A27 HS002123Q0001.pdf

Performance Work Statement Defense Counterintelligence and Security Agency

Acquisition and Contracting Credit Reporting Services

Part 1

General Information

1. General: This is a non-personal services contract to provide credit reporting services. The Government shall not exercise direct supervision or control over the contractor providing the services herein. Contractor staff shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.2. Description of Services/Introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and services necessary to perform as defined in this Performance Work Statement. The Contractor shall perform to the standards of the contract.

1.3. Background: The mission of the Defense Counterintelligence and Security Agency (DCSA) is continuously ensuring a trusted federal, industrial and affiliated workforce, and enabling industry’s delivery of uncompromised capabilities by leveraging advanced technologies and innovation. A segment of DCSA’s mission is to obtain data source records for inclusion in the Federal Background Investigations program. This acquisition will allow DCSA to complete its mission by obtaining employment credit reports throughout the DCSA personnel vetting mission.

DCSA is specifically seeking access to employment credit report data, as required by the Federal Investigative Standards. This information is vital to the mission of DCSA in the performance of personnel vetting and conducting background investigations (BI) and adjudications for the departments and agencies of the federal Government. BIs are required to determine an individual’s eligibility for access to classified information, assignment to, or retention in positions with sensitive duties, or other designated duties requiring such investigations. Records may be obtained during the initial background investigation, the adjudication process, and/or the continuous vetting process.

1.4. Objectives: The overall objective of this requirement is to receive credit reporting services.

Listed below are the specific functions of the requirement:

• Single Credit Reports (from all three credit bureaus: TransUnion, Experian, Equifax)

• Tri-Merge Credit Reports

• Credit Monitoring

Vendors are required to establish connections to DCSA systems. Connections are expected to take between 6 and 10 months.

1.5. Scope: The scope of this requirement is for the vendor to provide access to online single and tri-merge credit bureau reports and credit monitoring. The vendor shall provide online credit reports in a system to system connection from the three credit bureaus: TransUnion, Experian, and Equifax. The contractor shall provide the reports using a Department of Defense (DoD) format which will be defined at the order level.

1.6. Period of Performance (PoP): The Government contemplates awarding multiple-award blanket purchase agreements (BPAs), each with a five year ordering period. Orders will be competed as requiring activity needs arise.

1.7 Ordering – Only appropriately warranted Government Contracting Officers are authorized to place orders under this BPA. The ordering activity may send the contractor a request for quote (RFQ) that will include the requirement, inclusive of any formatting requirements, and evaluation criteria to the BPA holder, unless a separate determination is made in accordance with FAR 8.405-

6. The Government will evaluate the response received and the KO will place the orders with the BPA holder, in accordance with the evaluation criteria provided with the RFQ. Contractors may be required to respond to an order RFQ in as little as one day. Depending on the needs of the Government, individual orders may include option quantities. The type of option and the evaluation methodology will be established within the RFQ.

Ordering activities may require the BPA awardee to identify potential conflicts of interest and address and resolve any concerns prior to placing an order.

Orders will be competed upon the KO receiving a request from the requiring activities. Each BPA awardee, with an established connection, will receive an “order request worksheet” in order to be considered for the competitive order award.

1.8. General Information:

1.8.1. Quality Control: The Contractor shall develop and maintain an effective quality control program, including a Quality Control Plan (QCP), to ensure services are performed in accordance with this performance work statement. The Contractor shall develop and implement procedures to ensure they are meeting the terms and conditions of the requirement. The QCP shall be delivered within 30 calendar days after BPA award. A comprehensive written QCP shall be submitted to the Contracting Officer (KO), Contracting Officer Representative (COR), and Contracting Specialist (CS) within 7 calendar days when changes are made thereafter. After acceptance of the QCP the Contractor shall receive the KO’s acceptance in writing of any proposed change to the QCP.

1.8.2. Quality Assurance: The Government shall evaluate the Contractor’s performance at the order level, in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rates.

1.8.3. On-Site Working Conditions, Holidays and other Closures:

1.8.3.1. The contractor will not be working on-site at any DCSA facilities.

1.8.3.2. The Government expects the contractor to establish 24 hours a day system accessibility.

The contractor, at all times, shall maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the below reasons.

1.8.3.3. Government personnel observe the following days as holidays and the Government facilities will be closed and unavailable to Contractor personnel on the following days:

New Year’s Day January 1st*

Martin Luther King’s Birthday Third Monday in January President’s Day Third Monday in February Memorial Day Last Monday in May

Juneteenth National Independence Day June 19* Independence Day July 4th* Labor Day First Monday in September Columbus Day Second Monday in October

Veterans Day November 11th* Thanksgiving Day Fourth Thursday in November Christmas Day December 25th*

*If the date falls on a Saturday, the Government holiday is the preceding Friday. If the date falls on a Sunday, the Government holiday is the following Monday.

1.8.3.4. In addition to the days designated as holidays, the Government observes the following days:

• Any other day designated by Federal Statute

• Any other day designated by Executive Order

• Any other day designated by the President’s Proclamation

1.8.3.5. It is understood and agreed between the Government and the Contractor that observance of such days by Government personnel shall not otherwise be a reason for an additional period of performance, or entitlement of compensation except as set forth within the contract. In the event the Contractor's personnel work during the holiday, they may be reimbursed by the Contractor, however, no form of holiday or other premium compensation will be reimbursed either as a direct or indirect cost, other than their normal compensation for the time worked.

1.8.3.6. When the Federal, State, Local or other Governmental entity grants excused absence to its employees, assigned Contractor personnel may also be dismissed. The Contractor agrees to continue to provide sufficient personnel to perform critical tasks already in operation or scheduled, and must be guided by the instructions issued by the KO or COR.

1.8.3.7. If Government personnel are unavailable due to furlough or any other reason, the Contractor must contact the KO or the COR to receive direction. It is the Government's decision as to whether the contract price/cost will be affected. Generally, the following situations apply:

1.8.3.7.1. Contractor personnel who are able to continue contract performance (either on-site or at a site other than their normal workstation), must continue to work and the contract price shall not be reduced or increased.

1.8.3.7.2. Contractor personnel who are not able to continue contract performance (e.g., support functions) may be asked to cease their work effort. This may result in a reduction to the contract.

1.8.4. Place of Performance: The work to be performed under this contract will be performed at the Contractor facility.

1.8.5. Type of Contract: The Government contemplates multiple-award Firm-Fixed-Price BPAs.

1.8.6. Security Requirements: All personnel performing under this agreement or subsequent orders that will come in contract with, or have access to personally identifiable information (PII), must be U.S. Persons and have record of a U.S. Citizenship verification. There is not required level of investigation, but rather U.S. Citizenship verification. Any changes to the eligibility/clearance requirement or investigation requirement will be detailed in the orders. All PII must be handled in accordance with the Privacy Act of 1974.

1.8.7. Security Requirements: General network information as it pertains to the contract. The vendor shall:

• Be able to process Controlled Unclassified Information (CUI) ,

• Provide Cyber Security submissions and general network information to the COR within

30 days after award,

• Points of Contacts for company and access to associated FedRAMP package shall be provided,

• Vendor will need to follow DoD IL4 Provisional Authorization Requirements

1.8.8. Physical Security: The Contractor shall be responsible for safeguarding all Government equipment, information and property provided for Contractor use.

1.8.9. Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR subpart 42.5.

The KO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. It is anticipated that periodic progress meetings will be held quarterly, at either the BPA or task order level. At these meetings, the KO will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.8.10. Contracting Officer’s Representative: The COR will be identified by a separate, appointment letter. The COR monitors all technical aspects of the BPA and assists in administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the KO and Contractor of any deficiencies; coordinate availability of Government furnished information, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.8.11. Personnel: The Contractor shall provide a Program Manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the Contractor when the manager is absent shall be designated in writing to the KO. The Program Manager or alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 8:00 a.m. to 4:30p.m., Monday thru Friday except Federal holidays or when the Government facility is closed for administrative reasons.

1.8.12. Contract Manpower Report: The Contractor shall report all contract labor hours/services (including subcontractor labor hours/services) required for performance of services provided under any task order issued from this BPA annually, by October 31, at www.sam.gov, on the services performed under any task order, including any subcontracts, during the executed PoP for the preceding Government fiscal year (October 1–September 30) in accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7023. Contractors may direct questions to the help desk for the reporting site.

1.8.13. Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR subpart

9.5. The Contractor shall notify the KO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the KO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the KO and in the event the KO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.8.14 Training

1.8.14.1 In accordance with DoD Instruction 5200.48 (DoDI 5200.48) dated March 6, 2020, Contractors are required to ensure all personnel receive and complete Initial and Annual Refresher CUI education and training and maintain documentation of this training for audit purposes. Initial and Annual Refresher CUI security education, training and awareness on the required topics identified in Section 2002:30 of Title 32 CFR, including protection and management of CUI, to http://www.sam.gov/

DoD personnel and contractors through the Center for Development of Security Excellence

(CDSE).

CUI Courses and Resources Created for Industry:

• The Center for Development of Security Excellence (CDSE) has developed an eLearning course titled “DoD Controlled Unclassified Information (CUI) Training For Contractors (IF141.06.FY21.CTR). The course fulfills CUI training requirements for industry.

• Additionally, CDSE has a CUI Toolkit available at https://www.cdse.edu/toolkits/cui/current.html. The Toolkit includes training, policy documents, resources, and an FAQ video.

• Review the DoD CUI Registry at https://www.dodcui.mil to become familiar with CUI organizational index groupings and CUI categories.

1.8.14.2 Training Requirements: Contractor personnel performing under this contract shall complete all applicable Government training. Training shall be completed and reported to the COR within 30 calendar days of award and annual refresher training for the remaining contract duration. The Contractor shall submit certificates of completion for each affected Contractor employee and subcontractor employee, to the COR. This training shall be completed and reported to the COR within thirty (30) calendar days of award and annual refresher training for the remaining contract duration.

The following training is required:

• Operations Security (OPSEC) Awareness Training: All Contractor personnel are required to take initial OPSEC Awareness training, in accordance with DoD M 5205.02-M within 30 calendar days of the start of the period of performance an annual thereafter.

• DoD Mandatory Controlled Unclassified Information (CUI) Training for Contractors:

Contractor personnel with access to controlled unclassified information shall complete this training within 30 calendar days of the start of the PoP and annually thereafter in accordance with DoDI 5200.48, Controlled Unclassified Information (CUI) dated 06 Mar 2020.

• Counterintelligence Awareness: Required by all personnel supporting DCSA.

• DCSA Annual Security Awareness: Required by all personnel supporting DCSA.

Part 2 Definitions and Acronyms

2. Definitions and Acronyms:

2.1. Definitions:

2.1.1. Contractor. An offeror, supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.2. Contracting Officer. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

2.1.3. Contracting Officer’s Representative. An employee of the U.S. Government appointed by the Contracting Officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4. Defective Service. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.5. Deliverable. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.6. Physical Security. Actions that prevent the loss or damage of Government property.

2.1.7. Quality Assurance. The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.8. Quality Assurance Surveillance Plan. An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

2.1.9. Quality Control. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.10. Subcontractor. One that enters into a contract with a prime Contractor. The Government does not have privity of contract with the Subcontractor.

2.1.11. Work Day. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.12. Work Week. Monday through Friday, unless specified otherwise.

2.2. Acronyms:

CFR Code of Federal Regulations COR Contracting Officer Representative CS Contract Specialist CUI Controlled Unclassified Information DCSA Defense Counterintelligence and Security Agency DFARS Defense Federal Acquisition Regulation Supplement DOD Department of Defense FAR Federal Acquisition Regulation FedRAMP Federal Risk and Authorization Management Program KO Contracting Officer OCI Organizational Conflict of Interest OPSEC Operational Security PII Personally Identifiable Information POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program TE Technical Exhibit

Part 3 Government Furnished Information and Services

3.1. The Government will provide information through the 24 hours available system in order to satisfy the terms of the BPA. There will be no Government furnished property issued at neither the BPA or task order level.

3.2. Upon award, the Government will provide awardees with various support in order to obtain connection to DCSA systems.

Part 4 Contractor Furnished Items and Services

4. Contractor Furnished Items and Responsibilities:

4.1. General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this requirement.

4.2. As outlined in PWS 1.6.7.1, the offeror must be able to process Controlled Unclassified Information (CUI) in compliance with (or in accordance with) DoDI 8510.01.

4.3. Contractor personnel are required to be US Persons and have record of a U.S. Citizenship verification. There is no required level of investigation, but rather U.S. Citizenship verification.

Any changes to the eligibility/clearance requirement or investigation requirement will be detailed in the orders. All PII must be handled in accordance with the Privacy Act of 1974.

Part 5 Specific Tasks

5. Specific Tasks:

The Contractor shall provide support services to execute the following tasks at the task order level:

5.1 Task One: Single and Tri-Merge Reports

• The contractor will deliver Single and Tri-Merge reports to the Government,

• Information will be reliable and include a timely delivery of credit information from

TransUnion, Experian, and Equifax, o Vendor will confirm that each tri-merge report includes information from all three bureaus.

• The timelines for queries are as follows:

XML Webservice or Application Programming Interface (API) connections

Deliver single and tri-merge reports within 6 hours of initial query.

Batch or Connect Direct Exchanges Deliver single and tri-merge reports within 24 hours of initial query.

Online/Web Interface Queries Deliver responses immediately

• Provided information will include:

o Tradeline information, o Collection information, o Public Records relating to civil judgments, tax liens, bankruptcies, o Subject income, o Consumer identification to include names, AKAs, current and prior addresses, and date of birth, o Credit history identifying creditors, debt payment(s) performance, current and past due charge off, collection and collection factored accounts, balances and past due amounts, and status of accounts for the past 24 months, o A listing of inquiries within the last 12 months, o Overall score based on DCSA specifics (tri-merge).

• The vendor will provide the following features as required within the vendor environment:

o XML or API format via web service, o Ability to accept batch files or 1-for-1 exchange of requests/results, o Single and Tri-Merge (3 in 1) credit report from the three major reporting bureaus, o Credit inquiries should be records as soft hits, o Be accessible over the internet using appropriate access control security features such as passwords, secure sockets layers, etc.

o Be accessible over the internet with no software requirement needed, such as to be loaded on individual computers, in order to access the reports, o System accessibility 24 hours a day, o Allow for the assignment of an unlimited quantity of account managers and user roles in the credit report access portal, o System request/review consumer credit reports for single bureau reports, ability to print report, o Alerts of suspicious activity and/or changes in credit file information and how quickly the alert is able to be made following the discovery, o Provide a manifest of responses provided, o Electronic method for obtaining missing tradeline addresses, o A test environment, to include test data to mirror production environment, o Ability to provide detailed invoices and quality control reports.

5.2 Task Two: Credit Monitoring

• The contractor will provide the following on behalf of the Government to the affected individual(s), if deemed necessary by the Government:

o Provide credit monitoring for a 12-month period beginning on the date the affected individual elects to partake in the service using an unexpired activation code, o Provide tri-merge (3-in-1) reports consisting of credit reports from the three major reporting bureaus, o Credit Score and/or Rating, o Alerts of suspicious activity and/or changes in credit file information, o Provide Identity Theft Insurance up to $1 million.

5.3 Task Three: Deliverables/Reports

• The contractor will provide a written monthly status report to the KO, CS, and COR following completion of prior month;

o Must be provided within 5 business days of prior month ending, o The monthly status report shall summarize the work ordered and work performed;

To include summary of the number of credit reports provided, itemized list of reports provided with sufficient detail to validate invoices, itemized list of credit monitoring subscriptions to allow for proper invoice approval.

To include performance issues.

Monthly status reports shall be submitted in conjunction with monthly invoices.

• The monthly status report shall include quality control information;

total number of queried items, number provided, number provided with errors, and other information as requested by the COR, KO, or

CS.

5.4 Connection

• The contractor must establish and then maintain connection to DCSA systems.

Part 6 Applicable Publications

6.1. The Contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures. The services provided must meet the DoD guidelines and requirements for the security and protection of DoD information. Specifics will be expounded upon at the task order level.

Document Number Document Title Date of Document

32 CFR Part 117 National Industrial Security Program Operating Manual (NISPOM) 13 July 2021

DoDI 5200.48 Controlled Unclassified Information 06 March 2020

32 CFR 2002

National Archives and Records Administration, Controlled Unclassified Information

14 September 2016

DoDD 5400.07 DoD Freedom of Information Act (FOIA) Program 05 April 2019

DoDM 5400.07 DoD Freedom of Information Act (FOIA) Program 25 January 2017

DoDI 8500.01, DoDI 8510.01

Cybersecurity, Risk Management Framework for DoD Information Technology

07 October 2019

National Institute of Standards and Technology (NIST) Special Publication 800-171 Rev.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

28 January 2021

DoDD 5205.02E DoD Operations Security (OPSEC) Program 20 August 2020

DoDI 5230.09 Clearance of DoD Information for Public Release 25 January 2019

DoDI 5230.29 Security and Policy Review of DoD Information for Public Release 14 April 2017

DoDI 5400.04 Provision of Information to Congress 17 March 2009

DoDI 8170.01 Online Information Management and Electronic Messaging 24 August 2021

CJCSI 6510.01D Information Assurance (IA) and Computer Network Defense (CND) 15 June 2004

Part 7 Technical Exhibit Listing

7. Technical Exhibit List:

7.1. Technical Exhibit 1 – Performance Requirements Summary

7.2. Technical Exhibit 2 – Deliverables Schedule

7.3. Technical Exhibit 3 – Estimated Workload Data

Technical Exhibit 1: Performance Requirements Summary

The Contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

No. Performance

Objective

PWS

Reference Standard Performance

Threshold Method of Surveillance

1 Requests for single credit reports, tri-merge credit reports, and/or credit monitoring must be provided back to the Government, in the requested format.

5.1, 5.2 Results are to be provided IAW

PWS Sections 5.1, 5.2.

The system shall be available 24 hours a day 7 days a week.

Results are to be provided as described in the PWS 98% of the time.

100% inspection

3 Reports shall be operational, accessible and without system errors.

5.1, 5.2 Results must be readable, legible, error free, and timely.

Results are to meet the standard 98% of the time.

100% inspection

3 The contractor shall notify the COR of any unplanned outages which impact system availability.

1.8.3.2 The contractor will

notify the COR in writing and via phone within 2 hours of unplanned system outage.

0 instances of system outage without COR notification

As reported by COR

Technical Exhibit 2: Deliverables Schedule

No. Deliverable PWS

Ref Frequency Medium/ Format Submit To

1 Quality Control Plan 1.8.1 60 days following award PDF or WORD KO, CS, COR

2 Monthly Status Report

5.3 Monthly (no longer than 5

business days following prior month)

PDF or WORD KO, CS, COR

Technical Exhibit 3: Estimated Workload Data

Requirement Annual Estimate Single Credit Reports 4,137,631

Tri-Merge Credit Reports 665,600

Credit Monitoring 375

Technical Exhibit 1: Performance Requirements Summary