ARARNG_FY27_Marketing_PWS_A10Format.docx

PERFORMANCE WORK STATEMENT (PWS)

FOR

Comprehensive Marketing Program Services

PERIOD OF PERFORMANCE:

One (1) Year from Effective Date of Contract

DATE OF ISSUANCE:

June 2026

1.0 General:

1.1 Scope: The contractor shall provide all personnel, equipment, tools, materials, supervision, and quality control necessary, except as specified in Paragraph 3.0 as Government Furnished, to perform Comprehensive Marketing Program Services as defined in this Performance Work Statement (PWS).

1.1.1 Objective: The objective of this PWS is to provide a comprehensive marketing package to the Arkansas Army National Guard (ARARNG) for recruitment and retention goals. The Contractor shall provide services to generate qualified recruitment leads, offer a customized lead capture and nurturing solution, and support the Recruiting and Retention Battalion (RRBN) leadership, recruiters, and marketing staff.

1.2 Background: The ARARNG Recruiting and Retention Battalion's (RRBN) mission is to promote the ARARNG to gain the interest and attention of prospective recruits. The ARARNG RRBN has a dual mission that is not well understood by the general public, which has difficulty distinguishing the National Guard from Active Duty. The primary target market is non-prior service (NPS) individuals 17–34 years of age. The ARARNG requires the services of a contractor with experience providing marketing solutions for the Army National Guard to develop and execute a comprehensive marketing program that includes branding, engagements, lead generation, and recruiter support to help the ARARNG achieve recruitment and retention goals.

1.3 Period of Performance (PoP): The Period of Performance shall be one (1) Base Year of 12 months from the effective date of the awarded contract.

1.4 General Information:

1.4.1 Place and Performance of Services: The contractor shall provide all work offsite. The contractor shall at all times maintain an adequate work force for the uninterrupted performance of all tasks defined within this PWS. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the work force are essential.

1.4.2 Protection of Personally Identifiable Information (PII): The contractor shall protect all PII encountered in the performance of services in accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 224.103, Personally Identifiable Information, and Department of Defense Directive (DoDD) 5400.11, Department of Defense Privacy Program, and DoD 5400.11-R. If a PII breach results from the contractor's violation of the aforementioned policies, the contractor shall bear all notification costs, call-center support costs, and credit monitoring service costs for all individuals whose PII has been compromised.

1.4.3 Recognized Holidays: The contractor shall not be required to perform services on the following recognized United States (US) holidays:

1.4.3.1 New Year's Day: January 1st

1.4.3.2 Martin Luther King, Jr.'s Birthday

1.4.3.3 Presidents' Day

1.4.3.4 Memorial Day

1.4.3.5 Juneteenth National Independence Day: June 19th

1.4.3.6 Independence Day: July 4th

1.4.3.7 Labor Day

1.4.3.8 Columbus Day

1.4.3.9 Veterans Day: November 11th

1.4.3.10 Thanksgiving Day

1.4.3.11 Christmas Day: December 25th

1.4.4 Quality Assurance (QA): The Government will evaluate the contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). The plan defines how performance standards will be applied, the frequency of surveillance, and Acceptable Quality Levels (AQLs). The QASP is primarily focused on ensuring that the contractor has performed in accordance with PWS performance standards.

1.4.5 Communications Security / Information Technology (COMSEC/IT) Security: All communications with DoD organizations are subject to COMSEC review. All telephone communications networks are subject to intercept by unfriendly intelligence organizations. DoD has authorized the military departments to conduct COMSEC monitoring and recording of telephone calls originating from or terminating at DoD organizations. The contractor is advised that any time contractor personnel place or receive a call they are subject to COMSEC procedures. The contractor shall ensure wide and frequent dissemination of this information to all employees dealing with DoD information. The contractor shall abide by all Government regulations concerning the authorized use of the Government's computer network.

1.4.6 Post Award Conference / Periodic Progress Meetings: The contractor agrees to attend any post-award conference convened by the Contracting Officer (KO) in accordance with FAR 42.5. The KO, Contracting Officer Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review performance. At these meetings, the KO will apprise the contractor of how the Government views contractor performance and the contractor shall apprise the Government of any problems being experienced. Contractor attendance at these meetings shall be at no additional cost to the Government.

1.4.7 Contract Manager (CM): The contractor shall designate a Contract Manager (CM) who shall be responsible for contractor performance under this contract. The name of this person, and an alternate who shall act for the contractor when the CM is absent, shall be designated in writing to the KO. The CM or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The CM shall work through the COR to resolve issues, receive technical instructions, and ensure adequate performance. The CM shall ensure that contractor employees do not perform any services outside the scope of the contract without an official modification issued by the KO.

1.4.8 Identification of Contractor Employees: All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as contractors to avoid creating an impression that they are Government employees. The contractor shall ensure that all documents or reports produced by contractor personnel are suitably marked as contractor products. The contractor's status as a 'contractor' shall be displayed prominently in all correspondence and dealings with Government or non-Government entities.

1.4.9 Combating Trafficking in Persons: The United States Government has adopted a zero-tolerance policy regarding trafficking in persons. Contractors and contractor employees shall not engage in severe forms of trafficking in persons during the period of performance of the contract; procure commercial sex acts during the period of performance of the contract; or use forced labor in the performance of the contract. The contractor shall notify its employees of the United States Government's zero-tolerance policy and the actions that will be taken against employees for violations of this policy. The contractor shall take appropriate action, up to and including termination, against employees or subcontractors that violate this policy as described at FAR 22.17.

1.4.10 Data Rights: The Government has unlimited rights to all documents and materials produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government-owned and are the property of the Government, with all rights and privileges of ownership and copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the KO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose.

1.4.11 Organizational Conflicts of Interest (OCI): Reserved.

2.0 Definitions and Acronyms:

2.1 Definitions:

2.1.1 Contractor: A supplier or vendor awarded a contract to provide specific supplies or services to the Government. The term used in this contract refers to the prime.

2.1.2 Contracting Officer (KO): A person with authority to enter into, administer, and/or terminate contracts, and make related determinations and findings on behalf of the Government. The only individual who can legally bind the Government.

2.1.3 Contracting Officer Representative (COR): An employee of the U.S. Government designated by the KO to monitor contractor performance. The COR has authority to provide technical direction to the contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. The COR does NOT have authority to change the terms and conditions of the contract.

2.1.4 Defective Service: A service output that does not meet the standard of performance associated with the PWS.

2.1.5 Deliverable: Anything that can be physically delivered, including non-manufactured items such as meeting minutes or reports.

2.1.6 Key Personnel: Contractor personnel evaluated in a source selection process that may be required to be used in the performance of a contract by the PWS.

2.1.7 Physical Security: Actions that prevent the loss or damage of Government property.

2.1.8 Quality Assurance: Government procedures to verify that services being performed by the contractor are performed according to acceptable standards.

2.1.9 Quality Control: All necessary measures taken by the contractor to ensure that the quality of an end product or service meets contract requirements.

2.1.10 Subcontractor: One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.2 Acronyms:

3.0 Government Furnished Property, Material, Equipment and Services (GFP/M/E/S):

The Government will only provide the materials listed below for performance under this contract. Access to relevant Arkansas Army National Guard data and information necessary for the contractor to perform the required services under this contract, including but not limited to production, FAZR, and RSID data. Administrative access is necessary for the contractor to perform the services in this contract, including but not limited to Google Business Profile, Facebook, Instagram, and other social media platforms as appropriate.

4.0 Contractor Furnished Property, Materials, and Equipment (CFP/M/E):

4.1 General: Except for those items specifically stated to be Government-Furnished in Paragraph 3.0, the contractor shall furnish everything required to perform these services as indicated in Paragraph 1.1 and throughout this PWS.

5.0 Requirements:

The contractor shall perform the following requirements:

5.1 Program Management:

The contractor shall assign a Program Manager to oversee all aspects of the program. The Program Manager shall serve as the primary point of contact for all day-to-day account activities, including status meetings, performance dashboard management, and monthly reporting. The Program Manager shall also be responsible for oversight and coordination of training, consulting, marketing strategy development, and the annual Return on Investment (ROI) analysis. The Program Manager or a designated alternate shall be available to the ARARNG RRBN during normal business hours throughout the period of performance.

5.2 Account Management and Strategic Support:

The contractor shall assign a Subject Matter Expert (SME) in military recruiting marketing as ARARNG's primary point of contact to provide ongoing strategic guidance and operational support.

5.2.1 The contractor shall facilitate bi-weekly status meetings via Microsoft Teams or another mutually agreed-upon platform.

5.2.2 The contractor shall support the development and refinement of marketing strategies and annual plans, assist with media planning and execution, coordinate the creation and delivery of training materials, provide point-of-view analyses, and review performance data to adjust strategies in alignment with evolving recruitment needs.

5.3 Campaign Management and Reporting:

The contractor shall manage the marketing program, coordinate marketing initiatives, and provide monthly reports on campaign progress and effectiveness.

5.3.1 The contractor shall provide a reporting dashboard with near real-time analytics for core program elements.

5.3.2 The contractor shall provide monthly reports that include relevant Key Performance Indicators (KPIs). These KPIs include, but are not limited to: social media post views, engagements, and view times; media buy views and engagements; business listing views, engagements, and reputation per directory listing; and breakdowns for business listings on a per-location basis. Monthly reports shall be provided no later than (NLT) the 7th calendar day of the following month.

5.3.3 The contractor shall conduct an annual Return on Investment (ROI) Analysis at the conclusion of the period of performance to evaluate the performance of all program elements and provide actionable recommendations to improve results. The ROI Analysis shall be provided within 30 calendar days after all media elements have been executed.

5.4 Training and Consulting:

The contractor shall provide training, ongoing consultation, and guidance to the ARARNG to optimize campaign effectiveness and provide insights on industry best practices and emerging trends.

5.4.1 The contractor shall provide up to two (2) multi-day in-person training and consulting sessions at the ARARNG headquarters for marketing and key RRBN personnel during the period of performance.

5.4.2 The contractor shall provide online training sessions for all program elements to ARARNG marketing staff and/or recruiters as needed throughout the period of performance, available to up to 50 personnel.

5.4.3 The contractor shall provide, at a minimum, a monthly one-hour online consulting session via Microsoft Teams or another Government-approved virtual meeting platform. Sessions shall occur no later than the 21st day of each month.

5.5 Marketing Strategy:

The contractor shall develop and implement a marketing strategy that incorporates market research, provides tools and training for recruiters, and employs targeted marketing for lead generation.

5.5.1 Marketing Execution Guide: The contractor shall develop a step-by-step marketing execution plan based on ARARNG mission priorities, market timing, and other relevant factors. The contractor shall assist with the development of the annual marketing plan using the National Guard Bureau (NGB)-approved template. The Marketing Execution Guide shall be provided within 45 calendar days of receiving all required information from the Government.

5.5.2 Media Plan: The contractor shall develop a fiscal year media plan in conjunction with the Marketing Execution Guide.

5.6 Recruiting Location Management and Search Engine Optimization (SEO):

The contractor shall optimize recruiting location listings, manage review responses, and execute digital outreach campaigns to support storefront recruiting locations. The ARARNG has approximately 44 total recruiting locations. Of those, 20 are designated as priority locations and shall receive full Recruiting Location Management (RLM) services as described below. The remaining 24 locations shall receive Lite RLM services.

5.6.1 Audit: The contractor shall audit current recruiting location listings and identify changes needed to improve local Search Engine Optimization (SEO). The audit report shall be provided within 45 calendar days of contract start.

5.6.2 Directory Listings: The contractor shall update the ARARNG's recruiting location listings for all 44 locations with the latest information, including phone numbers, email addresses, website URLs, and working hours. The contractor shall publish these listings to major online search directories, social media platforms, and navigation applications, including but not limited to Google, Facebook, Bing, Apple Maps, Waze, Foursquare, MapQuest, Uber, Lyft, and Yellow Pages.

5.6.3 Location Finder Page: The contractor shall provide a recruiter location finder web page that is connected to the directory listings to boost local SEO. Pages shall be published within 5 working days of directory listing publication.

5.6.4 Lite RLM (All 44 Locations): All 44 recruiting locations shall receive baseline listing management including directory accuracy maintenance and reputation monitoring.

5.6.5 Full RLM — Priority Locations (20 Locations): The following services shall be provided exclusively for the 20 designated priority recruiting locations:

a. Local SEO Management: The contractor shall provide search engine business profile posts, keyword optimization, and FAQs for each priority location.

b. Reputation Management: The contractor shall provide review monitoring, automated review responses, real-time notifications of new reviews, and access and training for ARARNG RRBN staff to respond to reviews. Non-templated responses requiring specific recruiting information shall be forwarded to the RRBN for input. Automated responses shall be deployed immediately upon review submission. The contractor shall also provide physical review signage for placement at each priority recruiting location. Signage shall include gating functionality via QR code or personalized URL that directs satisfied users to public review platforms (e.g., Google, Facebook) and directs unsatisfied users to a private feedback form for internal resolution. Reports on reputation metrics shall be provided monthly.

c. Email and SMS Review Campaigns: The contractor shall execute email and SMS campaigns for each priority location to solicit new reviews from individuals who have recently visited the storefronts, including follow-up messages directing them to relevant online directories. The contractor shall provide up to 100 emails and 50 SMS messages per location, per month.

5.7 Call Tracking and Analytics:

The contractor shall provide a robust, cloud-based call tracking and analytics system for all 44 ARARNG recruiting locations. The system shall assign unique call tracking numbers (including spoof/forwarding numbers) to each recruiting location, enabling attribution of inbound call activity to specific marketing channels and locations.

5.7.1 The contractor shall provide comprehensive tools to manage, route, and analyze inbound call activity to support communication effectiveness and recruitment performance monitoring.

5.7.2 Advanced Call Routing: The system shall include advanced call routing capabilities that allow inbound calls to be forwarded to multiple phone numbers, either simultaneously or in sequence, based on customizable routing logic. Routing logic shall support configuration by time-of-day, business hours, and agent or office availability. Conditional call flows and voicemail fallback must be supported for all managed locations.

5.7.3 Automated SMS Response: The system shall support automated text message responses triggered by missed calls or specified inbound call events. Automated SMS responses shall be configurable on a per-location basis and shall allow custom message content aligned with ARARNG recruiting communication standards.

5.7.4 Real-Time Analytics Dashboard: The contractor shall provide a real-time analytics dashboard accessible to authorized ARARNG users. The dashboard shall display key call data including, but not limited to: caller ID, call duration, call disposition (answered, missed, voicemail), the agent or office that received the call, and timestamps for all interactions.

5.7.5 Call tracking services shall be active and operational 99% of all non-federal-holiday business days. Dashboards and analytical tools shall be accessible and functional 90% of the same identified period, barring any exigent circumstances acknowledged by both the contractor and the Government.

5.7.6 The contractor shall provide call analytics reporting as part of the monthly KPI report referenced in paragraph 5.3.2.

5.7.7 The contractor shall provide administrative-level access to at least one (1) RRBN staff member and online training on the call tracking platform.

5.8 Digital Business Cards and QR Codes:

The contractor shall provide digital business cards and dynamic QR codes for ARARNG marketing and recruiting efforts (up to 500 digital business cards and QR codes combined).

5.8.1 The contractor shall provide a minimum of two (2) custom digital business card templates and individual cards with unlimited scans. The contractor shall set up and manage the digital business card platform and provide access to RRBN staff for mobile and print use. Initial setup shall be completed within 45 calendar days of contract start.

5.8.2 The contractor shall provide a minimum of five (5) custom QR code templates and up to 400 dynamic and static QR codes with unlimited scans, including full setup and management. The Government shall be provided administrative-level access to the QR code platform with the ability to independently create, edit, and reassign QR codes as mission needs require. QR code requests submitted to the contractor shall be processed and delivered within 5 business days of request. Corrections for unresponsive QR codes shall be completed within 1 business day of notification.

5.8.3 The contractor shall provide administrative-level access for at least one (1) user, along with self-paced online training and normal business-hours technical support for the QR code platform.

5.8.4 The contractor shall provide monthly reports on remaining QR code supply.

5.9 Digital Asset Management (DAM) System:

The contractor shall implement and manage a centralized, searchable digital asset management system for organizing, storing, and sharing ARARNG marketing assets.

5.9.1 The contractor shall organize and store ARARNG digital assets, including images, videos, and documents (capacity for up to 1,000 assets and 1 Terabyte [TB] of storage). The contractor shall provide notification when data storage reaches each 25% interval threshold of remaining capacity.

5.9.2 The contractor shall provide the ability to create up to 20 pre-designed layouts or structures within the DAM system that allow users to maintain brand consistency and streamline content creation via standardized design elements (e.g., fonts, colors, logos, imagery).

5.9.3 The contractor shall create five (5) custom ARARNG-branded templates within the DAM system. Templates shall be delivered within 45 calendar days of receiving all required information from the Government.

5.9.4 The contractor shall provide system access to all RRBN staff, one (1) administrative-level user account, and online training on the DAM system. Access shall be available within 1 business day of contract start.

5.9.5 The contractor shall track and provide analytics on asset utilization as part of monthly reporting.

5.10 Landing Pages:

5.10.1 The contractor shall provide three (3) unique landing pages to serve as calls-to-action for marketing efforts. These pages shall be delivered within 45 calendar days of receiving all required information from the Government.

5.10.2 The contractor shall provide a custom landing page for each individual recruiter. Each recruiter landing page shall be directly linked to that recruiter's personalized digital business card QR code, enabling seamless transition from card scan to landing page. Each recruiter landing page shall include a lead capture form that collects prospect contact information and inquiry details. Upon form submission, the system shall generate an immediate automated notification to the applicable Recruiting and Retention NCO (RRNCO), providing real-time lead alert capability. All lead capture and data handling shall be conducted in accordance with applicable military regulations and standards governing the collection, storage, and handling of personally identifiable information (PII) and sensitive recruiting data. These pages shall be delivered within 45 calendar days of receiving all required information from the Government.

5.11 Program Management Support — Joint Enlistment Enhancement Program (JEEP):

The contractor shall provide resources, systems, and training to help the ARARNG manage the Joint Enlistment Enhancement Program (JEEP).

5.11.1 The contractor shall provide a dedicated JEEP Program website serving as the central hub for program information, JEEP Assistant registration, and lead referral submission. The website shall be publicly accessible, mobile-friendly, and branded in accordance with ARNG standards.

5.11.2 The contractor shall provide a secure registration and onboarding portal for JEEP Assistants. The portal shall include automated document collection with e-signature-enabled webforms, allowing JEEP Assistants to complete required enrollment documentation electronically. The portal shall host training resources and program guidance materials accessible to registered JEEP Assistants at any time.

5.11.3 The contractor shall implement a secure, cloud-based solution for capturing, managing, and tracking leads under the JEEP program. The system shall capture all JEEP-referred leads, route them to the appropriate recruiting team, and track disposition and follow-up status. Each team shall receive a dedicated tracking sheet or dashboard view for lead management. The contractor shall ensure lead data can be securely retained and exported in compliance with federal records management standards. Export functions must apply proper data protection controls during download and transfer. All lead capture, storage, and handling under this section shall comply with Section 5.15 of this PWS.

5.12 Optichannel Marketing Campaigns:

The contractor shall create and manage multi-channel marketing campaigns utilizing a mix of traditional and digital media (e.g., direct mail, email, SMS, and custom audience social media).

5.12.1 The contractor shall execute the following campaigns:

5.12.1.1 Non-Prior Service Campaign: Targeting approximately 10,000 contacts in priority high schools and colleges in Arkansas using personalized direct mail, outbound messaging, retargeting, lead nurturing, and a microsite.

a. The campaign shall include a minimum of six (6) emails, one (1) SMS, and one (1) direct mail postcard. (The contractor is not required to provide printing and postage.)

b. The contractor shall provide a microsite with a customized campaign landing page (lead form capture) and a minimum of five (5) pages of relevant ARNG recruiting information linked to nationalguard.com.

5.12.1.2 Retention/Precision Campaigns: Targeting current Guard members and IRR (up to 5,000 contacts).

a. The contractor shall execute up to four (4) Precision campaigns (e.g., Retention, Mid-Career, Prior Service, Officer, Warrant Officer).

b. Each campaign shall include a minimum of six (6) emails, one (1) SMS, and one (1) direct mail postcard. (The contractor is not required to provide printing and postage.)

c. The contractor shall provide a microsite with a customized campaign landing page (lead form capture) and a minimum of four (4) pages of relevant ARNG recruiting information linked to nationalguard.com.

5.12.2 The contractor shall utilize an automated marketing platform (AMP) to personalize campaigns, track KPIs, and generate actionable insights to improve lead-to-enlistment conversion rates.

a. The contractor shall use personalized URLs (PURLs) in all outbound messaging and personalized QR codes on direct mail postcards for tracking purposes.

b. The contractor shall personalize all outbound messages with the recipient's name.

c. The contractor shall automate outbound messaging and integrate retargeting tactics to increase engagement-to-lead conversions.

d. The contractor shall implement lead scoring to identify high-propensity leads.

5.12.3 The contractor shall develop messaging and creative materials adhering to Army National Guard (ARNG) brand standards. All creative elements must be NGB-approved prior to execution.

5.12.4 The contractor shall provide end-to-end campaign analytics, a user-friendly tracking dashboard, and monthly reporting on KPIs, lead generation, and channel analysis.

5.13 Social Media:

5.13.1 The contractor shall develop an annual social media strategy aligned to ARARNG recruiting objectives and submit for RRBN approval within 30 calendar days of contract start.

5.13.2 The contractor shall develop a monthly content calendar covering all planned social media content for the upcoming calendar month in its entirety. The completed content calendar, including all post copy, imagery or imagery direction, and scheduling details, shall be submitted to the ARARNG RRBN Marketing NCOIC for review and approval no later than the last business day of the preceding month. No content shall be published prior to receiving Government approval.

5.13.3 The contractor shall post content five (5) times per week across the ARARNG's designated social media channels. All content shall adhere to NGB brand standards and be submitted for Government approval in advance.

5.14 Media:

5.14.1 The contractor shall conduct media research and develop a media strategy and plan addressing ARARNG marketing objectives. The media strategy and plan shall be submitted for Government approval within 30 calendar days of receipt of Government input on media goals and intent.

5.14.2 The contractor shall purchase and place paid media on behalf of the ARARNG. Prior to purchasing any media placement or entering into any contracts in support of this effort, the contractor shall secure ARARNG COR/KO approval. The ARARNG shall provide a response within seven (7) calendar days of a purchase being submitted for approval. In no circumstance shall the contractor expend these funds or enter into a media placement contract without prior approval of the ARARNG COR or KO.

5.14.3 The total media budget shall not exceed $14,000 for the period of performance. Of this total, no more than $4,000 shall be allocated to media strategy and execution (labor), with the remaining $10,000 designated exclusively for paid media placement.

5.14.4 The contractor shall monitor platform performance and provide the ARARNG with access to a near real-time online dashboard tracking KPIs including, but not limited to: impressions, cost per impression, clicks, click-through-rate, cost per click, on-site conversions, conversion rate, cost per conversion, completed video views, and social engagements (e.g., likes, comments, shares). The dashboard shall be available within 3 business days of media strategy execution approval.

5.15 Data Security and Compliance — Lead Data and Personally Identifiable Information (PII):

This section establishes contract-wide security and compliance requirements applicable to all contractor-managed platforms, systems, and services that collect, process, store, transmit, or retain lead data, prospect information, or Personally Identifiable Information (PII) on behalf of the ARARNG. These requirements apply to, but are not limited to: the JEEP program lead management platform, recruiter landing pages with lead capture forms, the Automated Marketing Platform (AMP), the call tracking and analytics system, and any other contractor-operated system that handles ARARNG recruiting leads or prospect data.

5.15.1 Authorization Baseline: All contractor-managed platforms covered by this section shall be authorized at a minimum under the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline and shall hold Department of Defense (DoD) Impact Level 4 (IL4) authorization. This authorization level is required to ensure the safe handling of Controlled Unclassified Information (CUI) and Personally Identifiable Information (PII) in accordance with DoD and Army National Guard standards.

5.15.2 Security Controls: All covered platforms must meet all applicable FedRAMP Moderate and DoD IL4 requirements, including but not limited to:

a. Data encryption in transit and at rest using FIPS 140-2 validated cryptographic modules;

b. Continuous monitoring of system security posture with regular reporting;

c. Comprehensive access logging and audit trail capabilities;

d. Multi-factor authentication (MFA) required for all user accounts with access to lead or PII data;

e. Role-based access controls (RBAC) limiting data access to authorized personnel only.

5.15.3 Data Handling and Retention: The contractor shall collect, store, and handle all lead data and PII in strict accordance with applicable military regulations, Department of Defense directives, and Army National Guard standards, including but not limited to DFARS 252.224-7000, DoDD 5400.11, DoD 5400.11-R, and applicable provisions of the Privacy Act of 1974. The contractor shall ensure lead data can be securely retained and exported in compliance with federal records management standards. Export functions must apply proper data protection controls during download and transfer.

5.15.4 PII Breach Notification: In the event of a confirmed or suspected breach of PII or lead data resulting from contractor action or inaction, the contractor shall notify the ARARNG COR within two (2) hours of discovery. The contractor shall bear all notification costs, call-center support costs, and credit monitoring service costs for all individuals whose data has been compromised, as specified in paragraph 1.4.2 of this PWS.

5.15.5 Authorization Documentation: Prior to the activation of any platform covered by this section, the contractor shall provide to the COR written documentation confirming FedRAMP Moderate authorization and DoD IL4 authorization status for each applicable system. Documentation shall be updated and resubmitted within 10 business days of any change to authorization status.

6.0 Applicable Publications:

Publications applicable to this PWS are listed below:

TECHNICAL EXHIBIT 1

Performance Requirements Summary (PRS) This PRS includes performance objectives the Government will use to determine contractor performance and compare contractor performance to the Acceptable Quality Level (AQL).

TECHNICAL EXHIBIT 2

Deliverables Schedule

TECHNICAL EXHIBIT 3

Estimated Workload Data This information is provided for historical background only. It is not a guarantee of workload quantities.

END OF PERFORMANCE WORK STATEMENT