B08 - ATTACHMENT 1 - PWS - Auditorium Maintenance Final.pdf

ATTACHMENT 1

PERFORMANCE WORK STATEMENT

Contents

1. INTRODUCTION

2. PURPOSE AND BACKGROUND

3. SCOPE

4. PERIOD OF PERFORMANCE

5. WORK SCHEDULE AND LOCATION

6. PERFORMANCE REQUIREMENTS

7. DELIVERABLES

8. PERFORMANCE REQUIREMENTS SUMMARY MATRIX

9. TRANSITION SUPPORT

13. CONTRACT MANAGEMENT

14. COMPLIANCE DOCUMENTS

16. OTHER TERMS, CONDITIONS, AND PROVISIONS

PERFORMANCE WORK STATEMENT (PWS)

Title: Auditorium Maintenance: Room 1W71

Requiring Activity Name: Walter Reed Army Institute of Research (WRAIR)

1. INTRODUCTION

The WRAIR aims to conduct biomedical research that is responsive to Department of Defense and US Army requirements and delivers life-saving products including knowledge, technology and medical material that sustain the combat effectiveness of the Warfighter.

With our headquarters dedicated to Senator Daniel E. Inouye and located in Silver Spring, Maryland, the Walter Reed Army Institute of Research is the largest biomedical research facility currently serving the Department of Defense.

Established in 1893, our research and development now reaches around the world from Maryland to Germany, Thailand, and Kenya.

Our vision is to be the premier DoD biomedical research organization, constantly relevant, integrating basic research and advanced technology that protects, projects, and sustains the Warfighter today, invents global medical solutions for the future, and keeps the Warfighter on point for the Nation. We host three Centers of Excellence for Military Psychiatry and Neuroscience Research, Military Infectious Disease Research, and Enabling Capabilities Research;

each center ranging from blast induced neurotrauma to malaria vaccine development.

2. PURPOSE AND BACKGROUND

The Walter Reed Army Institute of Research (WRAIR) and Naval Medical Research Center (NMRC) located at the U.S. Army Forrest Glenn Annex in Silver Spring, MD is seeking an independent contractor to provide 5-year (1-base year, with 4-option years) maintenance support to A/V equipment located in Building 503, Room 1W71 (Auditorium) of the main facility located in Building #503 on Robert Grant Avenue, silver Spring, MD 20910-7500.

3. SCOPE

The contractor shall provide maintenance services for Audio/Visual (A/V) equipment at the Albert Behnke Auditorium, located in Building 503 of the WRAIR. The Contractor shall provide the necessary manpower and material required to perform the diagnosis and repair/replacement of failed A/V equipment components, adjustments, and conduct testing during scheduled or non-scheduled work hours. The Contractor shall maintain the entire A/V in an operational state of functionality. WRAIR’s requirement for A/V maintenance also has multiple locations throughout the building.

Additional maintenance locations may be required, as WRAIR’s research requirements change.

4. PERIOD OF PERFORMANCE

The periods of performance for this contract are as follows:

Base Period 29 September 2020 – 28 September 2021 Option Period 1 29 September 2021 – 28 September 2022 Option Period 2 29 September 2022 – 28 September 2023 Option Period 3 29 September 2023 – 28 September 2024 Option Period 4 29 September 2024 – 28 September 2025

5. WORK SCHEDULE AND LOCATION

5.1. Work Location

The work location is 503 Robert Grant Avenue, Silver Spring, MD 20910.

5.1.1. Telecommuting

Telecommuting is not feasible for the services provided under this contract.

5.1.2. Working During Emergency Situations

Unless coordinated with the COR, Contractor shall not schedule repairs on those days the Government or installation is closed due to safety conditions, inclement weather conditions, national emergencies, Pandemics (i.e. COVID-19), energy conservation or by direction of the Installation Commander for any other reason.

5.2. Federal Holidays

5.2.1. The contractor shall not perform services on days designated as a Federal Holiday by Federal

Status, Executive Order, Presidential Proclamation or Installation Commander

5.2.2. Federal holidays are an exception to the regular duty hours. Any of the holidays listed below falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. The following is a list of legal federal holidays that services shall not be performed.

The following are Federal Holidays:

New Year’s Day Birthday of Martin Luther King, Jr.

Washington’s Birthday Memorial Day Independence Day

Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

5.3. Post Closure

Unless coordinated with the COR, contractor shall not schedule any auditorium equipment maintenance on days the Government or installation is closed due to local determinations relating to safety conditions, inclement weather conditions, national emergencies, energy conservation. During these periods of closure, the mission essential contractor personnel shall report for work.

5.4. Work Schedule

The contractor shall provide regular support during normal business hours, from 0745 to 1630 hours, Eastern Time, Monday to Friday.

6. PERFORMANCE REQUIREMENTS

6.1. Objectives

The objective of this requirement is to provide preventative and any necessary emergency maintenance on the A/V system for the WRAIR auditorium.

6.2. Specific Tasks / Requirements

6.2.1. Preventative Maintenance Service Calls: The contractor shall coordinate with COR for scheduling maintenance visits during the year. The contractor will provide the necessary on-site labor, to perform preschedule routine cleaning, adjustments, and alignments to maintain optimum system performance. The contractor shall respond to service requests within two hours; during regular business hours. (Deliverable 5)

6.2.2. Unlimited Unscheduled/Emergency Service Calls: The contractor shall provide certified service personnel to perform unscheduled maintenance. Unscheduled maintenance support is defined as critical maintenance visits for component and system failures that cause significant security risks to personnel or property. Contractor shall respond to emergency service calls within one hour of reception of notification, and shall provide a service technician within one business day. The severity and urgency of the service requirement will be determined by the WRAIR technician.

6.2.3. All maintenance shall be performed in accordance with the equipment manufacturer's recommendations.

6.2.4. Help Desk Support: The contractor shall provide a toll-free telephone number for Help Desk support to the COR and designated VTC room facilitators, to provide support for problem identification and resolution. This number will be available 24 hours a day, 7 days a week. Calls shall be responded to within 1 hour or reception. (Deliverable 1)

6.2.4.1. The contractor will retain help desk records for up to two years after contract completion, and will provide a quarterly report to the COR during the Period of Performance. (Deliverable 2)

6.2.5. Parts and Shop Service: The contractor shall provide shop labor for diagnosis and repair of faulty equipment, provide all replacement parts, except consumables, and cover all charges for equipment sent to manufacturers for repair. (Deliverable 3) Additionally, the contractor shall act as a liaison between the client and the manufacturer.

6.2.6. Installation Access: All personnel serving on this contract shall have a National Agency Check with Inquiries (NACI) completed prior to being allowed access to the installation. The Government reserves the right to terminate the entry of any Contractor employee upon disclosure of information which indicates the individual’s continued entry to the installation is not in the interest of national security. The violation of or deviation from the established security procedures by Contractor employees may also result in denial of entry to the installation. Should it be deemed necessary to deny an employee entry, that individual will be replaced immediately with an employee of equal or greater qualifications.

a. The Contractor shall be responsible for any delays caused by employees who report to work without their badge and or CAC.

6.3. Management Reports and Plans

Maintenance Service Request Reports: (Deliverable 4) The Contractor shall record each Maintenance Service Request (MSR). At a minimum, the MSR shall contain the component involved, its location, date and time the call was received, nature of trouble, name(s) of service personnel assigned to the task, instructions describing what has to be done, the amount and nature of the materials to be used, cost of materials used for repair, the time and date work started, and the time and date of completion. The Contractor shall provide copies of the MSRs after each visit or when requested by the WRAIR technician.

Quality Control Plan (Deliverable 7). The contractor shall provide a draft Quality Control Plan (QCP) no later than (NLT) 15 days after contract award. The contractor shall prepare and adhere to a QCP describing how the contractor intends to manage the contract to achieve the established standards set forth in the Performance Standards Summary Matrix and the contractor’s QCP. At a minimum, the QCP must include a self-inspection plan, an internal staffing plan, and an outline of the procedures that the Contractor will use to maintain quality, timeliness, responsiveness, and customer satisfaction.

7. DELIVERABLES

The contractor shall complete and submit deliverables in accordance with the “Deliverables Table” below. Unless specified in the PWS within the description of the deliverable, all deliverables will be made to the COR electronically.

DELIVERABLES TABLE

PWS

Ref. Number Title/Description Due

6.2.4. Deliverable 1 Help Desk Support: The contractor shall provide a toll free help desk number for business hours, and after hours support.

Within 15 calendar days of award.

6.2.4.1. Deliverable 2 Records Maintenance: The contractor shall retain help desk records for two years, and provide a report to the

COR.

After each service call.

6.2.5. Deliverable 3 Parts and Shop Service: The contractor shall provide shop labor for diagnosis and repair of faulty equipment, provide all replacement parts, except consumables, and cover all charges for equipment sent to manufacturers for repair.

As needed.

6.3. Deliverable 4 Quality Control Plan: The contractor shall provide a draft Quality Control Plan (QCP).

NLT 15 days after contract award.

6.3. Deliverable 5 Annual Preventive Maintenance: The contractor shall perform an annual PM during the last quarter of the base year, and in the last quarter of all of the option years.

Annually.

7.1. Reports and Documents – Not Applicable

7.2. Inspection and Acceptance

The COR delegated oversight of specific technical, functional and oversight responsiblities is responsible for inspection and acceptance of all services, incoming shipments, documents, and services.

Certification by the Government of satisfactory services provided is contingent upon the Contractor performing in accordance with the performance standards contained in the Performance Work Statement and all terms and conditions of this order, including all modifications.

7.3. COR Information

To be determined upon award.

8. PERFORMANCE REQUIREMENTS SUMMARY MATRIX

The Government intends to utilize a Quality Assurance Surveillance Plan (QASP) to monitor the quality of the Contractor’s performance in relation to performance objectives. The Government will finalize the QASP immediately following award, and the COR will provide a copy of the final QASP to the contractor. The QASP is a living document and may be updated by the Government as necessary.

The Government will use the following performance requirements to measure the performance of the contractor.

The contractor shall meet the Performance Objective(s) and Acceptable Quality Level(s) within the “Performance Requirements Summary Matrix” (PRS Matrix).

Performance Requirements Summary Matrix

# PWS Ref. Performance Objective

Performance Measurement

Acceptable Quality Level

Method of Surveillance Incentive

1. 6.2.1.

The contractor responds to service requests within two hours

All service requests receive a response within two hours of reception by the contractor

Meets: >95%

Does Not Meet:

<95%

Method: Monitored via Remedy and After

Action Reports.

Frequency: As needed

Past Performance

2. 6.2.2.

The contractor shall respond to all emergency service requests within one hour

All emergency service requests receive a response within one hour of reception by the contractor

Method: Monitored via

3. 6.2.4.

Help desk available 24 hours a day, 7 days a week

Help desk is available for assistance, as defined in paragraph 6.2.4.

Method: Monitored via

4. 6.2.4.1.

Help desk records are maintained for two years after the end of the contract

Helpdesk records maintained for 2 years after end of contract

Meets: 100%

Method: COR observation

Frequency: Quarterly

5.

6.2.6.

16.11.2.

Installation Access -

Contractor shall follow installation access procedures.

Sum of all incidents in which contractor personnel did not follow installation access procedures

< 1 incident per month

Direct observation by COR and installation security.

Past Performance

6. 16.11.4.

iWATCH Training -

Contractor shall provide iWATCH training to all personnel within 30 calendar days of contract

(Sum of all contractor personnel who have completed iWATCH training within 30 calendar days of contract award) / (total number of

>90% Review of Training report from the contractor.

award. contractor personnel supporting the contract)

7. 16.11.6.

OPSEC SOP –

Contractor shall submit OPSEC SOP that meets minimum quality standards.

Number of calendar days after contract award that the contractor submits the

OPSEC SOP to the COR

< 90 calendar days after contract award

COR receipt of OPSEC SOP Past Performance

8. 16.11.9.

Information Assurance – Contractor information assurance workforce personnel are trained in accordance with DoD and Army policy

Number of calendar days after contract award in which the contractor submits training certifications for all personnel requirement information assurance training

< 30 calendar days

COR receipt of all certifications Past Performance

9. TRANSITION SUPPORT

9.1. Incoming Transition Plan – Not applicable

9.2. Outgoing Transition Plan – Not Applicable

10. KEY PERSONNEL – Not Applicable

11. TRAVEL/TEMPORY DUTY (TDY) – Not Applicable

12. GOVERNMENT FURNISHED PROPERTY – Not Applicable

13. CONTRACT MANAGEMENT

13.1. Government Management

The Contracting Officer’s Representative (COR) for this contract will be appointed by the Contracting Officer (KO). The COR will serve as the primary point of contact for all activities and issues that occur under this contract. Only the KO has the authority to enact changes to this award.

13.2. Contractor Management

The contractor shall designate a single Program Manager (PM) to be the contractor’s authorized point of contact (POC) with the COR. The PM will be responsible for formulating and enforcing performance standards, assigning contractor schedules, reviewing performance quality, communicating policies, purposes, and goals to subordinates. This will include coordination with the KO and the COR to resolve any issues that may arise, trends relating to the contract, or proposed changes or modifications to the contract.

13.3. Contractor Organization

The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. The contractor shall ensure that all contractor personnel are advised of their chain of command and who they should contact if they have questions.

13.4. Contractor Vacant Positions

The contractor shall fill vacant positions within thirty (30) business days. If contractor positions are vacant for more than thirty (30) days, the COR will provide a Contract Deficiency Report (CDR) to the KO.

13.5. Subcontract management

13.5.1. The contractor is responsible for any subcontract management necessary to integrate services performed on this contract.

13.5.2. The contractor is responsible and accountable for subcontractor performance on this contract.

13.5.3. The contractor is responsible to manage task distribution to ensure there are no OCI considerations.

13.5.4. Contractor my add subcontractors to their team after notification and written approval from the

KO.

13.5.5. Privy of contract is with the contractor and the subcontractor.

13.6. Foreign Nationals

A foreign national can only be hired if they have a special skill that a US Citizen cannot be found to perform.

A background investigation must be completed in its entirety before unescorted access to the facility is granted. Government computer access will not be approved until a background check is done in accordance with para 18.9. Typically, a background check cannot be performed on a foreign national unless the individual has lived in the United States for three (3) of the last five (5) years.

14. COMPLIANCE DOCUMENTS

14.1. General Compliance

14.1.1. Federal Law

The services provided under this contract must be conducted in accordance with all Federal law, Department of Defense (DOD), Department of the Army (DA) and Medical Research and Development Command (USAMRDC) laws and command laws, regulations, policies, and procedures that govern the conduct of regulated research.

Federal regulations governing regulations for human subject’s protection are found in 45 CFR 46. The International Convention on Harmonization Guidelines for Good Clinical Practice is the standard governing the conduct of research trials. References for military regulations and policies governing regulated research may be found at https://MRDC.amedd.army.mil/rodorphrpo.asp.

14.1.2. Occupational Safety and Health Administration

The contractor shall comply with Occupational Safety and health Administration Standard Number

1904.32. The contractor shall deliver the 300A by February 1 of each year (Deliverable 9).

14.1.3. DoD Compliance Documents

A complete list of Department of Defense compliance documents providing specifications, standards, or guidelines can be found at http://www.dtic.mil/whs/directives/corres/dir.html

A complete list of Department of Defense compliance documents providing specifications, standards, or guidelines can be found at http://www.dtic.mil/whs/directives/corres/dir.html

a) Army Regulation 340-21, Army Privacy Program.

http://www.army.mil/usapa/epubs/340_Series_Collection_1.html

b) Army Regulation 25-1, Information Technology.

http://armyhpubs.army.mil/epubs/25_Series_Collection_1.html

c) Army Regulation 25-2, Information Assurance.

d) Department of Defense (DoD) Instruction 3216.02, Protection of Human Subjects and Adherence to Ethical Standards in DoD-Supported Research, dated November 2011.

http://www.dtic.mil/whs/directives/corres/pdf/321602p.pdf

e) Department of Defense (DOD) 6025.18 Regulation, DOD Health Information Privacy Regulation, 24 January 2003.

f) DOD Instruction 3210.7, Research Integrity and Misconduct, 14 May 2004.

g) Department of Defense (DOD) Instruction 8500.01 Cybersecurity

h) Department of Defense (DOD) Instruction 8510.01 Risk Management Framework (RMF) For DOD Information Technology (IT Department of Defense (DoD) Instructions 5400.11-R, Privacy Program http://www.dtic.mil/whs/directives/corres/pdf/540011p.pdf

14.2. Information Technology Compliance

14.2.1. Army Regulation 25-1, Information Technology

Compliance information regarding Army Information Technology may be found at:

http://armyhpubs.army.mil/epubs/25_Series_Collection_1.html

14.2.2. Army Regulation 25-2, Information Assurance

Compliance information regarding Army Information Assurance may be found at:

https://ia.signal.army.mil/docs/AR25-2.pdf

14.2.3. Cyber-security

a. Federal Law

• The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

• The Federal Information Security Management Act (FISMA)

• The E-Government Act of 2002

b. Office of Management and Budget (OMB)

• The following publications are located at https://www.whitehouse.gov/omb/agency/default

• Circular A-130

• Guidance M-05-24, Implementation of Homeland Security Presidential Directive

(HSPD) 12-Policy for a Common Identification Standard for Federal Employees and Vendors

c. National Institute of Standards and Technology (NIST)

• The following publications are located at http://www.nist.gov/publication-portal.cfm

• NIST Special Publication (SP) 800-37 – Guide for Applying the Risk Management

Framework (RMF) to Federal Information Systems

• NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and

Organizations

d. Federal Information Processing Standards (FIPS)

• The following publications are located at http://www.nist.gov/itl/fipscurrent.cfm

• FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules

• FIPS PUB 199 – Standards for Security Categorization of Federal Information and

Information Systems

• FIPS PUB 201-2, Personal Identity Verification of Federal Employees and Vendors

e. Department of Defense (DoD)

• The following publications are located at http://www.dtic.mil/whs/directives/

• DoD Instruction 5200.2, DoD Personnel Security Program (PSP)

• DoD Instruction 8500.1, Cybersecurity

• DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK)

Enabling

• DoD Instruction 8510.01, Risk Management Framework Process (RMF)

• DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)

• DoD Instruction 8580.02, Security of Individually Identifiable Health Information in

DoD Health Care Programs

• DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in

DoD Health Care Programs

• DoD Directive 5400.11, DoD Privacy Program

• DoD Manual 5400.11-R, Department of Defense Privacy Program

14.2.4. Risk Management Framework

Department of Defense (DOD) Instruction 8510.01 Risk Management Framework (RMF) For DOD Information Technology (IT Department of Defense (DoD) Instructions 5400.11-R, Privacy Program http://www.dtic.mil/whs/directives/corres/pdf/540011p.pdf https://www.whitehouse.gov/omb/agency/default http://www.nist.gov/publication-portal.cfm http://www.nist.gov/itl/fipscurrent.cfm

15. REFERENCE DOCUMENTS – Not Applicable

16. OTHER TERMS, CONDITIONS, AND PROVISIONS

16.1. Non-Personal Services

This PWS identifies services that are strictly non-personal in nature, as defined by Federal Acquisition Regulation (FAR) Part 37, Service Contracting. To ensure there is no appearance of any personal services, the Government shall neither supervise contractor personnel nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks or prepare work schedules for individual contractor personnel. It shall be the responsibility of the contractor to manage its personnel and to guard against any actions that give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Contractor Officer (KO) immediately.

16.2. Severable / Non-Severable Services

This award identifies services that are severable in nature.

16.3. Inherently Governmental Functions

This requirement has been reviewed and contains no services that are inherently governmental functions.

16.4. Acquisition Functions Closely Associated with Inherently Governmental Functions

Not applicable for this award

16.5. Organizational Conflict of Interest

Walter Reed Army Institute of Research (WRAIR) has categorized its requirements into two broad categories, as defined below, for purposes of identifying, avoiding or mitigating against OCIs in accordance with FAR Subpart 9.5. These categories apply to all enterprise laboratories AFRIMS, USAMRD-A, and USAMRD-G.

These categories are defined as follows:

Global Support: Where services which, by their very nature, give the Contractor access to non-public procurement sensitive data about the contract requirements, other contractors’ proprietary information, or put the contractor in a position to influence the award decision on a contract in which they are participating.

These services are identified as those having a direct impact to the operations of the greater WRAIR enterprise.

Services would be characterized as having access to Command Wide procurement sensitive information, or work that could likely have an influence over follow-on awards or contracts within subordinate directorates/Commands.

Mitigation strategies may include: avoidance (non-participation), firewalls between existing personnel and new requirement.

Isolated Support: Services which have focused impact on a specific Branch/ Department/ Program of WRAIR rather than the WRAIR enterprise.

Services can be characterized as having little or no access to procurement sensitive information other than the immediate requirement and little chances of follow-on work that can be influenced by the immediate requirement.

Mitigation Strategies: Contractor can provide a mitigation plan or acceptable self-certification that no OCI exists.

Contractor participation in more than one of these areas may give rise to an unfair competitive advantage resulting from access to advance acquisition planning, source selection sensitive or proprietary information.

Furthermore, Contractor participation in more than one area may give rise to a real or apparent loss of Contractor impartiality and objectivity where its advisory or planning assistance in one area potentially affects its present or future participation in another area.

The purpose of this categorization is to accomplish the following three objectives: (1) to inform prospective Offerors that WRAIR presumes that award of a contract or order in the subject category will give rise to real or apparent OCI’s with respect to requirements in the other category and or may give rise to an OCI in the same category; (2) to assist current Contractors and prospective Offerors in developing their own business strategies regarding participation in WRAIR requirements and in identifying and, where possible, avoiding or mitigating against OCIs; and (3) to ensure that all current Contractors and prospective Offerors are afforded the maximum practicable opportunity to compete for all WRAIR requirements consistent with the restrictions required under FAR Subpart 9.5 and sound business practices.

For purposes of identifying and/or mitigating against OCIs, WRAIR will examine all its services requirements and acquisitions regardless of the cognizant contracting activity (e.g., USAMRAA, GSA, other agency Multiple Award Schedules, etc.) or the type of contract vehicle used (e.g., FSS order, Fair Opportunity competitive order under Multiple Award ID/IQ Contracts, competitively negotiated awards under FAR Part 15, etc.).

Each WRAIR services solicitation will therefore be designated as falling within one of the above defined categories. The applicable OCI category will be set forth in each award.

This requirement is categorized as ISOLATED SUPPORT.

Organizational and consulting conflicts of interest may arise by performing advisory or consulting support services. Organizational conflicts of interest include providing services or performing advisory or consulting work for private companies that participate or will participate in future services or contract activities (solicitations and award). See FAR subpart 9.5.

The Contractor shall ensure that the Participation Agreement, either A and / or B as identified on each award, is signed by all staff assigned to or performing on each award before performing any work, including all subcontractors and consultants. The Participation Agreement shall be cosigned by a corporate official (contractor Task Manager or higher). The Contractor shall also ensure that all staff understand and adhere to the terms of the non-disclosure statement, protecting the procurement sensitive information of the Government and the proprietary information of other contractors. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the Contractor and the COR will immediately initiate a CDR.

16.6. Invoices

The contractor shall submit invoices monthly to Wide Area Work Flow (WAWF) with sufficient documentation to provide certification of invoice.

The contractor is responsible for properly preparing and forwarding to the appropriate Government official, the invoice and receiving report for payment. The contractor shall attach back up information to receiving reports for direct labor and Other Direct Costs (ODCs). Direct labor backup information shall reflect the person’s name, job title and quantity of hours worked for each pay period at a minimum. Backup information for ODCs shall list all elements of costs, such as travel breakout backup, including itinerary, dates of travel, name of employees traveling plus per diem costs shall accompany the receiving report. All ODCs exceeding $3,000 requires that the contractor conduct appropriate competition and obtain approval from the COR prior to purchase. Equipment purchases are not authorized under this contract. The Wide Area Workflow – Receipt and Acceptance application is the required method of submission.

Where applicable, contractor will include additional ODC invoice details as required per protocol for any volunteer payments in support of this PWS.

16.7. Dissemination of Information/Publishing – Not Applicable

16.8. Contractor Identification

When contractor personnel perform the services required in this contract on a Government installation they are required to possess and wear an identification badge that displays his or her name and the name of the Company. The contractor shall ensure that contractor personnel identify themselves as contractors when attending meetings, answering Government telephones, providing any type of written correspondence, or working in situations where their actions could be construed as official Government acts.

While performing in a contractor capacity, contractor personnel shall refrain from using their retired or reserve component military rank or title in all written or verbal communications.

16.9. Attendance at Meetings

Contractor personnel may be required to attend meetings or otherwise communicate with Government and/or other contract or assistance agreement representatives to meet the requirements of this order. Contractor personnel shall make their contractor status known during introductions.

16.10. Data Rights – Not Applicable

16.11. Anti-Terrorism and Operational Security

16.11.1. AT Level I Training. (Deliverable 10)

All contractor employees, including subcontractor employees, requiring access to Army installations, facilities, and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable.

DFARS 204.7202 Contractor personnel who, as a condition of contract performance, require routine physical access to a Federally-controlled facility or military installation are required to complete Level I antiterrorism awareness training within 30 days of access and annually thereafter.

Include the clause at DFARS 252.204-7004 DoD Antiterrorism Awareness Training for Contractors, in solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial items, when contractor personnel require routine physical access to a Federally-controlled facility or military installation.

The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website: http://jko.jten.mil.

16.11.2. Installation Access

Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of Emergency Services, or Security Office.

Contractor workforce must comply with all personal identity verification requirements (CFR clause 52.204- 9, Personal Identity Verification of Contract Personnel) as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force http://jko.jten.mil/

Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

a) For contractors requiring CAC. Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

b) For contractors that do not require CAC, but require access to a DoD facility or installation. Contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (Army Directive 2014-05/AR 190-13); applicable installation, facility and area commander installation and facility access and local security policies and procedures (provided by Government representative); or, at OCONUS locations, in accordance with status-of-forces agreements and other theater regulations.

16.11.3. AT Awareness Training for Contractor Personnel Traveling Overseas – Not applicable

16.11.4. iWATCH Training. This standard language is for contractor employees with an area of performance within an Army-controlled installation, facility, or area The contractor and all associated subcontractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance, with the results reported to the COR NLT 30 calendar days after contract award.

16.11.5. Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to Government information systems All contractor employees with access to a Government info system must be registered in the ATCTS at commencement of services and must successfully complete the DoD Information Assurance Awareness prior to access to the information system and annually thereafter.

16.11.6. For Contracts That Require an OPSEC Standing Operating program

The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it, and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander. In addition, the contractor shall have an identified certified Level II OPSEC coordinator per AR 530-1.

16.11.7. For Contracts That Require OPSEC Training

Per AR 530-1, Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

16.11.8. For IA/IT training

All contractor employees and associated subcontractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M, and AR 25-2 within six months of appointment to IA/IT functions.

16.11.9. For Information Assurance (IA)/Information Technology (IT) Certification

Per DoD 8570.01-M , DFARS 252.239.7001, and AR 25-2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

16.11.10. For Contractors Authorized to Accompany the Force. – Not applicable

16.11.11. For Contract Requiring Performance or Delivery in a Foreign Country. – Not applicable

16.11.12. For Contracts That Require Handling or Access to Classified Information. – Not applicable

16.11.13. Threat Awareness Reporting Program (TARP) (Deliverable 11) All contractor employees, regardless of whether or not they possess a security clearance, must complete TARP training on an annual basis per USAMRDC command directive, as outlined in USAMRDC Memorandum for Record, Command Guidance for TARP Training Compliance, dated 06 January 2016.

The training can be conducted face-to-face in a classroom setting or on-line. The supported military organization will coordinate all face-to-face training. Personnel may access the on-line training via the ALMS website under the course name, U.S. Army Threat Awareness and Reporting Program (TARP) Course. This training shall be completed within 60 calendar days after the contract award or after new employees commence performance, and annually thereafter.

16.12. Information Security Program Training (Deliverable 12)

The Information Security Program (ISP) Training Certification meets an Army mandatory annual training requirement for this subject. This Certification is the consolidation of the training topics previously provided in the Security Training - Initial Security Orientation and Security Training - Annual Security Refresher Training courses. The contractor shall ensure all service providers receive ISP training not later than 30 calendar days after contractor personnel begin performance under this contract and annually thereafter.

Training can be found at - https://www.lms.army.mil/

16.13. System Security Plan and Associated Plans of Action – Not applicable

16.14. Identification, Tracking, and Restricted Flow Down of all Covered Defense Information, and for Requesting the Contractor’s Record of Tier 1 Level Subcontractors, Vendors, and/or Suppliers who Receive or Develop Covered Defense Information – Not applicable

16.15. Compliance with Relevant DoD, Service, and Institutional Policy Regulations. – Not applicable

16.16. Personally Identifiable Information (PII) and Protected Health Information (PHI) – Not applicable

16.17. Public Key Infrastructure Authentication and Encryption Contractors shall follow the DoD standards, policies, and procedures related to the use of Public Key Infrastructure (PKI) certificates and biometrics for positive authentication including authentication to DoD private web servers or applications. Where interoperable PKI is required for the exchange of unclassified information, including the encryption of e-mail containing sensitive information, between DoD and its Contractors, industry partners shall obtain all necessary certificates if they are not eligible for a DoD Common Access Card. (refer to: http://iase.disa.mil/pki/eca/ and http://www.cac.mil/)

16.18. Network Security

Contractor personnel requiring access to DoD networks to perform work under this contract must have a NACI or an open, pending investigation prior to commencement of work. If the Contractor has a pending investigation, the contractor must present a copy of this investigation to the WRAIR Security Manager at the time of in-processing for review and must contain no unfavorable information. The Contractor must maintain this level of security for the life of the contract. Citizenship will be verified by presenting an original birth https://www.lms.army.mil/ certificate or a valid US Passport or the original Naturalization certificate to the WRAIR Personnel Security Manager at the time of in-processing for all contractor personnel assigned to the contract.

Contractor personnel shall use only Government-provided computer equipment; and shall follow all applicable statutes, regulations and policies governing DoD, MEDCOM, USAMRDC, and WRAIR cyber security and information system assets. Personnel must provide proof of applicable training and certifications to include annual Cyber Awareness training. This training must be documented in the Army Training and Certification Tracking System (ATCTS) unless otherwise authorized by applicable policies. DoD Information System, IT service, and IT product acquisition or development must also adhere to applicable policies as described below:

16.18.1. It is DoD policy that Cybersecurity requirements shall be identified and included in the design, acquisition, installation, operation, upgrade, or replacement of all DoD information systems. This includes systems and processes developed within the Defense Acquisition System; systems and processes developed at private expense; outsourced business processes supported by private sector information systems; and outsourced information technologies. Information technology services provided under this contract must comply with statutory and regulatory IA policy. The source documents for this policy are (available in the WRAIR regulatory repository for review):

a. The National Security Act of 1947

b. Title 40/Clinger-Cohen Act

c. Executive Order 12333, “United States Intelligence Activities,”

d. National Security Presidential Directive-54/Homeland Security Presidential Directive-23

e. Subchapter III of chapter 35 of Title 44, United States Code (also known as the “Federal

Information Security Management Act (FISMA) of 2002”)

f. National Security Telecommunications and Information Systems Security Policy No. 11, "Revised Fact Sheet National Information Assurance Acquisition Policy" and associated "Frequently Asked Questions"

g. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-39

h. Federal Information Processing Standards

i. DoD Instruction 8500.01, “Cybersecurity,” March 13, 2014

j. DoD Instruction 8500.2, "Information Assurance Implementation"

k. DoD Instruction 8580.1, "Information Assurance in the Defense Acquisition System"

l. DoD Instruction 5000.02, “Operation of the Defense Acquisition System,”

m. DoD Directive 8570.01, "Information Assurance Training, Certification, and Workforce

Management"

n. Chairman of the Joint Chief of Staff Instruction 6510.01E, "Information Assurance (IA) and

Computer Network Defense (CND)"

o. Defense Acquisition Guidebook – Chapter 7 Acquiring Information Technology and

National Security Systems, Section 7.5 Information Assurance

p. DoD Instruction 8510.01, "Risk Management Framework (RMF) for DoD Information

Technologies"

16.18.2. Each proposal under this contract, will be screened for compliance with applicable Cybersecurity statutes, policies, and procedures. Specific requirements will be stated in the performance work statement/statement of objectives. This special contract provision shall be updated by reference for any changes to source documents. Any new laws or policies applicable to Cybersecurity subsequent to issuance of this contract will be incorporated into the basic contract unilaterally without equitable adjustment to the basic contract. Any equitable adjustment shall be assessed by individual contracts that may be affected by the change as applicable.

16.18.3. Non-US citizens are not being adjudicated for WRAIR trustworthiness determinations at this time.

Non-US Citizens are not allowed access to DoD IT systems unless approved by an authority designated in Appendix 6, DoD 5200.2-R. Only US citizens shall be granted access and assigned to sensitive duties. Exceptions to these requirements shall be permitted only for compelling national security reasons (DoD 5200.2-R. C2.1.1, AP6.6.1).

16.19. Workplace Safety

The contractor employee must be able to maintain a safe workplace and comply with occupational health and safety rules and regulations. Contractor employees are required to attend safety training(s) relative to his/her position and report any infractions of safety procedures to the COR immediately.

The Contractor will be required to ensure compliance with Occupational Health physicals or vaccinations in support of the PWS. These shall be documented and charged as an ODC.

The contractor shall maintain an OSHA 300a log for all reportables (greater than first aid, lost time, lost days, transfer). The contractor shall provide a quarterly report of all mishaps, regardless of class or reportability.

Annually, the contractor shall provide a 300A (summary) report to the COR and KO.