DRAFT-AdvertisingServicesPWS_20210823.docx

Performance Work Statement (PWS) Office of People Analytics, Joint Advertising, Market Research and Studies Marketing Communication Services

1.0 INTRODUCTION The Office of People Analytics (OPA) through its Joint Advertising, Market Research and Studies (JAMRS) program requires a Contractor to perform full-service Integrated Marketing and Advertising services. This requirement will provide services associated with, but not limited to brand planning, identifying target markets, design and development, conducting and administrating national multi-media advertising campaigns, secure database management and website properties.

2.0 BACKGROUND

OPA/JAMRS leads the Defense Human Resources Activity (DHRA) marketing communications effort in support of military recruiting and performs work on behalf of the Under Secretary of Defense for Personnel & Readiness [USD (P&R)]. Policy guidance for the OPA/JAMRS program is provided by the Deputy Under Secretary of Defense Military Personnel Policy (DUSD/MPP) office. OPA/JAMRS focuses its corporate advertising efforts on creating awareness of, interest in, and preference for the military among youth and the adults who influence them. Demands on today’s military and their families have never been greater, as Department of Defense (DoD) continues to recruit for its All-Volunteer Force. OPA/JAMRS provides valuable resources and communications programs from a holistic military perspective, enabling DoD and the Services to make informed, research-based decisions to enhance their individual recruiting efforts. OPA/JAMRS maintains databases and conducts research on a wide variety of military-related populations. OPA/JAMRS also executes programs on behalf of the Office of the Secretary of Defense (OSD), including corporate branding, advertising and marketing programs.

4.1. Provide Direct Marketing Services. Execute and analyze all aspects of the direct marketing program (direct mail, phone, interactive, email, and any other forms of direct-response marketing). Provide broad and targeted direct marketing, as well as micro-targeting, that incorporates effective timing of messages and a method of reaching target markets directly with diversity in advertising formats (e.g. phone, direct mail business reply cards, Internet and all other approved formats). Compile, reproduce, merge/purge, track and test direct-response services. Customize mailing/calling/contact lists and develop interactive (e.g. Internet) direct marketing programs (part of an integrated drive-to-web campaign). Explore and assess relevant new forms of direct marketing communication and submit to the Government.

4.2. Provide Interactive Marketing Services. Provide Interactive (digital) communications services related to the development and maintenance of websites, planning and execution of online advertising, planning and execution of other forms of Interactive/Direct media – including new and emerging forms of technology.

4.2.1. Develop, operate, and maintain the Government’s targeted websites, todaysmilitary.com, myfuture.com, medicineandthemilitary.com, and OPA/JAMRS/DoD’s .mil or .gov related sites, information technology resources and web hosting/mastering capability. Development and operation include activities such as web hosting, site maintenance and updates (e.g. content and technical updates, site builds or redesigns, cybersecurity assessments and certification).

4.2. E-mail OPA/JAMRS stakeholders as required about program updates and events (e.g. market research results, Direct marketing/Interactive Conferences/Seminars and new products).

4.2.3. Develop content for websites (e.g. copy, videos, imagery), and conduct online maintenance updates (e.g. photo change, update links, video updates, site management and architectural improvements).

4.2.4. Maintain ongoing website metrics analysis reporting capability. The Contractor shall ensure that their web-based reporting tool is available with industry-standard security and service-levels (as an example of one of the required metrics, the connection must be available and properly functioning 99% of the time in each month for which the measure is taken) and complies with all applicable DoD website administration and privacy policies.

4.2.5. Implement, monitor and update search placements on Google, Bing, and other search engines for OPA/JAMRS website properties.

4.2.6. Plan and implement digital media campaigns, and produce multiple sizes/formats of digital media.

4.2.7 Develop content for paid placements, monitor developments, and technically maintain brand pages on social media platforms such as Facebook, YouTube, Instagram, and update the channels when requested.

4.2.8. Conduct Information Assurance Vulnerability Alerts (IAVAs) patching as needed.

4.2.9. Conduct ongoing evaluation of 508 compliance and provide quarterly reports.

4.2.10. Attain, maintain and continuously update RMF cybersecurity certification and documentation for websites requiring authentication (e.g., OPA.mil).

4.3. Provide Public Relations Services. Assist the Government in strategizing, coordinating, and executing all Public Relations (PR) outreach programs and services to positively reach targets. Help address and defuse issues (e.g. consumer and special interest group protests about capturing and using consumer data for recruiting) by providing technical details to the Government; train personnel on media interactions; produce a Joint Service print publication, support approved marketing campaigns and develop and execute a social media strategy. Services involve:

4.3.1. Promoting OPA/JAMRS advertising and other marketing initiatives such as Futures magazine, and website properties through PR communication channels.

4.3.2. Assisting Government in responding to DoD public affairs media queries with media relations efforts.

4.3.3. Assisting Government in developing and producing press releases, public affairs guidance, press kits, and other media materials.

4.3.4. Maintaining and updating existing crisis communications plans and working with OPA/JAMRS to help defuse issues that arise.

4.3.5. Conducting media training with OPA/JAMRS personnel, such as developing messages, understanding the media, and preparing for an interview.

4.3.6. Creating concepts, developing and producing a 40- to 48-page full-color Joint Service print publication through the mechanicals phase. This includes screening and hiring a professional photographer, interviewing military candidates, writing all copy, and providing all photographs obtained by the photographer to the Government via digital files.

4.3.7. Developing and executing earned media campaigns.

4.3.8. Develop content for organic placements, monitor developments, and technically maintain brand pages on social media platforms such as Facebook, YouTube, Instagram, and update the channels when requested

4.3.8.1 Develop and update a social media tool kit.

4.4. Provide Brand Research and Integrated Media Strategy and Execution. Integrate the strategy and execution (once approved by the Government) of all media campaign programs across multiple media and disciplines. Evaluate current strategies and tactics (from both a media and messaging standpoint), and propose any necessary changes to strategies, or the tactical execution of those strategies. Provide recommendations in the areas of media mix and spending, as well as in the specific areas of media planning and content (creative) development and evaluation.

4.5. Provide Integrated Media Planning and Buying. Perform integrated media planning and buying functions, based on approval from the Government, that can seamlessly execute across a full array of traditional media forms (i.e., mass print and broadcast), integrated/emerging media forms, and digital and direct marketing vehicles at national and local levels, with primary focus on national reach. Provide high value for media dollars, from both an efficiency and effectiveness standpoint, and be adept at all industry standard media measurement techniques to help evaluate the effectiveness and efficiency of its media buys. Ensure all requisite talent, music, and Internet/Broadcast usage rights are secured for the Government.

4.6. Provide Creative Development. Provide creative work that fully embraces OPA/JAMRS mission, and is well conceived to execute multi-disciplinary marketing communications programs. Produce and deliver creative work across various media based on relevant planning insights.

4.7. Provide Campaign Execution. Execute and evaluate prospect and adult influencer (e.g. parents, teachers, coaches, clergy) marketing communications campaigns. Campaigns shall be executed through integrated print, broadcast, online, direct marketing and PR efforts. Provide support to the Government to evolve the current effort in terms of content and media placement.

4.8. Provide Production Services. Provide all commercial production services required for the execution of integrated, corporate branding, marketing and communications programs (including research, advertising, direct marketing, database marketing, interactive marketing, broadcast (TV and radio), Print and PR). Such production capabilities include all forms of art and graphic design services; all forms of commercial photography and videography services (film, digital and videotape); interactive marketing production (website, CD-ROM, DVD, Blu-Ray disc, etc.); radio recording; and the revision/editing of all materials in any media format. Productions should conform to Screen Actors Guild-American Federation of Television and Radio Artists (SAG-AFTRA) union requirements for talent and safety.

4.9. Provide Marketing Database Services. Administer, maintain and store large amounts of data (i.e. Joint Leads, High School Master File [HSMF], College File, and the Selective Service System [SSS] file) in a highly secure manner that meets all Federal law requirements including the Privacy Act, National Archives retention, and Risk Management Framework on a Government-owned information system. Compile, process, and distribute files based on the needs of OPA/JAMRS stakeholders. Compile, reproduce, merge/purge, track and test direct-response services and/or customized lists. This includes setting processing specifications for every file release and review and quality control of all distributed fields to the Services. The database provides the ability to measure the effectiveness of list purchases through ongoing analysis as well as removal of names of individuals currently enlisted including those who are enlisting in the Armed Forces, and those who have asked that their names be removed from future recruitment lists.

4.9.1. Administer a Joint Leads program by compiling “leads” (i.e. people who request information) from sources that have historically included but are not limited to: SSS Direct Mail Brochure Business Reply Cards, Futures magazine Business Reply Cards, and websites (todaysmilitary.com). Dates of receipt vary according to source of potential leads (e.g. web, daily; mail, daily). Upon receipt from the above sources, leads shall be placed into the Joint Leads file for database maintenance, processing, management and daily dissemination to the advertising agencies and Data Management Divisions of the Services.

4.9.2. Administer and maintain the HSMF comprised of youth who have not yet requested information on military service (i.e. potential leads) but are in the target age group. Sources shall include: commercial list vendors, state agencies (e.g. Departments of Motor Vehicles/Public Safety) and information on youth who have taken the Armed Services Vocational Aptitude Battery (ASVAB) in their high schools. All potential lead information from the above sources shall be placed into the HSMF for database maintenance, processing, management and dissemination to the advertising agencies and Data Management Divisions of the Services.

4.9.3. Provide support to the Selective Service System to receive monthly registrant files. Process the monthly SSS files on a quarterly basis. Process and distribute approximately three to six million names annually through SSS mail files. Manage the monthly Joint Service direct mail campaign to new SSS registrants, to generate recruiting leads for the Services.

4.9.4. Obtain college data files (more than three million names) from various national commercial list sources.

4.9.5. Process and store permanent, monthly suppression files of 7,000,000 names (from multiple sources including public opt-out requests and the Defense Manpower Data Center (DMDC) suppression file).

4.9.6. Ensure that marketing (Direct and Interactive) database solutions are continually maintained and upgraded throughout the lifecycle of the system. Provide support to the Government by enabling DoD assessment and authorization in accordance with DoD Instruction 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT).

4.10. Provide Account Planning. Provide integrated account planning, strategy, resource management, assessment and mid-course correction as necessary.

4.10.1. Report and monitor (monthly, per project) deadlines/milestones and status of actions. The report shall be accessible to OPA/JAMRS advertising staff (Director, Advertising Chief, and Project Officers).

4.10.2. Submit a comprehensive and detailed annual plan to OPA/JAMRS in August of each Fiscal Year (FY) that includes a statement of key advertising objectives, strategies for achieving them, expected outcomes, evaluation procedures. The activities detailed in the plan shall be executable and feasible within the constraints provided by the OPA/JAMRS program. After OPA/JAMRS has reviewed the plan and provided feedback/guidance, the Contractor shall make any adjustments to the plan including if OPA/JAMRS decides the plan is not executable and/or feasible.

4.10.3. Maintain, inventory, trademark, copyright and preserve all digital content and files, films, tapes, commercials, slides, negatives, and any other items produced by the Contractor on behalf of OPA/JAMRS and required for continuity of operations and protection of materials. The Contractor shall not destroy, discard, transfer, or otherwise relinquish ownership or possession of any such items without OPA/JAMRS’ written approval.

4.10.4. Maintain all master video and audio recordings, irrespective of medium, along with complete documentation concerning talent contracts, music rights, and other information pertaining to the broadcast, use, or distribution of any broadcast products. All broadcast products, whether the task order, effort, project, or product is ultimately finalized, completed, abandoned, or terminated are the property of OPA/JAMRS and will be provided by the Contractor, on request, with use limited only by talent contracts.

4.10.5. Conduct a semi-annual inventory of materials provided during the contract, which lists all items stored and maintained by the Contractor, to include storage location.

4.10.6. Coordinate, execute, manage and maintain all talent contracts, talent residuals, music rights, and other information pertaining to the usage or distribution of any broadcast or Internet products. Conform to SAG-AFTRA union requirements when appropriate.

4.10.7. Secure end user licensing agreements to enable the Government’s unlimited access and use of commercial fonts, font libraries, and imagery/videography, across all developed marketing products.

4.11. Provide Measurement of Integrated Media Effectiveness. Employ standard advertising industry measures of effectiveness in media planning, placement, and evaluation to include reach and frequency, cost-per-thousand, Gross Rating Points (GRPs), audience composition, audited circulation data, and ratings. Online (digital) industry measures of media effectiveness should include, but are not limited to, site visits, page views, video views, time on site, time on page, Click Through Rate (CTR), link-offs to the Services’ sites, and leads generated for the Services. These shall be used by the Contractor to determine the most cost-efficient media to reach target audiences. Conduct post-buy analyses by comparing actual results to the media plan(s). Obtain and finalize performance guarantees with media sources, pursuing make-good advertising placements if actual performance does not meet such guarantees. Obtain and finalize added-value opportunities for advertising purchases and placements.

4.12. Provide Brand Strategy Research and Reporting. Conduct brand strategy research, special studies, analysis and reporting. Review, revise, analyze, report on and/or develop customized brand/media research and special studies to support OPA/JAMRS and DoD stakeholder needs (i.e. the Secretary of Defense).

4.12.1. Provide a thorough understanding of the DoD’s markets, especially that of influencers of youth (parents, educators, coaches, etc.), as well as the youth market, to include an in-depth understanding of the influence parents, educators and others have on youths’ career planning and decision-making, to develop persuasive, effective communications

4.12.2. Conduct user testing for OPA/JAMRS websites, and implement Government-approved site updates based upon testing recommendations.

412.3. Provide experienced marketing-oriented advice and recommendations on OPA/JAMRS research (such as tracking studies) and, for all research, the ability to generate actionable insights for outreach from the results and information.

4.12.4. Conduct brand communication-strategy research to aid in the development and/or refinement of outreach products.

4.13. Marketing Communications Training. Provide marketing communications training to DoD personnel through conferences and seminars (e.g. annual Joint Service Marketing Seminars and Advertising Boot Camps).

4.14. Provide Contractor Personnel. Provide a highly professional and experienced account management team to lead and manage a diverse and complex marketing communications program. The team requires professional experience in managing integrated marketing communications programs similar in scope to the OPA/JAMRS program. Successful performance of this contract is best predicted by the level and extent of the Contractor’s:

4.14.1. Advertising expertise in the area of military recruiting, such as in-depth knowledge of DoD’s major market segments (parents, educators, recruiters and youth).

4.14.2. Experience with military recruiting outreach, as well as have the capability to conduct market research on military recruiting-related topics.

4.14.3. Knowledge of military recruiting in order to provide informed advice and Service-specific military recruitment outreach recommendations.

4.14.4. Familiarity with all aspects of marketing communications, including traditional and emerging media, direct marketing, interactive marketing, publication design, production and printing, social media, and public relations.

4.14.5. Account management experience that shows account team can be responsible for OPA/JAMRS general advertising, interactive marketing, PR, and direct marketing to ensure OPA/JAMRS is meeting its program objectives.

4.14.6. Interactive Marketing experience that shows a thorough understanding and mastery of DoD/CIO digital policy.

4.14.7. Direct Marketing expertise in list purchasing, secure database management, and the RMF accreditation process. The Contractor must attain and maintain certification in the RMF accreditation process. Examples of individual skill would include ensuring that marketing (Direct and Interactive) database solutions are continually maintained and upgraded throughout the lifecycle of the system; and compiling, reproducing, merging/purging, tracking, and testing direct-response services and/or customized lists. This also includes setting processing, security level marking, and usage specifications for every file release, and review and quality control of all distributed files to the Services.

4.15. Provide Collateral Materials. Provide support to the Government with the following communications services by developing collateral materials that promote or augment marketing, media and military awareness efforts (e.g. pamphlets, magazines, booklets, brochures, leaflets, newsletters, newspaper advertisements, catalogs, coins, printed and/or electronic displays, posters), and by developing trade show/exhibits, conference and event-planning services; consumer promotion and event marketing; and multicultural target marketing.

4.16. Provide Branding, Advertising, and Marketing Support of Other OSD Stakeholders. Assist other OSD stakeholders (e.g. Recruiting Command leadership, DHRA, and the Secretary of Defense & programs (e.g. Under Secretary of Defense for Personnel and Readiness, Defense Civilian Personnel Advisory Service (DCPAS), Sexual Assault Prevention and Response Office (SAPRO), Federal Voting Assistance Program (FVAP) and Common Access Card (CAC) programs) with branding, advertising, and marketing support as required.

4.17. Provide a Project Management Plan. Include a project management plan for providing complete program management support that will fully integrate, control, and document all phases of the contract requirements. The project management plan shall provide a summary of the necessary managerial, administrative, and financial management resources necessary to ensure the quality of program strategies and executions, ensure the execution and integrity of databases, and adhere to established financial reporting procedures. The project management plan should fully address how the Contractor will accomplish and implement the PWS requirements for the various marketing communications and database services; including any significant partner and/or subcontract resources and how the activities of those partners and/or subcontract resources will be effectively integrated on behalf of OPA/JAMRS programs.

4.18 Provide Transition of Contract Services. Provide a plan for transition in and out services to ensure minimum disruption to vital Government business. This plan shall address how the Contractor will work with the incumbent and/or successor contractor and Government personnel to ensure that there will be no service degradation during and after the transition-in period of five (5) business days.

4.19 Participate in a Post-Award Conference. This meeting shall provide an introduction between the Contractor personnel and Government personnel who will be involved with the contract. The meeting shall provide the opportunity to discuss technical, management and security issues. The Post Award Conference will aid both the Government and Contractor in achieving a clear and mutual understanding of all requirements, and identify and resolve any potential issues. The Contractor shall be prepared to discuss any items requiring clarification and gather information as necessary to support each deliverable.

5.0 DELIVERABLES

The Contractor shall provide deliverable(s) in a format mutually agreed upon by the Government and the Contractor. All deliverables will be reviewed for timeliness, accuracy and format. If a deliverable due date falls on a weekend or holiday, the Contractor shall submit the deliverable on the last work day prior to the due date. In fulfillment of this effort, the Contractor shall provide the following deliverables to the COR.

6.0 ANNUAL REPORTING

6.1 The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via a secure data collection site. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, unless a later date is otherwise authorized by the Office of the Under Secretary of Defense (Personnel and Readiness). The DoD is in the process of transitioning reporting from eCMRA to the System for Award Management www.sam.gov for fiscal year 20 reports.

6.2 The contractor shall submit an annual report in the contractor’s format to demonstrate the progress towards small business subcontracting stated in the Small Business Participation Commitment Document (SBPCD) submitted with the contractor’s proposal. The report is due no later than 30 days after the end of each period of performance, and shall be submitted to the CO and COR. Additionally the contractor shall submit the report via email to the DHRA Office of Small Business Programs at dodhra-small-business@mail.mil.

6.3 The goals for small business subcontracting at DHRA are 30% of total contract value. The contractor shall submit a copy of its plan to meet the subcontracting goals for this contract, within 30 days after award. The goals shall be submitted to the COR, CO and via email to the DHRA Office of Small Business Programs at dodhra-small-business@mail.mil. The contractor shall submit an annual report in the contractor’s format to demonstrate its small business subcontracting towards its goals. The report is due no later than 30 days after the end of each period of performance, and shall be submitted to the CO and COR. Additionally the contractor shall submit the report via email to the DHRA Office of Small Business Programs at dodhra-small-business@mail.mil.

7.0 CONTRACTOR TRAVEL. Travel is included in this contract and shall be specified by task order. Travel will include but not be limited to: meetings, briefings, conferences, photography/videography shoots, interviews, focus groups and other research. Contractor costs for Government authorized travel are included in this contract. All travel shall be in accordance with FAR 31.205-46 and applicable travel regulations (Joint, Federal or Standardized). Contractor payment claims shall include applicable documentation to support actual costs incurred (e.g. airfare and hotel/lodging receipts) as well as any receipts valued at or above $75.00. Failure to provide appropriate documentation may result in loss of reimbursement of travel expenses.

8.0 SECURITY

8.1 Access To Sensitive Information

8.1.1 To the extent that the work under this contract requires the Contractor to have access to DoD sensitive information the Contractor shall after receipt thereof, treat such information as confidential and safeguard such information from unauthorized use and disclosure. The Contractor agrees not to appropriate such information for its own use or to disclose such information to third parties unless specifically authorized by the Government in writing.

8.1.2 The Contractor shall allow access only to those employees who need the sensitive information to perform services under this contract and agrees that sensitive information shall be used solely for the purpose of performing services under this contract. The Contractor shall ensure that its employees will not discuss, divulge or disclose any such sensitive information to any person or entity except those persons within the Contractor’s organization directly concerned with the performance of the contract.

8.2 Position of Trust Requirements. All Contractor personnel with access to DHRA systems or data must comply with DOD Personnel Security Program. All persons on this contract will be designated in a Critical-Sensitive, or Non-Critical Sensitive position (IT-I or IT-II) as determined by the Government per position responsibilities.

8.2.1 Prior to beginning work on this contract, the contractor will complete all required personnel security requirements as specified by DHRA, Personnel Security Office.

8.2.1.1 Complete and submit a vetting application (Standard Form (SF) 86 National Security Questionnaire through e-QIP, fingerprints and proof of US citizenship) that is favorably accepted by the Office of Personnel Management (OPM) for all employees under this contract requesting a position of trust determination.

8.2.2 It is the responsibility on the contractor to ensure their employees and sub-contractors (if applicable) comply with DHRA personnel security requirements.

8.3 Listing of Employees & Clearance (System Access) Documentation. The Contractor shall maintain a current listing of employees. Within 10 calendar days of contract award, the Contractor shall provide the COR a list with the names, location of performance and security vetting required of company employees that require system access. The list shall be validated and signed by the company DHRA Personnel Security. An updated listing shall be provided when an employee's status or information changes.

8.5 Controlled/Restricted Areas. The Contractor shall be compliant with local procedures for entry to DHRA controlled/restricted areas where Contractor personnel will work.

8.6 Physical Security. The Contractor shall safeguard all Government property and controlled forms provided for Contractor use and adhere to the Government property requirements contained in this contract. At the end of each work day, all Government facilities, equipment and materials shall be secured.

8.7 Pass and Identification Items. The Contractor shall ensure the pass and identification items required for contract performance are obtained for employees and non-government owned vehicles.

8.7.1 Comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the Common Access Card (CAC). Be responsible for obtaining CAC or PIV ready status prior to contract start.

8.7.1.1 All Contractor personnel that require Government system access must obtain/maintain a favorable FBI National Criminal History Check (fingerprint check).

8.7.1.2 Provide two forms of identification (I-9 document).

8.7.1.3 Personnel must be citizens of the United States.

8.7.1.4 Obtaining CAC or PIV ready status is the responsibility of the contractor. It is the responsibility of the contractor to notify DHRA Security and/or DMDC Cybersecurity Division when complete.

8.8 Retrieving Identification Media. The Contractor shall retrieve all identification media, including vehicle passes from employees who depart for any reason before the contract expires; e.g. terminated for cause, retirement, etc.

8.9 Weapons, Firearms, and Ammunition. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their contractor-owned vehicle or privately-owned vehicle while on all DHRA installations.

8.10 For Official Use Only (FOUO). The Contractor shall comply with DoD 5400.7-R, Chapter 4, DoD Freedom of Information Act (FOIA) Program, requirements. This regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding FOUO material.

8.11 Reporting Requirements. Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware may pose a threat to the security of DOD personnel, Contractor personnel, resources, and classified or unclassified defense information.

8.12 Key Control/Access Badge Control. The Contractor shall establish and implement methods of making sure all keys/badges issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The Contractor shall not duplicate any keys issued by the Government.

8.12.1 Prohibited Use. The Contractor shall prohibit the use of keys, issued by the Government, by any persons other than the Contractor’s employees and the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in performance of contract work requirements in those areas.

8.13 Government Furnished Equipment (GFE). The Contractor shall establish and implement procedures to ensure all GFE to include laptops and other data processing devices, issued to the Contractor by the Government are not lost or misplaced, are not used by unauthorized persons or are not subject to unauthorized external devices. The Contractor shall immediately report to the COR any occurrences of lost GFE within two (2) hours of discovery of occurrence. In the event that GFE is lost, the Contractor may be required, upon written direction of the CO, to replace the equipment at no additional cost to the Government. The Government may replace the equipment and deduct the cost of such from the monthly payment due the Contractor.

8.14 Conduct while on Government Installation. The CO may direct the contractor to remove an employee(s) from an assignment under this contract for reasons of security or misconduct. Where the reasons for the removal request is due solely for security or misconduct by the employee(s), the replacement shall be at the contractor’s expense and not chargeable to the government.

8.15 Information System Security. The Contractor shall implement Information System (IS) security protections and ensure the protections are appropriate to the confidentiality, integrity, and availability needs of the Government. Establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data.

8.16 Risk Management Framework. All Information Systems (IS), Platform Information Technology (PIT) and Information Technology (IT) Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with Department of Defense (DOD) Instruction (DoDI) 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT) and comply with annual Federal Information Security Management Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

8.16.1 All systems subject to RMF must present evidence of authorization in the System Security Plan (SSP), Security Assessment Report (SAR) Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD Risk Management Framework (RMF) or equivalent DoD Component PIT system accreditation decision that is current within 3 years. Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) or, if acceptable to the Government, an Interim Authority to Operate (IATO) by contract award.

8.17 Information Security Continuous Monitoring (ISCM). ISCM is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. ISCM is a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur. The Contractor shall maintain ongoing monitoring, analysis and incident response procedures for all IS and PIT systems under this requirement in accordance with NIST SP 800-137.

8.18 Cybersecurity Service Provider (CSSP). The Contractor shall perform CSSP services in accordance with DoDI 8530.01, Cybersecurity Activities Support to the DoD Information Network Operations, Change 1, July 25, 2017.

8.19 Cyber Incident Reporting. Within one (1) hour of discovery of any cyber incident the Contractor shall notify the DMDC Incident Response (IR) team by emailing an Initial cyber incident report to the following organizational box: dodhra.dodc-mb.dmdc.list.ir-team@mail.mil, with subsequent reporting every 24 hours until the incident is closed. The Contractor shall also notify the COR and CO at the time the incident is reported to DMDC/IR.

8.20 The Contractor shall support independent on-site government assessment of compliance of NIST SP 800-171 and NIST SP 800-171A.

8.20.1 The Contractor shall rapidly (within 72 hours) report cyber incidents to the DoD at http://dibnet.dod.mil. Prior to contract award the Contractor shall obtain a medium assurance certificate at http://iase.disa.mil/pki/eca/Pages/index.aspx in order to timely report cyber incidents to the DoD.

8.20.2 System Security Plan (SSP) The Contractor shall develop, document, and periodically update a System Security Plan (SSP) and any associated plans of action developed to satisfy the adequate security requirements of DFARS 252.204-7012, and in accordance with NIST Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”. The SSP shall describe the Contractor’s unclassified information system(s)/network(s) where covered defense information associated with the execution and performance of this contract is processed, is stored, or transmits. The SSP shall be provided to the Government as part of the proposal.

8.20.3 The Contractor shall provide the Government with access to the SSP (or extracts thereof) and any associated plans of action for each of the Contractor’s tier one level subcontractor(s), vendor(s), and/or supplier(s), and the subcontractor’s tier one level subcontractor(s), vendor(s), and/or supplier(s), who process, store, or transmit covered defense information associated with the execution and performance of this contract.

8.21 Identification and Marking of Covered Defense Information (CDI). Identify all covered defense information associated with the execution and performance of this contract. At the post-award conference the Contractor and the Government/Program Office shall identify and affirm marking requirements for all covered defense information, as prescribed by DoDM 5200.01 Vol 4, Controlled Unclassified Information, and DoDI 5230.24, Distribution Statements on Technical Documents, to be provided to the Contractor, and/or to be developed by the Contractor, associated with the execution and performance of this contract.

8.21.1 Tracking CDI. Track all covered defense information associated with the execution and performance of this contract. The Contractor shall document, maintain, and provide to the Government, a record of tier 1 level subcontractors, vendors, and/or suppliers who will receive or develop covered defense information – as defined in DFARS Clause 252.204-7012 and associated with the execution and performance of this contract.

8.21.2 The Contractor shall restrict unnecessary flow down of covered defense information in accordance with marking and dissemination requirements specified in the contract and based on a ‘need-to-know’ to execute and perform the requirements of this contract. This shall be addressed and documented at the post-award conference.

8.22 Compliance with Cybersecurity and Privacy DoD Instructions and Directives. The Contractor and all Contractor personnel with access to or responsibility for nonpublic Government data under this contract shall be in compliance with the latest versions of:

DoD Instruction (DoDI) 8500.01, Cybersecurity DoD Instruction (DoDI) 8510.01, DoD Risk Management Framework (RMF) for DoD Information Technology (IT) The Privacy Act (5 U.S.C. 552a) DoD Instruction 5400.11 DoD Privacy and Civil Liberties Programs, January 2019 DoD Instruction 6025.18 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 2019 DODI 5200.02 DoD Personnel Security Program (PSP) (Incorporating Change 2, Effective May 11, 2018) HSPD-12, Homeland Security Presidential Directive NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations NIST SP 800-137, Information Security Continuous Monitoring DODI 8140, Cybersecurity Workforce DOD 8570.01-M, Information Assurance Workforce Improvement Program

8.23 Cloud Computing. Any commercial cloud computing services used for this requirement must comply with the DoD Cloud Computing Security Requirements Guide and DoD Cloud Computing Supplemental Guidance and Information as published by the Defense Information Systems Agency (DISA).

8.23.1 The Contractor shall have been issued an Authority to Operate (ATO) or Provisional-ATO (P-ATO) by Defense Information Systems Agency at the impact level appropriate to DHRA requirements to provide the relevant cloud computing services in accordance with DoD Cloud Computing SRG. Evidence of DISA authorization must be presented to the government.

8.23.2 The Contractor shall provide CSSP services that align with DoD Cloud Computing SRG requirements and will have a separate Service Level Agreement (SLA) initiated by the government.

8.24 Cyberspace Workforce Management Requirements. The Cybersecurity Workforce includes, but is not limited to, all individuals performing any of the cybersecurity functions described in DOD 8570.01-M. The cybersecurity workforce must be identified and managed, and personnel performing cybersecurity functions will be appropriately screened in accordance with DOD 8140.01 and supporting issuances. It is imperative to the DHRA mission that the cybersecurity workforce establish baseline technical and management cybersecurity skills among personnel performing cybersecurity functions across the DHRA enterprise.

8.24.1 Cybersecurity functions are focused on the development, operation, management, and enforcement of security capabilities for systems and networks. Personnel performing cybersecurity functions establish cybersecurity policies and implement security measures and procedures for DHRA and affiliated information systems and networks.

8.24.1.1 Cybersecurity measures to protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. This includes providing for their restoration by incorporating protection, detection, and reaction capabilities.

8.24.1.2 Job functions that require privilege access to DHRA assets.

8.24.1.2.1 Labor categories at IAT Level I include Computing Environment, Help Desk Support, Local Administrator, Developer/Programmer, Software Engineer, and Software Architect. Labor categories at IAT Level II include Network Environment, System Administrator, Database Administrator, Network Administrator, Application Administrator, Security Administrator, and Mainframe Administrator.

8.24.1.3 Cybersecurity duties may be performed as primary or additional/embedded duties, by a DHRA employee (civilian, military or contractor).

Table 1. The table outlines the job functions within the Cybersecurity Workforce categories and levels.

9.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/INFORMATION (GFP/GFE/GFI)

The Government will provide laptop computers to those Prime Contractors with a need to access Government information systems under this contract. The Contractors issued GFE shall maintain all GFE in accordance with applicable instructions and documents. GFE will be identified at the task order level.

10.0 PLACE OF PERFORMANCE

The Contractor will be working at the Contractor’s facility, and in various locations to be determined and formally agreed to, and executed in writing, by the Government and the Contractor.

11.0 QUALITY CONTROL

The contractor shall implement and maintain a Quality Control Plan (QCP) to ensure work performed conforms to the scope of work and meets the requirements under this PWS. The QCP shall, at a minimum provide a method for performing inspections; identifying, correcting and preventing problems/defective service; addressing customer complaints, and improving the quality of services over the life of the contract.

12.0 QUALITY ASSURANCE

12.1. The Government reserves the right to perform inspections and surveillance to evaluate the Contractor’s compliance to the contract terms and performance of the requirements in the PWS.

12.2. Contract Discrepancy Report (CDR). In the event of unsatisfactory contractor performance, the COR or CO will issue a CDR that will explain the circumstances and findings concerning the incomplete or unsatisfactory service. The contractor shall acknowledge receipt of the CDR and respond in writing as to how he/she shall correct the unacceptable performance and avoid a recurrence. The Government will review the contractor's corrective action response to determine acceptability and will use any completed CDR as part of an overall evaluation of Contractor performance when determining present or future contractual actions.

13.0 ORGANIZATIONAL CONFLICTS OF INTEREST

The Contractor acknowledges that it is familiar with FAR Subpart 9.5, Organizational and Consultant Conflicts of Interest, and agrees to avoid, neutralize or mitigate such conflicts of interest in accordance with the principles set forth in the FAR. If the performance requires the Contractor (to include subcontractors) to supply technical support related to systems or projects with which the Contractor is already directly concerned, either by prime or subcontract, the Contractor shall immediately inform the Contracting Officer. The PWS may be withdrawn if a conflict is found. The Contractor shall not undertake performance of any PWS requirements which requires it to supply technical support regarding such systems until the notice is given, and written consent to proceed is issued by the Contracting Officer.

14.0 DATA RIGHTS

The Government has, at a minimum, Government purpose rights to all documents /material produced under this Contract, regardless of funding source. All documents and materials, to include the source codes of any software, produced under this Contract shall be governed by the following DFARS clauses:

1. DFARS 252.227-7013 Rights in Technical Data-Noncommercial Items

2. DFARS 252.227-7015 Technical Data-Commercial Items

3. DFARS 252.227-7020 Rights in Special Works

These documents and materials may not be used or sold by the Contractor without written permission from the contracting officer.

14.0 APPLICABLE DOCUMENTS

SERVICE RECRUITING WEBSITES

Army Active: www.goarmy.com Reserve: www.goarmy.com/reserve Guard: www.nationalguard.com

Marine Corps http://www.marines.com/#default

Navy Active: www.navy.com Reserve: www.navyreserve.com

Air Force Active: www.airforce.com Reserve: www.afreserve.com Guard: www.goang.com

Space Force www.airforce.com/spaceforce

Coast Guard www.gocoastguard.com

CLAUSES INCORPORATED BY REFERENCE

Rights

Certifications

Or Proposed for Debarment