A02-PWS- Project_Management_and_Quality_Assurance_Support.pdf

SEP 24

PERFORMANCE WORK STATEMENT (PWS)

Facilities Project Management and Quality Assurance Support

Logistics (LOG), Walter Reed Army Institute of Research (WRAIR)

Part 1

General Information

1. General: This is a non-personal service(s) contract under which the personnel rendering the service(s) are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

1.1 Description of Services/Introduction: This is a non-personal service(s) contract to provide quality assurance support services for Facilities Management Department (FMD) of Logistics (LOG).

1.2 Background: The Walter Reed Army Institute of Research (WRAIR) provides unique research capabilities and innovative medical solutions to a range of Force Health Protection and Readiness challenges currently facing U.S. Service Members, along with threats anticipated during future operations.

Through both times of peace and war, infectious diseases have killed, sickened, and disabled far more Service Members than bombs and bullets. WRAIR has created a model of vaccine and therapeutic development that is unique, nimble, and responsive to dynamically evolving infectious disease threats of military importance. WRAIR, with its unparalleled expertise, facilities, and international network, has developed many vaccines and drugs in use today by military and civilian medicine around the globe.

In addition to protecting against infectious disease threats, WRAIR conducts basic and applied research that promotes psychological resilience, enhances neurological functioning, and improves operational readiness among U.S. Service Members. By using a continuum of research from basic science to applied field studies, WRAIR creates innovative solutions to enhance Service Members’ resilience and recovery. Research in military psychiatry and neuroscience has been an integral part of WRAIR's portfolio for more than 70 years. WRAIR researchers are recognized leaders in operational medical research for the military in a number of fields, including brain trauma, blast exposure, deployment stressors, and sleep management.

The FMD of LOG is responsible for operations and maintenance of medical research facilities occupied by the Walter Reed Army Institute of Research (WRAIR) and the Navy Medical Research Center (NMRC) located at Forest Glen Annex (FGA), Silver Spring, Maryland to include oversight and management of Army Medical Research facility construction and renovation projects.

The WRAIR FMD has a requirement to acquire non-personal services in support of WRAIR's facilities management program to support the initiatives and mission of FMD, to maintain continuity of facility operations, and to allow for continued facilities service support for the WRAIR/NMRC client-base.

1.3 Scope / Period of Performance:

1.3.1 Scope: The Contractor shall provide non-personal support service(s). This shall include providing all personnel, supplies, transportation, supervision, and other items necessary to perform services as described in the Performance Work Statement (PWS) and associated contract documents, except for those items specified in Part 3 Government Property and Services. The Contractor shall perform to the standards and acceptable quality levels (AQLs) identified in this PWS and associated contract documents.

1.3.2 Period of Performance (PoP):

The PoP for this requirement shall be as follows:

Base Period 16MAY2025 – 15MAY2026 Option Period 1 16MAY2026 – 15MAY2027 Option Period 2 16MAY2027 – 15MAY2028 Option Period 3 16MAY2028 – 15MAY2029 Option Period 4 16MAY2029 – 15MAY2030

1.4 Objectives: The objective of this requirement is to provide project management, quality assurance, and operational support technical services to the FMD. This shall include Continental United States (CONUS) and Outside the Continental United States (OCONUS) facilities that range in size from 22,140 square feet to 1,000,000 square feet, along with their surroundings and connections to municipal support (e.g., water, sewer, power, etc.).

Contractor personnel shall work independently and in association with various Government staff on assigned projects that are within the scope of work and shall provide the technical assistance necessary to accomplish the assigned tasks in the performance of this contract at the WRAIR/NMRC FGA and other WRAIR owned facilities both CONUS and OCONUS as needed.

1.5 General Information:

1.5.1 Quality Control Plan (QCP):

The contractor's existing quality assurance system shall be utilized in accordance with FAR 12.208.

1.5.2 Quality Assurance: The Government will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the ACLs (performance thresholds).

1.5.3 Recognized Holidays: The following provides information on recognized holidays for the purpose of the PWS. If submittal of any documentation (e.g., deliverables, submittals, etc.) deadlines fall on a holiday, the closest workday prior to the holiday will apply as the deadline for submittal.

1.5.3.1 United States (U.S.) Holidays: Work shall not be performed on U.S. federally recognized holidays occurring during the normal workweek unless otherwise directed by the KO. When a U.S. holiday occurs on a Saturday or a Sunday, the holiday is observed on the preceding Friday or following Monday, respectively.

New Year’s Day – January 1st M. L. King Memorial Day – 3rd Monday in January Presidents’ Day – 3rd Monday in February Memorial Day – Last Monday in May Juneteenth – June 19th Independence Day – July 4th Labor Day – 1st Monday in September Columbus Day – 2nd Monday in October Veteran’s Day – November 11th Thanksgiving Day – 4th Thursday in November Christmas Day – December 25th

1.5.3.2 Host Nation Holidays: Reserved.

1.5.4 Operating Hours: The Government facility office hours, facility operating hours, and the Contractor support hour requirements often coincide, however, they may differ. Please refer to the following.

1.5.4.1 Government Facility Office Hours: The Government facility office hours occur between the hours of 0800 and 1700 local time to the facility, Monday through Friday, except U.S. holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

1.5.4.2 Government Facility Operating Hours: The Government facility operating hours occur between the hours of 0600 and 1800 local time to the facility, Monday through Saturday. The Government facility is open for operations during the recognized U.S. holidays.

The facility may close due to local or national emergencies, administrative closings, or host nation national holidays.

1.5.4.3 Contractor Support Hours: The Contractor shall provide technical support services during standard business hours of 0800 to 1700 local time to the facility. The work week shall be a normal forty (40) hours per week, excluding vacation and sick time. Any deviation from the normal work schedule must be approved in advance by the COR. (e.g., evening or weekend scheduling of utility outages in order to minimize disruption to WRAIR personnel). The Contractor shall maintain an adequate workforce at all times, for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for specified reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential. For other than firm fixed price contracts, the Contractor will not be reimbursed when the Government facility is closed.

Telecommuting is not feasible for the services provided under this contract.

1.5.4.3.1 Contractor Work Plan: The Contractor shall prepare and maintain a work plan.

The plan, as a minimum, shall identify regularly scheduled work (to include location, work to be completed, timeline, etc.). The Contractor’s proposed work plan shall be submitted to the KO via the COR for review within 10 days after date of contract award. The Government will review and either accept or return their comments to the Contractor within 10 days. The Contractor shall then have three days to submit a final work plan. Any proposed change to the accepted final work plan is required to be resubmitted via the COR for review and acceptance by the KO at a minimum 30 days prior to implementation. The timeline noted above shall apply for review and acceptance for proposed changes. (A.001)

1.5.5 Training Holidays: WRAIR has historically granted military personnel training holidays as compensation for time that they spent in field training. These are typically combined with regular holiday leave schedules (for example, Christmas half-days or day-on-day-off schedules). Training holidays may affect access to military operated facilities. If scheduled work or access to facilities is required, coordination with occupants will be necessary or the work in affected facilities shall be rescheduled after the training holiday.

1.6 Place of Performance: The work to be performed under this contract will be performed at 503 Robert Grant Avenue, Silver Spring, MD 20910. Occasional support may be required at OCONUS locations.

1.7 Security Requirements:

1.7.1 Security Program: Contractor personnel performing work under this contract must have a Public Trust at time of the proposal submission and must maintain the level of security required for the life of the contract. The security requirements are in accordance with the DoD Contract Security Classification Specification (DD Form 254), which is currently accessible at the following link: http://www.dtic.mil/whs/directives/forms/eforms/dd0254.pdf

1.7.2 Personnel Security Clearance Requirements: Reserved.

1.7.3 Installation Access: Access to U.S. installations, buildings, and controlled areas is limited to personnel who meet security criteria and are authorized. Failure to submit required information/data and obtain required documentation or clearances will be grounds for denying access to U.S. installations, buildings, and controlled areas. The Contractor shall ensure that any subcontractors used in performance of this contract comply with these requirements and that all employees, of both the Contractor and any subcontractor utilized by the Contractor, are made aware of and comply with these requirements.

The Contractor shall be aware of and comply with the requirements associated with Installation Access Control. The Government is not liable for any costs associated with performance delays due solely to a firm’s failure to comply with Installation Access Control System (IACS) processing requirements.

The Contractor shall return installation passes to the issuing IACS office when the contract is completed or when a Contractor employee no longer requires access.

1.7.3.1 Installation Pass Log: The Contractor shall provide the KO, via the COR, an Initial Installation Pass Log within 30 days after contract award. The log shall be updated as employees are added or removed. The updated Installation Pass Log shall be current and available at any time upon request by the Government and submitted to the COR within five days after any changes to the log. (A.002)

1.7.3.2 Individual Termination or Expiration of Employment: The Contractor shall collect the installation access passes the same day employment of an individual has expired or has been terminated and shall return them to the issuing office within five days.

1.7.3.3 Contract Termination or Cancellation: Upon termination or cancellation of this contract, the Contractor shall collect all outstanding installation access passes and return them to the issuing office within five days.

1.7.3.4 Common Access Cards (CACs) and CAC Log: The Contractor shall provide the following information: Last, first and middle names, Government issued personal identifier (e.g. Social Security Number, Federal Identification Number, or Tax Identification Number), date of birth, primary email address (this email address will be used to contact the individual), and any other necessary information required to obtain a CAC or installation access card, to the COR within 10 days after award, unless circumstances require otherwise and as directed by the KO. The Contractor shall ensure safeguarding of Personally Identifiable Information

(PII).

The Contractor shall provide a CAC log within the first 30 calendar days after contract award and within five days after changes have been made (unless circumstances require otherwise and as directed by the KO). The COR will provide format and content for the log during the post award meeting. CACs are Government property and must be accounted for. (A.003)

1.7.3.4.1 Contractor workforce must comply with all personal identity verification requirements (CFR clause 52.204-9, Personal Identity Verification of Contract Personnel) as directed by DoD, HQDA, and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor security matters or processes.

For Contractors requiring CAC. Before CAC issuance, the Contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The Contractor employee will be issued a CAC only if duties involve one of the following: (1) both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of six months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

For Contractors that do not require CAC but require access to a DoD facility or installation.

Contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (Army Directive 2014- 05/AR 190-13);

applicable installation, facility, and area commander installation and facility access and local security policies and procedures (provided by Government representative); or, at OCONUS locations, in accordance with status-of-forces agreements and other theater regulations.

1.7.4 Background Checks:

1.7.4.1 U.S. Citizen: Reserved.

1.7.4.2 Local Nationals and Third Country Nationals: Reserved.

1.7.5 Physical Security: The Contractor shall safeguard all Government equipment, information, and property provided for Contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured in accordance with the Army Physical Security Program, Army Regulation (AR) 190-13.

1.7.6 Operations Security (OPSEC) Requirements: Contractor personnel shall adhere to facility security policies and restrictions. The Contractor shall immediately report suspicious activities to security personnel. Government issued access badges shall not be worn outside designated facilities where visible to the general public.

1.7.7 Key Control: Reserved.

1.8 Post Award Conference/Periodic Progress Meetings: The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The KO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the KO will apprise the Contractor of how the Government views the Contractor's performance and the Contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

The Contractor shall attend, participate in, and furnish input to scheduled and unscheduled meetings, conferences, and briefings that relate to the functions and services herein as required by the Government to provide effective communication and impart necessary information. The Contract Manager or designated representative shall attend meetings as requested by the Government. Meeting attendees shall at times include Contractor managerial, supervisory, and other personnel knowledgeable of the subject matter. Meetings may start or end outside of regular duty hours.

1.9 Contracting Officer’s Representative (COR): Refer to Part 2 of this PWS for the definition of a COR. As determined by the KO, a COR will be appointed and identified by letter of designation, a copy of which will be provided to the Contractor by the KO. The designation letter states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is not authorized to obligate the Government. If the work is not written in the contract, the COR is not authorized to request new work. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract, perform inspections necessary in connection with contract performance, maintain written and oral communications with the Contractor concerning technical aspects of the contract, issue written interpretations of technical requirements, including Government drawings, designs, specifications, monitor Contractor's performance and notifies both the KO and Contractor of any deficiencies, coordinate availability of Government property, and coordinate site entry of Contractor personnel.

1.10 Key Personnel: Reserved.

1.11 Identification of Contractor Employees: All Contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties must identify themselves, to include proper marking of signature blocks in correspondence, to avoid creating an impression in the minds of members of the public that they are Government officials. The Contractor shall ensure that all documents or reports, produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed.

1.11.1 Contractor Workspace: Contractor workspace (staging site, on-site office, desk, or work area, etc.) shall contain a sign signifying the space is occupied by Contractor employee(s) to ensure that Government employees and the public know that they are not Government employees. The proposed sign shall be submitted to the KO via the COR for review and acceptance 10 calendar days after contract award. Workspace sign location shall be coordinated with the COR. Contractor employees shall identify themselves by name and company affiliation when answering the telephone, presenting briefings, conducting or attending meetings, and seminars. All Contractor correspondence (written, facsimile, and email display) shall include their company name. (A.004)

1.11.2 Contractor Identification Badges: Contractor personnel shall be easily identifiable through the display of badges in accordance with Contractor Identification (AE Reg. 27-715).

The Contractor (to include subcontractors) shall provide each of their employees an easily readable identification badge. The badge must include the employee’s name, the Contractor’s company name, the functional area of assignment, and a recent color photograph of the employee. Companies with U.S. Government contracts will require their employees to wear these badges visibly when performing work at Government workplaces unless this would be impractical because of mission or safety considerations. The Contractor shall collect all ID badges upon completion of the contract or termination of employee. A listing of issued ID cards shall be furnished to the KO prior to the contract performance date and updated as needed to reflect Contractor personnel changes. (A.005)

1.12 Contractor Travel: Reserved as all work involving locations outside the WRAIR Silver Spring location will be completed virtually.

1.13 Other Direct Costs (ODCs): Cost type Contract Line Item Number (CLINs) under this contract will be invoiced as ODCs. The Contractor shall manage and account for all costs associated with requirements labeled as ODCs, not to exceed the price ceiling listed in this contract.

1.13.1 Invoices: The Contractor shall submit invoices monthly to Wide Area Work Flow (WAWF) with sufficient documentation to provide certification of invoice.

The Contractor is responsible for properly preparing and forwarding to the appropriate Government official, the invoice and receiving report for payment. The Contractor shall attach back up information to receiving reports for ODCs.

Backup information for ODCs shall list all elements of costs. All ODCs exceeding $3,000 requires the Contractor to conduct appropriate competition and obtain approval from the COR prior to purchase. Equipment purchases are not authorized under this contract. The WAWF – Receipt and Acceptance application is the required method of submission.

Where applicable, the Contractor will include additional ODC invoice details as required per protocol for any volunteer payments in support of this PWS.

1.14 Data Rights: The Government has unlimited rights to all documents and materials produced under this contract. All documents and materials, to include the source codes of software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership and copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the KO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.15 Non-Disclosure Requirements: Performance under this contract may require the Contractor to access data and information proprietary to a Government agency, another Government Contractor, or of such nature that its dissemination or use other than as specified in this work statement would be adverse to the interests of the Government or others. The Contractor and Contractor personnel shall not divulge or release data or information developed or obtained under performance of this PWS, except to authorized Government personnel or upon written approval of the KO. The Contractor shall not use, disclose, or reproduce proprietary data, which bears a restrictive legend, other than as specified in this PWS. All documentation showing individual names or other personal information shall be controlled and protected under the provisions of the Privacy Act of 1974, Public Law 93-579, 5 United States Code (U.S.C.) Section 552a.

1.15.1 Non-Disclosure Statements: The Contractor shall provide signed non-disclosure agreements to the Government no later than 30 days prior to commencement of work under the contract. Disclosure of information by Contractor personnel may result in removal of Contractor personnel from performance under this contract. (A.006)

1.16 Protection of Government and Contract Information: Per Public Use Notice of Limitations stated by Defense Imagery Management Operations Center and contained at www.dimoc.mil/resources/limitations/, the Contractor shall not cite any information (e.g., contract information, pictures, locations, etc.) obtained through this contract on any hard copy or digital marketing tools to include its company website.

1.17 Organizational Conflict of Interest (OCI): Contractor and subcontractor personnel performing work under this contract may receive, have access to, or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent OCI as defined in FAR Subpart 9.5. The Contractor shall notify the KO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the KO to avoid or mitigate any such OCI. The Contractor’s OCI mitigation plan will be determined to be acceptable solely at the discretion of the KO. In the event the KO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI. (A.007)

1.18 Phase In /Phase Out Period: Reserved.

1.19 Safety: The following provides information pertaining to safety and accident prevention:

1.19.1 Safety Laws and Regulations: The Contractor shall comply with FAR 52.236-13, Accident Prevention (November 1991), the references contained therein (e.g., U.S. Army Corps of Engineers Safety and Health Requirements Manual (EM 385-1-1)).

The requirements under FAR 52.236-13 and specifically of the EM 385-1-1 include, but are not limited to the following: (A.008)

A. Before initiation of work at the job site, an Accident Prevention Plan, written by the Contractor for the specific work and hazards of the contract and implementing in detail the pertinent requirements of EM 385-1-1; will be reviewed for acceptance by designated Government personnel. Specific requirements for development of the Accident Prevention Plan are found in 01.A and Appendix A of EM 385-1-1. EM 385-1-1 is available online at www.usace.army.mil.

B. Before beginning each activity involving a type of work presenting hazards not experienced in previous project operations or where a new work crew or subcontractor is to perform work, Activity Hazard Analysis (AHA) shall be prepared by the Contractor performing the work activity (See paragraph 01.a.09 of EM 385-1-1).

C. The Contractor shall require subcontractors to submit their plan of operations showing methods they propose to use in accomplishing major phases of work.

D. The Contractor shall discuss the plans in conferences convened by the KO prior to starting work on each major phase of operation. Plans shall include all pertinent information such as layout of haul roads, access roads, storage areas, electrical distribution lines, methods of providing minimum exposure to overhead loads, and methods of access to work areas. The plan for accomplishing the initial work phase shall be submitted within 15 calendar days after award of the contract. Plans for subsequent major phases of work shall be submitted no later than 15 calendar days prior to initiation of work on each major phase.

E. In all areas where construction, demolition, alteration, building, or similar related activities take place, the Contractor shall have the following minimum personal protective clothing and equipment requirements in place for any person working on or visiting the site: short sleeve shirt; long trousers; steel-toed safety boots; and hard hat.

1.19.1.1 In addition to other requirements for accident prevention specified in this contract, the Contractor shall comply with all Federal and State requirements governing safety and health protection on construction sites and other applicable occupational safety codes.

The Contractor shall indicate its plan for compliance considering conditions of the work described by the design, technical proposal, operational activities of the Government or others in the area of the work, identification of the coordinator, and implementation of all other accident prevention provisions of this contract.

1.20 Environmental Compliance: Reserved.

1.20.1 Environmental Compliance Plan and Program: Reserved.

1.21 Required Training: Contractors shall comply with DoD and DHA directed training. The following provides information on training requirements.

1.21.1 Anti-Terrorism (AT) Level I Training: All Contractor employees, including subcontractor employees, who are employed under the contract, shall complete AT Level I Training within 15 days after contract start date, or 15 days after employment of new personnel. Contractor personnel travelling overseas shall complete Area of Responsibility (AOR) specific AT awareness training for U.S. based Contractor employees and associated subcontractor employees. Training shall be completed annually thereafter. Verification of the training shall be provided to the COR within five days after completion of the training. AT Level I awareness training is available at https://jkodirect.jten.mil. Contractor personnel shall complete refresher training every 12 months except AOR specific AT Level I training which shall be completed as required by local AT policies.

If training cannot be conducted on the website, the Contractor shall coordinate with the COR who will contact the local AT Officer at their assigned location for classroom training.

Contractor personnel completing training in the classroom will receive a certificate or the training attendance roster signed by the AT Officer. Verification of the training shall be provided to the COR within five days after completion of the training. (A.008)

1.21.1.1 AT Awareness Training for Contractor Personnel Traveling Overseas: Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of Emergency Services, or Security Office.

1.21.2 OPSEC Training: All Contractor employees, including subcontractors, shall complete Level I OPSEC training within 15 days after contract start date, or 15 days after employment of new personnel. Verification of the training shall be provided to the COR within five days after completion of the training. OPSEC Level I training is available at https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf. Contractor personnel must complete refresher training every 12 months thereafter.

If training cannot be conducted on the website, the Contractor shall coordinate with the COR, who will contact the local OPSEC Officer at their assigned location for classroom training.

Contractor personnel completing training in the classroom will receive a certificate or the training attendance roster signed by the OPSEC Officer. Verification of the training shall be provided to the COR within five days after completion of the training. (A.009)

1.21.3 Information Security Program (InfoSec) Training: All Contractor employees, including subcontractors, requiring access to Government information systems shall complete the Information Security Program Training within 15 days after contract start date, or 15 days after employment of new personnel. Training shall be completed annually thereafter.

Verification of the training shall be provided to the COR within five days after completion of the training. (A.010)

1.21.3.1 This training is located online through the Army Learning Management System (ALMS) at https://www.lms.army.mil/. Login through the Enterprise Access Management Service-Army (EAMS-A). Select “Mandatory Training” in the left side tool bar, then select “Launch” under Information Security Program Training. At the bottom of the screen, it will display the two modules that must be completed. Once these modules are completed you will find the course certificate in the “My Certificates” tab. Submit a copy of this certificate to the COR within five days of completion.

1.21.4 Information Assurance (IA) Training:

1.21.4.1 All Contractor employees, including subcontractors, requiring access to Government information systems shall complete the DoD IA Cyber Awareness Challenge within 15 days after contract start date, or 15 days after employment of new personnel.

Training shall be completed annually thereafter. Verification of the training shall be provided to the COR within five days after completion of the training. Training is available at https://ia.signal.army.mil/DoDIAA/default.asp. (A.011)

1.21.4.2 All Contractor employees, including subcontractors, working Information Technology (IT)/IA functions shall comply with DoD and Army training requirements per Information Assurance Training Certification and Workforce Management DoD Directive (DoDD) 8570.01, Information Assurance Workforce Improvement Program DoD 8570.01-M, and Information Assurance AR 25-2 within 30 calendar days of employment. Training is available at https://ia.signal.army.mil/DoDIAA/default.asp.

1.21.4.3 All Contractor employees, including subcontractors, performing services under this contract with access to a Government information system must be registered in the Army Training Certification Tracking System (ATCTS) (requires CAC to access) within 15 days after contract start date, or 15 days after employment of new personnel. Verification of registration shall be provided to the COR within five days after registration. (A.012)

1.21.5 Personally Identifiable Information (PII): Contractor employees, including subcontractors, performing services under this contract with access to PII and Government information shall complete “Identifying and Safeguarding PII” within 30 calendar days of employment. Contractor personnel shall complete refresher training every 12 months thereafter. The Contractor shall provide the COR a copy of the training certificates for its employees no later than five days after completion. Training is available at http://iatraining.disa.mil/eta/piiv2/launchPage.html. (A.013)

1.21.6 Privacy Act of 1974 and Health Insurance Portability and Accountability Act (HIPAA): Contractor employees, including subcontractors, performing services under this contract with access to protected health information and Government information shall complete “HIPAA and Privacy Act Training” within 30 calendar days of employment. Contractor personnel shall complete this training every 12 months thereafter. Verification of the training shall be provided to the COR within five days after completion of the training. Training is available at https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf. (A.014)

This course provides an overview of two critical privacy laws – the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the Privacy Act of 1974 – and discusses how these laws are applicable to the Military Health System (MHS). This training provides high-level regulatory standards that apply the same to operations staff, clinical staff, and senior management. It is divided into five modules followed by end-of-module exam. Module 1 provides a general overview of HIPAA, then explores the HIPAA Privacy Rule and correlating DoD Privacy Standards in greater detail. Module 2 focuses on the HIPAA Security Rule as well as DoD’s implementation standards. Module 3 provides information about HIPAA Enforcement and HIPAA complaints. Module 4 focuses on the Privacy Act and the DoD Privacy Act Program. And, the final module, Module 5, covers Breach Response at DoD.

1.21.7 Threat Awareness Reporting Program (TARP): All Contractor employees, regardless of whether they possess a security clearance, must complete TARP training on an annual basis per United States Army Medical Research and Development Command (USAMRDC) command directive, as outlined in USAMRDC Memorandum for Record, Command Guidance for TARP Training Compliance, dated 06 January 2016. The training can be conducted face-to-face in a classroom setting or on-line. The supported military organization will coordinate all face-to-face training. Personnel may access the on-line training via the Army Learning Management System (ALMS) website under the course name, U.S.

Army Threat Awareness and Reporting Program (TARP) Course. This training shall be completed within 30 days after contract start date, or 30 days after employment of new personnel. Training shall be completed annually thereafter. Verification of the training shall be provided to the COR within five days after completion of the training. (A.015)

1.21.8 Controlled Unclassified Information (CUI): This course is mandatory training for all DoD personnel with access to CUI. The course provides information on the eleven training requirements for accessing, marking, safeguarding, decontrolling, and destroying CUI along with the procedures for identifying and reporting security incidents. This course also fulfills CUI training requirements for industry when it is required by Government Contracting Activities for contracts with CUI requirements.

Contractor employees, including subcontractors, performing services under this contract with access to protected health information and Government information shall complete “DoD Mandatory Controlled Unclassified Information (CUI) Training” within 30 days after contract start date, or 30 days after employment of new personnel. Training shall be completed annually thereafter. Verification of the training shall be provided to the COR within five days after completion of the training. This training is available online at https://securityawareness.usalearning.gov/cui/index.html. (A.016)

1.21.9 Privacy and Civil Liberties: All Contractor employees, regardless of whether they possess a security clearance, must complete Privacy and Civil Liberties training on an annual basis. This training must be completed within 30 days after contract start date, or 30 days after employment of new personnel. Training shall be completed annually thereafter. This training is located online through the Army Learning Management System (ALMS) at https://www.lms.army.mil/. Login through the Enterprise Access Management Service-Army (EAMS-A) using the PKI Login button. In the top search bar search “Privacy and Civil Liberties”, then select “Register” under the displayed Training, then select “Course Details”. At the bottom of the screen, it will display one module that must be completed. Once this module is completed you will find the course certificate in the “My certificates” tab. Verification of the training shall be provided to the COR within five days after completion of the training. (A.017)

1.22 Network Security: Contractor personnel requiring access to DoD networks to perform work under this contract must have a NACI or an open, pending investigation prior to commencement of work. If the Contractor has a pending investigation, the Contractor must present a copy of this investigation to the WRAIR Security Manager at the time of in-processing for review and must contain no unfavorable information. The Contractor must maintain this level of security for the life of the contract.

Citizenship will be verified by presenting an original birth certificate or a valid U.S. Passport or the original naturalization certificate to the WRAIR Security Manager at the time of in-processing for all Contractor personnel assigned to the contract.

Contractor personnel shall use only Government-provided computer equipment and shall follow all applicable statutes, regulations, and policies governing DoD, U.S. Army Medical Command (MEDCOM), USAMRDC, and WRAIR cyber security and information system assets. Personnel must provide proof of applicable training and certifications to include annual Cyber Awareness training. This training must be documented in the ATCTS unless otherwise authorized by applicable policies. DoD information system, IT service, and IT product acquisition or development must also adhere to applicable policies as described below:

1.22.1 It is DoD policy that cybersecurity requirements shall be identified and included in the design, acquisition, installation, operation, upgrade, or replacement of all DoD information systems. This includes systems and processes developed within the Defense Acquisition System; systems and processes developed at private expense; outsourced business processes supported by private sector information systems; and outsourced IT. IT services provided under this contract must comply with statutory and regulatory IA policy. The source documents for this policy are (available in the WRAIR regulatory repository for review):

A. The National Security Act of 1947 B. Title 40/Clinger-Cohen Act C. Executive Order 12333, “United States Intelligence Activities,” D. National Security Presidential Directive-54/Homeland Security Presidential Directive-23 E. Subchapter III of chapter 35 of Title 44, United States Code (also known as the “Federal

Information Security Management Act (FISMA) of 2002”) F. National Security Telecommunications and Information Systems Security Policy No. 11, “Revised Fact Sheet National Information Assurance Acquisition Policy” and associated “Frequently Asked Questions”

G. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-39 H. Federal Information Processing Standards I. DoD Instruction 8500.01, “Cybersecurity,” March 13, 2014 J. DoD Instruction 8500.2, “Information Assurance Implementation” K. DoD Instruction 8580.1, “Information Assurance in the Defense Acquisition System” L. DoD Instruction 5000.02, “Operation of the Defense Acquisition System,” M. DoD Directive 8570.01, “Information Assurance Training, Certification, and Workforce

Management” N. Chairman of the Joint Chief of Staff Instruction 6510.01E, “Information Assurance (IA) and Computer Network Defense (CND)” O. Defense Acquisition Guidebook – Chapter 7 Acquiring Information Technology and

National Security Systems, Section 7.5 Information Assurance P. DoD Instruction 8510.01, “Risk Management Framework (RMF) for DoD Information

Technologies”

1.22.2 Each proposal under this contract will be screened for compliance with applicable cybersecurity statutes, policies, and procedures. Specific requirements will be stated in the PWS. This special contract provision shall be updated by reference for any changes to source documents. Any new laws or policies applicable to cybersecurity after issuance of this contract will be incorporated into the basic contract unilaterally without equitable adjustment to the basic contract. Any equitable adjustment shall be assessed by individual contracts that may be affected by the change as applicable.

1.23 Program Management Plan (PMP): The PMP is a resource-loaded baseline that outlines the steps that will be taken, provides the timeline to completion (estimated project start and stop dates), provides an expenditure plan aligned to key milestones within the project (to include any anticipated ODCs), identifies and quantifies the deliverables associated with each project, and identifies any associated risks and appropriate mitigation needed for execution of the contract. The completion timeline(s) of any given project shall not extend beyond the overall PoP. The Contractor shall provide the initial PMP within 15 days after award and provide an updated PMP quarterly. Upon acceptance and approval by the Government, the Contractor shall meet the cost, schedule, and forecasted delivery date of all deliverables by taking all reasonable measures to fulfill the requirement. (A.018) (PRS-2)

1.24 Monthly Status Report (MSR): The MSR shall provide a detailed status for each project within the PMP as well as capture an overall status of the support. The Contractor shall deliver the MSR on the last day of each month to the COR. Specific MSR format, and any additional content not specified in this section, shall be mutually agreed upon by the Contractor and COR. The MSR reports cost, schedule, and performance against the PMP baseline and identifies planned versus actual expenditures per project; details all hours worked and workload accomplished; total monthly and cumulative ODC expenditures and projections;

status of known risks and risk mitigation efforts; deliverable(s) completed; technical progress made; meetings attended and outcomes; conference and event status and log; CONUS or OCONUS trip reports; schedule status; and updated staff contact roster. The MSR shall report all funding received and shall detail the projects supported by such funding, the date received, and the funding source. If the MSR shows that a project is not meeting the AQLs set forth in the Performance Requirements Summary (PRS) (PWS Part 7, Attachment 1), the Contractor shall provide the rationale and circumstances preventing the standards from being met.

(A.019) (PRS-3)

PART 2

DEFINITIONS AND ACRONYMS

2. Definitions and Acronyms:

2.1 Definitions: Although not inclusive of every term used within this PWS, the following provides a list of definitions used throughout this PWS and commonly used in the acquisition field.

Contracting Officer (KO) – means a person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

Contracting Officer's Representative (COR) – As defined in Defense Federal Acquisition Regulation Supplement (DFARS) 202.101, means an individual designated and authorized in writing by the KO to perform specific technical or administrative functions. DoD Instruction (DoDI) 5000.72, Part II Definitions states the following when defining a COR: “Defined in subpart 202.101 of Reference (f). Any individual delegated responsibilities pursuant to subpart 1.602-2 of Reference (e), regardless of local terminology, must be certified in accordance with this instruction. For example, local terminology can be COR, KO’s technical representative, technical point of contact, technical representative, alternate COR, administrative COR, assistant COR, line-item manager, task order manager, quality assurance personnel, quality assurance evaluator, or COR management.” In addition, AR 70-13, Chapter 2, paragraph 2-2g, states, in part, the following when providing other surveillance support personnel to assist the COR when needed, “…These other surveillance support personnel may serve as on-site representatives of the COR in performance of actual contract surveillance if they meet all COR requirements and have been appointed by the KO as alternate CORs.”

Contractor – means a supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contractor Acquired Property - means property acquired, fabricated, or otherwise provided by the Contractor for performing a contract and to which the Government has title.

Day – means, unless otherwise specified, a calendar day.

Defective Service – means a service output that does not meet the standard of performance associated with the PWS.

Deliverable – means anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Government Furnished Property (GFP) – As reflected in FAR 52.245-1, GFP “means property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. GFP includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. GFP also includes Contractor acquired property if the Contractor acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

Government Property - means all property owned or leased by the Government. Government property includes both Government-furnished and Contractor-acquired property. Government property includes material, equipment, special tooling, special test equipment, and real property. Government property does not include intellectual property and software.

Property Administrator - means an authorized representative of the KO appointed in accordance with agency procedures, responsible for administering the contract requirements and obligations relating to Government property in the possession of a Contractor.

Physical Security – means that part of security concerned with physical measures designed to safeguard personnel; to prevent unauthorized access to equipment, installations, material, and documents; and to safeguard against espionage, sabotage, damage, and theft.

Quality Assurance – (or Government contract quality assurance) means the various functions, including, inspection, performed by the Government to determine whether a Contractor has fulfilled the contract obligations pertaining to quality and quantity.

Quality Assurance Surveillance Plan (QASP) – means the key Government-developed surveillance process document and is applied to Performance-Based Service Contracting. The QASP is used for managing Contractor performance assessment by ensuring that systematic quality assurance methods validate that Contractor quality control efforts are timely, effective, and are delivering the results specified in the contract or task order. The QASP directly corresponds to the performance objectives and standards (i.e., quality, quantity, timeliness) specified in the PWS.