Attachement 1_Draft Unisys Migration_PWS_v1.docx

DRAFT

PERFORMANCE WORK STATEMENT

Defense Finance and Accounting Service (DFAS) 4 System Unisys Migration.

(GAFS-BL, CPAIS, HQARS, UPVM)

1. General:

This requirement is established in order to “lift and shift” four systems from a Unisys OS2200 mainframe platform running COBOL 74 to an alternate Linux platform hosted in the DISA Linux Virtual or Linux On Premise environment running COBOL 74. The requirement includes data migration to a relational database for each of the four systems.

1.1. Background:

The Defense Finance and Accounting Services (DFAS) requires IT Professional Support to migrate four mainframe systems to a Linux platform hosted in the DISA Linux Virtual or Linux On Premise environment.

1.2. Systems to Migrate:

1.2.1. GAFS-BL (General Accounting & Finance System Base Level) The General Accounting & Finance System Base Level (GAFS-BL) accumulates the most accurate financial summary of an organization’s yearly authorization, budget, and expenditures to date for the Air Force. GAFS - BL is the final accumulator of all financial transactions from all subsidiary systems. Records maintained by GAFS-BL include funding authority, commitments, direct and reimbursable obligations, and balance of available, expired, and closed funds. System input is performed through on-line entry or through batch process during periodic systems interfaces with subsidiary systems.

· 28 Interface Partners

· Processes approximately152 monthly interface files

· Convert 879,354 Lines of COBOL 74 code for user (terminal) screens, batch programs, Executive Control Language, sub-programs and copy PROCs

· Create GUI front end

· Create ability for Online File Download/upload with printing capabilities

· Create ability to do/view User access provisioning and User system activity reports

· Migrate Data to a relational database

1.2.2. CPAIS (Civilian Pay Accounting Interface System)

The Civilian Pay Accounting Interface System (CPAIS), DSD H002L/E4, in conjunction with the Civilian Pay Accounting Bridge (CPAB), is the standard Air Force accounting interface with the Defense Civilian Pay System (DCPS). CPAIS receives, verifies, reports and transfers accounting information related to payrolls processed by DCPS. An accounting interface is maintained with the General Accounting and Finance System (GAFS) to transfer payroll charges. Civilian Manpower and funding reporting is accomplished by CPAIS. In addition, summary and detailed management reports are produced as needed.

· 28 Interface Partners

· Process approximately 152 monthly interface files

· Convert 36,313 Lines of COBOL 74 code for user (terminal) screens, batch programs, Executive Control Language, sub-programs and copy PROCs

· Create GUI front end

· Create ability for Online File Download/upload with printing capabilities

· Create ability to do/view User access provisioning and User system activity reports

· Migrate Data to a relational database

1.2.3. HQARS (Headquarters Accounting and Reporting System)

The Headquarters Accounting and Reporting System (HQARS) is a departmental level financial reporting system for receiving, validating, consolidating budget execution, and expenditure data submitted from field accounting offices. The accounting and reporting system is operated at DFAS-IN for the generation of departmental level monthly financial reports to the U.S. Treasury, OSD, OMB, Army, Defense Agencies, and other customers as well as preparation of quarterly and annual financial statements.

· 16 Interface Partners

· Processes approximately 150 monthly files

· Convert 771,000 Lines of COBOL 74 code for user (terminal) screens, batch programs, Executive Control Language, sub-programs and copy PROCs

· Create GUI front end

· Create ability for Online File Download/upload with printing capabilities

· Create ability to do/view User access provisioning and User system activity reports

· Migrate Data to a relational database

1.2.4. EUD (Elimination of Unmatched Disbursements) UPVM (Unisys Pre-validation Module) The Elimination of Unmatched Disbursements (EUD) Unisys Pre-validation Module (UPVM) system is an interface between the accounting system and PPVM. To eliminate unmatched disbursements, communication must be established between the pay and accounting systems. 1 Interface Partner

· Processes approximately 3 daily files

· Create ability for Online File Download/upload with printing capabilities

· Create ability to do/view User access provisioning and User system activity reports through GAFS-BL

· Migrate Data to a relational database

1.3. Objectives:

The objective is to migrate four systems from a Unisys mainframe platform running COBOL 74 to an alternate Linux platform in the DISA Linux Virtual or Linux On Premise environment. The targeted application software or solution needs to include a sustainable programming language. The migration solution will include the introduction of a relational database. Additionally, the solution needs to be able to handle high side and low side transactions. The purpose behind this migration is to migrate systems to an interim sustainable platform while the functionality is being built out in target long-term solutions.

Vendors must design a comprehensive strategy to create and deploy GAFS-BL, CPAIS, HQARS, & UPVM in an alternative operating environment. Recommendations should utilize a lift and shift approach in revisioning to a Linux platform hosted in the DISA Linux Virtual or Linux On Premise environment. All recommended strategies must address the total environment structure including, but not limited to, hardware, infrastructure, platforms, software, and security.

DFAS is open to considering any reasonable designs, however, there are certain technical aspects that have been pre-determined:

a. Data Migration: The goal of DFAS is to utilize the current Unisys code base, COBOL, in order to continue auditability, compliance, and accuracy. The current DFAS code base for this migration effort is estimated at 1.65 million lines of COBOL code between the four systems. COBOL is the desired code base to utilize on the Linux platform. Final code base should be easily integrated with other code bases in the same language.

b. Database Structure: The goal is to leverage an efficient design that best utilizes a high performance scalable RDMBS for each system that aligns with DFAS Enterprise Architecture. The target databases will also need to comply with and accommodate NARA requirements and will need to retrieve archival data for retroactive processing.

c. Data Cleansing and Conversion: The goal is to cleanse, convert when necessary, and migrate all necessary system and account data, current and historical, from the legacy systems into the new data structure. Data in the DEV and TEST environments shall be refreshed at an agreed upon frequency.

d. Security: All software, commercial and developed, must fully comply with all applicable DoD and DFAS Cyber Security requirements and guidelines, including Zero Trust, and Security Technical Implementation Guide (STIG), NIST, STIGs, SSAE18, DoD FMR. Any and all tools, platforms, and software libraries must be current, with patches, versioning, and under vendor support. Software must also comply with Supply Chain requirements and clearly identify company and country of origin. In addition, all products, commercial and custom, must be analyzed for vulnerabilities using code analysis tools such as FORTIFY or ACAS. Vulnerabilities found in testing or code scanning to be tracked in a Vulnerability tracker and noted on a POAM (Plan of Action and Milestones) or risk tracker.

e. System Integrator: The desire of the DFAS is to work with a vendor that has experience leading large modernization efforts that involve many different technical aspects that will need to be brought together for an efficient and stable modern system.

1.4. Scope:

The contractor will provide all necessary personnel, management, administrative, and technical services to meet the requirements outlined in this PWS. In carrying out such efforts, the contractor will complete the following items:

· Assess the current application architecture of GAFS-BL, CPAIS, HQARS, & UPVM and present a recommended architectural approach to deploy GAFS-BL, CPAIS, HQARS, & UPVM in a Linux platform hosted in the DISA Linux Virtual or Linux On Premise environment. The contractor shall provide details of the solution architecture within the government furnished target architecture. The reference architecture must show: the underlying environment, application layer, integration layer, data layer, presentation layer, and how they interface.

· Contractor to provide prototype example screens for proof of concept, and present for mutual agreement.

· Contractor to present a reasonable schedule for remediation of the complete GAFS-BL, CPAIS, HQARS, & UPVM application code base to be used in progress measurement through the completion of the Period of Performance (POP).

· A recommendation for revision or re-architecture of the GAFS-BL, CPAIS, HQARS, & UPVM application code must address all aspects of the network environment, including but not limited to, hardware, software, communications, and access.

· The contractor shall ensure that GAFS-BL, CPAIS, HQARS, & UPVM remain in a steady state of audit readiness during development, testing, validation, and controls by submitting required artifacts showing evidence of technical design, unit test results, technical peer reviews, full documentation for STIGS, RMF controls, FISCAM controls, FFMIA compliance and final handoffs to user acceptance testing.

· The requirements do not include any code changes driven by user enhancement features; the code base AFTER conversion should operate functionally as it did before code conversion.

· Vendor to present a training plan acceptable to Government management to ensure Government technical personnel have sufficient understanding to support the re-architected or revised GAFS-BL, CPAIS, HQARS, & UPVM systems by the time the contract has been completed. May include options for extended support.

· Vendor to supply lessons learned from past performance, to include references to COBOL, line of code and complex interconnected systems.

· Per the accepted training plan, the contractor shall provide a reasonably sufficient level of documentation and training such that DFAS personnel can maintain these solutions once the contract has been completed (enhanced sustainment)

· Revise/re-architect/replace GAFS-BL, CPAIS, HQARS, & UPVM application code to the agreed-upon modern, secure, and supported solution that is sustainable and consistent across the entire code base. Ability for government to sustain modernized system after implementation.

· The Contractors recommendation must be compliant with Risk Management Framework (RMF), FISCAM, FFMIA, NIST, ICAM, 508 Compliance and STIGS.

· Each phase of contract activity can only begin after specific approval to proceed is given by Government.

· Provide a detailed schedule for the migration activities, including key milestones, dependencies, and deadlines. Break the timeline down into phases to capture all activities required across 4 systems.

1.5. General Information:

1.5.1. Quality Control (QC): The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which it assures itself that the work complies with the requirement of the PWS. The contractor shall deliver its proposed quality control plan with their quote. When changes are made, the contractor shall submit a revised plan within five (5) working days thereafter. After acceptance of the quality control plan, the contractor shall receive the contracting officer’s (CO’s) acceptance in writing of any proposed change to the QC system.

1.5.2. Quality Assurance Plan: The Government shall evaluate the contractor’s performance under each Call Order in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance and the minimum acceptable level of support.

1.5.3. Place of Performance: The work to be performed under this PWS will be performed remotely and occasional Onsite Collaboration meetings as needed at the following DFAS site: Comment by Schoeck, Kristin CIV DFAS ZEC (USA): TBD?

DFAS Indianapolis 8899 E. 56th St.

Indianapolis, IN 46249

1.5.4. Interaction with Contractor Personnel: The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

The prime contractor official representative shall coordinate a training schedule with the COR that does not cause undue delays to Task Order (T.O.) performance.

The prime contractor official representative (including subcontractor’s personnel, when applicable) shall provide the COR, within 30 days after T.O. award/exercise of an option, a written report identifying:

(1) Contractor employees required to take the training

(2) Contractor employees who completed the training

(3) Contractor employees who are delinquent

Contractor personnel shall direct their questions or concerns to their contractor management chain and/or company representative.

1.

1.1.

1.2.

1.3.

1.4.

1.5.

1.5.1.

1.5.2.

1.5.3.

1.5.4.

1.5.5. Recognized Holidays:

Juneteenth Independence Day

1.5.6. Hours of Operation: The contractor shall conduct business between the hours of 6:00AM and 6:00PM, Monday thru Friday except the Federal holidays listed in 1.5.5 or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for any of the above reasons.

1.5.7. Extended/Emergency Hours: When mission needs dictate, at the request of or upon coordination with the COR, Contracting Officer Technical Representative (COTR), the contractor staff shall be available outside facility duty hours (i.e. will work nights and weekends) to support the types of work described within the PWS.

1.5.8. Remote Location: The contractor may be authorized to work from a remote location when it’s advantageous to the DFAS mission. This must be coordinated and approved by the COR and CO. NOTE: Work involving classified information will not take place at the contractor facility.

1.5.9. Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the Government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.5.10. Contracting Officer Representative (COR): The COR is the primary point of contact for the contractor. The COR shall interface with DFAS Information and Technology (IT) Point Of Contact (POC) as well as the appropriate DFAS Site Force Protection Office POC to maintain internal monthly system updating to DoD compliance. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection ePortal Page.

https://eportal.dfas.mil/portal/server.pt/community/force_protection/656

Follow the link titled “Site Specific Force Protection/Security Services” in the Additional Points of Contact section near the top right side of the Web page.

The COR is responsible for monitoring all technical aspects of the award and assisting in contract administration. COR duties include:

· Ensure contractor performs the technical requirements of the award.

· Perform inspections necessary in connection with contract performance.

· Maintain written and oral communications with the contractor concerning technical aspects of the award.

· Monitor contractor’s performance and notifies both the CO and contractor of any deficiencies.

· Coordinate availability of Government furnished property and site entry of contractor personnel.

A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.5.11. Type of Contract: The award will be a combination of Firm-Fixed-Price (FFP)

1.5.12. Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contract personnel will be issued Government Common Access Cards (CACs) identifying them as a contractor after favorable security adjudication. Contractor employees must wear CAC’s while in the facility.

1.5.13. Travel Policy: The Government will reimburse the contractor for allowable travel cost incurred by the contractor in performance of the contract in accordance with FAR 31.205-46. Overhead, profit and Other Direct Costs are not an allowable travel cost for this requirement. The contractor will only be reimbursed for allowable direct labor costs.

Travel must be approved by the COR prior to any travel being made. When travel is required, the contractor is responsible for making all needed arrangements for their personnel. Actual travel costs will be reimbursed IAW FAR 31.205-46.

The contractor shall provide a trip report five (5) days after each trip associated with a travel approval. The contractor shall maintain a summary of all approved travel, to include at a minimum, the name of the traveler, location of travel, duration of trip, total cost of trip. The contractor shall confirm travel requests in writing and shall provide the COR with names of travelers, expected duration of travel, travel locations, cost estimates and labor effort associated with the travel prior to travel period. No travel is expected outside the continental United States (OCONUS).

Travel, subsistence, and associated labor charges for travel time are authorized for travel beyond a 50-mile radius of the local office, whenever a task assignment requires work to be accomplished at a temporary alternate work site. No travel, subsistence, or associated labor charges for travel time shall be charged for work performed within a 50-mile radius of the Contractor’s local office, normal work site, or temporary work site unless approved in advance by the COR. Under no circumstances will costs be reimbursed for travel performed for personal convenience and daily travel to and from the normal work site, to include parking expenses. A CLIN will be used for contractor travel reimbursement.

1.5.14. Data Rights: This requirement is covered by the data rights clauses included in the contract. In the event Data or Application Code is required that was developed exclusively at private expense of the contractor DFARS Clause 252.227-7015 is applicable. In the event Data or Application Code is developed during performance of this requirement using government funds DFARS Clauses 252.227-7013, 252.227-7016, 252.227-7017, 252-227-7030, and 252-227-7037 is applicable.

1.5.15. Weekly Status Reports: The prime contractor official representative shall submit a weekly status update to the COR, identifying the initial and annual SPIRIT training status of all contractor personnel. This report can be integrated with the regularly scheduled weekly Status Reports and made available to the COR as a deliverable item on the contract.

1.5.16. Section 508 Compliance:

· Requirements for accessibility based on Section #508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) are determined NOT to be relevant for the following program need: “NAF Configuration Management Server Migration.”

· Requirements for accessibility based on Section #508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) do not apply based on the claim of the following exception founded in Federal Acquisition Regulation (FAR) 39.204:

· Section 508 back-office exception based on CFR D1194.3 (f) “Products located in spaces frequented only by service personnel for maintenance, repair, or occasional monitoring of equipment are not required to comply with this part.” Justification for this claim is documented by the following: “NAF server and host applications reside on server hardware located in a controlled access data center. End-users have no direct access to NAF server hardware in DFAS data centers.”

1.5.17. Alternate Worksite Authorization: The Contractor may be authorized to work at an alternate worksite under the subject task order, on a case-by-case basis, only with prior authorization from either the COR or CO. Each alternate worksite effort will be for a definitive period of time as agreed upon by both parties.

1.5.18. Telework – Request, Monitoring Plan and Other Requirements:

The Defense Finance and Accounting Service (DFAS) requires contractors to maintain adequate

contractor does not have telecommuting written policies and procedures, or if such procedures are

Regarding the above, items recommended to be addressed are:

1. Has proper advance approval by appropriate management officials been provided for the employee(s)?

2. How is evaluation of the participating employee’s performance in completing assigned tasks addressed? Is there a standard of onsite performance that must be maintained to be eligible?

3. Is written documentation of the specific tasks to be performed, along with expected completion dates, part of the program/plan?

4. Is there a requirement that employees attend periodic meetings at the work site to allow the employee and supervisor to discuss work progress, be assign new tasks and to evaluate work performed?

5. Is there a requirement that employee’s work a mutually agreeable set of core hours to allow management to have access to the employee at designated times?

The contractor should provide within any request for teleworking the following details:

1. Positions for telework

2. Location of telework

3. Justification, which should include benefits achieved in support of this contract and cost reduction resulting from telework

4. Repercussion of not receiving telework approval

5. Financial benefits to the Government for allowance of telework

6. A plan for monitoring telework

Note: The government may not consider allowing telework for every contract. The government may deem having employees working at home to not be practical, efficient or effective if the work:

Regarding timekeeping, telecommuting employees should be required to submit timecards (either hard copy or electronic) in accordance with the company-wide timekeeping system guidance, and processes. Copies of the timecards should be kept at the company facility and are subject to Government audit. If an auditor finds inadequacies during an audit, the contractor may be cited for a labor accounting system deficiency and telework authorization may be rescinded.

1.5.19. Government Furnished Property:

Government Furnished Property, Equipment, or Information (GFP, GFE, and GFI): All facilities and services (i.e. computer products-PCs, printers, telephones, software and Government provided developmental platforms) will be furnished by DFAS for use within the DFAS Center. The DFAS site location will furnish office space, desks, chairs, and supplies for Contractor personnel working on this task order. The office space, supplies and equipment will be of the type ordinarily found at the DFAS site. The furnishings will be of the type used by personnel at in the DFAS site.

All computer software required to complete the tasks will be made available to the Contractor. Desktop Management Initiative (DMI) is the DFAS Standard for software/hardware. All computers connected at DFAS sites must be configured under DMI. Vendor’s employees will be provided standard issue DMI laptOperations. For Contractor personnel working at alternate locations agreed upon by DFAS and the Contractor, logon ID’s will be provided to access to the required platforms. The Contractor shall provide the access network connection via the Pulse Secure for any personnel not working at the physical DFAS site.

Government Furnished Property is subject to the following clauses which have been included in this RFQ by full text.

The awardee of this contract must have an acceptable Property Management System, per DFARS 252.245-7003 and 52.245-1(f) in place in order to be able to receive GFP. The Contractor will provide sufficient information as part of their offer in order for the CO to determine the Contractor’s Property Management System is acceptable. Reporting requirements are defined in the provisions/clauses above.

GFP on this contract will be in the form of DFAS formatted laptOperations in which the contractor will need to remove the laptOperations from a Government Controlled Facility in order to perform the tasks that are required on the contract at an alternate location.

Receipt and return of GFP will be created and tracked through the GFP Tool.

1.6. Security Requirements:

General Requirements. Contractor personnel must meet the following conditions of employment.

1. Must be a U.S Citizen or National

2. Registered for Selective Service (males born after 12-31-1959). A Status Information Letter is required for any male born after 12-31-1959 that is not registered with Selective Service.

3. This is a national security position which requires a favorable fitness review and background investigation as a condition of employment. Failure to maintain security eligibility may result in termination.

Personnel Security Investigation (PSI) Requirements. Contractor personnel working on this contract will require a favorably adjudicated Tier 3, or equivalent Noncritical Sensitive (formerly IT-II) level or higher investigation. No access to classified information is required. IAW standard DFAS Personnel Security policy, ALL incoming contractors must submit a new set of fingerprints (taken within the last 30 days)*. A Declaration for Federal Employment (OF-306) should then be submitted to the Contracting Officer Representative (COR), who will submit this form along with a Contractor Request for Investigation (CRI) (DFAS Form 9035) to DFAS Personnel Security as soon as possible, but not less than fifteen (15) calendar days prior to the intended start date. DFAS Personnel Security will review all submitted documentation to validate whether contractor personnel meet personnel security requirements to perform work on the contract or if a new background investigation is required.

*New fingerprints are not required if any of the following apply:

1. The person has been fingerprinted for the Defense Counterintelligence and Security Agency (DCSA) within the past 30 days.

2. The person is currently undergoing a background investigation, or reinvestigation, by DCSA or any other Federal agency.

3. The person has a background investigation currently being adjudicated by the DCSA Adjudication and Vetting Services (DCSA AVS) or another AVS.

4. The person has been favorably adjudicated within the past 30 days by the DCSA AVS or a AVS from any other Federal agency: or

5. The person is coming directly from another DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

6. The DFAS Personnel Security Office otherwise determines that no new fingerprints are required.

Regulatory Requirements. Contractor personnel shall follow the security and training requirements in DFAS 2000.1-I, “Force Protection Mission,” DoDM 5200.01, Volumes 1-3, “DoD Information Security Program,” DoDI, 5200.48, “Controlled Unclassified Information,” DFAS 5200.1-I, “Information Security Program,” DFAS 5200.8-I, “Physical Security Program,” and DFAS 5200.10-I, “Counter Insider Threat Program.” Contractor personnel shall follow all host security requirements in accordance with Part 117 of Title 32, Code of Federal Regulations; paragraph 117.16. The contractor shall immediately report any occurrences of violation of stated regulations to the Contracting Officer (CO), COR, and the DFAS Personnel Security Office.

DFAS Personnel Security Incident Reporting Requirements, the National Industrial Security Program and Due Process as it Relates to DFAS Contractor Personnel. The National Industrial Security Program (NISP) is a partnership between the federal government and private industry to safeguard classified information and CUI.

Executive Order 12829, as amended, "National Industrial Security Program", further amended by Section 6 of E.O. 13691, was established to achieve cost savings and to ensure that industry safeguards the classified information with which it is entrusted while performing work on contracts, programs, bids, or research and development efforts while working for United States Government.

It is important to note that personnel employed as contractors for DFAS are not covered under the National Industrial Security Program (NISP) and are exempt from the provisions of 5 C.F.R. 731. This means that DFAS contractor personnel involved in an incident that potentially violates one or more of the National Security Adjudicative Guidelines found at https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf , are not entitled to Due Process rights normally afforded to federal civilian employees and those personnel covered under NISP; more specifically, DFAS Personnel Security may suspend or revoke their access to DFAS IT systems, sensitive information and/or DFAS facilities.

Incident Reporting Requirements.

In all cases, whenever a DFAS contractor displays conduct, or is involved in any incident, which is in violation of any of the thirteen National Security Adjudicative Guidelines*, the contractor must immediately report the incident to the contractor company Security Office/Facility Security Officer, the DFAS Manager of the area to which they are assigned, the COR, and the DFAS Personnel Security Office. Reporting to DFAS Personnel Security may be made by phone to (317) 212-7888, by email to dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil, or, in the case of personnel physically located at DFAS Indianapolis Center, in person to the DFAS Personnel Security Office located on the third floor center hallway at Column 320T.

All incidents will be investigated by DFAS Personnel Security and, depending on the date of the subject’s most recent investigation, may need to have an updated background investigation initiated. Those that do not require a new investigation will have all relevant information regarding the incident forwarded to the DCSA AVS for review and re-adjudication.

*The thirteen National Security Adjudicative Guidelines are:

Some Examples of Incidents That Require Reporting to DFAS Personnel Security:

a) An arrest for any criminal offense, not including minor traffic violations, by any law enforcement agency. This DOES include the traffic offenses of Driving Under the Influence of Alcohol or Drugs, and Reckless Driving.

b) Violation of any court order.

c) Civil judgements.

d) Delinquencies on any debt for 180 days or longer.

e) Federal, State or Local tax issues or delinquencies.

f) Delinquencies on any Federal debt (including Federal Student Loans and Federally backed home mortgage loans).

g) Child Support delinquencies.

h) Filing for Chapter 7 or Chapter 13 bankruptcy in any Federal Bankruptcy Court.

i) Foreign Travel.

j) Marriage or Cohabitation with a Foreign National (person from a foreign country).

k) Having a close personal friendship with a Foreign National with regularly occurring contact.

l) Ownership of property or financial accounts in a foreign country; and

m) Being approached by a person know to be, or suspected to be, working as an agent of a foreign government or terrorist organization, or any other person, who seeks any information about DFAS, the Department of Defense, or the U.S. Government, especially if the person offers money or something of value to the contractor employee.

It should be noted that person’s delinquent on Federal debt of any kind may not obtain or maintain favorable personnel security adjudication or be considered for a contractor position with DFAS unless they can provide documentary proof that a payment plan has been established with the government agency to whom the debt is owed, and that regularly recurring payments are being made. Contractor personnel who cannot obtain and maintain a favorable personnel security adjudication may not have access to the government data, facility, and equipment required under the contract.

NOTE: This list does not cover every potential incident or offense; any incident in which a contractor is involved, and a question exists as to whether it should be reported, should report the incident to DFAS Personnel Security, who will then determine if further action is warranted. Failure to report an incident is, in and of itself, an incident involving personal conduct, and may, in some cases, be more serious than the original incident.

Foreign Travel by DFAS Contractor Personnel Official and Unofficial (Personal) Travel: Official U.S. Government Business: persons employed as contractor employees with DFAS, to include those with Noncritical Sensitive (formerly IT-II) access, Critical Sensitive (formerly IT-I) access, access to critical program information (related to Research, Development, Test, and Evaluation), sensitive compartmented information, and/or special access program information, in accordance with DoD Directive 5240.06, are required to complete a DFAS Form 9133, Notification of Foreign Travel, not less than 30 calendar days prior to the scheduled travel.

One copy shall be sent the DFAS Personnel Security group box at dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil and one copy shall be turned into the Site Force Protection Office of the DFAS site where they are stationed. Site Force Protection POC information: https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx Upon receipt of the completed Form 9133, the Site Force Protection Office will contact the contractor employee to validate training, complete the country/theater clearance package, as required, and schedule a Foreign Travel briefing. Immediately prior to travel, contractor employees will check with the State Department at https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html.html for any travel advisories for the country or region being traveled to and take the appropriate steps to ensure their safety for any location covered by a travel advisory or warning.

Security Education and Training. Contractor personnel shall receive initial, continuous and refresher security education training in accordance with DFAS 2000.1-I, DoDM 5200.01, Volume 3, “DoD Information Security Program – Protection of Classified Information,” DoDI 5200.48, and DFAS 5200.1-I. Contractor personnel shall also complete all required contractor training requirements identified in this SOW/PWS.

Access To, Accountability For, and Safeguarding of Controlled Unclassified Information (CUI). The DFAS manager of the requiring office will determine what CUI contractor personnel are given access to. CUI may not be disclosed to contractor personnel unless required for contract performance. Contractor personnel shall safeguard CUI in accordance with DoDI 5200.48 and DFAS 5200.1-I. The sponsoring DFAS activity will provide storage capability for all CUI required for contract performance.

Installation Entry and Common Access Card (CAC) Requirements.

The Contractor shall comply with established security procedures for entering government installations and facilities. Contractor employees shall be required to obtain and wear identification (ID) badges that will permit access into the facility.

Contractors shall work with the assigned DFAS COR/Mission Partner Account Sponsor (MPAS) to obtain a CAC using Mission Partner Identity Credential Account Management (MP ICAM). Under no circumstances will a CAC be issued to any person unless that person has been cleared by the DFAS Personnel Security Office to work on the contract.

All CACs and badges issued to Contractor personnel are Government property and must be returned to the assigned DFAS COR/MPAS upon departure from the program or at the conclusion of the contract, whichever comes first. CACs can also be mailed in or turned into RAPIDS locations. Contractors whose CAC is lost or stolen must report the loss as soon as possible to the assigned DFAS COR/MPAS and present documentation that the CAC is missing and describing the circumstances under which the loss occurred. The assigned DFAS COR/MPAS will follow agency CAC procedures to issue a new CAC.

Contractors’ must not share their CACs and passwords with any other staff members. The assigned DFAS COR/MPAS will report any violation or suspected violation to the Contracting Officer and DFAS MP ICAM Account Security Manager (MPASM). Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from another agency, that CAC must be revoked and returned before issuance of a new CAC.

Training.

DoD Mandatory Contractor Personnel Training Requirements: The contractor shall direct that its employees performing under this contract complete the annual mandatory training in accordance with the DoD mandate identified for each training module.

Contractor personnel working at a DFAS site who require a Common Access Card (CAC), or contractor personnel working remote via VPN, need to complete the following training modules within 30 days after receipt of CAC, (note for Cyber Awareness Challenge Module 003, completion of this module is required prior to requesting a new DFAS network or VPN account), as a precondition for continued attendance and/or network access.

In addition, these modules shall be completed annually to retain accessibility. Noncompliance will negatively impact contract performance and lead to the loss of CAC and/or network access for contractor personnel.

Continuity of Operations and Crisis Management Organization. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

Cyber Awareness Challenge. Completion of this module is required prior to requesting a new DFAS network or VPN account. For contractor personnel unable to access the DFAS Portal, the same training is available at:

https://public.cyber.mil/training/cyber-awareness-challenge/

Upon completion of the training Contractor personnel shall maintain a copy of the training certificate in PDF, submit a copy to the COR, attached to the request for network access as proof of completion.

Keeping DFAS Safe: Physical Security, Information Security, Personnel Security, CBRNE, Counterintelligence and Operations Security. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Level I Antiterrorism Awareness Training. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf

All other contractor personnel shall take the training through the DFAS Portal upon receipt of network access.

Privacy Act (PA) and Personally Identifiable Information (PII). Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Records Management. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Insider Threat (InT) Awareness Training. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

DoD Mandatory Controlled Unclassified Information (CUI) Training. All contractor personnel shall take this CUI training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://securityawareness.usalearning.gov/cui/index.html

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

Unauthorized Disclosure of Classified Information and CUI. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

https://securityawareness.usalearning.gov/disclosure/index.html

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

NOTE: This list of training requirements is subject to change.

Training Time. The average estimated time for completion of each training module is approximately one hour or less. The Keeping DFAS Safe: Physical Security, Information Security, and Personnel Security training module will take approximately 90 minutes to complete.

Training Methods:

Network Training. Network training through the DFAS Portal is the required method for those Contractor personnel who have an existing DFAS network account.

Web-based Training. All contractor personnel are required to take the following web-based training: Cyber Awareness Challenge (When system/network access is required), Level I Antiterrorism Awareness Training, DoD Mandatory Controlled Unclassified Information Training, and Unauthorized Disclosure of Classified Information and CUI. If an individual does not have network access through the DFAS Portal, they can complete the training through a DoD authorized Web source. All other contractor personnel shall take the training through the DFAS Portal upon receipt of DFAS network access. The contractor personnel shall retain a PDF copy of the “Certificate of Completion” or a “screen shot” with the date of the completion of the training. The COR will maintain a file for proof of completion.

Contractor personnel who do not require network access but require unescorted access into a DFAS facility shall receive applicable security training through the site Force Protection Office. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection Portal Page:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx The prime contractor official representative shall provide the COR with a group list of its personnel requiring completion of the training. The COR will submit the ‘group list’ to the Site Force Protection Officer to schedule training. As a reminder, the prime contractor official representative shall submit this group list of names within 30 days after contract award. Requests for individual training shall be justified in writing and submitted to the COR for evaluation. Special arrangements will be determined by the Site Force Protection Officer, other training Module POCs and the COR.

Interaction with Contractor Personnel. The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

The prime contractor official representative shall coordinate with the COR a training schedule without causing undue delays to contract performance.

The prime contractor official representative (including subcontractor’s personnel when applicable) shall provide the COR, within 30 days after contract award/exercise of an option, a written report identifying:

Contractor personnel shall direct their training questions or concerns to their contractor management chain and/or company representative.

Monthly Training Status Reports. The prime contractor official representative shall submit a monthly status update to the COR, identifying the initial and annual training status of all contractor personnel.

Training Point of Contact (POC). The COR is the POC for the Contractor. The Contractor shall provide regular training updates to the COR and keep an updated registry to assure employees who come on board at any time in the contract life have completed all required training.

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1 DEFINITIONS:

2.1.1 CONTRACTOR. A supplier or contractor awarded a contract/T.O. to provide specific supplies or service to the Government. The term used in this T.O. refers to the prime unless otherwise stated.

2.1.2 CONTRACTING OFFICER (CO). A person with authority to enter into, administer, and /or terminate contracts/T.O., and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

2.1.3 CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the CO to administer the contract/T.O. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the contractor as long as that direction is within the scope of the contract/T.O., does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract/T.O.

2.1.4 DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.5 DELIVERABLE. Anything that can be physically delivered, may include non- manufactured things such as meeting minutes or reports.

2.1.6 PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.7 QUALITY ASSURANCE. The contractor’s methodology to ensure that the services performed are completed according to acceptable standards.

2.1.8 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance by the Government.

2.1.9 SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.2. ACRONYMS