Crime Center (DC3) via https://dibnet.dod.mil/portal/intranet/. In the event of a cybersecurity incident involving a CUI- Specific breach (i.e., PII/PHI), the Contractor, in addition to reporting to the DC3, shall follow the incident reporting guidance prescribed in the TRICARE Operations Manual, Chapter 1, Section 5, “Compliance with Federal Statutes” at https://manuals.health.mil/

6.5.8.2 Cyber incident report: The cyber incident report shall be treated as information created by or for DoD and shall include, at a minimum, the required elements as prescribed at the https://dibnet.dod.mil/portal/intranet/.

6.5.8.3 Medium assurance certificate requirement: In order to report cyber incidents in accordance with this clause, the Contractor or subContractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents. For information on obtaining a DoD-approved medium assurance certificate, see https://public.cyber.mil/ https://www.fedramp.gov/ https://dibnet.dod.mil/portal/intranet/ https://manuals.health.mil/ https://public.cyber.mil/

November 16, 2021

6.5.9 Malicious software: When the Contractor or subContractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to DC3 in accordance with instructions provided by DC3 or the Contracting Officer. Do not send the malicious software to the Contracting Officer.

6.5.10 Media preservation and protection: When a Contractor discovers a cyber incident has occurred, the Contractor shall preserve and protect images of all known affected IS and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest.

6.5.11 Access to additional information or equipment necessary for forensic analysis: Upon request by DoD, the Contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis.

6.5.12 Cyber incident damage assessment activities: If DoD elects to conduct a damage assessment, the CO will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of DFARS clause 252.204-7012.

6.5.13 Apply other IS security measures when the Contractor reasonably determines that IS security measures may be required to provide adequate security in a dynamic environment or to accommodate special circumstances (e.g., HIPAA) and any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability. These measures may be addressed in a system security plan.

6.5.14 The Contractor shall maintain within the US or US territories all Government data that is not physically located on DoD premises, unless the Contractor receives written notification from the CO to use another location, in accordance with DFARS 239.7602-2(a).

6.5.15. The Contractor shall mitigate supply chain risk to the government by complying with DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

6.6 Risk Management Framework (RMF) for DoD IT: Platform Information Technology (PIT) and IT Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with DoDI 8510.01, Risk Management Framework (RMF) for DoD IT and comply with annual Federal Information Security Modernization Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the NIST SP 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

6.6.1 All systems subject to RMF must present evidence of authorization in the System Security Plan, Security Assessment Report) a Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD RMF or equivalent DoD Component…