Attachment 4 - Draft Technical Exhibits.pdf

Defense Counterintelligence and Security Agency Personnel Vetting Fieldwork

DRAFT TECHNICAL EXHIBITS A-M

Table of Contents

A Personnel Vetting Information Technology Requirements B Personnel Vetting Training Requirements C Personnel Vetting Security Requirements D Personnel Vetting Billing Requirements E Requirements for the Protection of Personally Identifiable Information F Reserved G Performance Requirements Summary H Deliverables Schedule J Placeholder for Quality Assurance Surveillance Plan K Firm-Fixed-Unit-Price BI Product List L Required Contractor Training M Wage Determination

DCSA BI Fieldwork Technical Exhibits

Technical Exhibit A. Personnel Vetting Information Technology Requirements

This Technical Exhibit provides additional details related to the technical requirements for the Contractor under this Contract. The Contractor shall adhere to all standards applicable to the execution of this contract, including Cybersecurity Maturity Model Certification (CMMC) Level 2 Third-Party (C3PAO) Assessment requirements, to ensure the security and integrity of systems, data, and services.

All Contractor systems, software, and tools used in the performance of the contract that store, or process Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) shall adhere to the CMMC requirements.

1. APPLICABILITY

1.1. The Contractor shall comply with the below requirements as part of the Fieldwork Contract.

1.2. This document applies to the Contractor, its subcontractors and teaming partners, and employees (hereafter referred to collectively as “Contractor”).

1.3. These requirements, including all the references listed are applicable to all information, regardless of medium, maintained by the Contractor for the performance of this contract.

1.4. These requirements are in addition to all applicable requirements established by 5 United States Code (U.S.C.) 552a; and to all other requirements established by various Federal statutes, mandates, and Executive Orders for the management and security of Information and Information Systems. The following additional requirements should not be construed to alter or diminish civil and/or criminal liabilities provided under 5 U.S.C. 552a or any other applicable Federal statutes.

1.5. The Contractor shall furnish and maintain dedicated computing devices for all Contractor personnel.

These devices shall be used solely for the execution of duties related to this Contract and no other purposes.

1.6. Government IT infrastructure and networks provided for Contractor use are expected to maintain a ninety percent (90%) operational uptime. During periods of system downtime within this ten percent (10%) threshold, the Contractor shall ensure personnel are reassigned to other tasks, offline duties, or relevant training to maintain productive performance under this Contract. The Contractor hereby waives the right to submit a Request for Equitable Adjustment (REA) for lost productivity, idle time, or schedule delays resulting from IT outages that fall within the ten percent (10%) anticipated downtime allowance.

2. CYBERSECURITY REQUIREMENTS

2.1. CMMC. The activities required by this contract necessitate the Contractor’s access to Government Information, including CUI. The Contractor shall implement measures to protect CUI and other sensitive data. The Contract requires CMMC Level 2 C3PAO as required by the Department of Defense (DoD) for the duration of the contract.

2.1.1. Verification of SPRS Score: The Contractor or its parent company must have a current CMMC assessment score in SPRS at the time of award.

2.1.2. Annual Affirmation: The Contractor must provide an annual affirmation of continued compliance in accordance with DFARS 252.204-7021, Contractor Compliance with the CMMC Level Requirements.

2.1.3. Subcontractor Compliance: The Contractor must verify the CMMC level of any subcontractors before sharing CUI.

2.1.4. Reporting Requirements: The Contractor must report cyber incidents within 72 hours via the DoW's cyber incident reporting portal.

2.2. Security Violations. DCSA may require the Contractor to immediately remove individuals from work on the awarded contract, at any time, as a result of individual security violations. If at any time during Contract performance it is determined that the Contractor is not in full compliance with the security and cybersecurity requirements of the awarded contract, the Government may immediately suspend performance under the awarded contract and require the immediate return of all case materials to the Government at full Contractor expense. Any work suspension resulting from a security lapse will not be subject to equitable adjustment; all costs will be borne by the Contractor.

2.3. Upon request of the Contracting Officer (KO) or Contracting Officer’s Representative (COR), the Contractor must immediately return all DCSA Information.

2.4. Contractor Information System Security Assessment

The Contractor shall maintain compliance with the cybersecurity standards specified in this contract.

Pursuant to DFARS 252.240-7997 (DEV 2026-O0025), NIST SP 800-171 DoD Assessment Requirements, the Contractor shall ensure that its covered contractor information systems are prepared to undergo Government-led Medium or High Assessments as directed by the Department of War (DoW).

3. ACCESS TO DCSA SYSTEMS

3.1. System Authorization Access Requests. The Contractor shall submit daily System Authorization Access Requests-DD2875 (SAAR) to the COR identifying all individuals scheduled to separate from the contract that day. The COR will provide administrative instructions for completion and submission deadlines for the SAAR process.

3.2. Zero Trust/Comply to Connect/Hardware. The Contractor is to provide their own computers to connect to the DCSA network.

3.2.1. Each Contractor employee is required to utilize a Common Access Card and government mandated Zero Trust Network Access (ZTNA) solution to access DCSA IT systems. Using shared accounts to access DCSA IT systems is strictly prohibited. Users of the DCSA IT systems will be subject to periodic auditing to ensure compliance with DCSA policies.

3.2.2. Contractor devices must have the ZTNA solution installed as the primary access software for DCSA systems.

3.2.3. In the event of a ZTNA solution outage, the Contractor devices must have the latest Cisco Secure Client Any Connect Client software installed. Currently, DCSA requires version 5.1.6 or newer installed as the back-up solution to the ZTNA solution. DCSA will provide the configuration file for Cisco Secure

Client Any Connect Client Profile. The Contractor is responsible for managing Cisco Secure Client Any Connect Client on their endpoint computers.

3.2.4. DCSA conducts quarterly failover exercises to ensure DCSA systems are accessible to the contractors. The contractors are required to support DCSA during this quarterly verification/validation test. The contractors are required to provide 4-6 staff to conduct quarterly verification/validation tests.

3.2.5. DCSA will prevent network access to any Contractor device that does not have the DCSA approved access control software client installed on an approved Contractor domain member device.

3.2.6. Security control enforcement of interconnected endpoints is accomplished through various means to include continuous monitoring of all concurrent connections to DCSA information systems and networks. All connectivity is subject to ongoing monitoring and validation by DCSA’s network security team.

3.2.6.1. DCSA will provide the primary Endpoint Detection and Response (EDR) solution, but Contractor remains responsible for final remediation, device maintenance, compliance assurance, and vulnerability management.

3.2.6.2. Contractor should attempt to resolve endpoint troubleshooting through internal Contractor Helpdesk before contacting the DCSA Helpdesk for assistance.

3.2.6.3. Compliance will be assured with several levels of action – DCSA will warn and notify Contractor when device compliance falls below an initial threshold and deny access to DCSA resources when a second threshold is reached. Baseline conditions must be met before access to DCSA resources is permitted through the ZTNA solution: device disk must be fully encrypted, the device must be managed and belong to a Contractor domain approved for access to DCSA systems, and the EDR software client must be present. Contractor laptops are recommended to be updated to the latest N-1 system OS version to ensure continued compliance with DCSA ZT enforcement.

3.2.6.4. DCSA will implement the ZTNA agent in accordance with the Department of War (DoW) Zero Trust (ZT) mandate. This is a crucial step in enabling ZT, providing continuous endpoint monitoring and proactive threat identification. To maintain network security, no DCSA software can be modified without prior approval from DCSA.

3.2.7. Endpoint security specifications are as follows: Endpoints must utilize Trusted Platform Module

1.2 or higher.

4. USER INACTIVITY

4.1. Inactivity on DCSA systems may trigger an inquiry from DCSA to the Contractor to determine if access to DCSA systems is still needed. If DCSA system access is pulled from investigative personnel for any reason, that individual will be unable to transmit reports via DCSA systems, and all GFI will be collected in accordance with performance work statement subsections 3.3.4. [Return of GFI for Inactive Personnel] or 3.3.5. [Return of GFI for Terminated, Suspended or Separated Personnel], as appropriate.

4.2. The Contractor will receive a weekly report, of users who have been inactive. The Contractor will be responsible for taking action for each user to either suspend or revoke access or ensure that the user resumes activity.

4.3. User inactivity results:

• BIES/PIPS Inactivity * This will be updated with NBIS developments o 30 Days: Requires Password Reset o 45 Days: Account is Disabled

• Active Directory/Network o 30 Days: Account is Disabled, Requires Reset o 60 Days: Account is Deleted, Recoverable o 90 Days: Account is Deleted, Non-Recoverable

5. CLOUD COMPUTING

5.1. The Contractor is authorized to utilize external Cloud Service Providers (CSP) to store, process, or transmit CUI, provided the CSP meets security requirements equivalent to the FedRAMP Moderate baseline or DoW Impact Level 5 (IL5).

5.2. To ensure CMMC compliance, the Contractor must document the Customer Responsibility Matrix (CRM) and integrate the shared security controls within their assessed system boundary.

5.3. Furthermore, the Contractor shall ensure that the CSP complies with the cyber incident reporting, malicious software, media preservation, and forensic analysis requirements outlined in DFARS 252.204- 7012 paragraphs (c) through (g).

6. TRANSCRIPTION OR RECORDING SOFTWARE

6.1. The Contractor shall not utilize any transcription or recording software, regardless of platform or application, in connection with the performance of this contract without obtaining express, prior written approval from the DCSA. Any request for approval must detail the specific software to be used, the intended purpose, and the security measures in place to protect sensitive information. DCSA reserves the right to deny approval based on security concerns or non-compliance with applicable regulations.

Technical Exhibit B. Personnel Vetting Training Requirements

1. GENERAL REQUIREMENTS

1.1. Training Responsibility and Oversight: The Contractor is responsible for all initial and supplemental training, using a curriculum that incorporates all federally mandated standards. The Contractor shall bear all associated costs, including, but not limited to, travel, lodging, meals, tuition, and similar incidentals. DCSA reserves the right to audit and inspect any aspect of the training program(s).

1.2. Security Briefing: Training, provided by the Contractor, shall include a security briefing, covering the proper handling and storage of case materials, and standards of professional conduct.

1.3. Learning Management System (LMS): If the Contractor develops or uses an LMS, its use under this contract must be coordinated with and approved by DCSA. The Contractor’s LMS must meet all applicable DCSA IT requirements before implementation/utilization.

1.4. Training Completion Verification: The Contractor shall provide certificates of completion for all personnel to the Contracting Officer’s Representative (COR) or the KO upon request. All required training must be completed before any investigative work is conducted under this contract.

1.5. Monthly Training Report: By the 10th calendar day of each month, the Contractor shall submit a training report to the COR detailing all training completed during the preceding month. The report must include the following information for each trainee: last name, first name, middle initial (in separate fields); course title; completion date; test score (if applicable); certificate number (if applicable); and credential issuance date (if applicable).

1.6. Non-Background Investigation (BI) Training: For required training not related to Background Investigations, specifically IT, Security, and Personally Identifiable Information (PII) and Controlled Unclassified Information (CUI) training, see Technical Exhibit L, “Required Contractor Training.”

2. TRAINING REQUIREMENTS FOR BACKGROUND INVESTIGATORS

2.1. Mandatory Training: All Contractor personnel (including subcontractors) conducting background investigations under this contract must complete training that is in compliance with the Performance Accountability Council Background Investigator (BI) National Training Standards (NTS), issued October 10, 2023, before performing any work.

2.2. Training Records: The Contractor shall maintain records verifying investigator training compliance for the duration of the contract. These records must be available for Government audit/inspection within 24 hours and include:

• Training methodology (e.g., instructor-led classroom training, online training, on-the-job training

(OJT))*

• Provider*

• Date completed*

• Specific element(s) of the BI NTS to which the training relates (e.g., program of instruction/course control document reference) *

• Method of assessing training performance outcomes*

• Course titles/descriptions*

• Rosters (to include course title* and investigator name)

• All results and assessment tools

• Transcripts (to include remedial training)

* Items marked with an asterisk are specific requirements outlined in the National Training Standards Implementation Plan, dated July 10, 2024. Retained records must be available for a government audit/inspection within 24 hours.

2.3. Training Reciprocity: DCSA may, at its sole discretion and in accordance with DCSA policy and the National Training Standards Implementation Plan, grant reciprocity for investigators who previously completed an NTS-compliant course of instruction and can provide required documentation as outlined in the National Training Standards Implementation Plan.

2.3.1. Contractors may contact the COR to verify an investigator’s NTS compliance assessment status.

2.3.2. DCSA may require additional training for investigators, even if they have completed training compliant with the Performance Accountability Council Background Investigator National Training Standards, to ensure casework quality and Trusted Workforce 2.0 requirements.

2.4. Training Plan Review: DCSA will review Contractor training plans for compliance with the Performance Accountability Council Background Investigator National Training Standards and DCSA policies and procedures.

2.5. DCSA-Specific Training: All investigators must be trained in accordance with DCSA’s background investigation requirements as detailed in Section 3, “Qualifications and Training Requirements for Background Investigators.”

2.6. DCSA Training Materials: DCSA will provide instructional materials covering, at a minimum, the following topics to assist in Contractor training development:

• Investigation process/procedures

• Coverage

• Briefing

• Note taking

• Subject Interviews

• Personal Source Interviews

• Records

• Issue Resolution

• Reporting

Note: DCSA-provided training materials must be handled according to their classification markings and cannot be shared with external entities without prior written approval from the KO or COR.

2.6.1. The Contractor shall augment the training (e.g., with materials describing Contractor roles and responsibilities, internal control processes, testing, check-rides, mentoring) using its existing staff to ensure compliance with DCSA policies and procedures.

2.6.2. DCSA will conduct an Investigator Train-the-Trainer program upon request.

2.7. DCSA-Offered Training: DCSA may offer or mandate additional background investigator training to Contractor-sponsored candidates throughout the contract’s life, in accordance with the Performance Accountability Council Background Investigator National Training Standards.

2.8. Supplemental Training: DCSA may develop supplemental standards and requirements for investigations during the contract’s life, necessitating additional Contractor training. The Contractor is responsible for all such training and associated costs, including travel, lodging, meals, tuition, and similar incidentals.

2.9. Updates and Revisions: DCSA may periodically update and revise training materials, policies, guidance, and other necessary documentation. Costs associated with distributing these updates to personnel and any required training time are considered normal operating costs and are the sole responsibility of the Contractor. Distribution of these documents outside of personnel cleared by DCSA to work on this contract is strictly prohibited without prior written approval from the KO or COR.

3. QUALIFICATIONS AND TRAINING REQUIREMENTS FOR BACKGROUND INVESTIGATORS

3.1. Background Investigator Qualifications

SPECIALIZED TRAINING EXPERIENCE EDUCATION

*Successful completion of a Background Investigator NTS compliant investigator training course.

And Either

4 years of General Experience* Or

4-year course of study leading to a bachelor’s degree

*Successful completion of a Background Investigator NTS

2 years of Specialized Experience** within the last 5 years

*Successful completion of a Background Investigator NTS

1 year of Specialized Experience** in Federal Background Investigations experience within the last 5 years

* General Experience is progressively responsible experience which demonstrates the ability to:

• Problem solve: Analyze problems to identify significant factors, gather pertinent data, and recognize solutions.

• Plan and organize work.

• Communicate effectively orally and in writing on a professional level.

** Specialized Experience is progressively responsible experience which includes conducting:

• General background investigations as a local, state, military, or Federal law enforcement officer. Federal background investigations for a federal agency.

3.1.1. Background Investigator training must encompass, at a minimum, Federal Personnel Vetting Investigative Standards, applicable Executive Orders, Security Executive Agent Directives, governing policies, investigative methodology, issue resolution, interviewing techniques, and the following background investigator core competencies as defined by the Performance Accountability National Training Standards for Background Investigators:

• Technical Competence: Uses knowledge that is acquired through formal training or extensive on-the-job experience to perform one's job; works with, understands, and evaluates technical information related to the job; advises others on technical issues.

• Planning: Organizes work, sets priorities, and determines resource requirements; determines short- or long-term goals and strategies to achieve them; coordinates with other organizations or parts of the organization to accomplish goals; monitors progress and evaluates outcomes.

• Autonomy: Displays a high level of initiative, effort, and commitment towards completing assignments in a timely manner; works with minimal supervision; is motivated to achieve;

understands how professional, technical, and personal conduct affects self and others;

demonstrates responsible behavior.

• Communication: Uses interpersonal, speaking, and writing skills to show understanding, friendliness, courtesy, tact, empathy, concern, and politeness to others; develops and maintains effective relationships with others; may include effectively dealing with individuals who are difficult, hostile, or distressed; relates well to people from varied backgrounds and different situations; is sensitive to cultural diversity, race, gender, disabilities, and other individual differences.

• Technology Application: Uses technology effectively in the performance of the job; accepts and integrates new technology when appropriate.

3.1.2. The Background Investigator training program will, at a minimum, prepare students to achieve the following three terminal performance objectives:

• Given a background investigation assignment, conduct necessary planning functions to include preparing a briefing guide, prioritizing workload, scheduling appointments, and performing administrative duties in accordance with the appropriate National Standards and/or Agency policies.

• Having planned a background investigation, conduct required fieldwork activities consisting of record reviews, resource/ reference interviews, subject interviews, and pursuit of investigative issues in accordance with the appropriate National Standards and/or Agency policies.

• In accordance with the appropriate National Standards and/or Agency policies, use the information obtained during the investigation to write and submit a Report of Investigation.

3.1.3. All investigator training materials and supporting documentation must comply with the Revised Trusted Workforce 2.0 Policies, Standards, and Implementation Guidance, the National Training Standards Implementation Plan, and applicable DCSA policies and procedures. Contractors may use their preferred training methodologies but must adhere to the conditions outlined in the National Training Standards Implementation Plan. DCSA and other authorized entities retain the right to inspect, verify, audit, or monitor training and materials at any time. Identified corrections/changes must be implemented upon notification.

3.1.4. The Contractor shall maintain and provide upon request an investigator training matrix cross-referencing each NTS Performance Indicator (PI) and Occupational/Technical Knowledge and Skills (OTKS) with its corresponding location within the training materials (e.g., document name, page number) and the associated enabling and terminal performance objectives. Answer keys for tests, quizzes, and graded exercises must similarly identify the relevant PIs and supporting objectives for each item. This information is necessary to ensure training materials align with the Performance Accountability Council Background Investigator Training Standards and supports inspections, training program reviews, and audits. The goal is to ensure that evaluated PIs and OTKSs are communicated and assessed in accordance with DCSA policies and procedures.

3.1.5. The Contractor shall retain all training-related information for the contract duration. This includes course descriptions, rosters (including course title and investigator name), training dates, results, transcripts (including remedial training), and assessment tools. These records must be available for Government audit/inspection.

3.2. New Background Investigator Training: All training for new Background Investigator personnel must comply with the Revised Trusted Workforce 2.0 Policies, Standards, and Implementation Guidance and the National Training Standards Implementation Plan. The Contractor will determine the duration, format, and delivery of required training components and mentoring, which must be at least six weeks.

Training will cover all aspects of background investigator duties, including mock interviews and an On-the-Job Training (OJT) component. Trainees must demonstrate proficiency in all NTS performance indicators and OTKSs. Assessments will consist of knowledge tests and practical evaluations, with a minimum passing score of 80% on each. The Contractor will remediate any deficiencies using appropriate methodologies (e.g., OJT). The Contractor will also establish a process for assessing individual training needs based on knowledge, skills, abilities, and aptitude, which will inform the appropriate amount of OJT. OJT must include observation, review, and discussion of the trainee's work by a senior staff member experienced in DCSA investigations, technology, policy, and procedures. Post-training audits are required for at least 30 days following the mentoring phase.

3.3. Experienced Background Investigator Training: For experienced and trained investigators (defined as having training compliant with the Performance Accountability Council Background Investigator National Training Standards and possessing specialized experience), the Contractor will determine the appropriate duration, format, and delivery of required training and mentoring. All experienced investigators must be trained in all 70 performance indicators and the 15 Occupational/Technical Knowledge and Skills (OTKS)1 listed in the Performance Accountability Council Background Investigator National Training Standards. Documentation validating this training or demonstrating proficiency, as described in paragraph 3.1, must be provided to DCSA within 24 hours of request.

3.3.1. Experienced and trained investigators who meet the above requirements are eligible to continue working in the same capacity with a different employer. They must demonstrate NTS knowledge, skills, and abilities through a Contractor-defined performance assessment, with a minimum passing score of 80%. Any deficiencies must be remediated using appropriate methodologies (e.g., OJT). Documentation of the assessment process must be maintained and available for DCSA review within 24 hours of request.

3.4. Shared Investigative Personnel: When investigators are shared by multiple contractors or move between contractors, both contractors must ensure the investigators are trained in accordance with the Performance Accountability Council Background Investigator National Training Standards and maintain documentation as outlined in the National Training Standards Implementation Plan. Contractors may require additional training and/or assessments at their discretion. They must maintain documentation as specified in paragraph 2.2 and provide it to DCSA within 24 hours of request. DCSA must be notified immediately if shared personnel cannot complete the training requirements of any participating Contractor.

4. QUALIFICATIONS AND TRAINING REQUIREMENTS FOR OTHER INVESTIGATIVE SUPPORT PERSONNEL

4.1. Training Requirement: Investigative support personnel (e.g., record collectors, investigative technicians, subcontractors) conducting investigative work under this contract must be trained in DCSA’s background investigation requirements before performing any work.

4.2. Training Records: The Contractor shall maintain and make available for Government audit/inspection (within 24 hours) records verifying required training. These records must include course descriptions, rosters (including course title and personnel name), training dates, results, assessment tools, and transcripts (including remedial training). These records must be retained for the contract's duration.

4.3. DCSA-Offered Training: DCSA may offer or mandate training for Contractor-sponsored candidates during the contract's life. The Contractor is responsible for all such training costs, including travel, lodging, meals, tuition, and similar incidentals.

4.4. Investigative Technician and Record Searcher Qualifications: Investigative Technician and Record Searcher personnel must complete a respective training course and have either one year of general

1 IAW Presidential Executive Orders Place, training programs will not address or train OTKS 5 and OTKS 6.

experience or a high school diploma. General experience is defined as progressively responsible experience demonstrating the ability to:

• Analyze problems, identify significant factors, gather pertinent data, and recognize solutions.

• Plan and organize work.

• Communicate effectively orally and in writing on a professional level.

4.5. Training Content: The training will cover various aspects of the role, including (but not limited to) instruction on job duties, conducting and reporting record searches, mock interviews and/or mock record reviews (as applicable), situations for obtaining records (if relevant to the position), and a final exam that must be passed, with remediation provided as needed. Training should also include any applicable duties defined by Federal Personnel Vetting Standards, Executive Orders, Intelligence Community Directives, governing policies, methodology, issue resolution, and interviewing techniques.

Training will also cover relevant mission systems. The Contractor sets the minimum passing score for the final exam consistent with established standards of competence.

4.6. Mentoring: These personnel must receive mentoring from a senior, experienced staff member or investigator until they demonstrate competency in all (or designated) tasks. Mentoring includes observation of the trainee's work by a senior staff member knowledgeable in DCSA investigations, technology, policy, and procedures. Post-training audits are required for at least 30 days following the mentoring phase.

Technical Exhibit C. Personnel Vetting Security Requirements

1. GENERAL

1.1. Security Requirements

The Contractor and any subcontractor(s)/consultants will comply with the provisions established in Federal regulations, DCSA policies and procedures for the protection of CUI and material. Any revisions to DCSA policies, procedures or manuals will be provided to the Contractor by DCSA and incorporated by reference into this Contract. All personnel supporting this contract are responsible for completing all security-related training. The Contractor agrees to insert terms that conform substantially to the language of this section in all subcontracts under this Contract that involve access to Classified Information and CUI.

1.2. Security Compliance

If at any time during Contract performance it is determined that the Contractor is not in full compliance with any of the security requirements of the Contract, the Government may immediately suspend performance under the Contract and require the immediate return of all case materials to the Government at full Contractor expense.

1.3. Adherence to NISPOM

The Contractor will adhere to the requirements established in the 32 CFR Part 117, National Industrial Security Program Operating Manual, DoD 5220.22-M/NISPOM, Chapter 1, Section 2, 1-201, and appoint a Facility Security Officer (FSO) to supervise and direct security measures necessary for implementing applicable requirements of the NISPOM and related Federal requirements for the protection of Classified Information and CUI.

1.4. Compliance with DCSA Policy on the Protection of Personally Identifiable Information The Contractor will ensure that all personnel comply in accordance with the Privacy Act of 1974, Personally Identifiable Information in 2 CFR Part 200.79 and all applicable DCSA privacy policy guidance.

(See Technical Exhibit E. Requirements for the Protection of Personally Identifiable Information for requirements pertaining to the protection of PII.)

1.5. Destruction Standards

The Contractor will adhere to 32 CFR Part 117 /NISPOM, DoD 5220.22-M/NISPOM, Chapter 5, Section 7 for the destruction of classified material. The Contractor will adhere to DoDI 5200.48 Controlled Unclassified Information, DCSA Instruction 5200.01, or its successor policy, for the destruction of CUI material.

1.6. Common Access Cards and Credentials

The Contractor will establish and implement methods to mitigate the risk that CACs, and/or other credentials are lost, misplaced, or used by unauthorized persons. This will be done in accordance with the security requirements provided in section 3.3.1. (Credentials) and 3.3.3. (Common Access Cards) of the PWS. The Contractor will immediately report any occurrences of lost items to the COR.

2. PERSONNEL SECURITY REQUIREMENTS

2.1. Provision of Staff

The Contractor will provide an adequate, qualified, trained, and investigated/adjudicated investigative support (clerical, technical, professional) staff with the skills necessary to perform all investigative functions referenced in this Contract and all attachments and references. Security/suitability requirements for personnel are found in Executive Orders 13526 and 12968, and credentialing and fitness standards.

2.2. Favorably Adjudicated Background Investigations

The Contractor personnel, to include their subcontractors, and consultants engaged in the performance of work under this Contract will have a completed, current investigation of the appropriate level relevant to the sensitivity of the position and access they require with a favorable eligibility determination. The level of investigation and eligibility determination requirement, appropriately designated through use of the Position Designation Tool (PDT), is determined by position, function, and level of access, or possession of administrative capabilities in a system storing background and personnel security investigations and adjudicative data. Personnel in positions involving investigative duties (including access to or handling of background investigations or counterintelligence investigations), in positions related to the adjudication, recommendation of adjudicative determinations, or granting of national security eligibility, or in positions providing administrative capabilities in a system storing background and adjudicative data, require a High Tier background investigation with a TOP SECRET eligibility determination. Personnel with routine access to investigative files without the capability to render national security determinations or who serve in program management administrative positions require a Moderate Tier background investigation with a SECRET eligibility determination at a minimum. The investigation must be favorably adjudicated by the Trust Decision (Adjudications) prior to the Contractor employee working under this Contract and prior to any subsequent change of position. An interim determination for eligibility may be utilized for access in accordance with DoDM 5200.02, unless prohibited by the requirements of the position. Trust Decision (Adjudications) must complete the final adjudication. (See section 2.5. of this document for more on interim eligibility.)

Upon notification of favorable adjudication by DCSA, the Contractor has forty-five (45) calendar days to onboard the approved individual. If the Contractor fails to onboard the individual within this timeframe, and the delay is not directly attributable to the Government, the Contractor shall reimburse the DCSA Federal Investigations Notice rate for the cost of the background investigation. This reimbursement shall be processed as an offset on the next scheduled invoice.

2.3. Reportable Requirements

Trust Decision (Adjudications) is responsible for the adjudication and administration of clearances and access for Contractor personnel. In order to properly administer this program, the Contractor will report incidents in accordance with NISPOM Chapter 1, Section 3, and Security Executive Agent Directive 3.

2.3.1. Reportable Events Analysis: All reportable events will be analyzed to determine impact on an individual’s current access or clearance level. Determinations will be communicated through the Contractor’s Facility Security Officer.

2.3.2. Reportable Event Deliverable: All reportable events will be delivered through the incident report function within the DoD adjudication system of record, or personnel security database.

2.4. Approval Process

The Government will review proposed Contractor personnel to ensure they meet the requirements of the contract only after verification of an existing current favorably adjudicated investigation and eligibility determination that meets or exceeds the needs of the individual’s intended position.

Contractor personnel performing work under this Contract must be enrolled in, and remain compliant with, the appropriate Continuous Vetting (CV) capability corresponding to their designated investigative tier and position designation, in accordance with Federal Personnel Vetting Guidelines and Trusted Workforce 2.0 standards. The Contractor’s FSO is responsible for ensuring all assigned personnel are successfully enrolled in CV through DCSA. The Contractor must proactively coordinate with the COR and the Government Vetting Authority to maintain CV enrollment and immediately report any changes in status or security-relevant information.

2.5. Interim Eligibility

Trust Decision (Adjudications) has the authority to grant an interim eligibility determination which will allow the Contractor personnel to train and begin supporting the contract and access related systems.

All contractor personnel supporting this contract, excluding those in roles assigned IT privileged user or system administrative responsibilities submitted for an eligibility determination will be considered for interim eligibility. In the event that Trust Decision (Adjudications) discovers or receives information that could result in an unfavorable determination at any time during the investigation or eligibility determination, Trust Decision (Adjudications) may withdraw the Interim Eligibility and access could be revoked or suspended.

2.6. Sponsoring Company

If an individual is cleared to work for multiple BI Fieldwork Contractors under the DCSA BI Fieldwork Contract, the sponsoring company will be the first company that the individual was cleared to work for according to DoD adjudication system of record (DISS or the Intelligence Community’s Scattered Castles database). The sponsoring company is administratively and financially responsible for certain requirements relating to sponsored personnel, including, but not limited to, Credential and CAC accountability, and DCSA’s required annual training. If the individual is favorably separated from the sponsoring company and is cleared to work for other BI Fieldwork Contractor, the new sponsoring company will be the one with the earliest clearance date for that individual according to DoD adjudication system of record. If an employee is on off duty status with the sponsoring company, but is cleared to work for other BI Fieldwork Contractors, sponsorship may be transferred upon request by another Contractor and subject to DCSA approval.

2.7. DCSA’s Right to Suspend or Remove Contractor Personnel’s Clearance to Work on the Contract As this Contract is essential to the National Security of the United States, all persons performing work under this Contract will be held to the highest ethical standards. The Contractor will exhibit high ethical and professional standards as set forth in pertinent DoD and DCSA policies in the performance of all fieldwork under the Contract. DCSA may, for any reason, immediately suspend or revoke Contractor or Contractor personnel NBIS and facility access authorization, security clearance, and/or general access to perform work under the Contract. Upon such suspension or removal to work on the Contract, the Contractor will immediately discontinue their employee’s access to all systems and files supporting the Contract and comply with all other requirements of this Contract regarding separated or suspended personnel. The Contractor will not direct its personnel to contact DCSA for details concerning a suspension or removal.

2.8. Recordkeeping Requirements

Upon request of DCSA, the Contractor will provide any and all requested records for its personnel, subject to the limitations noted below. DCSA will provide the Contractor with a written request for the records sought, and the Contractor will provide such records within seven (7) calendar days. Such records may include, but are not limited to: personnel, timekeeping, security, training, work assignments or any other records in possession of the Contractor and relating to the specified individual’s employment or record of performance (i.e., computer logs, employee phone records for company/employer provided phone). Exceptions to this requirement include records containing employee health information, information regarding requests for accommodation under the Americans with Disabilities Act or state disability laws, paperwork related to requests under the Family Medical Leave Act or state equivalents or other information covered by Health Insurance Portability and Accountability Act, or any other information protected from disclosure under state or Federal law will not be supplied.

2.9. Security Training

The Contractor shall be compliant with applicable training requirements set forth in NISPOM and the PWS. A complete list of required training for Contractors who access DCSA networks is located in Technical Exhibit L.

3. PHYSICAL SECURITY REQUIREMENTS

3.1. Required Security Classification

The Government will notify Contractor of required security classification associated with this contract, and of any subsequent revisions in such security classifications, by use of Contract Security Classification Specification (DD Form 254), or other written notification. A draft DD Form 254 is attached to this Exhibit, and the final executed version will replace that draft upon contract award.

3.2. Administrative

Facility Clearance. The Contractor Company shall possess and maintain a TOP SECRET Facility clearance granted by the DCSA at the time of proposal submission and must maintain the level of security throughout the life of the contract to include all potential option years identified in the PWS. All contractor personnel supporting this contract shall be US Persons and shall possess and maintain a clearance/eligibility determination based on a favorably adjudicated background investigation at the levels specified in section 2.2. of this document and be within investigation scope and/or currently enrolled in Continuous Evaluation (CE) / CV prior to contract performance and throughout the life of the contract to include all potential option years identified in the PWS. It is incumbent upon the Contractor to ensure that the necessary security paperwork is submitted in sufficient time to enable each individual to be cleared prior to proposal submission. In accordance with DoDM 5200.02 and the Director Intelligence Counterintelligence, Law Enforcement, and Security Memo, an Interim Determination for eligibility to access classified information can be utilized for access unless prohibited by the requirements of these positions.

The DD 254 shall be completed within the Defense Counterintelligence and Security Agency National Industrial Security System Increment 2 (NI2), which superseded NCCS (https://niss.dcsa.mil/) at contract award. The DD 254 will be housed within NI2 through the life of the contract. The Contractor shall be required to be registered within NI2 at time of award to gain access to the DD 254. It is incumbent upon the Contractor to ensure that the necessary security paperwork is submitted in sufficient time to enable each individual to be cleared prior to beginning work on this contract. In the event that NI2 is superseded by another System Of Record, the same requirements apply. The DCSA KO will maintain the DD254 in the DCSA Official Contract File. The Contractor is required to maintain a copy in their records and to ensure distribution to their Cognizant Security Office. Subcontracting on this effort requires approval of the DCSA KO or DCSA Agreements Officer (AO). If approved, contractor shall provide copies of all Subcontract DD254s to the Government Contracting Activity (GCA) and KO. For accesses which require prior written authorization from the GCA, KO, the contractor shall submit a DRAFT SUBCONTRACT DD254 to the GCA and KO for review and concurrence with coordination of the DCSA Industrial Security Program Manager.

The Contractor shall comply with (1) Security Agreement (DD Form 441/DD Form 441-1), including the NISPOM, DoD 5220.22-M and any revisions and (2) 32 CFR Part 117. Provisions of the Privacy Act apply to all records and reports maintained by the contractors.

Contractor personnel performing or assigned under this contract must be U.S. persons. Security Classification Guide requests should be presented to the Government Sponsor, if required, subsequent to contract award. All classified information received or generated under this contract is the property of the U. S. Government. The U. S. Government shall provide disposition instructions. No release of classified information or controlled unclassified information under this contract is authorized. All requirements for control and accounting of original documentation and copies apply. All applicable provisions of the NISPOM and its supplements and 32 CFR Part 117 apply. Any classified information shall be transmitted in accordance with DOD 5200.01, DOD Information Security Program Regulations.

The contractor shall adhere to Chapter 8, NISPOM, which applies to non-DoD IT systems.

Within 10 days of contract award, prime contractor shall submit a Visit Authorization Request (VAR) to DCSA Security Office to validate that all management, supervisory, and other personnel assigned to this contract meet the clearance. Failure to provide security eligibility information shall delay and/or deny the individual access to DCSA, and DoD facilities and information. It is the responsibility of the Prime Contractor to maintain either an owning or servicing relationship in Defense Industrial System for Security (DISS) with all personnel supporting this contract, this includes Prime contractor personnel, subcontractor personnel, and any consultants. All Visit Authorization Requests (VARs) submitted to the host government locations must be sent via the DISS and *must* come from the Prime Contractor's SMO in DISS. For visits to DCSA, Collateral Visit Authorization Requests should be sent to SMO

DCSAHQSEC.

In accordance with Security Executive Agent Directive (SEAD) 3 all covered individuals who have been granted eligibility or hold a sensitive position shall report as required in this directive to DCSA and must be favorably adjudicated, by Trust Decision (Adjudications).

Contractor is not authorized to subcontract on this effort without an approved subcontracting plan with written GCA/COR authorization.

All CACs, building access badges, and parking passes must be returned immediately at the end of the period of performance date.

Period of Performance: The period of performance for this effort has a five-year base period and five one-year option periods. The final period of performance dates will be reflected in the base contract and associated task orders.

All programs and materials developed at government expense during the performance period of this contract are the property of the US Government.

Prior to granting an employee access to classified information and/or materials, the contractor shall brief employees with regard to their obligation to comply with the NISPOM, to include any changes and/or amendments, and 32 CFR Part 117. The contractor’s employees shall be debriefed when access to the material is no longer needed or is terminated. A list of all employees who have had access to classified information during the period of this contract shall be maintained by the contractor company and be available for DCSA inspection.

3.3. Access to General Protection/Security Policies and Procedures.

All contractor employees, including subcontractor employees stationed or assigned on a US Government facility shall comply with applicable installation, facility access procedures and local security policies (provided by the US Government security personnel). The contractor workforce shall comply with all personal identification verification requirements as directed by DCSA and/or local policy. In addition to the changes otherwise authorized by the changes clause in this contract, should the Force Protection Condition at any individual facility or installation change, the US Government may require changes in the contractor security processes or procedures.

Contractors requiring access to US Government IT systems must adhere to all US Government requirements. All contractor employees and any associated subcontractor employees shall annually complete the DoD Information Assurance Training and sign an Acceptable Use Policy (AUP). The training certificate and AUP must be provided to the designated personnel at US Government facilities before issuance of network access and annually thereafter.

Contactor employees shall abide by US Government Security Regulations and Security Standard Operating Procedures when working on-site at US Government facilities/installations and shall annually attend Government mandatory training including Operational Security, Security Awareness, Subversion and Espionage, Ethics and Prevention of Sexual Harassment, and any/all other training as directed by the US Government.

CACs are authorized for contractor employees that work on-site at DCSA Government facility. CACs are the property of the US Government and shall be given to the Contractor Facility Security Officer upon termination of employment with the company, expiration of the CAC, replacement of a CAC, or upon contract completion. The FSO shall immediately return the CACs to the DCSA Government KO or COR.

The loss of a CAC shall be reported on the first business day following the discovery of the lost CAC to your chain of command and to the issuing agency.