DRAFT_PWS.docx

Performance Work Statement (PWS)

1.0 INTRODUCTION

The Defense Human Resource Activity/Enterprise Operations Center (DEOC)/ Contracting Directorate (PK) requires Source Selection Evaluation desktop software license and facilitation support for Source Selection Evaluation Boards (SSEBs). The period of performance will be one year from date of contract award, with four 12-month option periods.

DHRA Enterprise Operations Center (DEOC) Contracting Directorate (PK) requires acquisition source selection hardware, software and facilitation services to ensure accurate, effective and Federal Acquisition Regulation (FAR) and Defense Federal Acquisition Regulation Supplement (DFARS) compliant Technical Evaluation Board reviews are being held for competitive acquisition requirements.

2.0 BACKGROUND

PK provides professional acquisition support to the Defense Human Resources Activity. PK has utilized the FEDSELECT desktop application software since 2010. CACI has provided the selection software as well as facilitation services under contract H98210-15-F-0049.

3.0 SCOPE The Contractor shall provide the personnel, management and materials necessary to provide the Government Source Selection laptop computers, automation software & supporting IT infrastructure, personnel access and use of the application, allow for document downloads, and for file application sharing over a local area network.

4.0 REQUIREMENTS The Contractor shall:

4.4 Provide user training for the application.

All relevant training material will be provided to the Government within 20 work days of contract award.

4.5 Maintenance and help desk support during each source selection period.

Must be able to troubleshoot software and coordinate technical support within 24-hours of reported software discrepancies.

4.6 Provide facilitation and technical support services during PK’s SSEB’S.

The software application used by the Contractor shall meet, at a minimum, the following functionality and performance objectives: Provide facilitation of evaluation services utilizing an application to permit evaluators and other authorized personnel to review shared documents and to provide individual comments.

4.6.1 Workflow design, which ensures DHRA PK source selection evaluation process adherence and integrity.

· Standardized templates for developing and recording individual evaluations and the exchange process.

· Allow designated individual(s) the capability to consolidate all individual evaluations/comments.

· Application set-up and configuration routines, which ensure efficient and responsive loading of DHRA PK evaluation criteria and standards. Set-up will ensure accuracy, consistency, and inter-relationship between all acquisition-related documentation and the web-based consolidated document coordination application.

· DHRA PK evaluation criteria and standards are derived from the following documents. These documents must be uploaded to the application accessible to the evaluation team at all times:

· Solicitation (Request for Proposal {RFP}, amendments to RFP, and attachments)

· Source Selection Plan

· Efficient collaboration, data sharing and progress reporting features for evaluators and source selection management (e.g., internal questions and answers, evaluator progress monitoring and reporting, etc.)

· Provide source selection support, caucus facilitation (group consensus), and software assistance with the collection, distribution and compilation of any source selection evaluation documents. The facilitator must create a final source selection evaluation board report from source selection software in a Microsoft word format.

4.7 Maintain procurement integrity in accordance with (IAW) FAR 3.104. Information for each source selection evaluation shall be considered “Source Selection Information” as defined by FAR 2.101 and shall be protected. The Source Selection Information shall be accessible only by PK staff and the members of the specific evaluation team associated with that evaluation, as designated by the Source Selection Plan or Contracting Officer. All, Source Selection Information shall be marked IAW with FAR, “Source Selection Information – See FAR 2.101 and 3.104”.

· The Technical evaluation team must only have access to the technical and past performance volumes of the proposal. The Contractor facilitator will assist with past performance evaluations, however the Contractor facilitator will not be privy to an offeror’s proprietary information.

· In accordance with FAR 52.203-16 Preventing Personal Conflicts of Interest, contractor shall provide signed Non-Disclosure and Conflicts of Interest Agreement and Self Certifications.

· At the conclusion of each SSEB, the laptops shall be wiped cleaned of all data.

4.8 Participate in a Post-Award Conference

This meeting shall provide an introduction between the Contractor personnel and Government personnel who will be involved with the contract. The meeting shall provide the opportunity to discuss technical, management and security issues. The Post Award Conference will aid both the Government and Contractor in achieving a clear and mutual understanding of all requirements, and identify and resolve any potential issues. The Contractor shall be prepared to discuss any items requiring clarification and gather information as necessary to support each deliverable. The Contractor shall provide a written summary of the Post-Award Conference.

5.0 DELIVERABLES:

6.0 CONTRACTOR MANPOWER REPORTING

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for DHRA/PK via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, unless a later date is otherwise authorized by the Office of the Under Secretary of Defense (Personnel and Readiness). Contractors may direct questions to the help desk at help desk at: http://www.ecmra.mil

7.0 CONTRACTOR TRAVEL

No travel is anticipated under this contract.

8.0 SECURITY: The Contractor shall

8.1 Establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data to ensure the confidentiality, integrity, and availability of government data. The Contractor and all Contractor personnel with access to or responsibility for nonpublic Government data under this contract shall:

8.1.1 Comply with:

DoD Instruction (DoDI) 8500.1, Cybersecurity The Privacy Act (5 U.S.C. 552a) DoD 5400.11-R, and DoD Directive 5400.11, DoD Privacy Program DoD 6025.18-R, DoD Health Information Privacy Regulation DoD 5200.2-R, Personnel Security Program HSPD-12, Homeland Security Presidential Directive.

8.1.2 Comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the Common Access Card (CAC) and:

8.1.2.1 Be responsible for obtaining CAC or PIV ready status prior to reporting for work. At a minimum, all Contractor personnel must obtain/maintain a favorable FBI National Criminal History Check (fingerprint check), two forms of identity proofed identification (I-9 document), and submit a National Agency Check and Law Credit (NACLAC) vetting package for processing.

8.1.2.2 Be citizens of the United States.

8.1.2.3 Maintain favorable FBI National Criminal History checks and ensure completion and successful adjudication of a NACLAC as required for Federal employment.

8.2 If at any time, any Contractor personnel requiring a CAC is unable to obtain/maintain an adjudicated NACLAC, immediately notify the Requiring Activity’s Information Systems Security Group (ISSG) and remove such person from work under this contract.

8.3 Report, within 24 hours, the discovery of any confirmed or suspected Privacy breach first to the Requiring Activity’s Senior Component for Privacy/Privacy Office and secondly to the COR.

8.3.1 All Contractor employees assigned to this contract who create, work with or otherwise handle PII are required to take DoD-provided privacy management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

8.4 Comply with all applicable records management laws and regulations, as well as DoD and National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

8.4.1 In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

8.4.2 All Contractor employees assigned to this contract who create, work with or otherwise handle records are required to take DoD-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

8.4 All Information Systems (IS), Platform Information Technology (PIT) and Information Technology (IT) Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with Department of Defense (DOD) Instruction (DoDI) 8510.01 "Risk Management Framework (RMF) for DoD Information Technology (DIT)” issued March 12, 2014 (formerly the DOD Information Assurance Certification and Accreditation Process (DIACAP)). IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

8.6 DoD-Controlled IS and PIT Systems operated by a Contractor or other entity on behalf of the DOD; to include contractor owned IS and PIT systems that are dedicated to DoD processing, must be authorized as DoD IS or PIT systems. The Requiring Activity’s Authorizing Official (AO) must render an authorization decision for this type of a DoD system prior to DoD use of the capability.

8.7 IT services provided by a commercial or other non-federal government entity under this requirement must ensure the security protections of the IS delivering the service is appropriate to the confidentiality, integrity, and availability needs of the Requiring Activity’s information and mission in order to be approved for acceptable use. The Government will assess the adequacy of security proposed by potential service providers, and accept the proposed approach, negotiate changes to the approach to meet DoD needs, or reject the offer. The accepted security approach will be documented and included as attachments to the resulting contract.

8.8 Any commercial cloud computing services used for this requirement must comply with DoD cloud computing policy and procedural guidance as published.

8.9 Information security continuous monitoring (ISCM) is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. All IS and PIT under this requirement must maintain ongoing monitoring, analysis and incident response procedures as defined and documented in NIST SP800-137 as a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur. In addition, all systems under this requirement must comply with all annual Federal Information Security Management Act (FISMA) security control testing and reporting requirements. The contractor shall provide evidence of these compliance activities.

9.0 PLACE OF PERFORMANCE

Work shall be performed at DHRA Enterprise Operations Center (DEOC), Contracting 4800 Mark Center Drive, Suite 03E25, Alexandria, VA 22350

10.0 QUALITY CONTROL

The contractor shall implement and maintain a Quality Control Plan (QCP) to ensure work performed conforms to the scope of work and meets the requirements under this PWS. The QCP shall, at a minimum provide a method for performing inspections; identifying, correcting and preventing problems/defective service; addressing customer complaints, and improving the quality of services over the life of the contract.

11.0 QUALITY ASSURANCE

11.1. The Government reserves the right to perform inspections and surveillance to evaluate the Contractor’s compliance to the contract terms and performance of the requirements in the PWS.

11.2. Contract Discrepancy Report (CDR). In the event of unsatisfactory contractor performance, the COR or CO will issue a CDR that will explain the circumstances and findings concerning the incomplete or unsatisfactory service. The contractor shall acknowledge receipt of the CDR and respond in writing as to how he/she shall correct the unacceptable performance and avoid a recurrence. The Government will review the contractor's corrective action response to determine acceptability and will use any completed CDR as part of an overall evaluation of Contractor performance when determining present or future contractual actions.

12.0 ORGANIZATIONAL CONFLICTS OF INTEREST

The Contractor acknowledges that it is familiar with FAR Subpart 9.5, Organizational and Consultant Conflicts of Interest, and agrees to avoid, neutralize or mitigate such conflicts of interest in accordance with the principles set forth in the FAR. If the performance requires the Contractor (to include subcontractors) to supply technical support related to systems or projects with which the Contractor is already directly concerned, either by prime or subcontract, the Contractor shall immediately inform the Contracting Officer. The PWS may be withdrawn if a conflict is found. The Contractor shall not undertake performance of any PWS requirements which requires it to supply technical support regarding such systems until the notice is given, and written consent to proceed is issued by the Contracting Officer.

13.0 APPLICABLE DOCUMENTS:

14.0 PERFORMANCE REQUIREMENT SUMMARY (PRS)

14.1 Purpose. The PRS lists performance objectives for the required services the Government will surveil. The absence of any contract requirement from the PRS shall not detract from its enforceability nor limit the rights or remedies of the Government under any other provision of the contract including the clauses entitled “Inspection of Services” or “Inspection” or “Default” in Section E and Section I of the contract.

14.2 Components. The PRS states the performance objective (required service), and threshold (performance standard, accept and reject points (if applicable)) in either a qualitative or quantitative fashion for each critical success factor.

Performance Objective

PWS paragraph

Performance Standard/Acceptable Quality Level

1) Delivered Not Later than (NLT) 5 days after contract award.

2) Fully functional, with updated software and interfaces, and uploaded on computers during Source Selections 100% of the time (no deviations).

1) Mid-level or senior acquisition consultants with FAR and DFARS source selection experience

a) Personnel must have knowledge of FAR 8, FAR 12, FAR 13, FAR 15 and FAR 16 procurements.

2) Personnel must be familiar with use of source selection software

3) Must be able to train up to 6 Government personnel on use of source selection software.

4) Must be able to troubleshoot source selection software and coordinate technical support within 24-hours of reported software discrepancies.

15. Mandatory Training Requirement for Contractor:

Contractor employees performing under this contract shall complete the following mandatory trainings within 30 days of contract award and date of any option exercised. If additional mandatory training is required, amendment or modification will be issued to incorporate the changes.

1. DoD Training on Unauthorized Disclosures IAW OSD Memorandum dated September 19, 2017 and the training is currently available at https://securityawareness.usalearning.gov/disclosure/index.html

2. Privacy Act and Personally Identifiable Information IAW DoDD 5400.11 dated October 29, 2014 and the training is currently available at https://iatraining.disa.mil/eta/piiv2/launchPage.htm

3. IT Security Awareness IAW 5 CFR 930.301 and the training is currently available at https://iatraining.disa.mil/eta/disa_cac2018/launchPage.htm

4. National Insider Threat IAW Executive Order 13587 and the training is currently available at https://securityawareness.usalearning.gov/itawareness/index.htm

5. Counterintelligence Awareness and Reporting Training IAW DoDD 5240.06 and the training is currently available at https://securityawareness.usalearning.gov/cidod

The Contractor program manager shall provide a copy of its employee(s)’ training certificate to the Contracting Officer’s Representative (COR) to meet the mandatory training requirements. The CORs shall maintain the contractor’s certificate(s) in the COR file or CORT.

9 Ver: April 2018