CUI A 04.01 Performance Work Statement Final Attachement 1 -Updated.pdf

PERFORMANCE WORK STATEMENT (PWS)

Identification Card Administration (ICA) support services in support of Puget Sound Naval Shipyard and Intermediate Maintenance Facility (PSNS & IMF)

PART 1

GENERA L INFORMATION

1. GENERAL: This is a non-personnel services contract to provide Identification Card Administration (ICA) support services. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform ICA support services as defined in this performance work statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background: The Department of Defense (DoD) provides federal employees and members of the uniformed services with a distinct identification (ID) card identifying them as Regular Armed Forces, Guard, Reserve, retired members, or DoD Civilian, and authorizing them to receive uniformed services benefits and privileges. DoD also authorizes a distinct ID card to eligible family members, including issuance to same-sex marriage spouses and their children and other qualifying individuals entitled to receive uniformed services benefits and privileges. ICA support services are required for all Puget Sound Naval Shipyard and Intermediate Maintenance Facility (PSNS & IMF) site access. The ICA Program services over 5,000 customers annually. Primary policy and procedural direction is BUPERSINST 1750.10D, which provides the overall rules and regulations for ICA processes and procedures.

1.3 Objectives: The objective is to provide ICA support for PSNS & IMF and naval ships and submarine project employees (including ship’s force) at Defense Enrollment Eligibility Reporting System (DEERS) and Real-time Automated Personnel Identification System (RAPIDS) sites inside the controlled industrial Area (CIA) of Naval Base Kitsap-Bremerton, Washington.

1.4 Scope: The contractor shall provide ICA support services at PSNS & IMF by verifying the identity and eligibility of authorized DoD beneficiaries, issuing DoD ID cards, and performing DEERS updates in accordance (IAW) with DoD regulations, BUPERSINST 1750.10D, and AFI 36-3026. RAPIDS facilities with on-line access to DEERS shall issue common access cards (CAC) with and without the chip, volunteer logical access card (VoLAC), and DD forms authorized by DoD instructions for eligible sponsors and beneficiaries when they are not otherwise restricted by the system, and they: (1) are enrolled in DEERS, or;

(2) are not enrolled in DEERS but provide legal documentation to establish eligibility; or (3) provide a properly verified DD 1172-2 Application for Identification Card/DEERS Enrollment from the sponsor's parent uniformed service or DoD agency RAPIDS facility.

1.5 Period of Performance: The base period of performance for this requirement is 28 February 2022 through 27 February 2023.

following the base period.

The resultant contract will feature four 1-year option periods consecutively The period of performance reads as follows:

Base Year Option Year I Option Year II Option Year III Option Year IV

28 FEB 2022 – 27 FEB 2023

28 FEB 2023 – 27 FEB 2024

28 FEB 2024 – 27 FEB 2025

28 FEB 2025 – 27 FEB 2026

28 FEB 2026 – 27 FEB 2027

1.6 General Information

1.6.1 Quality Control: The contractor maintains an effective quality control program (QCP) to ensure services are performed IAW this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s QCP is the means by which they ensure themselves that their work complies with the requirement of the contract.

1.6.2 Quality Assurance: The government shall evaluate the contractor’s performance under this contract IAW the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure the contractor has performed IAW the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays: The contractor is not required to perform services on holidays.

New Year’s Day Martin Luther King Jr.’s Birthday President’s Day Memorial Day Juneteenth Independence Day

Labor Day Columbus Day Veteran’s Day Thanksgiving Day Christmas Day

1.6.4 Hours of Operation: The contractor is responsible for conducting business between the hours of 0700

- 1530 Monday through Friday, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government -directed facility closings.

The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.5 Place of Performance: The work to be performed under this contract will be performed at Puget Sound Naval Shipyard and Intermediate Maintenance Facility; 1400 Farragut Avenue Bremerton, WA 98314; Building 445 (within the controlled industrial area). Although not anticipated, future site changes may occur. There will be no modifications to the contract for site changes within a commuting distance of 50 miles or less.

1.6.6 Type of Contract: The government will award a Firm-Fixed Price type contract.

1.6.7 Security Requirements: Contractor personnel performing work under this contract must have a National Agency Check (NAC) with Law and Credit (NACLC)/T3/T3R at time of the proposal submission, and must maintain the level of security required for the life of the contract. The security requirements are IAW the attached DD 254 and Naval Base Kitsap (NBK) and/or PSNS & IMF Controlled Industrial Area (CIA) Access (Attachment 5).

1.6.7.1 ACCESS TO DOD INFORMATION TECHNOLOGY (IT) SYSTEM

IAW Department of the Navy Chief Information Officer Memorandum for the Record of 8 September 2020 (IT Level Designation on DD 2875 System Authorization Access Request), SECNAVINST 5510.30C (Department of the Navy Personnel Security Program), and SECNAV M-5239.2 (Department of the Navy Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual), contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III.

The IT-II level includes positions which require access to sensitive information. Sensitive information includes information protected under the Privacy Act, to include protected health information. All contractor employees under this contract who require access to Privacy Act-protected information are therefore categorized no lower than IT-II. IT levels are determined by the requiring activity's command Information System Security Manager (ISSM) or Information Assurance Manager (IAM).

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check (NAC) with Law and Credit

(NACLC), T3, or T3R described above. Due to the privileged system access, a T3, T3R, NACLC, or Access National Agency Check with Written Inquiries + Credit Check (ANACI) investigation is required.

Individuals who have access to system control, monitoring, or administration functions (e.g., system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and shall be trained and certified on the operating system or computing environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in process with the Navy Activity Security Manager (ASM) and ISSM or IAM upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy IT resources. The decision to authorize access to a government IT system or network is approved by the Government authority. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system or network access required or the COR shall sign the SAAR-N as the supervisor.

When required to maintain access to required IT systems or networks, the contractor shall ensure all employees requiring access complete annual cyber awareness training, and maintain a current requisite background investigation. The contractor's security representative (CSR) shall contact the ASM for guidance when reinvestigations are required.

1.6.7.1.1 INTERIM ACCESS

The ASM may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer or network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of their responsibility to perform.

1.6.7.1.2 DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this action, including denial or termination of physical or system access, in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this requirement in all subcontracts when the subcontractor is permitted to have unclassified access to a federally-controlled facility, to a federally-controlled information system or network, or to government information (i.e., information not authorized for public release).

1.6.7.1.3 CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the CSR. Within three (3) workdays after contract award, the contractor shall provide the CSR’s name, title, address and phone number to the requiring ASM and the KO in writing. The CSR shall be the primary point of contact on any security matter. The CSR shall not be replaced or removed without prior notice to the KO and ASM.

1.6.7.1.4 BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL

PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR

PERFORMING SENSITIVE DUTIES

Navy security policy requires all positions be given a sensitivity value based on level of risk fact ors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as noncritical sensitive [automated data processing IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and PHI, provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a United States (U.S.) citizen and have a favorably completed NACLC, T3, or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-

II position, at the time of award. The investigation consists of a standard NAC and Federal Bureau of Investigation (FBI) fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

- SF-86 Questionnaire for National Security Positions (or equivalent Office of Personnel Management (OPM) investigative product).

- Electronic fingerprint submission.

- Original signed release statements.

Failure to provide the required documentation at award of the contract shall result in delaying the individual's start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The CSR shall contact the ASM for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements, ALL contractor employees shall in process with the ASM upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Employees requiring IT access shall also check-in and check-out with the ISSM or IAM. Completion and approval of a SAAR-N is required for all individuals accessing Navy IT resources.

The contractor shall ensure each contract employee requiring access to IT systems or networks complete annual cyber awareness training and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the ASM. The ASM will review the submitted documentation for completeness prior to submitting it to OPM; potential suitability or security issues identified may render the contractor employee ineligible for the assignment.

An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The ASM will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Consolidated Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Defense Information Security System (DISS) (or its successor system) or a hard copy VAR directly from the CSR. Although the contractor will take DISS owning role over the contractor employee, the Navy command will take DISS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT position category per SECNAV M-5239.2 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee's performance under the contract.

1.6.7.2 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information, and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.6.7.2.1 The contractor shall comply with all federal, state, and local security statutes, regulations, and requirements. The contractor shall become acquainted with and comply with all Government regulations as posted, or as requested by the COR when required to enter a Government site.

1.6.7.2.2. Employee Listing. The contractor shall maintain and provide a current listing of employees upon request.

The list shall include the employee’s name and level of security eligibility, and be provided to the COR or alternate COR (ACOR) within one calendar day of the request.

1.6.7.2.3. Access Arrangements. The contractor shall contact the COR at contract award to obtain access to buildings, facilities, and other work areas, and when necessary, arrange for them to be opened and closed by the controlling authority’s site representative.

1.6.7.2.4. The Government may issue keys including credentials or access tokens to the contractor. The contractor shall use due diligence and be responsible for compromised security systems to include replacement costs that result from its action or inaction.

1.6.7.2.5. The contractor shall comply with all local security policies established at each work location.

1.6.7.2.6. Access to Buildings. The contractor shall monitor and control access into ID card facilities, allowing only those individuals who have been properly cleared into controlled areas or other restricted access areas.

The contractor shall comply with security requirements, plus those imposed by the controlling authority at all times. Personnel with access to special areas will have the appropriate screening or security clearance, and personnel requiring routine access to restricted areas will wear special badges authorizing access for those areas. Contractor personnel shall not enter restricted or controlled areas or installation facilities unless specifically authorized in performance of their duties. The contractor shall secure all buildings and facilities under the contractor’s cognizance.

1.6.7.2.7. Key Control. The contractor shall establish and implement methods of ensuring keys including credentials or access tokens issued by the Government for contractor employee use are not lost or misplaced and are not used by unauthorized persons. Immediately report to the government representative onsite any occurrences of loss, unauthorized use, or unauthorized duplication of keys. In the event keys (other than master keys) are lost or duplicated, the contractor may be required, upon written direction of the COR or ACOR, to re-key or replace the affected lock or locks without cost to the Government. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced at contractor expense. The contractor shall control access to all Government-provided lock combinations to preclude unauthorized entry. Contractor employees shall surrender keys including credentials and access tokens when leaving employment.

1.6.7.2.8. The contractor shall establish and implement methods for controlling contractor employee credential or access tokens (e.g., keycards, combos, biometric scanners, retinal scanners) that are management information systems-controlled. The contractor shall interface with the system administrators to preclude unauthorized entry, and remove contractor employees when leaving employment. For systems under contractor control, the contractor shall preclude unauthorized entry, and remove contractor employees when leaving employment.

1.6.7.2.9. Background Checks. The contractor shall submit an OPNAV 5239/14 System Authorization Access Request Navy (SAAR-N) and a DD 2875, for each employee requiring access to DoD systems and information to a government representative prior to beginning work. Government validation of each SAAR and completion of government-furnished information assurance training is required prior to accessing DoD systems and information.

1.6.7.2.10. The contractor shall be responsible for processing administrative actions to initiate government security vetting and SAAR completion for its personnel.

1.6.7.2.11. The contractor shall be responsible for processing requests for background checks, clearances, and SAARs for its personnel.

1.6.7.2.12. Not Applicable

1.6.7.2.13. Damage Reporting. The contractor shall submit to the COR or ACOR in the manner and on the forms prescribed by the Government all damage to Government property by contractor employees.

1.6.7.2.14. Fire Protection. The contractor shall know where fire alarms are located and how to activate them. The contractor shall handle and store all combustible supplies, materials, waste, and trash in a manner that prevents fire or hazards to persons, facilities, and materials.

1.6.7.2.15. Disposal. The contractor shall dispose of debris and rubbish resulting from the work under this contract after determined to be non-usable and non-recyclable in authorized receptacles.

1.6.7.2.16. Privacy Act Information. The contractor personnel shall provide safeguards for the protection of records and personal information per Chapter 5, Section 552a of Public Law 93-579, The Privacy Act of 1974.

1.6.7.2.17. Safeguarding Information. The contractor personnel, as a custodian of DEERS records, shall be responsible for safeguarding said records from loss and unauthorized disclosures while under the contractor’s custody or control. Provisions for reasonable care include responsibility for opening working spaces and files at the commencement of duty hours and for locking these working spaces and files at the close of business.

1.6.7.2.18. The contractor personnel shall secure and dispose of identification card stock and consumables IAW BUPERSINST 1750.10, RAPIDS User Guide, and all DoD policies, instructions, and guidance.

1.6.7.2.19. The contractor personnel shall report to the designated information assurance officer (IAO), service project office (SPO), or manager any attempt to gain unauthorized access to sensitive information, any system failure, or any suspected defect that could lead to the unauthorized disclosure of sensitive information.

1.6.7.2.20. The service provider shall report suspected (or actual) security violations or practices dangerous to security to the site IAO and SPO.

1.6.8 Minimum Qualifications:

1.6.8.1. Proficient in both oral and written communication in order to communicate effectively with others and explain complex actions taken in regards to military members entitlements, allowances, and collections.

1.6.8.2. Working knowledge of Microsoft Office products; e.g., Word, Excel, PowerPoint.

1.6.8.3. Working knowledge of grammar, spelling, capitalization, punctuation, and military terminology commonly used within office settings to prepare material correctly.

1.6.8.4. Working knowledge of standard office equipment such as computers, electric typewriters, copiers, printers, fax machines, scanners, and other office automation systems to perform a substantial range of office automation support. A fully qualified typist is not required.

1.6.8.5. Minimum of one (1) year experience in a customer service environment.

1.6.9 Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office IAW Federal Acquisition Regulation Subpart 42.5. The KO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings, the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues.

1.6.10 Contracting Officer Representative (COR): The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: ensure the contractor performs the technical requirements of the contract, perform inspections necessary in connection with contract performance, maintain written and oral communications with the contractor concerning technical aspects of the contract, issue written interpretations of technical requirements (including Government drawings, designs, or specifications), monitor contractor's performance and notifies both the KO and contractor of any deficiencies, coordinate availability of government-furnished property, and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price and estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.11 Key Personnel. The following personnel are considered key personnel by the government:

- (1) Contract Manager. The contractor shall provide a contract manager who shall be responsible for ensuring the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the KO. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 0700 - 1530 Pacific Standard Time, Monday through Friday, except Federal holidays or when the government facility is closed for administrative reasons.

- (2) Site Security Managers (SSM). The SSM shall manage the daily operations at a RAPIDS site to include managing users, card stock, and consumables. The Contract Manager shall assign a primary and secondary SSM to ensure the site continues to function in the absence of one of the SSMs. The SSM shall perform all responsibilities of a RAPIDS user verifying officer (VO), as well as all SSM responsibilities of disseminating program information on ICA policies and procedures, preparing and providing reports, and executing the quality control program. They will serve as point of contact (POC) for the COR when addressing and resolving day-to-day performance and quality issues. The SSM’s shall be available between 0700 - 1530 Pacific Standard Time, Monday through Friday, except Federal holidays or when the government facility is closed for administrative reasons.

1.6.11.1 Qualifications for all key personnel: general experience in project management, data analysis, financial analysis, marketing and public affairs, organizational management, and business process improvement.

1.6.12 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contractor personnel will be required to obtain and wear security badges that are clearly visible at all times in the performance of this service.

1.6.13 Other Direct Costs: Not Applicable

1.6.14 Data Rights (If applicable): The Government has unlimited rights to all documents and material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government-owned and are the property of the Government with all rights and privileges of ownership and copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the KO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.6.15 Phase In /Phase Out Period: Not Applicable

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.2. CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.3. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.5. DELIVERA BLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.6. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the personnel listed in the PWS. When management personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.7. PHYSICA L SECURITY. Actions that prevent the loss or damage of Government property.

2.1.8. QUALITY ASSURANCE. The government procedures to verify that services being performed by the contractor are performed according to acceptable standards.

2.1.9. QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.10. QUALITY CONTROL. All necessary measures taken by the contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.11. SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.12. WORK DAY. The number of hours per day the contractor provides services IAW the contract.

2.1.13. WORK WEEK. Monday through Friday, unless specified otherwise.

2.2. ACRONYMS:

ACOR

CFR

CONUS

COR

Alternate Contracting Officer's Representative Code of Federal Regulations Continental United States (excludes Alaska and Hawaii) Contracting Officer Representative

DD254

DEERS

DFARS

DMDC

DOD

FAR

HSPD

IAO

ICE

ID

KO

NACI

NMPS

NKO

NMCI

NSIPS

OPINS

PIN

PIPO

POC

PRS

PWS

QA

QAP

QASP

QC

QCP

RAPID

S SAAR

SOP

SSM

SVO

TA

TE

USID

VO

VIOS

WBT

Department of Defense Contract Security Requirement List Defense Enrollment Eligibility Reporting System Defense Federal Acquisition Regulation Supplement Defense Manpower Data Center Department of Defense Federal Acquisition Regulation Homeland Security Presidential Directive Information Assurance Officer Interactive Customer Evaluations Identification Contracting Officer National Agency Check with Inquiries Navy Mobilization Processing Sites Navy Knowledge Online Navy and Marine Corps Internet Navy Standard Integrated Personnel System Officer Personnel Information System Personal Identification Number Phase In/Phase Out Point of Contact Performance Requirements Summary Performance Work Statement Quality Assurance Quality Assurance Program Quality Assurance Surveillance Plan Quality Control Quality Control Program Real-time Automated Personnel Identification System System Authorization Access Request Standard Operating Procedures Site Security Manager Super Verifying Official Technical Assistant (Government Representative onsite) Technical Exhibit Uniform Services ID Verifying Official Verifying Official Information System Web-Based Training

PART 3

GOVERNM ENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNIS HED ITEMS AND SERVICES:

3.1. Services: The Government will provide technical libraries, which generally consist of reference material, instructions, standard operating Procedures (SOP), etc. that will be electronically available.

3.1.1. Mailing Services: The Government will furnish mail and shipping service for items related to the performance of the ICA function.

3.1.2. Training: The contractor shall provide personnel who meet the minimum qualifications and criteria identified by this contract. However, where the necessary training is limited to a Navy -specific course of instruction (versus a commercially available course of instruction such as Information Assurance, etc.) the Government will furnish training. Government-furnished training is limited to onsite or online training requirements.

3.1.3. The Government will furnish onsite or online initial and refresher training to satisfy mandated training requirements, which include, but are not limited to, Information Assurance, Privacy Act, Security, Safety, Antiterrorism, Hazardous Material (HAZMAT), etc.

3.1.4. Security: The Government will furnish the contractor workforce with a Tier 3 investigation or equivalent.

3.2 Facilities: The Government will provide access to two office spaces, within the current site, with room for one contracted employee and one customer (per office), workspace, and furnishings at a Government site. The Government will furnish local, Defense Switched Network (DSN), and long distance telephone service onsite for direct performance of the task order. The Government will also provide access to computers, terminals, common use software, communications networks, and other resources owned or leased and operated by the Government. The contractor is responsible for providing non-government off-site parking solutions to contracted employees.

3.3 Utilities: The Government will provide adequate heating, ventilation, and air conditioning, electrical, and water as required for occupancy. Building zone managers will provide customer service to obtain repair and construction services as required to sustain occupancy of the government -owned facilities. The contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount to accomplish cleaning equipment.

3.4 Equipment: The Government will provide RAPIDS Components: The Government will furnish one equipment associated with the RAPIDS suite in each of the two spaces which includes, but is not limited to, a computer, printer with lamination unit, fingerprint reader, camera with stand, personal identification number (PIN) pad, smart card reader and encoder, document scanner, printer, copier, and surge protector.

3.4.1. NMCI Computers and Peripherals: The Government will provide access to NMCI computers and peripherals in order to access various Navy management information systems or successor systems (e.g., Navy Knowledge Online (NKO).]

3.5 Materials: The Government will provide, and automatically replenish, all consumables necessary to produce CACs. This includes CAC card stock, lamination materials, transfer film, color ribbon, CAC printer cleaning kits, and other related consumables, such as printer paper. The service project shall coordinate emergency shipments through the SPO.

3.5.1. The Government will furnish and replenish all consumables necessary to produce non -CAC ID cards.

This may include card stock, lamination materials, toner cartridges, printer paper, and other related consumables as applicable. The contractor shall request card stock and laminate, through the designated government representative (DGR). The contractor shall secure card stock and laminate not in use under lock when the office is closed or unattended.

3.5.2. Common Access Card: The Government will furnish CACs to eligible contractor employees. The CAC is the property of the U.S. Government. The contractor shall ensure all employee CACs are returned to the Trusted Associate Sponsorship System (TASS) upon end of contract or termination of an employee.

3.5.3. Uniformed Service Identification (USID) card stock: The Government will furnish USID card stock obtained through the normal Navy supply channels.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1 General: The contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Section 3 of this PWS.

4.2 Secret Facility Clearance: The contractor shall possess, and maintain a SECRET facility clearance from the Defense Security Service. The contractor’s employees, performing work in support of this contract shall have been granted a SECRET security clearance from the Defense Industrial Security Clearance Office at award. The DD 254 is provided as Attachment 4.

4.3. Materials: The contractor shall maintain and order all consumables, perform user maintenance, and support DMDC hardware and software maintenance necessary to meet the requirements under this PWS.

4.4. Equipment: The contractor shall maintain RAPIDS equipment IAW DMDC guidance to meet the requirements under this PWS. The contractor shall contact DMDC for any hardware or software changes or upgrades. Hardware upgrades and maintenance replacements will be provided by DMDC and the contractor may be responsible for component setup. These components include, but are not limited to, computers, printers, cameras, and monitors. The service provider shall provide troubleshooting assistance and component replacements as directed by DMDC Support Center User Help desk and associated hardware, software or training vendors.

4.4.1 Software updates will be provided through a system push by DMDC. Such updates would include but not be limited to Information Assurance Vulnerability Bulletin (IAVB), Information Assurance Vulnerability Alert (IAVA), and software patches and updates.

PART 5

SPECIFIC TASKS

5. SPECIFIC TASKS:

5.1. Basic Services: The contractor shall provide services for Identification Card Administration as detailed in para. 5.1 Through 5.1.2.11. Average ICA CAC replacements for two operating systems is 5,000 replacements per year. Customers will be acknowledged within 60 seconds of arrival and advised where to wait. Scheduled ICA replacement appointments will result in completed products within 20 minutes (on average). Unscheduled services such as PIN or certificate resets will be addressed between scheduled appointments and on average within 15 minutes of beginning the transaction.

5.1.1. Process CACs IAW DoD regulations and AFI 36-3026. The contractor is responsible for the issuance and strict control of armed forces identification and privilege cards for all eligible personnel (e.g., active duty military, verified command personnel, and verified contractors).

5.1.1.1.1. “Process” includes determining eligibility, issuing and retrieving or returning CACs as applicable, and issuing and retrieving or destroying non-CAC ID cards as applicable.

5.1.1.1.2 Any authorized Uniformed Service personnel office or ID card-issuing facility with on line access to the DEERS shall, on presentation of the required documentation or verification through the DEERS, verify and issue CACs to eligible recipients IAW DoDI 1000.13.

5.1.1.1.3. Serve as a Verifying Official on DEERS or RAPIDS terminal and ensure inputted data for accuracy and correctness.

5.1.1.1.4. Assist customers with questions concerning identification card eligibility, application requirements, and DEERS, and answer telephone inquiries.

5.1.1.2. All failed or retrieved CACs shall be returned to DMDC within per DMDC requirements.

5.1.1.3. Verify and update customer personnel data IAW DoD, Office of the Chief of Naval Operations (OPNAV), Bureau of Naval Personnel (BUPERS), and other references, instructions, directives, and policy.

5.1.1.4. Not Applicable

5.1.1.5. Perform customer services to include, but not limited to, PIN resets, verifying and updating public key infrastructure certificates, etc.

5.1.1.6. Ensure DEERS or recruit DEERS updates are performed as soon as possible.

5.1.1.6.1. Verify and update customer personnel data IAW DoD, OPNAV, BUPERS, the most current RAPIDS Users Guide, and other references, instructions, directives, and policy.

5.1.1.6.2. Update DEERS information IAW the RAPIDS User Guide, BUPERSINST 1750.10C, and DoDI 1000.13.

5.1.1.7. Provide ICA services as necessary to ensure the distribution and retrieval of identification cards, to include updating customer information in DEERS.

5.1.1.8. Initiate CAC requests and distribute CACs and PINs upon receipt.

5.1.1.8.1 Initiate CAC requests and distribute CACs and PINs IAW the RAPIDS User Guide.

5.1.1.9. Verify the identity and eligibility of authorized Do D beneficiaries, issue DoD ID cards, and perform DEERS updates IAW DoD regulations and AFI 36-3026.

5.1.1.10. Verify identification IAW Homeland Security Presidential Directive 12 (HSPD12) and Federal Information Processing Standards FIPS201-1.

5.1.1.11. Provide ID card services to all personnel assigned to support customer commands, other military service personnel, and contractors verified through TASS.

5.1.1.12. All customers must be acknowledged verbally within 60 seconds of arrival.

5.1.1.13. Personnel shall verbally encourage all customers to submit feedback and ensure all customers are provided with the website, phone number, and other necessary information to access the program’s customer feedback systems.

5.1.1.14. Ensure the COR is immediately notified of any unauthorized or unsafe acts, regardless of the rank or position of the person who performed the unauthorized or unsafe act.

5.1.1.15. Maintain RAPIDS equipment within the physical parameters and configurations established at the time of installation. Relocation of RAPIDS equipment without prior approval of the COR is not permitted.

All RAPIDS equipment shall be treated as high dollar value items IAW the Security SOP. During duty hours and when RAPIDS equipment is processing, transmitting, receiving, or printing sensitive material, an authorized user shall maintain positive control of the system. When the workstation is unattended, the user must remove their CAC from the smart card reader or encoder to lock the workstation prohibiting any RAPIDS activity. Because of the Privacy Act data, access to or view of the RAPIDS screen is restricted to authorized individuals with a need-to-know.

5.1.1.16. Perform printer maintenance as stated in the Maintenance and Cleaning Procedures, located in the Verifying Officials Information System. Perform user maintenance on RAPIDS equipment.

5.1.2 Program Management

5.1.2.1. Implement work control procedures to permit tracking and reporting of work in progress. Status reports shall be provided when requested by the COR or ACOR. A written status report of any item of work must be provided within three (3) workdays of the request.

5.1.2.2. Provide a minimum of two (primary and alternate) SSMs for each RAPIDS site.

5.1.2.3. Verify employment eligibility and identity of all employees or representatives who will perform these support services. The contractor shall complete Department of Homeland Security U.S. Citizenship and Immigration Services Form I-9 Employment Eligibility Verification prior to any contractor employee or representative beginning work. All contractor employees shall be U.S. citizens due to personally identifiable information (PII) access requirements.

5.1.2.4. Ensure all unvetted contractor staff personnel submit a Tier 3 investigation or equivalent investigation (as determined by the Government). Contract staff performing as VO or SSM must be U.S.

citizens. U.S. citizens may be granted access to RAPIDS if the security investigation has been initiated through OPM IAW DoD Regulation 5200.2-R. Contractors assuming roles as SSM or alternate SSM must have a favorable Tier 3 or equivalent determination before performing those duties.

5.1.2.5. Develop a site-specific continuity of operations plan (COOP) IAW the Security SOP for RAPIDS and submit to the COR and KO within 90 days of contract award. A locally prepared COOP shall be maintained to ensure a quick return to operation after a system failure or other unplanned outage. The SSM shall contact the host command to ensure RAPIDS is included in local disaster recovery plans.

5.1.2.6. Ensure all personnel obtain and maintain all required DoD online training and appropriate certifications for operating DEERS or RAPIDS.

5.1.2.7. Maintain a training plan that ensures all required certifications and records are up to date and available for inspection upon request by the DGR. Required certifications are:

5.1.2.7.1. DEERS and RAPIDS. Contractor personnel shall successfully complete and retain web-based training certification for all RAPIDS and affiliated applications as required.

5.1.2.7.2. Personally Identifiable Information Training. Contractor personnel shall successfully complete the online training “What you need to know about protecting Personally Identifiable Information (PII)” located at http://iase.disa.mil/eta.

5.1.2.7.3. Cyber Awareness: Contractor personnel shall complete the online training found at http://iase.disa.mil/eta

5.1.2.7.4. Support scheduled and unscheduled outside inspections, audits, and assessments that may be conducted by DMDC or the Navy Project Office.

5.1.2.8. The contractor shall conduct a joint facilities and equipment condition inventory annually. Damage (other than fair wear and tear), that was nonexistent at the time of the performance start date or facilities possession date, shall be documented and signed by the contractor with a copy sent to the COR or ACOR.

5.1.2.9. The Contractor shall submit a monthly report to the COR and KO t racking performance measures of the PWS to include service downtime, outages, issues, customer wait times, and abandonment rates.

5.1.2.10. Not Applicable

http://iase.disa.mil/eta http://iase.disa.mil/eta

5.1.2.11. QC Inspections: establish and maintain an inspection system to ensure work performed conforms to the contract requirements. The contractor shall maintain a file of all scheduled and performed QC inspections, inspection results, and dates with details of corrective and preventive actions. The file shall be the property of the Government and made available at all times during the Government’s regular working hours.

PART 6

APPLICABLE PUBLICATIONS

6. APPLICABLE PUBLICATIONS (CURRENT EDITIONS):

6.1. The contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures. Applicable DoD, Secretary of the Navy (SECNAV), OPNAV, and other instructions, directives, and references are listed below. The contractor shall comply with the most current version of all instructions, directives, and reference requirements as they apply to the services covered by this specification. This is not intended as a complete list of instructions, directives, and references. The contractor shall comply with applicable law in the performance of this contract.

- Homeland Security Presidential Directive-12 (HSPD-12) of 27 August 2004, Policies for a Common Identification Standard for Federal Employees and Contractors DoD Instruction 1000.13 of 23 January 2014, Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and Other Eligible Individuals DoD Manual 1000.13 Volume 1 of 23 January 2014, DoD Identification (ID) Cards: ID Card Life- Cycle DoD Manual 1000.13 Volume 2 of 23 January 2014, DoD Identification (ID) Cards: Benefits For Members Of The Uniformed Services, Their Dependents, And Other Eligible Individuals DoD Instruction 5200.46 of 9 September 2014, DoD Investigative and Adjudicative Guidance for Issuing the Common Access Card (CAC) AFI 36-3026 Volume 1 of 4 August 2017 AFI 36-3026 Volume 2 of 17 May 2018 Verifying Officials Information System (https://vois.dmdc.osd.mil/appj/vois/)

PART 7

ATTACHMENT/TECHNICAL EXHIBIT LISTING

7. ATTACHMENT/ TECHNICAL EXHIBIT LIST:

7.1 Attachment 1/Technical Exhibit 1 – Performance Requirements Summary:

7.2. Attachment 2/Technical Exhibit 2 – Deliverables Schedule:

7.3 Attachment 3/Technical Exhibit 3 – Estimated Workload Data:

7.4 Attachment 4 – DD 254

TECHNICAL EXHIB IT 1

Performance Requirements Summary The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Objective Standard Performance Threshold Method of Surveillance

PRS # 1.

Provide services for Identification Card Administration. See 1.0-1.4 and 5.1.

Monthly Performance Metric Report and Customer Observation and Trends (COAT) Report.

All customers must be acknowledged verbally within 60 seconds of arrival.

Issue and wait time shall not exceed 30 minutes 80% of the time, 45 minutes 90% of the time, and 60 minutes 95% of the time.

All customers are issued the proper ID card and privileges 100% of the time.

Monthly DMDC Reports

Daily ICE comments from https://ice.disa.mil/

PRS # 2

Process CACs IAW DoD regulations and AFI 36-3026. See 5.1.1.

The contractor provided format No more than a 1% adjusted CAC issuance error rate per month by site.

Corrective actions that can be accomplished onsite must be completed within 1 workday.

Corrective actions to all errors requiring external assistance (e.g., SPO, DMDC) must be identified to the responsible external authority within 1 workday.

Monthly QC Inspections

PRS # 3

Update DEERS information IAW the RAPIDS User Guide and serve as a Verifying Official on DEERS or RAPIDS terminal and ensure inputted data for accuracy and correctness. See 5.1.1.6.2.

The contractor provided format All DEERS updates are accurately entered 100% of the time.

(Monthly QC Inspections.)

PRS # 4

Assist customers with questions concerning identification card eligibility, application requirements, and DEERS, and answer telephone inquiries. See 5.1.1.1.4.

The contractor provided format Update or wait time shall not exceed…