A23 RFQ PWS ACS IDS Camera.pdf

Performance Work Statement DFAS-IN ACS IDS Camera Maintenance

Defense Finance and Accounting Service (DFAS)

1 | P a g e

1.0 Introduction: This contract is for a vendor to provide maintenance, on-call service response when requested CCTV (closed-circuit television), IDS (Intrusion Detection System), and ACS (Access Control System) at the Defense Finance and Accounting Service-Indianapolis (DFAS-IN), The vendor to perform installs and/or removals when requested.

2.0 Scope: The Contractor shall provide labor and all associated hardware, software, field devices and equipment for both the DFAS-IN Access Control System (ACS) and the DFAS-IN Intrusion Detection System (IDS) to be fully operational/installed.

2.1 Access Control System (ACS): The ACS includes:

LENEL System Administration, Alarm Monitoring, Video Viewer, automatic door openers.

2.2 Intrusion Detection System (IDS): The IDS includes:

DMP and Bosch system panels.

The IDS Areas are:

1. Client Systems 1 Alarm: Requires UL

2. Client Systems 2 Alarm: Requires UL

3. Agency Force Protection: No UL

4. Force Protection Operations Center: No UL

5. The Office of Preparedness: No UL

6. Client Systems 2 Server Room: No UL

7. Disbursing Vault: No UL

8. Room 139V: No UL

The IDS currently includes the following approximate count/description of items that may require maintenance under this contract:

• 120 card readers

• 102 IP (Cameras (includes 4 parapet cameras)

• Axis P3354, P3719, P3364, P3367-5mp, Q3819-PVE, M3045, P5624-E

• IDS includes Bosch and DMP panels, expansion modules, power supplies, door contacts, high security door contacts, motion detectors, cabinet tampers, phone line module, internet module

3.0 Place of Performance:

Defense Finance and Accounting Service-Indianapolis, 8899 East 56th Street, Indianapolis, IN 46249.

The Contractor shall only work in the areas designated by the Contracting Officer Representative (COR).

Smoking and tobacco use is prohibited in all Federal facilities and government owned vehicles. Tobacco products include cigarettes, cigars, cigarillos, smokeless tobacco, electronic cigarettes, inhaled tobacco, all new and emergent tobacco products, as well as all other tobacco products designed for human

2 | P a g e consumption. Smoking and tobacco use is only permitted in designated smoking areas which are clearly marked.

4.0 Period of Performance: The contract will be valid for one year from the date of award and includes four (4) one-year options. The total contract will not exceed five years.

5.0 Recognized Holidays: The following have recognized US federal holidays:

New Year’s Day Martin Luther King’s Birthday President’s Day Memorial Day Juneteenth Independence Day Labor Day Columbus Day Veteran’s Day Thanksgiving Day Christmas Day

6.0 Requirements:

6.1 Telephone Consultation:

DFAS-IN will call in all requests for repair and requests for assistance. The Contractor shall reply to all requests within two hours, 7 days a week, 24 hours a day, 365 days a year. If a situation cannot be corrected via a phone consultation, the Contracting Officer Representative (COR) will determine if the situation is an Emergency.

6.2 In-Person Emergency Repair/Service:

6.2.1 The Contractor will provide an in-person technician trained to repair the DFAS-IN ACS and IDS within four (4) hours of DFAS Notification 24 hours a day, seven days week (including federal holidays) if the malfunction is deemed an Emergency Situation. DFAS Notification is the original call made for a telephone consultation. An Emergency Situation is any condition that requires immediate action to eliminate life or serious injury hazards to personnel, prevent damage to Government property, and maintain security of DFAS-IN assets. The Contracting Officer Representative will determine if the situation is an Emergency and notify the contractor.

6.2.2 The Contractor shall provide, at their expense, all personnel, parts, supervision, equipment, tools, material, and other items and services necessary to perform all repairs and maintenance of the entire DFAS-IN ACS and IDS. If the Contractor requires outside support (electrician, scissors lift, etc.), the Contractor will ensure DFAS is advised with sufficient lead time for DFAS to arrange such outside support, prior to the Contractor dispatching a technician.

6.2.3 Emergency repairs shall be completed within 24 hours of being reported (including federal holidays and weekends).

3 | P a g e

6.2.4 The Contractor shall perform a test of all repaired systems to ensure proper operation before repairs are considered complete. Testing will be conducted in the presence of DFAS-IN Security Officials as a means of confirming results. A DFAS-IN Security Official will verify system operations.

6.2.5 The DFAS COR will provide the contractor with a work request for service. The contractor will ensure the appropriate work order number is used in all documentation pertaining to the work completed.

6.3 In-Person Non-Emergency Repair/Service:

6.3.1 The Contractor will provide a technician trained to service the DFAS-IN ACS and IDS within twenty-four (24) hours of DFAS Notification. DFAS Notification is the original call made for a telephone consultation. Non-Emergency repairs should be performed during normal business hours, Mon – Fri 7:00 a.m. – 5:00 p.m., excluding Federal Holidays. With regard to non-emergency repairs/service, when the 24-hour period encompasses a Saturday, Sunday, and/or federal holiday, the Contractor shall arrive onsite on the first workday following initial Government notification.

6.3.2 The Contractor shall provide all personnel, parts, supervision, equipment, tools, material, and other items and services necessary to perform all repairs and maintenance on the entire DFAS-IN ACS and IDS. The Contractor shall provide, at their expense, outside support (electrician, scissors lift, etc.) if necessary. The Contractor will ensure DFAS is advised with sufficient lead time for DFAS to arrange such outside support, prior to the Contractor dispatching a technician.

6.3.3 Non-Emergency Repairs shall be completed within five business days of being reported.

6.3.4 The Contractor shall perform a test of all repaired systems to ensure proper operation before repairs are considered complete. Testing will be conducted in the presence of the COR as a means of confirming results.

6.3.5 The DFAS COR will provide the contractor with a work request for service. The contractor will ensure the appropriate work order number is used in all documentation pertaining to the work completed.

6.4 Equipment Install/Removal Service

6.4.1 DFAS may, from time to time, require installation and/or removals of equipment specified in Section 2.0. The Contractor shall install/remove equipment specified in PWS section 2.0, SCOPE within 30 calendar days of notice. If DFAS does not have parts on hand, the Contractor shall provide a quote for additional parts within 5 (five) business days for DFAS’s review with the expected delivery date. For parts that need to be ordered, the Contractor shall install/remove equipment specified within 30 calendar days of receipt of parts.

If DFAS does not have parts on hand, the Contractor shall provide a quote for additional parts within 5 (five) business days for DFAS’s review with the expected delivery date. Upon approval from the COR, the Contractor shall provide the parts and bill for additional install parts costs.

• DFAS-IN estimates up to 12 (twelve) installs and/or removals per year.

7.0 Submittals: The Contractor is required to submit the following reports and records to the COR:

7.1 Test Reports: Indicate procedures and results for specified field testing and inspection. Test Reports must be submitted within three business days after testing.

4 | P a g e

7.2 Manufacturer’s Field Reports: Indicate activities on site, adverse findings, and recommendations. Manufacturer’s Field Reports must be submitted within three business days after testing.

7.3 Service Records shall be maintained by the contractor in an automated database and be available for review by the COR during normal business hours. Contractor shall submit a copy of all service actions, mark-ups, and test and/or service reports within three business days after request by the COR. All records remain the property of the government and are to be turned over when requested by the COR or at the conclusion of the contract.

8.0 LENEL Security System Equipment and Intrusion Detection System Equipment

8.1 ACS: The Contractor will provide labor and all associated hardware, software, and equipment for the DFAS-IN ACS. The ACS includes: Lenel OnGuard System Administration, Alarm Monitoring, Video Viewer, 98 automatic door openers and associated system operating equipment to include: 7 CPU’s, 1 Server, 1 Badge Printer, aproximently120 Card Readers, Door Hardware (electrified mortise, cylindrical, panic devices, strikes, door hardware power supplies, electric power transfer devices, door contacts, sensors, automatic door openers and request to exits), 6 Network Video Recorders (NVR), 102 IP cameras (includes 4 parapet cameras), power supplies and related video products (including NVR and associated equipment), any other associated hardware and wiring. Contractor will also maintain all wiring associated with the ACS.

8.2 IDS: The Contractor will provide labor and all associated hardware, software, and equipment for the DFAS-IN IDS. The IDS includes Bosch and DMP panels, expansion modules, power supplies, door contacts, high security door contacts, motion detectors, cabinet tampers, phone line modules, internet modules and any other associated hardware and wiring. Contractor will also maintain all wiring associated with the IDS.

8.3 Quality Assurance and Surveillance Plan (QASP)

The Government will utilize a QASP to monitor and provide feedback on contractor performance. The services will be performance-based with measurable performance standards that define what is considered acceptable performance. The measure of successful performance outcomes in the QASP are in the Performance Requirements Summary (PRS). The PRS is contained in Section 9.5 of the PWS.

8.4 Monthly Up-time Report

The Government will monitor a Monthly Uptime Report. The report will have a separate calculation for each stand-alone system. The report will be based on the total number of minutes the system is expected to be available for the month and the total number of minutes the system was actually available for the month.

The calculation will deduct the either the allowable allotted time for each type of incident, i.e. in person emergency repairs – 24 hours, In-Person Non-Emergency Repair/Service – 50 hours (5 days at 10 hours per day) or the actual time needed to address the issue for each incident; whichever is smaller.

9.0 Qualifications:

9.1 Contractor must possess a working knowledge of the LENEL ON-Guard software applications.

9.2 Contractor must maintain and submit yearly proof of LENEL/On-Guard Certifications for their employees supporting this contract.

5 | P a g e

9.3 Contractor must be a LENEL Value Added Reseller (VAR). The Contractor must maintain and submit yearly proof of their VAR license.

9.4 Contractor must possess and demonstrate a working knowledge of the Bosch and DMP Intrusion Detection System panels and associated devices to support system operation. The contractor must be a Bosch and DMP reseller. The Contractor must maintain and submit yearly proof of their reseller license for Bosch and DMP.

9.5 Performance Requirements Summary Standards:

ATTACHMENT 1: PERFORMANCE REQUIREMENTS SUMMARY

Performance Requirements Summary Standards, Acceptable Level of Performance (ALP)

Task ID Objective Outcome Acceptable

Level of Performance

Surveillance

Requirements

6.1 Telephone

Consultation

DFAS-IN will call in all requests for repair and requests for assistance.

The Contractor shall reply to all requests within two hours, 7 days a week, 24 hours a day, 365 days a year. If a situation cannot be corrected via a phone consultation, the Contracting Officer Representative (COR) will determine if the situation is an Emergency.

The Contractor replies to all requests within two hours, 7 days a week, 24 hours a day, 365 days a year

Meets identified level of support

The COR will perform a 100% review of test and/or service reports for each incident.

6.2 In-Person

Emergency

Repair/Service

The Contractor will provide an in-person technician trained to repair the DFAS-IN ACS and IDS within four (4) hours of DFAS Notification 24 hours a day, seven days week (including federal holidays) if the malfunction is deemed an Emergency Situation. DFAS

Notification is the original call made for a telephone consultation. The

Contractor shall perform a test of all repaired systems to ensure proper operation before repairs are considered complete.

The Contractor provides an in-person technician trained to repair the DFAS- IN ACS and IDS within four (4) hours. Also, applicable tools, material, other items, supervision, and service will be provided. Emergency repairs are completed within 24 hours of being reported (including federal holidays and weekends).

Meets identified level of support

The COR will perform a 100% review of test and/or service reports for each emergency incident to ensure repairs are completed within 24 hours of being reported.

6 | P a g e

6.3 In-Person

Non-

Emergency Repair/Service

The Contractor will provide a technician trained to service the DFAS-IN ACS and IDS within twenty-four (24) hours of DFAS

Notification. DFAS Notification is the original call made for a telephone consultation. The

Contractor shall perform a test of all repaired systems to ensure proper operation before repairs are considered complete.

The Contractor provides a technician trained to service the DFAS-IN ACS and IDS within twenty-four (24) hours to correct the issue. Also, applicable tools, material, other items, supervision, and service will be provided. Non- Emergency Repairs are completed within five business days of being reported

Meets identified level of support

The COR will perform a 100% review of test and/or service reports for each non-emergency incident to ensure repairs are completed within 5 business days of being reported.

6.4 Equipment

Install/Removal

Service

The Contractor shall install/remove equipment specified in PWS section 2.0, SCOPE within 30 calendar days of notice. If DFAS does not have parts on hand, the Contractor shall provide a quote for additional parts within 5 (five) business days for DFAS’s review with the expected delivery date. For parts that need to be ordered, the Contractor shall install/remove equipment specified within 30 calendar days of receipt of parts.

The contractor installs/removed required on-hand equipment within 30 days of notice or within

30 days of delivery for parts ordered.

Meets identified level of support

COR will monitor install/removal request dates, expected delivery dates, actual delivery dates and actual install/removal dates.

7.0 Submittals

The Contractor is required to submit the following reports and records to the COR

Indicate activities on site, adverse findings, and recommendations.

Manufacturer’s Field

Reports must be submitted within three business days after testing. Service Records shall be maintained by the contractor in an automated database and be available for review by the COR during normal business hours. Contractor shall submit a copy of all service actions, mark-ups, test and/or service reports within three business days after request by the COR.

Meets identified timeframe during the month

The COR will randomly review Manufacturer’s Field Reports, Service Records service actions, mark-ups, and test and/or service reports.

7 | P a g e

8.4 Monthly

Up-time Report

The Contractor will provide personnel and supplies to service the

DFAS-IN ACS and IDS systems and maintain the availability for each system.

The contractor is expected to respond to Government requests for repair and requests for assistance and provide the personnel needed and services to maintain a 90% uptime calculation for each system.

Systems uptime meets or exceeds 90% availability.

PM and COR will review the Government's Monthly Up-time report for each system and provide a copy to the contractor monthly.

9.0 Employees

Contractor shall submit LENEL/OnGuard Certifications for employees before an employee is assigned for this requirement and annually.

Contractor shall submit proof of being a LENEL Value Added Reseller (VAR) and reseller license for Bosch and DMP annually before an option is exercised or at anytime their status changes with the companies

Certificates should be sent for approval. The assigned COR/or contracting officer will respond with approval.

Meets identified level of certification.

100% Inspection

9.6 Invoice Submissions

The vendor shall submit invoices for payment monthly. Invoices should be submitted no later than ten business days following previous month end. Invoices shall contain a description of the service month and the year.

9.7 CONTRACTING OFFICER REPRESENTATIVE (COR)

A COR will be appointed by the Contracting Officer to provide technical direction and administration.

The appointment shall be in writing and shall state the scope of authority and limitations. The COR has authority to provide technical direction to the Contractor as long as that direction is within the scope, does not constitute a change, and has no funding implications. The COR is not authorized to change any terms or conditions. Only the Contracting Officer has the authority to make changes to the terms and conditions.

Any changes or modifications requested by the Contractor must be directed to the Contracting Officer for review and official approval. Upon award, a letter of designation will be issued to the COR and shared with the Contractor.

9.8 INSPECTION/ACCEPTANCE

The COR is designated as the point of final inspection and acceptance by the Government of all items and services. Upon final acceptance/inspection, invoices shall be submitted IAW with the Wide Area Workflow (WAWF) clause DFARS 252.232-7003. Payment will be made in accordance with the Prompt Payment Act.

10.0 Security Requirements.

10.1 General Requirements. Contractor personnel must meet the following conditions of employment.

1. Must be a U.S Citizen or National.

8 | P a g e

2. Registered for Selective Service (males born after 12-31-1959). A Status Information Letter is required for any male born after 12-31-1959 that is not registered with Selective Service.

3. This is a national security position which requires a favorable fitness review and background investigation as a condition of employment. Failure to maintain security eligibility may result in termination.

10.2 Personnel Security Investigation (PSI) Requirements.

Contractor personnel working on this contract will require a favorably adjudicated Tier 3, or equivalent Noncritical-Sensitive (formerly IT-II) or higher-level Investigation granting National Security eligibility.

Contractor personnel must also have current enrollment (within 5 years) in the Continuous Vetting program, in accordance with Trusted Workforce 2.0 standards. No access to classified information is required. In accordance with standard DFAS Personnel Security policy, ALL incoming contractors must submit a new set of fingerprints (taken within the last 30 days) *.

Contractor personnel must apply for a fingerprint appointment immediately (the next business day) upon award date.

Contractor personnel shall submit the Contractor Request for Investigation (CRI) (DFAS Form 9035) immediately (the next business day after providing fingerprints) to the Contracting Officer Representative (COR). The information needed in the Declaration for Federal Employment (OF-306) shall also be submitted to the COR by contractor personnel.

The COR will submit the OF-306, DFAS Form 9035, and proof of fingerprints to DFAS Personnel Security all at once. Under no circumstances should this documentation be submitted less than fifteen

(15) calendar days prior to the intended performance start date. DFAS Personnel Security will review all submitted documentation to validate whether contractor personnel meet personnel security requirements to perform work on the contract or if a new background investigation is required.

Contractors obtaining favorable security evaluations and DoD CACs for required contractor employees performing on this contract are a prerequisite for contractor performance and invoicing. Also, the failure of a contractor to provide employees who can obtain a favorable security adjudication and a DoD CAC in a timely manner may be considered negatively when assessing contractor performance, termination, or other.

*New fingerprints are not required if any of the following are applied:

1. The person has been fingerprinted for the Defense Counterintelligence and Security Agency (DCSA) within the past 30 days.

2. The person is currently undergoing a background investigation, or reinvestigation, by DCSA or any other Federal agency.

3. The person has a background investigation currently being adjudicated by the DCSA Adjudication and Vetting Services (DCSA AVS) or another AVS.

4. The person has been favorably adjudicated within the past 30 days by the DCSA AVS or an AVS from any other Federal agency: or

9 | P a g e

5. The person comes directly from another DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

6. The DFAS Personnel Security Office otherwise determines that no new fingerprints are required.

10.3 Regulatory Requirements. Contractor personnel shall follow the security and training requirements in DoDM 5220.23, “Industrial Security Procedures For Government Activities,” DoDM 5200.01, Volumes 1-3, “DoD Information Security Program,” DoDI, 5200.48, “Controlled Unclassified Information,” DFAS 2000.1-I, “Force Protection Mission,” DFAS 5200.1-I, “Information Security Program,” DFAS 5200.8-I, “Physical Security Program,” and DFAS 5200.10-I, “Counter Insider Threat Program.” Contractor personnel shall follow all host security requirements in accordance with Part 117 of Title 32, Code of Federal Regulations; paragraph 117.16. Ensure that all contracting officers include applicable clauses in all contracts that require work to be performed for a DFAS location. The contractor shall immediately report any occurrences of violation of stated regulations to the DFAS Manager of the area to which they are assigned, Contracting Officer (CO), COR, Director, Force Protection, and the DFAS Personnel Security Office.

DoD Issuances can be located at the following web link:

https://www.esd.whs.mil/dd/dod-issuances/

DFAS Instructions can be located at the following agency portal web link:

Official Forms and Pubs - All Documents

10.4 DFAS Personnel Security Incident Reporting Requirements, the National Industrial Security Program and Due Process as it Relates to DFAS Contractor Personnel. The National Industrial Security Program (NISP) is a partnership between the federal government and private industry to safeguard classified information and CUI.

Executive Order 12829, as amended, "National Industrial Security Program," further amended by Section 6 of E.O. 13691, was established to achieve cost savings and to ensure that industry safeguards the classified information with which it is entrusted while performing work on contracts, programs, bids, or research and development efforts while working for the United States Government.

It is important to note that personnel employed as contractors for DFAS are not covered under the National Industrial Security Program (NISP) and are exempt from the provisions of 5 C.F.R. 731. This means that DFAS contractor personnel involved in an incident that potentially violates one or more of the National Security Adjudicative Guidelines found at https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf , are not entitled to Due Process rights normally afforded to federal civilian employees and those personnel covered under NISP; more specifically, DFAS Personnel Security may suspend or revoke contractor personnel access to DFAS IT systems, sensitive information and/or DFAS facilities.

10.5 Incident Reporting Requirements.

In all cases, whenever a DFAS contractor displays conduct, or is involved in any incident, which is in violation of any of the thirteen National Security Adjudicative Guidelines*, the contractor must immediately report the incident to the contractor company Security Office/Facility Security Officer, the https://www.esd.whs.mil/dd/dod-issuances/ https://dfasportal.dfas.mil/docs/Documents/Forms/AllItems.aspx?RootFolder=%2fdocs%2fDocuments%2fOfficial%20Forms%20and%20Pubs&FolderCTID=0x012000C5AD4BBE89E91A47852CADC95291E394 https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf

10 | P a g e

DFAS Manager of the area to which they are assigned, the CO, the COR, the Director, Force Protection, and the DFAS Personnel Security Office. Reporting to DFAS Personnel Security may be made by phone to (317) 212-7888, by email to dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil, or, in the case of personnel physically located at DFAS Indianapolis Center, in person to the DFAS Personnel Security Office located on the third floor center hallway at Column 320T.

All incidents will be investigated by DFAS Personnel Security and, depending on the date of the subject’s most recent investigation, may need to have an updated background investigation initiated. Those that do not require a new investigation will have all relevant information regarding the incident forwarded to the DCSA AVS for review and re-adjudication.

*The thirteen National Security Adjudicative Guidelines are:

1. GUIDELINE A: Allegiance to the United States

2. GUIDELINE B: Foreign Influence

3. GUIDELINE C: Foreign Preference

4. GUIDELINE D: Sexual Behavior

5. GUIDELINE E: Personal Conduct

6. GUIDELINE F: Financial Considerations

7. GUIDELINE G: Alcohol Consumption

8. GUIDELINE H: Drug Involvement and Substance Misuse

9. GUIDELINE I: Psychological Conditions

10. GUIDELINE J: Criminal Conduct

11. GUIDELINE K: Handling Protected Information

12. GUIDELINE L: Outside Activities

13. GUIDELINE M: Use of Information Technology

Some Examples of Incidents That Require Reporting to DFAS Personnel Security:

a) An arrest for any criminal offense, not including minor traffic violations, by any law enforcement agency. This DOES include the traffic offenses of Driving Under the Influence of Alcohol or Drugs, and Reckless Driving.

b) Violation of any court order.

c) Civil judgements.

d) Delinquencies on any debt for 180 days or longer.

e) Federal, State or Local tax issues or delinquencies.

f) Delinquencies on any Federal debt (including Federal Student Loans and Federally backed home mortgage loans).

g) Child Support delinquencies.

h) Filing for Chapter 7 or Chapter 13 bankruptcy in any Federal Bankruptcy Court.

i) Foreign Travel.

j) Marriage or Cohabitation with a Foreign National (person from a foreign country).

k) Having a close personal friendship with a Foreign National with regularly occurring contact.

mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil

11 | P a g e

l) Ownership of property or financial accounts in a foreign country; and

m) Being approached by a person know to be, or suspected to be, working as an agent of a foreign government or terrorist organization, or any other person, who seeks any information about DFAS, the Department of Defense, or the U.S. Government, especially if the person offers money or something of value to the contractor employee.

It should be noted that a person’s delinquency on Federal debt of any kind may not obtain or maintain favorable personnel security adjudication or be considered for a contractor position with DFAS unless they can provide documentary proof that a payment plan has been established with the Government agency to whom the debt is owed, and that regularly recurring payments are being made. Contractor personnel who cannot obtain and maintain a favorable personnel security adjudication may not have access to government data, facilities, and/or equipment required under the contract.

NOTE: This list does not cover every potential incident or offense; any incident in which a contractor is involved, and a question exists as to whether it should be reported, should report the incident to DFAS Personnel Security, who will then determine if further action is warranted. Failure to report an incident is, in and of itself, an incident involving personal conduct, and may, in some cases, be more serious than the original incident.

10.6 Foreign Travel by DFAS Contractor Personnel

Official and Unofficial (Personal) Travel: Official U.S. Government Business: persons employed as contractor employees with DFAS, to include those with Noncritical Sensitive (formerly IT-II) access, Critical Sensitive (formerly IT-I) access, access to critical program information (related to Research, Development, Test, and Evaluation), sensitive compartmented information, and/or special access program information, in accordance with DoD Directive 5240.06, are required to complete a DFAS Form 9133, Notification of Foreign Travel, not less than 30 calendar days prior to the scheduled travel.

One copy shall be sent the DFAS Personnel Security group box at dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil and one copy shall be turned into the Site Force Protection Office of the DFAS site where they are stationed. Site Force Protection POC information:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx Upon receipt of the completed Form 9133, the Site Force Protection Office will contact the contractor employee to validate training, complete the country/theater clearance package, as required, and schedule a Foreign Travel briefing. Immediately prior to travel, contractor employees will check with the State Department at https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html.html for any travel advisories for the country or region being traveled to and take the appropriate steps to ensure their safety for any location covered by a travel advisory or warning.

10.7 Security Education and Training. Contractor personnel shall receive initial, continuous and refresher security education training in accordance with DoDM 5200.01, Volume 3, “DoD Information Security Program – Protection of Classified Information,” DoDI 5200.48, DFAS 2000.1-I, DFAS 5200.1- I, DFAS 5200.8-I, and DFAS 5200.10-I. Contractor personnel shall also complete all required contractor training requirements identified in this SOW/PWS.

10.8 Access To, Accountability For, and Safeguarding of Controlled Unclassified Information (CUI). The DFAS manager of the requiring office will determine what CUI contractor personnel are given access to. CUI may not be disclosed to contractor personnel unless required for contract performance. Contractor personnel shall safeguard CUI in accordance with DoDI 5200.48 and DFAS 5200.1-I. The sponsoring DFAS activity will provide storage capability for all CUI required for contract performance. Contractor personnel must monitor CUI for aggregation and compilation based on the mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html.html

12 | P a g e potential to generate classified information. Contractor personnel must report the potential classification of aggregated or compiled CUI to the DFAS Manager of the area to which they are assigned, the CO, the COR, and the Director, Force Protection.

10.9 Installation Entry and Common Access Card (CAC) Requirements.

The Contractor shall comply with established security procedures for entering government installations and facilities. Contractor employees shall be required to obtain and wear identification (ID) badges that will permit access into the facility.

Contractors shall work with the assigned DFAS COR/Mission Partner Account Sponsor (MPAS) to obtain a CAC using Mission Partner Identity Credential Account Management (MP ICAM). Under no circumstances will a CAC be issued to any person unless that person has been cleared by the DFAS Personnel Security Office to work on the contract.

All CACs and badges issued to Contractor personnel are government property and must be returned to the assigned DFAS COR/MPAS upon departure from the program or at the conclusion of the contract, whichever comes first. CACs can also be mailed in or turned into RAPIDS locations. Contractors whose CAC is lost or stolen must report the loss as soon as possible to the assigned DFAS COR/MPAS and present documentation that the CAC is missing and describe the circumstances under which the loss occurred. The assigned DFAS COR/MPAS will follow agency CAC procedures to issue a new CAC.

Contractors must not share their CACs and passwords with any other staff members. The assigned DFAS COR/MPAS will report any violation or suspected violation to the Contracting Officer and DFAS MP ICAM Account Security Manager (MPASM). Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from another agency, that CAC must be revoked and returned before issuance of a new CAC.

10.10 Training.

DoD Mandatory Contractor Personnel Training Requirements: The contractor shall direct that its employees performing under this contract complete the annual mandatory training in accordance with the DoD mandate identified for each training module.

Contractor personnel working at a DFAS site who require a CAC, or contractor personnel working remote via VPN, need to complete the following training modules within 30 days after receipt of CAC, (note for Cyber Awareness Challenge Module 003, completion of this module is required prior to requesting a new DFAS network or VPN account), as a precondition for continued attendance and/or network access.

In addition, these modules shall be completed annually to retain accessibility. Noncompliance will negatively impact on contract performance and lead to the loss of CAC and/or network access for contractor personnel.

10.11 Continuity of Operations and Crisis Management Organization. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

10.12 Cyber Awareness Challenge. Completion of this module is required prior to requesting a new DFAS network or VPN account. For contractor personnel unable to access the DFAS Portal, the same training is available at:

https://public.cyber.mil/training/cyber-awareness-challenge/ Upon completion of the training Contractor personnel shall maintain a copy of the training certificate in PDF, submit a copy to the COR, attached to the request for network access as proof of completion.

Keeping DFAS Safe: Physical Security, Information Security, Personnel Security, CBRNE, Counterintelligence and Operations Security. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

https://public.cyber.mil/training/cyber-awareness-challenge/

13 | P a g e

Level I Antiterrorism Awareness Training. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf

All other contractor personnel shall take the training through the DFAS Portal upon receipt of network access.

Privacy Act (PA) and Personally Identifiable Information (PII). Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Records Management. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Insider Threat (InT) Awareness Training. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

DoD Mandatory Controlled Unclassified Information (CUI) Training. All contractor personnel shall take this CUI training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://securityawareness.usalearning.gov/cui/index.html

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

Unauthorized Disclosure of Classified Information and CUI. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://securityawareness.usalearning.gov/disclosure/index.html

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

NOTE: This list of training requirements is subject to change.

Training Time. The average estimated time for completion of each training module is approximately one hour or less. Keeping DFAS Safe: Physical Security, Information Security, and Personnel Security training module will take approximately 90 minutes to complete.

Training Methods:

Network Training. Network training through the DFAS Portal is the required method for those Contractor personnel who have an existing DFAS network account.

Web-based Training. All contractor personnel are required to take the following web-based training:

Cyber Awareness Challenge (When system/network access is required), Level I Antiterrorism Awareness Training, DoD Mandatory Controlled Unclassified Information Training, and Unauthorized Disclosure of Classified Information and CUI. If an individual does not have network access through the DFAS Portal, they can complete the training through a DoD authorized Web source. All other contractor personnel shall take the training through the DFAS Portal upon receipt of DFAS network access. The contractor https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf https://securityawareness.usalearning.gov/cui/index.html https://securityawareness.usalearning.gov/disclosure/index.html

14 | P a g e personnel shall retain a PDF copy of the “Certificate of Completion” or a “screen shot” with the date of the completion of the training. The COR will maintain a file for proof of completion.

Contractor personnel who do not require network access but require unescorted access into a DFAS facility shall receive applicable security training through the site Force Protection Office. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection Portal Page:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx The prime contractor official representative shall provide the COR with a group list of its personnel requiring completion of the training. The COR will submit the ‘group list’ to the Site Force Protection Officer to schedule training. As a reminder, the prime contractor official representative shall submit this group list of names within 30 days after contract award. Requests for individual training shall be justified in writing and submitted to the COR for evaluation. Special arrangements will be determined by the Site Force Protection Officer, other training Module POCs and the COR.

Interaction with Contractor Personnel. The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

The prime contractor official representative shall coordinate with the COR a training schedule without causing undue delays to contract performance.

The prime contractor official representative (including subcontractor’s personnel when applicable) shall provide the COR, within 30 days after contract award/exercise of an option, a written report identifying:

- Contractor employees required to take the training

- Contractor employees who have completed the training

- Contractor employees who are delinquent Contractor personnel shall direct their training questions or concerns to their contractor management chain and/or company representative.

Monthly Training Status Reports. The prime contractor official representative shall submit a monthly status update to the COR, identifying the initial and annual training status of all contractor personnel.

Training Point of Contact (POC). The COR is the POC for the Contractor. The Contractor shall provide regular training updates to the COR and keep an updated registry to assure employees who come on board at any time in the contract life have completed all required training.

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx

9.6 Invoice Submissions