A03 SOW.docx

STATEMENT OF WORK

Defense Finance and Accounting Service (DFAS) Contract For Erasure of Data and Destruction of Tape Drives

1. BACKGROUND:

NAFCPS pays Army and DoD Non-Appropriated Funds employees. NAFCPS is the Automated Information System (AIS) used to perform the following functions related to NAF Funds; NAF Civilian Pay, Debt and Claims, Garnishments and, Tax and Disbursing Reports. NAFCPS calculates pay and leave in accordance with applicable laws, regulations and union agreements on a biweekly basis for a variety of types of employees with differing pay and entitlements. NAFCPS provides users with detailed reports concerning taxes, benefits, garnishments, allotments, leave information and expenses by General Ledger Account Code (GLAC) after each payroll processes. The system prepares quarterly IRS Form 941 and annual W-2 forms for all mission essential civilian employees. We have two (2) servers that need to be decommissioned located at the Army Red River Depot Data Center in Texarkana, Texas. In order to decommission them, we need to erase sensitive data (including Personally Identifiable Information - PII) from two (2) tape drives and two (2) tapes and then destroy them.

2. SCOPE:

The scope of this contract is the erasure of sensitive data (including PII) from two (2) tape drives and two (2) tapes and the destruction of them after the data is erased. The contractor must provide media erasure and destruction services to include the destruction of client’s data bearing media devices (such as tape drives, magnetic tape, solid state devices, etc.). The contractor must provide a certification that the data has been erased and the tape drives and tapes destroyed.

The contractor must provide personnel, equipment, tools, materials, and any other items necessary to perform all services herein from the following DFAS Facilities/Sites:

Destruction site:

Army Red River Depot Data Center 100 James Carlow Drive Building 184 Texarkana, TX 75507

3. REQUIREMENTS:

3.1 Contractor to provide confidential on-site erasure of data and destruction of two (2) tape drives and (2) tapes to protect customers from identity theft, in accordance with laws and regulations.

3.2. Reliably and completely remove all data from tape drives and tapes so that it can no longer be read or recovered and destroy the tape drives and tapes at the destruction site.

3.3. The contractor will perform secure data erasure in accordance with privacy and security federal regulations and laws.

3.4. The contractor shall destroy all tape drives and tapes with observation from the Government Point of Contact (GPOC) or site designee.

3.5. The contractor must provide verification and certification for every erasure and destruction. No later than 24 hours after destruction, a signed certificate for erasure of data and destruction must be issued upon completion of each job. The certificate will be submitted to the COR and indicate the date of erasure of data and destruction, identify the material destroyed, method of destruction, number of tapes and tape drives disposed and be signed by the individuals (contractor and Government) designated to destroy and witness the erasure of data and destruction. Each erasure of data and destruction operation is performed according to the standards set by DoD 5220.22-M, NIST 800-88 Clear and Purge.

3.6. The contractor must provide personnel, equipment, tools, materials, and any other items necessary to perform all services.

3.7. Contractor Facility Requirements: The contractor will adhere to the following facility restrictions:

3.7.1. The contractor will not bring a phone or laptop into the Data Center.

3.7.2. The contractor must be escorted.

3.7.3. The contractor cannot take any photos.

3.7.4. The contractor will not leave anything in top of the servers.

3.7.5. The Contractor shall meet all Government security requirements and be agreeable to site inspections for vehicles.

4. PERIOD OF PERFORMANCE:

The service shall be performed within 30 days after contract is awarded.

5. CONTRACTING OFFICER REPRESENTATIVE (COR):

A COR will be appointed by the Contracting Officer to provide technical direction and administration of the contract. The appointment shall be in writing and shall state the scope of authority and limitations. The COR has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. The COR is not authorized to change any terms or conditions of the contract. Upon contract award, a letter of designation will be issued to the COR and shared with the Contractor.

The COR listed below is subject to change. The contractor will be notified via written communication when a change is made.

Charles M. Cales, DFAS Columbus, Telephone: 614-701-2059, e-mail:charles.m.cales.civ@mail.mil.

6. ADMINISTRATIVE:

The Government Point of Contact (GPOC) will act as the on-site point of contact for the Government. They will initiate requests and monitor performance. The GPOC or designee’s authority is limited to the technical issues and is not authorized to make contractual decisions. The authority to resolve monetary issues and contractual interpretations is the responsibly of the Contracting Officer. The COR or designee for each requirement will be identified on the individual award.

Government Point of Contact (GPOC) for this Requirement:

Carmen Reyes Aguayo, DFAS-Indianapolis, Telephone: 317-989-2767, email: carmen.m.reyesaguayo.civ@mail.mil.

7. SECURITY (escorted as a visitor and not access to any system, turned off and disconnected)

Security Requirements – UNCLEARED ESCORTED CONTRACTORS

For contractor personnel not requiring direct access to DFAS systems/networks, Classified Information, Controlled Unclassified Information (CUI), to include Personally Identifiable Information (PII), escorted continuously by DFAS personnel, and who do not currently possess a current U.S. Government background investigation of Tier 1 (formerly IT-III) or equivalent and higher:

· The following items must be submitted to the DFAS Personnel Security Office for contractor personnel who are escorted:

1. DFAS Form 9035, Contractor Request for Investigation (CRI);

2. OF306, Declaration for Federal Employment

3. A request from the COR, in writing, for “Escorted Access Only”

4. A set of fingerprints, unless any of the following apply;

a. The person has been fingerprinted for the Office of Personnel Management (OPM) within the past 30 days;

b. The person is currently undergoing a background investigation, or reinvestigation, by OPM or any other Federal agency;

c. The person has a background investigation currently being adjudicated by the Department of Defense Consolidated Adjudications Facility (DoD-CAF) or another CAF;

d. The person has been favorably adjudicated within the past 30 days by the DoD CAF or a CAF from any other Federal agency; or

e. The person is coming directly from another DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

f. The Personnel Security Office otherwise determines that no new fingerprints are required.

· Once the results of the fingerprints are received, and the results are negative for a criminal record, the Personnel Security Office will issue a notice to the COR indicating the contractor employee is clear to proceed. No further action will be needed at this point.

· In cases where a fingerprint record check indicates contractor personnel have been involved in any criminal activity within the previous seven (7) years, DFAS Personnel Security will conduct a review of the record to determine if the activity is disqualifying i.e. presents a security risk to U.S. Government/DFAS personnel or assets. If it is determined that the record is not disqualifying, the Personnel Security Office will issue a notice to the COR indicating the contractor employee is clear to proceed.

· Contractor personnel with current, pending criminal charges or criminal cases that have not yet been adjudicated and concluded by the court having jurisdiction, are not eligible to work on the contract.

· DFAS personnel will escort and remain with the contractors 100% of the time the contractors are onsite. Contractors will not have or need direct system access.