Attachment 1_PWS.docx

Forward Networks Enterprise – EL

CUI

Forward Networks Enterprise – EL

CUI

PERFORMANCE WORK STATEMENT (PWS)

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator See DITCO Additional Text G1 - Points of Contact

2. Contract Title. Forward Networks Enterprise – Enterprise License (EL)

3. Background. The Department of Defense (DoD) has been utilizing Forward Networks’ software since 2025 to enhance network assurance and verify Zero Trust Architecture (ZTA). This capability was procured on a restrictive, per-device basis via the DISA Capacity Services Communications II (CSCII) contract vehicle, which successfully established a baseline "Digital Twin" and proved the platform’s technical value. However, recent federal directives, including the Presidential Executive Order on Artificial Intelligence (AI), mandate a rapid expansion of secure AI enclaves, projecting exponential network device growth. The legacy per-device licensing model is financially and administratively unsustainable at this scale. It creates severe administrative burdens and risks leaving critical joint-warfighter networks unmonitored. To address these challenges, the Government must transition from the decentralized per-device model to an EL model. This effort builds directly upon the work already accomplished, simplifies vendor management, and provides the unrestricted scalability necessary to secure critical AI infrastructure at machine speed.

4. Objectives. The primary objective of this contract is to procure a Forward Networks EL that transitions DISA from a restrictive, decentralized licensing model to a centrally managed, unlimited-use software EL. This transition will establish a predictable, flat-rate pricing structure, eliminating per-device financial penalties and providing the unrestricted scalability required to support the DoD Information Network’s (DoDIN’s) exponential devices growth. Furthermore, the contract aims to ensure mission readiness by delivering the critical network modeling and predictive verification capabilities necessary to secure advanced AI enclaves, in direct alignment with the Presidential Executive Order on Artificial Intelligence. Finally, by deploying dedicated Original Equipment Manufacturer (OEM) Resident Engineering support, the Government will accelerate the integration of the digital twin, automate ZTA compliance, and create a unified, queryable operational picture across DISA’s complex, multi-vendor environment.

5. Scope. The scope of this contract is enterprise-wide, encompassing all DISA-owned and -operated network infrastructure across physical, virtual, and multi-cloud environments to include the Combatant Commands (COCOMs). The EL provides comprehensive, flat-rate licensing to cover all devices across unclassified (e.g., Non-classified Internet Protocol Router Network (NIPRNet)) and classified (e.g., Secret Internet Protocol Router Network (SIPRNet), specialized joint-warfighter enclaves) domains.

This ensures complete coverage as the DoDIN expands, guaranteeing full visibility and security assurance for all mission-critical assets. The general scope of work required includes, but is not limited to, the following high-level operational tasks:

· Platform Provisioning and Architecture Setup: The contractor shall provision the enterprise license and establish the hosting architecture across both unclassified and classified enclaves. The contractor shall ensure the platform operates in strict compliance with DoD Cloud Computing Security Requirements Guide (CC SRG) Impact Level (IL) 5 through IL7 standards.

· Ongoing Implementation and Scaling Support: Leveraging the ongoing, in-flight implementation, the contractor shall deploy dedicated, Top Secret, Sensitive Compartmented Information (TS/SCI)-cleared OEM Resident Engineers to rapidly ingest, configure, and parse new network devices as they are introduced.

· Continuous Mathematical Digital Twin Modeling: The contractor shall configure the software to continuously collect and normalize configuration and state data from over 30+ disparate hardware and cloud vendors into a single, unified database, creating an always-accurate, mathematical software replica of the global network topology.

· Zero Trust and Behavioral Intent Implementation: The contractor shall design, write, and deploy customized Network Query Engine (NQE) scripts and automated Behavioral Intent checks. This work will mathematically verify that all active network paths comply with DoD ZTA micro-segmentation guidelines, specifically isolating sensitive AI model weights and training datasets.

· Pre-Deployment Change Modeling and Simulation: The contractor shall integrate the platform's behavioral "What-If" sandboxing capabilities into standard network operations workflows, enabling DISA engineers to simulate routing, firewall, and access control changes prior to production deployment to eliminate human-error outages.

· Program Management and Mission Onboarding: The contractor shall provide centralized governance, reporting, and customer service operations. This includes developing onboarding guides to facilitate the rapid, frictionless integration of new joint-warfighter network enclaves under the enterprise licensing structure.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 10% of the contractor’s total proposed cost/price for the base and all option periods.

6. Performance Requirements.

The Contractor shall provide the software, services, and support necessary to meet the functional, enterprise licensing, engineering, asset management, and program management requirements detailed in the subtasks below.

6.1 Subtask 1 - Functional Requirements (Software Capabilities) The Contractor shall provide a core software capability that creates a mathematically precise, scaled "Digital Twin" of the entire hybrid network to continuously verify Zero Trust security, predict configuration errors, and treat infrastructure as code. The software shall proactively calculate all possible packet paths across the network fabric without relying on live traffic to guarantee ZTA micro-segmentation enforcement. Specific functional requirements shall include, but are not limited to:

· Mathematical State Calculation: The capability to calculate all possible network forwarding paths simultaneously spanning Open Systems Interconnection Layer 2 through Layer 4 policy logic, rather than relying on active ping/traceroute network simulation injections.

· Pre-Deployment 'What-If' Sandboxing: A built-in behavioral sandbox allowing Agency engineers to modify configuration text files, routing tables, and security ACLs inside the digital twin environment to verify the exact blast radius and policy impacts prior to pushing changes to production infrastructure.

· Unified Multi-Cloud/On-Premises Abstraction: The capability to abstract hardware configuration logic from over 30+ disparate network hardware vendors alongside native public cloud entities into a single, vendor-neutral queryable database.

· Behavioral Intent Verification: The capability to continuously audit the network to verify that behavior matches security intents (such as Zero Trust policies) and trigger proactive alerts before issues cause outages, rather than simply checking if a device is "up."

· Vendor-Agnostic Normalization: The capability to aggregate and normalize configuration and state data across multi-vendor on-premise hardware and major cloud platforms into a single console.

6.2 Subtask 2 - Enterprise License Requirement

Secret, NIPRNet, and SIPRNet accesses are required to support: The Contractor shall provide an EL that maximizes the aforementioned capabilities by providing device scalability at a fixed annual cost. The EL shall cover all DISA managed and/or owned devices regardless of classification (NIPRNet, SIPRNet, etc.). As the Government's AI infrastructure devices expand, this flat-rate EL shall eliminate the financial penalties of per-device licensing, remove administrative burdens for contract modifications, and ensure no newly deployed AI enclave is left unsecured due to licensing constraints.

6.3 Subtask 3 - OEM Engineering Services Requirement

Secret, TS, SCI, SIPRNet, SCI, and NIPRNet accesses are required to support technical participating in classified architectural planning sessions, reviewing highly sensitive network diagrams, and developing specialized NQE scripts that model secure enclaves. Additionally, program management responsibilities requiring up to TS/SCI access include overseeing the classified segments of the Program Management Office (PMO), reviewing sensitive, multi-domain system health and device ingestion reports, managing risk mitigation strategies for classified AI enclaves, and participating in closed-door Program Management Reviews (PMRs) where classified network vulnerabilities, threat models, and operational defense strategies are formally briefed. SIPRNet Access: Is required for email communication and computing requirements at the Secret level.

The Contractor shall provide dedicated embedded OEM Resident Engineer support to accelerate system deployment, implementation, and daily operations. The Contractor shall provide deployment, implementation, test plans and reports to facilitate system deployment, implementation, and daily operations. Support shall ensure long-term operational value and include:

6.3.1 Subtask 1 - Platform Deployment & Tuning:

The Contractor shall lead the end-to-end installation, configuration, and scaling of the solution across physical, virtual, and multi-cloud networks; optimize data collection schedules and ensure all network devices are properly credentialed and parsed. The Contractor shall provide Platform Installation & Tuning report. Further, the contractor shall perform the following:

· Assist with configuring and tuning the Forward Networks platform.

· Monitor usage and suggest improvements for better performance and efficiency.

6.3.1.1 Subtask 1 - Creation of Dashboards and Key Performance Indicators (KPIs) The contractor shall collaborate with DISA to define KPIs relevant to their network management and performance. The contract shall develop and configure custom dashboards within the Forward Networks platform to visualize the defined KPIs. The contractor shall ensure dashboards provide actionable insights into network performance, security, and operational metrics. The contractor shall provide training on how to use and interpret the dashboards and KPIs. The contractor shall regularly review, and update dashboards as needed to reflect changes in network priorities and objectives. The Contractor shall provide Custom KPI Dashboard.

6.3.2 Subtask 2 - Custom Query & Intent Development:

The Contractor shall write custom queries to audit specific configuration standards unique to the agency; develop and maintain Behavioral Intent Checks to continuously verify Zero Trust policies and security segmentation. The Contractor shall provide Custom Query Repository, Behavioral Intent Check Repository, and Automated Workflows & Assessment.

6.3.3 Subtask 3 - API & Ecosystem Integration:

The Contractor shall integrate the solution with existing IT Service Management tools (e.g., ServiceNow), security information and event management (e.g., Splunk), AIOps tools, and IPAM systems; automate workflow triggers based on network verification discrepancies. The Contractor shall further perform the following:

· Assess customer network environment and requirements.

· Plan and execute the deployment of the Forward Networks platform.

· Work with customer representatives on the integration of the Forward Networks platform with other tools and platforms, such as monitoring solutions, ticketing systems, and security platforms.

6.3.4 Subtask 4 - Operational & Incident Support:

The Contractor shall assist in rapid troubleshooting during network outages or security incidents using the digital twin's path analysis and historical snapshots; conduct post-incident forensic reviews to determine exactly why and when network behavior deviated from the baseline.

· Provide on-site technical support to address any issues or concerns.

· Troubleshoot and resolve technical problems in a timely manner.

· Escalate issues to Forward Networks support teams when necessary.

6.3.4.1 Subtask 1 - Network Mapping & Vulnerability Management The Contractor shall perform the following:

· Conduct a comprehensive assessment of DISA's network infrastructure.

· Utilize the Forward Networks platform to create a detailed map of the network topology.

· Identify and document all network devices, connections, and configurations.

· Provide a visual representation of the network to aid in understanding and managing the infrastructure.

· Conduct a thorough analysis of DISA's network for potential security vulnerabilities.

· Utilize Forward Networks to identify and manage vulnerabilities.

· Evaluate vulnerabilities using Common Vulnerabilities and Exposures (CVE) to understand their impact and relevance.

· Assess compliance with Security Technical Implementation Guide (STIG) standards and best practices.

· Provide a detailed report on the security posture of the network.

· Provide a Network Topology Map.

· Provide Vulnerability (CVE) Reporting, Security Compliance Auditing Reporting, and Post-Incident Forensic Reports.

6.3.5 Subtask 5 – Assessment and Authorization (A&A)

The Contractor shall provide expertise, knowledge, understanding, support and implementation of all phases of the Risk Management Framework (RMF) and A&A lifecycle in support of Forward Enterprise software. The Contractor shall provide security engineering to the Government and execute A&A activities for development, test, and production systems to maintain compliance with DoD 8500 series publication. All personnel supporting A&A, or other information assurance functions, shall have the appropriate Information Assurance Certification in accordance with DoDI 8570.1 or applicable superseded DoD manuals.

The Contractor shall perform all required activities to meet the conditions of the Authority to Operate (ATO) to include:

a) The Contractor shall operate and maintain the software, IT subscriptions, service subscriptions and within the Government-approved infrastructure to include updating, patching, STIG’ing, and vulnerability scanning in accordance with DISA and DoD standards. The Contractor shall install and configure hardware and/or software and provide A&A accreditation support.

b) The Contractor shall scan the system monthly using an instance of the Assured Compliance Assessment Solution (ACAS) using DISA required plug-ins in accordance with the ATO.

c) The Contractor shall continuously remediate system vulnerabilities, as discovered, in accordance with DISA policy.

d) The Contractor shall provide support to the PMO in attaining an Interim Authority to Test, Interim ATO, ATO-Continuous (ATO-C) and an ATO from the DISA Authorizing Official (AO). During production, at a minimum, an ATO-C will be required, however, the Contractor shall continue to check off and complete A&A requirements to gain full approval for an ATO.

e) The Contractor shall address security vulnerabilities and eliminate information system security gaps discovered from DOD vulnerability scans/assessments. On a case-by-case basis, the Contractor may request an exception if findings cannot be resolved without degrading or substantially impacting the FCI system.

6.3.6 Subtask 6 - Team Enablement & Mentorship:

The Contractor shall provide ongoing, customized training, workshops, and mentorship to Network Operations, Security Operations, and Cloud teams; help formalize Standard Operating Procedures (SOPs) around the use of the digital twin. The contractor shall provide SOPs. Further, the Contractor shall perform the following:

· Conduct training sessions for customer teams on the Forward Networks platform.

· Develop and deliver training materials and documentation.

· Provide NQE training to enhance customer teams' understanding and utilization of the platform.

· Ensure customer teams are self-sufficient in using the platform.

6.3.7 Subtask 7 – OEM Embedded Engineering Support Warranty:

The Contractor will determine the resources required for the provision of the OEM Embedded Engineering services and may assign personnel to perform the services, with the option for DISA to request changes to assigned personnel upon prior written notice and for reasonable cause. The Contractor warrants that the OEM Embedded Engineering Services will be performed as detailed in the applicable PWS and that any deliverables will conform to the applicable documentation provided by the Contractor for a period of thirty (30) days from delivery. If DISA discovers any non-conformity, it must provide written notice within thirty (30) days of delivery. Upon receipt of such notice, the Contractor shall either re-perform the defective services at no additional charge or refund the applicable fees paid, at the Government’s election.

Deliverables:

6.4 Subtask 4 - Asset Management Support Requirement

The Contractor shall provide native asset management capabilities as a core component of the contract, delivered through a single, centralized platform that provides DISA with complete visibility and control over the managed device count.

6.4.1 Subtask 1 - Platform Requirements: The Contractor shall provide a commercial, service-provider-operated solution designed for Federal agencies. It must use process automation and role-based access controls to enable governance for data collection, ordering, tracking, and real-time reporting. Capabilities must include License Request Management, Education and Training (on-demand labs), Weekly/Monthly/Quarterly Reporting, Mission Partner Engagement (chatbot/outreach support), OEM Technical Support Request Management, and Hardware/Software Asset Management (tracking add/move/decommission actions). The Contractor shall provide Centralized Asset Management Portal, Automated Workflows & Integration, and On-Demand Education & Training Lab Portal.

6.4.2 Subtask 2 - Data Requirements: The solution shall collect, store, and process contract/financial audit data, software entitlements by stock keeping unit (SKU), and software consumption. It must consolidate account info to hardware asset data (device level only), track warranty/End-of-Sale data and provide real-time dashboards for KPIs and SLAs.

6.4.3 Subtask 3 - Commercial Solution Compliance: The platform shall comply with federal IT procurement policies mandating commercial solutions, consumption-based models, and modernization mandates. It must be vendor-agnostic, customizable, and align with DoD and federal cyber-security frameworks (e.g., FedRAMP, DoD CC SRG, DoD RMF).

Deliverables:

6.5 Subtask 5 - Program Management Support Requirement

Secret, TS, TS/SCI, SIPRNet, SCI, and NIPRNet accesses are required to support technical participating in classified architectural planning sessions, reviewing highly sensitive network diagrams, and developing specialized NQE scripts that model secure enclaves. Additionally, program management responsibilities requiring up to TS/SCI access include overseeing the classified segments of the PMO, reviewing sensitive, multi-domain system health and device ingestion reports, managing risk mitigation strategies for classified AI enclaves, and participating in closed-door PMRs where classified network vulnerabilities, threat models, and operational defense strategies are formally briefed. SIPRNet Access: Is required for email communication and computing requirements at the Secret level.

The Contractor shall establish Program Management support within ten (10) business days upon contract award to organize, plan, schedule, implement, control, analyze, and report on all elements of the contract. The contractor shall:

· Act as the primary point of contact between Forward Networks and the customer.

· Provide regular status updates and reports on activities and progress.

· Facilitate meetings and communication between relevant stakeholders.

· Provide monthly status reporting

6.5.1 Subtask 1 - Program Manager (PM):

The Contractor shall assign and provide PM information (verbally and written) within ten (10) business days upon award. The PM shall be the primary contact for all communications, work assignments, and technical directions, possessing the authority to ensure efficient program execution.

The contractor shall provide a contract program management plan (20) business days after contract award that provides contractor’s approach, timeline, and tools to be used in support of this contract. The contractor shall provide the technical and functional support required for the management of this contract. The contractor shall provide the centralized administrative, clerical, documentation, and related functions needed to support and demonstrate completion of activities required under this contract. The contractor shall provide contract administration to include, but not limited to, reporting, analysis, and customer support interaction. The contract program management plan shall provide resource allocation, training, personnel, and any other efforts necessary to facilitate contract activities. The contractor shall also provide a program schedule that outlines all project phases, key milestones, tasks, and deadlines to track the contractor's progress from start to finish.

6.5.2 Subtask 2 - Centralized Governance:

The Contractor shall provide a primary point of contact to manage all software licenses and OEM engineering services. The Contractor shall participate in PMRs and communicate to the Contracting Officer (KO) within seven (7) calendar days of awareness of any OEM intent to discontinue, improve, or replace offered products.

The PMRs shall address but are not limited to the status of programmatic and technical progress, enrollment activities, unresolved issues, action items, program status, the effectiveness of the contracting functions, analyze any problem areas, identify current and upcoming practices, modifications, and any outstanding issues concerning the contract. The contractor should also provide a monthly status report (MSR). The MSR shall address but are not limited programmatic progress and contract administration, platform scaling metrics (such as utilization, licensing, system health, and device ingestion), operational onboarding and adoption maturity assessments, and the status of action items and stakeholder communications, and staffing OEM embedded engineers.

The PMRs shall take place at either the contractor provided location or a DoD facility at a time determined by the COR. The contractor shall provide the EL PMO meeting minutes which accurately document the action items and substantive discussion points from the meeting within five (5) business days after the meeting occurrence. The contractor shall track action items identified at the program management reviews and shall report status to the EL Government PMO. The program reviews are for the mutual benefit of the contractor and the participants. Accordingly, the contractor shall not charge the DoD for participation and agrees to keep the DoD’s data confidential in accordance with relevant FAR and DFARS provisions and in accordance with the Non-Disclosure Agreement (NDA) procedures in Section 12 below

· A PMR shall be held quarterly with all relevant stakeholders at dates to be coordinated with the COR. At the PMR, the contractor shall present data via briefing as described above 6.5.2

· The contractor shall submit quarterly Program Management Status Reports (PMSR).

· Documentation shall be provided to COR five (5) business days prior to a scheduled quarterly PMSR.

· For meeting reviews, the contractor shall provide a summary of meetings, activities, and deliverables to include its status, and any other topics as agreed with the EL Government PMO.

· The contractor shall provide quarterly status reports and meeting notes within five (5) business days after the meeting occurrence.

6.5.3 Subtask 3 - Reporting and Scaling:

The Contractor shall submit reports tracking platform utilization, licensing, system health, and device ingestion as the network scales. The Contractor shall present contract status to the KO, COR, and PMO, and participate in quarterly PMRs.

6.5.4 Subtask 4 - Operational Onboarding & Promotion:

The Contractor shall manage customer service, develop onboarding guides for integrating DISA devices into new AI enclaves, and proactively communicate the EL as the mandatory enterprise network assurance "Digital Twinning" vehicle across DISA to prevent duplicative acquisitions.

· Perform a customer adoption maturity assessment to evaluate the current state of platform adoption and usage.

Deliverables:

6.6 Subtask 6 - Impact Level (IL) Requirements:

Due to the highly sensitive nature of the DoD AI mission, the integration of the "Digital Twin" involves the direct handling of classified network topologies, proprietary AI model capabilities, and national security data architectures.

Software Platform Impact Level (IL) Requirement: The proposed network assurance software must be architected and authorized to operate natively within highly secure federal boundaries. At a minimum, the deployment architecture must meet DoD Cloud Computing Security Requirements Guide (CC SRG) Impact Level 4 (IL4) - Impact Level 7 (IL7) standards. The software must securely process, store, and analyze Controlled Unclassified Information (CUI), National Security Systems data, and mission-critical network state data without requiring external, non-compliant internet connections or telemetric "phone home" features.

7. Performance Standards.

6.1 Subtask 1 - Functional Requirements (Software Capabilities) (The Contractor shall provide a core software capability that creates a mathematically precise, scaled "Digital Twin" of the entire hybrid network to continuously verify Zero Trust security, predict configuration errors, and treat infrastructure as code.)

- 100% Accuracy (Any needed revisions are minor and are resolved in a timely and satisfactory manner.)

- 100% Timeliness (Support Delivered on schedule within requested timeline)

- 100% Current (Data is up to date) Periodic inspection of deliverable products and services, programmatic, and technical/financial/ schedule risks

COR review of Deliverables against program requirements, current program state, program schedule and Quarterly PMRs and MSRs established schedules and their resulting taskers

6.3 Subtask 3 - OEM Embedded Engineering Services Requirement (The Contractor shall provide dedicated embedded OEM Resident Engineer support to accelerate system deployment and daily operations)

- 95% Accuracy (Any needed revisions are minor and are resolved in a timely and satisfactory manner.)

- 95% Timeliness (Support Delivered on schedule within requested timeline)

- 100% Current (Data is up to date)

- 90% of all survey respondents are Satisfied. More Than Satisfied, or Very Satisfied

Periodic inspection of deliverable products and services, programmatic, and technical/financial/ schedule risks

COR review of Deliverables against program requirements, current program state, program schedule, and Quarterly PMRs and MSRs established schedules and their resulting taskers

The number of users who were Satisfied, More Than Satisfied, or Very Satisfied divided by the total number of completed surveys returned.

6.4 Subtask 4 - Asset Management Support Requirement

(The Contractor shall provide native asset management capabilities as a core component of the EL, delivered through a single, centralized platform that provides DISA with complete visibility and control over the managed device count.)

- 100% Accuracy (Any needed revisions are minor and are resolved in a timely and satisfactory manner.)

- 95% Timeliness (Support Delivered on schedule within requested timeline)

- 100% Current (Data is up to date)

Periodic inspection of deliverable products and services, programmatic, and technical/financial/ schedule risks.

COR review of Deliverables against program requirements, current program state, program schedule, and Quarterly PMRs and MSRs established schedules and their resulting taskers.

- 95% Timeliness (Support Delivered on schedule within requested timeline)

- 95% Current (Data is up to date) Periodic inspection of deliverable products and services, programmatic, and technical/financial/ schedule risks.

COR review of Deliverables against program requirements, current program state, program schedule, and Quarterly PMRs and MSRs established schedules and their resulting taskers.

8. Incentives.

None.

9. Place of Performance.

*Other classified locations.

Primary Mission Location: DISA Headquarters 6910/6914, Cooper Ave., Ft Meade, MD 20755

Place of Performance: Required physical site support on premises shall be at the contractor’s discretion and in coordination with the local DISA/DOD customer. The contractor shall deliver all software, and services support as defined by the support requirements at DISA/DoD Continental United States (CONUS) and outside the Continental United States (OCONUS) locations for devices owned and/or managed by DISA.

*Place of performance, DoD Installations worldwide. Below list in not all inclusive. Contract Support covers all DISA owned and/or managed devices at other Government locations (e.g., Combatant Commands, Defense and Armed Forces Attache`) as required.

Government locations:

CONUS

1) (Primary) DISA Headquarters 6910/6914, Cooper Ave., Ft Meade MD 20755

2) Columbus, OH: DISA Columbus, 3990 East Broad St., Bldg. 23, Columbus, OH 43213

3) Mechanicsburg, PA: DISA Mechanicsburg, Bldg. 308 North End, 5450 Carlisle Pike, Mechanicsburg, PA 17050-0975

4) Montgomery, AL: DISA Montgomery, 401 East Moore Drive, Bldg. 857, Maxwell AFB/Gunter Annex, Montgomery, AL 36114-3001

5) Ogden, UT: DISA Ogden, 7879 Wardleigh Road, Bldg. 891, Hill AFB, UT 84056-5996

6) Oklahoma City, OK: DISA Oklahoma City, Gate 33, Se59 and Air Depot Rd, 8705 Industrial Blvd., Bldg. 3900, Tinker AFB, Oklahoma City, OK 73145-3064

7) San Antonio, TX: DISA San Antonio, 3326 General Hudnell Dr, San Antonio, TX 78226-2023

8) Pentagon VA, 6607 Army Pentagon Drive, Washington DC, DC 20301-1400

OCONUS

9) Stuttgart, GE: DISA DATA CENTER Stuttgart, Bldg. 2324, Patch Barracks, Stuttgart, Germany 70569

10) Wiesbaden, GE: DISA DATA CENTER Wiesbaden SEL4E3, MCC Gebaude 1000 Room OC01, Flugplatz Erbenheim, 65205 Wiesbaden, Germany

11) Ford Island, HI: Core Data Center-Hawaii, 477 Essex Street, Bldg. 77, Room 180, Pearl Harbor (Ford Island), HI 96860

12) Yokota Air Base, Japan: DISA Data Center – Yokota, Bldg. 650 Room B29, Bong Street, Yokota-kichiani, Fussa-shi, Tokyo-to, Japan 197-0001

13) Bahrain: TECC NSA Bahrain: PSC 451 Box 200, Kingdom of Bahrain

14) Al Udeid AB: 379/ECS/SCPF/GDIT AL UDEID AB, DOHA, QATAR 09309

Alternative work sites allow for regular teleworking or remote work flexibilities. Regardless of where work is performed, the Contractor shall ensure that work is completed effectively and that mission needs and requirements are met, without degradation of services. Also, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. The Contractor shall propose on-site rates for all work performed at an alternative work site. Incidental charges incurred while working at an alternative work site (e.g., electricity, internet) are not allocable to the contract and shall not be billed to the government.

Local travel to and around the mission location may be required throughout the period of performance; this travel will not be reimbursed. Long distance travel within CONUS or OCONUS (if applicable) may be required to support the requirements of this PWS. Long distance travel within CONUS must be pre-approved in writing by the COR prior to the Contractor incurring the cost in support of this contract.

The maximum number of seats available in the government site for this effort is _2__ (space waiver tracking #_______ for Government use only

Secondary Place of Performance – Contingency Only. As determined by the COR, contractor employees may be required to work at a secondary place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather). Additionally, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the KO or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

10. Period of Performance.

Period of Performance shall be One Base Year (BY) and two Optional Years (OY):

BY - 31 Jul 2026 - 30 Jul 2027;

OY1 – 31 Jul 2027 – 30 Jul 2028;

OY2 – 31 Jul 2028 – 30 Jul 2029;

Recognized Federal Holidays: The contractor is not required to perform services on Federal Holidays (as specified on the U.S. Office of Personnel Management website), unless otherwise specified by the COR.

Unplanned Federal Government Closure: In the event an authorized official, by either executive or legislative order, declares Federal offices closed (treated as a holiday for pay and leave purposes), the order only applies to Federal employees (unless otherwise stated in the order).

11. Security Requirements. This section supplements Block 13 of the Government provided DD Form 254, Contract Security Classification Specification. The following security requirements shall apply to this effort.

The contractor shall coordinate visits with site Point of Contract (POC) providing at least a 72-hour notice (or according to each site security requirements) prior to any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by cleared DISA personnel (civilian, military, or contractor).

References:

a. DISA End User Access Agreement

b. DISA Instruction 240-240-01, External Peripheral Devices Authorized for Network Connectivity

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-34, Controlled Unclassified Information (CUI)

e. DISA Instruction 240-110-36, Personnel Security

f. DISA Instruction 240-110-38, Industrial Security

g. DISA Instruction 240-110-43, Counterintelligence

h. DISA Instruction 240-110-43, Insider Threat Program

i. DISA Instruction 630-230-19, Cybersecurity

j. DoD Manual 5200.01, Vol. 1 and 3, DoD Information Security Program, 17 January 2025

k. DoD Manual 5200.01, Vol. 2, DoD Information Security Program, 28 July 2020

l. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

m. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP), 3 April 2017, Change 1, 29 October 2020

n. 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM), 24 February 2021

o. DoD Directive 5240.06, Counterintelligence Awareness and Reporting (CIAR), 17 May 2011, Change 3, 31 August 2020

p. DoD Instruction O-5240.24, Counterintelligence (CI) Activities Supporting Research, Development, and Acquisition (RDA), 8 June 2011, Change 2, 15 July 2020

q. DoD Instruction 5205.16, “The DoD Insider Threat Program,” December 20, 2024

r. DoD Instruction 5230.24, Distribution Statements for DoD Technical Information, 10 January 2023

s. DoD Instruction 8510.01, Risk Management Framework for DoD Systems, 19 July 2022

t. DoD Manuel 5400.07, DoD Freedom of Information Act (FOIA) Program, 25 January 2017

u. Security Executive Agent Directive 3 (SEAD 3) Reporting Requirements for Personnel With Access To Classified Information or Who Hold Sensitive Position, 12 June 2017

v. Security Executive Agent Directive 4 (SEAD 4), National Security Adjudicative Guidelines, 8 June 2017

v. DISA Instruction 240-110-35 Sensitive Compartmented Information (SCI)

w. DoD Manual 5105.21, Vol. 1-3, Sensitive Compartmented Information (SCI) Administrative Security Manual, 19 October 2012, Change 2, 06 October 2020

11.1 Facility Security Clearance. Work performed under this contract/order is up to the TS level and will require SCI access eligibility for some personnel. Therefore, the company must have an interim or final TS Facility Clearance from the Defense Counterintelligence and Security Agency (DCSA) Facility Clearance Branch.

11.1.2 Invalidated Facility Clearance. Companies with invalidated facility clearances (including those in partnerships, subcontracts, and Joint Ventures) are not eligible to bid on or be awarded any new or additional DISA classified contracts, subcontracts, or receive additional classified information except for information necessary for the completion of your current classified contracts. In addition, those companies with invalidated facility clearances will not be permitted access to all DISA networks. Performance on any DISA classified contracts, at any location, will not be authorized until it has been granted a Facility Security Clearance at the appropriate level by DCSA.

11.2 Security Clearance. All personnel performing on or supporting a DISA contract/order in any way shall be United States citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance eligibility delineated in the table below when performance starts.

Estimated number of security clearance levels required for SCI Indoctrination:

(10) TOP SECRET, SCI

SIPRNet Access: Is required for email communication and computing requirements at the Secret level.

11.2.1 TS/SCI Requirements. Individuals located onsite at Government locations listed in the place of performance and supporting PWS Tasks / Subtasks that require(s) a final TS security clearance will, immediately upon hire, require SCI access eligibility adjudicated by the DoD Adjudication and Vetting Services (AVS) or other federal AVS facility to perform their duties. Individuals located offsite who cannot provide valid justification in support of PWS Tasks / Subtasks will not be eligible for SCI Indoctrination. Processing for SCI eligibility will be coordinated with the supporting Government Special Security Representative and will begin immediately upon start of duty performance under this contract/order.

All SCI* work under this contract/order will be monitored by COR and ACOR.

IAW DoDM 5105.21-Volume 3:

Contracting Officer’s Representative/Contract Monitor (COR/CM). The COR/CM must be a Government employee (military or civilian) who is appropriately cleared and SCI indoctrinated for all accesses required by the contract. An alternate COR/CM should be appointed to assist the COR/CM whenever the COR/CM is not available.

11.3 Investigation Requirements. All personnel requiring Final Top Secret and SCI access under this contract/order shall undergo a favorably adjudicated Tier 5 (T5) investigation (formerly known as a Single Scope Background Investigation) as a minimum requirement. Enrollment into Continuous Evaluation current within 5 years and reflected in Defense Information System for Security (DISS), would meet the requirement for a current Periodic Reinvestigation (PR).

11.3.1 All personnel requiring Secret access under this contract/order shall undergo a favorably adjudicated Tier 3 Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. Enrollment into Continuous Evaluation current within 5 years and, reflected in DISS, would meet the requirement for current a PR.

11.3.2 The contractor is required to have personnel cleared with an interim or final Top Secret (as specified in the table located in section 11.2) at contract start date. If contractor personnel are replaced during performance of the contract, replacement personnel should also have interim or final clearance Top Secret (as specified in the table located in section 11.2).

11.4 Visit Authorization. Visit requests shall be processed and verified through the DISS to the Security Management Office (SMO) DKABAA10. DISS visits for contracts/orders are identified as “Other” or “Temporary Additional Duty (TAD)/Temporary Duty (TDY)” and will include the Contract/Order Number of the contract/order in the Additional Information section. Contractors that do not have access to DISS may submit visit authorizations by e-mail in a password protected portable document format file (.pdf) to the COR/ACOR specified in PWS/SOW Section 1.0.

11.4.0 SCI visit requests: shall be processed and verified through DISS to SMO DKABAA2. For visits to DISA Headquarters, all visitors shall be placed in the Visitor Eligibility Tool (VET) prior to their arrival. Ensure the visit level is set at SCI in the VET to ensure that it is routed to the DISA SSO for review and clearance verification. SCI VET submissions without a corresponding SCI visit request are subject to denial. For SCI visits to DISA Field Sites, follow the equivalent visitor procedures specific to that site.

*Prior coordination with the DISA COR should be made via email to ensure the Visit Authorization Letter (VAL)/ Visit Authorization Request (VAR)/ Visit Termination Notification (VTN) process is agreed upon and properly secure.

11.4.1 VAR Package. VAR Centers must receive VAR packages from the Security Manager (via email and require pre-approval from the assigned DISA COR) at a minimum of five business days in advance of the initial report date or renewal. For option years, VARs should be renewed 30-90 days prior to the expiration date unless modified sooner for changes such as name, COR/sponsor, contract modification, etc. As an option, a VAR can be approved for up to a maximum of three (3) years within the period of performance for contractors. The VAL/VAR/VTN should be sent via email to the appropriate COR. The VAL/VAR/VTN should be sent using in a locked “Zip” file in one e-mail and then followed up by another e-mail with the password to unlock the Zipped file, because it contains sensitive information covered by the Privacy Act.

Documents to include in the VAR Package (DISA Field Sites may have site specific VAR requirements):

1. Inter-office Memorandum (IOM)

2. DD Form 254 Prime and/or Sub (Good Standing approval emails for current option year)

3. PWS/SOW/Sub Memo

4. DISS verification of Visit Authorization by Security Manager

5. (Optional: see NOTE below) Contractor VAL signed by the Contractor Facility Security Officer (FSO)

NOTE: If DISS is not available, the VAL must contain the following information on company letterhead:

· Company name, address, telephone number, facility security clearance

· Commercial and Government Entity Code (CAGE CODE)

· Contract/Order Number

· Name, Social Security Number (SSN), date and place of birth, and citizenship of the employee intending to visit, email address, and phone number

· Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date and adjudication date & agency)

· Name of COR/Alt COR

· Dates or period the VAL is to be valid (i.e., Start date / End date)

11.4.2 VTN Package. The Contractor FSO will forward a VTN letter to the DISA COR identified in the PWS/TO/Sub for all employees leaving the contract/task order/subcontract.

11.4.2.1 In addition, the DISA CORs and security managers shall inform the DISA Security Office when contractor personnel are removed for cause from a contract supporting DISA. This step is to identify contractor personnel removed for security related issues in case of a return to DISA without appropriate vetting. This step will also provide security with pertinent information to make an informed decision regarding potential contractor employees’ access to secure facilities and sensitive information.