Attachment 1 - Performance Work Statement (PWS)_DEERS Contract_20260121_v2.rtf

ATTACHMENT 1

PERFORMANCE WORK STATEMENT (PWS)

US Army Reserve Command (USARC) DEERS/RAPIDS Military Identification Card, Common Access Card and Mission Essential Services

12 November 2025

Part I General Information

1. GENERAL This action is for a Firm Fixed Price (FFP) Task Order (TO) with a cost reimbursement (no fee) line item for Other Direct Costs (ODCs).It is a performance-based acquisition non-personal services contract to provide administrative support services to the US Army Reserve Command (USARC) G-1, necessary for processing identification issuance requests and issuing identification badges for building and system access to eligible recipients in support of the USARC Identification Card Office (ICO). The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

The Government has identified all Contractor services performed under this contract as essential Contractor services that must be executed during emergency and/or crisis events (DFAR 252.237- 7023). All tasks listed in PWS Part 5, Specific Tasks, are mission-essential functions. Mission- essential functions means those organizational activities that must be performed under all circumstances to achieve DoD component missions or responsibilities. Failure to perform or sustain these mission essential functions would significantly affect DoD’s ability to provide vital services or exercise authority, direction, and control.

1.1. Description of Services/Introduction. Except for Government furnished items and services identified in part three of this Performance Work Statement (PWS), the Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform support services as defined in this PWS. The Contractor shall perform issuance of Identification (ID) cards and Common Access Cards (CAC), with Public Key Infrastructure (PKI), and provide program support services for the USARC/Army Project Office (APO). The Contractor shall manage site cardstock, supplies, and equipment to ensure no interruption in services service military personnel worldwide.

1.2. Background: The USARC Command currently operates ICOs in different locations throughout the United States. The main responsibility of these Common Access Card (CAC) offices is to provide Department of Defense (DoD) CACs and Uniformed Services Identifications (USIDs) to eligible recipients in order to ensure that authorized personnel have identifications to secure and allow efficient physical access to Government facilities, access to secure web sites, and email systems. The USARC ICOs are also tasked with operating identification issuance systems, and issuing CACs to uniformed service members, retirees, family members/dependents and other eligible recipients such as Contractors assigned to work with USARC.

The Defense Manpower Data Center (DMDC) is responsible for providing all functional oversight for the ICOs equipment, software and maintenance of the Defense Enrollment and Eligibility Reporting System (DEERS)/ Real-time Automated Personnel Identification System (RAPIDS) sites

1.2.1. The Army Project Office (APO)at Fort Knox, KY serves as the uniformed services executive agent; initiates, develops, coordinates, and publishes uniformed services procedural guidance regarding the Defense Enrollment Eligibility Reporting System (DEERS), the Real- Time Automated Personnel Identification System (RAPIDS), or applicable systems, ID cards, and is the point of contact for the CAC for the Army Chief Information Officer (CIO)/G6. The APO also assists the U.S. Army staff with development of Army ID card policy; developing personnel procedural guidelines; and assisting in publishing AR 600-8-14, Identification Cards and Defense Enrollment Eligibility Reporting system (DEERS) Policy. The APO implements DoD policy and procedures for worldwide use of the DEERS and RAPIDS programs. Furthermore, the APO responds to all Army inquiries regarding DEERS enrollment, ID card policy, and procedural interpretations. The APO provides guidance regarding DEERS/RAPIDS hardware and software issues. The APO represents the Army as a voting member of the Joint Uniformed Services Personnel Advisory Committee (JUSPAC) and serves as committee chairperson on a rotational basis with the other uniformed services.

1.2.2. The Department of Defense (DoD) instituted the DoD CAC/PKI program to address the increased need for higher levels of information assurance as well as addressing issues related to identity protection and management. The CAC/PKI program provides the means to achieve secure and efficient physical access to Government facilities, as well as electronic access to secure web sites and electronic mail. The DoD CAC also serves as the standard identification card for all uniformed services' active-duty members, selected reserves, DoD civilian employees, non-DoD federal eligible employees, eligible Contractors, and other eligible populations. The CAC, with its inherent imbedded technologies, is issued and maintained in part using the DEERS/RAPIDS), or applicable systems.

1.2.3. Execution of Homeland Security Presidential Directive–12 (HSPD-12) and implementing guidance contained in Federal Information Processing Standard (FIPS) 201-3 for personal identity verification, and other DoD instructions, and directive type memorandums (DTMs), have a significant impact on supporting RAPIDS infrastructure as well as modifications to CAC issuance business processes. Compliance with these directives, standards, and instructions require a broad range of planning, analysis and coordination between Office of the Undersecretary of Defense- Personnel and Readiness (OUSD (P&R)) and OUSD - Intelligence (OUSD(I)), the Army Project Office and the Defense Manpower Data Center (DMDC) to ensure efficient execution of this program.

1.3. Objective: The Contractor shall provide administrative support services and qualified personnel to effectively staff designated ICOs during their Hours of Operation as detailed in Technical Exhibit 3 – Facility Sites and Hours of Operation. The Contractor shall perform ID and CAC issuance support services by processing identification issuance requests and supporting the Government’s issuance of identification badges for building and system access systems, following the guidance of AR 600-8-14, 32 CFR PART 161, DODI 1000.13, DODM 1000.13 V1-V3 and other applicable policies. The government’s primary objectives for this TO are:

1.4. Scope: Given current operational demands, USARC requires the contractor to have at least one (1) individual that is considered the Site Security Manager (SSM) at each of the designated locations and be able to perform the duties outlined in Section 5 of this PWS. Note that all personnel under this contract shall be considered as Verifying Officials (VOs). Provides Contractor support services to meet the demands placed on in-house resources resulting from population increase of eligible recipients of military ID cards (military/civilian/contractor employees, DoD and non-DoD federal agency and other eligible populations). This requirement ensures CAC/PKI related programs are successfully implemented and sustained within the Army. The Contractor shall provide management, research, and advisory services as the principal interface for the USARC G-1/APO. The Contractor shall provide services as defined in this PWS, except for those items specified as Government furnished property and services. The Contractor shall perform to the standards in this work statement.

1.5. Period of Performance (PoP). The Period of Performance for this requirement shall consist of 12- month base period (inclusive of a 60-day entrance transition) and two (2) 12- month option periods.

1.6. General Information:

1.6.1. Quality Control: Quality Control is the responsibility of the Contractor. The Contractor is responsible for the delivery of quality services/supplies to the Government (see FAR Clause 52.246-4 Inspection of Services-Fixed Price).

1.6.1.1. The Contractor shall develop, implement, and maintain an effective Quality Control System which includes a written Quality Control Plan (QCP). The QCP shall implement standardized procedures and methodologies for monitoring and documenting contract performance to ensure all contract requirements are met. The Contractors’ QCP shall contain a systematic approach to monitor operations to ensure acceptable services, supplies and products described in the contract are performed at or above the standards defined in the PWS and Performance Requirements Summary (PRS). Any/all travel associated with execution of the Contractor’s QCP shall be included as part of the FFP, unless it is directed by the COR/ACOR.

1.6.1.2. The Contractor shall submit a QCP to the Contracting Officer (KO) for acceptance. The initial QCP shall be submitted within 30 days of contract award. Changes to the QCP shall be submitted to the KO and Contracting Officer’s Representative (COR) and shall be accepted by the KO prior to implementation. The QCP shall address as a minimum:

1.6.1.3. Quality of Services. Include a separate section which addresses the Contractor's method of managing quality of work. The QCP shall include a description of the inspection system used to address services listed in this PWS and a description of the methods to be used for identifying and preventing unacceptable quality of services performed. The plan shall also include tasks or areas to be inspected on a scheduled or unscheduled basis, frequency of inspections, how inspections are to be conducted and the percentage of work that will be inspected. The contractor shall provide names of the Contractor personnel who will perform the inspections. If applicable, include a system to inspect subcontractor services and products to ensure compliance with contract requirements, and applicable laws and regulations.

1.6.1.4. Methods of Communications. The QCP shall contain methods of communication (direct and indirect) with the Government regarding the performance of the contract. Communication shall include regular and formal meetings with the Government for review and analyses of key process indicators, analysis of process deficiencies, and problem resolution.

1.6.1.5. Deficiency Identification, Prevention and Correction. The QCP shall include a method of identifying and preventing deficiencies in the quality of services performed before the level of performance becomes unacceptable. The QCP at a minimum shall address process control and continuous process improvement; procedures for scheduling, conducting and documentation of inspections; discrepancy identification; procedures for root cause analysis; corrective and preventive action procedures to include procedures for addressing Government discovered non- conformances; procedures for trend analysis; and procedures for collecting and addressing customer feedback/complaints. The QCP shall document process control and process performance measurement procedures that shall include how the Contractor implements preventive corrective actions.

1.6.1.6. Inspection System. The contractor shall develop, implement and maintain a system to inspect their services as well as any subcontractor services and products to ensure compliance with PWS requirements, and applicable laws and regulations. It shall specify tasks or areas to be inspected on a scheduled or unscheduled basis, the manner in which inspections are to be conducted, the titles of the individuals who will perform the inspections, and the percentage of the work that will be inspected on a recurring basis.

1.6.1.7. Inspection Files. The contractor shall document all inspections conducted, and the necessary corrective and preventive actions will be taken. The contractor shall retain records on-site of all inspections conducted by the Contractor and necessary corrective action taken. Documentation of all contractor quality control inspections and corrective actions shall be maintained by the contractor throughout the term of this contract. These documents shall be available for inspection by the Government during the term of the contract.

1.6.1.8. Customer Comment Processing System. The QCP shall detail a customer comment processing system for correction of COR validated comments received through the Interactive Customer Evaluation (ICE) program, verbally or other means. The system should be designed to provide feedback to the Government based on customer contact, investigation of derogatory comments, rebuttal to derogatory comments, or corrective action(s). The contractor shall document all customer complaints and report the complaint to the COR within one workday after receipt of complaint. These complaints shall be included in the Program Manager’s Weekly and monthly Status Report submitted to the COR. The contractor shall use electronic mail or other written memoranda as notification. Each customer complaint reported to the COR shall have a scheduled completion date subject to COR approval. The Government collected and graded customer satisfaction comment cards will be part of the Government’s performance evaluation process. Obtaining more than two (2) COR verified customer complaints per location per month, with no more than 10 complaints per month overall, may result in a Non-Conformance Report (NCR). Trends of less than acceptable performance could result in a negative CPARS rating.

1.6.2. Quality Assurance: The COR shall evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the COR must do to ensure that the Contractor has performed in accordance with the performance standards.

It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s). When an observation indicates defective performance, the COR will require the Contractor or designated on-site representative to initial the observation to acknowledge the defective performance. The acknowledgement of the observation does not necessarily constitute Contractor concurrence with the observation, only that the Contractor has been made aware of the defective performance.

1.6.3. Contracting Officer (KO): The KO is the only person authorized to direct changes in any of the requirements under this contract, and, notwithstanding any provisions contained elsewhere in this contract, said authority remains solely with the KO. In the event the Contractor makes any change at the direction of any person other than the KO, the change shall be considered to have been made without authority and solely at the risk of the Contractor. All contract administration will be affected by the KO. Communications pertaining to contractual administrative matters shall be addressed to the KO. No changes in or deviation from the terms and conditions shall be affected, without a written modification to the contract, executed by the KO authorizing such changes. The KO will approve all submittals and plans unless otherwise noted or required by this PWS.

1.6.4. Contracting Officer Representative (COR): The KO will designate a COR to perform contract oversight IAW AR 70-13, Management and Oversight of Service Acquisitions. The KO will also appoint an ACOR to assist the COR with contract surveillance. The COR/ACOR will have authority to take certain actions specifically provided and within the limitations prescribed in the designation. A copy of the designation will be furnished to the Contractor. In no event will the COR/ACOR, by virtue only of his/her designation as such, be empowered to execute or agree to any contract modification thereof. The KO will retain the ultimate responsibility for the administration of the contract. Any discrepancy resulting from coordination with or advisement from the COR/ACOR shall be addressed, in writing, to the KO.

1.6.4.1. COR/ACOR Functions. The COR/ACOR monitors all technical aspects of the contract and assists in contract administration. The COR/ACOR is authorized to perform the following functions: Assure the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements; monitor, document, and report Contractor's performance and notify both the KO and Contractor of any deficiencies, and coordinate site entry of Contractor personnel.

1.6.5. Government Technical Monitor (GTM). While a COR is the only officially appointed representative of the KO, given the scope and complexity of some service contracts, other individuals may assist the COR in monitoring the Contractor’s performance against the requirements in the contract. These individuals will be identified as GTMs and will be assigned to all facilities. The most common reason for designating additional technical monitors to support the COR is physical proximity to the Contractor’s worksite, although they may also be appointed because of special skills or knowledge necessary for effective monitoring of the Contractor’s work. The requiring activity will designate GTMs necessary to aid the APO and COR in observing the Contractor’s performance and reporting discrepancies to the APO and COR. The GTM is not empowered to make any contractual commitments or authorize any changes to the contract or in any way obligate additional funds by the Government, such authority rests solely with the KO.

1.6.6. Non-Conformance Report (NCR). When the Contractor’s performance is unsatisfactory, an NCR will be issued. An NCR will be used whenever necessary in the administration of the contract to formally document nonconforming performance. The Contractor shall reply to the KO in writing and within the period specified in the NCR, giving the reasons for the unsatisfactory performance, corrective action taken, and procedures to preclude recurrence.

1.6.7. Mission-Essential Contractor Services Plan. The Contractor shall submit a contingency plan for performing all Mission-Essential Contractor Services IAW DFAR 252.237.7024. The plan shall establish procedures, identify personnel, document essential services, and identify the means of maintaining essential services during disasters and emergency crisis events, to include pandemics. Disaster means natural disasters (e.g., earthquake, major storm, flash flood, or hurricane), utility outage, terrorist attack, or other special circumstances identified by the Government. Any changes made to the Mission-Essential Contractor Services Plan shall be submitted to the COR/ACOR and KO no more than 10 days prior to implementation.

1.6.8. Safety Plan. The Contractor shall submit a written comprehensive safety and health plan to the KO, COR/ACOR within 30 calendar days of contract award. The plan shall meet all applicable federal, state, and local environmental, health, and safety regulations as well as providing Contractor’s employees with the necessary training.

1.7. Recognized Federal Holidays: Federal law (U.S.C. 6102) establishes the below holidays. The Contractor shall not be required to perform services on recognized federal holidays. The recognized federal holidays include:

1.7.1. When a holiday occurs on a Saturday, Federal employees are normally granted the previous Friday as the holiday observance. When a holiday occurs on a Sunday, Federal employees are normally granted the following Monday as the holiday. The Contractor shall work on the days the Government is scheduled to work. The Department of Labor (DOL) wage determinations applicable to this contract may require additional holidays than those stated above. The Contractor is responsible for complying with wage determination requirements and all other appropriate DOL laws and regulations.

1.7.2. When an unforeseen installation closure occurs on a regularly scheduled day of work, the Contractor will have the following options: Reschedule the work so it is performed the following day unless the following day falls on a weekend

1.7.3. Reschedule the work on any day that is mutually satisfactory for the Contractor and COR/ACOR IAW federal and state labor laws

1.7.4. Hours of Operation. The Contractor shall be responsible for providing services at all designated ICOs during the Hours of Operation as detailed in Technical Exhibit 3, Monday through Friday except Federal holidays (or any other holidays in accordance with [IAW] DOL guidance) or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. Hours of operation may vary per location, but most locations are open from 7:30 am to 4:00 pm. local time. The Contractor shall coordinate with the USARC G-1/APO to obtain approval for modifying the hours of operation and business work week. The Contractor shall at all times maintain a workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons, to ensure stability and continuity of the workforce. Specific allowances may be made to accommodate situations to adjust operating hours in the event of adverse weather or other situations that risk personal safety and cause installation closure. Contractor personnel shall not exceed a 40-hour work week; flexible work schedule may be considered.

1.7.5. Place of Performance. Contractor shall have routine access to Government-controlled facilities. The work to be performed under this contract shall be performed in the Continental United States (CONUS), Puerto Rico, American Samoa and Saipan at the designated ICOs as indicated in Technical Exhibit 4. Contractor is not permitted to telework unless approved by COR/ACOR.

1.8. Security Requirements:

1.8.1. Security Clearance. Contractor personnel performing work under this contract shall have an opened National Agency Check with Inquires (NACI) Tier 1 investigation at the time of their performance start date and shall maintain a favorable NACI for the duration of their performance under the contract. Contractor personnel co-located at the USARC G-1 shall have an opened Tier III Secret Clearance prior to commencement of work under this contract due to the restricted access of the building in which they will be required to work. Contractor personnel shall comply with all applicable security and safety regulations, guidance, and procedures, including local, as referenced in this PWS and in effect at the work sites. Contractor personnel shall be responsible for safeguarding information of a confidential or sensitive nature. Failure to safeguard any privileged information which may involve the Contractor or the Contractor’s personnel or to which they may have access may subject the Contractor and/or the Contractor’s employees to criminal liability under Title 18, section 793 and 7908 of the United States Code. Provisions of the Privacy Act apply to all records and reports maintained by the Contractor. Security requirements for this contract are as stated in Technical Exhibit 6. Contractor shall comply with National Industrial Security Program Operating Manual (NISPOM) (DoD 5220-22-M) and Industrial Security Regulation (DoD 5220.22-R). Contractor personnel shall meet requirements IAW DODD 8140.01. For more information, please visit http://www.dss.mil. Personnel Security Clearances must be kept to an absolute minimum based on contractual needs.

1.8.1.1. Threat Awareness Reporting Program. Contractor shall comply with AR 381-12 Threat Awareness and Reporting Program (TARP). Contractor shall complete the TARP training within 30 calendar days of commencement of work under this contract and annually thereafter. The PM shall ensure that contractor employees receive their annual TARP training by a CI agent or other trainer as specified in 2-4b of AR 381-12.

1.8.1.2. Security Clearance requests shall be requested through the Contractor’s Facility Security Officer (FSO) based on bona fide contractual occupational requirement.

1.8.2. Common Access Card Issuance:

1.8.2.1. Contractor employees require access to Government systems in order to perform services under this contract and shall obtain a DoD CAC. Contractor personnel are required to obtain a CAC prior to the start of full performance.

1.8.2.2. USARC Access. Contractors located at USARC shall also obtain a USARC Access Badge. The CAC and USARC Access Badge shall be worn at all times, when performing work under this contract, to include attending government meetings and conferences. Unless otherwise specified in the contract, Contractor personnel shall wear the CAC and USARC Access Badge in a conspicuous place on the front of exterior clothing and above the waist, except when safety or health reasons prohibit such placement or when CAC is being used for computer access.

Reference DoDI 5200.46 Investigative and Adjudicative Guidance for Issuing the Common Access Card (CAC), Issuance and Revocations.

1.8.2.3. Proof of employment and security clearance / favorable background check IAW with DoD Regulation 5200.46 is required before a CAC will be issued authorizing access to the Installation and Government computer systems. CACs may not be issued to Contractor employees unless a data record authorizing CAC issuance is resident in the Defense Enrollment Eligibility Reporting System (DEERS). The Mission Partner Identity, Credential and Access Management (MP ICAM) system, or applicable system, is a secure and authorized means of entering Contractor data into DEERS in addition to automating the CAC application and approval process. In order to enter Contractor data into MP ICAM, the Contractor data must be resident in Defense Information System for Security (DISS). Personnel who are not in DISS will be required to register at a site where an equivalent background vetting will be accomplished IAW FIPS 201-3. The Contractor shall account for all forms of Government-provided identification credential issued to its employees in connection with performance under the contract.

1.8.2.4. CAC Registration Process. No later than (5) five business days from employee hire or employee replacement under this contract, the Contractor shall submit applicable CAC registration documentation to the COR/ACOR for all personnel requiring a CAC. Be advised that CAC issuance is restricted and should be limited to Contractor personnel directly assigned to support this contract.

1.8.2.5. The Contractor shall develop, maintain, and provide to the COR/ACOR an updated roster which shall include names and positions of all Contractor personnel as well as indicating which employees were issued CAC or other forms of government identification cards or badges. The Contractor shall submit initial roster to the COR/ACOR prior to the end of the phase-in period and within 5 calendar days of any changes.

1.8.2.6. The Contractor shall immediately notify the CORs and KO of all lost, stolen, or damaged CACs within 24 hours of issue occurrence. The Contractor shall collect the CAC and other government issued forms of identification prior to termination of an employee, or at the end of the contract performance period. The CAC and other government issued forms of identification shall be returned to the COR/ACOR within one (1) hour of employee termination, or at the end of contract performance period, whichever comes first. If an employee is transferred to another Army contract, they shall retain their CAC and will coordinate with their Mission Partner Affiliation Sponsor (MPAS) for transfer in the Mission Partner Identity, Credential and Access Management (MP ICAM) system. Final payment may be delayed if Contractor fails to comply with these requirements.

1.8.3 National Industrial Security Program (NISP). The Contractor shall implement and maintain a security program for control of personnel, property, and information, including, unclassified and classified materials, documents, and records. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” or “Secret,” and requires Contractors to comply with (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); any revisions to DOD 5220.22-M, notice of which has been furnished to the Contractor. In addition, the Contractor’s security program shall include provisions for, but not limited to:

1.8.4. Operations Security (OPSEC): The Contractor shall develop an OPSEC Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Requiring Activity OPSEC officer, per Army Regulation (AR) 530-1, Operations Security (See DoD DI- MGMT-80934C of the base contract).

The OPSEC Plan shall include the Government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how the Contractor will protect it. In addition, the Contractor shall identify an individual who will be the Contractor's OPSEC coordinator. The Contractor shall ensure this individual becomes OPSEC Level II certified per AR 530-1.

1.8.4.1 Initial and Annual Operations Security (OPSEC) awareness training IAW AR 530-1. Operations Security, new contract employees shall complete Level I OPSEC training within 30 calendar days of their reporting for duty and annually thereafter. OPSEC training link– https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf under EUC-ECJ6-110-N. Training status shall be reported in the monthly reports and training certificates made available upon request.

1.8.4.2 Receiving, storing, disseminating, transmitting, transporting, and protecting items classified as CONFIDENTIAL or SECRET by the Government, including the use of courier cards.

1.8.4.3. In-processing and out-processing Contractor personnel for security matters.

1.8.4.4. Obtaining Contractor personnel security clearances.

1.8.4.5. Documenting and reporting actual and potential security problems.

1.8.4.6. Initiating proper procedures to correct documented problems and implementing corrective procedures in the Contractor's security program.

1.8.4.7. Filing Classified Documents. All Government-furnished classified and unclassified files in existence at the contract performance start date and those generated under this contract shall be maintained in accordance with AR 25-400-2 or other applicable regulations. Files shall be transferred to the KO or designated representative upon completion of the contract period or last day of contract performance, whichever comes first. Such files are the property of the U.S. Government. The Contractor shall provide security of classified documents in accordance with AR 380-5 and DOD 5200.1-R, NISP Operating Manual.

1.8.5. Physical Security Plan. This portion of the Contractor’s security program shall address physical security aspects associated with contract performance and describe how the Contractor shall prevent unauthorized access, vandalism, pilferage, larceny, sabotage, and arson directed toward Contractor-controlled facilities and Government Furnished Property (GFP). The following regulations shall apply when developing the physical security plan: ARs 190-11, 190- 13, and 190-51; Department of Defense (DOD) 4500.9-R, and Department of Defense Instruction (DODI) 5100.76 and DODI 5220.22, and applicable policies which shall be provided by the Government customer. The Contractor shall develop and implement a physical security plan in accordance with AR 190-13. Physical Security Plan shall be submitted to the CORs within ninety (90) calendar days of contract award.

1.8.5.1. Safety: The contractor shall perform work in a safe manner as required by OSHA Safety and Health Requirements. Provide a verbal notification to the KO as soon as possible of each occurrence of damage to Government property or an accident resulting in death, injury, occupational disease, or adverse environmental impact. Provide a completed copy of required Accident Investigation Reports to the KO within five (5) calendar days of each occurrence.

1.8.5.2. Environment and OSHA: The Contractor shall comply with all local, state, and Federal environmental and occupational safety laws, rules, and regulations. Any apparent conflict between compliance with such local, state and Federal laws, rules and regulations, and compliance with the requirements of the contract shall be immediately brought to the attention of the KO and/or the COR final resolution. The Contractor shall notify the KO and COR in writing in addition to any verbal notification of such conflicts. The Contractor shall be liable for all fines, penalties, and costs which result from violations of, or failure to comply with, all such local state, or Federal laws, rules, and regulations. All unsafe acts or conditions fostered by the Contractor or Contractor personnel may be grounds for the KO or COR, to halt all Contractor performance with a commensurate deduction of monies due the Contractor until such unsafe conditions are corrected. The Contractor shall take due caution not to endanger personnel during performance of this contract. Upon discovery of any hazard such as, but not limited to, fire, or large fuel spill, the Contractor shall immediately notify the KO and COR.

1.8.6. Key Control: The Contractor shall include in the physical security section of the Contractor’s security program a key control plan IAW applicable regulations, policies and directives ensuring keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The key control plan shall include requirements of AR 380-5, if classified materials are being stored. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the CORs and the Building Facility Manager.

1.8.6.1. In the event keys are lost or duplicated, the Contractor shall, upon direction of the KO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re- keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.8.6.2. The Contractor shall prohibit the use of Government issued keys/key cards by any person other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of people other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the KO.

1.8.7. Lock Combinations. The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s security program plan.

1.8.8. Access and General Protection/Security Policy and Procedures. All Contractor personnel performing work under this contract shall comply with applicable installation, facility and area commander installation/facility access, local security policies and security procedures provided by the Security Manager Government representative.

Contractor personnel shall provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of Emergency Services or Security Office.

1.8.9 Contractor personnel shall comply with all personal identity verification requirements as directed by Department of Defense (DoD), HQ Department of Army (DA) or local policies. In addition to the changes otherwise authorized by this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor and subcontractor security matters or processes.

1.8.10. Information Security Plan:

1.8.10.1. The Contractor shall develop and implement an Information Security Plan IAW AR 380-5 AR 380-67, to AR 380-5, for the control of classified information. The Contractor’s information security program shall include applicable provisions of AR 380-series regulations. This Information Security Plan shall be submitted to the CORs within ninety (90) calendar days of contract award.

1.8.10.2. Information Assurance (IA)/Information Technology (IT) Training. The Contractor employees working in IA/IT functions shall comply with DoD and Army training requirements in DoDD 8570.01, DoDD 8570.01-M and AR 25-2 within 180 days of employment.

1.8.11. Systems Access. When requested by the Government, the Contractor shall provide access to and information regarding the systems that the Contractor operates or maintains on behalf of the Government under this contract.

1.8.12. Contractor-Owned and Operated Information Systems. The Contractor shall comply with all requirements of AR 25-2, Cybersecurity. Installation of non- Government- owned computing systems or devices without prior authorization of the appointed Designated Approving Authority (DAA) including but not limited to universal serial bus (USB) devices, external media, personal or Contractor-owned laptops, and mobile computer devices is prohibited. All Contractor-owned and operated information systems shall meet all security requirements for Government-owned hardware and software when operating on the Army Enterprise Infostructure (AEI) or any DoD or Federal Agency network, managing, storing, or processing Army, DOD, or Federal Agency data or information, or conducting official communications or business.

1.8.13. Data Security. Contractor personnel shall physically or electronically protect Government data when not in use and/or under the control of an authorized individual. The Contractor is responsible to abide by, and ensure compliance with, security requirements stipulated in the DoD Verifying Official (VO) certification practice statement (CPS) and the X.509 certificate policy for the DoD.

Furthermore, the Contractor should anticipate working with DoD information technology (IT) systems that require strict adherence to the DoD, and Army security investigation policies in effect at the time an employee is assigned to work on the contract. Provisions of the privacy act apply to all records and reports maintained by the Contractor.

During the course of contract performance, when Government data is no longer needed or required to be retained under applicable Government records retention policies, the Contractor shall destroy it through means that will make the data irretrievable (i.e., permanently unavailable for access by any person). The Contractor shall only use Government data obtained under a contract for purposes of the contract and shall not collect or use such information for any other purpose without the prior written approval of the KO. At expiration or termination of a contract, the Contractor shall coordinate with the KO to either turn over all Government data managed under the contract that is in its possession to the Government or successor Contractor, or if the Government so directs, destroys the Government data.

1.8.14. Personally Identifiable Information (PII) and Protected Health Information (PHI). The contractor shall comply with the Privacy Act and all applicable agency regulations on individual privacy, to include DoD Directive 5400.11 “Department of Defense Privacy Program” and DoD 5400.11-R, Department of Defense Privacy Program. Failure to safeguard information which may involve the contractor or the contractor’s personnel or to which they may have access may subject the contractor and/or the contractor’s employees to criminal liability under 5 U.S. Code § 552a. Provisions of the privacy act apply to all records and reports maintained by the contractor IAW Heath Insurance Portability and Accountably Act of 1996 (HIPAA), Personally Identifiable Information (PII), Protected Health Information (PHI), and AR 25-2. The contractor shall safeguard information of a confidential or sensitive nature, also known as PII and PHI. In addition, the contractor, unless otherwise authorized by the Government, shall limit access to PII and PHI to those employees who require the information in order to perform their official duties under this contract.

1.8.14.1. PII/PHI Data Security. The Contractor, unless otherwise authorized by the Government, shall limit access to PII to those employees who require the information to perform their official duties under this contract. The Contractor, and their employees, shall physically or electronically protect PII/PHI when not in use and/or under the control of an authorized individual. During the course of contract performance, when PII/PHI is no longer needed or required to be retained under applicable Government records retention policies, the Contractor shall coordinate to either turn over the PII to the Government or destroy it through means that will make the PII irretrievable (i.e., permanently unavailable for access by any person). The Contractor shall only use PII/PHI obtained under this contract for purposes of the contract and shall not collect or use such information for any other purpose. At expiration or termination of this contract, the Contractor shall coordinate to either turn over all PII/PHI managed under the contract that is in its possession to the Government or successor Contractor, or if the Government so directs, destroy the PII/PHI.

1.8.14.2. PII Systems Security. The Contractor shall encrypt all Contractor-owned laptops or other portable media storage devices that process or store PII, in accordance with FIPS 140-3 (or successor). The Contractor shall require FIPS 140-3 (or successor) encryption of any sensitive PII when transmitted electronically across the internet or other public networks.

1.8.14.3. PII Data Breach Response and Notification. The Contractor shall adhere to the reporting and response requirements for PII/PHI set forth in DoD 5400.11- R, Department of Defense Privacy Program.

The Contractor shall immediately (within one hour) notify the USARC G-1/APO upon discovery that a suspected or actual breach of PII/PHI has occurred. The notification shall include, /PHI the greatest extent possible, the identification of each individual whose PII has been or possibly has been breached. In addition, the Contractor shall provide the USARC G-1/APO with any other available information that must be included in required breach reporting and notifications.

The Contractor shall provide this information at the time of the initial notification to the Government or promptly thereafter as information becomes available. The Government will determine whether a breach of PII/PHI has occurred, and whether breach notification to affected individuals is required. If breach notification to affected individuals is required, the Government will determine if the Contractor shall make the required notification. If the Contractor is to notify the impacted population, it shall submit the notification letters to the USARC G-1/APO for review and approval.

1.8.15. Communications Security (COMSEC). All communications with DoD organizations are subject to COMSEC review. The Contractor shall be aware that telephone communications, and IT networks are continually subject to intercept by unfriendly intelligence organizations. DoD has authorized the military department to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DoD organizations. Therefore, the Contractor is advised that any time it places a call or receives a call it is subject to COMSEC procedures. The Contractor shall assume the responsibility for ensuring wide and frequent dissemination of the above information to all employees dealing with DoD information. The Contractor shall be aware of, and abide by, all Government regulations concerning the authorized use of the Government’s computer network (i.e., viewing pornographic material or restricted/subversive sites on the web), including the restriction against using the network to recruit Government personnel or advertise job openings.

1.8.16. Cyber Incident Reporting. The Contractor shall comply with DFARS 252.204- 7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. The contractor shall implement applicable security controls listed in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, "Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations" to safeguard covered defense information that is processed or stored on their internal information system or network. The contractor shall provide "adequate security" (as defined by DFARS 252.204-7012) for covered defense information that is processed, stored, or transmitted on the Contractor's internal information system or network

1.8.17. Contractor’s Security Representative. The Contractor shall designate an employee to serve as the Contractor’s Security Representative. Within three business days after contract award, the contractor shall provide, in writing, the name, title, e-mail address and phone number for the Contractor’s Security Representative. The Contractor’s Security Representative shall be the primary point of contact on any security matter and shall not be replaced or removed without prior notice to the KO and the CORs.1.9. Training Requirements: The Contractor shall track all training requirements and ensure that all employees working on this contract are compliant. If the training requirements are not met, the Government (installation or command) may refuse access to systems or work location. The Contractor shall maintain a training file for each employee (to include copies of all training certificates) and make it available for inspection upon request from the Government. The Contractor shall comply with and participate in any pertinent Army, command, and installation security training programs when performance or services will occur on a Government installation, and the Contractor employee(s) are embedded or integrated into the Government activity or office. The Contractor shall summarize employee training status on monthly reports. The employee training status section of the monthly reports shall include the following details for each employee: employee name, job title, site location, employment start date, name of trainings completed (OPSEC, iWatch, CTIP, etc.), and completion date for each training requirement.

1.9.1. Contractor is responsible for ensuring personnel complete the following required training within 30 days of contract start, or 30 days after a new employee(s) hire, and annually thereafter:

Antiterrorism Level 1 – Available at https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf under JS-US007.

OPSEC – Available at https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf under EUC-ECJ6-110-N.

Cyber Awareness – Log into https://cs.signal.army.mil/login.asp , click "Proceed to EAMS-A Login". Once you get to EAMS-A login using your CAC, under DoD Cyber Awareness Training click "Take Training". After completing the Cyber Awareness training, click on the “Sign Mandated Army IT User Agreement”.

Controlled Unclassified Information (CUI) – Available at https://securityawareness.dcsa.mil/cui/index.html Combating Trafficking in Persons – Available at https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf under CTIP-GA-US011 Sexual Assault Prevention and Response Training (SAPR/SHARP) - Available at https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf under JS-US021 TARP- https://learn.atis.army.mil/; search for "TARP" under catalog iWATCH

1.9.2. RAPIDS Training: Contractor will ensure all personnel supporting this contract are initially certified, and re-certified annually in RAPIDS. Contractor employees shall complete RAPIDS certification within seven (7) business days after contract start or seven (7) business days after a new employee(s) hire.