A02 PWS Building Lightning Protection_PWS_.pdf

Performance Work Statement (PWS) Building Lightning Protection Vision Statement

To provide safety for building occupants and prevent damage to buildings and equipment caused by lightning strikes.

1 Introduction This is a non-personal services contract to provide Inspection, Testing, Maintenance and Repair to all components of the Lightning Protection System at Tobyhanna Army Depot so it remains in good working order. The contractor shall provide all personnel, equipment, supplies, transportation, tools, ladders, lifts, materials, supervision, quality control, and other items and non- personal services necessary to perform lightning protection service, testing, and repair as defined in this PWS. The contractor shall perform to the standards in this contract and according to the most current version of DA PAM 385-64, NFPA 780, all applicable publications.

1.1 Mission

Tobyhanna is a recognized leader in providing world-class logistics support for Command, Control, Communications, Computers, Cyber, Intelligence, Surveillance and Reconnaissance (C5ISR) Systems across the Department of Defense. Tobyhanna's Corporate Philosophy, dedicated workforce and electronics expertise ensure the depot is the Joint C5ISR provider of choice for all branches of the Armed Forces and our industry partners. Tobyhanna's unparalleled capabilities include full-spectrum support for sustainment, overhaul and repair, fabrication and manufacturing, engineering design and development, systems integration, technology insertion, modification, and global field support to our Warfighters. Lightning protection is needed for protection of personnel and property.

1.2 Background

Tobyhanna Army Depot (TYAD) has a building lightning protection system (LPS) that covers several locations throughout the base. There is a requirement for inspection, testing, maintenance and repair of this system. A well maintained, fully functional LPS provides an umbrella of protection for personnel and for mission critical communications/electronics and data processing facilities. It is crucial to ensure that the Depot's LPS is fully operational and is in compliance with government and industry standards for Lightning Protection.

1.3 Scope

The contractor will provide service to the lightning protection system at Tobyhanna Army Depot. Services will include annual inspections for each building containing lightning protection, biennial electrical testing of building 1B, maintenance and any needed repairs on all the components of the existing lightning protection system.

2 General Requirements This section describes the general requirements for this effort. The following sub-sections provide details of various considerations on this effort.

2.1 Non-Personal Services

The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Procuring Contracting Officer (PCO) immediately.

2.2 Period of Performance

The period of performance shall be for one (1) Base Year of 12 months and two (2) 12-month option years.

The Period of Performance reads as follows:

Base Year (Insert PoP dates for Base Period here)

Option Year I (Insert PoP dates for Option Period I here)

Option Year II (Insert PoP dates for Option Period II here)

2.3 Type of Contract

The Government will award a hybrid contract with FFP and T&M Contract Line Items (CLINs).

2.4 Location and Hours of Work

The following subsections specify regular work day hours, place of work, and federal holidays.

2.4.1 Operating Hours

The contractor is responsible for conducting business, between the hours of 7:00 AM - 4:30 PM, (no Holidays or weekends) Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

2.4.2 Place of Performance

The work to be performed under this contract will be performed at Tobyhanna Army Depot.

2.4.3 Recognized Holidays

Unless an emergency occurs, the Contractor is not required to perform services on the following:

New Year’s Day

Martin Luther King Jr.’s Birthday

Presidents Day

Memorial Day

Juneteenth

Independence Day

Labor Day

Columbus Day

Veterans Day

Thanksgiving Day

Christmas Day

2.5 Contract Administration and Management

The following subsections specify requirements for contract, management, and personnel administration.

2.5.1 Key Personnel

The following personnel are considered key personnel by the government: Contracting Officers Representative (COR), Contract Specialist, and Contracting Officer (KO). The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 7:00 AM - 3:30 PM, Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

2.5.1.1 Contracting Officer (KO)

The KO shall ensure performance of all necessary actions for effective contracting, ensure compliance with the contract terms and shall safeguard the interests of the United States in the contractual relationship. The KO shall also ensure that the contractor receives impartial, fair and equitable treatment under this contract. The KO shall determine the final assessment of the contractor’s performance.

2.5.1.2 Contract Specialist

The Contract Specialist will assist the KO in the administration and evaluation of the contractor’s performance.

2.5.1.3 Contracting Officer Representative (COR)

The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

2.5.1.4 Contract Manager (CM)

The contactor shall designate a CM who shall ensure performance under this contract. The name of this person, and an alternate who shall act for the contractor when the CM is absent, shall be designated in writing to the KO. The CM or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The CM shall work through the COR, to resolve issues, receive technical instructions, and ensure adequate performance of services. The CM shall ensure that contractor employees do not perform any services outside the scope of the contract without an official modification issued by the KO. The CM shall ensure contractor employees understand that services performed outside the scope of the contract are performed wholly at the expense of the contractor.

2.6 Special Qualifications

Contractor must have an Underwriters Laboratories Lightning Protection Master Certification or Certification from the Lightning Protection Institute. The contractor shall also be experienced in the inspection, maintenance and repair of lightning protection systems in accordance with the National Fire Protection Association, NFPA70, NFPA 780, and all other requirements that govern the installation of lightning protection systems. At least one technician that is certified and qualified to do this work must be on site whenever work is performed and at no time will non-certified personnel (e.g. apprentice or helper) be at a worksite without direct supervision of a certified technician . Certifications must be presented upon request.

Certifications for any technicians that are hired after this contract has been awarded, or any existing employees that attain certification, must be submitted to the KO and COR before these employees can perform work without direct supervision of a certified technician.

3 Performance Requirements The following section specifies the Performance Objectives and Performance Elements for the contract.

3.1 Lightning Protection System Inspection and Assessment

TYAD has thirteen (13) buildings that have lighting protection, including one with a catenary system and one building that will require electrical testing and certification every 24 months per DA PAM 385-64 Ammunition and Explosives Safety Standards, starting with the base year of the contract. Each building shall require an annual visual inspection. The inspections and testing shall be performed in the springtime (April/May) each year and an assessment shall be made to identify any damage caused by weather, wear and tear, and any other conditions or system deficiencies that may jeopardize the safety of the facility and personnel. The contractor will submit a proposed schedule to complete the inspections and testing. The proposed schedule for the first year of the contract will be submitted 30 days after the contract is awarded. In subsequent years the proposed schedule will be submitted no later than January 31.

Performance Standards

a) Standard: Identifies and corrects deficiencies

AQL: 100%

b) Standard: Addresses all errors and inadequacies

AQL: 100%

Deliverables A004 Inspection and Testing Schedule

3.1.1 Visual Inspection

A visual inspection at each building containing LPS shall be conducted to ascertain the following;

1. The system is in good repair

2. There are no loose connections that might result in high-resistance joints

3. No part of the system has been weakened by corrosion or vibration

4. All down conductors and grounding electrodes are intact (non-severed)

5. All conductors and system components are fastened securely to their mounting surfaces as required (protected against accidental mechanical displacement)

6. No additions or alterations have been made to the protected structure which would require additional protection

7. The system complies in all respects with the current edition of NFPA 780

The contractor shall visibly inspect the condition and integrity of all components, including but not limited to, air terminals, air terminal bases, roof conductors, cross-run conductors, down conductors, secondary conductors, conduits, bonding devices, cable splicers, connectors, ground rods, exothermic weld connections and miscellaneous materials

Any small remedial repairs such as loose connections that can be easily tightened should be addressed during the visual inspection. Any larger or more complex issues that are found during the inspection such as broken or missing parts will be repaired on a Time and Material basis. .

Performance Standards

a) Standard: Addresses all errors and inadequacies

AQL: 100%

3.1.2 1B Electrical Testing

Specific workload in building 1B requires that the LPS on this structure be electrically tested and certified every two years beginning with the first year of the contract. A Certificate of Compliance certifying that building 1B has passed the visual inspection and electrical testing per Appendix D of the Department of the Army Pamphlet 385-64, and meets NFPA 780 lightning protection standards with owner elected exceptions provided by the Tobyhanna Authority Having Jurisdiction. The certificate shall be good for two years until the system is electrically tested again. The certificate shall be submitted to the COR within 30 days of completing electrical testing.

Performance Standards

a) Standard: Compliant with applicable standards

AQL: 100%

A006 Certificate of Compliance

3.1.2.1 Continuity/Resistance Testing

Continuity/Resistance testing will be performed to ensure a low-impedance path through the conductors to the grounding system. The testing shall follow PAM DA 385-64 Appendix D Inspection and Test of Lightning Protection Subsystems section D-3. Testing shall be done using an ohmmeter capable of reading 1 ohm +/- 10%.

Performance Standards

a) Standard: Complete

AQL: 100%

b) Standard: Identifies and corrects deficiencies

AQL: 100%

3.1.2.2 Building Numbers and Size

The following is a list of building with lightning protection and their approximate square foot size.

• Building 1A 226,000 square feet

• Building 1B 260,000 square feet

• Building 1C 245,000 square feet

• Building 9 51,000 square feet

• Building 73 159,000 square feet

• Building 74 16,000 square feet

• Building 30 78,000 square feet

• Building 56 8,100 square feet

• Building 233 6,000 square feet

• Building 90 8,000 square feet

• Building 91 8,000 square feet

• Building 92 8,000 square feet

• Building 96 8,000 square feet

3.1.2.3 Air Terminal Quantities

The following are the approximate number of air terminals that shall be tested per bay in building 1B:

1B-B1 150 Air Terminals

1B-B2 100 Air Terminals

1B-B3 200 Air Terminals

1B-B4 175 Air Terminals

1B-B5 150 Air Terminals

These amounts are approximate and shall be field verified. The Contractor will be given drawings for these five bays for the purpose of marking the resistance readings for all air terminals and to note any deviations from the drawings of the actual locations of the air terminals.

3.1.3 Acceptable Test Results

Electrical testing will include measuring the bonding resistance of the lightning protection subsystem components. Each component of the system shall be measured to the down conductor where it enters the earth. A reading of 1 ohm or less is acceptable. A resistance reading above 1 ohm shall be deemed unacceptable and noted in the building inspection report. When performing a continuity test where a single conductor is used to extend the meter lead to the down conductor, the resistance of the conductor used shall be subtracted from the result to obtain an accurate reading. If it is determined that a high resistance reading is being caused by a loose connection that can be easily fixed then the connection will be tightened and the test will be performed again. Ground resistance must also be tested and should be 25 ohms or less. Where a fall of potential method cannot be performed because of asphalt, concrete, or other obstacles, a clamp on test method will be used to test ground resistance.

Performance Standards

a) Standard: Complete

AQL: 100%

3.2 Report

After the visual inspection, the contractor will submit a detailed report for each building listing at a minimum the following data:

1. Date of inspection

2. Building and Bay number

3. Name of person performing the inspection and organization

4. Current weather conditions

5. Sketch of lighting protection system (LPS) showing any problem areas

6. Condition of air terminals, conductors and other components

7. Discrepancies found

8. Recommendations for corrective actions

In addition to these requirements, when electrical tests are performed the following will also be included in the report:

9. Testing equipment used, serial number and manufacturer

10. All calibration and expiration dates of testing equipment used

11. Type of test performed

12. Results of Test including all Ohms readings

The report will be given to the COR within 30 days of the completion of each inspection. The report will be submitted in both digital (CD Only) and hard copy format. The COR will determine a course of action. If it is decided that repairs and/or parts replacements will be needed then the contractor shall provide a written estimate to the COR for labor and materials necessary to complete the task(s). All LPS replacement components shall be UL Listed. Once the written estimate is received and approved by the COR, the repair work will be scheduled.

Performance Standards

a) Standard: Complete

AQL: 100%

b) Standard: Accurate

AQL: 100%

Deliverables A002 Inspection Report A007 Test Equipment and Measurement Data

3.3 Other LPS Services

The contractor shall provide other LPS services, when necessary as directed by the COR, throughout the year to address system issues. These may include but are not limited to diagnosing system problems, moving or removing system components that may be causing issues, installation or repair of grounding test wells including driven electrodes, replacing or repairing system components that may have been damaged due to weather, corrosion, accident, etc. The work request will come from the COR and the contractor shall then provide a written estimate for labor and materials. Once approved by the COR, the completion of the work will be scheduled with the contractor. All of this work will be done T & M using labor rates and material prices provided by the contractor in their bid package.

Performance Standards

a) Standard: Complete

AQL: 100%

A005 Price Quote

4 Definitions and Acronyms

4.1 Definitions

4.1.1 CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

4.1.2. CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

4.1.3. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S.

Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions ofthecontract.

4.1.4. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

4.1.5. DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

4.1.6. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

4.1.7. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

4.1.8. QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

4.1.9. QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

4.1.10. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

4.1.11. SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

4.1.12. WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

4.1.13. WORK WEEK. Monday through Friday, unless specified otherwise.

4.1.14 LIGHTNING PROTECTION SYSTEM. A complete system of strike termination devices, conductors, ground terminals, interconnecting conductors, surge suppression devices, and other connectors or fittings required to complete the system.

4.1.15 LISTED. Equipment, materials, or services included in a list published by an organization that is acceptable to the authority having jurisdiction.

4.1.16 BONDING. An electrical connection between an electrically conductive object and a component of a lightning protection system that is intended to significantly reduce potential differences created by lightning currents.

4.2 Acronyms

ACOR Alternate Contracting Officer's Representative AFARS Army Federal Acquisition Regulation Supplement AQL Acceptable Quality Level

AR Army Regulation

CCE Contracting Center of Excellence

CFR Code of Federal Regulations

CONUS Continental United States (excludes Alaska and Hawaii)

COR Contracting Officer Representative

COTR Contracting Officer's Technical Representative

COTS Commercial-Off-the-Shelf

DA Department of the Army

DD250 Department of Defense Form 250 (Receiving Report)

DD254 Department of Defense Contract Security Requirement List

DFARS Defense Federal Acquisition Regulation Supplement

DMDC Defense Manpower Data Center

DOD Department of Defense

FAR Federal Acquisition Regulation

FFP Firm Fixed Price

HIPAA Health Insurance Portability and Accountability Act of 1996

IAW In Accordance With

KO Contracting Officer

LPS Lightning Protection System

OCI Organizational Conflict of Interest

OCONUS Outside Continental United States (includes Alaska and Hawaii)

ODC Other Direct Costs

PIPO Phase In/Phase Out

POC Point of Contact

PRS Performance Requirements Summary

PVT Performance Verification Testing

PWS Performance Work Statement

QA Quality Assurance

QAP Quality Assurance Program

QASP Quality Assurance Surveillance Plan

QC Quality Control

QCP Quality Control Program

TE Technical Exhibit

T&M Time and Material

TYAD Tobyhanna Army Depot

UL Underwriters' Laboratories

WAWF Wide Area Work Flow

5 Security Requirements All TYAD contracts and other acquisition-related documents must ensure privacy and security controls follow the information, and that contractors and service providers protect Privacy Act information in the same way the organization adhering to the Federal Acquisition Regulations (FAR) Privacy Act provisions (Subparts 24.1 and 24.2) and include the specified contract clauses (Parts 52.224-1 and 52.224-2), as appropriate, to ensure that personal information is protected as mandated.

In addition to the changes authorized by the clause of this contract; should Force Protection Condition (FPCON) at the installation change, the Government may require changes in contractor security matters and/or processes.

FPCON impact on work levels. (Please annotate with an X which may apply):

____X_ During FPCONs Charlie and Delta, Lightning Protection Services are discontinued. Lightning Protection Services will resume when the FPCON level is reduced to level Bravo or lower.

_____This contract and its employees are considered mission essential. Therefore, all contractor employees are required to report for duty and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the contacting officer via the appropriate COR.

5.1 Contingency Operations Plan

The Contractor shall prepare and submit a Contingency Operations Plan to the Government. The Contingency Operations Plan shall document Contractor plans and procedures to maintain support during an emergency.

The Contingency Operations Plan shall include the following:

o A description of the Contractors emergency management procedures and policy o A description of how the Contractor will account for their employees during an emergency o Planned temporary work locations or alternate facilities o How the Contractor will communicate with Government during emergencies o A list of primary and alternate Contractor POCs, each with primary and alternate telephone numbers o Procedures for protecting Government Furnished Equipment (GFE)/Government furnished property

(if any) o Procedures for safeguarding sensitive and/or classified Government information (if applicable)

Unscheduled gate closures by the Security Police may occur at any time causing all personnel entering or exiting a closed installation to experience a delay. This cannot be predicted or prevented. Contractors are not compensated for unexpected closures or delays. Vehicles operated by contractor personnel are subject to search pursuant to applicable regulations. Any moving violation of any applicable motor vehicle regulation may result in the termination of the contractor employee’s installation driving privileges.

The contractor’s employees shall become familiar with and obey the regulations of the installation; including fire, traffic, safety and security regulations while on the installation. Contractor employees should only enter restricted areas when required to do so and only upon prior approval. All contractor employees shall carry proper identification with them at all times. The contractor shall ensure compliance with all regulations and orders of the installation which may affect performance.

5.2 Antiterrorism (AT) Level I Training.

All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities, and controlled access areas shall complete AT Level I awareness training prior to contract report date. This training is required for any additional or new contractor employees, who start after that period. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR/POC within 10 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website:

http://jko.jten.mil/courses/atl1/launch.html for their training. Completion of contractor employee training will be documented on ELTY form 583, TYAD On-Post Training Record, or contractor equivalent. As applicable, contractor employees must complete annual AT awareness training as it pertains the length of the contract.

5.3 iWATCH Army Training.

The contractor and all associated sub-contractors shall brief all employees on the local iWATCH Army Program. This will consist of utilizing the tools and media products on the informational iWATCH Army website to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR/POC. The iWATCH training is available at the following website:

https://myarmyonesource.com select Family Programs and Services, in the drop down boxes select: Go To, iWATCH Army "See Something, Say Something. The contractor shall notify the COR/POC within 10 calendar days of review of the information on the website for any new employees or subcontractor personnel to assure the ELTY form 583 or contractor equivalent is properly documented. Completion of contractor employee training will be documented on ELTY form 583, TYAD On-Post Training Record or contractor equivalent.

5.4 Access and General Protection/Security Policy and Procedures Contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by TYAD Law Enforcement. Contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA, and/or local policy.

Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by the government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

A background check and approval from Tobyhanna Army Depot (TYAD) Law Enforcement is required for all contractor and subcontractor personnel prior to on-site access at TYAD. All persons seeking entrance to TYAD shall submit to and comply with all security standards and requirements in force at the time such persons are seeking entry. All contractors, regardless of resident status or citizenship, will be subject to vehicle search and intense in-processing by TYAD security personnel prior to being granted access to TYAD.

This security screening process may be time consuming and access may be delayed or denied. The contractor shall ensure ELTY Form 648-C is completed for all contractor and subcontractor personnel requiring depot access to include warranty services. The TYAD point of contact (POC) will provide ELTY Form 648-C, "Request Access to Tobyhanna Army Depot to the contractor/vendor at least ten days prior to the expected visit date for completion. The contractor/vendor shall return the completed ELTY Form 648-C to the TYAD POC in a timely manner so the same may be submitted to Security for processing no later than seven days prior to the visit. All of the required fields on the form shall be complete and accurate by the contractor/vendor for timely processing. This requirement is inclusive of on-site supervisory or managerial personnel and sub-contractor personnel that the Contractor anticipates will be performing work or visiting on-site. This security screening does not relieve the contractor of any responsibilities to conduct thorough pre-employment background checks and drug screening. Contractor workers will not be granted access to the work site until security screening is completed and access is approved. Any contractor personnel on-site who fail screening will not be permitted further access to TYAD. See "Access and General Protection/Security Policy and Procedures.

Submit the completed ELTY Forms 648-C form(s) to the COR or POC. Ensure contracts include the provisions that check for the possibility of and prevent undocumented workers for inclusion in contracted work related to Army missions.

The company will ensure that its employees entering Army-controlled installations or facilities have obtained access badges and passes in accordance with facility regulations and that these badges and passes are obtained in advance so as not to delay the accomplishment of contracted services.

5.5 Common Access Card (CAC) and Information Systems/Network Access by Contractor Workers.

[If applicable.] Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

For contractors that do not require CAC, but require access to a DOD facility or installation. Contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (Army Directive 2014-05/AR 190-13); applicable installation, facility and area commander installation and facility access and local security policies and procedures (provided by Government representative); or, at OCONUS locations, in accordance with status-of-forces agreements and other theater regulations.

5.6 Collection of Badges

The Contractor shall account for all forms of Government-provided identification issued to the Contractor employees in connection with performance under this contract. The Contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government:

(1) When no longer needed for contract performance.

(2) Upon completion of the Contractor employees employment.

(3) Upon contract completion or termination.

The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements. The Contractor shall insert the substance of this clause, including this paragraph, in all subcontracts when the subcontractor’s employees are required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing agency in accordance with the terms set forth in of this section, unless otherwise approved in writing by the Contracting Officer. The company will return all issued U.S. Government Common Access Cards, installation badges, and/or access passes to the COR when the contract is completed or when a contractor employee no longer requires access to the installation or facility. Contractor personnel will obtain a vehicle pass for access to the military installation and Common Access Cards (CAC) for computer access, if applicable.

5.7 Security and privacy requirements for all Department of Defense-Tobyhanna (TYAD) information technology (IT) procurements Applicability: The requirements established in this document apply to all employees, contractors, and users authorized to participate in the TYAD IT procurement process. Further, the requirements established herein apply as the entire contract or order (hereafter referred to as a "contract), or any portion thereof, includes either or both of the following:

1. Access (Physical or Logical) to Government Information: Physical and Logical Access refers to when contractor personnel (and/or any subcontractor) are expected to have (1) routine physical access to an TYAD-controlled facility; (2) logical access to an TYAD-controlled information system; (3) access to government information, whether in an TYAD-controlled information system or in hard copy; or (4) any combination of circumstances (1) through (3) as per OMB M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors.

2. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) employee will operate a federal system and information technology containing data that supports the TYAD mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

5.8 Requirements

Safeguarding Information and Information Systems In accordance with the Federal Information Processing Standards Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect Government information and information systems in order to ensure:

o Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information.

o Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity.

o Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to a TYAD network or operated by the Contractor on behalf of TYAD regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within sixty (60) minutes or less, bring the situation to the attention of the other party.

c. Adopt and implement policies, procedures, controls, and standards that are in effect at the time of contract solicitation and required by the TYAD Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract.

Obtain the TYAD Information Security Program security requirements based on the National Institute of Standards and Technology (NIST) "Framework for Improving Critical Infrastructure Cybersecurity. The framework contains the five (5) core functions to "Identify, "Protect, "Detect, "Respond (to), and "Recover (from) any cybersecurity event.

d. Comply with the Privacy Act requirements and with the Federal Information Security Modernization Act (FISMA) and with the OMB memo M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, Contractor Employee Personnel Security Screenings documents, and FAR clauses as applicable and incorporated into this solicitation/contract. Personally Identifiable Information is defined as below.

Per Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII) is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. Examples of PII include, but are Security and Privacy Requirements for Information Technology Procurements not limited to the following:

social security number, date and place of birth, mother’s maiden name, biometric records, etc.

Per TYAD, sensitive PII is PII that if released improperly could result in harm, embarrassment, inconvenience, or unfairness to the individual whose name or identity is linked to the information. Context must be accounted for in order to determine whether PII is sensitive. Some PII is always sensitive, and some is only sensitive when it is used in a particular context. For example, a list of people subscribing to a government newsletter is generally not sensitive PII; a list of people receiving treatment for substance abuse would always be considered sensitive PII.

The list below is not exhaustive. Context must be accounted for in order to determine whether PII is sensitive.

The following types of information are always considered sensitive:

o Social Security Numbers (including using just the last 4 digits of the SSN) o Date of birth o Mothers maiden name o Biometric identifiers (e.g., fingerprint, iris scan, voice print) o Personal financial information, credit card and purchase card account numbers o Citizenship and immigration status o Criminal history Computer access passwords and security questions o Medical records

1. e. Mandatory Training for All Contractor Staff - All contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable TYAD Cybersecurity and Privacy Awareness training (provided upon contract award) before performing any work under this contract (this training is available to new contractors, even if they do not have a PIV card). Thereafter, the employees shall complete the TYAD Cybersecurity and Privacy Awareness training at least annually, during the life of this contract. All provided training shall be compliant with TYAD training policies. Contractor Employees Who Require Access to Government Information Systems. All contractor employees with access to a government information system must be registered in the Army Training Certification Tracking System (ATCTS) at commencement of services and must successfully complete the DOD Information Assurance (IA) Awareness prior to access to the information system and then annually thereafter.

f. Training Records - The contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with TYAD policy. A copy of the training records shall be provided to the COR within 30 days after contract award and annually thereafter, or upon request.

5.9 Information assurance (IA)/information technology (IT) training All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six months of employment.

5.10 Information assurance (IA)/information technology (IT) certification Per DoD 8570.01-M , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DOD 8570.01-M must be completed upon contract award.

5.11 Security Clearances

[If applicable.] Performance of work will require access to classified information or equipment IAW the DD Form 254, Contract Security Classification Specification, provided as an attachment. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified "Confidential, "Secret, or "Top Secret and requires contractors to comply with (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DOD 5220.22-M); (2) any revisions to DOD 5220.22-M, notice of which has been furnished to the contractor.

If, subsequent to the date of this contract, the security classification or security requirements under this contract are changed by the Government and if the changes cause an increase or decrease in security costs or otherwise affect any other term or condition of this contract, the contract shall be subject to an equitable adjustment as if the changes were directed under the Changes clause of this contract.

The Contractor agrees to insert terms that conform substantially to the language of this clause, but excluding any reference to the Changes clause of this contract, in all subcontracts under this contract that involve access to classified information. Contractor personnel performing IT sensitive duties are subject to investigative and assignment requirements IAW AR 25-2, AR 380-67, DoD 8570.0 and affiliated regulations. Army regulation available at www.apd.army.mil.

http://www.apd.army.mil/

5.12 Threat Awareness and Reporting Program (TARP)

[If applicable.] For all contractors with security clearances, per AR 381-12, TARP contractor employees must receive initial and annual TARP training by a CI Agent or other trainer as specified in 2-4b.

5.13 Contracts that Require OPSEC Training

Per AR 530-1, Operations Security, new contractor employees must complete Level I OPSEC training within 30 calendar days of their reporting for duty. All contractor employees must complete annual OPSEC awareness training. The training is available at the following website: http://cdsetrain.dtic.mil/opsec/index.htm The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR/POC within 10 calendar days after completion of training. Completion of contractor employee training will be documented on ELTY form 583, TYAD On-Post Training Record or contractor equivalent.

a. Contractor personnel shall not discuss government operations in public or over unprotected or unencrypted communications. Official Business, controlled unclassified information may only be transmitted as directed in the SOW/PWS.

b. Contractor personnel shall not discuss government operations in public or over unprotected or unencrypted communications. Official Business, controlled unclassified information may only be transmitted as directed in the SOW/PWS.

c. The Contractor shall not post to company websites, publications, newsletters or other media any images, data or information that reveal sensitive government operations, personnel, equipment, and/or classified or controlled unclassified information. When in doubt, company press releases related to this contract should be coordinated through the Contracting Officer Representative (COR) or Technical Point of Contact, as applicable.

d. Because observation of events, operations, physical changes, etc. may reveal National Security information, specific restrictions are needed to preclude unintentional release of this information to unauthorized parties. (Unauthorized disclosure and transfer of National Security Information is punishable under 18 USC § 793.) Therefore, contractor personnel shall not disclose to unauthorized third parties, post to unofficial sites (including Social Networking sites) any images, data or information, or observed events that reveal sensitive government operations, personnel, equipment, including, but not limited to:

e. Tactics, techniques and procedures, production or work schedules, any visible or concealed modifications, upgrades, additions to vessels, aircraft, or weapons or equipment; increases, change, or decreases in work/deployment frequency or government personnel, vehicle, vessel or aircraft movements;

specialized equipment orders, deliveries, shipments, etc., Unauthorized disclosures and attempts to solicit this type of information by unauthorized third parties or others not affiliated with this contract shall be reported to the installation Security Office, contract point of contact, and your company Facility Security Officer and/or the Defense Security Service. Non-Disclosure requirements remain in effect during the duration of this contract and indefinitely thereafter.

f. Government issued badges, identification shall be removed and/or concealed from plain sight when off station and shall not be left in vehicles or unprotected. Badges and passes may not be duplicated or copied or loaned to others. Lost or stolen identification badges, vehicle passes etc. will be immediately reported to the installation Security Office.

g. Practice OPSEC and implement countermeasures to protect CI and other sensitive unclassified information and execution of military operations performed or supported by the contractor in support of the mission. Protection of CI will include the adherence to and execution of countermeasures which the contractor initiates or as provided by TYAD, for CI on or related to the SOW/PWS.

h. It is strongly recommended the contractor mark and protect related internal production schedules, deliverables, inventories and shortages and identified vulnerabilities related to production of government material. Internal company markings e.g., Business Sensitive, etc., are appropriate for identifying the aforementioned as sensitive information. Specific Government-provided information, drawings etc., will be protected in accordance with guidance in applicable paragraphs of the SOW.

i. All government information must be destroyed at contract termination or returned to the government at the government’s discretion.

5.14 Contracts that Require an OPSEC Standing Operating Procedure/Plan The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer, per AR 530-1, Operations Security. This SOP/Plan will include the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator. The contractor will ensure this individual becomes OPSEC Level II certified per AR 530-1.

5.15 Information Security (INFOSEC)

Contractor personnel must comply with local security requirements for entry and exit control for personnel and property at the Government leased facility or any Government facility where work is being performed.

Contractor employees will be required to comply with all Government security regulations and requirements.

Initial and periodic security training and briefings will be required. Failure to comply with security requirements can cause for removal and the Contractor will not be permitted to provide service on this contract.

The Contractor shall not divulge any information about DOD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information.