CTIP SME PWS 20260624.docx

Performance Work Statement (PWS)

1.0 INTRODUCTION The Combating Trafficking in Persons (CTIP) Program Office requires Subject Matter Expertise for CTIP professional training development and to provide support at the program and policy level services that align and comply with NSPD-22, NDAA, and DoWI 2200.01 to meet the CTIP Program Office’s daily mission requirements and strategic future.

2.0 BACKGROUND

The CTIP Program Office is responsible for the development and oversight of the Department’s policy to combat human trafficking. The National Security Presidential Directive 22 (NSPD-22) dated December 16, 2002, Executive Order 13627 Strengthening Protections Against Trafficking in Persons in Federal Contracts dated September 25, 2012, National Defense Authorization Act (NDAA) Section 1298, Efforts to End Modern Slavery published November 30, 2016, and Department of War Instruction 2200.01 (DoDI 2200.01), June 19, 2019, require the Department of War (DoW) to develop programs, policies, training, awareness materials, and reporting for CTIP. Compliance is incumbent upon having an infrastructure in place that will institutionalize Services, Combatant Commands (COCOMs), and Defense Agencies combating trafficking in persons programs that align with DoW requirements. Additional assistance is imperative to accomplish the multiple phases necessary for a successful program. The Department supports the US Government’s zero tolerance policy for trafficking in persons (TIP). DoW’s CTIP program mirrors the U.S. Government’s TIP program outlining prevention, protection, and prosecution strategies for an effective CTIP program.

4.1 Provide experienced Subject Matter Expertise to develop, update, and maintain professional training modules and related resource materials for the CTIP program office OUSW P&R/DHRA to support the following training products:

4.1.1 General Awareness training module and Refresher

4.1.2 Investigative Professionals training modules

4.1.3 Acquisition Personnel training modules and Resource Kit

4.1.4 CTIP Training for DoW Educational Activity Educators and School Staff

4.1.5 Student Guides and Parent Guide

4.1.6 Leadership Resource and Standard Curriculum toolkits

4.1.7 Chaplain’s training and Toolkit

4.1.8 Healthcare Training and Toolkit

4.1.9 Military Recruiters Training

4.1.10 Judge Advocate/Legal Counsel training and Toolkit

4.1.11 Seal and Repel: Border Security to Prevent Human Trafficking

4.1.12 National Guard Training

4.1.13 Warfighter Readiness Training

4.1.14 Develop public service announcements that coincide with several training courses

4.1.15 Weekly/Monthly Status Report

4.2 Provide training updates consistent with receipt of human trafficking changes in policies, laws, regulations, and new information and support the overall CTIP Training Program.

4.2.1 Provide instructional design, including adult learning theory and all aspects of the Analysis, Design, Development, Implementation, Evaluation, Sustainment (ADDIES) model, Provide updates to the Acquisition Professional training module

4.2.2 Provide learning strategy, including both the recommendation and supporting coordination for approved strategic training initiatives. Provide minutes for meetings with DoD components.

4.2.3 Provide training support materials such as job aids, videos, games, and toolkits (collections of support materials for specific audiences), needs analyses, data collection analysis for input to data call requests from DoW, DoS, DoJ, Congress, White House, and other reviews, prior to suspense set by CTIP Program Office.

4.2.4 Support DoW CTIP PMO by drafting recommended training strategies based on efficient, data-driven solutions. Assist the Government in its implementation of approved training solutions which align with agency-wide compliance and strategic based on efficient, data-driven solutions that meet strategic objectives for both compliance and effectiveness.

4.2.5 Ensure deliverables include current and accurate human trafficking information by: providing subject-matter expertise through institutional knowledge and facilitating the work of developers, and other SMEs as necessary. Performing quality assurance reviews prior to submission to the Government. Make all corrections to deliverables as annotated in Government reviews to ensure compliance with the requirements of the PWS.

4.2.6 Provide reach-back to personnel with specialized skills, as needed, such as: video production, data collection and analysis, strategic communication, strategic planning, graphic material design, and 508 compliances for interactive training materials. Maintain and update Communications Plans.

4.3 Provide research, draft materials, and administrative support to assist the CTIP PMO in its development of Strategic Plans and Blueprints for Action, subject to final review and approval by the CTIP PM.

4.3.1 Provide content updates of existing web-based training courses, as well as CTIP Leadership Resource, CTIP Standard Curriculum Toolkit, Acquisition Resource Kit, Chaplain Tool kit, ealthcare Personnel Toolkit, Judge Advocate/Legal Counsel Toolkit, CTIP Student and companion Parent Guide, CTIP Middle School Guide and Preventing Online Exploitation Guide.

4.3.2 Provide the CTIP PMO the status and tracking of tasks, schedule, to-do checklist of tasks to be done before training or Toolkits can be deployed for stakeholder and subject matter expert (SME) reviews.

4.3.3 Coordinate with stakeholders (CTIP POCs) during the review process, update content by implementing CTIP POCs comments, researching case studies and current CTIP laws and policies as they pertain to the DoW.

4.3.7 Research and provide analysis using data and metrics reports from end of course surveys and other data collected by the CTIP Program Office and provide expert advice on human trafficking issues, trends, laws, and policies that can be incorporated in CTIP training, CTIP resources, and CTIP reporting.

4.3.8 Ensure CTIP PMO training materials and resources reflect current and accurate information and advise the CTIP PM as necessary.

4.3.9 Accompany CTIP PMO on site visits, CONUS and OCONUS, provide administrative support and document observations, to assist the CTIP PMO in conducting its risk management and internal controls program reviews.

4.3.10 Utilize extensive survivor network contacts to consult with specific survivors who have lived experience with particular product focus and sometimes a DoW nexus (e.g. healthcare, chaplain, military recruiter, student guide) for content creation and review. Conceptualize, design, and obtain unique survivor lived experience information delivered in written testimony narrative, videotaped stories, and short clips on specific subject relevant to the DoW.

4.3.11 Attend quarterly CTIP Task Force meetings as an observer to provide technical expertise when requested, clearly identifying as contractor personnel, and take meeting minutes.

4.3.12 Provide technical analysis and draft background materials to assist the CTIP Program Director in preparing for high-level meetings and briefings (such as the White House President’s Interagency Task Force, and Senior Policy Operating Group meeting), subject to final review and approval by the CTIP Program Director.

4.3.13 Transition Out. The outgoing Contractor is ultimately responsible for performing full services IAW the contract, during the phase-out period, and shall not defer any requirements for the purpose of avoiding responsibility or of transferring, such responsibility to the succeeding Contractor. The outgoing Contractor shall fully cooperate with the succeeding Contractor and the Government, so as not to interfere with their work or duties.

5.0 DELIVERABLES

The Contractor shall provide deliverable(s) in a format mutually agreed upon by the Government and the Contractor. All deliverables will be reviewed for timeliness, accuracy and format. If a deliverable due date falls on a weekend or holiday, the Contractor shall submit the deliverable on the last workday prior to the due date. In fulfillment of this effort, the Contractor shall provide the following deliverables to the COR.

5.1 The contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via the System for Award Management (SAM) (https://sam.gov) in accordance with DFARS 252.204-7023.

5.2 The contractor shall submit an annual report in the contractor’s format to demonstrate the progress towards small business subcontracting stated in the Small Business Participation Commitment Document (SBPCD) submitted with the contractor’s proposal. The report is due no later than 30 days after the end of each period of performance, and shall be submitted to the CO and COR. Additionally, the contractor shall submit the report via email to the DHRA Office of Small Business Programs at dodhra-small-business@mail.mil.

5.3 The goals for small business subcontracting at DHRA are 30% of total contract value. The contractor shall submit a copy of its plan to meet the subcontracting goals for this contract, within 30 days after award. The goals shall be submitted to the COR, CO and via email to the DHRA Office of Small Business Programs at dodhra-small-business@mail.mil. The contractor shall submit an annual report in the contractor’s format to demonstrate its small business subcontracting towards its goals. The report is due no later than 30 days after the end of each period of performance, and shall be submitted to the CO and COR. Additionally, the contractor shall submit the report via email to the DHRA Office of Small Business Programs at dodhra-small-business@mail.mil.

5.3.1 Participate in a Post-Award Conference. The Contractor shall attend any post award conference convened by the contracting activity in accordance with Federal Acquisition Regulation (FAR) Subpart 42.5, Post Award Orientation. This meeting shall provide an introduction between the Contractor personnel and Government personnel who will be involved with the contract. The meeting shall provide the opportunity to discuss technical, management and security issues. The Post Award Conference aids both the Government and Contractor in achieving a clear and mutual understanding of all requirements and identifying and resolving any potential issues. The Contractor shall be prepared to discuss any items requiring clarification and gather information as necessary to support each deliverable. The Contractor must provide a written summary of the Post-Award Conference. This conference may be virtual or on-site at Vendors Location.

6.0 CONTRACTOR TRAVEL

6.1 The government anticipates travel to locations including CENTCOM Headquarters, Tampa Florida, NORTHCOM Headquarters, Colorado. PACOM Headquarters, South Korea, and Fort Bliss, El Paso, Texas, during the period of performance.

7.0 RECORDS MANAGEMENT

7.1 Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

7.2 In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

7.3 In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

7.4 Defense Human Resources Activity and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of Defense Human Resources Activity or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Contracting Officer’s Representative (COR). Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to the COR and the Defense Human Resources Activity Component Records Management Officer at dodhra.mc-alex.dhra-hq.mbx.records@mail.mil so DHRA may report promptly to NARA in accordance with 36 CFR 1230.

7.5 The Contractor shall immediately notify the COR upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know in accordance with all applicable privacy, security, and information protection policies. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the COR. When information, data, documentary material, records and/or equipment are no longer required, it shall be returned to DHRA control, or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the COR. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (7.4).

7.6 The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and Defense Human Resources Activity guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7.7 The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with Defense Human Resources Activity policy.

7.8 The Contractor shall not create or maintain any records containing any non-public Defense Human Resources Activity information that are not specifically tied to or authorized by the contract.

7.9 The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

7.10 The Defense Human Resources Activity owns the rights to all data and records produced as part of this contract. The contractor shall not include any contractor markings on deliverables created under the contract. All deliverables under the contract are the property of the U.S. Government for which Defense Human Resources Activity shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. The contractor shall not use or disclose any data or deliverables under this contract for any purposes other than performing the contract, unless expressly approved by the Government.

8.1 SECURITY

8.1 Personnel Security. Overarching security requirements are Unclassified. Contractor and subcontractor personnel require Unclassified access to DoD network(s), Information Technology (IT) systems, and Government Furnished Equipment (GFE). Contractor and subcontractor personnel must obtain, DoD credentials, (also known as the Common Access Card (CAC)) for physical and logical access to federally controlled facilities and DoD Information Systems (IS) containing Personally Identifiable Information (PII) or Controlled Unclassified Information (CUI).]

8.1.1 The Contractor and Subcontractor personnel on this contract will be designated performing in critical positions with unclassified access. Personnel assigned to this contract are required to obtain and maintain Tier 3 background investigation (BI) and adjudication or suitability determination. This designation aligns with investigative requirements outlined by Defense Counterintelligence and Security Agency (DCSA) and is in accordance with the DoD Personnel Security Program, as defined in DoDI 5200.02, DoDM 5200.02. Specifically, Title 32, Code of Federal Regulations Part 156 applies to unclassified contracts, and Part 117 applies to contracts covered by the National Industrial Security Program (NISP).

8.1.2 No employee may perform under this contract or have access to DoW information or systems under this contract until they have completed a Tier 3 or higher Tier background investigation (BI) that meets the requirement or be in the process of a Personnel Security Investigation (PSI) with a minimum of interim eligibility approval.

8.2 Security Clearances. This contract requires personnel to perform duties requiring a security clearance, as specified in DD Form 254, DoD Contract Security Classification Specifications. The Contractor shall possess or obtain a Facility Security Clearance (FCL) at the Secret level. The Contractor shall register and submit clearance requests through the National Industrial Security Program Central Access Information Security System (NCAISS) (https://www.dss.mil/is/ncaiss/).

8.2.1 The Contractor shall provide the names and clearance levels of designated personnel performing work under this PWS in roles requiring a National Security Clearance, Secret, to the respective COR. An individual’s personnel security clearance shall not exceed both the facility clearance level (FCL) and the clearance level specified on DD Form 254.

8.2.2 Contractor personnel requiring access to classified information must possess the required clearance eligibility or have the required investigative Tier in progress before requesting access to government resources. Designated personnel must have at least interim eligibility Secret and access activated in the Defense Information System for Security (DISS).

8.2.3 If subcontractors are utilized in the performance of a classified contract, the Prime Contractor shall create a Subcontract DD Form 254 in the National Industrial Security Program Contract Classification System (NCCS). The Prime Contractor shall ensure that all teaming partners and subcontractors possess the appropriate security clearances. Security Clearance Requirements:

8.2.3.1 The Industry Facility Security Officer (FSO) is responsible for processing contractor personnel for the respective Tier background investigation for National Security Clearances (e.g., Top Secret, Secret, Confidential). The Contractor shall adhere to security requirements outlined in E.O. 12968 – Access to Classified Information, E.O. 12829 – National Industrial Security Program (NISP), and Title 32, Code of Federal Regulations Part 117 - Industrial Security Program Operating Manual (NISPOM).

8.2.3.2 The FSO shall take ownership in DISS of all personnel determined to require a security clearance. For all contractor personnel requiring classified access, a Visit Notification shall be submitted in DISS to DHRA Security up to the duration of the contract, but no more than one year, and annually thereafter if applicable.

8.2.3.3 Continuous Vetting (CV). The FSO shall maintain the respective investigative Tier for all personnel requiring security clearances Secret, including submitting Continues Evaluation (CE) enrollments and re-enrollments, in accordance with the DoD Continuous Evaluation (CE) Program and Trusted Workforce 2.0.

8.2.4 The Contractor FSO must immediately notify DHRA Security and the COR of any derogatory change in clearance eligibility. If a contractor employee is unable to obtain or maintain the required security clearance, the contractor FSO must immediately notify the Government and restrict the employee from accessing government resources under this contract.

8.2.5 A Standard Form (SF) 312 Non-Disclosure Agreement (NDA) initiated by the contractor’s FSO is required for each of the Contractor’s personnel.

8.3 Staffing. Contractor personnel requiring access to DHRA-sponsored resources (e.g., DHRA-sponsored credentials, DoD networks, DoD IT systems, DoW Information Systems (IS), CUI/PII data, or federally controlled facilities) must be citizens of the United States. This citizenship requirement also applies to personnel assigned to or working on the contract at any remote site.

8.4 Onboarding. All Contractor personnel working on behalf of DHRA contracts, regardless of their access level, must be processed using the DHRA onboarding system (EAFi or DoW Service Center). They must also provide a completed Defense Logistics Agency Headquarters (DLAH) Form 1728, Request for HQC Contractor Badge and/or Information Technology (IT) Access, using a secure method (e.g., encrypted email or DoD SAFE). The DHRA Security and DLA Personnel Security (PERSEC) offices will then validate that the contractor meets DoW background investigation requirements.

8.5 Listing of employees & Clearance Documentation. The Contractor shall maintain a current listing of employees. Within 10 calendar days of contract award, the Contractor shall provide the COR with a list of all personnel assigned to the contract or task order. The personnel list must include the following information: contract number, contract expiration date, employee information (full legal names), DHRA center/office, location of performance, clearance level needed (e.g., Top Secret, Secret, Confidential or None [for unclassified access]), and IT access needed (e.g., privilege, authorize or other). The Contractor shall provide the COR and DHRA Security with an updated list whenever personnel status or information changes.

8.6 Access to Sensitive Information. To the extent that the work under this contract requires the Contractor to have access to DoW sensitive information, the Contractor shall, upon receipt, treat such information as sensitive and safeguard it from unauthorized use and disclosure. The Contractor shall not appropriate such information for its own use or disclose such information to third parties unless specifically authorized by the Government in writing.

8.6.1 The Contractor shall only allow access to sensitive information to those employees who need it to perform services under this contract and who have acknowledged that it shall be used solely for that purpose. The Contractor shall prevent its employees from discussing, divulging, or disclosing any sensitive information to any person or entity except those within the Contractor’s organization directly performing the contract.

8.7 Operations Security (OPSEC) Requirements. The Contractor is not required to develop an OPSEC Plan. However, the Contractor shall comply with DoD Directive 5205.02E and the requiring activity's OPSEC program. Contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter. The Contractor shall maintain all OPSEC training records and shall provide copies to the COR upon request.

8.8 Information Technology (IT) Investigation Requirements. The contractor/subcontractor personnel supporting this contract will require Privilege (Moderate) access to DHRA IT & Information.

8.8.1 Contractor personnel, who perform work on sensitive networks, IT systems or applications, must possess and maintain the appropriate background investigation (BI) and adjudication determination. The Contractor shall assure that individuals assigned to the contract undergo the respective BI and obtain the proper eligibility, based on job function or tasks performed, before performing any work or accessing any systems or information under the contract.

8.8.2 IT position category designation does not imply or convey authorization to access classified information.

8.8.3 The IT access requirement will determine the category needed to perform work on the DoD IT Systems/Networks. The IT designated is based on the IT system/network requirements according to the DoW Cyber Security Technical Implementation Guides (STIGs).

8.8.4 It is the contractor’s responsibility to ensure that employees meet the appropriate Tier investigation requirements before requesting IT access.

8.8.4.1 Contractor personnel in positions with significant involvement in life-critical or mission-critical systems pose a relatively high risk of causing grave damage to National Security.

8.9 Personal Identifiable Information (PII) and Tier Investigations. All personnel supporting this contract must protect PII data according to the Privacy Act of 1974. Personnel requiring access to Information Technology (IT) or access to DoD Information Systems that contain military active duty, guard, or reservists’ PII or information pertaining to Service members that are otherwise protected from disclosure, where such access has the potential to cause serious damage to national security, must be vetted accordingly and protect the data. Background Investigations (BI) levels required for each job function or necessary access include, but are not limited to, the following:

8.9.1 Tier 3/Tier 3R for Noncritical-Sensitive – Moderate Risk: All personnel with the ability to aggregate or extract military PII en masses from an automated records repository require, at a minimum, a favorably adjudicated Tier 3 (T3) BI or equivalent.

8.9.2 The Contractor shall report any privacy breach immediately to the DHRA Privacy Office and secondly to the COR.

8.10 Controlled Unclassified Information Requirements for DoD Contractors. The following procedures will be used to protect Controlled Unclassified Information (CUI) documents and materials:

8.10.1 HANDLING: Access to CUI material shall be limited to those employees needing the material to perform their duties. The CUI marking is assigned to documents and material created by a DoD User Agency. CUI is not a classification but requires extra precautions to ensure it is properly safeguarded and disseminated and is not released to the public without government authorization.

8.10.2 MARKING: The Contractor shall mark unclassified documents containing CUI as follows: “CUI" at the top and bottom of each page, include the CUI warning box, and the CUI Designation Indicator Block as required in DoDI 5200.48.

8.10.2.1 If the document or material contains CUI under the category of Controlled Technical Information (CTI), use of distribution statements is required. See DoDI 5200.48.

8.10.2.2 If a classified document contains CUI material or if the classified material becomes CUI when declassified, place the following statement on the bottom of the cover or the first page under the classification marking: “NOTE: If declassified, review the document to make sure the material is not still CUI. If it does, then it must have the appropriate safeguarding, dissemination controls, and CUI markings applied.

8.10.2.3 Mark other records such as computer print outs, photographs, films, tapes, or slides in accordance with DoDI 5200.48 so the receiver or viewer knows that it contains CUI material.

8.10.2.4 Mark a message containing material in accordance with DoDI 5200.48. Unclassified messages containing CUI material must show the abbreviation (CUI) before the text begins.

8.10.2.5 Ensure documents transmitting CUI material call attention to any attachments containing CUI.

8.10.2.6 CUI material released to a contractor by a DoD user agency must have the following statement on the front page or cover:

THIS DOCUMENT CONTAINS CUI MATERIAL AND MUST BE REVIEWED BY A GOVERNMENT REPRESENTATIVE UNDER THE REQUIREMENTS OF DODI 5200.48, DODI 5230.09, and DODI 5230.29.

8.10.3 STORAGE: The Contractor shall, place CUI material in an out-of-sight location during normal work hours, if the work area is accessible to persons who do not have an authorized government purpose for access to the material. After normal duty hours, the Contractor shall store CUI material to prevent unauthorized access by filing it with other unclassified records in unlocked files or desks when internal building security is provided and the file is marked as CUI. When there is no internal security, locked buildings or rooms usually provide adequate after hours protection. For additional protection, store CUI material in locked containers such as file cabinets, desks, or bookcases.

8.10.4 TRANSMISSION: CUI documents and materials may be transmitted via first class mail, parcel post or, for bulky shipments, fourth class mail. Within the CONUS discussion of CUI material on the telephone is authorized if necessary for the performance of the contract and no alternative is available. Electronic transmission of CUI (voice, data, or facsimile) should be by using approved and secure communications systems whenever practical. If there is a fax transmission, the sender must ensure the intended receiver is available to receive it or a cover sheet will be used to allow carrying it to the final recipient to avoid unauthorized disclosure of the CUI.

8.10.5 RELEASE: CUI material shall not be released outside of the contractor’s facility except to the representative of DoD or DHRA.

8.10.6 DESTRUCTION: When the CUI material no longer meets the threshold for safeguarding and dissemination, the Contractor shall immediately decontrol it, process it through the records management process, and destroyed by the approved methods identified in DoDI 5200.48 to preclude its disclosure to unauthorized individuals by rendering it unreadable, indecipherable, and irrecoverable.

8.11 Position of Trust (POT) Requirements. The Contractor shall provide the COR with a list of personnel requiring unclassified access no later than five business days after contract award and within three business days of any change.

8.11.1 Reciprocity Consideration. In accordance with DoD standards outlined in Executive Order E.O 13488, existing Personnel Security Investigations (PSIs) for contractor personnel will be validated or assessed for reciprocity. Contractor personnel shall provide additional information if requested by the DHRA and DLA Security office for DCSA re-adjudication or eligibility assessments. PSI equivalency will be determined according to the investigative alignments provided by DCSA. Reciprocity considerations include verifying any break in federal service (e.g., U.S. Military, U.S. Civilian or U.S. Contractor) exceeding 24 months since the last favorable investigation.

8.11.2 Government Responsibilities. The Government is responsible for funding Contractor personnel PSIs or sponsoring a DoD-determined equivalent background check when eligibility is required for Position of Trust without access to classified information. The Contractor shall ensure the COR and Government Security Office are informed of Contractor personnel requiring sponsored PSIs.

8.11.3 Tier Application Requirements. DCSA offers three-tier Personnel Security Investigations (PSI): Tier 5 (High Tier), Tier 3 (Moderate Tier) and Tier 1 (Low Tier). Contractor personnel requiring a Tier PSI shall provide an FBI fingerprint check, proof of U.S. Citizenship, and a Personnel Security Questionnaire (PSQ). The Standard Form (SF) SF86 must be used for High or Moderate Tiers, and SF85 for Low Tier, using the National Background Investigation Services (NBIS) electronic Application (eApp). Contractor personnel shall provide all requested information pursuant to the Privacy Act of 1974 when requested by the Government. The Government Security Office will provide instructions, specific to the individual case and designated Tier, on how to access the NBIS system. For information, visit NBIS website at https://www.dcsa.mil/is/nbis/

8.11.4 Interim Determinations. DLA Security will assess each Tier PSI application package, including FBI fingerprint check results, Proof of U.S. Citizenship, and PSQ for interim eligibility. The Contractor shall not assign personnel to duties supporting the Government contract before interim approval is granted. To maintain interim Position of Trust eligibility, personnel must:

8.11.4.1 Comply with all personnel security requirements specified by DHRA and DLA Security.

8.11.4.2 Obtain and maintain favorable FBI fingerprint results.

8.11.4.3 Comply with all investigative and adjudicative requirements, including responsiveness to time-sensitive requests (e.g., interviews, additional information, or clarification) from DHRA or DLA Security, a DCSA investigator, or the adjudicative agency.

8.11.4.4 Obtain and maintain favorable eligibility for the Tier background investigation.

8.11.5 Continuous Vetting (CV) for Positions of Trust. In accordance with the DoD Continuous Evaluation (CE) Program and Trusted Workforce 2.0, all personnel must comply with Continues Evaluation (CE) enrollment and re-enrollment requirements upon request to maintain their eligibility.

8.12 Controlled/Restricted Areas. The Contractor shall comply with local procedures for entry to all DoD/DHRA controlled or restricted areas where Contractor personnel will be working.

8.13 Physical Security. The Contractor shall safeguard all Government property and controlled forms provided for Contractor use and shall adhere to the Government property requirements outlined in this contract. At the conclusion of each workday, all Government facilities, equipment, and materials must be secured.

8.14 Pass and Identification Items. The Contractor shall ensure that all necessary passes and identification items required for contract performance are obtained for employees and non-government owned vehicles.

8.15 DoD Credentials/Common Access Card (CAC). Contractor personnel must comply with DODM 1000.13, DoD Identification (ID) Cards: ID Card Life-Cycle and Homeland Security Presidential Directive 12 (HSPD-12) Personal Identity Verification (PIV) issuance requirements when recurring physical access to federally and non-federally controlled facilities or logical access (e.g., DoD networks, CUI/PII data, IT/Information Systems) on behalf of the DoD is required. To Request access to DoD resources (such as DoD facilities, DoD IT/Information Systems), personnel must obtain a CAC or PIV and maintain a ready status. CAC Applicants supporting this contract must meet the following requirements:

8.15.1 Execute, and obtain/maintain a favorable FBI National Criminal History Check (fingerprint check).

8.15.2 Possess a Tier 3 or higher BI to meet the access or sensitivity requirements for the role or job.

8.15.3 Be prepared to provide two forms of identification (I-9 documents);

8.15.4 Provide proof of U.S. Citizenship.

8.16 Key Control/Access Badge Control. The Contractor shall establish and implement methods of making sure all keys/badges issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The Contractor shall not duplicate any keys issued by the Government.

8.16.1 Prohibited Use. The Contractor shall prohibit the use of keys issued by the Government by anyone other than the Contractor’s employees. Contractor employees shall not open locked areas to permit the entrance of anyone other than Contractor employees engaged in the performance of contract work requirements in those areas.

8.17 Conduct while on Government Installations. The Contractor shall not assign work or direct its employees to access government information, systems, or installations unless the employees possess and maintain the required background investigation, clearances, and authorizations.

8.18 Weapons, Firearms, and Ammunitions. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, either in their possession or within their contractor-owned vehicle or privately-owned vehicle, while on any government installation.

8.19 Reporting Requirements. The Contractor shall ensure their personnel are aware of the requirement to report to their supervisor and site security office any information or circumstance they are aware of that may pose a threat to the security of government or contractor personnel, resources, or information.

8.20 Government Furnished Equipment (GFE). The Contractor shall establish and implement procedures to protect Government Furnished Equipment (GFE), including laptops and data processing devices, from lost, misplacement, unauthorized use, and connection of unauthorized external devices. The Contractor shall report any lost GFE to the COR within two (2) hours of discovery. If GFE is lost, the Contracting Officer may direct the Contractor in writing to replace the equipment at no additional cost to the Government; otherwise, the Government may replace the equipment and deduct the cost from the Contractor’s monthly payment.

8.21 Lock Combinations. The Contractor shall control access to all government-provided lock combinations to prevent unauthorized entry. The Contractor is prohibited from recording lock combinations without the written approval of the COR. Records containing written lock combinations for authorized secure storage containers, secure storage rooms, or certified vaults shall be marked and safeguarded at the highest classification level of the classified material maintained within the approved containers.

8.22 Offboarding. Coordination with COR. The Contractor shall coordinate the removal of personnel from work under this contract with the COR upon any of the following occurrences: contract completion, personnel relocation, retirement, resignation, termination, inability to meet contract expectations, or violation of DHRA security policies. In addition, if any Contractor personnel supporting this contract are unable to obtain or maintain the required security clearance or eligibility, the Contractor shall immediately notify the COR. The Contractor shall remove the individual from roles performed under this contract and replace them with a qualified individual possessing the necessary knowledge, skills, and abilities (KSAs) to perform the services. When offboarding personnel, the Contractor shall:

8.22.1 Utilize DHRA’s employee termination checklists, and notification systems, ensuring all relevant parties are informed of the individual’s departure.

8.22.2 Retrieving Identification Media. The Contractor shall ensure that all identification media, including vehicle passes and credentials (e.g., CACs, badges, identification cards) is retrieved and returned to the COR, their local Installation Access Control Office, or the Government Security Office.

8.22.3 Ensure issued tokens are returned to the appropriate Certificate Authority (CA) or the respective issuing authority.

Provide an updated list of personnel to the COR within three (3) business days of any change.

9.0 Cybersecurity

9.1 The contractor shall execute all activities and tasks required to develop and maintain DoD systems and applications in accordance with DoD, DHRA, and DMDC, policies, directives, instructions, processes, procedures, and guidance. The Deputy Director, DHRA is the DHRA Chief Information Officer (CIO) and Authorizing Official (AO) for DHRA managed systems and applications. DMDC oversees IT system portfolio management and cybersecurity for the entire DHRA enterprise (including DHRA Headquarters and Components, Centers, and Offices) DMDC provides IT strategy, guidance, policy, oversight, and reporting for all DHRA systems.

9.2 Cyber Incident Reporting. In addition to DFARS 252.204-7012, the Contractor shall notify the DMDC Incident Response (IR) team by emailing an initial cyber incident report to dodhra.dodc-mb.dmdc.list.ir-team@mail.mil, the Contracting Officer, and the COR within one hour of discovering any cyber incident. The Contractor shall follow up with a supplemental report every 24 hours until the incident is closed.

9.3 Information System Security. The Contractor shall implement IS security protections that are appropriate for the confidentiality, integrity, and availability needs of the contract. The protections must include the administrative, technical, and physical safeguards necessary to protect all nonpublic Government data.

9.4 Risk Management Framework

9.4.1 All DoD IS or DOD information in electronic format must be authorized to operate by the Authorizing Official (AO) according to Department of Defense (DOD) Instruction (DoDI) 8510.01, Risk Management Framework (RMF) for DoD Systems. Contractors must directly support RMF authorization activities that are consistent with the principles established in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37.

9.4.2 Contractors supporting authorized systems must maintain their authority to operate and conduct RMF activities pertaining to all life cycle phases (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) to maintain compliance with RMF.

9.4.3 The Contractor shall support requirements to maintain current and achieve new Authorities to Operate (ATOs), Interim Authorization to Test (IATTs), Authorities to Connect (ATCs) for all IT systems using the DoD RMF.

9.4.4 The Contractor shall implement security controls in accordance with NIST SP 800-53 and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required. System categorization is performed by DMDC Cybersecurity Division (CSD) and adheres to the Committee on National Security Systems Instruction (CNSSI) 1253 requirements.

10.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/INFORMATION (GFP/GFE/GFI) The Contractor shall establish and implement procedures to ensure all GFE to include laptops and other data processing devices, issued to the Contractor by the Government are not lost or misplaced, are not used by unauthorized persons, and are not subject to unauthorized external devices. The Contractor shall immediately report to the COR any lost GFE within two (2) hours of discovery of occurrence. In the event that GFE is lost, the Contractor may be required, upon written direction of the Contracting Officer, to replace the equipment at no additional cost to the Government. The Government may replace the equipment and deduct the cost from the monthly payment due the Contractor.

11.0 PLACE OF PERFORMANCE

Place of Performance: The Contractor will work remote except for occasional visits to the Mark Center.

12.0 QUALITY CONTROL

The contractor shall implement and maintain a Quality Control Plan (QCP) to ensure work performed conforms to the scope of work and meets the requirements under this PWS. The QCP shall, at a minimum provide a method for performing inspections; identifying, correcting and preventing problems/defective service; addressing customer complaints, and improving the quality of services over the life of the contract.

13.0 QUALITY ASSURANCE

13.1. The Government reserves the right to perform inspections and surveillance to evaluate the Contractor’s compliance to the contract terms and performance of the requirements in the PWS.

13.2. Contract Discrepancy Report (CDR). In the event of unsatisfactory contractor performance, the COR or CO will issue a CDR that will explain the circumstances and findings concerning the incomplete or unsatisfactory service. The contractor shall acknowledge receipt of the CDR and respond in writing as to how he/she shall correct the unacceptable performance and avoid a recurrence. The Government will review the contractor's corrective action response to determine acceptability and will use any completed CDR as part of an overall evaluation of Contractor performance when determining present or future contractual actions.

14.0 ORGANIZATIONAL CONFLICTS OF INTEREST

The Contractor acknowledges that it is familiar with FAR Subpart 9.5, Organizational and Consultant Conflicts of Interest, and agrees to avoid, neutralize or mitigate such conflicts of interest in accordance with the principles set forth in the FAR. If the performance requires the Contractor (to include subcontractors) to supply technical support related to systems or projects with which the Contractor is already directly concerned, either by prime or subcontract, the Contractor shall immediately inform the Contracting Officer. The PWS may be withdrawn if a conflict is found. The Contractor shall not undertake performance of any PWS requirements which requires it to supply technical support regarding such systems until the notice is given, and written consent to proceed is issued by the Contracting Officer.

15.0 PERFORMANCE REQUIREMENT SUMMARY (PRS)

15.1 Purpose. The PRS lists performance objectives for the required services the Government will surveil. The absence of any contract requirement from the PRS shall not detract from its enforceability nor limit the rights or remedies of the Government under any other provision of the contract including the clauses entitled “Inspection of Services” or “Inspection” or “Default” in the contract.

15.2 Components. The PRS states the performance objective (required service), and threshold (performance standard, accept and reject points (if applicable)) in either a qualitative or quantitative fashion for each critical success factor.

Paragraph Performance Threshold/Acceptable Quality Level

a) There is no more than one late delivery per month; and

b) critical information is accurate

17.0 Mandatory Training Requirements:

Contractor employees performing under this contract shall complete the following mandatory trainings within 30 calendar days of reporting for duty and annually thereafter when applicable. Refer to the COR/Government point of contact for the websites/links to the specific training identified below. They will provide a sheet with the Mandatory Training Website/links. The Contractor shall provide a copy of its employee(s)’ training certificates to the COR/Government point of contact to meet the mandatory training requirements.

1. OPSEC Awareness for Military Members, DoD Employees and Contractors IAW DoDM 5205.02, “DoD Operations Security (OPSEC) Program Manual”, dated October 29, 2020.

1. Unauthorized Disclosure of Classified Information and Controlled Unclassified Information IAW DoDI 5200.48, “Controlled Unclassified…