DHA_Draft PWS_CCO 2025.docx

Department of Defense Defense Health Agency Performance Work Statement

Correspondence Control Office Support

Office of the Chief of Staff

Correspondence Control Office

Solicitation Number:

Version: 2 Date: 8 May 2025

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide Correspondence Control Office support services.

1.2 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Correspondence Control Support Services as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this PWS.

1.3 Background: The Military Health System (MHS) is a global, comprehensive, and integrated system that includes combat medical services, peacetime health care delivery, public health services, medical education and training, and medical research and development. The MHS is comprised of the Office of the Assistant Secretary of Defense for Health Affairs (ASD (HA)), the DHA, the Military Medical Services, and the TRICARE healthcare program. The MHS creates and sustains a medically ready military force through the delivery of safe, high-quality medical, dental, and public health services around the world. A ready medical force provides these services worldwide, from the battlefield to military hospitals and clinics. The MHS currently includes 55 military hospitals, 373 military medical clinics, and 245 dental clinics. The MHS cares for 9.4 million beneficiaries, delivering care globally in military hospitals and clinics and providing coordinated, integrated care through civilian TRICARE networks. TRICARE is the healthcare program for uniformed Service members, retirees, and their dependents around the world that provides comprehensive coverage to all beneficiaries including special health programs and healthcare, prescriptions, and dental care plans.

DHA supports the Combatant Commanders and Military Services to execute the Department of Defense (DoD) medical mission in peacetime and wartime. As a Combat Support Agency (CSA), the DHA delivers joint functions and activities for the MHS that enable rapid adoption of proven practices, reduce unwanted variation, and improve the coordination of care across time and treatment venues. The DHA manages Enterprise Support Activities (ESA) that serve the entire MHS in the diverse and complex responsibilities of military medicine.

The DHA is responsible for the administrative functions of all Military Medical Treatment Facilities (MTFs) for budgeting, IT, administration and management, policies and procedures, and construction DHA is active around the world, with military and civilian experts supporting military health operations at military hospitals and clinics, as well as dental and veterinary clinics. In addition, healthcare providers offer services in the private sector through TRICARE.

An integral part of the DHA mission is the DHA Chief of Staff (CoS). The CoS provides a primary focal point for situational awareness, information fusion, and analysis sharing. Under guidance of the CoS, the Correspondence Management Team (CMT) will provide a consistent, cross functional team that will support:

· DHA HQ

· 9 DHA Networks

· OASD Health Affairs

1.4 Objectives: The objective of this contract is to provide document management, task management, coordination, and reporting requirements to include developing and revising business rules. For document management support the contractor shall provide coordination, and reporting requirements; develop document management business rules; administrative support services; auxiliary support services; and document management maintenance and record keeping utilizing the document management Enterprise Task Management Software Solution (ETMS2). This contract supports services to the DHA Networks in support of healthcare delivery, and coordination of readiness support to the Services and Combatant Commands. The following areas of support are as follows:

· Program Support Services

· Operations

· Task Management

· ETMS2 Training

1.5 Scope: The contractor shall provide document management support, coordination, reporting requirements and ETMS2 support to DHHQ, DHA Networks, and the Assistant Secretary of Defense (Health Affairs).

1.6 Period of Performance (PoP): The Period of Performance shall be for one (1) twelve (12) month base year and four (4) twelve (12) month option periods. The period of performance is as follows:

1.6.1 Transition: Transition-in/transition-out period

1.6.1.1 Transition-in period: Full performance start date is, ten (10) business days after contract award Transition-in performance is defined as the days between the contract award and full performance start date. During the transition-in period, the contractor shall prepare to meet all contract requirements and ensure incoming personnel are functionally trained and qualified on the full performance start date except cybersecurity requirements, which must be fully adhered during transition and full performance periods. The remaining incoming personnel shall be trained and qualified within 10 days. If the contractor cannot staff the effort within 10 days, a draft transition plan will be due with proposal with a final transition plan due within 10 days of contract award. See Part 7, Technical Exhibit 2, Deliverable/CDRL A004.

1.6.1.1.1 The contractor shall comply with transition-in requirements of the DHA, as listed in paragraph 1.11.1, for contractors needing to be issued Common Access Card (CAC) identification, including Department of Defense (DoD) and DHA-directed training and forms submission, prior to network access.

1.6.1.2 Transition-out period: The transition-out plan shall facilitate the accomplishment of a seamless transition from the incumbent to an incoming contractor/Government personnel at the expiration of the contract. See Part 7, Technical Exhibit 1. Deliverable/CDRL A005.

1.6.1.2.1 The contractor shall comply with transition-out requirements of the DHA for contractors who have been issued a CAC or who generate “records”, as defined by DoD (records manual), including DoD-directed disposition of records, and others displayed on the In/Out (I/O) Processing Portal.

1.7 Administrative specifications

1.7.1 Place of performance: The work shall be performed at:

· Defense Health Headquarters, 7700 Arlington Boulevard, Falls Church, Virginia 22042

· The Pentagon, Arlington, Virginia 20301;

1.7.1.1 Telework: By exception, telework agreements in support of off-site work may be considered if in the best interest of the Government and with coordinated approval by the Contracting Officer’s Representative (COR) and Remote work may be considered for personnel with a demonstrated history of MHS background and exceptional capabilities.

1.7.2 Recognized Federal holidays: The contractor is not required to perform services on holidays.

Independence Day

NOTE: Any of the above holidays falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. Any holidays that are declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above. If the area in which a contract employee is scheduled to work is closed due to the holiday declared by an Executive Order and the employee is not required to report in, payment will not be made for those hours. Closures of the installation due to inclement weather or other such acts of God shall be handled in the same manner.

1.7.3 Hours of operation: The contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.7.4 Emergency Services:. Operations During Emergency Situations - Individual contingency operation plans shall be activated immediately after determining that an emergency has occurred, shall be operational within twelve (12) hours of activation, and shall be sustainable until the emergency is resolved and normal conditions are restored, or the contract is terminated, whichever comes first. In case of a life-threatening emergency, the COR will immediately contact the Contractor Task Managers to ascertain the status of any Contractor personnel who were in Government controlled space affected by the emergency. When any disruption of normal, daily operations occur, the Contractor Task Manager shall promptly open an effective means of communication with the COR and verify:

· Key points of contact (Government and Contractor)

· Temporary work locations (alternate office spaces, telework, virtual offices, etc.)

· Means of communication available under the circumstances (e.g., email, webmail, telephone, FAX, courier, etc.)

· Essential work products expected to continue production by priority

The Contractor Task Manager, in coordination with the COR, shall make use of the resources and tools available to continue DHA contracted functions to the maximum extent possible under emergency circumstances. Regardless of contract type, and of work location, Contractors performing work in support of authorized tasks within the scope of their contract shall charge those hours accurately in accordance with the terms of this contract.

1.8 Contractor travel: RESERVED.

1.9 Other Direct Costs (ODC): RESERVED

1.10 Quality

1.10.1 Quality Control (QC): The contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The contractor’s QC program is the means by which the work complies with stated requirements. A draft Quality Control Plan (QCP) shall be submitted with the contractor’s proposal and a comprehensive finalaized QCP shall be submitted within 15 days after contract award. After acceptance of the Quality Control Plan (QCP) the contractor shall receive the CO’s acceptance in writing of any proposed change to his QC system. (See Part 7, Technical Exhibit 1 – Quality Control Plan – CDRL A001)

At a minimum, the QCP shall include and document the following:

· A self-inspection plan and an outline of the procedures that the Contractor will use to maintain quality, timeliness, responsiveness, and customer satisfaction in each of the survey program management domains, survey design and development; sampling, web hosting, fielding, data management and analysis; reporting and debriefing.

· Identify and describe the processes, procedures, and metrics for assuring quality in accordance with commercial standards.

· Identify and describe the methods and procedures for the conduct and reporting of periodic and continuous internal audits and inspection necessary to verify compliance with all aspects of the contract.

· Identify and describe Data Quality Validation procedures and processes to ensure data is carefully and rigorously reviewed for accuracy, consistency, and relevance.

1.10.2 Quality assurance (QA): The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11 Contractor personnel

1.11.1 CAC requirements: For all contractors who will work in Government facilities, the Facilities Security Officer (FSO)/Company's Security point of contact (POC) will provide the Government all the required information per the DHA CAC request process current version 2.1, January 2018, or more recent when updated. See process attached at Part 7 Section 7.1.1 of the PWS. A CAC is the standard identification for eligible DoD contractor personnel.

1.11.1.1 The contractor shall return all CACs to the COR upon the departure of the contractor(s).

1.11.2 Contractor onboarding and training. The contractor shall complete all requirements, training, and forms as prescribed in the following requirements:

1.11.2.1 The DHA’s “Onboarding Checklist for Contractor Employees” is located at the DHA Onboarding and Offboarding Portal at https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx

1.11.2.2 The DHA’s contractor training instructions embedded at Part 7 Section 7.1.2.

1.11.2.3 The contractor shall comply with onboarding requirements of the DHA for contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at: https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available).

1.11.2.4 The DHA’s new employee handbook at Part 7 Section 7.1.4

1.11.3 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.11.4 Key control: The contractor shall establish and implement methods of making sure all keys/key cards issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the contractor by the Government shall be duplicated. The contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the CO.

1.11.4.1 In the event keys, other than master keys, are lost or duplicated, the contractor shall, upon direction of the CO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the contractor.

1.11.4.2 The contractor shall prohibit the use of Government issued keys/key cards by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the CO.

1.11.5 Lock combinations: Reserved.

1.12 Key personnel (Contractor): The contractor shall provide a Contract Manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the Contract Manager is absent shall be designated in writing to the CO. The Contract Manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The Contract Manager or alternate shall be available between 8:00 a.m. to 4:30 p.m. EST, Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

The Government has identified the following Key Personnel positions, duties and minimum qualifications:

1.12.1 Program Manager (also serves as the Contract Manager)

Duties: Performs day-to-day management of project consisting of multiple efforts that involve teams of documentation and task management professionals. Will perform the following:

· Develop, review, and approve staff schedules

· Supervise assigned technical and administrative staff, including subordinate managers; directs daily staff and task activities to meet client objectives

· Manage the successful completion of tasks assigned

· Assure quality and accuracy of deliverables

· Prepare and provide various planned and ad-hoc reports and technical reviews requested

· Serve as a liaison to the Contracting Officer Representative (COR) to monitor performance of the contractor team, and solve any related problems

· Ensure compliance with relevant government policies and standards, maintains all necessary documentation tasks

Minimum Qualifications: Bachelor’s Degree with 5-10 years of technical or supervisory experience with ETMS2 (to include the predecessor systems) within the DoD organization.

1.12.2. Program Analyst

Duties: Performs day-to-day management of tasks consisting of multiple efforts that involve the CMT team of documentation and task management professionals. Will perform the following:

· Agency coordination

· Has primary responsibility for implementation of specific task orders and conducts quality control on associated work

· Responsible for daily supervision of staff and periodic reporting to the Manager

· Direct, coordinate, and exercise supervisory authority for the management and execution of ETMS2 taskers

· Performs day-to-day management of assigned work packages

· Determine work schedules, sets priorities, and implements procedures for performing work activities

· Direct and monitor work results for meeting customer requirements, specifications, and quality assurance standards

· Evaluates performance of assigned program tasks in terms of quality, cost control and program schedules

Minimum Qualifications: Bachelor’s Degree OR 3 -5 years of technical or supervisory experience with ETMS2, to include the predecessor system, and within the DoD organization. The Program Analyst must also demonstrate and have experience performing the following:

· Implementation of specific task orders

· Conducting quality control on task work

· Directed, coordinated, and exercised supervisory authority for the management and execution of ETMS2 (or its predecessor systems) taskers

· Determination of work schedules, priority setting, and procedure implementation for performing work activities

· Direct and monitor work results for meeting customer requirements, specifications, and quality assurance standards

1.13 Data rights: Reserved

1.14 Reporting

1.14.1 Contractor Manpower Reporting (CMR): RESERVED.

1.14.2 Non-Disclosure Agreement (NDA): (Deliverable/CDRL A002): All contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA contractor NDA (DHA Form 49) prior to beginning work on the subject contract. The contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other contractors. The NDA shall be executed not later than first day of employment and to be renewed upon exercising a contract option period. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the contractor. The contractor shall maintain originally signed NDAs of individual employees and provide copy to the COR.

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.14.4 Post award conference/periodic progress meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom they have business dealings in support of the Defense Health Agency or Assistant Secretary of Defense (Health Affairs). The contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DHA/ASD (HA) understands that the person is contractor support personnel. Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/ASD (HA) understands that the person is contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.16.1 FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system. Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The contractor shall be prepared for this process as it could take two (2) or more weeks. The FSO/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.16.2 Company's FSO/Security POC must notify the Personnel Security Office when the contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a contractor's termination from the contract, including the termination date.

1.17 Personnel Security Requirements

This clause establishes requirements and processes for the Personnel Security Screenings for Defense Health Agency Contractor personnel and any subcontractors in performance of this contract, in accordance with Department of Defense (DoD) and federal regulations.

1.17.1 General Requirements

The Contractor shall ensure that all personnel performing work under this contract comply with the applicable Department of Defense (DoD) personnel security requirements as outlined in DoD Manual 5200.02, DoD Instruction 5200.46, DoD Instruction 1402.05, DoDM 5200.01 V1-3, DoDM 5105.21 V1-3, and all other relevant regulations. The Contractor shall verify that all personnel performing duties under this contract are suitable for access to Controlled Unclassified Information (CUI) and/or secure facilities, as determined by the appropriate security clearance level and background checks.

1.17.2 Background Investigations

All personnel performing duties on this contract must have their security clearance status verified by the Defense Health Agency (DHA) Administration Security Division (ASD). Procedures and requirements can be found in DHA Administrative Instruction 5200.04, 5200.05, and DHA Internal Policy Memorandums. The Facility Security Officer (FSO) will be required to grant classified access in Defense Information System for Security (DISS) and send a visit request to DHHQ-DDAAFC6-200.

1.17.2.1 Minimum Background Investigation

All personnel performing duties on this contract must have been subject to, at a minimum, a Tier 3, or equivalent background investigation as required by the Office of Personnel Management Federal Investigation Standards. The Contractor is responsible for ensuring security clearance eligibility at the secret level is granted by Defense Counterintelligence and Security Agency (DCSA) or cognizant security authority, and their personnel are enrolled into continuous evaluation (CE) within the last five years. The Contractor is responsible for all required background investigations and clearance maintenance. Any personnel who are unable to maintain the requisite level of eligibility or found to be unsuitable for employment on this contract shall be removed from the project at the direction of the Contracting Officer or ASD Personnel.

1.17.2.2 Background Checks Supporting Local Anti-Terrorism/Force Protection Requirements The Defense Health Agency does not control Military Installation Physical Security requirements; supplemental background checks may be required to for entry. Additional costs associated with processing supplemental background checks are not covered within this contract.

1.17.3 National Security Information

This section outlines the requirements for accessing, protecting, handling, marking, and documenting the transfer of National Security Information (NSI) associated with this contract. All personnel performing under this contract who require access to NSI must adhere strictly to these procedures.

1.17.3.1 Contract Security Classification Specification (DD Form 254) The DD 254 specifies security requirements for this contract; The Contractor shall adhere to all provisions specified within this document. Administration Security Division, Industrial Security Branch is the Reviewing Official for all DHA Classified contracts.

The Contractor shall provide appropriately completed DD Form 254s to all subcontractors requiring access to NSI. The Contractor is responsible for ensuring the subcontractor's compliance with the security requirements outlined in the DD Form 254.

Any changes to the security requirements of this contract, including changes to the classification level or handling procedures, will be reflected in a revised DD Form 254 issued by the Government and endorsed by ASD.

1.17.3.2 Access to National Security Information

Access to NSI is restricted to individuals who possess the appropriate security clearance eligibility granted by the cognizant security authority, have a valid need-to-know, and have signed a Classified Information Nondisclosure Agreement (SF 312). All personnel that require access to classified information will attend information security indoctrination brief after onboarding for accessing classified information.

The Contractor shall verify the eligibility of all personnel proposed for access to NSI prior to requesting access, and ensure all required trainings are completed. Verification shall include confirming the individual's security clearance level, need-to-know, signed SF 312, and ensure classified access is granted in Defense Information System for Security (DISS) or successor system. This verification must be documented and maintained by the Contractor's Facility Security Officer.

1.17.3.3 NSI Protection, Handling, and Marking Requirements

Safeguarding: The Contractor shall always safeguard NSI, both during working hours and non-working hours, in accordance with applicable security regulations, including DODM 5200.01 Vol 3, National Industrial Security Program Operating Manual (NISPOM), and any applicable Intelligence Community Directives (ICDs).

Transmission: Hand-carrying of classified material is minimized to the greatest extent possible and in accordance with DoDM 5200.01 V3, and DHA policies and procedures. Component Head and/or Information Security Senior Agency Official holds overall authority for authorizing courier cards. Transmission of NSI shall be conducted using authorized and secure methods, as specified in above mentioned regulations and the DD 254 for this contract. Transmission of classified information at the Secret level is authorized for electronic transmission on SIPRNET. Transmission of Top Secret/SCI information is authorized for electronic transmission on JWICS.

Storage: NSI shall be stored in GSA approved security containers or facilities when not in use. The storage location shall meet the physical security requirements for the classification level of the information as listed in the applicable regulations.

Handling of NSI: NSI shall only be disclosed to individuals with a valid need-to-know. Reproduction of NSI shall be limited to the minimum necessary and shall only be performed on authorized equipment and by authorized personnel. All reproduced material shall bear the same markings as the original. NSI shall be destroyed in accordance with approved procedures, ensuring complete destruction and preventing reconstruction.

Marking of NSI:

All NSI shall be clearly and correctly marked in accordance with applicable regulations. This includes markings for classification level, special handling caveats, and any other required markings.

Derivatively Classified Information: Information derivatively classified from this contract shall be marked in accordance with the Security Classification Guide (SCG) provided by the Government.

1.17.4 Controlled Unclassified Information

Controlled Unclassified Information under this contract shall be safeguarded as specified in DoD Instruction 5200.48 Controlled Unclassified Information (CUI).

1.17.4.1 Access to CUI

Prior to accessing CUI, all personnel must have completed a Personnel Security screening as described in paragraph 1.17.2 Background Investigations and received, at a minimum, a favorable HSPD-12 interim determination

CUI requires safeguarding measures identified by the CUI EA in Part 2002.14 of Title 32, CFR and, as necessary, in the law, regulation, or government-wide policy with which it is associated. DoD CUI may be disseminated to DoD personnel to conduct official DoD and U.S. Government business in accordance with a law, regulation, or government-wide policy.

· (1) No individual may have access to CUI information unless it is determined he or she has an authorized, lawful government purpose.

· (2) The person with authorized possession, knowledge, or control of CUI will determine whether an individual has an authorized, lawful government purpose to access designated CUI.

· (3) CUI information may be disseminated within the DoD Components and between DoD Component officials and DoD contractors, consultants, and grantees to conduct official business for the DoD, provided dissemination is consistent with controls imposed by a distribution statement or limited dissemination controls (LDC).

· (4) CUI designated information may be disseminated to a foreign recipient in order to conduct official business for the DoD, provided the dissemination has been approved by a disclosure authority in accordance with Paragraph 3.4.c. and the CUI is appropriately marked as releasable to the intended foreign recipient.

Contractors shall ensure all employees and subcontractors granted access to CUI are informed of their responsibilities under this clause and applicable laws and policies.

1.17.4.2 CUI Protection, Handling, and Marking Requirements

Handling: Access to CUI material shall be limited to those employees needing the material to perform their duties. The CUI marking is assigned to documents and material created by a DoD User Agency. CUI is not a classification but requires extra precautions to ensure its properly safeguarded and disseminated and is not released to the public without government authorization.

Marking: All CUI shall be marked in accordance with DoDI 5200.48 and 32 CFR Part 2002. The minimum marking shall include:

· The "CUI" designation at the header and footer of each page, presentation, spreadsheet, e-mail, etc.

· Category markings (if applicable) and dissemination controls;

· The first page or cover of any document or material containing CUI, including a document with commingled classified information, will include a CUI designation indicator.

· Portion markings are encouraged, but not required unless specified.

Emails containing CUI must include the acronym "CUI" in the subject line, attachments containing CUI and appropriate CUI markings in the header and footer. E-mails containing CUI should be encrypted.

CUI material released to a contractor by a DoD user agency must have the following statement on the front page or cover:

THIS DOCUMENT CONTAINS CUI MATERIAL AND MUST BE REVIEWED BY A GOVERNMENT REPRESENTATIVE UNDER THE REQUIREMENTS OF DODI 5200.48, DODI 5230.09, and DODI 5230.29.

Storage: During normal duty hours, steps will be taken to minimize the risk of access by unauthorized personnel, such as not reading, discussing, or leaving CUI information unattended where unauthorized personnel are present. Use a CUI cover sheet for single layer protection. After normal duty hours, CUI information will be stored in unlocked containers, desks, or cabinets if the government or government-contract building provides security for continuous monitoring of access. If building security is not provided, the information will be stored in locked desks, file cabinets, bookcases, locked rooms, or similarly secured areas. The concept of a controlled environment means there is sufficient internal security measures in place to prevent or detect unauthorized access to CUI. Expenditure of funds for security containers or closed areas solely for the protection of CUI material is prohibited.

Transmission: CUI information and material may be transmitted via first class mail, parcel post, or, bulk shipments. When practical, CUI information may be transmitted electronically (e.g., data, website, or e-mail), via approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure or transport layer security (e.g., https). Avoid wireless telephone transmission of CUI when other options are available. CUI transmission via facsimile machine is permitted; however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission (e.g., facsimile machine attended by a person authorized to receive CUI; facsimile machine located in a controlled government environment).

Unauthorized Disclosure: Report misuse, mishandling, or Unauthorized Disclosure of CUI to the Unauthorized Disclosure Program Management Office, the Controlling Agency and the appropriate Military Department Counterintelligence Organization. While Unauthorized Disclosure of CUI does not constitute a security violation, a formal security inquiry/investigation is required if administrative action will be taken against the individual(s) responsible. Unauthorized Disclosure of certain CUI, such as export controlled-technical data, may also result in civil and criminal sanctions against responsible persons based on procedures codified in relevant law, regulation, or government-wide policy.

Processing: Unclassified Automated Information Systems (AIS) used to process CUI under this contract must meet the basic security requirements listed in the NIST SP 800-171 REV 2, “Protecting Controlled Unclassified Information in Non-Federal Systems and Organizations”, 21 February 2020. AIS accredited and approved for processing classified information under this contract are also approved to process DoD CUI.

Dissemination: CUI may be disseminated between officials of DoD Agencies, DoD contractors, consultants and grantees to conduct official business for the DoD provided the dissemination is consistent with controls imposed by a Distribution Statement or Limited Dissemination Controls (LDC). Guidance on Distribution Statements and LDCs will be provided separately by the government for any prescribed CUI Specified information. For classified contracts, this information will be contained in the program SCG. CUI always requires Foreign Disclosure Decision before release outside of DoD Agencies, DoD contractors, consultants and grantees.

Destruction: When the CUI material no longer meets the threshold for safeguarding and dissemination, it shall be immediately decontrolled, be processed through the records management process, and destroyed by the approved methods identified in DoDI 5200.48 precluding its disclosure to unauthorized individuals by rendering it unreadable, indecipherable, and irrecoverable.

1.17.4 Common Access Card Issuance

Common Access Card (CAC) issuance requires, at a minimum, a favorably adjudicated Tier 1 (T1) or higher investigation in accordance with DODI 5200.46. The contractor employee will be issued a CAC only if duties involve one of following:

(1) Both physical access to a DOD facility and access, via logon, to DOD networks on-site or remotely;

(2) Remote access, via logon, to a DOD network using DOD-approved remote access procedures; or

(3) Physical access to multiple DOD facilities or multiple non-DOD federally controlled facilities on behalf of the DOD on a recurring basis for a period of six-months or more.

A CAC may be issued on an interim basis once a Tier 1 has been successfully scheduled with the Defense Counterintelligence and Security Agency (DCSA) and a favorable Federal Bureau of Investigation (FBI) fingerprint results.

1.17.5 Mission Partner Identity, Credential and Access Management Process Mission Partner Identity, Credential and Access Management (MP ICAM) (formerly known as Trusted Associate Sponsorship System (TASS)): The contractor shall process CAC applications through the MP ICAM, the procedures for which are described below. Although there is no requirement for the contractor to designate a “Corporate Facility Security Officer" (FSO) to serve as its single point of contact for the BI, the MP ICAM application process and other CAC and security-related matters, such designation facilitates these processes. If a Corporate FSO is not established, all contractor employees requiring a CAC will be required to process their own applications. The submission process for CAC applications is as follows:

1.17.5.1. The contractor's FSO or COR shall submit requests for a CAC via email to the designated Mission Partner Affiliation Sponsor (MPAS) (formerly known as the Trusted Agent (TA)).

1.17.5.2. The Government will establish a MP ICAM application account for each CAC Request and each contractor employee will receive (2) automated emails from MP ICAM; a user ID and password. The contractor employee or designated proxy shall access the MP ICAM account and complete the CAC application. Once completed, the contractor employee will submit the completed application to the MPAS for next steps.

1.17.5.3. An automated email triggered by the MPAS will inform the contractor applicant one of the following:

1.17.5.3.a. Approval * Upon approval, the information is transferred to the DEERS database and an email notification is sent to the contractor with instructions on obtaining their CAC. The contractor proceeds to a RAPIDS station (RAPIDS Site Locator: https://idco.dmdc.osd.mil/idco/).

1.17.5.3.b. Rejection * The Government sponsor, in separate correspondence, will provide reason(s) for rejection.

1.17.5.3.c. Return * Additional information or correction to the application required by the contractor employee.

1.17.5.3.d. Transfer * Upon transfer, the contractors MP ICAM profile is now assigned to a different contract and/or MPAS for further management.

1.17.6. Foreign Nationals

The Contractor shall immediately notify the Contracting Officer of any foreign national personnel assigned to work on this contract. The Contracting Officer, in consultation with the Security Office and Foreign Disclosure Officer, will determine the eligibility of foreign national personnel for access to sensitive information and ensure compliance with applicable security protocols.

1.17.7. Security Training

The Contractor shall provide personnel security training to all employees working under this contract. Such training shall cover all applicable security requirements, including handling of classified material, protection of sensitive information, and security breach reporting procedures.

1.17.8. Reporting of Security Violations

The Contractor shall immediately report any security violations or potential security risks, including unauthorized access, mishandling of protected information, or any personnel security issues, to ASD through the COR.

The Contractor shall cooperate fully with any security investigations and take any prescribed corrective action as required by the Contracting Officer. Any suspected or actual security violations involving NSI shall be immediately reported to the Government Contracting Activity Security Officer (GCASO) and the Contractor's Facility Security Officer (FSO).

This section is subject to change based on evolving security requirements and applicable government regulations. The Contractor is responsible for maintaining current knowledge of and compliance with all relevant security regulations.

1.17.9. Termination of Personnel

The Contractor must immediately notify the Contracting Officer and ASD if the employment of any personnel performing duties on this contract is terminated. If applicable, all visit authorizations should be canceled as soon as reasonably practicable.

1.17.10. Documentation and Records

The Contractor shall maintain records of all personnel security clearances, background investigations, and security training for the duration of the contract. These records shall be made available to the Contracting Officer or authorized ASD representatives upon request.

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D-Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R-Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.1.7 Defective Service. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.8. Deliverable. Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

2.1.9. Key Personnel. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.10. Physical Security. Actions that prevent the loss or damage of Government property.

2.1.11. Quality Assurance. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.12. Quality Assurance Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.13. Quality Control. All necessary measures taken by the Contractor to assure that the quality of a product or service shall meet contract requirements.

2.1.14. Subcontractor. One that enters a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.15. Work Day. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.16. Work Week. Monday through Friday, unless specified otherwise.

2.2 Acronyms: