CPOC Technical Exhibits A - N - DRAFT - CPO 14 June_(CUI).pdf

CUI

PRE-DECISIONAL

CUI

PRE-DECISIONAL

Defense Counterintelligence and Security Agency Case Processing Operations Center

Contract No. XXXXX

Technical Exhibits A-N

Table of Contents

A Background Investigation Information Technology Requirements B Background Investigation Training Requirements C Background Investigation Security Requirements D Background Investigation Billing Requirements E Requirements for the Protection of Personally Identifiable Information F Units of Work (UOW) Table G Performance Requirements Summary H Deliverables Schedule J Inspection Parameters K Firm-Fixed-Unit-Price Background Investigation Product Table L Required Contractor Training

M

CDRL 1 – Ramp-Up Timeline and Strategy CDRL 2 – Onsite Supervisors Report CDRL 3 – Processes and Procedures Manual CDRL 4 – Workload Capacity Plan CDRL 5 – Staffing Plan CDRL 6 – Training Plan, Schedule and Material CDRL 7 – Quality Control Plan CDRL 8 – Code of Business Ethics and Conduct CDRL 9 – Monthly Meeting, Agenda, and Notes CDRL 10 – Quarterly Reports/Meetings CDRL 11 – Phase-Out Transition Plan CDRL 12 – System Authorization Access Request CDRL 13 – Work Reports

N Wage Determination

Controlled by: DCSA Controlled by: FIRE CUI Category: CONTRACT Limited Dissemination Controls: FEDCON POC: mary.e.price79.civ@mail.mil mailto:mary.e.price79.civ@mail.mil

Technical Exhibit A. Background Investigation Information Technology Requirements

This document has been prepared to detail the IT requirements for contracts awarded by DCSA. It has been developed with the entirety of the IT community in mind, including, and most prominently, the IT security and privacy communities.

DCSA is committed to the protection and security of all Federal information under its control. This includes all information that is received, generated, processed, transmitted, or stored through, or by, any system operating in support of an official DCSA mission. The requirements apply to all Contractors with authorized access to Federal information or information systems owned or operated by or for the agency.

1. APPLICABILITY

1.1. This document applies to the Contractor, its subcontractors and teaming partners, and employees (hereafter referred to collectively as “Contractor”).

1.2. These requirements, including all of the references listed are applicable to all information, regardless of medium, maintained by the Contractor for the performance of this contract.

1.3. These requirements are in addition to all applicable requirements established by 5 United States Code (U.S.C.) 552a; and to all other requirements established by various Federal statutes, mandates, and Executive Orders for the management and security of Information and Information Systems. The following additional requirements should not be construed to alter or diminish civil and/or criminal liabilities provided under 5 U.S.C. 552a or any other applicable Federal statutes.

2. AUTHORIZATION TO HANDLE DCSA ELECTRONIC DATA

2.1. Prior to receiving, collecting, transmitting, processing, storing, using, accessing, sharing, or removing DCSA data from any approved locations; the Contractor must receive approval in writing through the DCSA Risk Management Framework (RMF) process, as described in DoDI 8510.01 and DCSA Assessment and Authorization Process Manual (DAAPM), from the Chief Information Security Officer (CISO) and/or Authorizing Official (AO). Contractors are to ensure their major IT systems and capabilities have authorizations in accordance with DoDI 8510.01, DoDI 8582.01, and, when applicable, the DOD Cloud Computing Security Requirements Guide (SRG). Contractors will act as the Program Manager for the RMF process and will need to follow the RMF process accordingly.

2.2. The Contractor and all subcontractor(s) shall comply with all applicable laws, regulations, and DoD instructions such as: Federal Information Modernization Security Act (FISMA) of 2002, DoDI 8500.01, DoDI 8510.01, DODI 4140.67, DoDI 5000.82, DoDI 5200.44, DoDI 5200.48, DoDI 5240.24, DoDI 5000.02, DoDI 8320.04, DODI 8100.04, National Institute of Standards and Technology (NIST) 800-53 Revision 5, 800-171, Committee for National Security Instruction (CNSSI) 1253, DoD Federal Acquisition Regulation Supplement (DFARS) Clauses 252.204-7012, 252.204-7021, 252.239-7017, 252.239-7018, 262.246-7007, 252.246-7008, DFARS Subpart 239.71, 239.76, and Federal Acquisition Regulation (FAR) Clauses 52-204-23, 52.204-24, 52.204-25, and 52.204-26.

2.3. The DCSA RMF guidance and processes for identifying, implementing, assessing and authorizing the operation of the Contractor’s information system can be found in DoDI 8510.01 and DAAPM. Any cross domain actions must receive approval from the CISO and/or AO and must receive proper trusted agent training prior to any data removal or sensitive data transfers.

2.4. If the Contractor should begin to receive, collect, transmit, store, use, access, or share DCSA data without appropriate approval, the Contractor must report this to the CISO and AO, and follow the DCSA Incident Response Plan.

The services provided must meet the DoD guidelines and requirements for the security and protection of DoD information.

Current Version Table:

Document Number Document Title

32 CFR Part 117 National Industrial Security Program Operating Manual (NISPOM)

DoDI 5200.48 Controlled Unclassified Information

32 CFR 2002

National Archives and Records Administration, Controlled Unclassified Information

DoDD 5400.07 DoD Freedom of Information Act (FOIA) Program

DoDI 8500.01, DoDI 8510.01

Cybersecurity, Risk Management Framework for DoD Information Technology

National Institute of Standards and Technology (NIST) Special Publication 800-171 Rev. 2

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

DoDD 5205.02E DoD Operations Security (OPSEC) Program

DoDI 5230.09 Clearance of DoD Information for Public Release

DoDI 5230.29 Security and Policy Review of DoD Information for Public Release

DoDI 5400.04 Provision of Information to Congress

DoDI 8170.01 Online Information Management and Electronic Messaging

CJCSI 6510.01D Information Assurance (IA) and Computer Network Defense (CND)

DOD Instruction 3305.13 DOD Security Education, Training, and Certification

DOD Manual 3305.13 DOD Security Accreditation and Certification

DOD Directive 5400.11 DOD Privacy and Civil Liberties Programs

DOD Manual 5200.01 Information Security Program:

Protection of Classified Information Vol. 3

DOD 8582.01

Security of Non-DOD Information Systems Processing Unclassified Nonpublic DOD Information

NIST SP 800-171

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

48 CFR § 252.204-7012

Safeguarding Covered Defense Information and Cyber Incident Reporting

DODI 8520.02 Public Key Infrastructure (PKI) and Public Key (PK) Enabling

DODI 8530.01 Cybersecurity Activities Support to DOD Information Network Operations

DODI 8170.01 Online Information Management and Electronic Messaging

DFARS 252.204-7021 Cybersecurity Maturity Model Certification

DFARS 252.204-7012

Safeguarding Covered Defense Information and Cyber Incident Reporting

DFARS SUBPART 239.71 SECURITY AND PRIVACY FOR

COMPUTER SYSTEMS

DFARS SUBPART 239.73 REQUIREMENTS FOR INFORMATION

RELATING TO SUPPLY CHAIN RISK

DODI 5200.48 Controlled Unclassified Information (Figure 3)

DOD CC SRG DOD Cloud Computing Security Requirements Guide

Federal Acquisition Regulation (FAR) 52.204-23

Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities

FAR 52.204-24

Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment

FAR 52.204-25

Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

FAR 52.204-26 Covered Telecommunications Equipment or Services-Representation

FISMA Federal Information Security Modernization Act of 2014

3. INFORMATION SYSTEM SECURITY REQUIREMENT

3.1. The activities required by this contract necessitate the Contractor’s access to Government Information, including CUI. Contractors are required to comply with current Federal regulations and guidance found in FISMA Public Law 107-347; 5 U.S.C. 552a; E-Government Act of 2002, Section 208;

National Institute of Standards and Technology (NIST); Federal Information Processing Standards (FIPS); Office of Management and Budget (OMB) Circular A-

130. The Contractor must comply with implementation of required security controls for protection of the Government Information based on the sensitivity of the data within the system as determined through DoDI 8510.01 and DCSA DAAPM.

3.2. The Contractor must implement and maintain an information security program that is compliant with FISMA Public Law 107-347, NIST Special Publication 800-53, OMB guidelines, DCSA security policies, and other applicable laws, throughout the performance of this contract.

3.3. The Contractor’s facilities and IT systems must meet the security requirements for the same security classification or greater as defined by FIPS Publication 199 as required for the protection of Government Information. DCSA will provide written approval of FIPS Publication 199 security categorization.

4. CONTINUOUS MONITORING REPORTING REQUIREMENTS

4.1. The Contractor must comply with the DCSA continuous monitoring (CM) reporting requirements as stated in DoDI 8510.01 and DCSA DAAPM. Contractors will be required to follow the annual CM plan, which provides a monthly security control self-assessment requirement. The assessment results of each of the security controls will be reported monthly, quarterly and annually in respective reports. In addition to the reports, artifacts will also be provided to support the assessment results.

4.2. DCSA may choose to coordinate quarterly site visits with the Contractor in an effort to ensure that the previous quarter’s CM report is complete, accurate, and has all artifacts submitted pertaining to each of the assessed controls.

4.3. Contractors must ensure their documents and policies are available upon request. Contractors must report any and all information security incident (ISI)s involving, or suspected of involving, IT systems and DCSA data within thirty (30) minutes of becoming aware of the ISI, regardless of the time of day or day of the week, and inclusive of Federal holidays and Federal office closures (i.e., the Contractor must report ISIs “24/7/365”). This requirement will take precedent over any Contractor- led internal investigation, evaluation, or confirmation of procedures or activities that occur as a result of the ISI. All ISI will be reported to the CISO and AO in accordance with the DCSA Incident Response Plan.

5. INFORMATION SECURITY INSPECTIONS

5.1. The Contractor must permit and cooperate with the scheduling of onsite and/or offsite information security inspections, which may occur prior to the notice to proceed with work, on a regular recurring basis during performance, following an actual or suspected ISI, or as otherwise deemed necessary by DCSA.

5.2. DCSA will provide the Contractor with a Post-Inspection Report, which will state findings and specify the Contractor’s requirement for remediating findings to maintain compliance with this contract.

5.3. The Contractor must provide a formal response to the DCSA Post-Inspection Report to the CISO and AO within fifteen (15) business days of receipt of the report for critical/high risk findings, and within thirty (30) business days for all other findings.

6. ACCESS TO DCSA IT SYSTEMS

6.1. During the contract ramp-up period, the Contractor must provide an initial and complete list of employee names that require access to DCSA IT systems. This list will be provided at least thirty (30) business days prior to required access. Procedures will be provided at contract award. After the contract ramp-up period, the Contractor must submit individual access requests through procedures provided at contract award.

6.2. The Contractor shall submit a System Authorization Access Request-DD2875 (SAAR) for system access to dcsa.eastern.bi.mbx.fire-support-access-requests@mail.mil. The Contractor must complete the form in its entirety, except for section 17. The COR will provide instructions for access requests to systems that do not require a DD2875.

6.3. The Contractor must submit a completed “Acceptable Use of Information Systems” agreement.

6.4. Each Contractor employee is required to utilize a PIV and/or CAC to access DCSA IT systems, in accordance with the FIPS Publication 201. Using shared accounts to access DCSA IT systems is strictly prohibited. DCSA will disable accounts, and access to DCSA IT systems will be revoked and denied if Contractor employees share accounts. Users of the DCSA IT systems will be subject to periodic auditing to ensure compliance with DCSA policies.

6.5. All Contractor computer security violations will be handled in accordance with the DCSA Incident Response Plan. If a Contractor employee commits a computer security violation, their system access will be immediately terminated, pending investigation in accordance with the DCSA Incident Response Plan.

DCSA may require the Contractor to immediately remove individuals from work on the awarded contract, at any time, as a result of individual security violations. If at any time during Contract performance it is determined that the Contractor is not in full compliance with the security and cybersecurity requirements of the awarded contract, the Government may immediately suspend performance under the awarded contract and require the immediate return of all case materials to the Government at full Contractor expense. Any work suspension resulting from a security lapse will not be subject to equitable adjustment; all costs will be borne by the Contractor.

6.6. Upon request of the KO or COR, the Contractor must immediately return all DCSA Information, including, but not limited to, data stored on recovery media, tape backups, and images.

6.7. The COR and DCSA System Access Management must be notified at least five (5) business days prior to a Contractor employee being removed from a contract. For unplanned terminations or removals of Contractor employees from the Contractor organization, the COR and DCSA System Access Management must be notified within two (2) hours of the individual’s departure.

6.8. Inactivity on BIES may trigger an inquiry from DCSA to the Contractor to determine if access to DCSA systems is still needed. If DCSA system access is pulled from investigative personnel for any reason, that individual will be unable to transmit reports via BIES, and all GFI or GFE will be collected. The Contractor will be notified, monthly, of users who have been inactive for thirty (30) calendar days or more. The Contractor will be responsible for taking action for each user to either suspend or revoke access, or ensure that the user resumes activity.

7. ACCESS TO CONTRACTOR IT SYSTEMS

7.1. During contract performance and throughout any contract close-out period, the Contractor must provide DCSA, or a designee, with immediate access to all IT systems used by the Contractor to support the performance of the contract for the purpose of inspection and forensic analysis in the event of an

ISI.

7.2. Contractor will provide assistance or access to DCSA engineers to debug issues.

7.3. DCSA reserves the right to restrict access to all unpatched clients with 24 hours’ notice in the event an emergency patch is determined to be necessary.

7.4. DCSA will prevent network access to any Contractor workstation which does not have the DCSA Network Access Control Software client installed on an approved Contractor domain member workstation.

8. HARDWARE/SOFTWARE

8.1. The Contractor is to maintain their own computers and systems to connect to the DCSA network, all of which will require approval through the DCSA RMF process. Contractors must submit the Certificate of Networthiness to Enterprise Cybersecurity for the CISO and/or AO approval prior to connecting any non-GFE devices or other capabilities.

8.2. Laptop computers at DCSA are intrinsic components of one (1) or more DCSA Federal information systems and will therefore comply with the full scope of NIST Special Publication 800-53 security controls as stated in DoDI 8510.01. Within DCSA, laptops are components of larger DCSA Information Systems and as such are supported by the full set of information security controls in the systems they are a part of. For laptops operated by a Contractor or other entity on behalf of DCSA, NIST references implementation and compliance requirements in Defense Information Systems Agency, Security Technical Implementation Guides (STIGs) which can be found at https://public.cyber.mil/stigs/.

8.3. The Contractor will provide the initial prototype of each model and brand of laptop or desktop for DCSA approval of its software configuration. If more than one (1) model or brand will be used by the Contractor, a prototype for each will need approved by DCSA. Updates to approved images require DCSA's reapproval before they are released for use. Any subsequent models or brand changes in laptops or PCs will also be submitted to DCSA for approval of configuration. Laptops and PCs will have Adobe Reader installed to enable use of the DCSA Investigator Handbook and other electronic documents provided on the Field Document Repository system.

8.4. Enforcement of DCSA laptop security control requirements is accomplished through various means to include continuous monitoring of all workstations and laptop connections to DCSA information systems. All connectivity is subject to ongoing monitoring and validation by DCSA’s network security team. Initial enforcement of laptop requirements is accomplished through baseline configurations in compliance with the guidelines in STIGs. Ongoing enforcement of DCSA-controlled laptops is managed by the designated DCSA team.

8.5. Laptop security specifications are as follows:

8.5.1. Laptop hardware must be compliant with the Trade Agreement Act;

8.5.2. Laptops must utilize Trusted Platform Module 1.2 or higher;

8.5.3. Laptops must have capability to support smart card readers for PIV/CAC authentication;

8.5.4. Laptops must not have Bluetooth capabilities nor embedded camera feature;

8.5.5. Company-provided laptop hardware will be required to run the approved version of supported Microsoft Windows Operating System.

8.5.6. Encryption of the laptop hard drive will be determined and managed by the Contractor, consistent with their RMF process.

8.6. The integrity and confidentiality of investigation data will be maintained through technical and procedural controls. Software requirements as defined by DCSA will be provided for the Contractor to use as elements of a secure software package configured by the Contractor. All software provided by DCSA is licensed or written by DCSA and is the property of DCSA, and all originals and copies must be returned to DCSA at completion of the contract or upon request. Reproduction of the software must be only for work performed for the purpose of completing investigative work for DCSA.

8.7. In order to ensure that only compliant and authorized machines are joining the DCSA network, all remote access must be brokered through DCSA’s non-persistent client-access VPN. Access to the VPN requires authentication through the use of PIV/CAC cards. All connecting vendor- managed systems are required to install DCSA’s Network Access Control (NAC), Endpoint Protection (EPP), and Data Loss Prevention software. The addition of the NAC component agent should not require laptop reimaging.

Additionally, DCSA does not require the Contractor to seek image approval, as stated in section 3, with the addition of this NAC component. DCSA will utilize the NAC agent only for the purpose of monitoring endpoints, for proactively identifying potential threats. No DCSA software can be modified without having been previously approved by DCSA prior to use on the DCSA network.

8.8. DCSA requires Network access control software installed on client endpoints used to validate security compliance of the device connecting to the network. Upgrades will be managed by Contractor personnel. DCSA will attempt to provide approximately thirty (30) business days of advance notice prior to implementing an upgrade to the DCSA Network Access Control Software client.

8.9. The Contractor will provide credentials with administrative permissions to upgrade the DCSA Network Access Control Software client on applicable systems.

8.10. Contractor staff will be required to periodically upgrade the DCSA Network Access Control Software client to stay current with DCSA standards.

8.11. DCSA will provide immediate notice once a vulnerability is identified before entering a planned upgrade/update cycle.

8.12. All machines will be upgraded with required operating system patches, or any other required DCSA patch in accordance with Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6510.01F within the below parameters per IAO to avoid DCSA removing or restricting access.

The IAO Parameter letter states during RMF Steps 3 and 4, the Program Management Office is required to document all findings in a Plan of Action and Milestones (POA&M) for mitigation.

CAT I: All CAT I and "Very High" & "High" findings are required to be mitigated within 14-days of system migration to production unless an AO approved justification is provided in the mitigation strategy and a Designated Risk Acceptance (ORA) is approved by the AO.

CAT II: A cumulative value of no more than 25% of CAT II and "Moderate" open findings are allowed before a full ATO will be granted and are required to be remediated or mitigated within 90 days.

CAT III: A cumulative value of no more than 50% of CAT III and "Low" open findings are allowed before a full ATO will be granted and are required to be remediated or mitigated within 180 days.

8.13. During any upgrade or patch cycle, DCSA will work with the Contractor to verify upgraded/patched hosts and debug any issues where upgraded/patched hosts are not reporting correctly to the management console before removing or restricting access for any non-compliant hosts.

8.14. DCSA reserves the right to enact emergency patching without notice if a high or critical vulnerability is discovered in the DCSA NAC software client.

8.15. Any deviation from the IT laptop or desktop requirements for reasonable accommodations will require pre-approval from DCSA prior to use.

9. DATA PROTECTION REQUIREMENTS

9.1. DCSA data must be encrypted in transit and at rest using FIPS Publication 140 and validated by the Cryptographic Module Validation Program.

9.2. The Contractor must provide the validation certificate number to the CISO or COR for verification.

This must occur prior to award and upon any changes to the cryptographic module.

9.3. The Contractor must redact or mask all DCSA data that is not essential to users, including privileged users.

10. SECURITY MONITORING AND ALERTING REQUIREMENTS

All Contractor-operated systems that use or store DCSA information must meet or exceed DCSA IT security requirements pertaining to security monitoring and alerting in accordance with the DCSA Incident Response Plan. System and network visibility and policy enforcement will occur at the following levels:

• Edge

• Server/Host

• Workstation/Laptop/Client

• Network

• Application

• Database

• Storage

• User

• Alerting and Monitoring

• System, User, and Data Segmentation

11. CLOUD COMPUTING

11.1. Prior to using any commercial cloud service provider (CSP), the Contractor must follow the Cloud SRG and obtain approval from DCSA through the CISO or COR.

11.2. Information stored in a cloud environment remains the sole property of DCSA, not the Contractor or the CSP.

11.3. The CSP must provide all the protections levied on the Contractor, and must be held accountable for all other requirements for DCSA IT systems and data, unless waived in writing by DCSA, through the CISO, AO or COR.

11.4. The CSP must allow DCSA, through the COR, access to DCSA data including data schemas, meta data, and other associated data artifacts that are required to ensure DCSA can fully and appropriately retrieve DCSA data from the CSP.

11.5. The CSP, and any subcontractor or teaming partner CSPs, must adhere to the guidelines and process as indicated in DoDI 8510.01 and DCSA DAAPM.

12. COLLECTION, RETENTION AND DESTRUCTION OF DCSA MATERIALS

No later than 14 calendar days prior to the end of the contract performance period, or within 14 calendar days of request by the COR or KO, the Contractor must provide a plan for the collection, retention, and secure destruction of all DCSA materials, and all DCSA digital information such as records, files, and metadata in electronic or hardcopy format. This requirement includes, but is not limited to, information provided by DCSA, obtained by the Contractor while conducting activities in accordance with this contract, distributed for any purpose by the Contractor to any other related organization and/or any other component or separate business entity, and received from the Contractor by any other related organization and/or any other component or separate business entity.

13. TRAINING AND CERTIFICATION

13.1. Training

13.1.1. All Contractor personnel assigned to perform cyberspace work roles will be required to abide by training requirements identified in DoD Directive 8140.01 within 6 (six) months of onboarding.

13.1.2. All Contractor and subcontractor employees requiring access to DCSA offices, facilities and controlled access areas must complete DoD Cyber Awareness training in accordance with DoD Directive

8140.01. Non-compliance will result in revocation of system access. The training can be found at https://public.cyber.mil/training/cyber-awareness-challenge/. Completion of the training must be reported to the cyber workforce team and the COR.

13.1.3. New Contractor personnel will complete DoD Cyber Awareness Training prior to receiving access to and/or working on any DCSA systems. The Government will provide periodic mandatory DoD Cyber Awareness training for all Contractor employees working under the awarded contract, and such training will be completed by the due date assigned by DCSA. If any Contractor personnel do not complete the training by the due date, they will be removed from the Contract until the training has been completed.

13.1.4. Contractor personnel performing work related to IT security are required to complete specialized IT security training based on the role-based requirements stated in DCSA DAAPM. The Contractor must certify to the COR that IT security personnel have completed the requisite training requirements as identified in the baseline certifications in DoD 8140.01.

13.1.5. DCSA may, upon Contractor request, host formalized BIES management training for Contractor personnel. An initial orientation will be given by DCSA on the use of BIES generated case management reports, case tracking, assigning cases, etc., for management and support staff personnel before cases are assigned to the Contractors.

13.2. Certification

13.2.1. New Contractor personnel filling either the Contractor Information System Security Manager or Contractor Information System Security Officer positions as defined in DCSA DAAPM must be certified to the Information Assurance Management (IAM) Training, Certification, and Workforce Management Level III as defined in DoD Directive 8140.01.

13.2.2. The Contractor must ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD Directive 8140.01. The Contractor must meet the applicable information assurance certification requirements defined by DoD, including the following:

13.2.2.1. DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8140.01; and

13.2.2.2. Appropriate operating system certification for information assurance technical positions as required by DoD 8140.01.

13.2.3. Upon request by DCSA, the Contractor must provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

13.2.4. Contractor personnel who do not have proper and current certifications will be denied access to DCSA information systems for the purpose of performing information assurance functions.

14. HOMELAND SECURITY PRESIDENTIAL DIRECTIVE-12 COMPLIANCE

14.1. All Contactor employees must consent to screening and sign an access agreement prior to accessing Government IT systems, and to rescreening according to changes in position risk designation or other requirements in accordance with the requirements in CJCSI 6510.01F.

14.2. COR approval is required prior to Contractor personnel accessing DCSA IT systems.

14.3. The Contractor must be in compliance with requirements in Instruction CJCSI 6510.01F.

14.4. All IT systems must enforce the use of PIV credentials, in accordance with the FIPS Publication

201. Development and test IT systems may be approved to use alternate two-factor authentication, such as tokens, with the written approval of the DCSA Information Officer, through the KO or COR, prior to implementation.

Technical Exhibit B. Background Investigation Training Requirements

1. GENERAL REQUIREMENTS

1.1. The Contractor will be responsible for all initial and supplemental training using a curriculum that incorporates all Federally mandated standards and bear the financial responsibility for all costs associated with initial, remedial, supplemental or other training, including, but not limited to, travel and lodging costs, meals, tuition, and similar incidental costs. DCSA reserves the right to audit and inspect any aspect of the training.

1.2. Training will include a security briefing (includes proper handling/storage of case materials) and standards of professional conduct.

1.3. If the Contractor chooses to develop (or already maintains) a learning management system, the Contractor must coordinate usage under this contract with DCSA and meet all necessary DCSA IT requirements prior to utilization.

1.4. The Contractor will provide certificates of completion for all personnel to the COR or to the KO upon request. Required training must be completed prior to conducting any work on the contract.

1.5. For non-background investigation required training, specifically IT, security, and PII training see Technical Exhibit L.

1.6. DCSA will assist Contractors in the development of their support training by providing DCSA instructional materials that, as a minimum, cover the following topics:

• Investigative process/procedures related to support items/records/cases

• Investigative Forms Coverage

• Records

• Issues

• Field Work System

• Reporting Note: Training materials provided by DCSA must be handled in accordance with classification markings and cannot be shared or released to outside entities.

1.6.1. The Contractor will augment the training (e.g., training materials to describe Contractor roles and responsibilities, internal control processes, testing, mentoring) using the Contractor’s existing staff to ensure compliance with DCSA’s policies and procedures.

1.6.2. Upon request, DCSA will conduct a Train-the-Trainer program.

1.7. During the life of this contract, supplemental standards and requirements may be developed that outline further requirements for investigations, which will require training of Contractor personnel. The Contractor will be responsible for all such training and will bear the financial responsibility for all costs including, but not limited to, travel and lodging, meals, tuition, and similar incidentals.

1.8. Electronic and/or hard copies of training materials, policies, guidance, and other documentation determined necessary by DCSA may be updated and revised periodically by DCSA. Any costs incurred by the Contractor for the distribution of these documents to personnel and any training time involved with implementation of updates or revisions are considered normal operating costs and will be the sole responsibility of the Contractor. Release of any portion of these documents, outside of personnel who have been cleared by DCSA to work on this Contract, is strictly prohibited without prior written approval from the KO or COR.

1.8.1. The Contractor must retain all training related information for the lifecycle of the contract. This includes course descriptions, rosters (to include course title and name), dates of training, results, transcripts (to include remedial training), and assessment tools. Retained records must be available for a Government audit/inspection.

2. QUALIFICATIONS AND TRAINING REQUIREMENTS FOR INVESTIGATIVE SUPPORT

PERSONNEL

2.1. Qualifications. The Contractor shall ensure that all personnel working under this Contract have the appropriate qualifications and training for their positions. The Contractor shall maintain records sufficient to support adequate and appropriate qualifications and training for investigative (i.e., clerical, technical, professional) staff and make the records available to the Government upon request.

2.2. The Contractor shall provide an adequate, suitable, and qualified investigative (i.e., clerical, technical, professional) staff with the skills necessary to perform assigned investigative functions.

2.3. Investigative support personnel conducting investigative work (such as record collection) on the Contract shall be trained on DCSA’s requirements for background investigations, prior to conducting any work on the awarded contract. Investigative support personnel may include record researchers, or investigative technicians, or subcontractors working in support of this requirement.

2.4. The Contractor shall maintain records which verify that its personnel possess the required training. These records will be retained for the lifecycle of the contract and shall be available for a Government audit/inspection within 24 hours. This includes:

• Course descriptions;

• Rosters (to include course title and personnel’s name);

• Dates of training;

• All results and assessment tools; and

• Transcripts (to include remedial training)

2.5. During the life of this contract, DCSA may offer/mandate training to candidates sponsored by the contractors. The Contractor will be responsible for all such training and will bear the financial responsibility for all costs including, but not limited to, travel and lodging costs, meals, tuition, and similar incidental costs.

2.6. The training will include, but is not limited to, instruction on all aspects of duties, conducting and reporting record searches, situations for obtaining records (if applicable to the position), a final exam that must be passed and remediation as necessary. The Contractor sets the minimum passing score consistent with the established standard of competence for the occupation, role, or skill. The training will also include any applicable duties defined by the FIS, Executive Orders, Intelligence Community Directives and governing policies, methodology, issue resolution, and interviewing techniques. Training will include instruction on any applicable IT mission systems, such as Field Work System.

2.7. These personnel must receive mentoring with a senior experienced person until the new personnel successfully demonstrates competency to complete all (or designated) tasks.

Mentoring includes an environment where a trainee’s work is observed by a senior staff member well versed in DCSA investigations, technology, policy, and procedures. Additional post-training audits are required for at least 30 days after the mentoring phase of training for new investigative support personnel.

Attachment:

Federal Background Investigations Case Analyst Program Curriculum (See PWS 7.1.4.)

Technical Exhibit C. Background Investigation Security Requirements

1. GENERAL

1.1. Security Requirements

The Contractor and any subcontractor(s)/consultants will comply with the provisions established in Federal regulations, DCSA policies and procedures for the protection of CUI and material. Any revisions to DCSA policies, procedures or manuals will be provided to the Contractor by DCSA, and incorporated by reference into this Contract. All personnel supporting this contract are responsible for completing any and all security related training. The Contractor agrees to insert terms that conform substantially to the language of this section in all subcontracts under this Contract that involve access to Covered Information and CUI.

The Contractor shall complete the following steps:

1. Appoint a Security Manager and ensure they are properly trained in accordance with Technical Exhibit L – Required Contractor Training

2. Ensure all positions are designated via the Position Designation Tool (PDT) to ensure the appropriate level of investigation

3. Submit all investigations via NBIS at the appropriate level to the position

4. Utilize the correct SON/SOI for these submissions

5. Vetting Risk Operations (VRO) will review the submissions for completeness and accuracy and release to Background Investigation to conduct the investigation

6. VRO will grant the appropriate interim eligibility upon favorable review of the advanced products

7. Adjudication and Vetting Services (AVS) will adjudicate and establish eligibility based upon the completed investigation

8. The Security Manager will report any incidents/derogatory information per Security Executive Agent Directive (SEAD) 3 to VRO via Defense Industrial System for Security (DISS)

9. The Security Manager will ensure all employees are enrolled in Continuous Evaluation (CE) /Continuous Vetting (CV)

10. VRO will process any CE/CV hits

11. The Security Manager will take an owning/servicing relationship in DISS on all assigned personnel

12. DCSA will take an owning relationship on all assigned personnel (since they are not in access, DISS will not allow a servicing relationship)

1.2. Security Compliance

If at any time during Contract performance it is determined that the Contractor is not in full compliance with any of the security requirements of the Contract, the Government may immediately suspend performance under the Contract and require the immediate return of all case materials to the Government at full Contractor expense.

1.3. Adherence to NISPOM

The Contractor will adhere to the requirements established in the 32 CFR Part 117, National Industrial Security Program Operating Manual, DoD 5220.22-M/NISPOM, Chapter 1, Section 2, 1- 201, and appoint a Security Manager to supervise and direct security measures necessary for implementing applicable requirements of the NISPOM and related Federal requirements for the protection of Covered Information and CUI.

1.4. Compliance with DCSA Policy on the Protection of Personally Identifiable Information The Contractor will ensure that all personnel comply in accordance with the Privacy Act of 1974, PII in 2 CFR Part 200.79 and all applicable DCSA privacy policy guidance. (See Technical Exhibit E.

Requirements for the Protection of PII for requirements pertaining to the protection of PII.)

1.5. Destruction Standards

The Contractor will adhere to DoDI 5200.48 Controlled Unclassified Information, DSS 25-1 Information Security Policy, or its successor policy, for the destruction of CUI material.

1.6. Common Access Cards and Personal Identity Verification Cards The Contractor will establish and implement methods to mitigate the risk that CACs, PIVs, and/or other credentials are lost, misplaced, or used by unauthorized persons. The Contractor will immediately report any occurrences of lost items to the COR.

Page 18 of 62CUI

2. PERSONNEL SECURITY REQUIREMENTS

2.1. Provision of Staff

The Contractor will provide an adequate, qualified, trained, and investigated/adjudicated investigative support (clerical, technical, professional) staff with the skills necessary to perform all investigative functions referenced in this Contract and all attachments and references. Security/suitability requirements for personnel are found in Executive Orders 13526 and 12968, and credentialing and fitness standards.

2.2. Favorably Adjudicated Background Investigations

All Contractor personnel, to include their subcontractors, and consultants engaged in the performance of work under this Contract will have a completed, current investigation of the appropriate level relevant to the sensitivity of the position and access they require with a favorable eligibility determination. The level of investigation and eligibility determination requirement, appropriately designated through use of the PDT, is determined by position, function, and level of access, or possession of administrative capabilities in a system storing background and personnel security investigations and adjudicative data. Personnel in positions involving investigative duties (including access to or handling of background investigations or counterintelligence investigations), in positions related to the adjudication, recommendation of adjudicative determinations, or granting of national security eligibility, or in positions providing administrative capabilities in a system storing background and adjudicative data, require a T5 or T5R background investigation with a TOP SECRET favorably adjudicated eligibility determination. Personnel with routine access to investigative files without the capability to render national security determinations or who serve in program management administrative positions require a T3 or T3R background investigation with a SECRET favorably adjudicated eligibility determination at a minimum. All must be within investigation scope and/or currently enrolled in CE/CV at the time of contract award and throughout the life of the contract to include all potential option years identified in this PWS. An interim determination for eligibility may be utilized for access in accordance with DoDM 5200.02, unless prohibited by the requirements of the position.

2.3. Reportable Requirements

In accordance with SEAD 3 all covered individuals who have been granted eligibility or hold a sensitive position shall report as required in this directive to DCSA and must be favorably adjudicated by Adjudication and Vetting Services (AVS) formerly known as DoD CAS.

2.3.1. Reportable Events Analysis: All reportable information shall be communicated to DCSA through the Contractor's Security Manager. It is not the responsibility or the authority of the Security Manager to make an adjudicative determination.

2.4. Approval Process

The Government will review proposed Contractor personnel to ensure they meet the requirements of the contract only after verification of an existing current favorably adjudicated investigation and eligibility determination that meets or exceeds the needs of the individual’s intended position. The

CUI

Contractor will initiate reinvestigations in accordance with timelines set forth in the 5 CFR Part 731, 5 CFR Part 1400 and the current Federal Investigative Standards of all Contractor personnel performing work under this Contract through notification to the COR and the AVS. It is the responsibility of the Contractor’s Security Manager to notify DCSA and AVS, 6 months prior to their Contract personnel needing a reinvestigation. The Government will review, close, and adjudicate the investigations conducted on these personnel.

2.5. Interim Eligibility

The DoD AVS has the authority to grant an interim eligibility determination which will allow the Contractor personnel to train and begin supporting the contract and access related systems. All Contractor personnel supporting this contract, excluding those in roles assigned IT privileged user or system administrative responsibilities submitted for an eligibility determination will be considered for interim eligibility. In the event that the DOD AVS discovers or receives information that could result in an unfavorable determination at any time during the investigation or eligibility determination, the DOD AVS may withdraw the Interim Eligibility and access could be revoked or suspended.

2.6. DCSA’s Right to Suspend or Remove Contractor Personnel’s Clearance to Work on the Contract As this Contract is essential to the National Security of the United States, all persons performing work under this Contract will be held to the highest ethical standards. The Contractor will exhibit high ethical and professional standards as set forth in pertinent DoD and DCSA policies in the performance of all work under the Contract. DCSA may, for any reason, immediately suspend or revoke Contractor or Contractor personnel BIES and facility access authorization, security clearance, and/or general access to perform work under the Contract. Upon such suspension or removal to work on the Contract, the Contractor will immediately discontinue their employee’s access to all systems and files supporting the Contract and comply with all other requirements of this Contract regarding separated or suspended personnel. The Contractor will not direct its personnel to contact DCSA for details concerning a suspension or removal.

2.7. Recordkeeping Requirements

Upon request of DCSA, the Contractor will provide any and all requested records for its personnel, subject to the limitations noted below. DCSA will provide the Contractor with a written request for the records sought, and the Contractor will provide such records within seven (7) calendar days. Such records may include, but are not limited to: personnel, timekeeping, security, training, work assignments or any other records in possession of the Contractor and relating to the specified

CUI

individual’s employment or record of performance (i.e., computer logs, employee phone records for company/employer provided phone). Exceptions to this requirement include records containing employee health information, information regarding requests for accommodation under the Americans with Disabilities Act or state disability laws, paperwork related to requests under the Family Medical Leave Act or state equivalents or other information covered by Health Insurance Portability and Accountability Act, or any other information protected from disclosure under state or Federal law will not be supplied.

2.8. Security Training

The Contractor shall be complaint with applicable training requirements set forth in NISPOM and the PWS. A complete list of required training for Contractors who access DCSA networks is located at Technical Exhibit L.

3. PHYSICAL SECURITY REQUIREMENTS

3.1. Required Security Classification

Due to the systems and information accessed under this contract, there is a very defined “eligibility” need. However, there is no need for “access”, at this time, therefore an Facility Clearance Level/DD 254 is not currently required.

3.2. Administrative

Provisions of the Privacy Act apply to all records and reports maintained by the Contractors.

Contractor personnel performing or assigned under this contract must be U.S. persons. Security Classification Guide requests should be presented to the Government Sponsor, if required, subsequent to contract award. All covered information received or generated under this contract is the property of the U. S. Government. The U. S. Government shall provide disposition instructions. No release of covered information or controlled unclassified information under this contract is authorized. All requirements for control and accounting of original documentation and copies apply. All applicable provisions of the NISPOM and its supplements and 32 CFR Part 117 apply. The Contractor shall adhere to 32 CFR Part 117.18 (NISPOM) , which applies to non-DoD IT systems.

Within 10 days of contract award, prime contractor shall submit a Visit Authorization Request (VAR) to DCSA Security Office to validate that all management, supervisory, and other personnel assigned to this contract meet the clearance. Additionally, the prime contractor will immediately notify the DCSA Security Office of any onboarding or separating employees to the contract. Failure to provide security eligibility information shall delay and/or deny the individual access to DCSA, and DoD facilities and information. It is the responsibility of the Prime Contractor to maintain either an owning or servicing relationship in DISS with all personnel supporting this contract, this includes Prime contractor personnel, subcontractor personnel, and any consultants. All Visit Authorization Requests (VARs) submitted to the host government locations must be sent via the DISS and *must* come from the Prime Contractor's SMO in DISS. For visits to DCSA, Collateral and SCI Visit Authorization Requests should be sent to SMO DCSAHQSEC.

CUI

Contractor is not authorized to subcontract on this effort without an approved subcontracting plan with written Government Contracting Authority/COR authorization.

All CACs, building access badges, and parking passes must be returned immediately at the end of the period of performance date.

The final period of performance dates will be reflected in the contract award document.

All programs and materials developed at government expense during the performance period of this contract are the property of the US Government.

Prior to granting an employee access to information and/or materials, the Contractor shall brief employees with regard to their obligation to comply with the NISPOM, to include any changes and/or amendments, and 32 CFR Part 117. The Contractor’s employees shall be debriefed when access to the material is no longer needed or is terminated. A list of all employees who have had access to information during the period of this contract shall be maintained by the Contractor company and be available for DCSA inspection.

3.3. Access to General Protection/Security Policies and Procedures.

All Contractor employees, including subcontractor employees stationed or assigned on a US Government facility shall comply with applicable installation, facility access…