B01-RSOI W9126G252SOI4998.pdf

DEPARTMENT OF THE ARMY

U.S. ARMY CORPS OF ENGINEERS, FORT WORTH DISTRICT

P.O. BOX 17300

FORT WORTH, TX 76102-0300

27 June 2025

REQUEST FOR STATEMENT OF INTEREST

W9126G-25-2-SOI-4998

Applicants must be a member in one of the following Cooperative Ecosystem Studies Units Regions:

Pacific Northwest, Hawaii-Pacific Islands, and Californian Regions

Project Title: Management of Invasive Species – Biosecurity Wake Island Airfield

A cooperative agreement is being offered ONLY to members of the Cooperative Ecosystem Studies Units (CESU) Program Region(s) identified above. Award will be made upon mutual agreement and acceptance of the terms and conditions contained in the request for proposal and the recipient’s CESU Joint and Cooperative Agreement (also known as the CESU Master Agreement).

Note the established CESU Program indirect rate is 17.5%.

Responses to this Request for Statements of Interest will be used to identify potential organizations for this project. Approximately $230,402.00 is expected to be available to support this project for the base period. Additional funding may be available to the successful recipient for optional tasks and/or follow on work in subsequent years.

NOTE: This project will be awarded under the authority of 16 USC 670c-1, Sikes Act. For projects for the implementation and enforcement of integrated natural resources management plans, priority shall be given to award to Federal and State agencies having responsibility for the conservation or management of fish or wildlife.

Period of Performance. The base period of the agreement will extend 18 months from the date of award. There may be up to four 18-month follow-on periods based on availability of funding.

Description of Anticipated Work: See attached Statement of Objectives.

NOTE: At this time we are only requesting that you demonstrate available qualifications and capability for performing similar or same type of work by submitting a Statement of Interest. A full proposal and budget are NOT requested at this time.

Preparation of your Statement of Interest: Provide the following (Maximum length: 2 pages, single-spaced, 12 pt. font):

1. Name, Organization, CAGE Code, Unique Entity ID, CESU Region, and Contact Information (Email)

2. Brief Statement of Qualifications (including):

a. Biographical sketch of the Principal Investigator, to include specific experience and capabilities in areas related to this project’s requirements

b. Relevant past projects and clients with brief descriptions of these projects

10 March 2025

c. Staff, faculty or students available to work on this project and their areas of expertise

d. Brief description of other capabilities to successfully complete the project: (e.g.

equipment, laboratory facilities, greenhouse facilities, field facilities, etc.)

Submission of Your Statement of Interest

1. Statements of Interest (SOI) are due by 2:00 P.M., Central Time, on 27 July 2025 via email to the parties listed below.

2. Direct questions no later than 9 July 2025 to the parties listed below.

Maria Lopez Grants Specialist USACE, Fort Worth District Email: Maria.E.Lopez@usace.army.mil Office: 817-886-1881

David Leptien Project Manager USACE, Fort Worth District Email: David.B.Leptien@usace.army.mil Office: 402-889-5570

Review of Statements Received: All statements of interest received from a member of the CESU Region(s) identified above will be evaluated by a board comprised of one or more people at the receiving installation or activity, who will determine which statement(s) best meet the program objectives, offer the most highly qualified Principal Investigator, have the most relevant experience and the highest capability to successfully meet the program objectives. Submitters whose statements are determined to best meet the program objectives will be invited to submit a full proposal.

Timeline for Review of Statements of Interest: RSOIs are required to be posted on www.Grants.gov for 30 days prior to the Government making a decision and requesting full proposals.

TO BE ELIGIBLE FOR AWARD, THE RECIPIENT AND ANY PROPOSED SUBRECIPIENTS

AND CONTRACT VENDORS MUST HAVE AN ACTIVE NIST SP 800-171 DOD

ASSESSEMENT (PERFORMED WITHIN THE LAST 3 YEARS). Additional details are provided as a separate attachment to this document.

Thank you for your interest in our Cooperative Agreements Program.

PAIGE E. POORMAN

Grants Officer

Attachment: Statement of Objectives http://www.grants.gov/

STATEMENT OF OBJECTIVES (SOO)

MANAGEMENT INVASIVE SPECIES – BIOSECURITY

WAKE ISLAND AIRFIELD

Cooperative Ecosystem Studies Unit (CESU) Cooperative Agreement

YGFZA53256121 – SPLIT FUND B

20 MAR 2025

1. PURPOSE

1.1. The overall goal of this project is to make attempts to eliminate the ability for invasive flora and fauna to establish on Pacific Air Forces Regional Support Center (PRSC) properties including Johnston and Wake Atoll, Koke’e Air Force Station (AFS), and Mt Ka’ala AFS.

Invasive species biosecurity tools and best management practices exist and can be used to control and potentially in some cases eliminate future incursions and subsequent establishment. The Non-Federal Entity (NFE) must be capable of travel to remote austere tropical locations outside of Hawaii and be capable of embarking on travel via oceanic vessels and long airplane trips of 4 or more hours.

1.2.This project aids the PRSC in its endeavor to achieve implementation of goals and objectives within the 2023 PRSC Integrated Natural Resources Management Plan (INRMP) specific to biosecurity. The PRSC INRMP in question was signed in 2023 by all tripartite parties and placed a focus on invasive species management both on PRSC properties as well as offshore locales. The NFE shall utilize the June 2015 Wake Island Biosecurity Management Plan Edition 4.0 and INRMP as a guide for implementation. This project supports implementation of INRMP Goal No 8 of the aforementioned INRMP specifically described as follows:

“GOAL 8: DEVELOP AND EMPLOY A SYSTEMATIC APPROACH FOR ONSHORE

AND OFFSHORE BIOSECURITY, INCLUSIVE OF EARLY DETECTION AND RAPID

RESPONSE METHODOLOY AND ONGOING COMMITMENT TO CONTROLLING

EXISTING PLANT AND ANIMAL INFESTATIONS TO MINIMIZE THEIR IMPACT TO

MISSION AND NATURAL RESOURCE ACTIVITIES.”

2. AUTHORITY

Authority to enter into a Cooperative Agreements (CA) for the work: Section 670c-1, Title 16 United States Code, Sikes Act.

2.1. In agreement with the above stated goals, the Non-Federal Entity (NFE) agrees to provide the necessary personnel, equipment, and materials required to implement, in part, the PRSC responsibilities pursuant to the Sikes Act Improvement Act (16 USC 670 et seq.), the National Environmental Policy Act (42 U.S.C. 4321 et seq.), and Air Force and Department of Defense natural resources directives and instructions.

In general, cooperative agreements must carry out a public purpose of support or stimulation, however under the authority of the Sikes Act (16 USC 670c-1 (c) (2)), notwithstanding chapter 63 of Title 31 (31 U.S.C. § 6301 et seq), a cooperative agreement under this section may be used to acquire property or services for the direct benefit or use of the United States Government.

Examples of carrying out a public purpose may include, but are not limited to, the following:

• Project results are made available to a wide audience (including nonfederal entities, following necessary coordination with the PRSC project manager

• Project results/outputs add to the scientific literature/knowledge base, with applicability and utility beyond the scope of the project footprint/study area

• Academic and other nonfederal partner institutions (and their personnel) gain professional experience, increase knowledge, and develop skills and abilities

• Students benefit from direct interaction with federal scientists, program and technical staff, and field unit managers

2.2 In accordance with section 6305 – Using cooperative agreements of the Federal Grant and Cooperative Agreements Act of 1977 (31 U.S.C. § 6301 et seq.), substantial involvement is expected between the Department of Defense and the recipient when carrying out the activity contemplated by the cooperative agreement. The DoD agrees to participate at a national level in support of the CESU program as accepted in the Master MOU for the establishment and continuation of the CESU program Article II 1- 4 and Article VI 1-7.

The AFCEC/PRSC further (hence DoD) agrees to provide substantial involvement as directed under the appropriate master agreement to include, but not limited to the following:

• AFCEC/PRSC is involved in development of study methodology, data gathering, analysis, and/or report writing

• AFCEC/PRSC actively participates and collaborates in carrying out the project plan of work, reviews and approves activities, helps train or select project staff or trainees.

• Coordinate research activities with other installation entities and scheduling of range time.

• Collaborating on appropriate course of action for attainment of site-specific objectives, including technical assistance and DoD guidance.

• Participation in status meetings including kick off meeting and Quarterly project update meetings.

3. DESCRIPTION OF OBJECTIVES

3.1. NFE shall provide one (1) full time employee to conduct biosecurity operations up to eighty

(80) hours per Federal pay period (14 calendar days) excluding Sundays and federal holidays and be available during core business hours of 0900-1500 HST. Personnel will be located on the Island of Oahu Hawai’i and travel intermittently to Koke’e AFS, Mt Ka’ala AFS, Wake Island Airfield, Johnston Atoll and offshore transportation depots used for staging and deployment of cargo to the aforementioned atolls.

3.1.1. Task 1: Professional Biological Document Review Assistance

Perform review of environmental assessments, construction designs, and proposed actions descriptions related to biosecurity for the protection of human health, safety, agriculture, natural resources and wildlife in alignment with Sikes Act, NEPA, ESA, MBTA, CWA and Air Force Manual 32-7003. Assume average participation in 3 document reviews and 3 corresponding comment resolution meetings per month. Review comments shall reference peer reviewed journals, accredited government publications, and other credible sources.

Assessments include but are not strictly limited to: (a) PRSC invasive species control projects; (b) Wake, Koke’e, Mt Ka’ala, Wake, and Johnston Atoll INRMP’s; construction designs for Wake Atoll, Koke’e AFS and Mt Ka’ala AFS; Johnston and Wake Atoll biosecurity procedures; preliminary ESA section 7 effects analysis; USAF NEPA 813’s.

Assumptions:

a. Assume average participation in 3 document reviews and 3 corresponding comment resolution meetings per month.

b. Assume average participation in 3 document creations and 3 corresponding comment resolution meetings per month.

3.1.2. Task 2: Wake and Johnston Atoll Invasive Species Inspections and Management

Perform invasive species inspections at offshore locations of cargo destined for Wake and Johnston atoll. Serve as the biosecurity first responder to invasive species discoveries on Wake Atoll, Johnston Atoll, Koke’e AFS, and Mt Ka’ala AFS. Document completion of all biosecurity inspections, site visits, and compliance procedures for all operations at Johnston Atoll and associated departure and staging areas. Submit reports and meeting minutes for all biosecurity site visits and meetings attended. Provide regulatory status updates during response events and ensure USAF client and chain of command is included in notifications to regulators. Attend all Wake Island Barge meetings and provide biosecurity education materials and guidance to all shipping participants utilizing the atoll. Provide Air Force POCs with meeting minutes and recommendations on how to tighten biosecurity requirements on barges, both Air Force funded and contractor barges. Coordinate biosecurity with Wake Island Base Operations Support Contractor (BOSC) to document if BOSC is completing biosecurity requirements. Implement Coconut Rhinoceros beetle monitoring on Wake Atoll. Provide client with annual records displaying the frequency of trap checks and contents discovered during such inspections. Purchase 50 New Zealand Department of Conservation (NZDOC) traps/boxes and ensure that they are available for deployment during Wake Island trips.

Assumptions:

a. Assume minimum of four-week notice prior to scheduled departure date.

b. Assume all travel shall require population of Site Arrival Requests and letters of authorization and prior to travel in accordance with base support letters.

c. Assume all travel to Wake Island shall be via rotator airplane which visits the atoll every two weeks.

d. Assume all travel to Johnston Atoll shall be provided by the USAF and will be either charter vessel or airplane. Such transport costs and mechanisms may be provided by SpaceX transportation platforms required by USAF agreements.

e. Assume austere living conditions, limited food options, and extreme heat as well as humidity on Wake and Johnston Atoll.

f. Assume seven (7) 2-week trips to conduct invasive species investigations on Wake Island Airfield, aim for overlap with barge arrival.

g. Assume Three (3) 1-week trips to Seattle Washington for barge inspections.

h. Assume Two (2) 1-week trips to mainland USAF SpaceX inspections

i. Assume One (1) month long trip to Johnston Atoll to oversee biosecurity inspections, assist with on shore validation of cleanliness and compliance with operations or work conducted at the site in accordance with Final NEPA Environmental Assessment.

3.1.3. Task 3: INRMP Project Development Support Specific to Invasive Species Management

Assist 611 CES NRM with development of strategies and new monitoring techniques applicable to natural resource and invasive species management projects at Johnston, Wake Atoll, Koke’e AFS, and Mt Ka’ala AFS. Project development may include refinement of methodologies, survey definitions, or estimation of level of effort and labor categories to achieve goals and objectives of invasive species projects depicted in the current INRMP.

During annual updates and 5-year revisions to the INRMP participate in reviews and resolution of comments specific to invasive species management.

a. Assume editing, task definition and authorship to at least 8 documents involving the research and or management of invasive species on PRSC lands.

b. Assume performing update to the current Wake biosecurity plan at least once during the period of performance; notification of date of update will be given by USAF NRM at least 6 months prior to need by date of revised document.

3.1.4. Task 4: Invasive Species Awareness Training

Provide annual invasive species awareness and rapid response training to the BOSC on Wake, as well as active duty and Air National Guard staff present at Koke’e and Ka’ala AFS.

During each site visit the biologist shall utilize historic training materials to brief staff on the dangers associated with bright lights and explain the phenomena of seabird fallout and how invasive predators prey upon fallout victims in the region. In addition to awareness training the biologist shall also survey the installation for presence/absence of invasive species and report such findings to the 611 CES NRM. The PRSC offices are located in Anchorage, Alaska and in house training shall be provided to 611 CES support staff twice during the PoP. The NFE shall utilize the same training materials used at Koke’e and Ka’ala and deliver that training to in house civilian, contract and active-duty personnel in the anchorage, Alaska based offices housed on Joint Base Elmendorf Richardson. The 611th NRM shall give the NFE a 3 months’ notice of when to hold the in house 611th invasive species awareness training to allow for ample travel planning time.

Assumptions:

a. Assume Three (3) two-day trips to both Koke’e AFS and Ka’ala AFS to conduct invasive species surveillance and seabird awareness training. Seabird training shall be performed prior to the fallout season for Hawaiian Seabirds.

b. Assume 1 (one) invasive species outbreak response trip per year at Koke’e and Ka’ala AFS and 7 days of labor at each site for immediate response and monitoring/detection of sighting.

c. Assume two (2) 7-day trips to Anchorage Alaska to deliver training to in house civilian, active duty, and contract support staff based on Joint Base Elmendorf Richardson.

3.2. NOTIFICATION REQUIREMENTS - The NFE is required to notify the 611 CES NRM of critical issues that may affect the performance of this SOO and/or human health and the environment. The types of issues that require notification include, but are not limited to, health risks, spills, unexpected utility crossings, unusual weather conditions, unacceptable materials, changes in critical personnel, and Unexploded Ordinance (UXO). As an example, if UXO was discovered during field activities, the NFE would be required to immediately stop work, report the discovery to the base POC and lead island officer on post, and implement the appropriate safety precautions. On critical issues, oral notification should be made immediately, followed by written notification as soon as practical. The NFE by accepting funds associated with this scope of work agrees to not release any information generated by this award to a non-USAF party without prior approval by USAF public affairs and security offices. The USAF encourages publication of scientific literature but reserves the right to review all draft literature prior to issuance to any non-USAF publication body or media entity. Any publication generated from this project shall give financial credit and acknowledgement to the Air Force Civil Engineer Center and project management support by the Pacific Air Forces Regional Support Center, JBER.

3.3. WORK SITE CONDITIONS - Coordinate work site activities to ensure the protection of human health and the environment; the prevention of damage to property, utilities, materials, supplies, and equipment; and the avoidance of work interruptions. Provide physical security to the work area with security equipment and personnel as specified in this SOO. The NFE must comply with Occupational Safety and Health Administration (OSHA) safety and health regulations and local safety office requirements. The NFE is required to provide the 611 CES NRM copies of any OSHA report(s) submitted during the duration of the PoP.

3.4. LOGISTICS - The NFE will work with the 611 CES NRM well in advance to ensure all supplies make it to WIA with the project field team or before the NR team arrives on the island. Using awarded funds in accordance with this SOO, the Cooperator will cover the cost for air travel to offshore biosecurity inspection areas, WIA, Koke’e and Ka’ala AFS and costs for all equipment needed to fulfill the scope of work. Transportation is limited on WIA, and the Cooperator must plan accordingly to ensure all transportation needs are established before arriving to the island. The Cooperator is required to bring their own transportation if they are unable to secure vehicles through the BOSC or other on island remote contract workforce. Remote Wake Atoll contractors can be utilized to support shipments and logistics; however, such utility of the on-island contract workforce shall be funded by the Cooperator using a subcontract or other legal contracting mechanism and such planning and execution of logistics will not be performed by the 611 CES NRM.

4.0 QUALIFICATIONS

The NFE’s biosecurity manager, supervisor and any subcontractor shall have recent experience performing work on remote tropical atolls or extremely humid and hot locales in oceanic settings.

Each onsite NFE utilizing pesticides to complete tasks in this SOO must hold a valid applicator license sanctioned by the Department of Defense and or any state within the USA. All parties must hold a valid driver’s license from a US State or territory. All parties executing tasks in this SOO must hold a minimum of a bachelor’s degree in botany, wildlife management, biology or comparable scientific field. Resumes for all parties involved in field work shall be provided to the 611 CES. Field biologists shall be capable of working in extreme heat and humidity and exhibit prior work experience in austere field locations with limited food options, primitive lodging, and only basic amenities.

All personnel who perform pest management activities on AF installations must hold the appropriate state certification and business license for the location and activity performed (this includes General Use and Restricted Use Pesticides). No uncertified technicians are allowed to apply pesticides on DoD installations (even under direct supervision).

5.0 GOVERNMENT FURNISHED MATERIALS OR PROPERTY

All supplies and materials required to complete the SOO must be purchased or leased by the NFE.

Any pesticides, tools or other equipment used during this project must be shipped in accordance with the associated EPA label affixed to the product and FAA guidelines. Personal protection equipment (PPE) shall be utilized during the project when applying pesticides. The PPE utilized shall be defined by the EPA label affixed to the product of intended usage. Vehicle rental, chainsaw procurement, on island gas purchases or procurement of any other equipment is the requirement of the NFE. Shipping of any materials to the island shall be done so at the cost of the

NFE.

6.0 PERIOD OF PEFORMANCE AND FOLLOW-ON PERIODS

6.1 Base Period: 18-months from date of award (3 months administrative period to complete on-boarding of employees and subcontractors, 12-month technical period for conducting field work, 3 months administrative for completion of reports only with no new work)

6.2 Four (4) 18-month Follow-On (FO) periods. Any overlap periods is to accommodate on-boarding of personnel, subcontracting activities, and reporting activities as field work is required during all 12 months of the technical period of performance.

6.3 Example POP Schedule:

Base Period: 06 MAR 2025 - 05 SEP 2026 (18 months) FO Period 1: 06 MAR 2026 - 05 SEP 2027 (18 months) FO Period 2: 06 MAR 2027 - 05 SEP 2028 (18 months) FO Period 3: 06 MAR 2028 - 05 SEP 2029 (18 months) FO Period 4: 06 MAR 2029 - 05 SEP 2030 (18 months)

7.0 COORDINATION

David Leptien Project Manager U.S. Army Corps of Engineers Regional Planning and Environmental Center (RPEC) Email: david.b.leptien@usace.army.mil Phone:402-889-5570

USAF Technical Point of Contact Joel Helm 611th Civil Engineer Squadron Email: joel.helm.1@us.af.mil Phone: 907-552-5230

USAF Financial Point of Contact Scott Webb

AFCEC/CZOP

Email: scott.webb.5@us.af.mil

Phone: 907-552-9618

8.0 DELIVERABLES

8.1 Kick Off Meeting/Meeting Minutes – The NFE shall set up a kickoff meeting with Air Force and USACE no later than 30 days from award. The kickoff meeting shall be in person or via teleconference. Draft meeting minutes shall be provided 1 week after the meeting for approval from the Air Force and USACE.

Upon approval, final meeting minutes will be distributed to all attendees.

8.2 Monthly Progress Updates – Monthly progress updates shall be due as of the last day of each month (monthly). Updates will be used to review and evaluate the overall progress of the project, along with any existing or potential problem areas. It shall include a summary of the events that occurred during the reporting period, discussion of performance, identification of problems, proposed solutions, corrective actions taken, and outstanding issues. Cost information shall be included in this report and display costs incurred during the month for labor, along with itemized list of equipment purchased, travel/lodging costs, as well as hours worked by subcontractors or supervisors.

Project updates shall be made privy to a 7-calendar day review by the USAF 611th NRM and all comments shall be responded to within 7 calendar days of receipt. The format of the monthly progress update shall be as follows:

• Relevant dates of the progress update

• List of assessment and investigation activities

• List of planning and decision meetings and follow-on activities

• List of documents reviewed

• List of information management meetings and/or activities

• List of general action items

• Number of days, locations, and activities in travel status

The NFE shall submit DD Form 1532-1 Pest Management Report/Pest Management Maintenance Record to the NRM weekly for pesticides applied.

8.3 Quarterly Progress Reports - One (1) typed letter report describing progress on the project shall be delivered to both the AFCEC and the USACE Project Manager. The report shall be due as of the last day of the third month (quarterly) and shall be transmitted via electronic mail, facsimile, or regular mail no later than the 10th calendar day following the end of the reporting period. Invoices for partial payment shall be submitted to coincide with receipt of the quarterly progress reports. No partial payment shall be approved unless the government has received all progress reports which are due.

8.4 Project Planning – The NFE shall submit a project planning summary no later than 60 days after award to the Air Force for review. The planning summary shall outline the NFE’s proposed activities. The Air Force will provide comments no later than 30 days after received. The NFE shall provide the final project planning summary no later than 30 days after receiving comments from the Air Force.

8.5 Annual Inventory – Federally owned property: An annual inventory listing

Federal property (to include description of the property, a serial number or other identification number) that is in the custody of the recipient; Copies to be sent to USACE PM and AFCEC POC.

8.6 Annual Inventory – Acquired Property: (purchased with funding from award)

Property records must be maintained that includes description of the property, serial number or other identification number, source of funding, who holds title, acquisition date, cost of property, percentage of Federal participation in project costs, location, use and condition of property, and ultimate disposition including date of disposal and sale price. A physical inventory must be taken, and results reconciled every two years. Copies of the inventory to be sent annually to USACE PM and AFWFB POC.

8.7 Spatial Data Mapping, Security, and Public Affairs Requirements - All products associated with this award that provide a map representation of the location of installation features (historical, existing, or planned) including installation maps, site plans, area development plans, walls-out as-built depictions, surveys, invasive species detections, wildlife sightings or other related overhead (plan) views of an installation (partial or entire) must adhere to requirements within reference B. All maps and associated data must comply with the United States Air Force GeoBase Program Natural Resources Entity Specification Directives attached to this SOO at reference B. Prior to release of any report, draft publication, draft media release, or website, the notice shall be shared with PRSC Public Affairs and 611th Air Support Squadron security personnel to be vetted for injurious content to national security. It is not the intent of the AFCEC or PRSC to thwart the distribution of science to the public or scientific community at large, but rather to ensure accidental release of sensitive information does not result from a product, map, or other information gathering effort generated from this award. In any and all draft publications or media releases the NFE shall reference the work associated with this project was funded by the Air Force Civil Engineer Center.

9.0 ADMINISTRATION

9.1 This cooperative agreement may be administered through a CESU only upon mutual agreement and official authorization by both parties of the acceptance of the application of the CESU Network IDC rate (17.5%).

9.2 Any resulting cooperative agreement will be subject to, and NFE shall comply with 2 CFR 200.313 “Equipment”, 200.314 “Supplies”, and 200.315 “Intangible Property” which includes use of research data. NOTE: In addition to the General Terms and Conditions, the Recipient shall request disposition instructions from the Federal Awarding agency (USACE) PM, as applicable.

10.0 POST AWARD and INVOICE PROCESS

10.1. Payment Requests and Progress Reports (Invoice Package) - Submit Payment Request and additional required documents to: swf-cesu-invoice@usace.army.mil. Carbon Copy the assigned USACE Project Manager as well as your organization’s point of contacts (POCs) for the additional required documents and for delinquent accounts.

10.1.1. Frequency: Quarterly plus 30-day grace period (except for the final invoice package noted below). If the coverage dates are not quarterly or preapproved by the PM (or the first/last submittal), the invoice package will be rejected.

Quarters Invoice pkgs due No Later Than (NLT):

Q1: Oct-Dec Q1: 31 Jan Q2: Jan-Mar Q2: 30 Apr Q3: Apr-Jun Q3: 30 Jul Q4: Jul-Sep Q4: 31 Oct

10.1.2. Payment Requests must be submitted on form SF270 Request for Advance or Reimbursement with the accompanying Standard Form-Performance Progress Report (SF- PPR), otherwise the SF270 will be rejected.

10.1.3. SF270 Request for Advance or Reimbursement

10.1.3.1 Block 9, Recipient Organization. For successful set up of Electronic Transfer of Funds (EFT), the Recipient’s name and address shall reflect the exact name and physical address that appears in the System for Award Management (SAM), https://sam.gov/.

10.1.3.2. Blocks 11, (a), (b), & (c) are for the description of funds. Preferred description is:

CLIN/POP Type, POP start and end dates, amount awarded (see example below); at minimum include the CLIN. If the description or the minimum CLIN information is missing, the SF270 and SF-PPR will be rejected.

Example:

CLIN 0001 / Base

22SEP23 – 21SEP24

$100,000.00 mailto:swf-cesu-invoice@usace.army.mil.

Funding must be separated as specified on the Award document. Sub-CLINs that specify “for funding only” (e.g., numbered 000101, 000102, etc.) may be rolled into the primary CLIN (e.g., 0001) unless otherwise instructed. All others required PM approval.

The SF270 may have multiple pages. An SF270 in Excel format may be requested at: swf-cesu- invoice@usace.army.mil, however, must be submitted in pdf format otherwise will be rejected.

10.1.4. SF-PPR Standard Form-Performance Progress Report: The Recipient shall tailor the SF- PPR to include, at minimum, the following information:

• Separate details by CLIN as applicable

• Achievements (must detail work during quarter associated with the invoice)

• Percent Completion

• Project Status

• Problems encountered and impact of activities and personnel on schedule.

• Anticipated work in next reporting period.

If the SF-PPR is incomplete, the SF-PPR and SF270 will be rejected.

A tailored SF-PPR form may be requested at: swf-cesu-invoice@usace.army.mil.

10.2. The Final invoice package is due no later than 90 days from final (funded/exercised) POP end date and must include the following documents: If any of the required information below is missing, the final invoice package will be rejected.

Final

SF270

SF-PPR

Final

SF425

DD882

SF428 plus attachment B (C&S if applicable)

SF298

Final Report

Forms may be requested from the district office at swf-cesu-invoice@usace.army.mil or found at: https://www.grants.gov/forms

[End of SOO] mailto:invoice@usace.army.mil mailto:swf-cesu-invoice@usace.army.mil mailto:swf-cesu-invoice@usace.army.mil http://www.grants.gov/forms

For ALL new opportunities with the Government, including modifications to existing awards, a NIST score is REQUIRED.

The attached guides are provided to assist in obtaining access to the systems and to upload your self-assessment NIST score.

In accordance with DoDI 5200.48, EO 13566, and Part 2002 of the Title 32 CFR 2002 Recipients and Subrecipients (Sub-Recips) are required to provide adequate security on all covered Recipient/Sub-Recip information systems, are required to implement NIST SP 800-171, and are required to have at least a Basic NIST SP 800-171 DoD Assessment that is current (i.e., not more than 3 years old unless a lesser time is specified in the solicitation).

SPRS provides storage and access to the NIST SP 800-171 assessment scoring information. To access the NIST SP 800-171 Assessments module, users must be registered in the Procurement Integrated Enterprise Environment (PIEE) https://piee.eb.mil/ and be approved for access to SPRS.

The NIST SP 800-171 DoD Assessment Methodology is located at:

https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171.

Please direct any questions related to this requirement to Paige.E.Poorman@usace.army.mil and Cheryl.R.Vendemia@usace.army.mil.

https://piee.eb.mil/ https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171 mailto:Paige.E.Poorman@usace.army.mil mailto:Cheryl.R.Vendemia@usace.army.mil

NIST Requirement Notice Attachment to (SOI or RFP).pdf

NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020 Additions/edits to Version 1.1 are shown in blue

NIST SP 800-171 DoD Assessment Methodology, Version 1. 2.1

Table of Contents

1) Background

2) Purpose

3) Strategically Assessing a Contractor’s Implementation of NIST SP 800-171

4) Levels of Assessment

5) NIST SP 800-171 DoD Assessment Scoring Methodology

6) Documenting NIST SP 800-171 DoD Assessment Results

7) Glossary of Terms

Annex A - NIST SP 800-171 DoD Assessment Scoring Template

Annex B - Basic (Contractor Self-Assessment) NIST SP 800-171 DoD Assessment Results Format

1) Background

a) Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, requires contractors and subcontractors to provide ‘adequate security’ to safeguard covered defense information, hereto referred to, for the purposes of this methodology, as Department of Defense (DoD) controlled unclassified information (CUI)1, when residing on or transiting through a contractor’s/subcontractor’s internal information system or network, and to report cyber incidents that affect that system or network to DoD. DFARS clause 252.204-7012 further states that to provide adequate security, the Contractor shall implement, at a minimum, the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, Protecting Controlled Unclassified Information (CUI) in Nonfederal Systems and Organizations. Contractors are also required to flow down DFARS Clause 252.204- 7012 to all subcontracts for operationally critical support, or for which subcontract performance will involve DoD CUI. Contractors must mark or otherwise identify, in accordance with direction contained within the specific contract, DoD CUI that is collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of performance of the contract.

b) DFARS provision 252.204-7008, Compliance with Safeguarding Covered Defense Information Controls, requires, among other things, offerors to represent they will implement the security requirements in NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the contracting officer. To document implementation of NIST SP 800-171, the contractor must develop, document, and periodically update a system security plan that describes system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. If implementation of the security requirements is not complete, companies must develop and implement plans of action to describe when and how any unimplemented security requirements will be met.

c) Under Secretary of Defense (Acquisition and Sustainment) (USD(A&S)) memorandum, “Strategically Implementing Cybersecurity Contract Clauses,” dated February 5, 2019, directed the Defense Contract Management Agency (DCMA) to pursue, with companies for which they administer contracts, the application of a standard methodology and approach to assess a contractor’s implementation of NIST SP 800- 171 at a strategic (corporate-wide) level as an alternative to the requirement for

1 DoD is transitioning from the use of the term ‘covered defense information’ in the DFARS to “DOD Controlled Unclassified Information (CUI), consistent with DoDI 5200.48, Controlled Unclassified Information (CUI)” contractors to document implementation of NIST SP 800-171 on a contract-by-contract basis.

2) Purpose

a) The NIST SP 800-171 DoD Assessment Methodology, Version 1.2 documents a standard methodology that enables a strategic assessment of a contractor’s implementation of NIST SP 800-171, a requirement for compliance with DFARS clause 252.204-7012.

b) This methodology is used for assessment purposes only and does not, and is not intended to, add any substantive requirements to either NIST SP 800-171 or DFARS clause 252.204-7012.

c) DoD will use this methodology to assess the implementation of NIST SP 800-171 by its prime contractors. Prime contractors may use this methodology to assess the implementation status of NIST SP 800-171 by subcontractors.

d) This methodology informed the conduct of pilot NIST SP 800-171 DoD Assessments performed by DCMA, in partnership with the Defense Counterintelligence and Security Agency (DCSA) and the DoD Components, during 2019. DoD will update and codify this methodology in policy/regulation.

3) Strategically Assessing a Contractor’s Implementation of NIST SP 800-171

a) The NIST SP 800-171 DoD Assessment Methodology enables DoD to strategically assess a contractor’s implementation of NIST SP 800-171 on existing contracts which include DFARS clause 252.204-7012, and to provide DoD Components with visibility to the summary level scores of strategic assessments completed by DoD, thus providing an alternative to the contract-by-contract approach.

b) The NIST SP 800-171 DoD Assessment consists of three levels of assessments (see Section 4 of this document). These three types of assessments reflect the depth of the assessment, and the associated level of confidence in the assessment results.

c) Assessment of contractors with contracts containing DFARS clause 252.204-7012 is anticipated to be once every three years unless other factors, such as program criticality/risk or a security-relevant change, drive the need for a different assessment frequency.

4) Levels of Assessment

a) Basic (Contractor Self-Assessment) NIST SP 800-171 DoD Assessment

i) The Basic Assessment is the Contractor’s self- assessment of NIST SP 800-171 implementation status, based on a review of the system security plan(s) associated with covered contractor information system(s), and conducted in accordance with

NIST SP 800-171A, “Assessing Security Requirements for Controlled Unclassified Information” and Section 5 and Annex A of this document.

ii) The Basic Assessment results in a confidence level of ‘Low’ in the resulting score because it is a self-generated score.

iii) The summary level scores resulting from Basic NIST SP 800-171 DoD Assessments should be documented as indicated in Section 6 and Annex B of this document.

b) Medium NIST SP 800-171 DoD Assessment

i) The Medium Assessment is conducted by DoD personnel who have been trained in accordance with DoD policy and procedures to conduct the assessment. It is anticipated that Medium Assessments will be conducted primarily by Program Management Office cybersecurity personnel, as part of a separately scheduled visit (e.g., for a Critical Design Review).

ii) The assessment will consist of a review of the system security plan description of how each requirement is met to identify any descriptions which may not properly address the security requirements.

iii) The Medium Assessment results in a confidence level of ‘Medium’ in the resulting score.

iv) The DoD assessor will document summary level scores resulting from Medium NIST SP 800-171 DoD Assessments as indicated in Section 6 of this document.

c) High (On-Site or Virtual) NIST SP 800-171 DoD Assessment

i) The High Assessment, conducted by DoD personnel who have been trained in accordance with DoD policy and procedures to conduct the assessment, requires a thorough on-site or virtual2 verification/examination/demonstration of the Contractor’s system security plan and implementation of the NIST SP 800-171 security requirements.

ii) The High Assessment is conducted using NIST SP 800-171A, “Assessing Security Requirements for Controlled Unclassified Information.” The assessment will determine if the implementation meets the requirements by reviewing appropriate evidence and/or demonstration (e.g., recent scanning results, system inventories, configuration baselines, demonstration of multifactor authentication).

iii) An on-site High NIST SP 800-171 DoD Assessment is the preferred methodology for a full evaluation of the risk to DoD CUI because of the ability to verify and validate the effectiveness of the safeguards that implement security

2 A virtual High Assessment was developed in response to the COVID-19 epidemic to allow protections of assessors and DIB personal to limit travel and exposure of staffs whilst still being able to assess contractor risk. The government may utilize this methodology in the future as required in response to similar or other scenarios.

requirements defined in NIST Special Publication 800-171. While a High Assessment maybe be conducted virtually in lieu of onsite, a virtual assessment will not fully cover all the NIST SP 800-171 requirements, resulting in a less than full understanding of overall risk.

iv) A virtual High Assessment utilizes the same methodology as the on-site with added data protections processes enacted to protect the DIB data that is shared with assessment teams. All data is transmitted through DoD Secure Access File Exchange (SAFE), is only reviewed locally on each assessor’s computer (screen sharing is conducted utilizing DoD collaboration mediums that are approved for processing CUI) and contractor data is destroyed post assessment using NSA guidance for data destruction. With concurrence from the DIB companies being assessed, the assessment verifies and examines all documents utilizing the NIST SP 800-171A methodology minus the demonstration or testing of some requirements. In some cases, a follow-up on-site assessment of the items not assessed may be required or requested.

v) The first step in a High Assessment is for the contractor to conduct a Basic Assessment and submit results to the Department using the procedures in Annex B of this document. The High Assessment consists of a review of the Basic Assessment, a thorough document review and discussion with the contractor regarding the results to obtain additional information or clarification as needed, combined with government validation that the security requirements have been implemented as described in the system security plan. Network access by the assessor(s) is not required.

vi) The High Assessment results in a confidence level of ‘High’ in the resulting score.

vii) The DoD assessor will document summary level scores resulting from High NIST SP 800-171 DoD Assessments as indicated in Section 6 of this document.

5) NIST SP 800-171 DoD Assessment Scoring Methodology

a) This scoring methodology is designed to provide an objective assessment of a contractor’s NIST SP 800-171 implementation status. With the exception of requirements for which the scoring of partial implementation is built-in (e.g., multi-factor authentication, security requirement 3.5.3) the methodology is not designed to credit partial implementation.

b) Conduct of the NIST SP 800-171 DoD Assessment will result in a score reflecting the net effect of security requirements not yet implemented. If all security requirements are implemented, a contractor is awarded a score of 110, consistent with the total number of NIST SP 800-171 security requirements. For each security requirement not met, the associated value is subtracted from 110. The score of 110 is reduced by each requirement not implemented, which may result in a negative score.

c) While NIST SP 800-171 does not prioritize security requirements, certain requirements have more impact on the security of the network and its data than others. This scoring methodology incorporates this concept by weighting each security requirement based on the impact to the information system and the DoD CUI created on or transiting through that system, when that requirement is not implemented.

d) Weighted requirements include all of the fundamental NIST SP 800-171 ‘Basic Security Requirements’ - high-level requirements which, if not implemented, render ineffective the more numerous ‘Derived Security Requirements’; and a subset of the ‘Derived Security Requirements’- requirements that supplement the Basic Security Requirements - which, if not implemented, would allow for exploitation of the network and its information.

i) For security requirements that, if not implemented, could lead to significant exploitation of the network, or exfiltration of DoD CUI, 5 points are subtracted from the score of 110. For example, failure to limit system access to authorized users (Basic Security Requirement 3.1.1) renders all the other Access Control requirements ineffective, allowing easy exploitation of the network; failure to control the use of removable media on system components (Derived Security Requirement 3.8.7) could result in massive exfiltration of CUI and introduction of malware.

(1) Basic Security Requirements with a value of 5 points include 3.1.1, 3.1.2, 3.2.1, 3.2.2, 3.3.1, 3.4.1, 3.4.2, 3.5.1, 3.5.2, 3.6.1, 3.6.2, 3.7.2, 3.8.3, 3.9.2, 3.10.1, 3.10.2, 3.12.1, 3.12.3, 3.13.1, 3.13.2, 3.14.1, 3.14.2, and 3.14.3.

(2) Derived Security Requirements with a value of 5 points include 3.1.12, 3.1.13, 3.1.16, 3.1.17, 3.1.18, 3.3.5, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 3.5.10, 3.7.5, 3.8.7, 3.11.2, 3.13.5, 3.13.6, 3.13.15, 3.14.4, and 3.14.6.

ii) For Basic and Derived Security Requirements that, if not implemented, have a specific and confined effect on the security of the network and its data, 3 points are subtracted from the score of 110. For example, failure to limit access to CUI on system media to authorized users (Security Requirement 3.8.2) or failure to encrypt CUI stored on a mobile device (Security Requirement 3.1.19), put the CUI stored on the system media or mobile device at risk, but not the CUI stored on the network itself.

(1) Basic Security Requirements with a value of 3 points include 3.3.2, 3.7.1, 3.8.1, 3.8.2, 3.9.1, 3.11.1, and 3.12.2.

(2) Derived Security Requirements with a value of 3 points include 3.1.5, 3.1.19, 3.7.4, 3.8.8, 3.13.8, 3.14.5, and 3.14.7.

iii) All remaining Derived Security Requirements, if not implemented, have a limited or indirect effect on the security of the network and its data. For these, 1 point is subtracted from the score of 110. For example, failing to prevent reuse of identifiers for a defined period (Security Requirement 3.5.5) could allow a user access to CUI to which they were not approved.

e) Two Derived Security Requirements can be partially effective even if not completely or properly implemented, and the points deducted should be adjusted depending on how the security requirement is implemented.

i) Multi-factor authentication (MFA) (Security Requirement 3.5.3) is typically implemented first for remote and privileged users (since these users are both limited in number and more critical) and then for the general user, so 3 points are subtracted from the score of 110 if MFA is implemented only for remote and privileged users; 5 points are subtracted from the score of 110 if MFA is not implemented for any users.

ii) FIPS validated encryption (Security Requirement 3.13.11) is required to protect the confidentiality of CUI. If encryption is employed, but is not FIPS validated, 3 points are subtracted from the score of 110; if encryption is not employed, 5 points are subtracted from the score of 110.

f) Although not common, future revisions of NIST SP 800-171 may add, delete or substantively revise security requirements. When this occurs, a value will be assigned to any new or modified requirements in accordance with this scoring methodology.

g) The contractor must have a system security plan (Basic Security Requirement 3.12.4) in place to describe each covered contractor information system, and a plan of action (Basic Security Requirement 3.12.2) in place for each unimplemented security requirement to describe how and when the security requirement will be met.

i) Since the NIST SP 800-171 DoD Assessment scoring methodology is based on the review of a system security plan describing how the security requirements are met, it is not possible to conduct the assessment if the information is not available. The absence of a system security plan would result in a finding that ‘an assessment could not be completed due to incomplete information and noncompliance with DFARS clause 252.204-7012.’

ii) Plans of action addressing unimplemented security requirements are not a substitute for a completed requirement. Security requirements not implemented, whether a plan of action is in place or not, will be assessed as ‘not implemented.’ For example, if the initial roll-out of 3.5.3, multifactor authentication, is only 75% complete, and there is a plan of action still being implemented, 3.5.3 will be considered ‘not implemented’, as the requirement has not been fully implemented.

iii) A lack of plan of action for unimplemented security…