Attmt 0001_DRAFT Cybersecurity Support Services PWS_05052022.pdf

PERFORMANCE WORK STATEMENT (PWS)

Program Executive Office - Intelligence Electronic Warfare & Sensors (PEO IEW&S)

Project Manager, –Intelligence Systems & Analytics (PM IS&A)

Cybersecurity Support Services

14 April 2022

Version 1.4

Submitted By:

PM Intelligence Systems & Analytics

SFAE-IEW-IA

Aberdeen Proving Ground, MD 21005 i

1 General

1.1 Description of Services/Introduction

1.2 Background

1.3 Objectives

1.4 Scope

1.5 Period of Performance

1.5.1 Federal Government Holidays

1.5.2 Hours of Operation

1.6 Place of Performance

1.6.1 Telework

1.6.2 Contractor Travel

1.7 General Information

1.7.1 Type of Contract

1.7.2 Other Direct Costs

1.7.3 Quality

1.7.4 Security Requirements

1.7.5 Post Award Conference/Periodic Progress Meetings

1.7.6 Contracting Officer Representative (COR)

1.7.7 Key Personnel

1.7.8 Data Rights

1.7.9 Organizational Conflict of Interest

1.7.10 Transition

1.8 Deliverables

1.8.1 OCI Mitigation Plan (DI-MISC-80048)

1.8.2 CONTRACTOR’S PROGRESS STATUS MANAGEMENT REPORT: MONTHLY REPORT (DI-

MGMT-80227)

1.8.3 Contract Funds Status Report (CFSR): CAIRO (DI-MGMT-81468)

1.8.4 TECHNICAL REPORT – STUDY/SERVICES: CONTRACTOR TRANSITION PLAN (DI-

MISC-80508)

1.8.5 RISK MANAGEMENT FRAMEWORK (RMF) PACKAGE (DI-MGMT-82001)

1.8.6 TECHNICAL REPORT – STUDY/SERVICES: AFTER ACTION REPORT (DI-MISC-80508) .. 26

2 GOVERNMENT FURNISHED ITEMS AND SERVICES

2.1 Services

2.2 Facilities / Equipment

2.3 Utilities

2.4 Materials

3 CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

3.1 General (If applicable)

3.2 Contactor Facility Clearance

3.3 Staffing

3.3.1 Badges / Identification of Contractor Employees

3.4 Training and Emergency Accountability

3.5 Materials

3.6 Equipment

4 Specific Tasks

4.1 Basic Services

4.2 Cybersecurity Systems Security Engineering

4.2.1 System Security Engineering

4.2.2 Cross Domain Solution - System Security Engineering

4.2.3 Cloud Security Engineering

4.2.4 Deliverables

4.3 Assessment and Authorization (A&A)

4.3.1 Deliverables

4.4 Field Service Engineering (FSE)

4.4.1 Deliverables

ii

5 APPLICABLE DOCUMENTS

5.1 APPLICABLE PUBLICATIONS (CURRENT EDITIONS)

6 DEFINITIONS AND ACRONYMS

6.1 DEFINITIONS

6.1.1 CONTRACT ADMINISTRATOR

6.1.2 CONTRACTOR

6.1.3 CONTRACTING OFFICER

6.1.4 CONTRACTING OFFICER'S REPRESENTATIVE (COR)

6.1.5 DEFECTIVE SERVICE

6.1.6 DELIVERABLE

6.1.7 GOVERNMENT-FURNISHED PROPERTY (GFP) OR GOVERNMENT PROPERTY (GP)

6.1.8 KEY PERSONNEL

6.1.9 PHYSICAL SECURITY

6.1.10 PRIVILEGED ACCESS

6.1.11 PRIVILEGED USER

6.1.12 QUALITY ASSURANCE

6.1.13 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

6.1.14 QUALITY CONTROL

6.1.15 SUBCONTRACTOR

6.1.16 WORK DAY

6.1.17 WORK WEEK

6.2 ACRONYMS

1 General

This is a non-personal services contract to provide Project Manager, Intelligence Systems & Analytics (PM IS&A) Cybersecurity Support Services. This Performance Work Statement (PWS) covers activities supporting cybersecurity systems engineering, assessment and authorization, field service engineer, and other management support services necessary to accomplish the missions and goals. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who in turn is responsible to the Government.

1.1 Description of Services/Introduction

The Contractor shall provide all personnel, supervision, and other items and non-personal services necessary to perform Cybersecurity Support Services as defined in the Performance Work Statement (PWS) except for those items specified as government furnished property and services. The Contractor shall perform to the standards in this contract.

1.2 Background

PM IS&A falls under Program Executive Office – Intelligence Electronic Warfare and Sensors (PEO IEW&S). PM IS&A is headquartered at Aberdeen Proving Ground (APG) with product line support offices located at Ft. Hood, TX and Ft. Belvoir, VA.

The Distributed Common Ground System-Army (DCGS-A) program was created in response to the Department of Defense (DoD) Distributed Common Ground/Surface System (DCG/SS) Mission Area Initial Capabilities Document (MA ICD), which captured the overarching requirements for an Intelligence, Surveillance, and Reconnaissance (ISR) Family of Systems (FoS) that will contribute to Joint and combined Warfighter needs. The MA ICD has since been updated to an Enterprise ICD. Based on evolving mission, in May 2020, PM DCGS-A was officially renamed to PM IS&A.

PM IS&A FoS (Tactical Intelligence and Targeting Access Node (TITAN), Intel Apps, DCGS- A, Capability Drop 1 & 2 (CD1, CD2) will facilitate seeing and knowing on the battlefield. PM IS&A FoS contribute to visualization and situational awareness (SA), thereby enhancing tactical maneuver, maximizing combat power and enhancing the ability to operate in an unpredictable and changing environment. It will facilitate the rapid planning, execution, and synchronization of all war fighting functions resulting in the ability to operate within the enemy’s decision cycle.

PM IS&A’s portfolio is executing a pivot to modernization investments and alignment to Multi Domain Objectives (MDO) with TITAN and Intel Apps programs while sustaining legacy efforts such as DCGS-A, CD1 and CD2.

DCGS-A is the Army’s primary system for tasking, processing, exploitation and dissemination (TPED) at all echelons of multi-sensor intelligence and weather information to the Warfighter. It is deployed worldwide in support of intelligence operations, including all Theaters of Operations.

TITAN is envisioned to be the future Army ISR data processing ground station that will consolidate the sensor processing capabilities in the current DCGS-A Operational-Intelligence Ground Station (OGS), Tactical-Intelligence Ground Station (TGS), the Advanced Miniaturized Data Acquisition System Dissemination Vehicle (ADV) and the Remote Ground Terminal

(RGT).

Intel Apps is the next generation of the Army Intelligence Software (AIS) functions and capabilities that will replace select DCGS-A/IS&A capabilities, synchronized with the Command Post Computing Environment (CPCE). Intel Apps provides a software-centric AIS program that will provide software capability in support of the Multi-Domain Intelligence (MDI) Framework, Multi-Domain Operations (MDO), and Joint All-Domain Operations (JADO).

PM IS&A continues to provide enhanced capabilities to the warfighter. These enhancements, which replac the existing baseline capabilities, are provided through incremental Capability Drops leveraging the latest Commercial Off-The-Shelf (COTS) and Government Off-The-Shelf (GOTS) technologies.

PM IS&A capabilities operate on multiple network domains that include the Joint Worldwide Intelligence Communications System (JWICS), National Security Agency Network (NSANet), Secret Internet Protocol Router Network (SIPRNet), Coalition Networks, and Non-Secure Internet Protocol Router Network (NIPRNet). DCGS-A also requires Cross Domain Solution Suite(s) (CDSS) to seamlessly receive source information and rapidly disseminate data and products to the warfighters at the various security classification enclaves. It is imperative that systems are developed, integrated, and certified in prescribed ways compliant with the respective network domain security and protection requirements, and their required assessment and authorization processes.

1.3 Objectives

This PWS covers activities supporting cybersecurity services for systems engineering, assessment and authorization, field service engineers, and other management support services necessary to accomplish the missions and goals of PM IS&A.

The Cybersecurity services will support PM IS&A as they support the Army’s and the larger ISR communities in the execution of their intelligence missions collaborating with National Agencies, all Major Commands, Coalition Forces, and Joint Service organizations. The PM provides technical support / interaction with the system software teams to ensure the required accreditation policies and procedures are adhered to as the systems / software are developed, fielded, and sustained. Additionally, the PM security team reviews and ensures all security documentation is accurate and meets the Raise the Bar (RTB) Standards and Risk Management Framework policies which support a successful accreditation event for each system.

PM IS&A is also responsible to deliver RTB compliant cross domain security (CDS) systems, and compliant system software. These cybersecurity services will support these efforts and include interaction with the user units, preliminary system testing, software maintenance, security test procedures, collaboration with the CDS vendor(s), the installation/configuration of system software, and accreditation test support.

1.4 Scope

This PWS establishes the support and service requirements for PM IS&A Cybersecurity Support Services activities. The Contractor shall provide Cybersecurity support and services for System Security Engineering, Cloud Security Engineering, Assessment and Authorization (A&A), and Cybersecurity Field Service Engineer (FSE). Cybersecurity support and services include, but are not limited to, analyze, access, integrate, document, enhance, improve, modernize, implement, test, monitor, sustain, and maintain PM IS&A cybersecurity posture and capabilities. It includes all cyber domain activities in order to ensure process efficiencies, standard compliance, and interoperability.

These services and support will apply to the PM IS&A Family of Systems that require an accreditation to operate on a classified network or in support of a classified event to include but not limited to exercises, real world missions, test events, demonstrations, etc. PM IS&A provides classified intelligence systems which require accreditations that must be maintained and which the PM is responsible to provide oversight / validation of as the Life Cycle Manager.

Additionally, interaction and collaboration with vendors, user units, MACOMs, staff and DA elements may be required in order to explain a security requirement, system configuration, or path forward in support of a PM system or activity.

1.5 Period of Performance

The period of performance shall be for one (1) twelve (12)-month base period and three (3) twelve (12)-month option periods.

1.5.1 Federal Government Holidays

Contractor personnel shall not work under this contract during recognized Federal holidays and base closures due to inclement weather unless explicitly approved to do so by the Contracting Officer’s Representative (COR).

New Years Day, 1st day of January Martin Luther King Jr.'s Birthday, 3rd Monday of January Presidents Day, 3rd Monday of February Memorial Day, Last Monday of May Juneteenth, 19 June Independence Day, 4th day of July Labor Day, 1st Monday of September Columbus Day, 2nd Monday of October Veterans Day, 11th day of November Thanksgiving Day, 4th Thursday of November Christmas Day, 25th day of December

If a holiday falls on a Saturday, for most Federal employees, the preceding Friday will be treated as a holiday for pay and leave purposes. (See 5 U.S.C. 6103(b).) If a holiday falls on a Sunday, for most Federal employees, the following Monday will be treated as a holiday for pay and leave purposes.

1.5.2 Hours of Operation

The Contractor is responsible to provide adequate support services and must maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS.

When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.

The Contractor shall conduct business Monday through Friday for 40 hours each week, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The workday is 8 hours. The hours worked by the Contractor personnel must include the core hours of 9:00AM and 3:00PM. Monday thru Friday. Routine telework is not available due to the classified nature of the work. For other than firm fixed price contracts, the Contractor will not be reimbursed when the government facility is closed for the above reasons, unless situational/ad-hoc telework has been pre-approved in writing by the Contracting Officer (KO) or COR.

In order to meet scheduling constraints, the Contractor may be required to periodically work other than ‘normal duty’ hours. During such activities as unit training exercises or deployments, the Contractor duty hours may be adjusted and the Contractor may be required to work 7 days a week, up to12 hours a day, 84 hours per work week, or as otherwise directed by the government.

The Contractor shall not be compensated with Field Differential pay when supporting 24 hour exercises and operations. The COR may modify the work schedule to ensure the government's ability to continue to execute its mission. Any modification to the Contractor's work schedule shall be in writing with approval by the KO or COR, with sufficient notice given to the Contractor. Sufficient notice is normally defined as a minimum of two weeks prior to the new work schedule, allowing for the Contractor to have ample time to make changes.

If work hours are expected to exceed 40 hours the Contractor shall submit an Extended Work Week (EWW) request to the COR for approval prior to the work being performed. All EWW requests must be submitted 14 business days in advance of performance and must be approved by the KO or COR, as authorized by the KO, before any EWW is worked and charged. Work performed in excess of 40 hours per week without an approved EWW request may not be reimbursed by the government. At the end of each month, the Contractor will provide the actual EWW hours worked during the prior month in CDRL A004: Contractor’s Progress, Status and Management Report.

Overtime, defined as hours worked that are in excess of 40 hours per week, is not authorized unless prior written approval authorization is obtained from the COR or KO.

Should situations arise in which the above specified advance notice cannot be met, government support of Contractor extended hours or overtime shall be handled on a case-by-case basis.

1.6 Place of Performance

The Contractor’s primary place of performance will be at the PM IS&A Project Management Office (PMO) location in Aberdeen Proving Ground, MD. The Contractor and its subcontractors will also be required to support Temporary Duty (TDY) assignments to, units, and Contractor facilities, located in Continental United States (CONUS), including Alaska and Hawaii, and Outside Continental United States (OCONUS), such as, EUCOM, NORTHCOM, SOUTHCOM, INDO-PACOM, and CENTCOM areas of operations.

1.6.1 Telework

Due to the classified nature of work, telework is not expected to be authorized. If deemed necessary, all situational / ad-hoc teleworking must be approved in writing by COR on a case-by-case basis. The government has the right to cancel or change telework agreements at any time.

1.6.2 Contractor Travel

The Contractor shall be required to travel to other Government installations or to Contractor facilities. The Contractor will be required to travel CONUS, including, Alaska and Hawaii, and to OCONUS locations during the performance of this contract. OCONUS locations may include EUCOM, NORTHCOM, SOUTHCOM, INDO-PACOM, AFRICOM and CENTCOM areas of operations.

A valid U.S. unrestricted passport and visa are required for personnel traveling to OCONUS locations.

The Contractor will be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR), AR 715-9 and the limitation of funds specified in this contract. The JTR, while not wholly applicable to Contractors, shall provide the basis for the determination as to whether travel costs are reasonable. This information can be found at the JTR website: https://www.defensetravel.dod.mil/site/perdiem.cfm.

All travel requires Government approval/authorization and notification to the COR. The Contractor and its subcontractors shall submit Travel Authorization Request (TAR) to the COR for approval at least fifteen (15) days prior to CONUS travel and forty-five (45) days for OCONUS travel. TAR must include travel details and estimated costs to include backup data to the source of the estimated costs. The COR or KO must approve travel prior to commencement of travel. In unique cases, where the TAR submission dates cannot be met, the COR will make every attempt to expedite approvals.

Costs for transportation may be based upon mileage rates, actual costs incurred, or a combination thereof, provided the method used results in a reasonable charge. Reimbursement for the cost of lodging and incidental expenses will be actual costs incurred and shall be considered reasonable and allowable provided that the actual cost does not exceed the amounts allowed in accordance with the law and Joint Travel Regulation (JTR). Maximum use is to be made of the lowest available customary standard coach or equivalent airfare accommodations available during normal business hours.

There will be no reimbursement for local travel in and around Contractor or subcontractor sites or facilities. Travel will be reimbursed as an Other Direct Charge (ODC) IAW applicable Federal Travel Regulations in effect at the time of travel. No profit shall be allowed on travel costs.

The Contractor shall submit a trip report within five (5) working days of the conclusion of a trip to the COR IAW DI-ADMN-81308A, A004.

During wartime, travel may be required within hostile war zones for providing systems support.

In the event of travel to an area eligible for Danger and/or Combat Incentive Pay, the incentives will be paid as an ODC IAW applicable Government Rules and Regulations in effect at the time of travel to such areas.

OCONUS locations may require contract personnel to adhere to theater clearance(s), country clearance(s), and OCONUS required trainings.

The Contractor will ensure that personnel required to travel meet Federal, State, local government and/or country specific vaccination and/or quarantine requirements.

1.6.2.1 Travel Arrangements

The number of trips and types of personnel required for trips shall be limited to the minimum required to accomplish work requirements. The Contractor and its subcontractors will be responsible for arranging all Contractor personnel travel requirements at the lowest cost, considering the mode of transportation with mission requirements. The Contractor will be authorized travel expenses consistent with the substantive provisions of the JTR.

Air travel will be accomplished on regularly scheduled commercial flights in the most economical manner consistent with the successful accomplishment of the mission.

1.6.2.2 Travel Special Requirements

IAW DoDM 5105.21-V3, para 17 a.(1) and AR 380-67 (Personnel Security), personnel holding a security clearance (Military, Civilian, Contractor) are required to report foreign travel, for personal or official, which must be properly tracked and documented in JPAS/DISS by their respective Special Security Office(SSO)/AT officer. Please note that failure to report all foreign travel, regardless if it’s for personal or official, can be reported as a security incident which could affect personnel security clearances.

All OCONUS travel shall be approved forty-five (45) days in advance by the COR. Some OCONUS locations may require Theatre specific clearance. The Contractor shall coordinate with the COR to obtain appropriate theatre clearances. All Contractor personnel travelling OCONUS shall be required to take appropriate OCONUS security/terrorism training.

OCONUS Travel shall be submitted into the Synchronized Pre-deployment and Operational Tracker (SPOT) application at https://spot.dmdc.mil/ in accordance with DoDI 3020.41, Contractor Personnel Authorized to Accompany the U.S. Armed Forces and OSD Memo, 25 January 2007. Additionally, the Contractor shall ensure that all personnel have a current DD Form 93, Record of Emergency Data Card, on file with both the Contractor and the COR or KO.

In addition, the Contractor personnel shall enroll in the Department of State’s Smart Traveler Program - https://step.state.gov/step/.

1.6.2.3 Personal Foreign Travel Reporting

In accordance with Security Executive Agent Directive 3 (SEAD-3), DoDM 5105.21, Army Regulation (AR) 381-12, and AR 380-67, requires all personnel holding a security clearance to report all personal foreign travel to their security office in advance of the travel. The Contractor Facility Security Officer (FSO) is required to submit written notification and copy of traveler’s full itinerary for the trip, including flight numbers and arrival/departure times, the country (or countries) to be visited and the dates of travel to the Government COR forty-five (45) days in advance of required travel date.

The Contractor FSO is responsible maintaining reporting records in accordance with associated policies.

1.6.2.4 OCONUS

DFARS Contract Clauses shall be in full force and effect:

1. 252.225-7995 Contractor Personnel Performing In The United States Central Command Area Of Responsibility

2. 252.225-7043 Antiterrorism/Force Protection for Defense Contractors Outside the United States (JUN 2015)

These clauses can be located in their entirety at https://www.acquisition.gov/dfarspgi.

1.6.2.4.1 Status of Forces Agreement (SOFA)

A Status of Forces Agreement (SOFA) is required to satisfy a requirement for Contractor travel if accompanying U.S. Forces or traveling to Germany, Italy, Japan, Korea and other countries, as required. Each location requires a separate agreement. Listed below are the countries and associated links that provide the documentation requirements for the SOFA and/or Technical Expert Status Accreditation (TESA) for each location. Some SOFAs require U.S. personnel to have a specific type of order or specific identification documents (see DoD Foreign Clearance Guide (FCG) individual country entries for requirements https://www.fcg.pentagon.mil/). The Contractor shall comply with SOFA entry and exit requirements for any personnel traveling on official business to a country requiring SOFA registration.

Germany

Travel to Germany for 90 days or less will be required to utilize Technical Expert Status Accreditation / Analytical Support Status Accreditation (TESA/ASSA) TDY and FAX-BACK processes. Contractor travel in excess of 90 days requires the utilization of Technical Expert (TE) personnel and/or Troop Care (TC), in accordance with Army in European Region (AER) 715-9. For Technical Expert Status Accreditation or Troop Care Positions, the DoD will coordinate approvals with the applicable OCONUS authorities. For travel to Germany for 90 days or less, the Contractor shall ensure all contract personnel have their TESA applications and resumes approved by the DoD Contractor Personnel Office (DOCPER) before deploying.

Accredited TE’s will be authorized to use government facilities in accordance with the SOFA policies.

Authorized logistics support items include: Commissary, to include rationed items; Army and Air Force Exchange Service (AAFES), to include rationed items and purchase of Policy on line (POL); military postal service;; local government transportation for official government business (non-tactical); emergency medical/dental services; local Morale Welfare and Recreation (MWR) services; Class VI, to include rationed items; military banking facilities; Customs Exception;

Mortuary Service; legal assistance; credit unions; and North Atlantic Treaty Organization (NATO) Status of Forces Agreement Letter and/or Stamp. The Contractor shall promptly notify the COR if an individual utilizing TESA is no longer performing duties requiring accreditation.

Short term TDY may be performed in accordance with Army Regulation: AR 715-9 (effective 20 July 2011).

Website: http://www.eur.army.mil/g1/content/CPD/docper.html or https://wr.acpol.army.mil/dcops-user/

Italy

Website: http://www.eur.army.mil/g1/content/CPD/docper/docper italyOps.html

Japan

Website: https://www.fcg.pentagon.mil/docs/JA.cfm

SOFA Agreement: http://www.usarj.army.mil/cmdstaffs/sja/doc/sofa 201601.pdf

Korea

The SOFA between the United States and Korea governs the rights and obligations of the United States armed forces in Korea. Only those individual Contractors who are United States nationals;

not ordinarily a resident in Korea; present in Korea at the invitation of and solely for the purpose of executing contracts with the United States for the benefit of the United States armed forces;

and, not present in Korea under any other SOFA status may be issued a Letter of Identification by the KO. If required a Letter of Identification shall be issued by the KO, and is provided for Contractor personnel status identification when entering or departing Korea. The KO is the only individual authorized to issue a Letter of Identification. The Contractor and subcontractor personnel shall comply with the ROK SOFA as implemented by United States Forces Korea (USFK) Regulation 700-19, which can be found under the publications tab on the U.S. Forces Korea homepage http://www.usfk.mil. The Contractor shall submit 700-19 forms 60 days in advance of required travel.

The Contractor shall meet the Country Clearance and VISA requirements for travel to the Republic of Korea.

Website: http://www.usfk.mil/Organization/AcquisitionManagement,FKAQ.aspx

1.6.2.5 SYNCHRONIZED PRE-DEPLOYMENT AND OPERATIONAL TRACKER

(SPOT)

SPOT is a web-based joint database used for tracking Contractor personnel who accompany the U.S. armed forces. SPOT is the current system mandated for use in tracking Contractor personnel movements within the forward area and for validating individual Contractor personnel, their authorization for access to specific DOD facilities, and their individual eligibility for specific DOD support services. SPOT is the authoritative source for near real-time reporting on globally deployed individuals, by name, by location, and by contract. SPOT also provides for tracking the use of and accountability for DOD equipment in the custody of Contractors.

Contractors are responsible for entering employee data. If you require additional information, the SPOT website is: http://www.acq.osd.mil/log/PS/spot.html . The current SPOT training link is also available at the above link.

Contractors shall enter their employee data into SPOT, if and when required.

1.6.2.6 Isolated Personnel Report (ISOPREP)

U.S. based Contractor employees and associated subcontractor employees will submit an Isolated Personnel Report (ISOPREP) prior to deployment, IAW AR 525-28, Personnel Recovery. The Contractor is required to fill out the survey on NIPRNet at https://prmsglobal.prms.af.mil/prmsconv/profile/survey/survey.aspx prior to deployment. Access to U.S. classified data outside the U.S. and its territories is limited to SECRET and only in the presence of U.S. Government officials.

1.6.2.6.1 Theatre Business Clearance (TBC)

The Contractor requires a Theatre Business Clearance (TBC) to operate within all COCOMs that require TBCs.

The following websites contain the most current TBC information and guidance:

https://www.jccs.gov/jccscoe/ https://www.acq.osd.mil/asda/dpc/cp/cc/index.html

1.6.2.7 Special Requirement when performance is in Theatre

1. Special Contract Requirements

a. Definitions:

“Discrimination” includes discrimination on the basis of race, color, national origin, religion, sex.

“Sexual Assault” is a crime defined as intentional sexual contact, characterized by use of force, physical threat or abuse of authority or when the victim does not or cannot consent. Sexual assault includes rape, nonconsensual sodomy (oral or anal sex), indecent assault (unwanted, inappropriate sexual contact or fondling), or attempts to commit these acts. Sexual assault can occur without regard to gender or spousal relationship or age of victim.

“Consent” will not be deemed or construed to mean the failure by the victim to offer physical resistance. Consent is not given when a person uses force, threat of force, or coercion or when the victim is asleep, incapacitated, or unconscious.

“Sexual Harassment” is a form of sex discrimination that involves unwelcome sexual advances, requests for sexual favors, and other verbal or physical conduct of a sexual nature when:

(1) Submission to such conduct is made either explicitly or implicitly a term or condition of a person's job, pay, or career, or

(2) Submission to or rejection of such conduct by a person is used as a basis for career or employment decisions affecting that person, or

(3) Such conduct has the purpose or effect of unreasonably interfering with an individual's work performance or creates an intimidating, hostile, or offensive working environment. This definition emphasizes that workplace conduct, to be actionable as "abusive work environment" harassment, need not result in concrete psychological harm to the victim, but rather need only be so severe or pervasive that a reasonable person would perceive, and the victim does perceive, the work environment as hostile or offensive. Any person in a supervisory or command position who uses or condones any form of sexual behavior to control, influence, or affect the career, pay, or job of an employee is engaging in sexual harassment. Similarly, any employee who makes deliberate or repeated unwelcome verbal comments, gestures, or physical contact of a sexual nature in the workplace is also engaging in sexual harassment.

2. Compliance with laws and regulations.

(a) The Contractor shall enforce standards for discipline, appearance, conduct, and courtesy IAW the published CENTCOM, USFOR-A and/or Base Commander Standards. For Contractors at Bagram Airfield (BAF) or for Contractors transiting BAF, they must abide by the Commander Bagram Airfield (COMBAF) Standards of Conduct while performing at any level (prime or subcontractor) on BAF and any other installation and facility for which COMBAF standards are applicable, and as designated applicable to Contractor personnel. COMBAF Standards are published at:

http://usfora.afghan.swa.army.mil/baf/des/pmo/Shared%20Documents/COMBAF%20Standards %20Book%20as%20of%208OCT17.pdf#search=COMBAF%20Standards.

(b) The Contractor is encouraged to resolve issues and concerns affecting discipline, appearance, conduct and courtesy in order to maintain good order and discipline and promote a positive work environment. The Contractor shall:

(1) Ensure employees are aware of their right to file a complaint of discrimination with their Human Resources office, the Contractor’s Equal Employment Opportunity (EEO) Manager if any, and/or directly to the Equal Employment Opportunity Commission (EEOC).

(2) Ensure employees are aware that they can report discrimination to the KO, however a complaint of harassment can only be filed with the entities listed in paragraph 2b(1) above.

(3) Upon learning of an alleged (or actual) sexual assault, sexual harassment, hostile or abusive conduct, the Contractor shall immediately contact the Provost Marshal and follow-up with a Serious Incident Report in accordance with CDRL A002 and Army Regulation (AR) 190-40.

3. Sexual Assault/Sexual Harassment and Awareness Policy.

(a) The Contractor shall have a written sexual assault/sexual harassment policy published to all employees that addresses, at a minimum, the following: (i) the definitions of sexual assault and sexual harassment as defined above in paragraph 1a; (ii) a description of sexual harassment (iii) the Company’s internal complaint process and the company’s internal process for adjudication;

(iv) the available channels through which an employee can report a sexual assault; and (v) protection against retaliation, coercion, and reprisal.

(b) The policy shall address that victims of sexual assault shall be protected, treated with dignity and respect, and shall receive timely access to comprehensive healthcare (medical and mental health) treatment, including emergency care treatment and services. Emergency care consists of emergency healthcare and the offer of a sexual assault forensic examination (SAFE) consistent with the Department of Justice protocol. The victim shall be advised that even if a SAFE is declined, the victim is encouraged (but not mandated) to seek medical care. Contractor employees are only eligible to file an Unrestricted Report. Contractor employees will also be offered LIMITED Sexual Assault Prevention and Response or SAPR services, meaning the assistance of a Sexual Assault Response Coordinator (SARC) and a SAPR Victim Advocate (VA) while undergoing emergency care OCONUS. These limited emergency medical services (at a Military Treatment Facility) and SAPR services shall be provided at no cost by the USG to all DoD Contractor personnel. Limited medical services are: a SAFE exam and consultation regarding further care in accordance with DoDI 6495.02.

(c) The Contractor shall designate an employee credentialed in Victim Advocacy as the company POC (for more information regarding credentialing as a Victim Advocate visit the National Advocate Credentialing Program (NACP): https://www.thenacp.org/).

(d) The Contractor shall provide a Sexual Assault/Sexual Harassment and Awareness Training Plan in accordance with CDRL A002.

4. Continental U.S. (CONUS) Replacement Center (CRC) Processing and departure points.

(a) Upon contract award the Contractor will coordinate with CRC reservations for in-bound personnel (see: https://www.bliss.army.mil/CRC/).

(b) All U.S. personnel shall report to the CRC at Ft. Bliss, Texas (or a DoD-approved equivalent process), for processing.

(c) All OCN personnel shall process through a DoD approved Non-CRC deployment center.

5. Medical. The current medical screening, immunization, and vaccination requirements i.e.

CENTCOM MOD 13, can be found at the Electronic Foreign Clearance Guide:

https://www.fcg.pentagon.mil/fcg.cfm.

6. Subcontracts: The Contractor shall incorporate the substance of this Special Contract requirement in all subcontracts when performance is in the CJOA-A.

1.7 General Information

1.7.1 Type of Contract

The government will award an Indefinite Delivery, Indefinite Quantity (IDIQ) Contract with Cost Plus Fixed Fee (CPFF) term and Cost Reimbursement (CR) Contract Line Items (CLINs).

FAR 16.301 and 16.306; DFARS 216.306. The CPFF CLINs shall be used for services. The CR CLINs shall be used for travel and other direct costs (ODCs) in accordance with (IAW) Federal Acquisition Regulation (FAR) 16.302, “Cost Contract.”

1.7.2 Other Direct Costs

In the course of performance pursuant to this contract, the Contractor may be required to purchase incidental items at the request of the Government. The Contractor shall acquire necessary items of other direct costs associated with the services on the contract with written, advanced, approval of the COR.

1.7.3 Quality

This section describes the Quality Control components for this effort. The following sub-sections provide details of various considerations on this effort.

1.7.3.1 Quality Control

Quality Control is the responsibility of the Contractor. The Contractor is responsible for the delivery of quality services/supplies to the Government (see FAR 52.246-1, Contractor Inspection Requirements).

The Contractor shall develop, implement and maintain an effective Quality Control which includes a written Quality Control Plan (QCP), in accordance with CDRL A005. The QCP shall implement standardized procedure/methodology for monitoring and documenting contract performance to ensure all contract requirements are met. The Contractor shall maintain an effective quality control program to ensure services are performed in accordance with the contract and PWS. The Contractor's QCP is the means by which the company self-assures that its work complies with the contract's requirements.

The finalized QCP will be accepted by the Government at the time of the award of the Task/Delivery Order. The Contracting Officer may notify the Contractor of required modifications to the plan during the period of performance. The Contractor then shall coordinate suggested modifications and obtain acceptance of the plan by the Contracting Officer. Any modifications to the program during the period of performance shall be provided to the Contracting Officer for review no later than 10 working days prior to effective date of the change. The QChall be subject to the Government's review and approval. The Government may find the QCP "unacceptable" whenever the Contractor's procedures do not accomplish quality control objective(s). The Contractor shall revise the QCP within 10 working days from receipt of notice that QCP is found "unacceptable”.

1.7.3.2 Quality Assurance

The government shall evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP) consistent with FAR Subpart 46.4. This plan is a Government only document primarily focused on what the Government must do to assure that the Contractor has performed in accordance with the requirements of the contract.

The Contractor shall address the support personnel qualifications and selection criteria and individual training and certification requirements for the various contract task requirements. The Contractor shall also conduct performance reviews via an In-Process Review (IPR) with the KO, COR and PM IS&A to discuss the contract performance, resolve issues, discuss customer feedback, both negative and positive, and feedback to all parties.

1.7.4 Security Requirements

This contract requires access to classified Government information at U.S. Government facilities or approved Contractor locations. Security requirements are contained in the DD 254 form.

Contractor personnel with access to DoD facilities shall observe all DoD security policies and procedures. Refer to the Security Appendix B of the PWS.

1.7.4.1 Personnel Clearances

The Contractor will require access to Communication Security (COMSEC) information, Sensitive Compartmented Information (SCI) and Non SCI Intelligence information, NATO, and Controlled Unclassified Information (CUI) information. The Contractor will require access to SIPRNet, JWICS, NSANet, collation networks, NIPRNet, Security Classification Guides and Operations Security (OPSEC) Plans at government and other Contractor facilities.

The Contractor personnel performing work under this contract must be U.S. Citizens and possess and maintain an active DoD Top Secret-SCI/SI/TK/G/HCS clearance. SCI Access is required and is only authorized for Contractors who require SCI access to perform their duties. The Contractor personnel must be capable of being read-on and to provide services upon contract award and for the life of the contract. The security requirements are in accordance with the attached DD Form 254, Department of Defense Contract Security Classification Specification.

The Contractor is solely responsible for obtaining the requisite security clearances for all Contractor personnel.

1.7.4.2 Common Access Card (CAC)

1.7.4.2.1 Contractors Requiring CAC

All Contractor personnel requiring a Common Access Card (CAC) shall adhere to established DOD, U.S. Army and PEO IEW&S, PM IS&A policies and procedures for obtaining and use of the CAC. Performance of some activities defined in this PWS may require access to classified data and restricted areas and Government Automated Information Systems (AIS). It is anticipated that all Contractor personnel providing the PWS support services will be required to possess TOP SECRET/Sensitive Compartmented Information (TS/SCI) clearances. It should be noted that personnel should not be nominated for, or be required to have TS/SCI clearances except as a bona-fide security requirement, and not solely to meet the anticipated contract TS/SCI staffing level. Security requirements will be identified on DD Form 254, Contract

Security Classification Specification. The Contractor will perform Automated Information System processing up to and including TS/SCI at the government facilities. The Contractor requires to have access to U.S. classified information outside the U.S. Puerto Rico, U.S.

possessions and trust territories. Contractor personnel performing Enterprise Information System (EIS) sensitive duties are subject to investigative and assignment requirements.

Before CAC issuance, the Contractor employee requires, at a minimum, a favorably adjudicated Tier 1 or an equivalent or higher investigation in accordance with Army Directive 2014-05. The Contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or

(3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled Tier 1 at the Office of Personnel Management.

1.7.4.2.2 Contractors NOT Requiring CAC but Request Access to DoD Installation/Facility

Contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theatre regulations.

1.7.4.3 Access to Government Systems

In accordance with DoD Directive Number 8500.01E, dated 24 October 2002, access to all DoD information systems shall be based on a demonstrated need to know, and granted in accordance with applicable laws and DoD 5200.2-R (reference) for background investigations, special access and IT position designations and requirements.

Contractors are not allowed access to any DoD system without explicit authorization of a relevant Government official. Individuals shall have the appropriate clearance for access to a particular system.

Contractor personnel requiring network privileged access will have a final adjudicated Tier 3 or Tier 5 security investigation. The investigation required is dependent on the network accreditation requirements and guidance provided by the Information System Security Manager/Officer of the local network or system. The government security manager will initiate the requisite security investigation for Contractors requiring network security investigations as required by the Information System Security Manager/Officer. Detailed privileged users access can be reference in Department of the Army Pamphlet 25–2–7 and AR 25-2, paragraph 2-38.

Access to Intelligence information requires a U.S. Government clearance at the appropriate level.

Access to SCI intelligence information requires a final U.S. Government clearance to Top Secret and indoctrinated for SCI access; which includes indoctrination to SI/TK/G/HCS and indoctrination to NATO Secret, as relayed by the Ground Intelligence Support Activity (GISA).

Contractor is not authorized to further disclose or release SCI (including release to a Subcontractor) without prior written authorization of the releasing agency. The Contractor shall gain authorization from DIA prior to downloading or destruction of any JWICS material. A copy of the written authorization will be sent to the Contracting Officer to be included in the file and a copy sent to CECOM G2 to be included in the tracker contract file under the Prime contract number.

Access to SIPRNet is required at Government facilities only. All Contractors granted SIPRNet access must be aware that they are not authorized to download ANY classified material without the guidance and written permission of the Cognizant Security Agency. All Contractors requiring access to the SIPRNet MUST HAVE A FINAL SECRET CLEARANCE OR Interim Top Secret clearance.

All Contractors with SIPRNet access MUST receive COMSEC and NATO Awareness briefings from their FSO prior to being granted access. COMSEC and NATO Awareness Briefing dates must be recorded on all visit requests. The NATO Awareness Briefing is required to inform personnel how to protect NATO information in the event they come across it while accessing SIPRNET. The Contractor shall not access, download or further disseminate any special access data (i.e., intelligence, NATO, COMSEC, etc.) outside the execution of the defined contract requirements. All Contractors will read the NATO Central Registry awareness briefing located at: https://secureappcac2.hqda.pentagon.mil/eimatraining/brief_form.asp prior to being issued a SIPRNet account. This briefing does not authorize NATO access, and is solely for the purpose of awareness.

The Contractor will require access to JWICS at Government facilities only. All Contractors requiring access to the JWICS MUST have a final Top Secret clearance and be indoctrinated for SCI access. All individuals require Secret NATO access and must receive a COMSEC briefing prior to being granted access to JWICS.

All Contractors requiring access to NSANet MUST have a final Top Secret clearance and be indoctrinated for SCI access. Contractors and/or Subcontractors requiring access to the NSANet will require a successfully completed Full Scope (Lifestyle) or Counterintelligence Polygraph.

Contractors requiring access to NSANet receive a COMSEC briefing prior to being granted access to NSANet.

1.7.4.4 Non-Disclosure Agreements

The Contractor personnel must sign a Non-Disclosure Agreement (NDA) due to the acquisition sensitive and/or pre-decisional nature of information they may be required to access in the performance of their duties. Personnel must perform within the security limitations of AR 381- 10, USSID 1800, and appropriate security regulations according to their mission requirements.

1.7.4.5 Security Classification Guides (SCG)

The Contractor will require access to various Security Classification Guides, such as, ARCYBER SCG FOR CYBERSPACE OPERATIONS AND SECURITY and the DCGS-A Security Classification Guide to perform responsibilities under this PWS.

1.7.4.6 Release and Export Controls

The International Traffic in Arms Regulations (IATR) Part 121, Category XIII (b) (4) states that the NCDSMO (previously known as the UCDSMO and UCDMO) will maintain a CDS product list called the UCDMO Control List (UCL). CDS products on the UCL are export controlled under ITAR.

The UCL includes:

All CDSs used by the U.S. Government to protect classified national security systems (whether or not they are known to the NCDSMO or on the baseline)

All CDSs on the CDS Baseline List All CDSs on the CDS Sunset List All CDS-specific specialized technologies and components

1.7.4.7 ANTITERRORISM /OPERATIONAL SECURITY (AT/OPSEC)

REQUIREMENTS

1. AT Level I Training. All Contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The Contractor shall submit certificates of completion for each affected Contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 60 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: https://jkodirect.jten.mil/ for CAC holders (Course number “US007”). Non-CAC-holders may go to:

http://jko.jten.mil/courses/atl1/launch.html.

2. AT Awareness Training for Contractor personnel traveling overseas for both unofficial and official travel: U.S. based Contractor employees and associated subcontractor employees shall receive government provided area of responsibility (AOR) specific AT awareness submit training as directed by AR 525-13, or other COCOM specific requirements, as necessary.

Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact. U.S. based Contractor employees and associated subcontractor employees will update their PRO-File survey prior to their official or unofficial travel, in accordance with AR 525-28, Personnel Recovery. The PRO-File survey is available at the following link: https://prmsglobal.prms.af.mil/prmsconv/Login/Banner.

3. iWATCH Training. The Contractor and all associated Subcontractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 60 calendar days after contract award. The training can be found at the following website:https://www.dvidshub.net/video/583923/iwatch-2018.

4. Mass Warning Notification System (MWNS) Requirement. Per DoDI 6055.17, all Contractors accessing government installations must register with the MWNS system in use at the government place of performance.

5. Government OPSEC Program: Contractor shall adhere to all OPSEC policies set forth by Government appointed OPSEC officer. This includes but is not limited to policies found in the CECOM OPSEC Plan and any policies set forth via HQDA mandate, AMC OPORD, and or CECOM tasker.

6. Public Release of Materials. Per AR 530-1 Operations Security and CECOM OPSEC Plan, an OPSEC review is required for any information related to U.S.