A03 Draft PWS-6-11-26.pdf

DRAFT Performance Work Statement Defense Finance and Accounting Service

Cognos Training 10 June 2026

1.0 BACKGROUND

The Defense Finance and Accounting Service (DFAS) mission is to direct, approve, and perform finance and accounting activities for the Department of Defense (DOD). The agency’s vision is to transform with the Warfighter to remain the trusted financial partner for the DOD. As the DOD workforce continues to participate in the evolution of the organization, we must optimize our greatest asset ‐ our people. Technical knowledge and professional skills are critical to DFAS’ ability to succeed in a rapidly changing financial management environment.

DFAS senior management has identified the need to standardize business analytics reporting models from multiple unsupported software packages and so has expanded the use of Cognos which is driving a need for additional instructor-led training.

This Performance Work Statement (PWS) outlines specific requirements associated with the instruction of courses related to technical skillset training.

2.0 SCOPE

The primary objective is for DFAS employees to maximize current Cognos software that will enable DFAS to replace soon to be unsupported software used with current Cognos reporting tools as part of the Business Environment Modernization initiative. In support of this high visibility initiative, DFAS desires to procure the services of a commercial vendor(s) to deliver various COTS/GOTS or individually developed training as specified in this PWS.

3.0 REQUIREMENTS

3.1 Training Delivery

The vendor shall provide all personnel, materials, and supervision necessary to deliver live instructor-led training. The vendor shall provide simultaneous virtual delivery of all in-person delivered classes through an online synchronous virtual platform supported by DFAS for students not located within the physical classroom. Each class shall be taught as Live, Instructor-Led training.

All costs for technical environments, virtual labs, course materials, and any vendor-approved equipment shall be included in the single unit cost of the course.

3.2 Training Delivery Methods

Delivery Method

Description

Virtual Only

The instructor and all students are in different locations, connected through a virtual delivery platform.

In-Person Off-Site

The instructor and primary student group are co-located at a vendor-provided training facility. The session must also be broadcast to remote students via the virtual platform, if needed.

In-Person The instructor and primary student group are co-located at a government-

On-Site provided DFAS facility. The session must also be broadcast to remote students via the virtual platform, if needed.

The vendor shall be required to deliver training using one of the following methods, as specified for each scheduled class:

3.3 Place of Performance and Equipment

The vendor must be capable of delivering virtual training to all DFAS locations (CONUS and OCONUS). The requirements for in-person training are determined by the primary site:

In-Person Method DFAS Locations Location & Equipment Responsibilities

Off-Site Columbus, OH Cleveland, OH Indianapolis, IN

Location: Classes shall be held at a vendor-operated facility within a 15-mile radius of the local DFAS building, with guaranteed, no-cost parking for all registered students. Equipment: The vendor shall provide all necessary equipment, including computers, monitors, projectors, and network connectivity for all students at the facility.

On-Site Limestone, ME Rome, NY Texarkana, TX

Location: Classes shall be held at the designated local DFAS government facility. Equipment: The government will provide the facilities and necessary equipment for on-site students. The vendor is responsible for providing their own adapters to ensure their instructors can successfully connect to the DFAS classroom display and may coordinate with the Classroom Manager to determine what type of adapter is needed. Possible connections to DFAS displays include (but are not limited to) HDMI, DisplayPort, DVI, and VGA. The vendor will provide a laptop and hotspot for all blended classes in order to access the vendor platform and/or present material to the class. The government will provide the facility and necessary equipment for on-site students.

3.4 Virtual Platform Requirements

All training delivered virtually must adhere to the following:

• The platform must be synchronous and online, allowing for real-time, interactive participation.

• The platform and any associated online lab environments must be accessible using a standard

DFAS workstation over a hardware or VPN connection.

• No installation of local software onto the student's workstation is permitted.

3.5 Virtual Lab Environment Requirements

For all classes, the vendor shall provide access to a virtual online lab environment for hands-on interactive learning. This lab must meet the following criteria:

• Availability: The lab must be available 24 hours per day for the duration of the course. If it must close, it shall not close before 11:30 p.m. (EST) on the final day of the course.

• Accessibility: Students must be able to access the lab using their standard DFAS workstations (via network or VPN) without any local software installation.

• Functionality: The lab environment must provide a means for all participants (in-person and virtual) to save their work, allowing them to review and redo activities at any time during the course.

3.6 Course Information

3.6.1 Course Content

Vendor shall ensure all instructional material is reviewed annually and updated as needed to keep pace with changes in the identified version(s) of courses to be taught. DFAS is currently using version 11.2.x and 12.x of the Cognos software. DFAS will inform the vendor of any software version changes. The vendor will have 60 days to revise curriculum to support the current identified version. Unless agreed to by the government in advance of the course presentation, there will be no deviation of the course material or instruction of the course material based on the stated course description. The vendor is responsible for all costs associated with curriculum revisions required by software version changes.

3.6.2 Course Objectives

Course content and delivery will emphasize application-based learning as opposed to only knowledge/academic based presentation style learning and delivery. Individual and group learning exercises will include but are not limited to the following:

• Scenario-based activities/case studies

• Knowledge checks

• Facilitated group discussions to draw upon real world applications in the DFAS environment

COURSE TITLE

(Vendor title may be used after award)

COURSE DESCRIPTION

(Vendor description may be used after award if meets/exceeds original intent)

IBM Cognos Analytics:

Author Reports Fundamentals

Teaches IBM course code B6258G or newer. This course provides authors with an introduction to build reports using Cognos Analytics. Techniques to enhance, customize, and manage reports will be explored. Activities will illustrate and reinforce key concepts during this learning opportunity.

IBM Cognos Analytics:

Author Reports Advanced

Teaches IBM course code B6259G or newer. This course teaches experienced authors advanced report-building techniques to enhance, customize, manage, and distribute reports. Additionally, the student will learn how to create highly interactive and engaging reports that can be run offline by creating Active Reports.

IBM Cognos Analytics:

Overview of Dashboards

Teaches IBM Code B7370G or newer. This course provides a comprehensive introduction to building interactive, insightful dashboards and stories using IBM Cognos Analytics. Through a combination of demonstrations, hands-on practice, and best practices, participants will learn how to create compelling visualizations, develop dynamic stories, build explorations for advanced analysis and apply forecasting and drill-through techniques to enhance user interactivity. This course will cover both foundational and advanced features, including new visualization properties, customization options and predictive insights.

IBM Cognos Analytics:

Working With Data

Teaches IBM course code B6290G or newer. This training teaches data modelers how to model data using data modules in IBM Cognos Analytics.

Modules Users will learn how to create data modules from different sources, such as uploaded files. They will also identify how to customize their data modules by adding joins, calculations, and filters. In addition, they will examine how to group their data (for example, by using navigation paths), how to share their data modules with others, and how to make use of some advanced modeling techniques, such as relative date analysis.

*IBM is the owner of Cognos software.

Note: The Government reserves the right to add IBM Cognos courses not specifically included in the list above

3.7 Learning Principles

The vendor should apply adult learning principles throughout course instruction. In addition, the vendor shall provide instructors who:

• Thoroughly prepare and understand the stated course objectives prior to instructing.

• Communicate the stated learning objectives to the students within the scheduled class hours.

• Discuss the enabling learning objectives (ELOs) for each unit of instruction and answer student questions pertaining to those objectives.

• Use personal expertise and experience to provide relatable examples and realistic work-related challenges by offering critical knowledge in the various facets of design, development, and troubleshooting to supplement or enhance materials to the extent at which they contribute to course objectives.

• Incorporate both individual and group learning exercises in the form of scenario-based activities, knowledge checks, and facilitated group discussions.

Note: Courses are intended to be instructor-led and application-based learning. Courses will not be self-paced learning events.

3.8 Learning Environment

The vendor shall apply the following classroom concepts during instruction of all courses:

• Dialogue – Positive interaction shall occur between the learners and instructors.

• Supportive Atmosphere – A comfortable environment for learning shall be established to include a nurturing instructor, friendly and informal discussion, non-threatening atmosphere where a learner can ask questions without fear of embarrassment or condemnation.

• Encouragement of Cooperative Communication – Clear opportunities for discussion between learners and instructors as well as learners amongst each other.

• Professionalism and Impression Management – All instructors shall maintain a professional business presence and shall not make any comments that may reflect negatively on DOD or any government activity or program.

• Student Assistance – Instructors shall provide personal assistance outside scheduled classroom hours to students experiencing difficulty or requiring further clarification with the units of instruction.

Instructors may also enlist the assistance of other students or establish student study groups to enhance performance.

3.9 Class Size

Class sizes shall not exceed twelve (12) participants for instructor-led and/or virtual delivery.

3.10 Annual Course Schedule

The vendor must be capable of delivering the same course at up to two (2) sites simultaneously. The below proposed annual schedule is to provide the vendor with sufficient information with which to quote. Specific dates, courses, and locations will be provided following award of the anticipated contract.

Estimated Number of Iterations

(Annually)

Course Title (Vendor title may be used after award)

Course Length (days)

Projected Number of Students

6 IBM Cognos Analytics: Author Reports Fundamentals 3 72 2 IBM Cognos Analytics: Author Reports Advanced 2 24 1 IBM Cognos Analytics: Overview of Dashboards 1 12 2 IBM Cognos Analytics: Working with Data Modules 1 24

NOTE: The iterations/number of students represents the estimated maximum number of courses expected to be delivered – but not guaranteed.

3.11 Instructor Qualifications

The vendor shall provide instructors that are subject matter experts in their topic. Subject matter experts shall have a minimum of three (3) years teaching experience and a minimum of three (3) years professional experience as an IBM Certified Cognos programmer/developer.

3.12 Assigned Instructors

Suggested 3.12 Language: The Contractor shall provide written notification to the Contracting Officer’s Representative (COR) identifying the assigned instructor at least ten (10) business days prior to the convening date of each class. Instructor substitutions requested after this ten-day deadline must be reported to the COR within 48 hours, and all alternative instructors require prior written approval from the COR before they may instruct. The prime Contractor shall bear ultimate responsibility for all contract deliverables and performance. The utilization of any subcontractors or sub-vendors requires explicit, prior written approval from the DFAS Contracting Officer for each specific instance. The Government will not maintain or recognize a pre-approved list of subcontractors."

3.13 Vendor Personnel

The vendor shall provide a primary point‐of‐contact (POC) to coordinate with DFAS as necessary to resolve any issues that may arise associated with the delivery of training (instructor-led and virtual). The vendor shall also provide a project manager (PM) who will be responsible for providing monthly status reports within the first ten (10) days of the beginning of each month. The primary POC and PM may be the same person.

3.14 Quality Assurance Surveillance Plan (QASP)

The Government will utilize a QASP to monitor and provide feedback on contractor performance. All deliverables under surveillance can also be found in this PWS.

3.15 Course Evaluations

Upon completion of the course, DFAS will provide students with a course evaluation. DFAS will provide the vendor with access to, or an electronic version of, the summary report of the class evaluation. The report will be available approximately one (1) month after class completion. Only the standard DFAS training evaluation form will be given to the participants. The vendor shall not request participants to complete a vendor's training evaluation form in addition to the DFAS version.

3.16 Instructor Evaluation Standard

On a regular and routine basis, DFAS will evaluate instructors by reviewing ratings and feedback provided within voluntary class surveys that are submitted by students having attended the course, as well as, through periodic observation by the Learning and Development staff. All instructors are required to adhere to course material being presented and course requirements being met as referenced in the Statement of Work/Performance Work Statement, as well as always conduct themselves in a professional manner Ratings, feedback, or observations that indicate less than satisfactory performance and/or citing instances of misconduct will be evaluated on a case-by-case basis and may be reported to the contractor. Within two (2) business days of the report, the contractor will provide information on what action shall be taken to mitigate performance issues or address conduct concerns. If the contractor fails to mitigate performance issues, DFAS may issue negative performance ratings, cure notices, and potential termination of the contract.

3.17 In-Process Reviews

The vendor shall participate in in‐process reviews (IPRs) as requested. These IPRs are used as a method to resolve critical issues which may impede progress and/or impact scheduled deliverables. The IPRs shall be conducted via available conferencing solutions. These IPRs shall establish a plan of action for problem resolution and continuance of work in accordance with the service contract and this PWS.

3.18 Course Material

The vendor shall provide electronic copies of all course materials to each student. Upon student request, the vendor shall also provide hard copy materials and will be responsible for all costs associated with the reproduction and distribution of those materials. Shipment of requested hard copies must occur at least eight

(8) business days prior to the scheduled class convening date, and the vendor shall provide tracking information upon request. All electronic materials must be delivered in a format that is not tied to a login, email address, User-ID, or any other form of cloud-based or online-only access. Course materials shall demonstrate sound comprehensive professional quality beyond simplified workbooks and PowerPoint presentations.

Courses will be 508 compliant. This includes accommodating the sight impaired when using vendor-owned computers/laptops to conduct training through use of Job Access with Speech (JAWS) software. In addition, sight impaired participants will be provided with all reading material or books in electronic text form.

3.19 Certifications

National Association of State Boards of Accountancy (NASBA)

• Any course with content that could align to NASBA will be granted CPEs.

• The successful vendor shall provide training in accordance with NASBA standards for continuing professional education (CPE) and shall provide each participant with a certificate of completion indicating the number of CPEs awarded within two (2) weeks after class completion.

• Vendors must be able to clearly show that they have NASBA CPEs and related fields of study for each class in which they quote. NASBA CPEs must be in place at contract award. Vendors will be allowed thirty (30) days from the date of closing of the RFQ to finalize CPE certification and demonstrate that they have the required CPEs.

3.20 Training Timelines

The vendor must be capable of providing requested training/services when provided at least ten (10) business days’ notice of the need for the training/service for CONUS classes and at least thirty (30) days’ notice for OCONUS classes.

3.21 Remote Access

Security requirements are as follows:

• On‐line learning resource assets will support DoD approved and supported browser versions.

• Vendors conducting remote or providing virtual, live, online, interactive training solutions for

DFAS users must employ a solution that does not require a reduction of the DFAS security posture to operate. The preferred training solution will be Internet portal based utilizing HTTPS over the standard TCP port 443. Use of other ports must be coordinated with the Government Contracting Officer prior to completion of an agreement. Port solutions determined as not meeting the DFAS security/cybersecurity requirements will not be permitted.

• The training will not require software to be loaded on government computers, collect/store personally identifiable information or require the use or acceptance of persistent cookies or cross‐ site scripting.

4.0 DELIVERABLES

4.1 Completion Certificates

The vendor shall provide each participant with a certificate of completion within two (2) weeks of the course completion date. Where possible, an electronic version of the completion certificate (Adobe Acrobat®) shall be delivered via e-mail utilizing the address specifically listed by each participant on the class roster. When this method of distribution is not practical, the completion certificate shall be mailed to the respective classroom site manager through use of common ground carrier (U.S. Postal Service, etc.).

The certificates must display the participant’s name, the training date and location, and the NASBA CPEs (if applicable) earned by the participant.

4.2 Monthly Status Report

The vendor shall provide a Monthly Status Report (MSR) by the tenth day of the following month, which identifies any problems or issues encountered during the month and recommended solutions. The report shall use Microsoft Word or Adobe format to be delivered via e-mail to the COR. The report shall include, as an attachment, a spreadsheet identifying the total number of seats available, and the number of seats actually filled in each course.

4.3 Class Rosters

The vendor shall be responsible for distributing class rosters (provided by DFAS) to enable students to formally document their attendance. The vendor will be responsible for furnishing the completed rosters to DFAS site classroom managers at the completion of each session and providing a copy to the DFAS Project Manager within five (5) days of the completed course.

4.4 Invoice Submissions

The vendor shall submit invoices for payment monthly. Invoices should be submitted no later than ten (10) business days following previous month end. Invoices shall contain a description of the course taught, the location of the delivered course and the date completed.

Suggested language: The vendor shall not invoice for a class until all deliverables for that class, including course materials and completion certificates with applicable CPEs, have been successfully delivered and accepted by the Government."

5.0 SCHEDULING

5.1 Hours of Operation

The vendor shall schedule all training to be held within the normal operating hours (8:00 am – 4:30 pm, local time) of the DFAS operating site where training is being conducted. While in a training status, DFAS students are required to maintain the mandatory number of work hours. For all full day courses, the contractor shall provide a training environment for the entire duration of normal operating hours. The vendor shall not release students early without advance permission of the COR.

5.2 Cancellation & Rescheduling Policy

Suggested Language: The Government reserves the right to cancel a CONUS class at least ten (10) business days (or at least thirty [30] business days for OCONUS classes) prior to the scheduled start date. In the event of such cancellation, the Government shall not be liable for any tuition, material, or administrative fees. The Government's sole liability shall be the reimbursement of documented, non-refundable travel and lodging expenses incurred by the Contractor, provided such expenses are fully compliant with the Federal Travel Regulations (FTR) and cannot be recovered through travel insurance or reservation modifications.

6.0 GOVERNMENT FURNISHED RESOURCES

6.1 Training Coordination

Government personnel will provide assistance with coordinating receipt of training materials, preparation of classrooms, and any other necessary liaison functions.

6.2 Contact Information

The government shall be responsible for providing the vendor with pertinent contact information for on-site personnel (name, phone number, etc.). This information will be provided prior to performing work under the contract.

7.0 LOCATIONS AND TRAVEL

Performance under this contract shall require travel by vendor personnel. When domestic (CONUS) and/or overseas travel (OCONUS) is required, the vendor shall provide for any/all necessary travel arrangements for their personnel. All travel will be included in the unit cost of each course. (one CLIN per course, not one CLIN for the course and one CLIN for travel).

8.0 PERIOD OF PERFORMANCE

One (1) year from the date of contract award with three (3) available one-year option periods..

9.0 CONTRACTING OFFICER REPRESENTATIVE (COR)

A COR will be appointed in writing by the Contracting Officer to provide technical oversight and contact administration support. The written designation letter will define the scope of the CORs authority and any limitations. The COR is authorized to provide technical directions to the Contactor, providing such directions:

• Are within the scope of the contract.

• Does not constitute a change to the contract terms and conditions.

• Does not result in any funding obligation or modification.

The COR is not authorized to make changes to the contact’s terms, conditions, scope, price, or period of performance. Only the Contacting Officer has authority to modify the contract. Any proposed changes or requests for modification shall be submitted to the Contracting Officer for review and written approval.

Upon contract award, a formal letter of designation will be issued to the COR and provided to the

Contactor.

10.0 INSPECTION/ACCEPTANCE

Contractors shall comply with the Wide Area Workflow (WAWF) electronic invoice system when submitting invoices for payment. All invoices and receiving reports must be submitted electronically through the WAWF in accordance with the DFARS 252.232-7006, WAWF Payment Instructions. The Contractor shall ensure that all required data fields are completed accurately, and that appropriate supporting document is attached. Failure to comply with WAWF submission requirements may result in payment delays. Specific WAWF instructions, including document types and routing codes, will be provided by the CO or designated representative at the time of the award.

11.0 SECURITY

General Requirements. Contractor personnel must meet the following conditions of employment.

1. Possess a REAL ID

2. 18 years or older.

3. U.S Citizen or National (Verification documents required if foreign born).

4. Social Security Number.

5. Selective Service Registration (males born after 12-31-1959). A Status Information Letter is required for any male born after 12-31-1959 that is not registered with Selective Service.

6. Reside in the United States.

7. The unescorted position is a non-sensitive position which requires a favorable fitness review and background investigation as a condition of employment. Failure to maintain security eligibility may result in termination

Personnel Security Investigation (PSI) Requirements – Non-Sensitive (NS) Positions (Unescorted Access). Contractor personnel will require a favorably adjudicated Tier 1, or equivalent Non-Sensitive (NS) level or higher investigation. No access to classified information, CUI, to include Personally Identifiable Information (PII), or system access required.

Personnel Security Investigation Waivers. For those contractor personnel who do not already have the required background investigation and adjudication, an NS position may be occupied with a pre-investigative waiver from DFAS Personnel Security provided no issues of security concern are identified by DFAS Personnel Security after a review of all information submitted by contractor personnel. Those contractor personnel who do not qualify for a pre-investigative waiver may not occupy a NS contractor position with DFAS until the background investigation is completed and favorably adjudicated by the Defense Counterintelligence and Security Agency Adjudication and Vetting Services (DCSA AVS). It is important to note that while there is no set schedule for background investigations, as each one is different, this process can be lengthy and take several months to more than one year in some cases. Should a contractor company not wish to wait for the entire process to be completed, they may withdraw the contractor applicant from further consideration by notifying DFAS Personnel Security within sixty days from the date DFAS Personnel Security determines the applicant to be ineligible for a waiver. The contractor company may then submit another contractor candidate for a background investigation.

Personnel Security Forms Required.

In accordance with standard DFAS Personnel Security policy, ALL incoming contractors must submit a new set of fingerprints (taken within the last thirty days) *.

Contractor personnel must apply for a fingerprint appointment immediately (the next business day) upon award date.

Contractor personnel shall submit the Contractor Request for Investigation (CRI) (DFAS Form 9035) immediately (the next business day after providing fingerprints) to the Contracting Officer Representative (COR). The information needed in the Declaration for Federal Employment (OF-306) shall also be submitted to the COR by contractor personnel.

The COR will submit the OF-306, DFAS Form 9035, and proof of fingerprints to DFAS Personnel Security all at once. Under no circumstances should this documentation be submitted less than fifteen calendar days prior to the intended performance start date. DFAS Personnel Security will review all submitted documentation to validate whether contractor personnel meet personnel security requirements to perform work on the contract or if a new background investigation is required.

Contractors obtaining favorable security evaluations and DoD CACs for required contractor employees performing on this contract is a prerequisite for contractor performance and invoicing. Also, the failure of a contractor to provide employees who can obtain a favorable security adjudication and a DoD CAC in a timely manner may be considered negatively when assessing contractor performance, termination, or other.

*New fingerprints are not required if any of the following apply:

1. The person has been fingerprinted for the DCSA within the past thirty days.

2. The person is currently undergoing a background investigation, or reinvestigation, by DCSA or any other Federal agency.

3. The person has a background investigation currently being adjudicated by the DCSA AVS or another

AVS.

4. The person has been favorably adjudicated within the past thirty days by the DCSA AVS or a AVS from any other Federal agency: or

5. The person is coming directly from another DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

6. The DFAS Personnel Security Office otherwise determines that no new fingerprints are required.

Incident Reporting Requirements.

In all cases, whenever a DFAS contractor displays conduct, or is involved in any incident, which is in violation of any of the thirteen National Security Adjudicative Guidelines*, the contractor must immediately report the incident to the contractor company Security Office/Facility Security Officer, the DFAS Manager of the area to which they are assigned, the Contracting Officer (CO), the COR, the Director Force Protection, and the DFAS Personnel Security Office. Reporting to DFAS Personnel Security may be made by phone to (317) 212-7888, by email to dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil, or, in the case of personnel physically located at DFAS Indianapolis Center, in person to the DFAS Personnel Security Office located on the third floor center hallway at Column 320T.

All incidents will be investigated by DFAS Personnel Security and, depending on the date of the subject’s most recent investigation, may need to have an updated background investigation initiated. Those that do not require a new investigation will have all relevant information regarding the incident forwarded to the DCSA AVS for review and re-adjudication.

*The thirteen National Security Adjudicative Guidelines are:

1. GUIDELINE A: Allegiance to the United States

2. GUIDELINE B: Foreign Influence

3. GUIDELINE C: Foreign Preference

4. GUIDELINE D: Sexual Behavior

5. GUIDELINE E: Personal Conduct

6. GUIDELINE F: Financial Considerations

7. GUIDELINE G: Alcohol Consumption

8. GUIDELINE H: Drug Involvement and Substance Misuse

9. GUIDELINE I: Psychological Conditions

10. GUIDELINE J: Criminal Conduct

11. GUIDELINE K: Handling Protected Information

12. GUIDELINE L: Outside Activities

13. GUIDELINE M: Use of Information Technology

Some Examples of Incidents That Require Reporting to DFAS Personnel Security:

a) An arrest for any criminal offense, not including minor traffic violations, by any law enforcement agency. This DOES include the traffic offenses of Driving Under the Influence of Alcohol or Drugs, and Reckless Driving.

b) Violation of any court order.

c) Civil judgements.

mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil

d) Delinquencies on any debt for 180 days or longer.

e) Federal, State or Local tax issues or delinquencies.

f) Delinquencies on any Federal debt (including Federal Student Loans and Federally backed home mortgage loans).

g) Child Support delinquencies.

h) Filing for Chapter 7 or Chapter 13 bankruptcy in any Federal Bankruptcy Court.

i) Foreign Travel.

j) Marriage or Cohabitation with a Foreign National (person from a foreign country).

k) Having a close personal friendship with a Foreign National with regularly occurring contact.

l) Ownership of property or financial accounts in a foreign country; and

m) Being approached by a person know to be, or suspected to be, working as an agent of a foreign government or terrorist organization, or any other person, who seeks any information about DFAS, the Department of Defense, or the U.S. Government, especially if the person offers money or something of value to the contractor employee.

It should be noted that a person’s delinquency on Federal debt of any kind may not obtain or maintain favorable personnel security adjudication or be considered for a contractor position with DFAS unless they can provide documentary proof that a payment plan has been established with the Government agency to whom the debt is owed, and that regularly recurring payments are being made. Contractor personnel who cannot obtain and maintain a favorable personnel security adjudication may not have access to government data, facilities, and/or equipment required under the contract.

NOTE: This list does not cover every potential incident or offense; any incident in which a contractor is involved, and a question exists as to whether it should be reported, should report the incident to DFAS Personnel Security, who will then determine if further action is warranted. Failure to report an incident is, in and of itself, an incident involving personal conduct, and may, in some cases, be more serious than the original incident.

Foreign Travel by DFAS Contractor Personnel Official and Unofficial (Personal) Travel: Official U.S. Government Business: persons employed as contractor employees with DFAS, to include those with Noncritical Sensitive (formerly IT-II) access, Critical Sensitive (formerly IT-I) access, access to critical program information (related to Research, Development, Test, and Evaluation), sensitive compartmented information, and/or special access program information, in accordance with DoD Directive 5240.06, are required to complete a DFAS Form 9133, Notification of Foreign Travel, not less than thirty calendar days prior to the scheduled travel.

One copy shall be sent the DFAS Personnel Security group box at dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil and one copy shall be turned into the Site Force Protection Office of the DFAS site where they are stationed. Site Force Protection POC information:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx Upon receipt of the completed Form 9133, the Site Force Protection Office will contact the contractor employee to validate training, complete the country/theater clearance package, as required, and schedule a Foreign Travel briefing. Immediately prior to travel, contractor employees will check with the State Department at https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html for any travel advisories for the country or region being traveled to and take the appropriate steps to ensure their safety for any location covered by a travel advisory or warning.

Security Requirements. Contractor personnel shall follow the security and training requirements in DFAS 2000.1-I, “Force Protection Mission.” Ensure that all contracting officers include applicable clauses in all contracts that require work to be performed for a DFAS location. Contractor personnel shall follow all host security requirements in accordance with Part 117 of Title 32, Code of Federal Regulations; paragraph

117.16. The contractor shall immediately report any occurrences of violation of stated regulations to the DFAS Manager of the area to which they are assigned, CO, COR, Director, Force Protection, and the DFAS Personnel Security Office.

DFAS Instructions can be located at the following agency portal web link:

Official Forms and Pubs - All Documents mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html https://dfasportal.dfas.mil/docs/Documents/Forms/AllItems.aspx?RootFolder=%2fdocs%2fDocuments%2fOfficial%20Forms%20and%20Pubs&FolderCTID=0x012000C5AD4BBE89E91A47852CADC95291E394

Security Education and Training. Contractor personnel shall follow all host training requirements.

Contractor personnel who require unescorted access into DFAS facilities shall receive applicable security training through the site Force Protection Office. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection Portal Page:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx

Installation Entry and Common Access Card (CAC) Requirements.

The Contractor shall comply with established security procedures for entering government installations and facilities. Contractor employees shall be required to obtain and wear identification (ID) badges that will permit access into the facility.

Contractors shall work with the assigned DFAS COR/Mission Partner Account Sponsor (MPAS) to obtain a CAC using Mission Partner Identity Credential Account Management (MP ICAM). Under no circumstances will a CAC be issued to any person unless that person has been cleared by the DFAS Personnel Security Office to work on the contract.

All CACs and badges issued to Contractor personnel are government property and must be returned to the assigned DFAS COR/MPAS upon departure from the program or at the conclusion of the contract, whichever comes first. CACs can also be mailed in or turned into Real-Time Automated Personnel Identification System (RAPIDS) locations. Contractors whose CAC is lost or stolen must report the loss as soon as possible to the assigned DFAS COR/MPAS and present documentation that the CAC is missing and describe the circumstances under which the loss occurred. The assigned DFAS COR/MPAS will follow agency CAC procedures to issue a new CAC.

Contractors must not share their CACs and passwords with any other staff members. The assigned DFAS COR/MPAS will report any violation or suspected violation to the Contracting Officer and DFAS MP ICAM Account Security Manager (MPASM). Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from another agency, that CAC must be revoked and returned before issuance of a new CAC.

12. DATA PROTECTION

The Contractor shall comply with Cybersecurity Maturity Model Certification (CMMC) Level 1 Self- Assessment requirements for the protection of Federal Contract Information (FCI), as applicable to this contract. This requirement is limited to safeguarding FCI that may be provided to or generated by the Contractor in performance of services under this contract. This requirement does not involve the processing, storage, or transmission of Controlled Unclassified Information (CUI).

12.1. The Contractor shall implement and maintain, at a minimum, the safeguarding requirements prescribed in RFO 52.240-93, Basic Safeguarding of Covered Contractor Information Systems and DFARS 252.204-7021, Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements. FCI under this contract may include but is not limited to work schedules; maintenance logs and service reports; equipment inventories; technical manuals or drawings provided for maintenance purposes; and contract administration documentation.

12.2. The Contractor shall ensure that any information system used to process, store, or transmit FCI in performance of this contract meets CMMC Level 1 safeguarding requirements and maintains compliance throughout the period of performance.

12.3 The subject requirement is designated as CMMC Level 1, which focuses on basic protection of Federal Contract Information (FCI). To meet this requirement, contractors must complete a CMMC Level 1 self-assessment prior to receiving award in the Supplier Performance Risk System (SPRS). The Level 1 self-assessment includes 15 basic security practices, as required by RFO 52.240-93, Basic Safeguarding of Covered Contractor Information Systems. The Contractor shall annually affirm continued compliance in SPRS throughout contract performance.

12.4 To complete the self-assessment, you will need the “SPRS Cyber Vendor User” role in PIEE. If you do https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx not currently have this role, you may request it through PIEE. The Government will verify the Offeror’s assessment status in SPRS. The offeror shall provide the CMMC Unique Identifier (UID) once the self-assessment is complete. For additional information on the CMMC program, please visit: https://dodcio.defense.gov/cmmc/About/ https://dodcio.defense.gov/cmmc/About/