A21-Appendix B - PWS S20-0046 Cyber.pdf

PERFORMANCE WORK STATEMENT (PWS)

S20-0046 CYBER READINESS SERVICES

Draft – 20 May 2020

1.0 Introduction (Objective) and Background

The purpose of this contract is to perform cyber readiness services for the United States Army Corps of Engineers (USACE), CIO/G-6 Cyber Directorate.

1.1 Background

USACE has an ongoing need for short-notice third-party cyber expertise at USACE sites to objectively check and improve cyber readiness. The primary purpose of this contract is to give USACE the ability to rapidly deploy cyber technicians to perform checks and simulated inspections, to recommend issue mitigation, ways to harden sites, and to train, report, and assist staff with Cyber issues within as little as 14 days of tasking.

The unexpected nature of cyber events drives the need for this task order contract – a tool to quickly deploy experienced and certified resources where and when needed, sometimes on very short-notice.

Not using Government or incumbent contract staff for this work provides objective third-party perspective, free from the USACE operating practices, methods, tactics, procedures and outside the normal operating chain of authority. This outside perspective gives the same fresh look inspectors and adversaries have, unbiased from local policies, procedures, habits and hierarchy.

This work requires a vendor experienced with Command Cyber Readiness Inspections (CCRI) that can quickly estimate task workload based on numbers of systems, site location, knowledge of USACE infrastructure tools and hardware, and experience with all that Cyber readiness and CCRI entails.

In addition to lifeline capability for inspection preparation and unexpected cyber events, USACE cyber managers need this contract for routine 3rd party cyber checks performed on random sites, checking and ensuring ongoing USACE-wide compliance with DISA directives. USACE estimates around five such routine simulated site inspections will be needed each year, depending of course on unexpected events and tasking that may also require use of this contract.

2.0 Mission Requirements (Scope)

Provide cyber security consultation Services to USACE, both onsite and virtually when ordered. Services include Cyber Readiness Inspection (CCRI) preparation, Risk Assessments, Security Readiness Reviews (SRRs), Security Technical Implementation Guides (STIG) Reviews, Physical Security Reviews, providing security-related training, and Cyber Subject Matter Expert (SME) engagement. When ordered, these services may include production of best business practice guides, recommendation and remediation reports, knowledge transfer documents, network diagrams for before and after solutions, device and infrastructure configuration recommendations, tool and resource recommendations, risk assessment grading reports, inspection assessment reports, and other deliverables.

3.0 Performance Requirements

3.1 Project Management –For every order, the contractor shall provide all technical, planning, and managerial support to meet the requirements in each task order. The contractor shall furnish all services, materials, and equipment necessary, apart from the Government Furnished Equipment (GFE) and Government Furnished Information (GFI) identified in task order (if any).

S20-0046 Cyber Readiness Services - PWS Page 2 of 22

3.1.1 For each order, the contractor shall designate in writing (email is acceptable) a primary and alternate Contract Manager (CM) within 5 business days of TO issue. The CM or alternate shall have full authority to act for the contractor on all contract matters relating to task order. The CM shall work with the GOV POCs to resolve issues, receive technical instructions, and ensure adequate performance of services. The CM shall ensure that contractor employees do not perform any services outside contract or task order scope without an official modification issued by the SCO. The CM shall ensure contractor employees understand that services performed outside the scope of the task order are performed wholly at the expense of the contractor.

3.2 Task order Options – When Ordered, the contractor shall:

3.2.1 Conduct simulated CCRI

Conduct simulated CCRI including reviews and results for web/SharePoint, Oracle and SQL database, End Point Security (EPS), Host Based Security System (HBSS also known as Army Endpoint Security System AESS), Assured Compliance Assessment Solution (ACAS), Network Infrastructure (internal, boundary, and domain name system (DNS)), Active Directory, Exchange, Video Teleconferencing and Voice Over Internet Protocol (VVOIP), Operating Systems (OS) including Microsoft and UNIX flavors such as Red Hat (all applicable versions), Computer Network Defense (CND) Directives and applicable Security Technical Implementation Guidelines (STIGs), Security Readiness Reviews (SRRs), and Security Requirements Guides (SRGs), and Best Business Guides/Practices, as well as Traditional/Physical Security. The aim of the simulated CCRI is to identify any issues or areas of concern that would pose a risk to the enterprise network or could prevent a passing CCRI score of 80% or better in a future DISA/CRIA CCRI inspection. Typically, technicians are on-site for one or two weeks for simulated CCRI and spend a third week completing reports afterward. Simulated inspection includes conducting hands-on in-person reviews of documentation, configurations, settings, policies, processes, etc. In addition guidance and recommendations will be provided to USACE government and contractor staff, as well as any on-site local nationals. Additional training may be provided to USACE government staff to ensure knowledge transfer of issues found and appropriate remediation.

The team can include up to 7 people, depending on overlapping SME skillsets to perform tasks listed above. Available time must be considered for personnel performing multiple technology reviews as many technology reviews take a long time. Variables with this order include: location, site size in terms of number of local technology area personnel, number of desktop systems and servers, networking equipment, databases, operations systems, etc. and can also have special considerations (e.g.

uncommon systems and network equipment, and may or may not include classified networks up to

SECRET.

Within 5 business days of onsite simulated inspection, Contractor shall deliver the following reports in writing (email of UNCLASSIFIED Reports is acceptable but CLASSIFIED reports require email via SIPRnet email) to GOV POCs:

Provide grading results in accordance with current CCRI Phase formulas in use by DISA CCRI teams.

Provide Risk Assessment grading results in accordance with CCRI Risk Indicator formulas currently used by DISA CCRI Teams.

Provide documented recommendations for a “Path to Success.”

3.2.2 CCRI ‘Game Day’ Support

Provide ‘Game Day’ support for official enterprise or local USACE CCRI pre-inspection or inspection assessments. Support includes preparation of technical documents for inspectors, briefings on USACE cybersecurity posture, diagrams of USACE computing/network infrastructure for UNCLASSIFIED and CLASSIFIED (SECRET) environments, and responses to CCRI queries for information. Typically “Game Day Support” lasts one month prior to assessment and two weeks onsite with inspectors and an

S20-0046 Cyber Readiness Services - PWS Page 3 of 22 additional week afterward for reporting/recommendations. Contractor shall provide report stating dates and times and locations they supported USACE CCRI, accomplishments they achieved, and recommendations for future inspections. Support variables with this order include: SME hours required, locations, scope and length of inspection and special considerations given at time of order, if any.

3.2.3 Vulnerability Assessments

Conduct and report vulnerability assessments including penetration testing, vulnerability scanning set-up (ACAS), and training, application security assessments, database, web, SharePoint, network security assessment, physical/traditional security, Wireless network assessment, mobility, VVOIP, and Microsoft and Unix system testing as listed above. Assessments can vary from one week to several months based on variables. Variables with this order include: number and types of assessments requested, locations, and classification level, and special considerations (if any). Assessment reports will be delivered not later than 5 business days after completion of on-site assessments.

3.2.4 Physical Security Checks

Conduct and report traditional/physical/personnel security readiness inspections including checks of physical and traditional security status, foreign national access, COMSEC, personnel security, and other checks that are in the DISA Traditional Security STIG, DOD 5200.01 and Army Regulation 380-5.

Physical Security checks generally take about 3 days per location and can be done standalone or in conjunction with other checks. Reports for checks shall be delivered not later than 5 business days after completion of on-site inspections. Variables with this order include: location, number of personnel on site, classified processing, and special considerations (if any).

3.2.5 Conduct Cyber Readiness Expert Evaluation

Conduct Cyber Subject Matter Expert (SME) engagement for test or evaluation of issue (e.g.

vulnerability remediation, courses of action recommendations, and Cyber perspective recommendations for site infrastructure design or cyber tools necessary for compliance or improvement). This can include support on-site and/or by telephone and email. SMEs provide consultation and advice on ways to optimize DOD/Army compliance and Cyber readiness in terms of configuration optimization, infrastructure design, cyber tools to deploy, or recommendations for resources needed to maximize readiness. Reports for expert evaluations shall be delivered not later than 5 business days after completion of evaluation. Variables with this order include: description of issue to evaluate and special considerations (if any).

4.0 PERFORMANCE CRITERIA

4.1 Period of Performance

Over-arching IDIQ contract will have a 12-month period of performance with four (4) 12-month optional years. TO POPs will be specified in each TO.

4.2 Place of Performance

Place of Performance will be specified in each Task Order.

4.3 Hours of Work

S20-0046 Cyber Readiness Services - PWS Page 4 of 22

Hours of work will be specified in each task order and may include work outside normal business hours.

Generally, the contractor shall provide services between the USACE business hours of 0700-1730 on Mon

– Friday, local time with the exception of Afghanistan, which works Sunday – Friday, 10 hours/day.

Holidays and when the Government facility/installation is closed due to local or national emergencies, administrative closings, or similar Government-directed facility/installation closings are also excluded.

4.4 Key Personnel

The contractor shall at all times maintain an adequate work force for the uninterrupted performance of all tasks defined. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the work force are essential and coincide with Government personnel’s working hours. Key personnel will vary based on the needs of each task order. Every position in Table 4.5 has the potential to be key, depending on task order requirements.

The contractor shall identify key personnel by name and ensure that any substitution of key personnel provides an equally or higher qualified individual. Prior to removing, replacing, or diverting any of the specified personnel, the Contractor shall notify the CO in writing no later than two weeks prior to the change and receive consent from the Contracting Officer in advance of the action. The Contractor shall submit justification (including proposed substitutions) in sufficient detail to permit evaluation of the impact on this task order and submit the resume of the new Key Personnel.

The contractor shall notify The Contracting Officer and GOV POCs within five (5) work days of when a vacancy has occurred.

4.5 Knowledge, Skills, and Abilities (KSA) and Security Clearance Requirements

The contractor shall represent/acknowledge that all personnel assigned to this task order are capable of working independently and with demonstrated knowledge, skills and expertise in their respective functional areas, which are necessary to perform all assigned duties.

The contractor is responsible for providing personnel with the appropriate clearances, certifications, and experience for work being performed based on each tasking. Clearances required will be identified in each tasking and could require as high as TOP SECRET clearances but will most-commonly require SECRET clearances. KSAs are listed in Table 4.5 to follow.

Table 4.5 – KSAs and Labor Categories

Position Alliant Category DOD 8570.01 Level Experience

Team Lead

123G-4 Master IA/Security Specialist or 128c Program Manager

IASAE III

CNDSP/CSSP Manager DISA CCRI Certified

Experience with CCRI

Traditional/Physical Security Requirements Reviewers

123G-3 Senior Security Specialist

CSSP Auditor or CISSP

Experience with Army or DOD level physical/traditional security Application of Traditional Security

STIG

S20-0046 Cyber Readiness Services - PWS Page 5 of 22

Network infrastructure Reviewers

126G-4 Master Network Specialist CISSP, Sec+ CE, or

CISA

CCNA certification Experience with Layer 2 and Layer 3 Switch architecture and knowledge of applicable STIG

Web/Database/ShareP oint Reviewers

123G-3 Senior IA/Security Specialist

SEC+ce, CISSP, or

CISA

Experience with IIS, Apache, SharePoint, Oracle and SQL Server databases

HBSS Reviewers

123G-3 Senior IA/Security Specialist

SEC+ce, CCNA- Security, GICSP, GSEC or SSCP. .

DOD8570 IAT level II

Five years or more experience with HBSS; Windows Workstation/Server and E-Policy Orchestrator (EPO) Security Reviews

ACAS Reviewers

123G-3 Senior IA/Security Specialist

SEC+ce, CISA, CISM, or CISSP

Basic Knowledge of vulnerability management and/or compliance auditing (STIG/SCAP),IA/IS concepts, vulnerability scanning tools and basic networking concepts; training from DISA;

Experience with server reviews, familiar with NESSUS and Red Hat Linux system administration.

Active Directory, Exchange, Reviewers

123G-3 Senior IA/Security Specialist

SEC+ce, CISA, CISM, or CISSP

Windows certified Knowledge of Group Policy Objects (GPO), Windows systems administration, Active Directory and Exchange experience and training

VVOIP Reviewers

123G-3 Senior IA/Security Specialist

SEC+ce, CISA, CISM, or CISSP

CISCO certification for VTC /

VOIP

OS Reviewers for all Microsoft OS

123G-3 Senior IA/Security Specialist

SEC+ce, CISA, CISM, or CISSP

Certified in related Windows OS technology; I.e. certified in windows server 2012 or better, or windows 10.

OS reviewer for UNIX flavors such as Red Hat (all applicable versions of OS)

123G-3 Senior IA/Security Specialist

SEC+ce, CISA, CISM, or CISSP

RHCSA, RHCE, or RHCA Certification. Experience with configuring Red Hat servers.

Contractors performing work shall have credentials and certifications listed in table above and:

o Expert knowledge and experience conducting CCRIs o Expert knowledge and experience with Army or DoD level physical/traditional security

(Application of Traditional Security STIGs) o Expert knowledge and experience with Layer 2 and Layer 3 switch architecture and applicable STIGs o Five years or more experience with HBSS; Windows Workstation/Server and E-Policy

Orchestrator (EPO) Security Reviews

S20-0046 Cyber Readiness Services - PWS Page 6 of 22 o Expert Knowledge of and experience with vulnerability management and/or compliance auditing (STIG/SCAP), IA/IS concepts, vulnerability scanning tools, and basic networking concepts o Expert knowledge and experience with IIS, Apache, SharePoint, Oracle and SQL Server databases o Windows Systems Administration Certified with Active Directory and Exchange experience with expert knowledge of Group Policy Objects (GPO) o Experience with server reviews and familiar with NESSUS and Red Hat Linux administration

4.6 Government Furnished Resources

If task order requires Contractor to work on a GOV site or connect to a GOV network, GOV will furnish workspace and access to telephones and computers and network access. Each task order will specify if Government Furnished Equipment (GFE) is available. Except for items or services stated as Government furnished, the contractor must furnish everything needed to perform the task order according to all its terms.

The Contractor shall specifically identify in their quote all items they will furnish during the performance of this task order if Contractor-provided materials are necessary.

4.7 Past Performance Information

The Government will provide and record Past Performance Information for acquisitions over $1,000,000 utilizing the Contractor Performance Assessment Reporting System (CPARS). The CPARS process allows contractors to view and comment on the Government's evaluation of the contractor's performance before it is finalized.

Contractors are required to register in the CPARS, so contractors may review and comment on past performance reports submitted through the CPARS and shall identify the contractor’s designated CPARS representative.

Contractors are required to register at the following web sites: CPARS: https://www.cpars.csd.disa.mil/

The contractor shall notify the COR when the CPARS registration process is completed.

4.8 Inherently Governmental Functions

The Contractor shall not perform any inherently governmental functions as defined by FAR Subpart 7.5.

All program decisions shall be the sole responsibility of the Government.

The Contractor shall not counsel, mentor, make judgments and/or discretionary decisions or perform any other activities related to supervision of Government personnel.

If the Contractor believes that any actions constitute or are perceived to constitute inherently governmental functions, the Contractor shall notify the CO immediately.

4.9 Subcontract Management

The Contractor shall be responsible for any subcontract management necessary to integrate work performed on this task order and shall be responsible and accountable for subcontractor performance on this task order.

S20-0046 Cyber Readiness Services - PWS Page 7 of 22

The Contractor shall manage work distribution to ensure there is no Organizational Conflicts of Interest (OCI), in accordance with FAR Subpart 9.5 as supplemented. Contractors may add Subcontractors to their team after examination of information that there is no OCI issue and notification to the CO or submission and approval of mitigation plan by the CO.

If a Subcontractor is contracted to perform the work on a requirement, a signed and processed DD Form 254 between the Contractor and Subcontractor, to include Government approvals as required by the DoD 5200.22-M, National Industrial Security Operating Manual, may be required before the Subcontractor begins performance on this task order.

4.10 Records / Data Rights

The Government has unlimited rights to all documents/material produced under this task order. All documents and materials, to include the source codes of any software, produced under this task order shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government in accordance with FAR 52.227- 14, Rights in Data-General (May 2014). These documents and materials may not be used or sold by the contractor without written permission from the SCO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

4.11 Section 508 Compliance

All electronic and information technology (EIT) procured through this task order must meet the applicable accessibility standards at 36 CFR 1194, unless an agency exception to this requirement exists. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended, and is viewable at http://www.access- board.gov/sec508/508standards.htm. The contractor shall indicate for each line item in the schedule whether each product or service is compliant or noncompliant with the accessibility standards at 36 CFR 1194. Further, the proposal must indicate where full details of compliance can be found (e.g., vendor’s website or other specific location).

5.0 DELIVERABLES AND ACCEPTANCE

5.1 Deliverables

All deliverables become property of USACE. The Government reserves the right to prioritize work and negotiate changes in delivery dates. The Contracting Officer and COR will review the contractor’s performance indicators in accordance with specifications stated in this document. Only the GOV POCs listed are authorized to inspect, accept, or reject work performed under this task order. All deliverables and acceptances shall reflect the Contracting Officer or GOV POC review and approval. It is highly recommended the contractor detail their performance results, to include deliverable due dates, submission dates and compliance results with the established performance measures in all their reports.

The Contractor shall submit the following reports via encrypted email to GOV POCs.

5.2 Reports

5.2.1 Status and Task Completion Reports

The contractor shall identify and report all program management actions, completed and future planned actions and deliverables in a Monthly Status Report (MSR) for tasks longer than a month.

Reports shall be electronically submitted to GOV POCs via email. Monthly and Task Completion Reports shall include: Task Order Overview/Description, Accomplishments/Findings/Results, S20-0046 Cyber Readiness Services - PWS Page 8 of 22

Recommendations/Lessons Learned, and Follow-on-Actions. Any reports, briefings, designs, drawings, or other products produced for the task order will be included as attachments.

5.2.2 Kickoff Meeting Minutes

Contractor shall coordinate and conduct a Kick-Off meeting via teleconference within ten (10) business days after the date of award of this contract and within five (5) business days of any task order. The contractor shall take meeting minutes and provide them to the Contracting Officer, Cyber POCs, and COR via email within five (5) business days after the meeting has been conducted. Minutes will be submitted to GOV POCs via email for final Government approval.

5.2.2.1 Contractor Manpower Reporting

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this task order for the USACE via the secure Contractor Manpower Reporting Application (CMRA) data collection site.

The contractor shall completely fill in all required data fields using the following web address:

http://www.ecmra.mil/. Reporting inputs shall be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30.

While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk at http://www.ecmra.mil.

5.2.3 OPSEC Standard Operating Procedure (SOP)/Plan

The contractor shall develop an OPSEC Standard Operating Procedure (SOP)/Plan within ninety (90) days of task order award. The OPSEC Standard Operating Procedure/Plan must be reviewed and approved by the Requiring Activity OPSEC Officer. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator.

5.3 Performance Standards

Performance of a service will be evaluated according to the Quality Assurance Surveillance Plan (QASP) to determine performance quality. Re-performance is the preferred method of correcting any unacceptable performance. The Contractor shall provide the COR a written response if a task was not performed or QASP criteria not met. Contractor shall include explanations of how performance will be returned to acceptable levels, and how recurrence of the cause will be prevented in the future.

5.4 Schedule and Delivery Instructions

The GOV reserves the right to prioritize work and negotiate any changes in delivery dates.

The Contractor shall deliver documentation in electronic format, unless otherwise directed in the task order.

Acceptable electronic media include the latest Microsoft and Adobe software.

The Client Representative will review the contractor’s performance in accordance with a QASP and all the specifications stated in this document.

5.5 Quality of Support/Service

The Contractor shall accomplish tasks by providing qualified personnel possessing the appropriate combinations of education, training, trustworthiness determination/security clearance and experience/skills IAW the PWS requirements. The Contractor shall utilize the appropriate labor skills at the established rates and man-hours necessary to accomplish the requirements. Additionally, the Contractor shall provide qualified replacement/substitute personnel which meet or exceed the same position standards in the

S20-0046 Cyber Readiness Services - PWS Page 9 of 22 contractor’s proposed solution. The Contractor shall conform to the task order requirements, specifications, and standards of good workmanship (technical, professional, environmental, and safety and health standards).

5.5.1 Inspection and Acceptance

For deliverables associated with the Firm Fixed Price (FFP) requirements noted in PWS section 4.0, inspection and acceptance will occur in accordance with FAR 52-246-4(a), Inspection of Services- Fixed Price. In the absence of other agreements negotiated with respect to time provided for Government review, deliverables will be inspected and the contractor notified of the Client Representative’s findings within fourteen (14) business days of normally scheduled review. If the deliverables are not acceptable, the Client Representative will notify the contractor immediately.

Acceptance of invoices shall constitute acceptance of performance. Unsatisfactory work performance by the contractor to correct defects found by the Government as a result of quality assurance surveillance and by the contractor as a result of quality control shall be at the contractor’s own expense without additional reimbursement by the Government.

5.5.2 Quality Assurance (QA)

The Government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and acceptable quality level(s) (defect rate(s)).

Performance by the contractor to correct defects found by the Government as a result of quality assurance surveillance and by the contractor as a result of quality control shall be at the contractor’s own expense without additional reimbursement by the Government. Unless otherwise negotiated, the contractor shall correct or replace all non-conforming services or deliverables not later than fourteen

(14) calendar days after notification of non-conformance.

6.0 REIMBURSABLE COSTS

All reimbursable costs must be in conformance with the task order requirements, validated for funding availability, and authorized by the COR and Contracting Officer advance of cost being accrued.

6.1 Travel

CONUS and OCONUS Travel is required. The contractor shall ensure that the requested travel costs shall not exceed what has been authorized in each task order. Contractor-incurred actual expenses resulting from Government-directed travel are cost reimbursable but are limited by the Federal Travel Regulations (FTR).

Travel Requests must be submitted at least 5 business days prior to any travel start dates and pre-approved in writing by the Contracting Officer or COR prior to travel. Failure to comply with this requirement may result in rejection of invoices and/or non-payment.

Travel Locations and the duration of travel cannot be established at this time so a not-to-exceed travel budget for the entire effort (excluding G&A) is estimated.

TI 0003 Base Period Travel Budget Estimate $95,891.87 TI 1003 Option Year 1 Travel Budget Estimate $97,809.71 TI 2003 Option Year 2 Travel Budget Estimate $99,765.90 TI 3003 Option Year 3 Travel Budget Estimate $101,761.22 TI 4003 Option Year 4 Travel Budget Estimate $103,796.45

A Contractor-generated travel authorization request shall be submitted to the COR or Contracting Officer and approved prior to beginning any travel. The form must identify the traveler’s name, travel dates, S20-0046 Cyber Readiness Services - PWS Page 10 of 22 location(s), per diem rates, purpose of trip, all estimated expenses (i.e., lodging, lodging tax, M&IE, transportation air fare, train, bus, rental car, fuel for rental car, private car mileage, registration, tolls, parking, other related expenses), and a funding validation reflecting an estimate of the trip total and the remaining travel funds available after the travel being authorized is completed.

A summary report shall be included with each invoice requesting travel reimbursement identifying each trip, and traveler, location, dates of travel, approved amount estimated, amount invoiced and delta, along with an electronic copy of the travel expense summary and receipts submitted with the monthly invoice.

6.2 Training

Training of contractor employees assigned to this task order shall be performed at the contractor’s own expense, with these exceptions:

• The Government has given prior approval for training to meet special requirements that are peculiar to the environment and/or operations.

• Limited contractor employee training may be authorized if the Government changes hardware or software during the performance of this task order, and it is determined to be in the best interest of the Government.

• The Government will not authorize contractor employees training to attend seminars, symposiums, or other similar conferences unless the Contracting Officer or designee certifies and approves that attendance is mandatory for the performance of the task requirements.

• Training request has been emailed for approval by the client and the Contracting Officer before training is performed.

In the event that the Government has approved and paid for contractor employee training, reimbursement may not be authorized for costs associated with re-training replacement individual(s) should the employee(s) terminate their employment under this task order. Costs that are not authorized include, but are not limited to; labor, travel, and any associated re-training expenses.

6.3 Other Direct Costs

Other Direct Costs such as materials, supplies, and equipment may be required and shall be proposed and purchased by the contractor when necessary for task order performance. The contractor shall obtain advance Government approval from the Contracting Officer (CO) or, Contract Specialist (CS), or COR for all purchases. All material requests shall be submitted in writing (email is acceptable). Material purchases and can commence once the request is approved. Materials, supplies and equipment purchased shall become Government Property.

TI 0004 Base Period Material Budget Estimate $5,000.00 TI 1004 Option Year 1 Material Budget Estimate $5,000.00 TI 2004 Option Year 2 Material Budget Estimate $5,000.00 TI 3004 Option Year 3 Material Budget Estimate $5,000.00 TI 4004 Option Year 4 Material Budget Estimate $5,000.00

7.0 SECURITY AND PRIVACY

S20-0046 Cyber Readiness Services - PWS Page 11 of 22

The contractor shall comply with all security and force protection requirements enforced at each installation or facility. Privacy act information shall be required to fulfill various security requirements and will be protected per the Privacy Act of 1974 (as amended). The Contractor shall ensure contractor employees immediately report all security issues/violations to the project security manager and incident shall also be synopsized in the next monthly status report. Knowledge and/or generation of classified and/or controlled unclassified information are required for performance of the task order.

7.1 Security Clearances and Other Requirements

Contractor personnel must hold the appropriate clearance level specified by task order (up to TOP SECRET) at the start of the task order period of performance.

Contractor employees whose clearance has been suspended or revoked shall immediately be denied access to classified information, sensitive but unclassified information, and Government computers. Contractor inability to obtain and/or maintain proper employee security clearance shall not constitute an excusable delay in task order performance.

7.1.1 E-Verify Program. The Contractor shall pre-screen personnel candidates using the E-verify Program (http://www.uscis.gov/e-verify) website to meet the established employment eligibility requirements. The Vendor shall ensure that the each employee has two valid forms of Government issued identification prior to enrollment to ensure the correct information is entered into the E-verify system. An initial list of verified/eligible Candidates must be provided to the COR no later than ten

(10) business days after the initial task order award.

7.1.2 Handling or Access to Classified Information: For Contracts That Require Handling or Access to Classified Information. The contractor shall comply with FAR Clause 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M) and applicable updates/changes. The Contractor will be escorted and monitored during the inspection and requires Top Secret clearance.

7.1.3 Access and General Protection/Security Policy and Procedures: The contractor and all associated subcontractors’ employees shall comply with applicable installation, access and local security policies and procedures. Policies and procedures will be provided by the local Security Office.

The contractor workforce must comply with all personal identity verification requirements as directed by DoD, HQDA, and local policies. In addition to the changes otherwise authorized by the changes clause of this task order, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

7.1.4 COMSEC/IT Security. All communications with DOD organizations are subject to communications security (COMSEC) review. All telephone communications networks are continually subject to intercept by unfriendly intelligence organizations. DOD has authorized the military departments to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DOD organizations. Therefore, the contractor is advised that any time contractor place or receive a call they are subject to COMSEC procedures. The contractor shall ensure wide and frequent dissemination of the above information to all employees dealing with DOD information. The contractor shall abide by all Government regulations concerning the authorized use of the Government's computer network, including the restriction against using the network to recruit Government personnel or advertise job openings.

7.1.5 Use of Government Information Systems (IS) and access to Government networks is a revocable privilege, not a right. Users are the foundation of the DoD strategy and their actions affect the most vulnerable portion of the DODIN-A. Contractor employees shall have a favorable background investigation or hold a security clearance and access approvals commensurate with the level of information processed or available on the system. Contractor employees shall:

S20-0046 Cyber Readiness Services - PWS Page 12 of 22

a) Comply with the command's Acceptable Use Policy (AUP) for Government owned IS and sign an AUP prior to or upon account activation.

b) Complete initial and/or annual Information Assurance (IA) training as defined in the IA Best Business Practices (BBP) training (https://informationassurance.us.army.mil). Contractors must provide documentation of compliance with DOD 8570.01 including baseline training/certification, industry certification and computing environment certification.

c) Mark and safeguard files, output products, and storage media per classification level and disseminate them only to individuals authorized to receive them with a valid need to know.

d) Protect IS and IS peripherals located in their respective areas in accordance with physical security and data protection requirements.

e) Practice safe network and Internet operating principles and take no actions that threaten the integrity of the system or network.

7.1.6 Protection of Personally Identifiable Information (PII). The contractor shall protect all Personally Identifiable Information (PII) encountered in the performance of services in accordance with DFARS 224.103 and DoDD 5400.11, Department of Defense Privacy Program, and DoD 5400.11-R.

If a PII breach results from the contractor’s violation of the aforementioned policies, the contractor shall bear all notification costs, call-center support costs, and credit monitoring service costs for all individuals who’s PII has been compromised.

7.1.7 CAC Requirements: The Common Access Card (CAC) is the Department of Defense (DOD) Federal Personal Identity Verification (PIV) credential. In accordance with Directive Type Memorandum (DTM) 08-003, December 1, 2008, incorporating Change 5, October 8, 2013, Initial issuance of a CAC requires at a minimum, the completion of FBI fingerprint check with favorable results reflecting "No Record" and submission of a National Agency Check with Inquiries (NACI) to the Office of Personnel Management (OPM), or a DoD-determined equivalent investigation. The issuance of a CAC will be based on four criteria; (a) eligibility for a CAC; (b) verification of DoD affiliation from an authoritative data source; (c) completion of background vetting requirements according to the Federal Information Processing Standards Publication 201-1, Personal Identity Verification (PIV) of Federal Employees and Contractors, March 2006, and DOD Regulation 5200.2- R, Department of Defense Personnel Security Program, January 1987, and (d) verification of a claimed identity. CAC eligible personnel must be registered in the Defense Enrollment Eligibility Reporting System (DEERS) through either an authoritative personnel data feed from the appropriate Service or Agency or Trusted Associate Sponsorship System (TASS).

7.1.8 Physical Security. The contractor shall safeguard all Government property provided for contractor use. At the close of each work period, Government facilities, equipment and materials shall be secured.

7.1.9 The contactor shall prohibit the use of the Government issued keys/key cards by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contactor employees engaged in the performance of services in those areas, or personnel authorized entrance by the Contracting Officer.

7.1.10 Contractor personnel will be escorted in areas where they may be exposed to classified and/or sensitive materials and/or sensitive or restricted areas: All contractor employees, including subcontractor employees who are not in possession of the appropriate security clearance, will be escorted in areas where they are exposed to classified and/or sensitive materials and/or sensitive or restricted areas. The contractor will coordinate with the COR and/or facility security office for access when required.

7.1.11 Combating Trafficking in Persons: The United States Government has adopted a zero-tolerance policy regarding trafficking in persons. Contractors and contractor employees shall not engage in severe

S20-0046 Cyber Readiness Services - PWS Page 13 of 22 forms of trafficking in persons during the period of performance of the contract; procure commercial sex acts during the period of performance of the contract; or use forced labor in the performance of the contract. The Contractor shall notify its employees of the United States Government’s zero tolerance policy, the actions that will be taken against employees for violations of this policy. Such actions may include, but are not limited to, removal from the contract, reduction in benefits, or termination of employment. The Contractor shall take appropriate action, up to and including termination, against employees or subcontractors that violate the US Government policy as described at FAR 22.17.

7.1.12 Unscheduled gate closures by the Security Police may occur at any time causing all personnel entering or exiting a closed installation to experience a delay. This cannot be predicted or prevented.

Contractors are not compensated for unexpected closures or delays. Vehicles operated by contractor personnel are subject to search pursuant to applicable regulations. Any moving violation of any applicable motor vehicle regulation may result in the termination of the contractor employee’s installation driving privileges.

7.1.13 The contractor’s employees shall become familiar with and obey the regulations of the installation/locations; including fire, traffic, safety and security regulations while on the installation.

Contractor employees should only enter restricted areas when required to do so and only upon prior approval. All contractor employees shall carry proper identification with them at all times. The contractor shall ensure compliance with all regulations and orders of the installation which may affect performance.

7.2 Contractor Identification

All contractor personnel attending meetings, answering Government telephones and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression that they are Government employees. The contractor shall ensure that all documents or reports produced by contractor personnel are suitably marked as contractor products or that contractor participation is appropriately disclosed. The contractor’s status as a “contractor” shall be predominantly displayed in all correspondence types (to include signature blocks on e-mail) and dealings with Government or non-Government entities/ Contractor personnel shall wear identification badges distinguishing themselves as such. The badges shall have the company name, employee name and the word “contractor” displayed. The contractor shall retrieve all identification media (including vehicle passes) from their employees who depart employment for any reason. All identification media (i.e., badges and vehicles passes) shall be returned to the COR within 14 days of an employee’s departure.

7.3 Security Requirements

The following are mandatory required security training requirements which shall be met in support of this contract:

7.3.1 Information Assurance (IA) / Information Technology (IT) Training All contractor employees working Information Assurance/Information Technology functions must comply with DoD and Army training requirements in DoD 8570.01, DoD8570.01-M and AR 25-2 at time of employment.

7.3.2 Information Assurance (IA) / Information Technology (IT) Certification All contractor employees supporting IA/IT functions shall be appropriately certified upon task order award IAW DoD 8570.01‐M, DFARS 252.239‐7001 and AR 25‐2. The baseline certification as stipulated in DoD 8570.01‐M must be completed upon task order award.

7.3.3 Operations Security (OPSEC) Standing Operating Procedure/Plan The Contractor shall develop an OPSEC Standard Operating Procedure (SOP)/Plan within 90 days of task order award. The OPSEC Standard Operating Procedure/Plan must be reviewed and approved by the

S20-0046 Cyber Readiness Services - PWS Page 14 of 22

Requiring Activity OPSEC Officer. The Standard Operating Procedure/Plan will include the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator.

7.3.4 Operational Security (OPSEC) Training:

All new contractor employees will complete Level I OPSEC training within thirty (30) calendar days of their reporting for duty. Additionally, all contractor employees must complete annual OPSEC awareness training.

7.3.5 Antiterrorism (AT) Level I Training

All contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas shall complete Antiterrorism Level I awareness training within thirty

(30) calendar days after task order start date or effective date of incorporation of this requirement into the task order, whichever applies. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the Contract Officers Representative (COR) within 10 calendar days after completion of training by all employees and subcontractor personnel. Antiterrorism Level I awareness training is available at https://atlevel1.dtic.mil/at.

7.3.6 iWatch, iReport, ikeep Us Safe (iWATCH) Training

The contractor and all associated subcontractors shall brief all contract employees on the USACE iWatch, iReport, ikeep Us Safe (iWATCH) program. This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the Contract Officers Representative (COR). This training shall be completed within thirty (30) calendar days of task order award and within thirty (30) days of new employees commencing performance on the task order. The contractor shall provide certification of completion to the COR within ten (10) days of training completion. Training documents will be provided to the Security Office.

7.3.7 Threat Awareness Reporting Program.

All new contractor employees shall complete annual Threat Awareness and Reporting Program (TARP) Training provided by a Counterintelligence Agent, IAW AR 381-12. The contractor shall submit certificates of completion for each affected contractor and subcontractor employee(s) or a memorandum for the record, to the COR within five (5) calendar days after completion of training. Authorized web based TARP training for CAC card holders is available at the following website: https://www.us.army.mil/suite/page/655474.

7.4 Security Incidents or Violations

The Contractor shall immediately notify the COR and Government Security Office of any potential or actual security incident or violation including potential or actual unauthorized disclosure or compromise of classified and/or controlled unclassified information, and any information or circumstances of which they are aware of that may pose a threat to the safety and/or security of DoD personnel, Contractor personnel, resources and classified or controlled unclassified information.

The Contractor shall immediately notify the Government Security Manager, the host base Information Protection office, COR and CO of any potential or actual security incident or violation including potential or actual unauthorized disclosure or compromise of classified and/or controlled unclassified information.

7.5 Security of Contractor Systems(s)

The Contractor shall ensure the security of automated information systems at the Contractor's facility to preclude potential security incidents or violations including potential unauthorized disclosure or compromise of classified and/or controlled unclassified information.

S20-0046 Cyber Readiness Services - PWS Page 15 of 22

7.6 Government Security Regulations

The Contractor shall ensure personnel, information, system, property, facility, and international security requirements are met. The Contractor shall comply with Government Security regulations including, DoD 5200.2-R, Personnel Security Program; DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM); DoDD 5205.02E, DoD Operations Security (OPSEC) Program; DoD Manual 5205.02- M, and DoD Operations Security (OPSEC) Program Manual.

7.7 Weapons, Firearms and Ammunition

Contractors shall not possess weapons, firearms, or ammunition, on themselves or within their Contractor-owned vehicle or privately-owned vehicle while on any installation or any office/working location covered under this task order.

7.8 Government Installation Traffic Laws

The contractor shall ensure contract employees are aware of and comply with government installation or base traffic regulations.

7.9 Limited Use of Data

Performance of this task order may require the contractor to access and use data and information proprietary to a Government agency or Government contractor which is of such a nature that its dissemination or use, other than in performance of this effort, would be adverse to the interests of the Government and/or others.

Contractor and/or contractor personnel shall not divulge or release data or information developed or obtained in performance of this effort, until made public by the Government or upon written approval of the Contracting Officer. The Contractor shall not use, disclose, or reproduce proprietary data that bears a restrictive legend, other than as required in the performance of this effort. Nothing herein shall preclude the use of any data independently acquired by the contractor without such limitations or prohibit an agreement at no cost to the Government between the contractor and the data owner which provides for greater rights to the contractor.

7.10 Privacy Act

Work on this project requires that personnel have access to Privacy Information.