DHQCAP15MP60007_CMMS_PWS.docx

PERFORMANCE WORK STATEMENT (PWS)

as of 4 March 2016

1. Contracting Officer Representative (COR)

a. Primary COR.

b. Technical Point of Contact.

Department of Defense Activity Address Code (DODAAC):

H98249

Greenwood Village, CO 80155-4598

2. Title. Computerized Maintenance Management Software (CMMS) Solution

3. Background. The DISA datacenters provide routine and mission-critical computer processing resources and support to numerous Government agencies, 24 hours per day and 7 days a week.

DISA Implementation and Sustainment Center (ISC) currently utilizes MP2 (through a maintenance and operations service contract) and Microsoft Excel inventories in support of CMMS for data center and non-data center (e.g. administrative) maintenance and asset management. This project is intended to replace those systems to maintain, inventory, and manage equipment assets within DISA Facilities.

The Government requires greater operational visibility over infrastructure maintenance and management activities in order to optimize their inventory and asset tracking procedures. Additionally, enhanced visibility is required over critical infrastructure. CMMS will streamline asset lifecycle management as well as identify preventive and predictive maintenance tasks, and automate the Work Order (WO) process under one centralized repository.

4. Objectives. The objective of this requirement is to procure a software solution. The software solution will consist of software licenses, implementation, data collection and/or data migration, software support, and annual software license maintenance. The objective of CMMS solution is to provide flexibility and scope of support sufficient to meet current and future DISA environment workload, security, availability, scalability, and modernization requirements, while ensuring DISA customers receive uninterrupted, continuous access to their applications and data. The contractor will acquire, install, configure, and provide software and software updates for all products associated with this contract.

5. Scope. The scope of this requirement is to procure a commercial off the shelf (COTS) software product including software licenses, implementation, data collection and/or data migration at all DISA Facilities. This includes software support and annual software license maintenance for an enterprise-level CMMS solution. This solution should include unlimited (non-restrictive) user licensing to support the enterprise. This project will integrate contract operations and maintenance support and Government facility management disciplines at DISA Facilities to centralize maintenance, lifecycle management, and asset optimization for the DISA Facilities. The CMMS tool is required to communicate with and integrate equipment and change control management information with other Government systems including, but not necessarily limited to, the DISA enterprise building automation system (BAS), the DISA enterprise information technology service management (ITSM) tool suite, the Data Center Information Management (DCIM) solution and the SharePoint/DoD Enterprise Portal Service (DEPS). Deployment will consist of using Government furnished development, test, and production computing environments to build, test, and deploy the application as designed. The vendor will develop a site migration and implementation plan that addresses data collection, procedural and reporting requirements for inclusion in CMMS, application training, and site operational transition support. Following award, the vendor will work with the Government to develop a proposed project schedule. Mutual agreement is required.

This project will use DISA-furnished and administered infrastructure resources (computing platforms including all required hardware, connectivity components, operating system, and Enterprise Systems Management (ESM) utilities for development, test, and production (e.g., operating environment). The operating environments for this project will be virtual. The solution must be operational in a high availability, redundant architecture (active/active, clustered, server pool, etc.) and operate on a virtual platform. If the solution contains embedded components (e.g. Java, etc.) these imbedded components must be maintained in accordance with information assurance (IA) and Security Technical Implementation Guide (STIG) compliance timelines. Vulnerabilities must be remediated within Government security guidelines and schedules. Patches and updates must be independent of the vendor software release lifecycle. For example, a java patch that is required to be applied immediately must be provided in accordance with Government guidelines and schedule and not held to coincide with next vendor software release.

The specific task areas addressed in the PWS are:

· Task Area 1 – Software

· Task Area 2 – Technical Support

· Task Area 3 – Implementation of the CMMS Solution

· Task Area 4 – Operations Support

· Task Area 5 – Option Year Software Support

· Optional Task Area 6 – On-site data collection in Stuttgart-Vaihingen, Germany for the CMMS Solution

· Optional Task Area 7 – On-site data collection in Bahrain for the CMMS Solution

6. Performance Requirements.

6.1 Task 1 – Software

The contractor shall provide a solution that includes the following capabilities:

The COTS solution shall meet requirements captured in the PWS, be fully compliant with Department of Defense (DoD) information assurance requirements and security requirements, and be interoperable with the targeted DoD architectures. The software licensing and support shall cover the entire IT environment to include Non-classified Internet Protocol Router Network (NIPRNet) and pre-production enclaves. Maintenance does not become effective until the Government approves 100% solution.

The contractor shall ensure that the software products and any product enhancements associated with the products in this contract will support commercially available operating systems, hardware, and processing environment technologies, and must comply with all applicable Federal and DoD IPv6 policies and the DoD IPv6 Capable definitions as specified in the DoD Chief Information Officer (CIO) Memorandum, DoD Internet Protocol Version 6 (IPv6) Definitions, dated 26 June 2008. Additionally, the solution must be capable of interfacing with the DISA enterprise ITSM tool suite. This enterprise system uses an Oracle Real Application Clusters (RAC) backend databases.

The Contractor’s software solution must be able to operate within DoD guidelines and directives.

6.1.1 Subtask 1 – Program Management. The Contractor shall provide the technical and functional support required for the Program Management of this PWS including Quality Assurance, progress/status reporting, schedule development, integration, and status reporting, risk identification/handling/mitigation strategy, and Program Reviews. The Contractor shall provide the centralized administrative, clerical, documentation, and related functions needed to develop work products and demonstrate completion of activities required under this task. The Contractor shall assign organize, plan, schedule, implement, control, analyze, and report on all elements of the contract. The vendor’s Program Manager (PM) shall have resources and authority to ensure efficient and timely program execution and shall be the focal point within the contractor's activity for all required program tasks. The PM shall be the primary contact through which communications, work assignments, and technical directions flow between the Government and the Contractor. The Contractor shall assign a designated representative to act in the absence of the PM.

6.2 Task 2 – Technical Support

6.2.1 Subtask 1 – Internet and Toll-Free Based Support

The contractor’s product support staff shall be accessible via a toll-free support line and available to assist in resolving software errors, answering questions regarding installation procedures, compatibility with other software, and general questions of the licensed software products during and after installation. All calls to the toll-free support line are at no cost. There are no instances that a call would include a cost. The contractor shall also provide Internet-based support to facilitate status reporting (acceptance and socialization) of software problems, and provide downloads of software patches, fixes, and documentation.

6.2.2 Subtask 2 – Software Errors Support

Upon notification of software errors, the contractor shall respond to all emergency and urgent requests for software support. Response times for requests are based upon the software error severity level. Upon failure of the contractor to resolve software errors, the contractor shall escalate the issue(s) to the next level of issue resolution category until reaching the emergency level, at which time the contractor will focus all resources available to resolve the issue(s).

The contractor’s escalation process shall include clear procedures that outline the escalation process, the identification of management points of contact within the escalation process, and the ability to communicate directly with upper management when errors are not resolved.

6.2.2.1 – Software Errors Support - Severity and Support Response Times

Required availability and response time varies based on the severity levels. The severity level of a software error may be increased at DISA’s discretion up to a Severity 1, as the severity of the issue to DISA’s business increases, to verify proper focus and attention of the issue.

6.2.2.1.1 – Severity Level 1

Severity Level 1 consists of a system going down or a software product’s inoperative condition impacting a production environment.

· A production environment where the product is unable to run

· A product is preventing another production application from executing

6.2.2.1.2 – Severity Level 2

Severity Level 2 creates a high impact business condition, which endangers a production environment. The software may operate, but it is severely restricted.

· A major portion of the software product is unusable in a production environment

· A software product is causing another production application to not perform correctly or inhibits the production application’s ability to meet its commitments

6.2.2.1.3 – Severity Level 3

Severity Level 3 creates a low-impact business condition in which the majority of software functions are still usable; however, some circumvention may be required to provide service.

· The product is not performing as documented

· The product is causing another application to not perform correctly

6.2.2.1.4 – Severity Level 4

Severity Level 4 consists of minor problems or questions that do not affect the software functions.

· The customer has questions about the product

· The product is having minor problems

· The product is causing another product to have minor problems

MANAGED SOFTWARE ERRORS -

SUPPORT REQUIREMENTS:

1. 24 Hours x 7 Days x 365 Days a Year Contractor Support

1. 1 hour Voice Response (Contractor returns call to the Government within 1 hour)

1. Support Direct to DISA Managed / Maintained Facility

1. Resolution within 12 hours

X

1. 8 Hours x 5 Days x 52 Weeks a Year Contractor Support

1. 2 business hours Voice Response Support Direct to DISA Managed / Maintained Facility

1. Resolution within 24 hours

X

1. 8 Hours x 5 Days x 52 Weeks a Year Contractor Support

1. 4 business hours Voice Response Support Direct to DISA Managed / Maintained Facility Support Direct to Requestor

1. Resolution within 2 Business Days

X

1. 8 Hours x 5 Days x 52 Weeks a Year Contractor Support

1. 1 business day Response Support Direct to DISA Managed / Maintained Facility Support Direct to Requestor

1. Resolution within 5 Business Days

X

Software Errors - Support Requirements Table

6.3 Task 3 – Implementation of the CMMS Solution

The contractor shall provide on-site installation of the CMMS solution. The contractor shall also be responsible for configuration, integration, testing, and STIG remediation of the software solution.

Throughout the implementation process, the contractor shall provide a weekly activity report (WAR) outlining the progress of current and future tasks with completion status, as well identifying any issues that require Government interaction for resolution and/or impact agreed upon delivery. The contractor shall also submit monthly status reports (MSRs) that include financial and schedule status, proposed changes to the schedule, technical accomplishments, issues and risks, and planned activities for the next reporting period. Any issues requiring Government response or action shall be readily identified in both weekly and monthly reports.

6.3.1 Subtask 1 – Stage 1 – Project Setup and Initiation

Within 2 weeks of contract award, a technical interchange meeting (TIM) will take place either in person or via teleconference or a combination of both. The TIM will be the beginning of a dialogue between the Government and the contractor to ensure successful execution of this contract. The Government shall coordinate the date, place, and agenda for the TIM with the COR. The agenda shall include, at a minimum, the following:

1. Introduction of management and technical teams

1. Creation and approval of draft project management and engineering/implementation plans

Deliverable 3: TIM Minutes Deliverable 4: Approved Draft Project Management Plan Deliverable 5: Approved Draft Engineering/Implementation Plan

6.3.2 Subtask 2 – Stage 2 – Solution Requirements Definition

During this stage the contractor and the Government will review the current technical and existing product architecture documents or other materials related to the implementation effort to identify unique configurations or environmental considerations that may impact the implementation. The contractor shall review and document the requirements for NIPRNet and provide a solution requirements specifications document (SRS).

Deliverable 6: Solution Requirements Specifications document

Additionally, the contractor will work with the Government to establish and document the final project management plan as well as the final engineering/implementation plan for the solution architecture and design. The project team will define and document the design and configuration decisions needed to support the implementation. The team shall produce a final engineering plan document that contains the following:

1. Solution architecture model, which defines solution components and component interface specifications

1. Physical architecture model, which provides a network diagram, system specifications, and configurations

1. Validation approach document, which provides a high-level description of how the solution’s functional and non-functional requirements will be validated

1. Solution phasing document, which describes the sequence of phases to roll out the solution and the high-level integration plan

The contractor shall also provide a high-level solution test and integration plan.

Deliverable 7: Final Project Management Plan Deliverable 8: Final Engineering/Implementation Plan Deliverable 9: Test and Integration Plan

6.3.3 Subtask 3 – Stage 3 – Solution Install, Configuration, and STIG

During this stage, the contractor, as the lead, will work with the Government to install and configure the solution in a pre-production/test environment, located in Montgomery, Alabama or Oklahoma City, Oklahoma. Site determination will be made by DISA during the engineering solution development following contract award. Non-consecutive days of on-site installation support will be required for pre-production installation in the test environment. During this stage, the contractor shall also provide a draft configuration design document that summarizes the configurations that have been applied by the contractor to the solution in the pre-production and/or NIPRNet environments. This document shall contain the following:

1. Configuration specifics, including code changes, settings, etc.

1. Discovery methods for initial services

1. Integration and reporting configuration details

Deliverable 10: Installation Guide Deliverable 11: Draft Configuration Design Document

The contractor will work with the Government to ensure all STIG requirements and application reviews are successfully conducted. The contractor will address any outstanding security items. Any outstanding items shall have a plan of action and milestones (POA&M) document.

Deliverable 12: POA&M Document

6.3.4 Subtask 4 – Stage 4 – Production Deployment and Integration

During stage 4, the contractor, as the lead, will work with the Government to install and configure the solution in a production environment for NIPRNet at the DISA site locations identified in the engineering solution. DISA requires non-consecutive days of installation support for the NIPRNet production environments within the Government sites.

During the implementation effort, Government personnel will receive CMMS solution knowledge transfer information, including documentation from the contractor describing DISA-specific installation and configuration items. The knowledge transfer information shall include tasks, personnel, and dates that the following activities were completed:

· Review of deployment architecture

· Demonstration of access management functionality

· Walkthrough discovery process

· Walkthrough configuration process

Deliverable 13: Final Engineering Solution Design Document Deliverable 14: Final Configuration Design Document Deliverable 15: Knowledge Transfer Activity Document

The contractor will conduct a technical wrap-up session with the Government to provide final project documentation and review the proposed next steps/phases. The Government shall coordinate the date, place, and agenda for the wrap-up session with the COR.

The mandatory publications listed herein and other guidance that can be obtained from http://iase.disa.mil will be critical in the contractor's successful implementation of the CMMS tool. The following publications are anticipated to be the absolute minimum IA documents necessary for the contractor to maintain certification and accreditation; other documents are possible dependent on the system(s) and components that are selected for implementation.

· DoDI 8510.01, Risk Management Framework (RMF) for DoD IT RMF

· Web Server STIG

· Database STIG

The contractor will work with the Government to ensure all STIG findings are mitigated and application reviews are successfully conducted. Any outstanding items shall be mitigated by the contractor or shall have a POA&M document submitted to the Information Assurance team to ensure compliance with the certification and accreditation process.

Once the solution is installed, configured, and in production by the contractor, the contractor shall load each site's data immediately after data is collected. As soon as the site data is loaded and validated, the site will assume responsibility for data and will update as changes are made. The contractor will have responsibility for the initial data load and validation with each respective site.

With regard to integration with identified systems, the schedule contractor and DISA shall work together to determine the appropriate frequency of synchronization based on industry best practices.

6.3.5 Subtask 5 – Stage 5 – Testing and Quality Assurance

During this stage, for each environment, the vendor’s project team, along with operators and end users, will perform testing and quality assurance to verify operational integrity. The team will validate the pre-production environment and utilize test plans to ensure mandatory requirements are met as well as execute use cases supplied by the Government based on defined functional and technical requirements.

Deliverable 16: Testing and Quality Assurance Report

6.3.6 Subtask 6 – Stage 6 – Configuration and Backup Strategy Documentation

During this stage the contractor will complete the system configuration documentation and back up strategy. The vendor and government teams will review the backup strategy for the solution which identifies appropriate backup methodologies and recovery processes based on the requirements in the engineering solution.

Deliverable 17: Backup Strategy Documentation Deliverable 18: System Configuration Documentation

6.3.7 Subtask 7 – Stage 7 – Implementation Handoff and Closure

During this stage, the project manager will conduct an implementation closure meeting or call to validate that the solution conforms to requirements identified in this PWS. The contractor shall coordinate the date, place, and agenda for the meeting with the COR. Along with a final overview of the solution, the project documentation will also be finalized, and an implementation sign-off letter will be completed.

Deliverable 19: Finalized Project Documentation Deliverable 20: Implementation Sign-Off Letter

6.4 Task 4 – Operations Support

The contractor shall provide onsite training for the CMMS solution.

6.4.1 Subtask 1 – Classroom Training

The contractor shall provide training for personnel based on roles and positions associated with the implemented solution. Training courses shall be specifically designed and developed for DISA’s configuration and implementation.

The contractor shall provide the following six (6) total trainings at DISA CONUS or OCONUS locations:

· Two instructor led trainings to cover administration of the solution for six (6) students each

· Two instructor led trainings to cover users of the solution for up to forty (40) students each

· Two instructor led trainings to cover reporting with the solution for twenty (20) students each

Training may be conducted virtually in conjunction with onsite training sessions in order to provide training to additional sites with government approval.

6.4.2 Subtask 2 – Training Materials

The contractor shall develop and provide the training material for implemented capabilities as identified by the Government. The Contractor shall develop a recommended training package with appropriate training material for approval by the Government. Training packages will consist of, but are not limited to, training documentation, course outline, course learning objectives, test bank of review questions, operational scenarios, and storyboards, Frequently Asked Questions (FAQ), and instructor notes. The Contractor shall develop and update training materials based on lessons learned and approved configuration changes. Training materials are anticipated to be developed at the unclassified levels, as needed and appropriate. All training materials should be scrubbed via a thorough quality assurance process prior to delivery. All documentation and software/media used for training must be approved by the Government and shall become the property of the Government upon delivery.

Deliverable 21: Course Materials

6.5 Task 5 – Option Year Software Support

The contractor shall provide software support for all software under the contract for the option years. Software support consists of software support, updates, revisions, error detection and correction, and rights to new releases and/or versions.

Deliverable 22: Option Year Software Support

6.6 Task 6 – Optional on-site data collection for Stuttgart-Vaihingen, and Wiesbaden,Germany for the CMMS Solution

The contractor shall provide on-site data collection for Stuttgart-Vaihingen, and Wiesbaden, Germany for the CMMS Solution at this OCONUS site.

Deliverable 23: Option Year travel to Stuttgart-Vaihingen, and Wiesbaden, Germany OCONUS site for collection and inclusion of data in CMMS system

6.7 Task 7 – Optional on-site data collection for Bahrain for the CMMS Solution

The contractor shall provide on-site data collection for Bahrain for the CMMS Solution at this OCONUS site.

Deliverable 24: Option Year travel to Bahrain OCONUS site for collection and inclusion of data in CMMS system

7. Performance Standards.

Task 3 Implementation of CMMS Solution (PWS para 6.3)

Deliverables –

· Weekly Activity Report

· Monthly Status Report

Subtask 1 - Stage 1 - Project Setup and Initiation (PWS para 6.3.1)

Deliverables –

1. TIM Minutes

1. Approved Draft Project Management Plan

1. Approved Draft Engineering/Implementation Plan

1. Solution Requirements Document

Subtask 2 - Stage 2 – Solution Requirements Definition (PWS para 6.3.2)

Deliverables

· Solution Requirements Specification

· Final Project Management Plan

· Final Engineering/Implementation Plan

· Test and Integration Plan

Subtask 3 - Stage 3 – Solution Install, Configuration, and STIG (PWS para 6.3.3)

Deliverables –

· Installation Guide

· Draft Configuration Design Document

· PO&AM Documentation

Subtask 4 - Stage 4 – Production Deployment and Integration (PWS para 6.3.4)

Deliverables –

· Final Engineering Solution Design Document

· Final Configuration Design Document

· Knowledge Transfer Activity Document

Subtask 5 - Stage 5 – Testing and Quality Assurance (PWS para 6.3.5)

Deliverable

· Testing and Quality Assurance Report

Subtask 6 - Stage 6 – Configuration Documentation and Backup (PWS para 6.3.6)

Deliverables –

· Systems Configuration Documentation

· Backup Strategy Documentations

Subtask 7 - Stage 7 – Implementation and Handoff (PWS para 6.3.7)

Deliverables

· Finalize Project Documentation

· Implementation Sign-off Letter

Task 4 – Operations Support (PWS para 6.4)

Subtask 1 – Classroom training

Subtask 2 – Training Materials

Task 5 - Option Year Software Support (PWS para 6.5)

Task 6 – Optional on-site data collection for Stuttgart-Vaihingen, and Wiesbaden, Germany

Task 7 – Optional on-site data collection for Bahrain

8. Incentives. None prescribed.

9. Place of Performance. The work will be performed at the current DISA CONUS and OCONUS DECC’s. Data collection may take place physically or virtually at all locations except as noted in 9.3 and 9.4. Training may take place virtually at OCONUS locations during CONUS training sessions with the approval of the Government.

9.1 DISA current CONUS locations are:

· Chambersburg, PA

· Columbus, OH

· Denver, CO

· Fort Meade, MD

· Mechanicsburg, PA

· Montgomery, AL

· Ogden, UT

· Oklahoma City, OK

· San Antonio, TX

· St Louis, MO

· Warner Robins, GA

9.2 DISA current OCONUS locations are:

· Stuttgart-Vaihingen, Germany

· Wiesbaden, Germany

· Pearl Harbor, Hawaii

· Bahrain

9.3 Optional Task 6 - Place of Performance. The work will be performed at DISA CONUS sites. Data collection will need to physically take place in Stuttgart-Vaihingen and Wiesbaden, Germany. Training can be done virtually in conjunction with CONUS training session with government approval.

9.4 Optional Task 7 - Place of Performance. The work will be performed at DISA CONUS sites. Data collection will need to physically take place in Bahrain. Training can be done virtually in conjunction with CONUS training session with government approval.

9.5 The number and location of the sites supported by this contract may vary as DISA moves towards assisting the DoD CIO in consolidating and organizing DoD datacenters as part of the departments JIE initiatives. The COR will provide a three (3)-month notice to the contractor of any additional site that may be added or any existing site that may be modified or closed.

9.6 Alternate Place of Performance

Contractor employees may be required to work at home, another approved DISA activity within the local travel area, or at the contractor's facility in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, etc.). Any equipment such as laptops or phones provided to Contractor personnel shall be returned at the termination of the engagement or at another time mutually agreeable to both parties. COR approval is required. The contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. The contractor shall continue to provide the same level of support as stated in the PWS.

10. Period of Performance. The period of performance shall consist of a 1-year base period and two, 1-year option periods.

11. Delivery Schedule.

Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer 1 copy of the transmittal letter with the deliverable to the Primary TM

12. Security Requirements.

The following security requirements shall apply to this effort:

References:

a. DOD 5200.2-R, DOD Personnel Security Program.

b. DISAI 240-110-36, Personnel Security.

c. DOD 5220.22-M, National Industrial Security Program Operating Manual.

d. DOD 5220.22-R, Industrial Security Regulation.

e. DISA Computing Services Directorate (CSD) Security Handbook.

f. DODM 5200.01, Information Security Program, 24 February 2012

12.1 Facility Security Clearance. The work to be performed under this contract is up to and including the Secret Level. Therefore, the company must have a final Secret Facility Clearance from the Defense Security Service (DSS) Facility Clearance Branch (FCB).

12.2 Security Clearance and IT Level. All personnel performing on this contract will be U.S. citizens. There are three levels of personnel security requirements under this contract covering three types of positions:

12.2.1 Contract employees that are in Secret/IT-I positions require a minimum of interim secret security clearance and interim IT-I eligibility when performance starts. Contract employees that are in Secret/IT-II positions require a minimum of interim secret security clearance and interim IT-II positions must have at least an interim secret security clearance when performance starts. Personnel in Unclassified/IT-II must be eligible for IT-II, either interim or final.

The following type of positions requires a minimum interim Secret security clearance and interim IT-1 eligibility when performance starts:

a. Application Support Personnel (system administration and developer): Secret/IT-I

The following type of positions requires a minimum interim Secret security clearance and interim IT-II eligibility when performance starts:

b. Project Managers and Support Personnel for NIPRNET: Unclassified/IT-II

12.3 Investigation Requirements. All personnel requiring IT-I eligibility under this contract must undergo a favorably adjudicated Single Scope Background Investigation (SSBI) as a minimum investigation. The SSBI will be maintained current within 5-years and requests for Special Background Periodic Review (SBPR) will be initiated 90 days prior to the 5-year anniversary date of the previous SSBI or SBPR.

12.3.1 All personnel requiring Secret under this contract must undergo a favorably adjudicated National Agency Check, Local Agency Check and Credit Check (NACLC) as a minimum investigation. The NACLC will be maintained current within 10-years and requests for Secret Periodic Reviews (SPRs) will be initiated 90 days prior to the 10-year anniversary date of the previous NACLC or SPR.

12.3.2 Contract employees that are not immediately eligible for at least interim IT-1 systems access will be permitted to begin work with interim IT-II systems access at the discretion of the Government, pending eligibility for IT-1. Before being permitted to begin work under this arrangement the individual contractor employee must be submitted by the company for an SSBI (investigation) that is reflected in the DoD JPAS database and granted interim IT-II systems access approval by DISA Personnel Security. The employee will not be granted any privileged access until interim or final IT-1 systems access is granted by DISA Personnel Security. The contract company must submit the request for SSBI as soon as a job offer is tendered to an employee. Advance NAC results will be requested by the contract company to facilitate expeditious consideration for interim IT-1 systems access by DISA Security. Advance NAC results or a previous DoD investigation are required for interim IT-1 consideration. If the employee is not able to obtain an interim IT-1 clearance within 90 days they will not be eligible to provide service on this contract.

12.4 Adjudication for IT access. Adjudication of investigations for granting of interim or final IT-I access will be accomplished through DISA Security. An exception to this is that individual contractor employees with an SSBI or SBPR (within a 5-year scope) that is favorably adjudicated for a Secret security clearance by any of the Department of Defense adjudication facilities (DoD CAF and DICAF) will be automatically accepted for final IT-I access.

12.5 Interim IT access. Pending completion of a SSBI (for IT-I) and final adjudication for security clearance, contractor employees may be granted interim authorization to perform duties designated as IT-I. The interim authority for IT sensitive positions is the DISA Personnel Security Office.

12.5.1 Following are the requirements, which must be met prior to granting of interim IT-I authorization:

· The request for SSBI (E-QIP or Word Fillable SF 86 and fingerprint cards) must be submitted by the contractor Facility Security Officer (FSO) through the Defense Security Service (DSS) to the Office of Personnel Management (OPM) and the Department of Defense (DoD) Personnel Security Data Base (JPAS) must reflect that the investigation is open. A copy of the E-QIP or SF 86 forms must be submitted to the DISA Field Security Office, Security Manager (SM). The SM will forward the forms along with a written request for interim IT-I authorization to DISA Personnel Security for approval.

· The National Agency Check (NAC) portion of the SSBI or a previous valid NCLC/DNACI/NAC or ENTNAC must be completed and favorably adjudicated before interim IT-I access will be granted. An interim security clearance (either Top Secret or Secret, as appropriate for the position) should be requested by the company FSO for those contractor employees without a previous investigation.

12.6 Visit Authorization Letters. The Contractor will forward a Visit Authorization Letter (VAL) to the Contracting Officer’s Representative/Program Manager at the following address for all employees prior to the beginning of each contracting/task order period of performance and as new contractor employees are assigned to the contract:

DISA ISC

ATTN: Shanna Neil IML11, Bldg 12

The VAL shall be on company letterhead or pre-fabricated form and contain the following information:

Contract number with start and end dates

CAGE CODE

Company point of contact (POC) and telephone number Government POC/COR name and telephone number Complete legal name of employee(s) Social Security Number Security Clearance level, date granted, and Adjudication facility name, e.g. DISCO Type of personnel security investigation (PSI) pending or completed Date PSI completed

Security Contacts. DISA Security Personnel can be contacted for security related questions as follows:

For Industrial Security related issues:

Tia M. Costin, phone: (301) 225-1206

Defense Information Systems Agency ATTN: MPS61, Industrial Security Command Building 6910 Cooper Ave.

Fort Meade, MD 20755-7088

For Personnel Security related issues to include interim IT access requests:

Primary: TBD, phone: (301) 225-1206 Alternate: Richard Young, phone: (301) 225-1237

Defense Information Systems Agency ATTN: MPS62, Personnel Security Command Building 6910 Cooper Ave.

Fort Meade, MD 20755-7088

12.7 Information Security and other miscellaneous requirements.

12.7.1 Contractor personnel must comply with local security requirements for entry and exit control for personnel and property at the Government facility.

12.7.2 Contractor employees will be required to comply with all Government security regulations and requirements. Initial and periodic security training and briefings will be provided by Government security personnel. Failure to comply with security requirements can be cause for removal and the contractor will not be able to provide service on this contract.

12.7.3 The Contractor shall not divulge any information about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

12.7.4 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

12.7.5 Contractor personnel will generate or handle documents that contain FOUO information at Government facilities. Contractor shall have access to, generate, and handle unclassified material only at Government facilities.