Attachment 1_PWS.pdf

PERFORMANCE WORK STATEMENT

COMMANDER, TASK FORCE (CTF) 75

NAVY EXPEDITIONARY FORCES COMMAND PACIFIC

INFORMATION TECHNOLOGY SERVICES

1. BACKGROUND

1.1 Commander, Task Force 75 (CTF 75), Navy Expeditionary Forces Command Pacific (NEFCPAC) is a US Navy task force of the United States Seventh Fleet and is 7th Fleet's primary expeditionary task force composed of Explosive Ordnance Disposal (EOD), Maritime Expeditionary Security, Cargo Handling, Intelligence Exploitation, and the Naval Construction Force. CTF 75 is responsible for the planning and execution of maritime security operations, explosive ordnance disposal, diving, logistics, engineering and construction, and underwater construction throughout the Indo-Asia-Pacific region as directed by 7th Fleet. CTF 75 HQ is permanently headquartered at Camp Covington, located at Naval Base Guam (NBG).

2. OBJECTIVE/SCOPE

2.1 The contractor shall provide on-site information technology (IT) infrastructure system support services for CTF 75 on Naval Base Guam. IT infrastructure system support includes liaison between staff and OCONUS Navy Enterprise Network (ONE-NET), ONE-NET incident response, ONE-NET physical infrastructure, Access Control System (ACS) to include Electronic Security System/Intrusion Detection System (ESS/IDS) and Closed Circuit TV (CCTV), USINDOPACOM Mission Partner Environment Engineering Services (MPE-ES), Special Security Officer (SSO) support for Joint Worldwide Intelligence Communication System (JWICS) / Sensitive Compartmented Information Local Area Network (SCI LAN), and Telephony services to include Secure Video Teleconferencing (SVTC), cellular and landline services. CTF 75 includes CTF 75 Headquarters and the CTF 75 Sensitive Compartmented Information Facility (SCIF) primarily but may include support to deployed units (e.g. NMCB Det Guam, NCHB Det Guam, and Intelligence Exploitation Team) on Guam.

2.1.1 ONE-Net is an outside of the continental United States (OCONUS) Navy Enterprise Network providing the manpower and administration services to operate Base Level Information Infrastructure (BLII) architecture for classified and unclassified information exchange.

2.1.2 MPE-ES is a USINDOPACOM Program of Record (POR) under Defense Information System Agency (DISA) providing multi-enclave coalition connectivity to USINDOPACOM warfighters through Desktop-as-a-Service (DaaS) private cloud technologies.

2.1.3 ACS, ESS/IDS and CCTV is a physical security system program under Navy Expeditionary Combat Command Pacific HQ (NECCPAC).

2.1.4 JWICS/SCI LAN is a Program of Record (POR) under Program Executive Command, Control, Communications, Computer Intelligence (PEO C4I) Shore and Expeditionary Program (PMW 160).

2.1.5 Navy’s Shore Telephony program is a component of unified capabilities (UC) that procures and installs integrated, interoperable, information assurance-certified voice and video systems, and peripherals in support of Defense Switch Network (DSN) which includes and not limited to Voice (analog, digital) Integrated Services Digital Network, Voice over Internet Protocol (VoIP) / Secure Voice over Internet Protocol (SVoIP), conferencing, voicemail and call centers, telephony management, Tactical Voice over Secure Internet Protocol, classified tactical Video Teleconferencing over secure IP (VTCoIP), telecommunications support for Base Communications Office.

2.2 Non-Personal Services and Inherently Governmental Functions:

2.2.1 Services rendered under this contract shall be non-personnel in accordance with Federal Acquisition Regulation (FAR) 37.104. Contractor personnel rendering services are not subject, either by the contract’s terms or by the manner of its administration, the supervision and control usually prevailing in relationships between the Government and its employees. Contractor personnel rendering services under this contract shall be under the direct supervision and control of the Contractor.

2.2.2 The Contractor shall not perform inherently Governmental Functions as prescribed under

FAR Subpart 7.5. Any performance objectives or other terms and conditions under this contract shall not be interpreted or implemented in any manner that may result in Contractor personnel creating or modifying Federal policies, obligating funds of the Government, or overseeing the work of Government employees or other Contractor personnel.

3. ATTACHMENTS

3.1 Attachments 1 – Performance Requirements Summary

3.2 Attachments 2 – Deliverable Schedule

3.3 Attachments 3 - Acronyms

4. PERFORMANCE REQUIREMENTS

4.1 IT System Administrator Services: The following tasks are to be performed at the following locations:

CTF 75’s Headquarters BLDG 556A/B, BLDG 553, BLDG 528, CTF 75 Office Spaces within BLDG 526, and CTF 75 SCIF BLDG 2002SY.

4.1.1 The contractors shall act as the liaison between staff and ONE-NET IT support services for the following:

4.1.1.1 The contractors shall submit, process and manage System Authorization Access Request Navy (SAAR-N) for Unclassified Internet Protocol Network (NIPR/Net) / Secret Internet Protocol Network (SIPRNet) access.

4.1.1.2 The contractors shall submit, process and manage user DoD Public Key Infrastructure / Enabling (PKI/PKE) (e.g. SIPRNet token) for Certificate Registration Instruction (CRI) and revocation.

4.1.1.3 The contractors shall create, submit and track ONE-NET trouble tickets affecting assets configuration anomalies, system connectivity issues, user account access and/or productivity issues.

4.1.1.4 The contractors shall create, submit and track ONE-NET trouble tickets affecting print services.

4.1.1.5 The contractors shall complete quarterly and annual ONE-NET Information Bulletin (OIB) 5B Authorized Connection to ONE-NET Classified and Unclassified site survey for Authorization to Operate (ATO) sustainment, establishment, and/or renewal. OIB 5B site survey shall be provided to CTF 75 Communications Officer for processing to ONE-NET Information Assurance Officer. Additionally, CTRs will assist with tracking ATO expiration and application of remediation plan if applicable.

4.1.1.6 The contractors will assist with reporting, drafting, submitting and tracking cyber incident report to include electronic spillages and/or network incidents IAW ONE-NET Cyber Incident Response SOP.

4.1.1.7 The contractors shall document any trouble ticket and service calls for ONE-NET user and system issues in the CTF 75 communications trouble ticket logs and provide daily updates to the Communications Officer.

4.1.2 The contractors shall act as the liaison between staff and USINDOPACOM MPE-ES support services.

4.1.2.1 The contractors shall submit and manage SAAR-N for accesses to various Secret Releasable enclaves hosted on MPE-ES infrastructure.

4.1.2.2 The contractor shall coordinate with DISA MPE-ES service engineers for application management and/or request for meeting mission requirements.

4.1.2.3 The contractors shall maintain garrison MPE-ES infrastructure, including configuration management, patch management, connectivity, and submitting and tracking trouble tickets.

4.1.2.4 The contractors will assist with reporting, drafting, submitting and tracking any cross domain violations and/or incidents reports (e.g. electronic spillages) IAW USINDOPACOM MPE-ES Cyber Incident Response SOP.

4.1.2.5 The contractors shall develop and maintain SOPs for registering account requests and providing basic troubleshooting support.

4.1.2.6 The contractors shall generate and submit trouble ticket requests with DISA MPE-ES for resolving system degradation, outages, or user issues. The contractors shall document all trouble tickets in CTF 75 communications trouble ticket log and shall provide daily updates to the Communications Officer.

4.1.3 The contractors shall manage ESS/IDS functionality, operations and services for all CTF

75 facilities.

4.1.3.1 The contractors shall act as the liaison between staff and program owner and/or third party service provider for troubleshooting software and hardware anomalies (e.g. power failure, software crashes, system interruptions, etc.).

4.1.3.2 The contractors shall provide ESS/IDS operations and management support services to include configuration management, patch management, database management, and connectivity assurance.

4.1.3.3 The contractors shall initiate trouble tickets and coordinate service call with system service provider and/or third party service provider. The contractors shall document all trouble tickets and service calls for ESS/IDS system issues in the CTF 75 communications trouble ticket logs and provide daily updates to the Communications Officer regarding status of ESS/IDS system.

4.1.3.4 The contractors shall develop and maintain SOPs for registering personnel, removing personnel, database cleanup, system log verification, system shutdown and start-up.

4.1.3.5 The contractors will complete annual ATO review requirement for sustainment and/or renewal of ATO. Additionally, CTRs will assist with tracking ATO expiration and/or application of remediation plan if applicable.

4.1.4 The contractor shall be manage CCTV system functionality, operations and services.

4.1.4.1 The contractors shall act as the liaison between staff and program owner and/or third party service provider for troubleshooting software and hardware anomalies (e.g. power failure, software/hardware issues, footage issues, etc.).

4.1.4.2 The contractors shall provide CCTV operations management support services to include configuration management, patch management, database management, footage backup, and connectivity assurance.

4.1.4.3 The contractors shall initiate trouble ticket and coordinate service call with system provider and/or third party service provider for system anomalies that cannot be remediated locally. The contractors shall document all trouble tickets and service calls for the CCTV system in the CTF 75 communications trouble ticket logs and provide daily updates to the Communications Officer.

4.1.4.4 The contractors shall develop and maintain SOPs for operating and managing camera feeds, backups, basic troubleshooting, and system maintenance.

4.1.4.5 The contractors will complete annual ATO review requirement for sustainment and/or renewal of ATO. Additionally, CTRs will assist with tracking ATO expiration and/or application of remediation plan if applicable.

4.1.5 The contractors shall act as the liaison between staff and JWICS/SCI support services at

CTF 75 SCIF BLDG 2002SY.

4.1.5.1 The contractors shall submit, process and managing System Authorization Access Request Navy (SAAR-N) for JWICS/SCI access.

4.1.5.2 The contractors shall coordinate and/or schedule JWICS/SCI Video Conferencing.

4.1.5.3 The contractors shall create, submit and track trouble tickets affecting user access and connectivity, system connectivity issues, issues with print service, SCI VoIP or video teleconferencing issues.

4.1.5.4 The contractors shall performing daily, weekly, and annual system backups. The contractors shall perform period system audits IAW ONI SOP.

4.1.5.5 The contractors shall create CTF 75 JWICS/SCI communications trouble ticket log for tracking trouble tickets and service calls for JWICS/SCI user and system issues and provide daily updates to the Communications Officer.

4.1.5.6 The contractors shall develop and maintain SOPs for user management, system management, system backup, system audit, system video conferencing, and basic troubleshooting.

4.1.5.7 The contractors shall complete periodic Office of Naval Intelligence (ONI) system assessment for ATO sustainment and/or renewal. Additionally, CTRs will assist with tracking ATO expiration and application of remediation plan if applicable.

4.1.5.8 The contractors will assist with reporting, drafting, submitting and tracking cyber incident report to include electronic spillages and/or network incidents IAW ONI Cyber Incident Response SOP.

4.1.6 The contractors shall act as the liaison between staff and Base Communications Office

(BCO) and ONE-Net in support of telephony services.

4.1.6.1 The contractors shall submit, process, manage landline requests and services providing local, international, DSN, and conference calling capabilities to BCO.

Contractors shall initiate trouble ticket and service calls for issues affecting users’ ability to make local, international, DSN and/or conference calls.

4.1.6.2 The contractors shall manage SVTC functionality and operations to include troubleshooting system anomalies, set-up and scheduling of SVTC through/with Network Operations Centers VTC/SVTC servicing bridge (e.g. NCTAMS PAC, NCTAMS LANT, point-to-point, etc.), and providing troubleshooting support for

Global Video System (GVS). Additionally, CTRs will assist with tracking ATO expiration and application of remediation plan if applicable.

4.1.6.3 The contractors shall submit, process, manage VoIP/SVoIP requests, connectivity and services providing DSN, non-secure/secure and/or cross-domain calling capabilities to BCO and/or ONE-NET. Contractors shall initiate trouble ticket and service calls for connectivity issues affecting users’ ability to place a DSN, non-secure/secure and/or cross-domain calls.

4.1.6.4 The contractors shall assist users with command cell phones with Pure-bred/Flankspeed application registration and provide troubleshooting assistance as required.

4.1.6.5 The contractors shall maintain the multi-timezone clocks across CTF 75 facilities and ensure accurate time kept.

4.1.6.6 Contractors shall document and track trouble tickets and service calls with BCO for all telephony related issues in the CTF 75 communications trouble ticket logs and provide daily updates to the Communications Officer.

4.1.7 The contractor shall inform the Communications Officer of degraded system(s) and current operational status within one (1) hour of service failure. Typically, the Communications Officer is co-located on the watch floor with technical support personnel. In these cases, face-to-face verbal notification is sufficient. When the Communications Officer is not readily available to the contractor, the contractor shall submit email notification or make voice call to the Communications Officer within two

(2) hours of service failure. Troubleshooting degraded network services occurs approximately 1-5 times per week. CTF 75 and respective N6 Department shall provide log and record format.

4.1.8 The contractor shall perform firmware, hardware and security updates on IDS/ESS, CCTV, VTC/SVTC, VoIP/SVoIP, MPE-ES, JWICS/SCI IAW Standard Maintenance and Material Management (3M) System procedures or as directed by Program Owner. The 3M system provides the Navy and CTF 75 the ability to manage, schedule, and control maintenance of equipment. The CTF 75 N6 Work Center Supervisor shall schedule all maintenance, assign maintenance checks, and provide all materials required for equipment maintenance to the contractor. The contractor shall report completion of maintenance and report any discrepancies identified during firmware, hardware and security update maintenance checks accordingly to the Communications Officer.

4.2 Cyber Security Administration: The following tasks are to be performed at the following locations:

CTF 75’s Headquarters BLDG 556A/B, BLDG 553, BLDG 528, CTF 75 Office Spaces within BLDG 526, and CTF 75 SCIF BLDG 2002SY.

4.2.1 The contractor shall review, analyze, and mitigate adverse security events for Host-Based Security System (HBSS)/End Point Security Solutions (ESS) managed assets and administer HBSS/ESS IAW DISA and Officer of Naval Intelligence (ONI) cyber security Tactics, Techniques, & Procedures (TTP) HBSS/ESS administration guidance, and local SOP for JWICS/SCI, MPE-ES, CCTV, ESS/IDS, VTC/SVTC, VoIP/SVoIP, and ONE- NET connected networks.

4.2.2 The contractor shall serve as a non-voting member of the IT Change Configuration Board

(CCB) and shall meet weekly with the CTF 75 Communications Officer to provide operational updates.

4.2.2.1 As CCB member, the contractor shall verbally discuss with the Communications

Officer current and/or emergent network security issues, computer tasking orders, or major configuration updates. Typically, meetings are held each Monday at 0900 hours in the CTF 75 N6 Directorate. In the event of a Monday holiday meetings shall be held on Tuesday at 0900 hours.

4.2.3 The contractor shall provide a formal written report monthly to the Contracting Officer Representative (COR) to be due no later than (NLT) the 5th day of each month. The contractors report shall include but is not limited to a report of the previous month’s technical issues, current month’s technical efforts, administrative actions completed, outstanding action items, and current technical coordination efforts (internal or external to

CTF 75).

4.2.4 The contractor shall perform Assured Compliance Assessment Solution (ACAS) system scans twice a month IAW DON, ONI Policy, and Navy Expeditionary Combat Command (NECC) Large Scale Communication Asset (LSCA) vulnerability scan guidance and local SOP for JWICS/SCI, MPE-ES, CCTV, ESS/IDS, VTC/SVTC, VoIP/SVoIP, and ONE-NET connected networks.

4.2.5 The contractor shall assist respective N6 department Information Systems Security Officer

(ISSO) with acknowledgment of Computer Task Order (CTO) and Information Assurance Vulnerability Alert (IAVA) compliance messages in VRAM IAW Fleet Cyber and 10th Fleet Directives as provided by the Government and local SOP for JWICS/SCI, MPE-ES, CCTV, ESS/IDS, VTC/SVTC, VoIP/SVoIP, and ONE-NET connected networks.

4.2.6 The contractor shall generate and/or assist with submitting trouble tickets with ONI or

ONE-NET Enterprise Service Desk for IT trouble ticket requests, NCDOC HBSS/ESS support, ACAS support and Request for Change (RFC) trouble tickets as required to coordinate enterprise helpdesk support for JWICS/SCI, MPE-ES, CCTV, ESS/IDS, VTC/SVTC, VoIP/SVoIP, and ONE-NET connected networks.

4.2.7 The contractors shall ensure all open trouble tickets are properly documented in the respective CTF 75 communications trouble ticket log and shall provide weekly updates to the Communications Officer regarding the current status for all open tickets.

5. ADDITIONAL REQUIREMENTS

5.1 The contractor shall provide a monthly information, communications, and cyber security report. This report shall be submitted no later than 5 business days after the end of the previous month. The status report shall include, at a minimum, all substantial activities from the month, all trainings conducted, meetings attended, and upcoming meetings or events.

5.2 In accordance with FAR 31.205-46, the Contractor shall obtain approval from the COR prior to making any travel arrangements or reservations. The Contractor shall submit a written travel request to the COR at least thirty (30) calendar days before the anticipated departure date.

5.3 Upon return from travel, the Contractor shall submit a request for reimbursement to the COR within five (5) working days. The request for reimbursement shall be substantiated with travel receipts and any other documents required by the COR to ensure audit readiness.

6. CONTRACTOR CERTIFICATION AND MINIMUM REQUIREMENTS

6.1 Contractor personnel shall be a U.S. citizen or U.S. national and shall be fluent in the English language.

6.2 Contractor personnel shall be technically proficient and have 1+ years of experience working with all-inclusive Microsoft Productivity suite, Network infrastructure (routing and switching) and VMware.

6.3 The contractor shall maintain a valid Information Assurance Technician Level 2 (IAT-2) baseline credential in accordance with DOD 8570.1M and complete 40 hours of continuing education units (CEU) annually. Contractor may complete a combination of position relevant training, education, experiential learning, and commercial certification activities to fulfill the 40 hours annual CEU requirement as approved by the NECC PAC Information Assurance Manager.

6.4 The contractor shall provide personnel with minimum of Secret clearance to access all CTF

75 facilities. A Top Secret security clearance with Single Scope Background Investigation (SSBI) is required for personnel operating in CTF 75 SCIF BLDG 2002SY.

6.5 The contractor is solely responsible for the control and supervision of contractor personnel performing under this contract. This includes contractor employee leave and timekeeping issues. The contractor is responsible for properly training its employees before they commence work on this contract.

Contractor personnel must be qualified to meet the requirements of the performance work statement at the commencement of the contract.

6.6 The contractor shall be responsible for obtaining any certifications and licenses required for performance under this contract.

6.7 The contractor shall attend all post award conferences and periodic progress meetings convened by the Contracting Officer, or Contracting Officer's Representative. Meeting attendance and resolution of any outstanding issues shall be at no additional cost to the Government.

6.8 The contractor shall promptly remove, or deny access to any contractor personnel whose conduct is determined by the contractor or Government site management to be inconsistent with the best interests of the Government. The contractor shall continue to perform contract services following the removal of, or denial of access to, said personnel.

6.9 IT System Administrator (PWS Paragraph 4.1)

6.9.1 Contractor personnel providing system administration services shall meet DoD 8570.1 IAT level II or higher certification requirements and have intermediate or expert level knowledge (5+ years of experience) of DoD Information Network (DODIN) operations, be technically proficient in installing, configuring, and troubleshooting enterprise VMware, Cisco, Microsoft, Network Appliance (NetAPP), and shall possess demonstrated experience in configuring Cisco Routers and Switches, EIGRP routing protocol design and implementation, Cisco VPN devices and Cisco Call Manager technology. Contractor personnel shall possess intermediate to advanced experience in configuring firewall devices, the ability to troubleshoot layer II and layer III network problems using command line interfaces from Cisco devices, VMWare and Microsoft Server 2008 (R2) or higher.

6.9.2 Contractor personnel providing telecommunication support services shall have intermediate or expert (5+ years) experience in radio frequency spectrum management, in working with Department of the Navy (DON) Maintenance and Material Management (3M) procedures and with DOD global Technical Control Facilities (TCF) operations.

6.10 Cyber Security Administrator (PWS 4.2)

6.10.1 Contractor personnel providing cyber security administrator services shall meet DoD

8570.1 IAT level III or higher certification requirements and have 7+ years of cyber security administration experience and shall possess intermediate to expert experience with VMware enterprise and desktop products, Microsoft Windows Server 2008 (R2) or higher. Contractor personnel shall possess intermediate to expert experience with HBSS/ESS, intermediate to expert experience with ACAS, experience with modifying, creating and troubleshooting Microsoft group policy objects, and demonstrated ability to troubleshoot and repair connectivity issues with Web Security Appliances.

6.11 In the event of loss of contractor personnel, the contractor is required to provide replacement personnel of equal to or better qualifications and certifications within five business days.

6.12 The contractor is required to furnish the COR a plan of action to address personnel that will be out due to convalescence, emergency leave/absence, and similar, prior to, or immediately following when the contractor is made aware, or should have been made aware of personnel absence.

7. BASE ACCESS

7.1 Identification Badges and Installation Access

7.1.1 Obtain access to Navy installations through participation in the Defense Biometrics Identification System (DBIDS). Requirements for Contractor employee registration, and transition for employees currently under Navy Commercial Access Control System (NCACS), are available at https://www.cnic.navy.mil/om/dbids.html. No fees are associated with obtaining a DBIDS credential.

7.1.2 Participation in the DBIDS is not mandatory, and Contractor personnel may apply for One-Day Passes at the Base Visitor Control Office to access an installation.

7.1.3 Access to both Exchange and Commissary may be permitted with the presence of

“Temporary Extension of Commissary and Exchange” letter and an appropriate photo ID in order to access the commissary and/or AAFES facility.

7.2 Registration for DBIDS

7.2.1 Registration for DBIDS is available at https://www.cnic.navy.mil/om/dbids.html.

Procedure includes:

7.2.1.1 Present a letter or official award document (i.e. DD Form 1155 or SF 1442) from the Contracting Officer, that provides the purpose for access, to the base Visitor Control Center representative.

7.2.1.2 Present valid identification, such as a passport or Real ID Act-compliant state driver's license.

7.2.1.3 Provide completed SECNAV FORM 5512/1 to the base Visitor Control Center representative to obtain a background check. This form is available for download at https://www.cnic.navy.mil/om/dbids.html.

7.2.1.4 Upon successful completion of the background check, the Government will complete the DBIDS enrollment process, which includes Contractor employee photo, finger prints, base restriction and several other assessments.

7.2.1.5 Upon successful completion of the enrollment process, the Contractor employee will be issued a DBIDS credential, and will be allowed to proceed to the worksite.

7.3 DBIDS Eligibility Requirements

7.3.1 Throughout the length of the contract, the Contractor employee must continue to meet background screening standards. Periodic background screenings are conducted to verify continued DBIDS participation and installation access privileges. DBIDS access privileges will be immediately suspended or revoked if at any time a Contractor employee becomes ineligible.

7.3.2 An adjudication process may be initiated when a background screen failure results in disqualification from participation in the DBIDS, and Contractor employee does not agree with the reason for disqualification. The Government is the final authority.

7.4 DBIDS Notification Requirements

7.4.1 Immediately report instances of lost or stolen badges to the Contracting Officer.

7.4.2 Immediately collect DBIDS credentials and notify the Contracting Officer in writing under the following circumstances:

7.4.2.1

7.4.2.2 An employee has departed the company without having properly returned or surrendered their DBIDS credentials.

7.4.2.3 There is a reasonable basis to conclude that an employee, or former employee, might pose a risk, compromise, or threat to the safety or security of the Installation or anyone therein.

7.5 One-Day Passes

7.5.1 Personnel applying for One-Day passes at the Base Visitor Control Office are subject to daily mandatory vehicle inspection, and will have limited access to the installation. The Government is not responsible for any cost or lost time associated with obtaining daily passes or added vehicle inspections incurred by non-participants in the DBIDS.

8. PERIOD OF PERFORMANCE

8.1 Base Year: 01 Jun 2024 – 31 May 2025

Option Year 1: 01 Jun 2025 – 31 May 2026 Option Year 2: 01 Jun 2026 – 31 May 2027 Option Year 3: 01 Jun 2027 – 31 May 2028 Option Year 4: 01 Jun 2028 – 31 May 2029

9. PLACE OF PERFORMANCE AND NORMAL HOURS OF OPERATION

9.1 The principal place of performance will be COMNEFCPAC/CTF 75 Headquarters BLDG 556A/B, BLDG 553, BLDG 528, CTF 75 Office Spaces within BLDG 526, and CTF 75 SCIF BLDG 2002SY. Performance at other locations on Naval Base Guam may be required.

9.2 The normal hours of operation shall be Monday through Friday, between 0830 and 1630 hours for all support. Performance during alternate hours of operation may be required on occasion.

9.3 Recognized Holidays: If the Federal holiday falls on a Saturday, the holiday is observed in the preceding Friday. If the Federal holiday falls on a Sunday, the holiday is observed on the following Monday. Contractor personnel are not required to perform services on recognized Federal holidays:

9.4 In the absence of other agreements negotiated with respect to time provided for government review, deliverables will be inspected and the contractor notified of the Government’s findings. The COR and the contractor will meet on a monthly basis to review performance and inspect work for compliance with the PWS. Reviews will normally be held at on-site; however, the COR, at his discretion, may request the review at the contractor’s location or an alternate site within the Camp Covington area.

10. INCIDENTAL GOVERNMENT FURNISHED EQUIPMENT

10.1 The following incidental equipment and services will be provided to the contractor:

10.1.1 Long distance telephone service, facsimile service, and postal and other mail services required to support this task (official use only).

10.1.2 All computer hardware and software required for the performance of the PWS tasks.

10.1.3 All support documentation (plans, programs, base comprehensive blueprints, applicable regulations, specifications, standards, technical manuals, as-installed drawings, and other documentation) required to complete the task.

10.1.4 All essential office resources (desk, chair, telephone with Pacific DSN access, filing cabinet space, etc.).

11. SECURITY REQUIREMENTS

11.1 Security requirements will be determined by the requiring activity and specified in the contract. The contractor shall comply with the latest version of OPNAV Instruction 5530.14E, "Navy Physical Security and Law Enforcement Program", as applicable, and all local security requirements for the work site.

11.2 Physical Security. The contractor is responsible for providing information to the Government or civilian facility necessary to obtain clearances, permits, and security badges which will allow contractor personnel access to work sites. This shall include any police checks, investigations, or other requirements of the badge issuing activity. Further, the contractor is responsible for ensuring security badges are promptly returned to the issuing activity upon termination of an employee or completion of a given project. The contractor shall provide picture identification badges for all employees performing work under the contract. When temporary employees are used for periods of two weeks or less, temporary identification badges without photos may be used. Identification badges shall clearly identify the contractor's name; the individual's full name and the employee identification number.

Badges shall be worn at all times and clearly displayed while performing work located at a Government facility. Contractor employees' identification badges shall be worn in addition to any security badges or passes required by a host Government activity where work is being performed.

11.3 Security Clearances. When access to classified information is required, a DD Form 254 ("Department of Defense Contract Security Classification Specification") will be provided with the contract. The contractor shall be responsible for providing personnel with appropriate security clearances to ensure compliance with DoD 5220.22-M, "National Industrial Security Program Operating Manual". The contractor shall fully cooperate with all security checks and investigations by furnishing requested information to verify the contractor employees' trustworthiness and suitability for the position. If the contractor's facility is used in performance of classified work, the appropriate facility clearance must be in place. Contractors must demonstrate their ability to obtain ‘up to’ a Top Secret Clearance for this contract.

12. INFORMATION ASSURANCE

12.1 Performance under this contract may require the contractor to have access to proprietary and/or business sensitive data. The contractor shall ensure that personnel accessing information systems are properly trained and certified in accordance with DFARS 252.239-7701 and DoD 8570.01-(series), "Information Assurance Workforce Improvement Program". Neither the contractor nor any personnel employed under this contract shall divulge or release data or information developed or obtained under performance of this contract, except authorized Government personnel or upon written approval of the Contracting Officer. The contractor shall not use, disclose, or reproduce proprietary data, other than as specified in the contract. Disclosure of proprietary data or information regarding operations and services of the requiring activity to persons not entitled to receive it, in connection with work under this contract, may subject the contractor, contractor's agent or employees, to criminal or civil liability.

12.2 In order to maintain access to required systems, the contractor shall ensure completion of annual

Information Assurance (IA) training, monitor expiration of requisite background investigations, and initiate reinvestigations as required.

13. QUALITY CONTROL PLAN (QCP) AND QASP

13.1 The contractor shall maintain a quality control program with the aim of identifying and correcting deficiencies in the quality of services before performance becomes unacceptable. As part of the Quality Control Program, the contractor is responsible for implementing and maintaining a Quality Control Plan (QCP) to ensure that the work performed meets or exceeds the requirements and results in the correction of potential and actual problems. The QCP shall be implemented within thirty (30) days of contract performance. Notwithstanding the Government’s Quality Assurance Surveillance Plan (QASP), the Contractor is not relieved from having their own QCP program to address quality issues during the contract period and shall include the following:

13.2 A description of the inspection system to cover all services listed on the Performance Work Statement.

The description shall include specifics as to the areas to be inspected on both a scheduled and unscheduled basis and the frequency of these inspections.

13.3 A description of follow-up procedures to ensure that deficiencies are corrected and the time frames involved in correcting these deficiencies.

13.4 A description of the record to be kept to document inspections and corrective or preventative actions taken.

13.5 The records of inspections shall be kept and made available to the Government, when requested, throughout the performance period, and for the period after completion, until final settlement of any claims under this contract.

14. CONTRACTOR PERFORMANCE EVALUATION

14.1 Quality Assurance: The Government shall evaluate the contractor’s performance under this contract in accordance with the QASP. The QASP is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

15. Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information

Technology (IT) Systems or Protected Health Information

15.1 Background:

15.1.1 Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement federal security standards for federal employees and contractors.

The Deputy Secretary of Defense Directive-Type Memorandum (DTM) 08-006 Department of Defense (DoD) Implementation of HSPD-12 dated November 26, 2008 (or its subsequent DoD Instruction (INST)) directs implementation of HSPD-12. This clause is in accordance with HSPD-12 and its implementing directives.

15.1.2 Applicability:

15.1.2.1 This text applies to contractor employees requiring physical access to any area of a federally controlled base, facility or activity and/or requiring access to a Department of the Navy (DoN) or DoD computer/network/system to perform certain unclassified sensitive duties. This clause also applies to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified as National Security Position, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance.

15.1.2.2 Each contractor employee providing services at a Navy command under this contract is required to obtain a DoD Common Access Card (CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

15.1.3 Access to Federal Facilities:

15.1.3.1 Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager (CSM) upon arrival to the command and shall out-process with the CSM prior to their departure at the completion of the individual's performance under the contract.

15.1.4 Access to DoD IT Systems:

15.1.4.1 In accordance with Secretary of the Navy (SECNAV) M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT- II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act, to include PHI. All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity's Command Information Assurance Manager (CIAM).

15.1.4.2 Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check (NAC) with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance (IA) Technical Level 1, and must be trained and certified on the Operating System (OS) or Computing Environment (CE) they are required to maintain.

15.1.4.3 Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy CSM and Information Assurance (IA) manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy IT resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR- N as the supervisor.

15.1.4.4 The SAAR-N shall be forwarded to the CSM at least thirty (30) calendar days prior to the individual's start date. Failure to provide the required documentation at least thirty (30) calendar days prior to the individual's start date may result in delaying the individual's start date.

15.1.4.5 When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Information Awareness (IA) training, and maintain a current requisite background investigation. The contractor's security representative shall contact the command security manager for guidance when reinvestigations are required.

15.1.5 Interim Access:

15.1.5.1 The CSM may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer, network, or both upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer and network. Denial of access due to unfavorable determinations will not relieve the contractor of its responsibility to perform.

15.1.6 Denial or Termination of Access:

15.1.6.1 The potential consequences of any requirements under this clause including denial or termination of physical or system access does not relieve the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system, network, government information, or any combination of the three, meaning information not authorized for public release.

15.1.7 Contractor’s Security Representative:

15.1.7.1 The contractor shall designate an employee to serve as the contractor's security representative. Within three (3) working days after contract award, the contractor shall provide to the CSM and the Contracting Officer, in writing, the name, title, address and phone number for the contractor's security representative. The contractor's security representative shall be the primary point of contact on any security matter. The contractor's security representative shall not be replaced or removed without prior notice to the Contracting Officer and CSM.

15.1.8 Background Investigation Requirements and Security Approval Process for Contractors

Assigned to National Security Positions or Performing Sensitive Duties

15.1.8.1 Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied.

Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility, or activity, requiring access to a DoD computer, network, or both to perform unclassified sensitive duties or requiring access to both.

This designation is also applied to contractor employees who access Privacy Act and PHI, provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a Federal Bureau of Investigation (FBI) fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

15.1.8.1.1 SF-86 Questionnaire for National Security Positions (or equivalent Office of Personnel Management (OPM) investigative product);

15.1.8.1.2 Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission); and

15.1.8.1.3 Original Signed Release Statements

15.1.8.2 Failure to provide the required documentation at least thirty (30) calendar days prior to the individual's start date shall result in delaying the individual's start date.

Background investigations shall be reinitiated as required to ensure investigations remain current (not older than ten (10) years) throughout the contract performance period. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

15.1.8.3 Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the CSM upon arrival to the command and shall out-process with the CSM prior to their departure at the completion of the individual's performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy command's information assurance manager.

Completion and approval of a System Authorization Access Request Navy (SAAR- N) form is required for all individuals accessing Navy IT resources. The SAAR-N shall be forwarded to the Navy command's security manager at least thirty (30) calendar days prior to the individual's start date. Failure to provide the required documentation at least thirty (30) calendar days prior to the individual's start date shall result in delaying the individual's start date.

15.1.8.4 The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual IA training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the CSM. The CSM will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM); Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The CSM will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

15.1.8.5 If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) or a hard copy VAR directly from the contractor's Security Representative. Although the contractor will take JPAS owning role over the contractor employee, the command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT position category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee's performance under the contract.

15.1.9 Background Investigation Requirements and Security Approval Process for Contractors

Assigned to or Performing Non-Sensitive Duties

15.1.9.1 Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc.) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

15.1.9.1.1 Must be either a United States (U.S.) citizen or a U.S. permanent resident with a minimum of 3 years’ legal residency in the U.S. (as required by the Deputy Secretary of Defense DTM 08-006 or its subsequent DoD INST);

and

15.1.9.1.2 Must have a favorably completed National Agency Check with Written

Inquiries (NACI) or T1 investigation equivalent including a FBI fingerprint check prior to installation access.

15.1.10 To be considered for a favorable trustworthiness determination, the CSR must submit for all employees each of the following:

15.1.10.1 SF-85 Questionnaire for Non-Sensitive Positions;

15.1.10.2 Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission); and

15.1.10.3 Original Signed Release Statements

15.1.11 The contractor shall ensure each individual employee has a current favorably completed

NACI or T1 equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM.

15.1.12 Failure to provide the required documentation at least thirty (30) calendar days prior to the individual's start date may result in delaying the individual's start date.

15.1.13 * Consult with your CSM and IA manager for local policy when IT-III (non-sensitive) access is required for non-US citizens outside the United States. *

16. CONTRACTING OFFICER REPRESENTATIVE

16.1 The COR is an individual designated and authorized in writing by the Contracting Officer to perform specific technical or administrative functions. These functions include providing clarification or technical guidance within the scope of the contract, monitoring the progress and performance of the Contractor, and providing evaluation feedback to the Contracting Officer.

16.2 The COR does not have the authority to permit any constructive changes to the contract or authorize the Contractor to perform work outside the scope of the contract. In the event that such unauthorized direction is given by the COR, the Contractor shall immediately notify the Contracting Officer in writing for resolution. Unless expressly authorized by the Contracting Officer, the Contractor shall not take action.

16.3 The COR for this contract will be appointed via separate letter.