Attachment 1 DHA PWS Fingerprint Services V1.pdf

Department of Defense Defense Health Agency

Performance Work Statement

Finger Printing Support Services

Defense Health Agency (DHA), Assistant Director Support, Personnel, and Financial Operations (AD SP&FO)

J-1 Administration Security Division (ASD)

Solicitation Number: HT001126QE014

Version: 1

Date: May 18, 2026

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to collect ink and digital fingerprints and submit to the Defense Counterintelligence and Security Agency (DCSA) for processing

1.2 Description of services/introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform fingerprinting Services as defined in this Performance Work Statement (PWS) except for those items specified as Government furnished property and services.

The Contractor shall perform to the standards in this PWS.

1.3 Background: The Defense Health Agency is required to conduct background investigations on all assigned Military, Civilian and Contractor employees. Fingerprint submissions are required within 180 days of submitting a background investigation. The absence of an internally managed process often leads to delays in time to hire and enrollment to the federally mandated Trusted Workforce 2.0.

1.4 Objectives: Provide fingerprinting collection and submission support services for personnel assigned to DHA. Effort includes:

• Timely submission of digital fingerprints to DCSA

• Capture and submission of ink fingerprints meeting various U.S. State requirements to

DCSA

• Provide a means for DHA to audit fingerprint transactions

1.5 Scope: Fingerprinting Services include collection and submission of digital fingerprints using the DCSA Secure Web Fingerprint Transmission (SWFT) system as well ink or hard card fingerprints on various fingerprint cards.

1.6 Period of Performance (PoP): The PoP for this effort shall be for a period of twelve (12) months, also referred to as the Base Period. This effort includes four (4) 12-month Option Period.

• Base: Sept 27, 2026 - Sept 26, 2027

• Option 1: Sept 27, 2027 - Sept 26, 2028

• Option 2: Sept 27, 2028 - Sept 26, 2029

• Option 3: Sept 27, 2029- Sept 26, 2030

• Option 4: Sept 27, 2030- Sept 26, 2031

1.7 Administrative specifications

1.7.1 Place of performance: The work shall be performed at any/all current or future vendor fingerprint collection sites. Contractor shall have a presence within each of the 50 U.S. States, Guam, Puerto Rico and U.S Virgin Islands.

1.7.2 Recognized Federal holidays: Contractor is expected to complete work on any date listed as available on the online schedule. Collection sites do not run on the OPM schedule and may be open on some of these holidays. This comment is to ensure that if the Contractor online scheduler allows an appointment to be scheduled on Veterans Day then that collection site should be open.

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day

Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

1.7.3 Hours of operation: The Contractor is responsible for conducting business during posted availability. Some Contractor locations may be joined with other businesses. If the business is scheduled to be open, then fingerprint services must be available during posted business hours.

1.7.4 Emergency Services: Reserved.

1.8 Contractor travel: Travel is not required by the Contractor.

1.9 Other Direct Costs (ODC): Reserved

1.10 Quality

1.10.1 Quality Control (QC): The Contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The Contractor’s QC program is the means by which the work complies with stated requirements. After acceptance of the Quality Control Plan (QCP) the Contractor shall receive the CO’s acceptance in writing of any proposed change to his QC system. See Part 7, Technical Exhibit 1 - CDRL A001.

1.10.2 Quality assurance (QA): The Government will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11 Contractor personnel

1.11.1 CAC requirements: CAC Issuance is not required for performance on this contract.

1.11.2 Contractor onboarding and training: Reserved

1.11.3 Physical Security: Reserved

1.11.4 Key control: Reserved

1.11.5 Lock combinations: Reserved

1.12 Key personnel (Contractor): Reserved

1.13 Data rights: Reserved

1.14 Reporting

1.14.1 Contractor Manpower Reporting (CMR): Reserved.

1.14.2 Non-Disclosure Agreement (NDA): Reserved

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the

Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor Contractor's performance and notifies both the CO and Contractor of any deficiencies; coordinate availability of Government furnished property; and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a Contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All Contractor personnel shall identify themselves as Contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings.

The Contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is Contractor support personnel.

Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is Contractor support personnel. Include a title block in all emails that states the fact that the person is Contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is Contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order.

Contractor personnel shall make their Contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a Contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.16.1 Access to HA/DHA Networks will not be required.

1.17 Personnel Security

1.17.1 Personnel Security vetting will not be required for performance of this contract.

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE

PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D- Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R- Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.2 Acronyms:

AIS Automated Information System APL Approved Products List APL AQL Acceptable Quality Level ARRT Acquisition Requirements Roadmap Tool ATO Authority to Operate B2B Business-2-Business CAC Common Access Card CAP Cloud Access Point CCEVS Common Criteria Cybersecurity Evaluation and Validation Scheme CDI Covered Defense Information CE Computer Environment CDRL Contract Data Requirement List CIO Chief Information Officer CJCSM Chairman of the Joint Chiefs of Staff Manual CMMC Cybersecurity Maturity Model Certification CMR Contractor Manpower Reporting CNSSI Committee on National Security Systems Instruction CO Contracting Officer(s) CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative CSP Cloud Service Provider CSSP Cyber Security Service Provider CUI Controlled Unclassified Information DAD-A Deputy Assistant Director for Acquisition DC3 DoD Cyber Crime Center DCSA Defense Counterintelligence and Security Agency DD Form 254 Department of Defense Contract Security Requirement List (if applicable)

DB Design-Build DBB Design-Bid-Build DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DISA Defense Information System Agency DoD Department of Defense DoDD Department of Defense Directive DoDI Department of Defense Instruction DSAs Data Sharing Agreements DSAA Data Sharing Agreement Application DMZ Demilitarized Zone DoDM Department of Defense Manual DPCLO DHA Privacy and Civil Liberties Office DUA Data Use Agreement eMSM Enhanced Multi-Service Markets EULA End User License Agreement EVM Earned Value Management FAR Federal Acquisition Regulation FCI Federal contract information FE Facilities Enterprise FedRAMP Federal Risk Authorization and Management Program FISMA Federal Information Security Modernization Act FRCS Facility Related Control Systems FSO Facilities Security Officer HA Health Affairs HIPAA Health Insurance Portability and Accountability Act HCA Head of the Contracting Activity HIT Health Information Technology IGCE Independent Government Cost Estimate IA Information Assurance IO Initial Outfitting I/O In/Out Processing Portal IPv Internet Protocol Version IS Information System ISP Internet Service Provider IT Information Technology ISCM Information Security Continuous Monitoring IV&V Independent Verification & Validation MedCOI Medical Community of Interest MHS Military Health System MIL-STD Military Standard MTFs Military Treatment Facilities NCR National Capitol Region NDA Non-Disclosure Agreement NIAP National Information Assurance Partnership NIST National Institute of Standards and Technology

OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs OPM Office of Personal Management OSD Office of the Secretary of Defense P-ATO Personal Authorization to Operate P&R Personnel and Readiness PGI Procedures, Guidance and Information PDT Project Delivery Team PHI Protected Health Information PII Personally Identifiable Information PIT Platform Information Technology PK Public Key PKI Public Key Infrastructure POA&M Plan of Action and Milestones POC Point of Contact PMO Program Management Office PoP Period of Performance PP Personal Property PPSM Ports, Protocols, and Services Management PRS Performance Requirements Summary PSP Personnel Security Program PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Plan RFP Request for Proposal RFQ Request for Quotation RMF Risk Management Framework SP Special Publication SPRS Supplier Performance Risk System SRM Sustainment, Restoration and Modernization SRG Security Requirements Guides STIG Security Technical Implementation Guides SWFT Secure Web Fingerprint Transmission TOS Terms of Service US United States UFC Unified Facilities Criteria VPN Virtual Private Network XML Extensible Markup Language

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

☒ Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

3.2 Facilities: The Government:

☒ Will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

3.3 Utilities: The Government:

☒ Will NOT provide Utilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

3.4 Equipment: The Government:

☒ Will NOT provide Equipment in support of this contract/task order. As a result, this paragraph is Not Applicable.

3.5 Materials: The Government:

☒ Will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

PART 4

4.0 CFURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor:

☒ Will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

4.2 General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work listed under Section 5 of this PWS.

PART 5

5.0 SPECIFIC TASKS

5.1 The Contractor shall provide a web registration process for applicants, collect demographic and biographic information required for the DCSA fingerprint submission.

5.1.1 Collection of fingerprints: The Contractor shall collect fingerprints using DCSA approved devices. Fingerprints should be “Type-4” and consist of 10 Rolled Impressions, 1 Plain Left and Right Simultaneous Four Finger Impressions and 1 Plain Left and Right Thumb Impression.

Fingerprint collection transactions are not expected to exceed 4,800 per year, electronic and hard copy combined.

5.1.1.1 No Shows or Rescheduling: The Contractor shall be solely responsible for any costs or impacts resulting from no shows or appointments that must be rescheduled with less than 24-hours’ notice. The Government will not be charged for, nor held liable for, any no shows or rescheduling that occurs with less than 24-hours’ notice.

5.1.2 Rejected fingerprint Submissions: DHA will provide the Contractor official documentation from DCSA regarding all fingerprint transactions labeled as unacceptable. The Contractor will be required to reprint these transactions at their expense.

5.2 Submission of Fingerprints: The Contractor shall submit fingerprints using pre-approved methods. In addition to electronic submission, paper submissions may also be required dependent on individual state requirements. Paper submissions will be sent to applicable DHA Headquarters location.

5.2.1 Electronic Submission: Fingerprint transactions collected through DCSA Secure Web Fingerprint Transmission System will be transmitted directly to DCSA.

5.2.2 Fingerprint Card Submission: Fingerprint transactions that require printing to a physical card (hard copy) will be mailed to the address associated with the requesting Submitting Office Number. Shipments must occur at least twice per week, according to a schedule determined and communicated by the COR. All shipments will be sent via “Standard Overnight.” Any additional shipments outside the established schedule require authorization from the Contracting Officer or COR. Shipping costs are included in the unit cost per transaction.

5.3 Electronic Portal: The Contractor shall provide a portal for requesters to query applicant information, verify applicant statuses, create reports, and archive applicant data.

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is unclassified.

6.2 The level and position sensitivity designation for positions under this contract is:

6.2.1 TIER III: Non-sensitive position.

6.3 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements:

6.3.1. Data Sharing Agreements (DSAs): Contractors requiring access to PII, which includes PHI, or access to de-identified data, are subject to the DHA Privacy and Civil Liberties Office (DPCLO) (Privacy Office) Data Sharing Program. This program requires DHA to enter into DSAs with parties outside the MHS who use or create MHS data. A DHA contract may use the term Data Use Agreement (DUA) rather than DSA. DSAs assure that outside parties protect MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a DSA, the Contractor submits a Data Sharing Agreement Application (DSAA) to the DHA DPCLO. The Contractor submits the DSAA even if a subcontractor will be the party accessing MHS data. After review and approval of the DSAA, the Privacy Office provides a DSA to the Contractor for execution.

6.3.2. Processing Procurement Sensitive Information: All individuals shall seek guidance from the CO or their designated representative regarding the coordination of documents, dissemination, and transmission of procurement sensitive information. Procurement sensitive information shall not be transmitted electronically unless encryption is utilized.

6.4 Training; Reserved

6.5 Cybersecurity Requirements for Non-DoD IT or Covered Contractor IS: Reserved

6.6 Risk Management Framework (RMF) for DoD IT: Reserved

6.7. Facility Related Control Systems: Reserved

6.8. System Communications: Reserved

6.9 MHS Demilitarized Zone (DMZ) Medical Community of Interest (MedCOI) Business-to-Business (B2B) Gateway - Reserved

6.10 Contractor Provided IT Infrastructure - Reserved

6.11 System Authorization Acess Request (SAAR), Defense Department (DD) Form 2875 - Reserved

6.12 MHS Systems Telecommunications - Reserved

6.13 Establishment of Telecommunications - Reserved

6.14 Contractors Located On Military Installations - Reserved

PART 7, ATTACHMENT 1

PERFORMANCE REQUIREMENTS SUMMARY

The Contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Objective (The Service required—usually a shall statement from Part 5)

PWS Reference Acceptable Quality Level (AQL) (This is the maximum error rate. It could possibly be “Zero deviation from standard”)

Method of Surveillance

Performance Requirements Summary (PRS) # 1.

The Contractor shall provide classifiable fingerprints to DCSA

PWS Part 5. Section 5.1.1

Fingerprints should be of quality acceptable to DCSA 98% of the time

Reviewing submission reports from DCSA – 100 Percent Inspection

PRS # 2

The Contractor shall properly transmit fingerprints to DCSA

PWS Part 5. Section 5.1.2

Fingerprints should be transmitted to DCSA using approved methods, there will be zero allowance for mislabeled mail transactions

Reviewing DCSA reports and audit of Contractor Dashboard – 100 Percent Inspection

PART 7, TECHNICAL EXHIBIT 1

DELIVERABLES SCHEDULE

Deliverable Initial Subsequent Submit To Applicable to:

CDRL A001 – Quality Control Plan

With Proposal Updated as required, within five (5) business days of Government Request

CO and COR All, See PWS 1.10.1

PWS Reference