Attachment I - PWS-SSN-Draft.pdf

Performance Work Statement (PWS) for

PHYSICAL SECURITY (PHYSEC) CONTRACTOR

ENGINEERING AND TECHNICAL SERVICES

In Support Of

Commander, Naval Information Forces

Shore Electronic Security System

Maintenance Program

(SESSMP)

1. INTRODUCTION

This effort provides technical direction, parts and labor for maintenance of electronic security systems and equipment, the respective infrastructure and testing and acceptance in support of Naval Information Forces (NAVIFOR) and subordinate command facilities identified in Appendix B. This effort is to support preventive and corrective maintenance of NAVIFOR Physical Security assets and Critical Infrastructures systems and equipment working in and/or protecting secure facilities.

2. SCOPE

This PWS defines and establishes the requirements and tasks for a comprehensive program for enterprise-wide command facilities quality assurance, engineering mission support and corrective and preventative maintenance as needed of Intrusion Detection Systems (IDS), Closed Circuit Television (CCTV), associated video recording/playback devises, Electronic Access Control Systems (EACS), other ancillary security requirements, software and hardware updates and support equipment. The Electronic Security System (ESS) equipment consists of LENEL components and the contractor needs to provide personnel that are LENEL certified. As built drawings are available upon request.

The Contractor shall provide technical support, preventive and corrective maintenance of security systems at Commands identified in Appendix B to all systems critical to DoD and NAVIFOR supported mission execution and building protection.

Physical security systems, including access control, intrusion detection, closed circuit television, video motion detection, vehicle barriers, and other related physical security elements.

The quality assurance and engineering support herein described is designed to achieve the maximum operational capability of each physical security system by providing Contractor support with the appropriate skill levels and expertise that augment organic NAVIFOR supported commands and mandated physical security capabilities. The objective of this effort is to establish highly skilled Contractor personnel with the requisite skills, expertise and technical background to ensure maximum system availability and continuity. The Contractor shall provide personnel required to successfully implement and manage the tasks prescribed in this PWS.

3. APPLICABLE DOCUMENTS

The following documents form an essential part of the PWS. Subsidiary documents, referenced in the cited documents, are also applicable as referenced herein. In all cases of conflict between provisions of the PWS and the documents referenced herein, this PWS shall govern. Subsequent changes to cited documents are applicable.

ANSI/ASME Y14.100M, Engineering Drawing Practices – (Available for purchase online at the contractor’s expense)

CNSSAM TEMPEST 1-13, Red/Black Installation Guidance dated JAN 14 (Available Online)

MIL-HDBK-45B, General Guidelines for Electronic Equipment, dated 15 Apr 2007 (Available Online)

DoD Instruction 5220.31, National Industrial Security Program (NISP) dated 9 May 2023 (Available Online)

Part 117 of Title 32 Code of Federal Regulations National Industrial Security Program Operating Manual (NISPOM), dated 2 Feb 22024 (Available Online)

Technical Specifications For Construction and Management of Sensitive Compartmented Information Facilities, Version 1.5.1, IC Tech Spec-for ICD/ICS 705, dated 26 Jul 2021 (Available Online)

DoD Manual 5200.01 Vol 3, DoD Information Security Program: Protection of Classified Information, dated 24 Feb 2012, incorporating Change 3 Effective 28 Jul 2020 (Available Online)

SECNAV M5510.36B, Department of the Navy (DON) Information Security Program, dated 12 July 2019 (Available Online)

SPAWAR Shore Installation Process Handbook V4 (12 Nov 2014) (Available Online)

CMS 1, Communications Security Material System (CMS) Policy and Procedures Manual (Available Online)

4. TECHNICAL REQUIREMENTS

4.1. TASKS

4.1.3 Maintenance

a. The Contractor shall provide preventative and corrective hardware maintenance to existing electronic security equipment and supporting infrastructure at NAVIFOR CONUS and OCONUS sites at a minimum of once per year per site listed in Appendix B.

b. The Contractor shall provide software patches and updates to existing electronic security equipment and supporting hardware/software at NAVIFOR CONUS and OCONUS sites as required.

4.1.4 Quick Response Capability (QRC)

a. On-call Support (Materials and Services). The Contractor shall provide technically qualified engineering, maintenance, and repair personnel, on a 24-hour emergency, or on-call basis to support NAVIFOR field sites within the Continental United States and within 72 hours for sites located outside the Continental United States.

b. Materials and services shall encompass equipment repairs, repair parts, installation and fabrication materials, installation drawings, technical manuals, other documentation, plans and other materials, such as piece parts, modules, peripherals, and minor equipment required to support projects in accordance with NAVIFOR tasking.

c. The QRC task may include 1) preventive and corrective maintenance and or repair, and integration products and services; 2) supply support, fly away support, supply services; and 3) incidental installation materials, units, piece parts, repair parts, programming corrections, and minor materials and documentation. These materials and services shall be provided on an on-call basis or QRC basis, when tasking is received from the NAVIFOR COR.

d. The Contractor shall submit maintenance and installation reports to the NAVIFOR COR summarizing the results of each period of on-call QRC service.

5. PLACE OF PERFORMANCE

Government Facilities: To ensure quick response to NAVIFOR facility requirements, the Government will provide required office space for two technicians and two unclassified network access to be shared at NAVIFOR Headquarters. Supported sites within CONUS and at OCONUS locations will provide space to work from during installations, refresh and/or maintenance visits. Please see Appendix B (NAVIFOR Locations) for a list of sites regarding the Place of Performance.

6. TRAVEL

The contractor may be required to travel in the performance of the tasking detailed in this PWS. All travel costs incurred will be separately priced and executed in accordance with the Federal Travel Regulations (FTR). This directive can be accessed at http://www.gsa.gov/portal/ext/public/site/FTR/file/FTRTOC.html/category/21865/hostUr i/portal. Travel costs for transportation, lodging, meals, and incidentals are allowable if incurred by contractor personnel on official business. Travel related costs shall be reasonable. See FAR 31.205-46 for more information on travel costs. Travel costs are further limited by funds specified in the contract.

Travel may be required to deploy and support installations, develop BESEP’s, or in response to outages or upgrades. All installation work will be performed at NAVIFOR ADCON facilities. The COR shall approve all travel, in writing, prior to performance.

Local travel will not be reimbursed. Travel will be required to the 7 following locations:

- Naval Information Forces Command (NAVIFOR), Suffolk, VA

- Naval Computer and Telecommunications Area Master Station Atlantic (NCTAMSLANT), Norfolk, VA

- Naval Computer and Telecommunications Station (NCTS) Bahrain, Manama Bahrain

- Naval Computer and Telecommunications Station (NCTS) Hampton Roads, Norfolk, VA

- Commander Naval Information Warfare Training Group (CNIWTG) Virginia Beach, VA

- Naval Information Warfare Training Group (IWTG) Norfolk, VA

- Fleet Weather Center Norfolk (FWC-N) Norfolk, VA

7. SECTION 508 COMPLIANCE

The Contractor shall conform to all Section 508 requirements when developing, procuring, or maintaining electronic and information technology products or systems.

8. SECURITY

The Contractor shall fully comply with the requirements of the DD Form 254, Contract Security Classification Specification. All Contractor personnel requiring access to classified information systems or electronic security systems shall possess at a minimum a current TOP SECRET/SCI eligibility by time of award.

The Contractor shall submit, update, and maintain a current Contractor Position Roster Log (CPRL), Form G5573. The Contractor shall work to ensure that modifications to the CPRL are minimal. The Government COR will provide a Classification/ Declassification Guide for use as needed.

All subcontracts that require subcontractor personnel to have access to classified information or perform work within secure facilities; either Government or Contractor shall be subject to the same security requirements as set forth above.

9. DELIVERABLES

Progress Reports - The Contractor shall prepare a detailed written progress report for each task on a bi-weekly basis no later than the following Wednesday after the bi-weekly period. The report will reflect progress based on each tasking. The report will note all Contractor personnel and subcontractors working during each reporting period. The report will note any impacts to the schedule identifying the situation causing the impact.

When applicable, provide actions taken to resolve the situation. The report shall be submitted to the COR.

Maintenance Report - The Contractor shall prepare a detailed report as repairs are made to security equipment and supporting infrastructure. The report shall be delivered no later than 7 business days after the system and equipment is returned to full operational status. The report shall be provided in softcopy in MS Office format. The report shall be submitted to the COR.

Trip Reports - The Contractor shall prepare a detailed written trip report, which includes a technical evaluation and an assessment summary of all topics covered during each trip and this report shall be submitted to the COR no later than 7 business days after return from the trip. The report shall summarize technical performance and highlight all areas that impact system maintenance and operational performance, identify possible causes, determine the impact these problems may have on other organizations and program milestones, and suggest corrective actions to resolve all identified problems.

Contractor Position Roster Log (CPRL) - The Contractor shall maintain a current Contractor Position Roster Log (CPRL), Form G5573. The Contractor shall submit the initial CPRL within 10 business days of contract award, and update when personnel are added to or deleted from the roster. This roster shall be submitted for review by the COR. The COR will sign and return the original and retain a copy at NAVIFOR. The Contractor shall work to ensure that modifications to the CPRL are minimal. The COR will provide a Classification/ Declassification Guide for use as needed. The form G5573 shall be populated with the personnel working on this contract, their clearance status, and labor category, Social Security Number, Date and Place of Birth. The form will be utilized by NAVIFOR security personnel to send/receive visit requests.

10. EQUIPMENT:

Materials Procurement: In support of this effort, the Contractor shall purchase equipment and materials (For preventive/corrective maintenance) to include but not limited to LENEL 1100, 1200, 1320 2000, 2220, and 3300 controller boards, batteries, HSPD-12 compliant card readers, passive infrared motion sensors, balance magnetic switches, electric strikes, magnetic locks, request to exit buttons, duress buttons, power supplies, sound masking equipment, closed circuit cameras, LENEL network video recorder, servers, clients, printers, electronic crash bars, and wiring. The Equipment Infrastructure is the physical hardware used to supply power, house electronic equipment and interconnect electronic security systems. The equipment infrastructure includes the transmission media, including telephone lines, cable television lines, satellites and antennas as well as the routers, aggregators, repeaters, converters and the devices that control transmission paths. Control boards, magnetic locks, electronically operated strikes, keypads, batteries and other like materials that actually operate the Electronic Security System(s). Materials are required to support identified tasks in support of Physical Security Systems to include Access Control Equipment, Intrusion Detection Equipment and Closed Circuit Television (CCTV) System Equipment and video record/playback/storage devices for all CCTV. The Contractor shall immediately notify the COR when materials are required. After the COR approves/validates the procurement requirement, the Contractor shall procure material and arrange for shipping directly to the project site. The COR must approve all procurements requested by the Contractor prior to purchase.

11. PERSONNEL QUALIFICATIONS

The Contractor is responsible for providing personnel with expertise on the Technical Requirements listed above in section 4 and Equipment listed above in section 10.

The required equipment meets the requirements set on the LENEL Certified Device List as approved and compatible. LENEL is the brand installed on the security systems throughout the NAVIFOR domain requiring preventive and corrective maintenance. It is imperative that the contractor needs to provide personnel that are LENEL certified.

12. SERVICE CONTRACT REPORTING REQUIREMENTS (OCT 2016)

(a) Definition. First-tier subcontract means a subcontract awarded directly by the Contractor for the purpose of acquiring supplies or services (including construction) for performance of a prime contract. It does not include the Contractor's supplier agreements with vendors, such as long-term arrangements for materials or supplies that benefit multiple contracts and/or the costs of which are normally applied to a Contractor's general and administrative expenses or indirect costs.

(b) The Contractor shall report, in accordance with paragraphs (c) and (d) of this clause, annually by October 31, for services performed under this contract during the preceding Government fiscal year (October 1-September 30).

(c) The Contractor shall report the following information:

(1) Contract number and, as applicable, order number.

(2) The total dollar amount invoiced for services performed during the previous Government fiscal year under the contract.

(3) The number of Contractor direct labor hours expended on the services performed during the previous Government fiscal year.

(4) Data reported by subcontractors under paragraph (f) of this clause.

(d) The information required in paragraph (c) of this clause shall be submitted via the internet at www.sam.gov. (See SAM User Guide). If the Contractor fails to submit the report in a timely manner, the contracting officer will exercise appropriate contractual remedies. In addition, the Contracting Officer will make the Contractor's failure to comply with the reporting requirements a part of the Contractor's performance information under FAR subpart 42.15.

(e) Agencies will review Contractor reported information for reasonableness and consistency with available contract information. In the event the agency believes that revisions to the Contractor reported information are warranted, the agency will notify the Contractor no later than November 15. By November 30, the Contractor shall revise the report, or document its rationale for the agency.

(f)(1) The Contractor shall require each first-tier subcontractor providing services under this contract, with subcontract(s) each valued at or above the thresholds set forth in 4.1703(a)(2), to provide the following detailed information to the Contractor in sufficient time to submit the report:

(i) Subcontract number (including subcontractor name and unique entity identifier); and

(ii) The number of first-tier subcontractor direct-labor hours expended on the services performed during the previous Government fiscal year.

(2) The Contractor shall advise the subcontractor that the information will be made available to the public as required by section 743 of Division C of the Consolidated Appropriations Act, 2010.

13. CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY

CONTROLLED FACILITIES, SENSITIVE INFORMATION,

INFORMATION TECHNOLOGY (IT) SYSTEMS OR PROTECTED

HEALTH INFORMATION

The security text does not apply in cases where the contractor/vendor does not have access to Navy Marine Corps Intranet (NMCI) computers, is not issued a Common Access Card (CAC) and is involved in training or other short term duties of less than 30 days duration that allow for the use of a visitor request. In these cases, the government employee must submit a Visitor Access Request (VAR) to the main gate or applicable processing entity for your facility and assume responsibility to escort those without CAC Credentials.

This local text does not apply to non-United States (U.S.) Nationals (foreign nationals) who are contactor employees performing work overseas. This text is applicable to the U.S. Nationals living in the U.S. or overseas who are performing work on a Navy contract.

The investigation of a non-U.S. national at a foreign location must be consistent with a National Agency Check with Written Inquiries (NACI), to the extent possible and include a fingerprint check against the Federal Bureau of Investigation (FBI) criminal history database, an FBI investigations file (name check) search and a name check against the terrorist screening database. Also, the above cited reference notes that Foreign Nationals may not be granted CAC credentials until completion of their investigation and not in the interim.

Per Department of Defense Memorandum (DoDM) 5200.2, Department of Defense (DoD) components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location.

The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location. The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S. and its allies or agency agreements with the host country.

CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED

FACILITIES, SENSITIVE INFORMATION, IT SYSTEMS OR PROTECTED

HEALTH INFORMATION

Executive Order 13467, Reforming Processes Related to Suitability for Government Employee, Fitness for Contractor Employees and Eligibility for Access to Classified National Security Information, Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 Part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense (OSD), the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy command under this contract is required to obtain a DoD CAC. Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Definition. As used in this clause - Military installation means a base, camp, post, station, yard, center, or other activity under the jurisdiction of the Secretary of a military department, or, in the case of an activity in a foreign country, under the operational control of the Secretary of a military department or the Secretary of Defense (see 10 U.S.C. 2801(c)(4)).

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC.

When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager (CSM) upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

Training. Contractor employees who require routine physical access to a Federally controlled facility or military installation shall complete “Level I Antiterrorism Awareness Training” prior to gaining access to a facility and annually thereafter in accordance with DoDI O-2000.16 Vol. 1. In accordance with Department of Defense Instruction O-2000.16 Volume 1, DoD Antiterrorism (AT) Program Implementation:

DoD AT Standards, Level I Antiterrorism Awareness Training shall be completed by:

1. Completion of “Level I Antiterrorism Awareness Training” available at https://jkodirect.jten.mil/pdf/atl1/launch.html; or

2. Under the instruction of a qualified Level I Antiterrorism Awareness instructor; or

3. By providing a training certificate for “Level I Antiterrorism Awareness Training” training showing completion within the last calendar year.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the COR or to the contracting officer, if a COR is not assigned, prior to being granted access to a Federally controlled facility or military installation.

Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (d), in subcontracts, including subcontracts for commercial items, when subcontractor performance requires routine physical access to a Federally-controlled facility or military installation.

OPERATION SECURITY (OPSEC)

It is DoD policy according to DoD Directive 5205.02E, “DoD Operations Security (OPSEC) Program,” June 20, 2012, as amended to establish and maintain OPSEC programs to ensure national security-related missions and functions are protected.

Training: Contractor employees shall comply with all DoD OPSEC requirements and complete “OPSEC Awareness for Military Members, DoD Employees and Contractor” training within 30 days of onboarding the contract and annual refresher training thereafter. Training shall be completed through a DoD sponsored and certified computer or web-based learning instruction available at https://securityawareness.usalearning.gov/opsec/index.htm.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after training is completed by all employees and subcontractor personnel.

START-UP PERIOD

All contractor resource onboarding documents must be submitted via the prime contractor. The prime contractor shall make all necessary preparations to assume full responsibility for productive performance as of the performance start date.

Definition of "productive":

a. OF-306 signed by contractor employee

b. FD-258 Fingerprint Card (Contingent upon availability of electronic fingerprinting submission)

c. Completed Electronic Investigation (e-QIP)

d. All contractor employees with need for a Common Access Card (CAC) must have an active Defense Information System for Security (DISS) profile.

e. Common Access Card (CAC)

f. DISS Visit Request submitted (Contingent upon classification of work being performed, Confidential, Secret, Top Secret).

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services and no reimbursement will be paid by the government for efforts expended during the start-up period.

Note (2): Foreign Nationals are not allowed access to the functional/system side of Enterprise Resource Planning (ERP).

ACCESS TO DOD INFORMATION TECHNOLOGY (IT) SYSTEM

In accordance with DON CIO Memorandum (IT LEVEL DESIGNATION ON DD FORM 2875 SYSTEM AUTHORIZATION ACCESS REQUEST) 08 September 2020, contractor employees who require access to Department of the Navy (DoN) or DoD networks are categorized as Privileged, Enhanced, or Authorized users. All user level accesses may include positions which require access to Controlled Unclassified Information (CUI). CUI includes sensitive information protected under the Privacy Act, to include Protected Health Information (PHI). IT System levels are determined by the requiring activity's Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring privileged access, (when specified by the terms of the contract) require a Tier 5 (T5) or T5R equivalent investigation, which is a higher level investigation than the Tier 3 (T3) and T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required.

Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance (IA) Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Contractors requiring Enhanced access, (when specified by the terms of the contract) require a T3, T3R, or equivalent investigation, which is a higher level investigation than the Tier 1 (T1) described below. Due to the enhanced system access, an investigation suitable for Moderate Risk national security positions is required.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy CSM and ISSM/IAM manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy IT resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the Contracting Officers Representative (COR) shall sign the SAAR-N as the supervisor.

The SAAR-N shall be forwarded to the CSM upon contractor employee acquiring a Common Access Card (CAC) credential. Failure to obtain a CAC credential may result in delaying the individual's start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all contractor employees requiring access complete annual Cyber Awareness training, and maintain a current requisite background investigation. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

INTERIM ACCESS

The CSM may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

ACCESS TO CONTROLLED UNCLASSIFIED INFORMATION

Safeguarding sensitive unclassified information is critical to achieve NAVSUP Modernization efforts and deliver cutting-edge and uncompromised capabilities. The Secretary of Defense’s operations security (OPSEC) campaign plan stresses the importance of protecting controlled unclassified information (CUI). CUI encompasses OPSEC, critical technology, intelligence, and personally identifiable information that, if not properly identified, marked, and controlled, could impair NAVSUP’s ability to conduct its mission. Contractor employees with access to Controlled Unclassified Information (CUI) shall comply with DoDI 5200.48 - Controlled Unclassified Information (CUI) and complete DoD approved initial and annual refresher CUI training.

a. Whenever Government provides CUI to, or CUI is generated by, non-DoD entities, all CUI records must be handled as required by the approved mandatory disposition authority.

b. All CUI records must follow the approved mandatory disposition authority whenever the Government provides CUI to, or CUI is generated by, non-DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and the DoDI 5200.48.

c. Contractor employees shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

d. Contractor employees shall submit unclassified government information for review and approval for release in accordance with the Standard DoD Component Processes, DoDI 5230.09, and DoDM 5205.07, Volume 1.

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the contractor's security representative. Within three (3) work days after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the contractor's security representative. The contractor's security representative shall be the primary point of contact on any security matter. The contractor's security representative shall not be replaced or removed without prior notice to the Contracting Officer and CSM.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY

APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL

SECURITY POSITIONS OR PERFORMING SENSITIVE DUTIES

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. If the Security Office validates the contractor’s position is Non-Critical Sensitive or if the IT system user level is determined to be Enhanced, at a minimum, each contractor employee must be a US citizen and have a favorably completed T3, T3R, or equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or Enhanced position. The investigation consists of a standard National Agency Check and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or Enhanced position is required to complete:

• SF-86 Questionnaire for National Security Positions (or equivalent Office of Personnel Management (OPM) investigative product)

• Two FD-258 Applicant Fingerprint Cards or electronic fingerprint submission (preferred))

• Original Signed Release Statements

Failure to provide the required documentation at least thirty (30) days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than ten (10) years) throughout the contract performance period. The Contractor’s Security Representative shall contact the CSM for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the CSM upon arrival to the command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

Employees requiring IT access shall also check-in and check-out with the Navy Command’s ISSM/IAM. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy IT resources. The SAAR-N shall be forwarded to the CSM upon the contractor employee acquiring a Common Access Card (CAC) credential. Failure to obtain a CAC credential or provide the required documentation shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Cyber Awareness training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the CSM. The CSM will review the submitted documentation for completeness prior to submitting it to the OPM. Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The CSM will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

For classified contracts, if the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Access Request (VAR) via the Defense Information Security System (DISS). If the contractor employee does not have a current favorably adjudicated investigation, the contractor shall submit the Visit Access Request in DISS until the contractor employee has at a minimum an interim clearance. If the contract only requires access to unclassified information, even if the contractor takes a DISS “owning” role over the contractor employee, the Navy Command will also take a DISS “owning” role over the contractor employee during the hiring process and for the duration of assignment under that contract. If the contract requires access to classified information, the contractor’s Facility Security Office (FSO) will take a DISS “ownership” role and the Navy command will take a DISS “servicing” role during the hiring process and the duration of assignment under that contract. All VARs requires annual renewal for the duration of the employee’s performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY

APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO OR

PERFORMING NON-SENSITIVE DUTIES

Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc...) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

• Must be either a U.S. citizen or a U.S. permanent resident with a minimum of 3 years of legal residency in the U.S. (as required by the Deputy Secretary of Defense DTM 08-006 or its subsequent DoD Instruction (INST)) and

• Must have a favorably completed NACI or T1 investigation or equivalent including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the CSR must submit for all employees each of the following:

• SF-85 Questionnaire for Non-Sensitive Positions

• Two FD-258 Applicant Fingerprint Cards (or the preferred method - electronic fingerprint submission)

• Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably completed NACI or T1 equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM.

Failure to provide the required documentation at least thirty (30) days prior to the individual's start date may result in delaying the individual's start date.

14. PREVENTATIVE/CORRECTIVE MAINTENANCE PROCEDURES

TO FIX, REPLACE AND/OR TEST EQUIPMENT AS NECESSARY

A. Access Control

1. Control Panel

Check installation integrity Check power Check battery Check Communications Check low power/battery alarms (if applicable) Check tamper alarms (if applicable)

2. Doors

Check all devices installation integrity Verify card reader functionality Verify lock functionality Verify door position switch functionality (if applicable) Verify request to exit devices functionality (if applicable) Check door forced/door held open alarms (if applicable)

B. CCTV

1. Headend

Verify DVR/NVR is online Verify DVR/NVR is recording Verify monitors are functional Check low power/battery alarms (if applicable) Verify functionality of other applicable items (fiber modules, POE injectors, etc.)

2. Cameras

Clean lens and enclosure (if applicable) Check for quality image If outdoor, check for moisture and weather seal If PTZ, check for proper PTZ functionality If IP, verify communication with headend

C. Intrusion Detection/Alarm

1. Alarm Panel

Check power Check battery Check communications Check low power/battery alarms (if applicable Check tamper alarms (if applicable)

2. Alarm Keypad

Verify proper functionality

3. Alarm Devices

Test applicable door position switches Test applicable motions Test applicable duress alarms Check applicable alarm sirens Check any additional monitored devices

D. Intercom

1. Master Stations

Check power Check audio quality Check video quality (if applicable) Check door release (if applicable)

2. Sub Stations

Check audio Check video quality (if applicable)

15. ATTACHMENTS

Appendix A - Definitions and Acronyms

Definitions:

Systems - Pertain to electronic and/or mechanical equipment including antennas, amplifiers, cables, radio frequency (RF) Distribution systems, receivers, processors, computer hardware, cameras, intrusion detection, access control, equipment interfaces, communication equipment, and test equipment.

Facilities - Pertains to the equipment and devices used to protect and support the security mission equipment and operation of the station. Includes the power plant (load side), heating, air-conditioning, and ventilation system, utility lighting, grounding and security (lighting, sensors, other intrusion/alarm) systems and related piping, wiring, and distribution systems.

Acronyms:

CAD – Computer-aided Design CCTV – Closed Circuit Television DID – Data Item Description DISS – Defense Information System for Security EACS – Electronic Access Control System ECP – Engineering Change Proposal ESS – Electronic Security System GFE – Government Furnished Equipment HSPD-12 – Homeland Security Presidential Directive IA – Information Assurance IDP – Installation Design Plan IDS – Intrusion Detection System IS - Information System ISSM - Information System Security Manager IT – Information Technology KO – Contracting Officer LAN – Local Area Network NAVSATCOMMFAC – Naval Satellite Communications Facility NCTAMS – Naval Communication-Telecommunication Area Master Station NCTS – Naval Communications-Telecommunications Station ODC – Other Direct Cost PSCs – Product Service Codes QRC – Quick Reaction Capability RF – Radio Frequency SMDB – Station Master Data Base SMDS – Station Master Drawing Set STEP – Site Telecommunications Engineering Plan VOIP – Voice over Internet Protocol WAN – Wide Area Network

Appendix B

APPENDIX B - Command Locations

The following sites will be addressed:

Preventive and Corrective Maintenance

NAVAL INFORMATION FORCES (NAVIFOR), SUFFOLK, VA

NAVAL COMPUTER AND TELECOMMUNICATIONS AREA MASTER STATION

ATLANTIC (NCTAMSLANT), NORFOLK, VA

NAVAL COMPUTER AND TELECOMMUNICATIONS STATION (NCTS) BAHRAIN,

MANAMA BAHRAIN

NAVAL COMPUTER AND TELECOMMUNICATIONS STATION (NCTS)

HAMPTON ROADS, NORFOLK, VA

HEADQUARTERS INFORMATION WARFARE TRAINING GROUP (HQ-IWTG)

VIRGINIA BEACH, VA

NAVAL INFORMATION WARFARE TRAINING GROUP (IWTG) NORFOLK, VA

Corrective Maintenance Only

FLEET WEATHER CENTER (FWC-N) NORFOLK, VA.