CCRI PWS.doc

Ver. June 2021

PERFORMANCE WORK STATEMENT (PWS) FOR

Command Cyber Readiness Inspection Preparation Services

General:

Scope: The contractor shall provide all personnel, equipment, tools, materials, supervision, and quality control necessary, except as specified in Paragraph 3.0 as Government Furnished, to perform Command Cyber Readiness Inspection Preparation Services, as defined in this PWS.

The contractor will provide a 5 person CCRI SAV Team for 8 working days during Tuesday – Friday from 5-16 September 2022 for the SAV Team inspection and the support shall start 1 September 2022 – 31 August 2023 for the remote support and training. The contractor will be onsite to complete on a Firm Fixed Priced contract including travel costs. After the completion of the CCRI SAVs there is a requirement for ongoing remote support for 120 hours for any technology area (1.1.2) within the CCRI services and 80hrs of remote training on Microsoft SQL Server (Database + Instance). The remote support and training will occur on a regular schedule for the period of performance of the base year.

ENVIRONMENT. The LA ARNG environment is a NIPR network. A sample of technologies that require review are:

2 Background: Provide the LA ARNG with CCRI certified Reviewers across several technologies to include web and database, HBSS, ACAS, Network Infrastructure and Traditional/Physical Security. Conduct hands-on training with staff to ensure complete knowledge transfer. Provide grading results in accordance with CCRI Phase IV formulas currently used by DISA CCRI Teams. Provide Risk Assessment grading results in accordance with CCRI Risk Indicator formulas currently used by DISA CCRI Teams. Provide documented recommendations for a “Path to Success”.

Period of Performance (PoP): The Period of Performance shall be 8 Working days during Tuesday – Friday from 5-16 September 2022 for the SAV Team inspection and the support shall start 1 September 2022 – 31 August 2023 for the remote support and training.

General Information:

Place and Performance of Services: Louisiana National Guard J6 is requesting services from 5-16 September 2022 total of 80 Hrs. of service for the SAV Team inspection and the support shall start 1 September 2022 – 31 August 2023 for the remote support and training. .The contractor shall provide services between the hours of 0700-1730 on Tuesday – Friday, except on recognized US holidays or when the Government facility/installation is closed due to local or national emergencies, administrative closings, or similar Government-directed facility/installation closings. Performance shall be at Camp Beauregard Pineville Louisiana Building 420 & 496. The contractor shall at all times maintain an adequate work force for the uninterrupted performance of all tasks defined within this PWS when the Government facility/installation is not closed for the above reasons. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the work force are essential. Teleworking in not authorized for the SAV Team inspection.

Telework: The Government does not permit the contractor to telework in support of this requirement. In furtherance of Continuity of Operations Planning (COOP), a telework program may be enacted to ensure that the Government's mission-critical operations stay operational during times of national emergency or incidents of national significance. Telework shall be at no additional cost to the Government.

Unscheduled gate closures by the Security Police may occur at any time causing all personnel entering or exiting a closed installation to experience a delay. This cannot be predicted or prevented. Contractors are not compensated for unexpected closures or delays. Vehicles operated by contractor personnel are subject to search pursuant to applicable regulations. Any moving violation of any applicable motor vehicle regulation may result in the termination of the contractor employee’s installation driving privileges.

The contractor’s employees shall become familiar with and obey the regulations of the installation; including fire, traffic, safety and security regulations while on the installation. Contractor employees should only enter restricted areas when required to do so and only upon prior approval. All contractor employees shall carry proper identification with them at all times, and shall be subject to such checks as may be deemed necessary. The contractor shall ensure compliance with all regulations and orders of the installation, which may affect performance. The Government reserves the right to direct the removal of an employee from Government property or revoke access to Government systems for misconduct, security reasons, or any overt evidence of communicable disease. Removal of contractor employees for reasons stated above does not relieve the Contractor from responsibility for total performance of this contract.

Recognized Holidays: The request for services dates do not fall within a holiday.

Quality Control (QC): The contractor shall develop and maintain an effective QC Plan (QCP) to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non- recurrence of defective services. The contractor’s QCP is the means by which it assures itself that its work complies with the requirements of the contract. As a minimum, the contractor shall develop QC procedures that address the areas identified in Technical Exhibit 1, Performance Requirements Summary (PRS). Provide the LA ARNG with CCRI certified Reviewers across several technologies to include web and database, HBSS, ACAS, Network Infrastructure and Traditional/Physical Security. A final QCP shall be submitted to the Contracting Officer Representative (COR) NLT 10 days after contract award. After acceptance of the QCP, the contractor shall obtain the Contracting Officer’s (KO’s) acceptance in writing of any proposed changes to its QCP.

Quality Assurance (QA): The Government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government will do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and acceptable quality level(s) or defect rate(s).

Installation Access and Security Requirements. The contractor shall comply with all applicable installation/facility access and local security policies and procedures, which may be obtained from the COR. The contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services, or Security Office. The contractor shall ensure compliance with all personal identity verification requirements as directed by Department of Defense (DoD), Headquarters Department of Army (HQDA) and/or local policy (see PWS 6.0). Should the Force Protection Condition (FPCON) change, the Government may require changes in contractor security matters or processes.

The contractor shall obtain base identification and vehicle passes, if required, for all contractor personnel who make frequent visits to or perform work on the Air Force installation(s) cited in the contract. Contractor personnel are required to wear or prominently display installation identification badges or contractor- furnished, contractor identification badges while visiting or performing work on the installation.

The contractor shall submit a written request on company letterhead to the contracting officer listing the following: contract number, location of work site, start and stop dates, and names of employees and subcontractor employees needing access to the base. The letter will also specify the individual(s) authorized to sign for a request for base identification credentials or vehicle passes. The contracting officer will endorse the request and forward it to the issuing base pass and registration office or Security Forces for processing. When reporting to the registration office, the authorized contractor individual(s) should provide a valid driver s license, current vehicle registration, valid vehicle insurance certificate, and [insert any additional requirements to comply with local security procedures] to obtain a vehicle pass.

During performance of the contract, the contractor shall be responsible for obtaining required identification for newly assigned personnel and for prompt return of credentials and vehicle passes for any employee who no longer requires access to the work site.

When work under this contract requires unescorted entry to controlled or restricted areas, the contractor shall comply with AFI 31-101, Integrated Defense, and DODMAN5200.02_AFMAN 16-1405.

Upon completion or termination of the contract or expiration of the identification passes, the prime contractor shall ensure that all base identification passes issued to employees and subcontractor employees are returned to the issuing office.

Failure to comply with these requirements may result in withholding of final payment.

Contractors requiring Common Access Card (CAC): The CAC is the DoD Federal Personal Identity Verification (PIV) credential. Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated Tier 1 or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) physical access to multiple DoD facilities or multiple nonDoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled Tier 1 investigation at the Office of Personnel Management. Sponsorship and enrollment information about each applicant must be registered in the Defense Enrollment Eligibility Reporting System (DEERS) through either the Real-Time Automated Personnel ID System (RAPIDS) using the DD Form 1172-2 or the Trusted Associate Sponsorship System (TASS).

Homeland Security Presidential Directive (HSPD)-12 Background Investigation Requirements: The contractor shall ensure that all contractor and subcontractor personnel whose duties require CAC card issuance obtain them, and shall process all CAC card applications. The contractor shall ensure that all employees requiring an initial background investigation complete a Personnel Security Investigation Portal (PSIP) form at Attachment “TBD”, at the earliest possible date and that this form is forwarded to the COR immediately. The COR will review the form for completeness and accuracy and forward it to the National Guard Bureau (NGB) Personnel Security manager who will initiate the investigation process via the PSIP. Contractor personnel will then receive two e-mail messages; the first will confirm that the investigative service provider has received the request, and the second will provide instructions for the completion of the appropriate form via the Electronic Questionnaires for Investigations Processing (e-QIP) system. Upon completion of the e-QIP questionnaire and submittal of all required documents, including fingerprint card to the security manager, the background investigation (BI) will be initiated. The contractor shall ensure immediate compliance with all instructions regarding background investigation processing, including those provided verbally, by e-mail or via a Government system. The contractor is cautioned that the entire process from submittal of the PSIP form to return of the FBI fingerprint check may routinely take from two to six weeks and shall factor this lead time into its hiring/placement process. The contractor shall make all reasonable efforts to ensure that contractor employees meet CAC eligibility standards upon assignment to the contract and shall be held responsible for delays, failure to meet performance requirements or decreases in efficiency in accordance with the applicable inspection clause.

Trusted Associate Sponsorship System (TASS): The contractor shall process CAC applications through the TASS, the procedures for which are described below.

Although there is no requirement for the contractor to designate a “Corporate Facility Security Officer" (FSO) to serve as its single point of contact for the BI, the TASS application process and other CAC and security-related matters, such designation facilitates these processes. If a Corporate FSO is not established, all contractor employees requiring a CAC will be required to process their own applications. The submission process for CAC applications is as follows:

The contractor's FSO or contractor employee shall submit requests for a CAC via email to the designated TASS Trusted Agent (TA). The TASS TA for this requirement will be “TBD”.

The Government will establish a TASS application account for each CAC Request and will provide each contractor employee a user ID and password, via email, to the contractor’s FSO or contractor employee. The FSO or contractor employee shall access the TASS account and complete the CAC application (entering/editing contractor information as applicable) at: https://tass.dmdc.osd.mil/tass/. The contractor’s FSO or contractor employee shall follow up to ensure that the TA is processing the request.

The Government will inform the contractor's applicant, via email, of one of the following:

Approval.* upon approval, the information is transferred to the DEERS database and an email notification is sent to the contractor with instructions on obtaining their CAC. The contractor proceeds to a RAPIDS station (RAPIDS Site Locator: http://www.dmdc.osd.mil/rsl/).

Rejection.* The Government, in separate correspondence, will provide reason(s) for rejection.

Return. Additional information or correction to the application required by the contractor employee.

*The contractor shall maintain records of all approved and rejected applications.

Contractor personnel shall obtain a CAC from the nearest Real Time Automated Personnel Identification Documentation System (RAPIDS) Issuing Facility (typically the local Military Personnel Flight (MPF)). At the RAPIDS station, the RAPIDS Verification Officer will verify the contractor employee by Social Security Number (SSN) and two forms of identification. Identity source documents must come from the list of acceptable documents included in Form I-9, OMB No. 1615-0047, "Employment

Eligibility Verification". Consistent with applicable law, at least one document from the Form I-9 list shall be a valid (unexpired) State or Federal Government-issued picture ID. The Identity documents will be inspected for authenticity and scanned and stored in the DEERS upon issuance of an ID. The photo ID requirement cannot be waived, consistent with applicable statutory requirements. The Verification Officer will capture primary and alternate fingerprints, picture, and updates to DEERS, and will then issue a CAC. Issued CACs will be valid for no longer than three years, or until the individual's contract end date (inclusive of any options), whichever is earlier.

The contractor shall manage requests for new or renewal CAC cards in sufficient time to ensure that all contractor employees have them when needed to perform work under this contract. The contractor shall provide at least 10 calendar days advance notice to the TA, unless there are extenuating circumstances approved by the COR or KO.

The contractor shall return issued CACs to the DEERS office upon departure or dismissal of each contractor employee, and shall obtain a receipt for each card and provide it to the TA/COR.

Failure to comply with these requirements may result in withholding of final payment.

Awareness Training (AT) Level 1: All contractor employees, including subcontractor employees, requiring access to Army installations, facilities, and controlled access areas shall complete AT Level 1 training within 30 calendar days after contract start date and within 30 calendar days of new employees commencing performance. The contractor shall submit certificates of completion for each affected contractor and subcontractor employee to the COR within 15 calendar days after completion of training by each employee or subcontractor personnel. AT Level 1 awareness training is available at the following website: https://jko.jten.mil/courses/atl1/launch.html.

Use of Government Information Systems (IS) and access to Government networks is a revocable privilege, not a right. Users are the foundation of the DoD strategy and their actions affect the most vulnerable portion of the Army Enterprise Info structure (AEI). Contractor employees shall have a favorable background investigation or hold a security clearance and access approvals commensurate with the level of information processed or available on the system. Contractor employees shall:

Comply with the command's Acceptable Use Policy (AUP) for Government owned IS and sign an AUP prior to or upon account activation.

Complete initial and/or annual Information Assurance (IA) training as defined in the IA Best Business Practices (BBP) training (https://atc.us.army.mil/iastar/docs/Training_BBP.pdf).

Mark and safeguard files, output products, and storage media per classification level and disseminate them only to individuals authorized to receive them with a valid need to know.

Protect IS and IS peripherals located in their respective areas in accordance with physical security and data protection requirements.

Practice safe network and Internet operating principles and take no actions that threaten the integrity of the system or network.

Information Assurance (IA)/Information Technology (IT) certification. All contractor employees performing services involving IA/IT functions shall comply with DoD and Army workforce training requirements in DoDD 8140.01, DoD 8570.01-M and AR 25-2 within six months of the start of contract performance or appointment to IA/IT functions. In accordance with DoD 8570.01-M, DFARS 252.239.7001, and AR 25-2, contractor employees supporting or performing IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M shall be completed upon contract award.

Protection of Personally Identifiable Information (PII). The contractor shall protect all PII encountered in the performance of services in accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 224.103 Personally Identifiable Information and Department of Defense Directive (DoDD) 5400.11, Department of Defense Privacy Program, and DoD 5400.11-R. If a PII breach results from the contractor’s violation of the aforementioned policies, the contractor shall bear all notification costs, call-center support costs, and credit monitoring service costs for all individuals whose PII has been compromised.

OPSEC Training: In accordance with AR 530-1, Operations Security, new contractor employees shall complete Level I OPSEC training within 30 calendar days of their reporting for duty and annually thereafter. The contractor shall submit certificates of completion for each contractor employee to the COR within 15 calendar days after completion of training. Level 1 OPSEC training is available at. https://securityawareness.usalearning.gov/opsec/index.htm.

Threat Awareness and Reporting Program (TARP). Per AR 381-12, Threat Awareness and Reporting Program (TARP), contractor employees with security clearances must receive annual TARP training by a counterintelligence (CI) agent or other trainer as specified in Chapter 2 Threat Awareness and Education, Section II, paragraph 2-4b. The contractor shall identify annual TARP training, personnel trained, and date of training within 15 days of training completion.

Physical Security. The contractor shall safeguard all Government property provided for contractor use. At the close of each work period, Government facilities, equipment and materials shall be secured.

Key Control NOTE: All references to keys include key cards. The contractor shall establish and implement methods of ensuring that no keys/key cards issued by the Government are lost or misplaced or are used by unauthorized persons. No keys issued by the Government shall be duplicated. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas..

The contractor shall immediately report any occurrences of lost or duplicated keys/key cards to the COR.

In the event keys, other than master keys, are lost or duplicated, the contractor shall, upon direction by the KO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re- keying. When the Government replaces or re-keys the locks, the Government will deduct the total cost of lock replacement or re-keying from the monthly payment due the contractor. In the event a master key is lost or duplicated, the Government will replace all locks and keys for that system, and will deduct the total cost from the monthly payment due the contractor.

The contactor shall prohibit the use of the Government issued keys/key cards by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contactor employees engaged in the performance of services in those areas, or personnel authorized entrance by the KO.

Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the KO in accordance with FAR 42.5. The KO, COR and other Government personnel, as appropriate, may meet periodically with the contractor to review the contactor’s performance. At these meetings, the KO will apprise the contractor of how the Government views the contractor’s performance and the contractor shall apprise the Government of problems, if any, being experienced. The contractor shall resolve outstanding issues raised by the Government. Contractor attendance at these meetings shall be at no additional cost to the Government.

Contract Manager (CM): The contactor shall designate a CM who shall ensure performance under this contract. The name of this person, and an alternate who shall act for the contractor when the CM is absent, shall be designated in writing to the KO. The CM or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The CM shall work through the COR, to resolve issues, receive technical instructions, and ensure adequate performance of services. The CM shall ensure that contractor employees do not perform any services outside the scope of the contract without an official modification issued by the KO. The CM shall ensure contractor employees understand that services performed outside the scope of the contract are performed wholly at the expense of the contractor.

Identification of Contractor Employees: All contractor personnel attending meetings, answering Government telephones and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression that they are Government employees. The contractor shall ensure that all documents or reports produced by contractor personnel are suitably marked as contractor products or that contractor participation is appropriately disclosed. The contractor’s status as a “contractor” shall be predominantly displayed in all correspondence types (to include signature blocks on e- mail) and dealings with Government or non-Government entities. Contractor personnel shall wear identification badges distinguishing themselves as such. The badges shall have the company name, employee name and the word “contractor” displayed.

The contractor shall retrieve all identification media (including vehicle passes) from its employees who depart employment for any reason. The contractor shall return all identification media (i.e., badges and vehicles passes) to the KO within 14 days of an employee’s departure.

1.4.11. Combating Trafficking in Persons: The United States Government has adopted a zero tolerance policy regarding trafficking in persons. Contractors and contractor employees shall not engage in severe forms of trafficking in persons during the period of performance of the contract; procure commercial sex acts during the period of performance of the contract; or use forced labor in the performance of the contract. The Contractor shall notify its employees of the United States Government’s zero tolerance policy, the actions that will be taken against employees for violations of this policy. The contractor shall take appropriate action, up to and including termination, against employees or subcontractors that violate the US Government policy as described at FAR 22.17.

Contractor Travel will be provided by the Contractor.

Data Rights: The Government has unlimited rights to all documents/materials produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the KO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

Organizational Conflicts of Interest (OCI): The contractor and subcontractor personnel performing services under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent OCIs, as defined in FAR Subpart 9.5. The contractor shall notify the KO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the KO to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the KO. In the event the KO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may impose other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the OCI.

Definitions and Acronyms:

Definitions:

Contractor: A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Key Personnel: Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

Physical Security: Actions that prevent the loss or damage of Government property.

Quality Assurance: The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

Quality Control: All necessary measures taken by the Contractor to ensure that the quality of an end product or service shall meet contract requirements.

Subcontractor: One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

Acronyms

Government Furnished Property, Material, Equipment and Services (GFP/M/E/S): The Government will provide the property, material, equipment, and/or services listed below solely for the purpose of performance under this contract:

Property: The Government will furnish the necessary workspace for the contractor to perform services outlined in this PWS to include desk space, telephones, computers and other items necessary to maintain an office environment.

Materials:

Equipment:

Services:

Utilities: All utilities in the facility will be available for the contactor’s use in the performance of this contract. The contractor shall instruct employees in utilities conservation practices. The contractor shall operate under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount.

Contractor Furnished Property, Materials, and Equipment (CFP/M/E):

Contractor Security Clearance: The contractor’s employees performing work in support of this contract shall have been granted a TOP SECRET security clearance from the Defense Industry Security Clearance Office.

If a SECRET or TOP SECRET facility clearance is required or contractor employees are required to have a SECRET or TOP SECRET security clearance, a corresponding DD254 must be provided with the procurement package to be attached to the solicitation.

5.0 Requirements: The contractor shall:

5.1 Special Qualifications: The contractor shall ensure all employees possess all required licenses for operating the CCRI Inspection used in the performance of this contract. This does not include education or other qualifications for the position in which the contractor employee is performing, dress codes, or other information. (NOTE: The Government does not provide training to contractors. Contractors must ensure that any personnel performing under a contract are fully trained, licensed, certified, and otherwise qualified to provide services. Louisiana National Guard is requesting a 5 person team that is CCRI certified Reviewers to help in the preparation of our upcoming CCRI inspection.

Past Performance Requirements:

Prime vendors need to reference up to three examples demonstrating five (5) years of experience within the last ten years supporting DoD CCRIs and CCRIs SAVS. Please demonstrate 20 completed CCRI SAVs with a subset of seven (7) for the National Guard in the past five (5) years. Please include contract information (title and period of performance) and agency supported.

Provide at least seven (7) examples of assisting ARNG state(s) get 80s or above for their Official CCRI preferred.

Experience and working knowledge of the LA ARNG networking environment preferred.

The Contractor shall report the required information annually by October 31, for services performed under this contract during the preceding Government fiscal year (October 1- September 30).

The DoD Guidebook for Service Contract Reporting in SAM, available on the DoD Procurement Toolbox at https://dodprocurementtoolbox.com/site-pages/service- contract-reporting-scr. The General Services Administration (GSA) has also posted additional guidance such as quick start guides, informational videos, and frequently asked questions, that can be accessed by going to https://sam.gov and searching the “HELP” section. The SAM Federal User Guide is also available in the “HELP” section for comprehensive instructions on navigating SAM. Contractors requiring assistance using SAM should contact the Federal Service Desk at https://www.fsd.gov.

6.0 Applicable Publications: Publications applicable to this PWS are listed below:

Publication (Chapter/Page) Date of Publication Mandatory or Advisory Website Federal Acquisition Regulation https://www.acquisition.gov/?q=browsefar Defense Federal Acquisition Regulation Supplement http://www.acq.osd.mil/dpap/dars/dfarspgi/current/in dex.html or https://www.acquisition.gov/dfars Joint Travel Regulation (JTR) https://www.defensetravel.dod.mil/site/travelreg.cfm DoDM 1000.13-M-V1 DoD Identification (ID) Cards (Enclosure 2, paragraph 3.b) 01/23/2014 (Change 1: 07/28/2020) http://www.esd.whs.mil/Directives/issuances/dodm Federal Information Processing Standards (FIPS) Publication 201-2 Personal Identity Verification (PIV) of Federal Employees and Contractors (paragraph 9) August 2013 http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201 -2.pdf DoDM 5200.2 Procedures for the DoD Personnel Security Program

(PSP)

04/03/2017 https://www.esd.whs.mil/Directives/issuances/dodm/ DoDI 5200.46 DoD Investigative and Adjudicative Guidance for Issuing the Common Access Card (CAC) 09/09/14 (Change 1: 05/04/2018) https://www.esd.whs.mil/Directives/issuances/dodi/ Homeland Security Presidential Directive (HSPD)-12 Policy for a Common Identification Standard for Federal Employees and Contractors 08/27/2004 https://www.dhs.gov/homeland-security-presidential- directive-12 DoDI 5400.11 Department of Defense Privacy and Civil Liberties Programs 01/29/2019 https://www.esd.whs.mil/Directives/issuances/dodi/ DoD 5400.11-R Department of Defense Privacy Program 05/14/2007 https://www.esd.whs.mil/Directives/issuances/dodm/ DoDD 8140.01 Cyberspace Workforce Management

10/05/2020 https://www.esd.whs.mil/Directives/issuances/dodd/ DoD 8570.01-M Information Assurance Workforce Improvement Program 12/19/2005 (Change 4: 11/10/2015) https://www.esd.whs.mil/Directives/issuances/dodm/ DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM) 02/28/2006 (Change 2: 05/18/2016) https://www.esd.whs.mil/Directives/issuances/dodm/ Army Directive 2014-05 Policy and Implementation Procedures for Common Access Card Credentialing and Installation Access for Uncleared Contractors 03/07/2014 https://armypubs.army.mil/ProductMaps/PubForm/A rmyDir.aspx

AR 25-2

Information Assurance 04/04/2019 http://armypubs.army.mil/ProductMaps/PubForm/AR .aspx

AR 530-1

Operations Security 09/26/2014 http://armypubs.army.mil/ProductMaps/PubForm/AR .aspx

AR 525-13

Antiterrorism 12/09/2019 http://armypubs.army.mil/ProductMaps/PubForm/AR .aspx

AR 381-12

Threat Awareness and Reporting Program (TARP) (Section II, ¶ 2-4.b) 06/01/2016 http://armypubs.army.mil/ProductMaps/PubForm/AR .aspx

6.1 Applicable Forms: Forms applicable to the PWS are listed below:

Form Date Website

DD 1172-2

Application for Identification Card/DEERS Enrollment Mar 2017 http://www.dtic.mil/whs/directives/forms/index.htm I-9 Employment Eligibility Verification 10/21/2019 https://www.uscis.gov/sites/default/files/files/form/i-9.pdf

DD 441

Department of Defense Security Agreement Feb 2020 http://www.dtic.mil/whs/directives/forms/dd/ddforms0001- 0499.htm

DD 250

Material Inspection and Receiving Report Aug 2000 https://www.esd.whs.mil/Directives/forms/dd0001_0499/

TECHNICAL EXHIBIT 1

Performance Requirements Summary (PRS)

This PRS includes performance objectives the Government will use to determine contractor performance and will compare contractor performance to the Acceptable Quality Level (AQL).

Performance Objective Performance Standard Acceptable Quality Levels (AQL) Surveillance Method / By Whom Provide the LA ARNG with CCRI certified Reviewers as detailed in 5.1.

Provide grading results in accordance with CCRI Phase IV formulas.

Contractor will Provide Daily Hot Washes and Out-Brief to LA ARNG Staff All CAT 1 and CAT 2 findings are identified and a plan for their mitigation is provided. Identified from this internal inspection. A minimum of 75% of the plan must be submitted to LA ARNG within the 15 days of inspection The 5 Man Team will be paired with our Staff to identify the areas of great importance to achieve a passing score from the upcoming DISA CCRI inspection FY23 Provide the LAANG USPFO DPI with SMEs for 120hrs of remote support as detailed in 1.1.1

Provide 120hrs of remote support during the period of performance

Contractor will provide certified Technician listed under 1.1.2

COR

Provide LA ARNG with 80hrs of remote training on Microsoft SQL Server (Database + Instance) as detailed in 5.1

Remote training to assist LA ARNG in setup and STIG requirements on SQL SME listed in 1.1.2

Contractor will provide 80hrs of training on Microsoft SQL Server (Database + Instance) and support during the period of performance

COR

TECHNICAL EXHIBIT 2

Deliverables Schedule

PWS Reference / Deliverable Title Frequency Number of Copies Medium/Format Submit To

Daily Hot Washes and Out- Brief to LA ARNG

Documents

COR

1.2.2 Conduct hands- on training with staff

to ensure complete knowledge transfer

Week 1&2

1.2.2 Provide grading results in accordance with CCRI Phase IV formulas currently used by DISA CCRI Teams

Week 2

Hard Copy

COR

1.2.2 Provide Risk Assessment grading results in accordance

with CCRI Risk Indicator formulas currently used by DISA CCRI Teams

Week 2

Hard Copy

COR

1.2.2 Provide documented recommendations for a “Path to Success”

Week 2

Hard Copy

COR

1.1.1 ongoing remote support for remote support will occur on a regular schedule for the period of performance of the base year

120 hrs. counted in 30min increments

Remote training

120 hours for any technology area

1.1.1 Provide LA

ARNG with 80hrs of Remote training support 80 hrs.

Remote training

COR

remote training on will occur on a regular counted in

Microsoft SQL Server schedule for the period of 30min

(Database + Instance) performance of the base increments year