A23 Attachment 1 UAM Green PWS.docx

PERFORMANCE WORK STATEMENT

User Activity Monitoring Green

1.0 OVERVIEW

This is a non-personal services contract to provide User Activity Monitoring (UAM) software, engineering support, travel and training for Non-Classified Internet Protocol Router Network (NIPRnet) system. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Background: DFAS requires ongoing User Activity Monitoring (UAM) support for Non-Classified Internet Protocol Router Network (NIPRnet) system in accordance with the White House Memorandum on National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs, dated November 21, 2012. The capability must also be in compliance with the technical requirements specified in the Committee on National Security Systems Directive (CNSSD) Number 504, (U) Directive on Protecting National Security Systems from Insider Threat dated February 4, 2014, and other Department of Defense (DoD) and Office for the Director of National Intelligence (ODNI) directives. UAM is the technical capability to observe and record the actions and activities of an individual, at any time, on any device (does not include mobile devices) accessing U.S. Government information in order to detect insider threats and to support authorized investigations.

1.2 Objective: The objective of this acquisition is for a commercial UAM capability (including software licenses, training, engineering support and travel) for the DFAS networks to monitor and log anomalous user behavior or signature based key indicators accessing network and computer systems/endpoint devices.

2.0 Scope: The purpose of this effort is to maintain UAM coverage on unclassified DoD networks without interruption and provide a proprietary Commercial-Off-The-Shelf (COTS) UAM capability in support of the Government’s networks. DFAS Force Protection Office requested InnerView license (1000 endpoints) and 600 labor hours for engineering support which includes maintaining DFAS owned hardware.

The following products and support are required for this effort:

UAM GREEN

3.0 GENERAL INFORMATION

3.1 Quality Assurance: The Government will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on tasks the Government can undertake to ensure that the Contractor has performed in accordance with the performance standards. The QASP defines ways the performance standards can be applied, the frequency of surveillance and the minimum acceptable level of support. The performance requirement summary is reflected in the PWS, which sets forth the tasks, results, and the acceptable level of performance and surveillance method.

3.2 Quality Control: The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the Contract. The Contractor shall provide a description of their Quality Control plan to the Government within 10 days from the date of award. Unsatisfactory work – performance by the Contractor to correct defects found by the Government as a result of quality assurance surveillance and by the Contractor as a result of quality control, shall be at its own expense and without additional reimbursement by the Government.

3.3 Place of Performance / Hours of Operations: The vendor shall provide the UAM Professional Services at DFAS, 8899 E. 56th St, Indianapolis, IN 46249. The products shall be delivered to the same location. The days/hours of operations are Monday through Friday between 8:00am and 4:00pm, except Federal Holidays. Any work outside this timeframe must be approved in advance by DFAS Contracting Officer Representative (COR).

3.4 Recognized Holidays: The Contractor shall perform services during normal workday business hours, Monday through Friday, excluding Federal holidays. Any labor to be performed outside of normal business hours or during Federal holidays must be approved in advance by the COR and DFAS Program Manager. There is no overtime rate. Federal Holidays include:

Independence Day

If the holiday occurs on a Saturday, the holiday will be observed on Friday. If the holiday occurs on Sunday, the holiday will be observed on Monday.

3.5 Period of Performance:

3.6 The COR is the primary point of contact for the Contractor. The COR will interface with DFAS Information and Technology (IT) Point Of Contact (POC) as well as the appropriate DFAS Site Force Protection Office POC to maintain internal monthly system updating to DoD compliance.

To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection ePortal Page.

https://eportal.dfas.mil/portal/server.pt/community/force_protection/656 Follow the link titled “Site Specific Force Protection/Security Services” in the Additional Points of Contact section near the top right side of the webpage.

3.7 Type of Contract: The contract type for this award is mixed consisting Firm Fixed Price(FFP) and Time and Material (T&M) CLINs for Travel

4.0 DELIVERABLES/TASKS

4.1 Engineering Support:

· Contractors will be working only on systems located in secure areas that require a TS/SCI security clearance for unescorted access.Personnel Security Investigation (PSI) Requirements.

· Contractor personnel that come onsite will require a current (within 5 years) Tier 5 Level investigation, (or equivalent) or equivalent Periodic Reinvestigation at the Tier 5 level, which has been favorably adjudicated for Top Secret/SCI eligibility, prior to work performance. The contractor company is responsible for obtaining required investigations and security clearances for their employees performing on this contract.

· For remote support, Contractors will require a favorably adjudicated Tier 3, or equivalent Noncritical Sensitive (formerly IT-II) level or higher investigation. No access to classified information is required.

· Contractors must never disclose classified information over the phone or via open email.

· Remote support consists of technical support (i.e. ‘how’ the system operates) and no classified, or potentially classified, information (i.e. ‘what’ data the system collects).

· Contractor will provide support for technical issues that may arise.

1.4.2 DELIVERABLES: The Contractor shall prepare and submit the deliverables in this effort to the COR and/or COR-identified DFAS personnel. DFAS’s determination as to the method of performance shall control. The deliverables shall be in the format described in the table below.

1.4.2.9.2

5.0 Transition Out:

Services under this contract are vital to the Government and must be continued without interruption. The Contractor agrees to exercise its best efforts and cooperation to affect an orderly and efficient transition should the contractor be notified by the Contracting Officer of any such transition effort.

6.0 Contractor Travel:

Performance under this requirement will require travel by Contractor personnel. The Government will reimburse the Contractor for allowable travel cost incurred by the Contractor in performance of the requirement in accordance with FAR Subpart 31.205-46. The Contractor shall obtain approval from the COR prior to any travel. When travel is required, the Contractor is responsible for making all needed arrangements for its personnel. Actual travel costs will be reimbursed IAW FAR 31.205-46. No overhead will be allowed on Contractor travel.

The Contractor shall provide a trip report within 5 days after each trip associated with a travel approval. The Contractor shall maintain a summary of all approved travel, to include at a minimum, the name of the traveler, location of travel, duration of trip, total cost of trip. The Contractor shall confirm travel requests in writing 14 days prior to the travel date and shall provide the COR with names of travelers, expected duration of travel, travel locations, cost estimates and labor effort associated with the travel prior to travel period. No travel is expected outside the continental United States (OCONUS).

Travel, subsistence, and associated labor charges for travel time are authorized for travel beyond a 50-mile radius of the local office, whenever a task assignment requires work to be accomplished at a temporary alternate work site. No travel, subsistence, or associated labor charges for travel time shall be charged for work performed within a 50-mile radius of the Contractor’s local office, normal work site, or temporary work site unless approved in advance by the COR. Under no circumstances will costs be reimbursed for travel performed for personal convenience and daily travel to and from the normal work site, to include parking expenses.

Deliverables Schedule

Performance Requirements Summary

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

7.0 Security Requirements:

Facility Security Clearance Requirements. The contractor must possess a Facility Security Clearance at the classification level of Top Secret prior to work performance.

Personnel Security Investigation (PSI) Requirements. Contractor personnel will require a current (within 5 years) Tier 5 Level investigation, (or equivalent) or equivalent Periodic Reinvestigation at the Tier 5 level, that has been favorably adjudicated for Top Secret/SCI eligibility, prior to work performance. The contractor company is responsible for obtaining required investigations and security clearances for their employees performing on this contract.

IAW standard DFAS Personnel Security policy, ALL incoming contractors must submit a Declaration for Federal Employment (OF-306), and a new set of fingerprints* to the Contracting Officer Representative (COR), who will submit these forms with a Contractor Request for Investigation (CRI) (DFAS Form 9035) to DFAS Personnel Security. DFAS Personnel Security will review all submitted documentation to validate whether contractor personnel meet personnel security requirements to perform work on the contract or if a new background investigation is required.

*New fingerprints are not required if any of the following apply:

1. The person has been fingerprinted for the Office of Personnel Management (OPM) within the past 30 days;

2. The person is currently undergoing a background investigation, or reinvestigation, by OPM or any other Federal agency;

3. The person has a background investigation currently being adjudicated by the Department of Defense Consolidated Adjudications Facility (DoD-CAF) or another CAF;

4. The person has been favorably adjudicated within the past 30 days by the DoD CAF or a CAF from any other Federal agency; or

5. The person is coming directly from another DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

6. The DFAS Personnel Security Office otherwise determines that no new fingerprints are required.

Security Requirements. Contractor personnel shall follow the security and training requirements in DFAS 2000.1-I, “Force Protection Mission,” DoDM 5200.01, Volumes 1-3, “DoD Information Security Program,” DoDI, 5200.48, “Controlled Unclassified Information,” DFAS 5200.1-I, “Information Security Program,” DFAS 5200.8-I, “Physical Security Program,” and DFAS 5200.10-I, “Counter Insider Threat Program.” Contractor personnel shall follow all host security requirements in accordance with Part 117 of Title 32, Code of Federal Regulations; paragraph 117.16. The contractor shall immediately report any occurrences of violation of stated regulations to the Contracting Officer (CO), COR, and the DFAS Personnel Security Office.

Sensitive Compartmented Information (SCI) Access Requirements:

Contractors will require access to SCI levels SI, TK, G, and HCS-P. SCI access by on-site contractor personnel, including oral and visual, will be under the supervision and control of DFAS SCI cleared government personnel. SCI will not be generated, handled, or stored at the contractor cleared facility in performance of this contract. The DFAS HR Personnel Security Office will sponsor applicable contractors for SCI eligibility to the DoD CAF. DFAS Special Security Officer (SSO) will grant contractors SCI access once SCI eligibility has been attained.

Contractor personnel will handle and safeguard SCI material in accordance with DoDM 5105.21, Volume 1, “Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Information and Information Systems Security,” Volume 2, “Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Physical Security, Visitor Control, and Technical Security,” Volume 3, “Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Personnel Security, Industrial Security, and Special Activities,” and all DFAS specific security regulations and policies including facility standard operating procedures (SOP).

North Atlantic Treaty Organization (NATO) Classified Information Access Requirements: Contractors will require access to NATO Secret classified information. The DFAS SSO will sponsor applicable contractors for NATO access. Special briefings are required for access to NATO classified information in accordance with United States Security Authority for NATO Affairs Instruction 1-07, “Implementation of NATO Security Requirements.” Prior approval of the DFAS Contract Services Directorate is required for subcontracting. Access to NATO classified information requires a final U.S. Government clearance at the appropriate level. Access to NATO classified information by on-site contractor personnel, including oral and visual, will be under the supervision and control of NATO cleared DFAS government personnel. NATO classified information will not be generated, handled, or stored at the contractor cleared facility in performance of this contract.

DFAS Personnel Security Incident Reporting Requirements, the National Industrial Security Program and Due Process as it Relates to DFAS Contractor Personnel. The National Industrial Security Program (NISP) is a partnership between the federal government and private industry to safeguard classified information and Controlled Unclassified Information (CUI).

Executive Order 12829, as amended, "National Industrial Security Program", further amended by Section 6 of E.O. 13691, was established to achieve cost savings and to ensure that industry safeguards the classified information with which it is entrusted while performing work on contracts, programs, bids, or research and development efforts while working for United States Government.

It is important to note that personnel employed as contractors for DFAS are not covered under the National Industrial Security Program (NISP) and are exempt from the provisions of 5 C.F.R. 731. This means that DFAS contractor personnel involved in an incident that potentially violates one or more of the National Security Adjudicative Guidelines found at https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf , are not entitled to Due Process rights normally afforded to federal civilian employees and those personnel covered under NISP; more specifically, DFAS Personnel Security may suspend or revoke their access to DFAS IT systems, sensitive information and/or DFAS facilities.

Incident Reporting Requirements.

In all cases, whenever a DFAS contractor displays conduct, or is involved in any incident, which is in violation of any of the thirteen National Security Adjudicative Guidelines*, the contractor must immediately report the incident to the contractor company Security Office/Facility Security Officer, the DFAS Manager of the area to which they are assigned, the COR, and the DFAS Personnel Security Office. Reporting to DFAS Personnel Security may be made by phone to (317) 212-7888, by email to dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil , or, in the case of personnel physically located at DFAS Indianapolis Center, in person to the DFAS Personnel Security Office located on the third floor center hallway at Column 320T.

All incidents will be investigated by DFAS Personnel Security and, depending on the date of the subject’s most recent investigation, may need to have an updated background investigation initiated. Those that do not require a new investigation will have all relevant information regarding the incident forwarded to the Department of Defense, Consolidated Adjudications Facility (DoD-CAF) for review and re-adjudication.

*The thirteen National Security Adjudicative Guidelines are:

Some Examples of Incidents That Require Reporting to DFAS Personnel Security:

It should be noted that persons delinquent on Federal debt of any kind may not obtain or maintain favorable personnel security adjudication be considered for a contractor position with DFAS unless they can provide documentary proof that a payment plan has been established with the government agency to whom the debt is owed, and that regularly recurring payments are being made. Contractor personnel who cannot obtain and maintain a favorable personnel security adjudication may not have access to the government data, facility, and equipment required under the contract.

NOTE: This list does not cover every potential incident or offense; any incident in which a contractor is involved and a question exists as to whether it should be reported, should report the incident to DFAS Personnel Security, who will then determine if further action is warranted. Failure to report an incident is, in and of itself, an incident involving personal conduct, and may, in some cases, be more serious than the original incident.

Foreign Travel by DFAS Contractor Personnel Official and Unofficial (Personal) Travel: Official U.S. Government Business: persons employed as contractor employees with DFAS, to include those with Noncritical Sensitive (formerly IT-II) access, Critical Sensitive (formerly IT-I) access, access to critical program information (related to Research, Development, Test, and Evaluation), sensitive compartmented information, and/or special access program information, in accordance with DoD Directive 5240.06, are required to complete a DFAS Form 9133, Notification of OCONUS Travel, not less than fourteen (14) calendar days prior to the scheduled travel. One copy shall be sent the DFAS Personnel Security group box at dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil and one copy shall be turned into the Site Security/Force Protection Office of the DFAS site where they are stationed.

NOTE: For SCI indoctrinated contractors, the DFAS Form 9133 must be sent to the DFAS Indianapolis SSO at dfas.indianapolis-in.jb.mbx.unofficial-travel@mail.mil.

Upon receipt of the completed Form 9133, the Site Security/Force Protection Office will contact the contractor employee and schedule a Foreign Travel briefing. Immediately prior to travel, contractor employees will check with the State Department at https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html.html for any travel advisories for the country or region being traveled to and take the appropriate steps to ensure their safety for any location covered by a travel advisory or warning.

Security Education and Training. Contractor personnel shall receive initial, continuous and refresher security education training in accordance with DFAS 2000.1-I, DoDM 5200.01, Volume 3, “DoD Information Security Program – Protection of Classified Information,” DoDI 5200.48, and DFAS 5200.1-I. Contractor personnel shall also complete all required contractor training requirements identified in this SOW/PWS.

Access To, Accountability For, and Safeguarding Of Classified Information and Controlled Unclassified Information (CUI). The DFAS manager of the requiring office will determine what classified information and CUI contractor personnel are given access to. Classified Information and CUI may not be disclosed to contractor personnel unless required for contract performance. Contractor personnel shall safeguard classified information and CUI in accordance with DoDM 5200.01, Volumes 1-3, DoDI 5200.48 and DFAS 5200.1-I. The sponsoring DFAS activity will provide storage capability for all classified information and CUI required for contract performance. All work involving classified information must occur in appropriately designated areas within DFAS facilities. Work involving classified information will not take place at the contractor facility.

Installation Entry and Common Access Card (CAC) Requirements.

The Contractor shall comply with established security procedures for entering government installations and facilities. Contractor employees shall be required to obtain and wear identification (ID) badges that will permit access into the facility.

All contractors who require unescorted access to DFAS facilities will be required to obtain a DoD CAC. Contractor shall work with the assigned DFAS COR/Trusted Agent (TA) to obtain a CAC using the Trusted Associate Sponsorship System (TASS). Under no circumstances will a CAC be issued to any person unless that person has been cleared by the DFAS Personnel Security Office to work on the contract.

All CACs and badges issued to Contractor personnel are Government property and must be returned to the assigned DFAS COR/TA upon departure from the program or at the conclusion of the contract, whichever comes first. Contractors whose CAC is lost or stolen must report the loss as soon as possible to the assigned DFAS COR/TA and present documentation that the CAC is missing and describing the circumstances under which the loss occurred. The assigned DFAS COR/TA will follow agency CAC procedures in order to issue a new CAC.

The CAC contains PII and must be treated as a controlled item. Contractors’ must not share their CACs and passwords with any other staff members. The assigned DFAS COR/TA will report any violation or suspected violation to the Contracting Officer and DFAS Trusted Agent Security Manager (TASM). Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from a previous engagement with another agency that CAC must be returned to that agency before issuance of a new CAC.

Training.

DoD Mandatory Contractor Personnel Training Requirements: The contractor shall direct that its employees performing under this contract complete the annual mandatory training in accordance with the DoD mandate identified for each training module.

Contractor personnel working at a DFAS site who require a Common Access Card (CAC), or contractor personnel working remote via VPN, need to complete the following training modules within 30 days after receipt of CAC, (note for Cyber Awareness Challenge Module 003, completion of this module is required prior to requesting a new DFAS network or VPN account), as a precondition for continued attendance and/or network access.

In addition, these modules shall be completed annually to retain accessibility. Noncompliance will negatively impact contract performance and lead to the loss of CAC and/or network access for contractor personnel.

Continuity of Operations and Crisis Management Organization. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

Cyber Awareness Challenge. Completion of this module is required prior to requesting a new DFAS network or VPN account. For contractor personnel unable to access the DFAS Portal, the same training is available at:

https://public.cyber.mil/training/cyber-awareness-challenge/ Upon completion of the training Contractor personnel shall maintain a copy of the training certificate in PDF, submit a copy to the COR, attached to the request for network access as proof of completion.

Keeping DFAS Safe: Physical Security, Information Security, Personnel Security, CBRNE, Counterintelligence and Operations Security. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Antiterrorism Level One. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf All other contractor personnel shall take the training through the DFAS Portal upon receipt of network access.

Privacy Act (PA) and Personally Identifiable Information (PII). Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Records Management. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Insider Threat (InT) Awareness Training. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

DoD Mandatory Controlled Unclassified Information (CUI) Training. All contractor personnel shall take this CUI training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://securityawareness.usalearning.gov/cui/index.html

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

Unauthorized Disclosure of Classified Information and CUI. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://securityawareness.usalearning.gov/disclosure/index.html

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

Derivative Classification. Contractor personnel shall complete this training before performing Derivative Classification or accessing a classified network and annually thereafter. This training is available at:

https://securityawareness.usalearning.gov/derivative/index.htm NOTE: This list of training requirements is subject to change.

Training Time. The average estimated time for completion of each training module is approximately one hour or less. The Keeping DFAS Safe: Physical Security, Information Security, and Personnel Security training module will take approximately 90 minutes to complete.

Training Methods:

Network Training. Network training through the DFAS Portal is the required method for those Contractor personnel who have an existing DFAS network account.

Web-based Training. All contractor personnel are required to take the following web based training: Cyber Awareness Challenge (When system/network access is required), Antiterrorism Level One, Controlled Unclassified Information Training, and Combating Trafficking in Persons (CTIP) Awareness Training. If an individual does not have network access through the DFAS Portal, they can complete the training through a DoD authorized Web source. All other contractor personnel shall take the training through the DFAS Portal upon receipt of DFAS network. The contractor personnel shall retain a PDF copy of the “Certificate of Completion” or a “screen shot” with the date of the completion of the training. The COR will maintain a file for proof of completion.

Contractor personnel who do not require network access but require unescorted access into a DFAS facility shall receive applicable security training through the site Force Protection Office. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection Portal Page:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx The prime contractor official representative shall provide the COR with a group list of its personnel requiring completion of the training. The COR will submit the ‘group list’ to the Site Force Protection Officer to schedule training. As a reminder, the prime contractor official representative shall submit this group list of names within 30 days after contract award. Requests for individual training shall be justified in writing and submitted to the COR for evaluation. Special arrangements will be determined by the Site Force Protection Officer, other training Module POCs and the COR.

Interaction with Contractor Personnel. The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

The prime contractor official representative shall coordinate with the COR a training schedule without causing undue delays to contract performance.

The prime contractor official representative (including subcontractor’s personnel when applicable) shall provide the COR, within 30 days after contract award/exercise of an option, a written report identifying:

Contractor personnel shall direct their training questions or concerns to their contractor management chain and/or company representative.

Monthly Training Status Reports. The prime contractor official representative shall submit a monthly status update to the COR, identifying the initial and annual training status of all contractor personnel.

Training Point of Contact (POC). The COR is the POC for the Contractor. The Contractor shall provide regular training updates to the COR, and keep an updated registry to assure employees who come on board at any time in the contract life have completed all required training.