Attachment I - Technical Support Services Statement of Work - BPA Contract_FINAL (CLEAN).pdf

ATTACHMENT I

Statement of Work for Technical Support Services

Blanket Purchase Agreement

1. General Information

1.1 Purpose

U.S. Agency for International Development (USAID) Office of Inspector General (OIG) requires technical services in support of our independent evaluations and audit. Such technical services may include external network penetration tests; internal network vulnerability assessments; Wi-Fi, cell phone, and oracle database tests; and related training of OIG staff.

The maximum value for all orders issued against the single-award Blanket Purchase Agreement (BPA) will not exceed $5 million without bilateral agreement from both parties. There is no minimum or maximum number of orders that may be issued against the BPA.

1.2 Background

1.2.1 About USAID OIG

Headquartered in Washington, DC, USAID OIG was established on December 16, 1980, by Public Law 96-533 which amended the Foreign Assistance Act of 1961. On December 29, 1981, the President signed the International Security and Development Cooperation Act of 1981, bringing the USAID OIG under the purview of the Inspector General Act of 1978. The mission of USAID OIG is to contribute to and support the integrity, efficiency, and effectiveness in all activities of USAID. Further information about USAID OIG can be found here: https://oig.usaid.gov.

OIG’s work must be conducted in accordance with applicable standards for the engagement.

Evaluations must be conducted in accordance with the version of the Council of the Inspectors General on Integrity and Efficiency’s Quality Standards for Inspection and Evaluation that are in effect at the time of the evaluation. Similarly, audits must be conducted in accordance with the U.S.

Government Accountability Office’s Government Auditing Standards in effect at the time of the audit.

1.2.2 Organizations That USAID OIG Evaluates and Audits

OIG is responsible for providing auditing or evaluation services to four Federal agencies: USAID, the Millenium Challenge Corporation (MCC), the U.S. African Development Foundation (USADF), and the Inter-American Foundation (IAF). The following paragraphs provide more information about each agency.

USAID is the Federal agency that leads foreign assistance. USAID strives to “provide humanitarian assistance, reduce poverty, strengthen democratic governance, advance economic opportunities” in foreign countries. (Source: https://www.usaid.gov/what-we-do as of July 31, 2024). USAID’s headquarters is in Washington, DC.

https://www.ignet.gov/sites/default/files/files/QualityStandardsforInspectionandEvaluation-2020.pdf https://www.gao.gov/yellowbook

MCC was created by Congress in January 2004. MCC partners with the world’s poorest countries by providing grants to promote “economic growth, reducing poverty, and strengthening institutions.”

These grants are expected to benefit almost 400 million people in 47 countries. (Source:

https://www.mcc.gov/about/ as of July 31, 2024). MCC’s headquarters is in Washington, DC.

USADF was created by Congress in 1980. USADF invests in development activities in 22 African countries by providing “grant capital, capacity building assistance, and convening opportunities to develop, grow and scale African enterprises and entrepreneurs who improve lives and livelihoods.”

(Source: https://usadf.gov/# as of July 31, 2024) USADF’s headquarters is in Washington, DC.

IAF was created by Congress in 1969. IAF invests in development activities in Latin America and the Caribbean by awarding small grants to civil society organizations. These grants are to “promote inclusive economic prosperity, reduce food insecurity, combat corruption, prevent violence and crime, protect the environment and build resilience to natural disasters, and sustainably manage natural resources.” (Source: https://www.iaf.gov/about/ as of July 31, 2024.) IAF’s headquarters is in Washington, DC.

1.3 Objective

The contractor must provide technical support for OIG's information technology evaluations and audits, as defined in individual orders. All work must be planned, conducted, and reported on in accordance with applicable standards. In some circumstances, services may be required during a non-standard workday, such as to minimize the possibility of degrading performance of the Agency’s network and to accommodate countries other time zones.

1.4 SCOPE OF WORK

The purpose of this BPA is to provide an ordering vehicle for USAID OIG to receive nonpersonal technical services in support of information technology evaluations and audits. The contractor operating as independent and not as an agent of the Government, will provide for all labor, tools, materials, facilities, equipment, supervision, and other items necessary, unless specifically stated elsewhere in this document or in the specific order. The Contractor may be required to perform work under multiple orders.

1.4.1 Examples of Types of Work

Some examples of potential types of work to be completed under this BPA call order are as follows:

• Network Penetration Testing o Black box penetration testing o Grey box penetration testing o White box penetration testing

• Other Penetration Testing o Wireless penetration testing o Internet of Things penetration testing o Physical penetration testing

• Technical Vulnerability Assessments o Internal network vulnerability assessment o Oracle database vulnerability assessment

• Employee/Contractor Tests o Social Engineering o Phishing o Faux Malicious Links o Adherence to physical security policies

▪ Use of screen and computer locks

▪ Display of PIV badges

▪ Removal of print output from printers

▪ Tailgating

• Combined Testing (i.e., Red Teaming)

• Conduct training on technical testing

• Stand up a sandbox environment for OIG to practice the technical tools and techniques

• Follow-up work to assess whether the agency implemented technical recommendations

• Conduct technical tests to assess agency staffs’ knowledge of security requirements.

1.4.2 Deliverables

For each BPA call order, deliverables may include the following.

• Detailed work plan for each phase of testing

• Quality assurance plan for each phase of testing

• Rules of engagement for testing to be signed by the contractor, OIG, and agency

• Detailed narrative and supporting documentation of actual testing performed

• Detailed technical report on results of testing and analysis for agency technical staff

• Discussion Paper that discusses the findings from testing so that non-technical readers at the fifth-grade level can understand, as described in individual orders

• Draft Evaluation or Audit Report – Contents of the discussion paper plus a detailed scope and methodology section of the work performed, as described in individual orders

• Final Evaluation or Audit Report – Contents of the draft report plus Agency management’s verbatim comments and the contractor’s- evaluation of the comments, as described in individual orders

• Technical training materials

• Resumes of staff assigned to the BPA call order

• Onboarding documents, such as nondisclosure agreements, statements of independence from the agency, U.S. Office of Personnel Management optional forms 306, Visit Authorization Letters, and Visitors Access Request.

1.4.3 Meetings

For each BPA call order, meetings may include the following.

• Post award meeting

• Session for OIG to train contractor staff on requirements for the engagement (i.e., evaluation or audit)

• Entrance conference for the engagement with agency and OIG officials

• Planning meetings with agency and OIG staff

• Biweekly status meetings with OIG staff

• Biweekly status meetings with agency and OIG staff

• Working meetings with OIG to write the draft and final reports and to address OIG reviewer and agency management comments

• Exit conference for the engagement with agency and OIG officials

• Training sessions

2. Definitions

Contracting Officer (CO) A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings. The term includes certain authorized representatives of the contracting officer acting within the limits of their authority as delegated by the contracting officer.

Only a warranted CO has the authority to issue modifications or otherwise change the terms and conditions of this BPA and its orders. If an individual other than the CO attempts to make changes to the terms and conditions of this BPA or its orders, you shall not proceed with the change and shall immediately notify the CO.

Contracting Officer’s Representative (COR) A federal employee delegated limited authority by a Contracting Officer to monitor and perform specific, enumerated contract management duties related to contract planning, contract administration, technical oversight, and closeout to ensure that the Contractor’s performance meets the standards set forth in the contract.

Upon award of an order, the CO for the Government will designate an authorized COR to supply the contractor with any appropriate Government furnished data and other necessary documents or equipment. Contract interpretation and associated guidance and direction from the Government shall not be official unless specifically provided by the COR or the CO. The COR will seek timely progress of the work and its satisfactory completion.

Defective Service A service output that does not meet the standard of performance requirement specified in the contract for that service.

Performance Requirements Summary (PRS) A listing of the service outputs under the contract that are to be evaluated by the COR on a regular basis, the surveillance methods to be used for these outputs, and the performance requirements of the listed outputs.

Quality Assurance A planned and systemic pattern of all government actions necessary to provide confidence that adequate technical requirements are established; products and services conform to established technical requirements; and satisfactory performance is achieved. Quality assurance refers to actions by the government assurance functions for a contracted service.

Quality Control Those actions taken by a Contractor to control the production of outputs to ensure that they conform to the contract requirements.

3. Technical Contract Requirements

3.1 Contract Manager

The Contractor shall provide a contract manager who will be responsible for the performance of all work. The name of this person, and an alternate or alternates, who will act for the Contractor when the manager is absent, will be designated in writing to the contracting officer (CO). The contract manager and alternate or alternates will be able to read, write, speak, and understand English.

The contract manager or alternate will have full authority to act for the Contractor on all contract matters relating to daily operation of this contract.

The contract manager or alternate shall be available during normal duty hours within thirty (30) minutes to meet by phone or at the facility with government personnel (designated by the CO) to discuss problem areas. After normal duty hours, the manager or alternate shall be available within two (2) hours.

The contract manager will provide an emergency phone/cell phone number to the COR and CO.

3.2 Contractor Personnel and Work Products

The contractor will not employ persons for work on this contract if such person is considered by the CO to be a potential threat to the health, safety, security, general well-being, or operational mission of the facility and its population.

Contractor personnel will present a neat appearance and be dressed appropriately for the work to be completed. Contractor personnel should be highly motivated, energetic self-starters, and possess nothing less than the utmost in professional demeanor, responsiveness, appearance, and deportment. Contractor personnel may be required to interface with senior, influential, international officials in the course of their work and should be adept at communication in a clear, concise and accurate manner.

The contractor will not employ any person who is an employee of the U.S. government if employing that person would create a conflict of interest. Before contractor personnel can begin work, they will sign and submit a “Conflict of Interest Certificate - Personal,” otherwise known as Attachment II, and “Contractor Non-Disclosure Agreement Form,” otherwise known as Attachment III to the CO and COR as specified in the specific call order. Both Attachment II and III will be updated at least annually. These documents shall be provided to the CO and COR.

At a minimum, contractor personnel should be able to:

• Read, write, speak, and understand the English Language.

• Have proficiency in the use of Microsoft Office Suite of applications including Word, Excel, PowerPoint, and Project (as appropriate for the position); and Adobe Acrobat.

The Government requires all work products and activities to be based on thorough research, all applicable laws and regulations, official Government policy guidance, irreproachable ethical behavior, and sound business judgment. Contractor will use its professional judgment and experience to suggest improved strategies, question non-conforming practices, make recommendations for correction of deficiencies, and provide suggestions to their designated work centers.

3.3 Contractor Personnel Identification

The Contractor will, when communicating with outside parties, USAID personnel, and other USAID contractors advise that they are agency contractors to ensure they are not mistaken as government employees.

Contractor personnel will identify themselves as an agency contractor in all documents (e.g., reports, correspondence, etc.) which they are listed as the point of contact. Email messages from contractor personnel will contain a signature block identifying the individual as contractor personnel with the firm’s name with a reference to being a USAID agency contractor.

The contractor will display on their person an identification badge that clearly indicates that he/she is a USAID contractor when on-site and when off-site if their “attendance” is related to providing services under this contract.

Standardized identification desk or cubicle placards will be provided identifying personnel as a contractor if stationed within a government facility.

3.4 Contractor Work Force Responsibility

It shall be the full responsibility of the Contractor to organize, furnish, maintain, supervise, and direct a workforce, which, within the limitations of the provisions of this BPA, is thoroughly capable of effectively performing the work set forth in this contract.

3.5 Transfer and Exchange of Contractor Personnel

Specified at the call order level.

3.6 Performance Evaluation Meetings

3.7 Government Point of Contact for Quality Assurance

The Contracting Officer’s Representative (COR) is the Government’s Point of Contact. If a separate COR is designated on a Call Order, a separate letter shall be provided to the Contractor indicating that individual’s authority.

3.8 System of Quality Controls

The contractor must provide for a detailed plan of its internal quality controls over all phases of its technical services provided in relation to section 1 of this BPA inclusive of subcontractor’s internal quality control processes and mechanisms.

Note that, for each BPA call, the contractor will be required to provide updated information on its system of quality controls and to attest whether it followed its system of quality controls for the services provided.

3.9 Hours of Operation, Holidays, and Closures

3.9.1 Hours of Operation

The Government’s hours of operation are typically from 7:30 AM to 6:00 PM Eastern, Monday through Friday, except for legal holidays. Any deviations from this schedule shall be annotated in the specific Call Order. The Contractor shall be required to complete all work during the specified hours of operation. If any unique circumstances arise in which there is a need to deviate from these hours, the Contractor shall contact the CO at least five (5) business days prior with the specific details regarding the need for a deviation. If the deviation is acceptable, the CO will notify the Contractor.

3.9.2 Official Federal Holidays

Official Federal Holidays are listed below:

New Year’s Day Martin Luther King, Jr.’s Birthday Washington’s Birthday Memorial Day Juneteenth National Independence Day Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

Visit the official website for specific dates of these holidays at: https://www.opm.gov/policydata-oversight/pay-leave/federal-holidays/. http://www.opm.gov/Operating_Status_Schedules/

Additional days may be designated by Federal law, Executive Order, or Presidential Proclamation.

Services under this contract are not required to be performed on federal holidays unless specified in the individual BPA Call Order.

3.9.3 Closures

When the facility is closed due to inclement weather, there may be circumstances which require the contractor personnel to work remotely. If this situation occurs, the contract manager will contact the COR regarding the circumstances and request permission for the contractor personnel to telework. If approved, the contract manager shall provide a report to the COR pertaining to what was accomplished by that individual. Costs associated with the contractor working remotely will be no greater than those associated with the use of the Government facility.

3.9.4 Shutdowns

If the Government is shut down, information shall be provided to the Contractor with appropriate instructions related to their performance during this time period. If necessary, a change order modification may be issued related to potential decreases in the effort from the Contractor.

http://www.opm.gov/Operating_Status_Schedules/

3.10 Telework

The Government may designate some types of work under specific Call Orders that can be completed as telework. For those positions that the Contractor does permit those staff members to telework, the contractor shall be required to submit a telework plan to the CO, with a copy to the COR, for approval prior to them commencing telework. The telework plan shall indicate the specific tasks the individual can perform while teleworking. The Contractor shall ensure that expectations regarding these assignments are discussed in the plan.

3.11 Safety

Contractor personnel working onsite at a government facility will take and pass an online facility safety course. Access information to this website will be provided by the COR after award of the BPA Call Order. Evidence of completion of the course will be provided to the COR within one (1) week after starting work.

3.12 Conservation of Utilities

The Contractor will ensure its personnel practice utility conservation. The Contractor shall be responsible for operating under conditions to prevent the waste of utilities to include, but not limited to lights, heating, ventilation, air conditioning systems, and water.

3.13 Weapons, Firearms, and Ammunition

Contractor personnel are prohibited from possessing weapons, firearms or ammunition, on themselves or within their contractor-owned vehicle or privately owned vehicle while on government property.

3.14 Government Furnished Equipment

3.15 Government-Furnished Services

3.16 Security

3.16.1 Computers and Information Technology Systems

Contractor personnel working under this action typically require investigative requirements for moderate or high when working on a USAID IT System for further details. The COR on the order will coordinate with the contractor regarding whether the work will necessitate high, moderate, or low risk investigation.

Contractor personnel shall have access to sensitive information and federal information technology systems. Contractor personnel shall take due care in safeguarding information and the integrity of IT systems. Contractor personnel working on site shall take and pass an online IT security awareness course. Access information to this website will be provided by the COR after award of the BPA Call Order. Evidence of completion of the course shall be provided to the COR within one

(1) week after starting work.

3.16.2 Physical Security

The Contractor shall be responsible for safeguarding all government property provided for Contractor use. At the end of each work period, all government facilities, equipment and materials shall be secured.

3.16.3 Key Control

If and when required by the call order, the contractor shall establish and implement a method of making sure all keys issued to the contractor by the government are not lost or misplaced and are not used by unauthorized persons. The contractor shall not duplicate any keys issued by the government.

The contractor shall immediately report to the COR or CO any occurrences of lost or duplicated keys.

In the event keys, other than master keys, are lost or duplicated, the contractor may be required, upon written direction of the CO to rekey or replace the affected lock or locks without cost to the government. The government may, however, at its option, replace the affected lock or locks or perform rekeying and deduct the cost of such from the monthly payment due to the contractor. If a master key is lost or duplicated, all locks and keys for that system shall be replaced by the government and the total cost deducted from the monthly payment due to the Contractor.

The contractor shall prohibit the use of keys issued by the government by any persons other than the contractor’s personnel assigned to this BPA. Opening locked areas by contractor personnel to permit entrance of persons other than the contractor personnel engaged in performance of contract work requirement in those areas is prohibited.

3.16.4 Export Controls

Due to the nature of the work and equipment utilized, USAID must ensure that we comply with export control regulations. As a result, the contractor shall request approval from the CO and COR prior to considering any individual that is a foreign national.

3.16.5 Non-U.S. Citizens

Additionally, there may be security concerns with access to the facility for an individual that does not possess a I-551 Permanent Resident Card (Green Card). Though an individual may have a right to work in the country, they may not meet the facility’s security requirements if they do not possess an I-551. To avoid potential concerns, the contractor shall consult the government regarding any non-us citizen that does not possess an I-551.

3.16.6 File Transmission

The contractor must use an agency approved mechanism to securely transmit files to and from the OIG and the agency.

3.17 Government-Contractor Relations (Non-Personal Services)

The Government and Contractor understand and agree that the services to be delivered under this BPA are non-personal services as defined in the Federal Acquisition Regulations (FAR) 2.101. No employer-employee relationship exists or will exist under this BPA between the Government and the Contractor’s personnel.

Contractor personnel under this BPA shall not be placed in a position where they are under relatively continuous supervision and control of a Government employee.

3.17.1 Employee Relationship

The rules, regulations, directives, and requirements that are issued by USAID under its responsibility for good order, administration, and security are applicable to all personnel who enter the government installation or who travel using government transportation. This is not to be construed or interpreted to establish any degree or government control that is inconsistent with a non-personal services contract.

3.17.2 Inapplicability of Employee Benefits

This BPA does not create an employer-employee relationship. Accordingly, entitlements and benefits applicable to such relationships do not apply.

3.17.3 Notice

The contractor shall notify the CO in writing promptly, within three (3) calendar days from the date of any incident that the contractor considers to constitute a violation of this requirement. The notice should include the date, nature and circumstance of the conduct; the name function and activity of each government employee, or contractor official or personnel, involved or knowledgeable about such conduct; identify any documents or substance of any oral communication involved in the conduct; and the estimate in time by which the government shall respond to the notice to minimize cost, delay, or disruption of performance.

3.18 Inherently Governmental Functions

The contractor shall not perform any functions that are considered Inherently Governmental Functions (see FAR 7.503). If at any time the services being provided appear to be inherently governmental in nature, the contractor shall contact the CO and COR regarding the work so that appropriate decisions can be made in how to resolve the problem. Within 21 calendar days of award of the task order, the contractor shall ensure the staff has been informed about inherently governmental functions.

Some examples of inherently functions are the following:

• The determination of agency policy, such as determining the content and application of regulations, among other things.

• The determination of Federal program priorities for budget requests

• The direction and control of Federal employees

• The selection or non-selection of individual Federal Government employment, including the interviewing of individual for employment.

• The approval of position description and performance standards for Federal employees.

• The determination of what Government property is to be disposed of and on what terms.

• In Federal Procurement activities with respect to prime contractor (1) Determining what supplies or services are to be acquired by government; (2) Participating as a voting member on an y source selection board; (3) Approving any contractual documents defining requirements, incentive plans, and evaluation criteria; awarding contracts; administrating contracts (including change ordering changes in contract performance or contract quantities; taking action based on the evaluation of contractor performance, and accepting or rejecting contractor productions or services); (4) Terminating contracts; (5) Determining whether contract cost are reasonable, allocable, and allowable; and (6) Participating as a voting member on performance evaluation boards.

• The approval of agency responses to Freedom of Information Act (FOIA) requests and the approval of agency responses to administrative appeals of denials of FOIA request.

• The determination of budget policy, guidance, strategy.

• The drafting of Congressional testimony, responses to Congressional correspondence, or agency responses to audit reports from the Inspector General, the Government Accountability Office, or other Federal Audit entity.

3.19 Confidential Information

3.20 Travel

The need for travel will be specified at the call order level; however, if needed, it is subject to the requirements below.

In order to receive payment, all travel estimates shall be approved by the COR at least fourteen (14) calendar days prior to anticipated travel.

The Contractor shall provide actual incurred travel expenses for reimbursement. At a minimum, any receipt over $75.00 shall accompany the invoice.

The travel expenses will be computed at the per diem rate(s) provided in the Federal Travel Regulations (FTR) in effect at the time of the Award of that requirement (e.g. New Call Order, Change Order Modification). When evaluating proposed costs of travel, the Government will make the following assumptions:

• Travel with a privately owned vehicle shall in accordance with the FTR.

• No per diem (including meals) will be paid when the official travel is 12 hours or less, within the continental United States.

• Commercial Airline tickets purchased will be:

o Lowest non-penalty coach fare available which satisfies the schedule (except for immediate departure) or o Reserved/purchases as far in advance as possible to make maximum use of discounts.

• Airport parking for one (1) night or more will be paid for at the long-term parking rate.

• Rental vehicles are authorized as follows:

o For 3 or less people – not to exceed the cost of the least expensive compact size; or o For 4 or 5 people – not to exceed the cost of the least expensive mid-size car/station wagon and van.

o For 6 or more people, or for carrying equipment, samples, or other materials – the least expensive of a van, or combination of station wagon, compact and van.

Per Diem expenses for the day of departure and last day of travel are at 75% of the applicable Meal and Incidental Expense (M&IE) rate.

The Federal Travel Regulations are located at: http://www.gsa.gov/portal/content/104790 (See Chapter 301).

When submitting a proposal for a call order that involves travel, the Contractor shall provide the information below:

• Purpose of the travel;

• Tentative travel dates;

• Method of travel (e.g. Private vehicle, airplane, etc.), cost for that method, and baggage expense, if applicable;

• Duration of travel;

• Departure location and arrival location;

• Number of people on travel:

• Per diem expenses per day;

• Lodging expenses per day, if applicable;

• Lodging taxes per day, if applicable;

• Distance from office or home to airport or other transportation facility, if applicable;

• Parking costs per day at the airport, if applicable;

• Method of transportation at arrival destination (e.g. – subway/metro, bus, taxi, rental car) with projected costs, if applicable; and

• Quantity and cost of fuel for a rental car, if applicable.

3.21 Political Activities

The contractor and its personnel are prohibited from posting political signs at government facilities.

The contractor and its personnel are prohibited from soliciting campaign contributions or advocating voting for a potential candidate while at government facilities or utilizing government resources, such as but not limited to phone, computers, and copiers.

The contractor and its personnel are not permitted to use their relationship with the government to imply endorsement or approval of their political platform or agenda.

The contractor and its personnel shall not utilize USAID email, USAID social media, or USAID websites in advocating a political platform or agenda.

These restrictions do not apply to business or personal email accounts (not USAID affiliated), social media, or websites if they are not using their relationship with USAID to imply endorsement.

3.22 Executive Order on Terrorism Financing

The Contractor is reminded that U.S. Executive Orders and U.S. law prohibits transactions with, and the provision of resources and support to, individuals and organizations associated with terrorism.

It is the legal responsibility of the contractor to ensure compliance with these Executive Orders and laws. This restriction must be included in all subcontracts/subawards issued under this BPA.

3.23 Place of Performance

Work outside the continental United States (OCONUS) is not anticipated but this specific requirement will be specified at the call order level. Most calls under this blanket purchase agreement shall be completed in the Washington, DC metropolitan area. Travel expenses to USAID OIG’s offices or other locations in the Washington, DC, metropolitan area for meetings or any activities will not be paid or reimbursed to the contractor or any consultants or subcontractors. The contractor, subcontractor(s), and/or consultant(s) are responsible for all their own local travel.

Travel to other locations in the continental United States will be billed in accordance with FAR 31.205-46. All travel must be pre-approved in writing by the appropriate COR. The not to exceed amount is to be determined at the call order level.

3.24 Period of Performance

The period of performance for this contract shall be as follows.

Contract Period Dates Base Year January 20, 2025 – January 19, 2026 Option Year 1 January 20, 2026 – January 19, 2027 Option Year 2 January 20, 2027 – January 19, 2028 Option Year 3 January 20, 2028 – January 19, 2029 Option Year 4 January 20, 2029 – January 19, 2030

3.25 Technical Directions/Relationship with USAID OIG

3.25.1 Technical Directions is defined to include:

• Written directions to the contractor which fill in details, suggest possible lines of inquiry, or otherwise facilitate completion of work.

• Provision of written information to the contractor which assists in the interpretation of drawings, specifications, or technical portions of the work statement.

• Review and, where required, provide written approval of technical reports, drawings, specifications, or technical information to be delivered. Technical directions must be in writing and must be within the scope of work as detailed in Section 1.

3.25.2 The COR is authorized by designation to take any or all action with respect to the following:

• Assure that the contractor performs the technical requirements of the contract in accordance with the contract terms, conditions, and specifications.

• Perform or cause to be performed, inspections necessary in connection with ‘a’ above and require the contractor to correct all deficiencies; perform acceptance for the Government.

• Maintain all liaison and direct communications with the contractor. Written communications with the contractor and documents must be signed as "Contracting Officer Representative" with a copy furnished to the Contracting Officer.

• Issue written interpretations of technical requirements of Government drawings, designs, and specifications.

• Monitor the contractor's production or performance progress and notify the contractor in writing of deficiencies observed during surveillance, and direct appropriate action to effect correction. Record and report to the Contracting Officer incidents of faulty or nonconforming work, delays or problems.

• Obtain necessary security clearance and appropriate identification if access to Government facilities is required. If to be provided, ensure that Government furnished property is available when required.

• Complete Contractor Performance Assessment Reports (CPARs) once a year.

• Meet quarterly with the contractor and the Contracting Officer concerning performance of items delivered under the contract and any other administration or technical issues.

Telephonic reports may be made if no problems are being experienced. Problem areas should be brought to the immediate attention of the Contractor and Contracting Officer.

3.25.2 Absence of a COR

In the absence of the designated primary COR, the alternate COR identified in the official COR delegation letter may serve as COR in their place. However, such an action shall immediately be communicated to the Contractor and the Contracting Officer.

3.25.3 COR Limitations

The COR is not empowered to award, agree to, or sign any contract (including delivery or task orders) or modifications thereto, or in any way to obligate the payment of money by the Government. The COR may not take any action which may impact on the contract schedule, funds, scope or rate of utilization of contract personnel resources. All contractual agreements, commitments, or modifications which involve prices, quantities, quality, schedules, must be made only by the Contracting Officer.

3.25.4 Contractual Problems

Contractual problems, of any nature that may arise during the life of the contract must be handled in accordance with specific public laws and regulations (i.e., Federal Acquisition Regulation and Agency for International Development Acquisition Regulation).

The contractor and the COR must bring all contracting problems to the immediate attention of the Contracting Officer. Only the Contracting Officer is authorized to formally resolve such problems. The Contracting Officer will be responsible for resolving legal issues, determining contract scope and interpreting contract terms and conditions.

The Contracting Officer is the sole authority authorized to approve changes in any of the requirements under this contract. Notwithstanding any clause contained elsewhere in this contract, the said authority remains solely with the Contracting Officer. These changes include but will not be limited to the following areas: scope of work, price, quantity, technical specifications, delivery schedules, and contract terms and conditions. In the event the contractor effects any changes at the direction of any other person other than the Contracting Officer, the change will be considered to have been made without authority.

Failure by the contractor to report to the Contracting Officer, any action by the Government considered a change, within the specified number of days contained in FAR 52.243-7 (Notification of Changes), waives the contractor's right to any claims for equitable adjustments.

3.26 Acceptance and Approval

The COR must accept and approve deliverables before payment may be made. Payment will be tied to completed tasks/deliverables as specified in each BPA call.

3.27 Contractor’s Staff Support, and Administrative and Logistics Arrangements

The contractor shall be responsible for all administrative support and logistics required to fulfill the requirements of this contract. This shall include all travel arrangements, appointment scheduling, secretarial services, report preparations services, printing, and duplicating.

4. Requirements for Staffing

Since each labor category listed below may not be required for every call order, the specific labor categories needed will be determined at the call order level.

4.1 Labor Category Descriptions

Prior to either obtaining a personal identity verification (“PIV”) card or gaining access to USAID, MCC, USADF, or IAF’s information or information systems, including third party-owned or operated systems, all personnel (“key” as well as “staff”) must (1) provide a signed nondisclosure agreement and (2) provide evidence of, at a minimum, a Public Trust Minimum Background Investigation (MBI). The MBI is required for individuals who will access sensitive but unclassified (or equivalent) information and those individuals with privileged access (e.g., ability to conduct technical vulnerability assessments of the network. The IPA must bear the cost of obtaining and sustaining the background investigations.

Any key personnel designations for labor categories are to be made at the call order level.

Key personnel shall have the following knowledge, skill, abilities, and experience.

• In-depth knowledge of the NIST Special Publication (SP) 800-115, Technical Guide to Information Security Testing and Assessment.

• Use of common technical vulnerability assessment tools, including proper credentialing, loading updates, and configuring the application to run in a safe mode.

• Ability to completely and accurately interpret the results of technical vulnerability scan reports and identify false positives.

• Experience in testing network infrastructure, servers, and clients and their common vulnerabilities and exposures. This includes knowledge of how a typical organization sets up its network and security measures, including firewalls, networks, etc.

• Experience in implementing penetration testing phases: reconnaissance, scanning, vulnerability assessment, exploitation, and reporting.

• Experience researching and recommending solutions to mitigate common vulnerabilities and exposures. Experience in conduct such work in various computing environments, e.g., local and wide area networks, including Cloud, Oracle Database.

• Ability to and experience in writing reports on results of technical testing for non-technical audiences.

• Skills in orally communicating results of technical testing to technical and non-technical audiences, including the ability to convincingly explain the results to defensive audiences.

• Possess excellent interpersonal skills, be flexible, work well with others, and maintain professionalisms in stressful situations.

4.1.1 Senior Cybersecurity Professional

The individual shall possess a bachelor’s degree in cybersecurity, computer science, information technology, or equivalent; certification in penetration testing and vulnerability assessments, such as a Computing Technology Industry Association PenTest+, Global Information Assurance Certification Penetration Tester, Cybersecurity Service Provide, Certified Ethical Hacker, Certified Penetration Tester, or equivalent; and more than 10 years of experience in conducting penetration testing and vulnerability assessments.

On a daily basis, this individual is responsible for ensuring that services are provided in a complete, accurate, efficient, and timely manner. The proposed individual is responsible for contract negotiations, adhering to the BPA and BPA calls, and ensuring the quality of all work products.

4.1.2 Mid-level Cybersecurity Professional

information technology, or equivalent; certification in penetration testing and vulnerability assessments, such as Computing Technology Industry Association PenTest+, Global Information Assurance Certification Penetration Tester, Cybersecurity Service Provide, Certified Ethical Hacker, Certified Penetration Tester, or equivalent; and at least 8 years of experience in conducting penetration testing and vulnerability assessments.

On a daily basis, this individual is responsible for directing the accomplishments of the engagement. this individual supervises project staff on-site, provides technical guidance on work assignments, and acts as a liaison between project staff and project manager. The individual sets the priorities and monitors progress against schedules, budgets and status reporting. In addition, the individual confers with OIG and agency staff regarding issues or conflicts and assures the quality of all deliverables.

4.1.3 Cybersecurity Professional

information technology, or equivalent; certification in penetration testing and vulnerability assessments, such as Computing Technology Industry Association PenTest+, Global Information Assurance Certification Penetration Tester, Cybersecurity Service Provide, Certified Ethical Hacker, Certified Penetration Tester, or equivalent; and at least 1 year of experience in conducting penetration testing and vulnerability assessments.

On a daily basis, this individual is responsible for completing tasks assigned by Mid-level Cybersecurity Professional.

4.1.4 Editor

The individual shall possess a bachelor’s degree in English, journalism, communications, or a related field; and at least 3 years of editing experience. The individual reviews, edits, and re-writes discussion papers, draft evaluation and audit reports, and final evaluation and audit reports (“the documents”). The individual must ensure the documents are clear, concise, internally consistent, and follow the OIG’s style guide.1 This individual have remote meetings with the Cybersecurity Professionals and OIG team to clarify the documents.

4.1.5 Administrative Support

The contractor shall provide administrative support staff, as needed, to facilitate execution of the statement of work, for tasks such as coordinating on-boarding and off-boarding of contractor staff.

4.2 Resumes and Personnel

The Contracting Officer may request the resumes of all personnel (“key” and “staff”) to verify that they meet the requirements before order award. Key personnel may be designated in the specific call order.

The contractor will obtain the consent of the CO and COR prior to making key personnel substitutions. Replacements for key personnel must possess qualifications equal to or exceeding the qualifications of the personnel being replaced, unless an exception is approved by the Contracting Officer.

Requests for changes in key personnel will be submitted to the CO at least fifteen (15) working days prior to making any permanent substitutions. The request should contain a detailed explanation of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any additional information requested by the CO. The CO will notify the contractor within ten (10) working days after receipt of all required information of the decision on substitutions.

1 Currently, OIG uses The Associated Press (AP) Stylebook as its style guide. However, OIG reserves the right to change its style guide.