Attachment 0001 EAS PWS FINAL.pdf

PERFORMANCE WORK STATEMENT

United States Army Counterintelligence Command/Directorate of Operations/Signature Reduction Program

External Assessments Service Support

1.GENERAL: This is a non-personnel services contract to provide External Assessment Service Support. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform External Assessment Service Support for the United States Army Counterintelligence Command (ACIC) and it’s subordinate units and activities as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background: ACIC is responsible for conducting global, multi-discipline counterintelligence operations and activities within a continuously evolving environment that presents increasingly difficult challenges. The most significant of these is the threat posed by technological advancements in conjunction with commercial sector drive for marketization and profitability of personal information. This threat is known as Ubiquitous Technical Surveillance or UTS and where the private or commercial sector collects, stores, analyzes, and shares this information to provide tailored products and services to individuals as consumers; this data can similarly be exploited by adversaries with minimal risk/effort to develop patterns of behavior and ascertain sensitive or critical information about the unit, its mission, and personnel.

Conducting assessments is a critical, necessary requirement as an evaluation tool for ensuring the unit makes informed decisions based upon reliable, evidence-based reporting and should not just be done on a case-by-case basis but as part of a continual cycle (much like the OPS/Mission/Intel Cycle) where current conditions are assessed, vulnerabilities are identified, countermeasures are put in place, risk is evaluated / assumed, and the new conditions are, in turn, re-assessed to ensure they are effective or require modifications.

1.3 Objectives: The objective of this requirement is to provide ACIC with a tailorable, diverse, on-demand analysis and assessment service from an external vendor with deliverable reports/products that would provide timely, relevant, and actionable data or information to enable ACIC leaders to make informed decisions.

1.4 Scope: The contractor shall provide highly qualified personnel to support the research, investigation, collection, and analysis of personnel, profiles, infrastructure, locations, or events based upon a limited set of data points provided by ACIC. The contractor will utilize advanced public, private, and commercially available tools, data, and investigative techniques and provide all findings, conclusions, recommendations, and other information in a final assessment report or product to ACIC.

1.5 Period of Performance: The period of performance shall be for one (1) Base Year of 12 months and four (4) 12-month option years. The Period of Performance reads as follows:

Base Year: 30 September 25 – 29 September 26 Option Year 1: 30 September 26 – 29 September 27 Option Year 2: 30 September 27 – 29 September 28 Option Year 3: 30 September 28 – 29 September 29 Option Year 4: 30 September 29 – 29 September 30

1.6 General Information

1.6.1 Quality Control: The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is how it assures the government that its work complies with the requirements of the contract and this PWS.

The QCP will be delivered electronically to the Contracting Officer (KO), Contracting Officer’s Representative (COR), and Alternate Contracting Representative (ACOR) within 30 calendar days after task order award, and within 5 calendar days when changes are made thereafter. After acceptance of the QCP the contractor shall receive the KO’s acceptance in writing of any proposed change to the QCP. The contractor will review and update the QCP at least once a year.

Deliverable: Contract Data Requirements List (CDRL) A001: Quality Control Plan

1.6.2 Quality Assurance: The government will use the Quality Assurance Surveillance Plan (QASP) as the objective basis for determining the contractor’s performance during any established reporting period. This plan primarily focuses on the Government measures to ensure that the contractor has performed IAW performance standards. The QASP is a living document that the government may review and revise on a regular basis. The intent of the QASP is to ensure performance IAW the metrics set forth in the contract documents so that the Government receives the quality of services specified and only pays for the acceptable level of services it receives. The QASP defines how the Government will apply the performance standards, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays: The contractor is not required to perform services on the following Federal holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Christmas Day

Independence Day

1.6.4 Hours of Operation: The contractor is responsible for conducting business Monday thru Friday during the hours prescribed by their employer (the vendor). The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS.

1.6.5 Place of Performance: The work to be performed under this contract will exclusively be conducted at the vendor’s business location.

1.6.6 Type of Contract: This is a non-personal services, firm-fixed price (FFP) contract as defined by Federal Acquisition Regulation (FAR) Subpart 37.101. Contractor personnel rendering services under this contract are not subject to direct, day-to-day, supervision by Government personnel. ACIC retains the authority to make all decisions regarding the ACIC mission, and the execution or interpretation of any laws, regulations, or policies applicable to an intelligence / counterintelligence agency operating under the Department of the Army of the United States. Contactor Services defined are not considered to be inherently Governmental in nature, as defined by FAR Subpart 7.5.

The Contractor will be responsible for the supervision of the Contractor employees at all duty locations. The Contractor is expected to work independently to accomplish the requirements of this order. The Contractor must generate reports and other deliverables as specified in the Performance Work Statement. The government will neither supervise contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances will the government assign tasks or prepare work schedules for individual contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services. If the Contractor believes that any actions constitute or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (KO) immediately.

While it is the Contractor’s responsibility to supervise its personnel, The United States Government, Department of the Army, and ACIC may require and ensure all contractor personnel have received any training deemed necessary to satisfy the mission and requirements of the United States Government. The delivery of said training will be determined by the United States Government, but may include online training via a link to contract employees, virtual training, and/or in person training.

1.6.7 Security Requirements: Contractor personnel performing work under this contract do not require a Security

Clearance.

1.6.8 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use.

1.6.9 Special Qualifications: The contractor shall be responsible for ensuring employed contractor personnel have all requisite training, certifications, accesses, and experience required to conduct the tasks outlined in this

PWS.

1.6.10 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

Deliverable: CDRL A002 Post Award Brief Slides and Minutes with Attendees List

The KO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor’s performance. At these meetings, the KO will apprise the contractor of how the government views the contractor’s performance, and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action will be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

Monthly Status Report (MSR): The MSR shall discreetly reference (by internal number or other identifier) each assessment/project conducted by the contractor on behalf of ACIC. Additionally, the MSR should minimally detail the type of assessment/project, dates conducted, approximate hours expended, and list any/all deliverables (reports/products) provided. The MSR is meant to help inform the Government on costs, schedule, and performance and helps identify deliverables funded and date they were funded as well as the titles, dates and number(s) of deliverables completed. For tracking purposes, the MSR shall detail the Government funding sources provided in the award document and subsequent funding modifications Specific MSR format and content shall be mutually agreed upon by the contractor and COR; this should be established no later than the Post-Award Conference. The Submission of this report should be no later than the thirtieth (30) day of the month following the previous month. If the MSR shows that a project is not meeting the performance thresholds set forth in the Performance Requirements Summary (PRS) found in Section 7.0, the contractor shall provide the rationale and circumstances preventing the threshold from being met, a get-well plan, to the satisfaction, acceptance and approval of the COR

Deliverable: CDRL A003 Monthly Status Report

1.6.11 Contracting Officer Representative (COR): The KO will appoint the COR via the Joint Appointment Module (JAM) in the Procurement Integrated Enterprise Environment (PIEE). The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions identified in the appointment letter: assure that the contractor performs the technical requirements of the contract;

perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor the contractor's performance and notify both the KO and contractor of any deficiencies; coordinate availability of Government furnished property;

and provide worksite entry for contractor personnel. The COR’s formal designation letter, a copy of which is forwarded to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting delivery task order.

1.6.12 Data Rights: The Government has unlimited rights to all documents/material produced under this contract.

All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.6.13 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

PART 2 DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. ASSESSMENT. Research, collection, and analysis of publicly or commercially available information (PAI/CAI) on people / profiles, locations / infrastructure, or activities / events for purposes of quantifying online exposure, identifying vulnerabilities, evaluating countermeasures, and measuring effectiveness of current TTP’s, employed tradecraft, and modernization efforts.

2.1.2. COMMERCIALLY AVAILABLE INFORMATION (CAI). Information or data readily available or obtainable for purchase, lease, or license to the general public or non-governmental entities for purposes other than governmental uses.

2.1.3. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.4. CONTRACTING OFFICER (KO). A person with authority to enter-into, administer, and/or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.5. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such an appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

2.1.6. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.7. DELIVERABLE. Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

2.1.8. EXTERNAL. Referring to agencies, organizations, or activities outside of the federal government.

2.1.9. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.10. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.11. PUBLICLY AVAILABLE INFORMATION (PAI). Information that is intentionally made available to the general public or is readily accessible through various public channels, including government records, widely distributed media, or information from public sources.

2.1.12. QUALITY ASSURANCE. The government procedures to verify that services being performed by the

Contractor are performed according to acceptable standards.

2.1.13. QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.14. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.15. SELECTOR. Synonymous with a “Data Point,” a selector is a single piece of information specific to a person, place, or activity that can be used individually or in conjunction with a “set,” of other selectors for purposes of analysis and assessment.

2.1.16. SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.17. UBIQUITOUS TECHNICAL SURVIELLANCE. The collection and long-term storage of data in order to analyze and connect individuals with other people, activities, and organizations. Five threat vectors: Online, Electronic, Visual-Physical, Financial, and Travel.

2.1.18. WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.19. WORK WEEK. Monday through Friday, unless specified otherwise.

2.2. ACRONYMS:

ACOR Alternate Contracting Officer's Representative AFARS Army Federal Acquisition Regulation Supplement AR Army Regulation CAI Commercially Available Information CCE Contracting Center of Excellence CFR Code of Federal Regulations

CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative COTS Commercial-Off-the-Shelf DA Department of the Army DD250 Department of Defense Form 250 (Receiving Report) DD254 Department of Defense Contract Security Requirement List DFARS Defense Federal Acquisition Regulation Supplement DMDC Defense Manpower Data Center DMV Department of Motor Vehicles DOD Department of Defense FAR Federal Acquisition Regulation HIPAA Health Insurance Portability and Accountability Act of 1996 IRC Internet Relay Chat KO Contracting Officer OCI Organizational Conflict of Interest OCONUS Outside Continental United States (includes Alaska and

Hawaii) ODC Other Direct Costs PAI Publicly Available Information PIPO Phase In/Phase Out POC Point of Contact

PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program TE Technical Exhibit TTP Tactics, Techniques, and Procedure USPER U.S. Persons Information UTS Ubiquitous Technical Surveillance

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1. Services: Not applicable

3.2. Facilities: None

3.3. Utilities: None

3.4. Equipment: None

3.5. Materials: None

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1. General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Section 3 of this PWS.

4.2. Secret Facility Clearance: Not required

4.3. Materials: The Contractor shall furnish all materials necessary to meet the requirements outlined within this

4.4. Equipment: The Contractor shall provide all equipment necessary to meet the requirements outlined within this

SPECIFIC TASKS

5. Specific Tasks:

5.1. The contractor shall provide services to include assessments of people, profiles, locations, and/or infrastructure that leverages the most advanced publicly and commercially available tools, data, and investigative techniques in order to proactively analyze data aggregation, conduct threat monitoring, and determine vulnerabilities of online exposure and ubiquitous technical surveillance (UTS). These services would minimally include collection and analysis of Publicly Available / Commercially Available Information (PAI/CAI), vulnerability/threat assessment and monitoring services, quality control / quality assurance (QA/QC), report deliverables, and debriefing with assigned analysts. The Government shall provide a subject of assessment via technical instruction. Once the order has been placed for the assessments and technical instruction provided to the contractor, final assessment reports shall be delivered in accordance with Technical Exhibit 3. The contract shall provide assessments for the following categories and will generally be utilized to determine service timelines and vendor deliverables as indicated in PART 7:

Personnel Assessment. An assessment of a particular person and/or profile that is conducted by the vendor based upon limited selector information provided by ACIC.

Location Assessment. An assessment of a particular location that is conducted by the vendor based upon limited selector information provided by ACIC.

Unit/Organizational Assessment. An assessment of ACIC and/or the unit’s subordinate elements/activities that is conducted by the vendor based upon limited selector information provided by ACIC.

Event/Activity Assessment. An assessment of a particular activity, event, or capability that is conducted by the vendor based upon limited selector information provided by ACIC.

5.2. Assessment Service Support.

5.2.1. The contractor will utilize both conventional (consistent with the search capabilities of an average person) and advanced PAI/CAI tools, databases, capabilities, research & investigative techniques on any / all selectors provided by ACIC. PAI/CAI data sources are listed below.

Data Sources (Required, but not limited to):

Open-Source Information Portals Available Proprietary Sources Deep Web Content Dark Web Content IRC/Chat Message Boards Online Broadcasting Websites Public Email Groups and Discussion Forums Social Media Sites USEnet Data Web Blogs World Wide Web Public Records (Court records, police reports, DMV records, news reports, etc.)

Ad-tech data / Data aggregation sources Geo-Location Data / sources

5.2.2. The contractor then utilizes any findings to piece together both public and hidden relationships between these selectors and their connections to any other people, places, or activities and evaluating / assessing how these connections may impose security risks / vulnerabilities to ACIC. Analysis should include but not be limited to the following considerations:

Analysis Considerations (Evaluate, Analyze, and Assess):

Level (size/amount) of exposure identified within the public / commercial domain.

Sources of exposure (where that information was found) and why it was found there Timelines (How long has selector information been present). Identify / analyze notable changes in exposure throughout time/distance/locations.

Connections with other critical/sensitive selectors (ex. ACIC unit, personnel, or activities) and/or with other notable IC / DOD agencies or missions.

Gaps in information / absence of information that should be there but is not – is the lack of this data a risk/vulnerability? What does the lack of this data indicate?

Anomalous activity or indicators of threats, risk, or vulnerabilities leveraging technical/analytical expertise in exhibited patterns, behaviors and activities.

Effectiveness of OPSEC/UTS measures (if present/known), TTPs, tradecraft Geo-fencing/location data, heat mapping (when/where do these selectors have a known presence, what affiliations do they have with other locations/activities/personnel?) Ex. ACIC sensitive operations or personnel affiliated with Ft. Meade with known travel or deployments to operational environments

5.2.3. The contractor will then provide a comprehensive report detailing the findings discovered during the conduct of PWS tasks 5.3.1 and 5.3.2 above, including recommendations on mitigating any risks or vulnerabilities, enhancing digital security, limiting exposure, and identifying potential threat vectors. This report will primarily be in the form of a slide presentation (PowerPoint or similar format) but should minimally include the following:

Graphics, images, graphs, screenshots, link diagrams, association matrixes, or other visuals that will aid in the interpretation/impact of the findings, analysis, and recommendations presented in the final report.

Summary of all discovered findings conducted analyses, and recommendations.

Deliverable: CDRL A004: Final Assessment Report

5.3. Constraints / Restrictions.

U.S. Persons Information (USPER): The contractor has routine access and exposure to USPER information / PII but only in the context of conducting online research and solely within the confines of what is legally prescribed as “publicly available / commercially available” information. Contractor will still protect PII as required by the Privacy Act.

ACIC will not request or personally obtain any USPER information / PII from the vendor outside of the scope of applicable legal and regulatory compliance (EO 12333, DODM 5240.01, AR 381-10, etc.)

based upon the unit’s mission (intelligence / counterintelligence) and only with appropriate approvals/authorities.

Risk of incidental collection/exposure to USPER information by ACIC outside of approved authorities outlined above will be almost entirely mitigated due to the vendor only providing specific feedback on ACIC requested assessments/reports.

Public / Online Interaction: The contractor may research and access any PAI / CAI but is not authorized to conduct interactions with other individuals/personas online or access otherwise restricted sources in the performance of their tasks under this PWS.

Search Constraints/Restrictions: ACIC reserves the right to provide (in addition to the requested selectors) a list of restricted terms or other criteria. This list is due to the vendor during submission of the request for an assessment but can be updated at any time throughout. There is no required format for this list so it could be submitted in email, official memorandum, or other means. These restricted terms or criteria will serve to inform the assigned analyst of searches that are not authorized and/or to limit the bounds/extent by which the search will take place (ex. specific databases, queries, or sites may be restricted).

5.4. Procedures for serious incidents or imminent threats.

Imminent Threat Information: If the Contractor discovers any information that could indicate an imminent threat, reporting procedures are as follows:

Physical Threat to Personnel / Property (local): A physical threat has been identified to personnel or property within a specific locale (ex. city, county).

1) STOP all activities

2) Immediately contact local authorities (law enforcement) or in an emergency call 911.

Provide all requested information on the threat to ensure proper response, Contact and advise the COR.

5) Maintain a written record of the incident (date/time, agency reported, location, Etc.). This should be included in the final report/product.

Physical Threat to Personnel / Property (Installation/post): A physical threat has been identified to personnel or property on a US military installation, post, or other federally owned location/facility.

2) Immediately contact the Installation’s or Federal agency’s law enforcement (Ex.

Military Police, NSA security). If unable to get a response, contact local authorities (as noted above) or call 911 in an emergency.

3) Provide all requested information on the threat to ensure proper response 4) Contact and advise the COR.

5) Maintain a written record of the incident (date/time, agency reported, location, Etc.). This should be included in the final report/product.

Serious Incident: This is described as any discovery that is considered a serious security threat / Risk

(ex. unauthorized disclosure of potentially classified information, non-imminent threats, foreign intelligence collection, etc.).

2) If dealing with confirmed/suspected classified information, immediately take custody of and safeguard the material. DO NOT further disseminate, copy, or involve other personnel.

3) Immediately contact and advise the COR.

in the case of potential classified information do not provide the document/material in question or allow them or others to view it.

4) The COR will leverage the SSO to Advise and assist on further procedures to report the incident and will provide the Contractor will further guidance.

6) Maintain a written record of the incident (date/time, agency reported, location, Etc.). This should be included in the final report/product. NOTE: This record should be a summary of the incident and not contain any sensitive/classified information.

Other Concerns: The contractor should generally report any security/vulnerability concerns outside of the imminent threat and serious incident categories outlined above to the COR or ACOR for review and action.

5.5. Debrief and Periodic Updates: The contractor may be required by ACIC upon request to provide a status update or summary of the current assessment at a point prior to the final assessment report being produced. This summary should be a format similar to that of the final report (slide presentation) but only representative of the progress up to the point requested. ACIC may also require separate to or in conjunction with, said status update report, the conduct of a debrief of the assigned contract analyst conducting the assessment. This action may be necessary for ACIC to ensure the assessment is going to meet their requirements and whether the selectors provided at the start of the assessment were sufficient or if additional context may be needed to enable more refined results.

5.6. Service completion. When all vendor services are complete, the contractor shall destroy all program material at the completion of the contract.

PART 6

APPLICABLE PUBLICATIONS

6. APPLICABLE PUBLICATIONS (CURRENT EDITIONS)

6.1. The Contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures. The Contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures.

Publications and forms applicable to this Performance Work Statement are listed below. The publications and forms have been coded as mandatory or advisory. The Contractor is obligated to follow those publications and use those forms coded as mandatory to the extent (that is, a specific procedure in a paragraph, section, chapter or volume) specified in the Performance Work Statement. The Contractor shall be guided by those publications or use those forms coded advisory to the extent necessary to accomplish requirements in the Performance Work Statement. All publications below can be found at http://armypubs.army.mil.

6.1.1. Regulations and Directives

NUMBER DATED DESCRIPTION MANDATORY ADVISORY

AR 530-1 SEP 2014 Operations Security X AR 380-5 MAR 2022 Army Information Security Program X http://armypubs.army.mil/

PART 7

ATTACHMENT/TECHNICAL EXHIBIT LISTING

7. Attachment/Technical Exhibit List:

7.1. Attachment 1/Technical Exhibit 1 – Performance Requirements Summary

7.2. Attachment 2/Technical Exhibit 2 – Deliverables Schedule

7.3. Attachment 3/Technical Exhibit 3 – Assessments Timeline and Coverage

TECHNICAL EXHIBIT 1

PERFORMANCE REQUIREMENTS SUMMARY

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Objective (The Service required—usually a shall statement)

Standard Performance Threshold (This is the maximum error rate. It could possibly be “Zero deviation from standard”)

Method of Surveillance

PRS # 1.

The contractor shall utilize both conventional (consistent with the search capabilities of an average person) and advanced PAI/CAI tools, databases, capabilities, research & investigative techniques on any / all selectors provided by ACIC.

PWS Para 5.2.1

100% of the time Zero deviation from the standard

Validated customer complaint

PRS # 2

The contractor then utilizes any findings to piece together both public and hidden relationships between these selectors and their connections to any other people, places, or activities and evaluating / assessing how these connections may impose security risks / vulnerabilities to

ACIC.

PWS Para 5.2.2

100% of the time Zero deviation from the standard

Validated

PRS # 3

The contractor will then provide a comprehensive report detailing the findings discovered during the conduct of PWS tasks 5.2.1 and 5.2.2 above, including recommendations on mitigating any risks or vulnerabilities, enhancing digital security, limiting exposure, and identifying potential threat vectors.

PWS Para 5.2.3

100% of the time Zero deviation from the standard

Validated

PRS # 4

The contractor shall provide periodic status updates on assessments and/or debriefings of assigned contractors as requested.

PWS Para 5.5

100% of the time (when requested) Zero deviation from the standard

Validated

TECHNICAL EXHIBIT 2

DELIVERABLES SCHEDULE

Deliverable Frequency # of Copies Medium/Format Submit To

Quality Control Plan

CDRL #A001

Within 30 days of contract award OR within 5 days of any changes/updates.

1 Electronic file by email as an MS Word attachment

KO, COR, and

ACOR

Post Award Brief Slides and Minutes with Attendees List

CDRL #A002

Within 5 days after requested.

1 Electronic file by email as an MS PowerPoint, Word, or similar format.

KO, COR, and other government employees (as applicable)

Monthly Status Report (MSR)

CDRL #A003

Monthly (Report due by 30th of month)

1 Electronic file by email. MS Word, Excel, or similar format acceptable

COR

Final Assessment Report

CDRL #A004

Upon completion of assessment (timeline below in Technical Exhibit #4)

1 Electronic file by email as an MS PowerPoint package.

KO, COR

TECHNICAL EXHIBIT 3

ASSESSMENTS TIMELINE AND COVERAGE

Category Coverage (Avg) Timeline

Personnel Estimated 20 hours (per person) No later than 15 Business Days after order

Location Estimated 40 hours (per location) No later than 15 Business Days after order

Unit/Org Estimated 60+ hours (per unit/org) No later 30 Business Days after order

Event/Activity Estimated 20+ hours (per event) No later 15 Business Days after order