DRAFT_ATCTS Performance Work Statement.pdf

PERFORMANCE WORK STATEMENT (PWS)

FOR UNITED STATES ARMY CIO/G6

TO SUPPORT THE CYBERSECURITY DIRECTORATE

FOR

ARMY TRAINING AND CERTIFICATION TRACKING SYSTEM (ATCTS)

MISSION SUPPORT

1 Jul 2022

TABLE OF CONTENTS

SECTION DESCRIPTION

1.0 Overview

1.1 Introduction

1.1.1 Primary Mission Background

2.0 Scope of Work

2.1 Requirement Description

3.0 Contractor Tasks

3.1 Listing of Mission Tasks

4.0 General Requirements

4.1 Period of Performance

4.1.1 Hours of Operation

4.1.2 Recognized Holidays

4.1.3 Place of Performance

4.1.4 Travel and Per Diem

4.1.5 Cost Reimbursable (CR) CLINs for Other Direct Costs (ODCs) and

Travel

4.1.6 Key Personnel

4.1.6.2 Key Personnel Certification

4.1.6.3 Security

4.1.5.3.1 Subcontractors

4.1.5.4.1 Citizenship Requirements

4.1.5.4.2 Access to Protected Information

4.1.5.4.3 Background Checks

4.1.5.4.4 AT Level 1 Training

TABLE OF CONTENTS (Continued)

4.1.5.4.5 iWATCH Training

4.1.5.4.6 Personal Identify Verification of Contractor Personnel

4.1.6 Information Assurance Training and Certification

4.1.6.1 Contractor Training Certification Requirements

4.1.6.1.1 DoD IA Awareness Training Requirements

4.1.6.2 Government Furnished Resources

4.1.6.2.1 Government Computers

4.1.6.2.2 Common Access Card Requirements

4.1.6.2.3 Use of Government Property

4.1.7 Contract Deliverables

4.1.7.1 Table of Deliverables

4.1.8 Points of Contact

4.1.8.1 Applicable Documents and Publications

4.1.9 Contract Transition

4.1.9.1 Incoming Transition Planning

4.1.9.2 Sufficient Personnel

4.1.9.3 Outgoing Contractor Transition

4.1.9.4 Outgoing Transition Planning

4.1.9.5 Continuity of Service

4.1.9.6 Listing of Open Tasks

4.1.9.7 Transfer of Materials

TABLE OF CONTENTS (Continued)

4.1.9.8 Sufficient Personnel

4.1.9.9 Cooperation with Other Contractors and Government Personnel

4.1.9.10 Contractor Manpower Reporting Application (CMRA)

5.0 Environmental Requirements

PERFORMANCE WORK STATEMENT

FOR

ARMY TRAINING AND CERTIFICATION TRACKING SYSTEM

1.0 Overview This Performance Work Statement (PWS) defines the requirements for the Contractor to provide non-personal services for Information Technology (IT) support to the United States Army Chief Information Officer (CIO)/G6, Cybersecurity Directorate.

The purpose of this effort is to continue perpetual licenses with integration to use the Army Training and Certification Tracking System (ATCTS) as to accommodate a comprehensive compliance tool that can provide all required Department of Defense (DoD) 8570.01-M and DoD Directive (DoDD) 8140.01 tracking and reporting requirements in one system.

1.1 Introduction

The DoDD 8140-01 establishes the management of DoD cyberspace IT and cybersecurity elements of the DoD cyberspace workforce. The DoD 8570.01-M provides guidance for the identification and categorization of positions and certification of personnel conducting Cybersecurity (CS) functions within the DoD workforce supporting the DoD Global Information Grid (GIG). The manual mandates the identification of all positions performing information system management, specialized, or privileged access CS functions by category, specialty, and level. This applies to all positions with CS and cyberspace IT duties, whether performed as primary or additional/embedded. This requirement applies to military (reserve/active), civilian and contractor positions, including those staffed by local nationals (LNs). The manual also requires that those same personnel must maintain their certified status with a certain number of hours of continuing professional education each year. In addition, all services are required to implement a way to identify, document and track CS/cyberspace IT personnel qualification and certification and qualification status in components personnel databases.

1.1.1 Within the Department of Army, the CIO/G6, Cybersecurity Directorate is responsible for the operation and management of CS/cyberspace IT capabilities for DoD systems and networks that are connected to the Army’s Enterprise Network/LandWarNet. To support the warfighter in a highly effective and professional manner, the Army must ensure that appropriate levels of Cyber awareness, training, education, certification, and workforce management are provided to the CS/cyberspace IT workforce and Information System users commensurate with their respective responsibilities.

1.1.2 The CIO/G6, Cybersecurity Directorate developed and deploys a comprehensive compliance mechanism called the Army Training and Certification Tracking System (ATCTS), to achieve overall objectives and compliance with DOD 8570-01-M and DoDD

8140.01 guidelines. Willco Tech LLC, a division of Metisentry LLC, provides this capability through IASTAR® software, annual maintenance, and support services.

ATCTS is an expansion of the IASTAR® base compliance management application.

2.0 Scope of Work

2.1 The objective of this contract is to verify DOD’s Cybersecurity/cyberspace IT workforce knowledge and skills through standard certification testing and to identify, track, monitor, report, and document completion of Cyber Awareness training requirements for all network/authorized users.

2.2 To maintain effective cybersecurity/cyberspace IT workforce in compliance with DOD’s 8570-01-M and DoDD 8140.01, this order is intended to provide the necessary level of administrative, professional, and technical support required to facilitate the overall objectives of the ATCTS continuation of the enterprise-wide site license.

3.0 Contractor tasks

3.1 The following tasks are required:

• Software support for 1,000,000 active perpetual IASTAR software licenses that will provide the capability for users and managers to register, add, modify, delete and manage training information to their accounts. Inactive licenses will be purged as they reach the four (4) year inactivity date.

• Maintain ATCTS to handle up to 10,000 concurrent user sessions and at least 1.4 million student records. Vendor must coordinate with the hosting server facility.

• Maintain automated interfaces with applicable DoD, Federal, Army and manpower databases. If automated interfaces cannot be established then a process must be implemented for daily/weekly/monthly manual updates via various Microsoft formats.

• Maintain and update the data dictionary for ATCTS.

• Update user interfaces to enable efficiency.

3.1.1 Technical Writing and Documentation Support

The Contractor shall provide technical writing and documentation support. Technical Writing Services and Documentation Support include, but are not limited to:

• Update ATCTS’ user and manager guides quarterly to support system usability.

• Provide updates to system design and document to support the Risk Management Framework requirements.

3.1.3 Mission and Business Application/Tool Development, Integration, and Maintenance

The Contractor shall provide mission and business application/tool development, integration, and maintenance services. These services focus on designing, developing, integrating, and maintaining applications, tools, services, and other software as required in order to improve business and mission capabilities and improve application effectiveness. Services include, but are not limited to:

• Add, modify delete functionality based on Army CIO/G6 requirements; Perform system upgrades to comply with hosting facility requirements;

• Maintain backup records of the system state in accordance with RMF and Continuity of Operations (COOP) requirements.

• Voucher integration and distribution: Maintain exam voucher management module to ensure all pre-purchased exam vouchers can be imported into the software, distributed to Information System Security Managers/Officers (ISSM/ISSO) and assigned to specific individuals for testing.

• Maintain mobile training course registration module- Mobile Training Team registration, tracking, reporting by monthly/quarterly/annually and Fiscal Year and integrate Army training course results and statistics into ATCTS.

• Report module- allowing managers at all levels to create, customize, print and export to excel, comma separated variable (CSV) and pdf formats, training and certification statistics for their personnel.

• News and document content: Maintain news and document content management features of ATCTS.

• Provide project plan for quarterly updates to ATCTS modules. Plan should include layout for Federal Information Security Management Act (FISMA) updates, timeline for NICE framework updates, projected down time for system updates for data optimization, timeline for reports module changes.

• Provide changes to the ATCTS data fields to capture annual changes in the FISMA reporting requirements.

• To the maximum extent possible, the Contractor shall use Government-provided software and tools to perform these services.

3.1.4 Web and Portal Systems Development, Integration, Maintenance, and Management

Maintain web portal and develop Application Programming Integration (API) as required.

These services include, but are not limited to, web and web portal planning, development, integration, testing, and support.

The Contractor shall support Army requirements for web and portal services and data security.

The Contractor shall assist the Government in the implementation of web services standards.

The Contractor shall adhere to the Security Controls and Security Technical Implementation Guideline (STIG) requirements to attain/maintain the Authority to Operate for ATCTS.

3.1.5 Updates:

• Prioritize updates as required to align features in ATCTS with DODD 8140.01 and the DoD Cyberspace Workforce Framework (DCWF)/National Initiative for Cyberspace Education (NICE) Framework.

• Provide project plan for quarterly updates to ATCTS modules.

• Provide changes to the ATCTS data fields to capture annual changes in the FISMA reporting requirements to align to the DoD Cyberspace Workforce Framework

(DCWF).

3.1.6 Service Desk

The Service Desk shall provide services during the hours of 0900-1700 EST, Monday through Friday. Does not include U.S. federal holidays. Customers must be able to reach helpdesk via email or telephone.

The Contractor shall support the development of Service Desk capabilities that include Helpdesk customer support services to at least 1.4 million active users.

The Service Desk will be staffed with personnel to answer customer inquiries for higher tier support and have extensive knowledge of the management system.

4.0 General Requirements

4.1 Period of Performance

Base Period: 1 August 2019 - 31July 2020 Evaluated Option 1: 1 August 2020 – 31 July 2021 Evaluated Option 2: 1 August 2021 – 31 July 2022 Evaluated Option 3: 1 August 2022 – 31 July 2023 Evaluated Option 4: 1 August 2023 – 31 July 2024

4.1.1. Hours of Operation:

The contractor shall conduct business between 9:00 AM to 5:00 PM, Monday thru Friday except Federal holidays, or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closing. The contractor shall coordinate employees’ proposed schedules with the Contracting Officer’s Representative (COR) and Contracting Officer to ensure they will meet mission requirements. Services to be performed under this contract shall generally be performed during normal duty hours.

4.1.2 Recognized Holidays:

The following are the Federal Holidays to be recognized by the contractor:

New Year’s Day Labor Day Martin Luther King Jr. Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day

Independence Day Christmas Day

4.1.3 Place of Performance:

The work to be performed under this contract will be performed at the contractor’s facility. In the event of a Government shut down due to weather or other events, the contractor shall not bill for these hours, unless work is performed at the contractor’s site. The contractor shall obtain COR concurrence and Procurement Contracting Officer (PCO) approval in advance for these events.

4.1.4 Travel and Per Diem:

The contractor shall provide support in the Continental United States (CONUS). The government anticipates potentially two CONUS trips per year to the Cybersecurity Directorate offices in Fort Belvoir, VA for the base and option years. It is the responsibility of the contractor to obtain all necessary travel documents to execute travel as required. The Government in accordance with the Joint Travel Regulation (JTR) and FAR 31.205-46 will reimburse the Contractor for all approved travel incurred in the performance of this contract. All travel requirements must be concurred on and PCO approval received prior to commencement of travel. The Contractor shall provide trip reports to the COR and PCO within 5 days of completion of travel. Any waiver to this requirement must be provided by the PCO and will be provided on a case-by-case basis and given prior to commencement of travel.

4.1.5 Cost Reimbursable (CR) CLINs for Other Direct Costs (ODCs) and Travel:

CR CLINs for ODCs and Travel in support of Mission requirements are authorized to procure items and supplies necessary for Army Training & Certification Tracking System (ATCTS). All ODCs and Travel shall be approved by the COR and Procuring Contracting Officer prior to implementation.

4.1.6 Key Personnel:

4.1.6.1 The contractor shall not replace the proposed Key Personnel for a period of 180 calendar days, from the date of contract award, unless one of the following circumstances applies: death, serious illness, disability, use of part-time personnel for surge purposes or at the request of the government, and personnel placed at risk due to the lack of funding).

Page 10 of

4.1.6.2 In the event the Contractor needs to substitute any of its Key Personnel, the Contractor shall submit resumes and Cyber security/IA training and certification certificates for all individuals proposed to serve in Key Personnel positions. Resumes, including security clearance levels, should be submitted at least two (2) weeks prior to the departure of the individual being replaced. Key Personnel shall not be removed or replaced from the program without prior notification, in writing, given to the COR and Contracting Officer.

4.1.6.3 Security: The Contractor shall maintain the following throughout the contract period of performance:

All Key Personnel shall maintain an active, final DoD Secret security clearance.

4.1.5.3.1 Subcontractors: Subcontractors must have an active, final DoD security clearance level that is the same as required for their portion of the contract. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “confidential”, “secret”, or “Top Secret” and requires contractors to comply with (1) The security agreement (DD Form 441) including the National Industrial Security Program Operating Manual (DoD 5220-22-M); any revisions to DoD 5220.22-M, notice of which has been furnished to the contractor. Contractor and all associated subcontractor employees shall comply with applicable installation, facility, and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required or background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by DoD, Headquarters Department of Army (HQDA) and/or local policy. In addition to the changes otherwise authorized by the changes clauses of this contract, should the Force Protection Condition (FPCON) at any individual facility for installation change, the Government may require changes in contractor security matters or processes.

4.1.5.4.1 All contractor personnel performing under this contract must be U.S.

Citizens.

4.1.5.4.2 Access to Protected Information: During the performance of this contract, contractor personnel may obtain access to protected information including, but not limited to, trade secrets or proprietary information of other Contractors, Government source selection information, Privacy Act information, and any other information with distribution limited by the Government. In the event of any such access, by any means, those contractor personnel shall in no way divulge any such information except as required for the performance of this contract, and then only within the Cyber security directorate, and they shall not otherwise use or disclose this information for their personal gain, the gain of their employer, or the gain of anyone else. Contractor personnel shall sign nondisclosure agreements.

The Contractor shall notify the Contracting Officer of any potential or actual organizational conflict of interest (OCI) that could arise under the contract. However, a nondisclosure agreement will not overcome an OCI as defined in FAR Part 9.5.

Moreover, compliance with the Trade Secrets Act requires the consent of the owner of the proprietary information before another non-federal entity may be allowed access to such information. Accordingly, any time the Contractor is given access to information marked as proprietary by a non-federal entity, it is incumbent upon the Contractor to inform the Contracting Officer of the access. Contractor personnel will ordinarily be required to sign a nondisclosure agreement before starting work under the contract.

Failure to comply with this paragraph shall be deemed adequate cause for the removal of a Contractor employee from employment with the Contractor. The Contractor’s employment contracts with their employees shall include a provision for removal under these conditions.

4.1.5.4.3 The Contractor shall also provide all information required for background checks of their personnel to meet installation access requirements. These background checks will be performed by the installation Provost Marshal Office, Director of Emergency Services or Security Office. The Contractor workforce must comply with all personal identity verification requirements as directed by DoD, HQDA and/or local policy. In addition to the Changes Clause, in the forthcoming contract should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor security matters or processes.

4.1.5.4.4 AT Level I Training. All Contractor employees, to include Sub-Contractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date, or effective date of incorporation of this requirement into the contract, whichever is applicable. The Contractor shall submit certificates of completion for each affected Contractor employee and Sub-Contractor employee to the COR or to the Contracting Officer within 30 calendar days of completion of training by assigned personnel. AT level I awareness training is available at the following website: https://jko.jten.mil course number: JS-US007 Level I Antiterrorism Awareness Training - (2 hrs) /

4.1.5.4.5 iWATCH Training. Contractor employees with an area of performance within an Army controlled installation, facility or area. The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity with the authority to operate (ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract award.

Contractor shall develop an Operat ion Secur i ty (OPSEC) Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer, per AR 530-1, Operations Security. This SOP/Plan will include the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator. The contractor will ensure this individual becomes OPSEC Level II certified per AR 530-1.

https://jko.jten.mil/

Per AR 530-1, Operations Security, new contractor employees must complete Level I OPSEC training within 30 calendar days of their reporting for duty. All contractor employees must complete annual OPSEC awareness training.

4.1.5.4.6 Personal Identity Verification of Contractor Personnel. In accordance with FAR clause 52.204.9 – Personal Identify Verification of Contractor Personnel (Sep 2007):

(a) The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

(b) The Contractor shall insert this clause in all subcontracts when the subcontractor is required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system.

4.1.6 Information Assurance Training and Certification:

4.1.6.1 Per DoD 8570.01-M, DFARS 252-239.7001 and AR 25-2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award. The positions supporting the tasks shall be Information Assurance Technical levels 1 or IA Management level 1 certified as a minimum in accordance with DOD 8570.01-M.

The DoD 8570.01M certifications for Technical Level 1 are A+CE, Network+CE, SSCP and CCNA Security. The DoD 8570.01M certifications for Management level one are CAP, GSLC and Security+CE. All contractor employees working CS/IT functions must comply with DoD and Army training requirements in DoDD 8140.01, DoD 8570.01-M and AR 25-2. All contractor employees with access to a government information system must be registered in the ATCTS at commencement of services, and must successfully complete the DoD Information Assurance Awareness course prior to access to the information systems and then annually thereafter.

4.1.6.1.1 All contractor employees and associated sub-contractor employees must complete the DoD Cyber awareness training before issuance of network access and annually thereafter. The Contractor must receive approval from the COR before contractor personnel take any training course on the Government’s time.

Other required Army training:

Anti-terrorism training: AT Level 1 Training. All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level 1 awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel. AT Level 1 awareness training is available at the following website: https://jko.jten.mil course number: JS-US007 Level I Antiterrorism Awareness Training - (2 hrs).

OPSEC Training: Per AR 530-1, Operations Security, new contractor employees must complete OPSEC level 1 training within 30 calendar days of their reporting for duty. All contractor employees must complete annual OPSEC awareness training.

The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 60 calendar days of contract award and within 45 calendar days of new employees commencing performance with the results reported to the COR NLT 90 calendar days after contract award.

4.1.6.2 Government Furnished Resources:

4.1.6.2.1 As appropriate to perform tasks in this PWS, the Government may issue laptop computers. The equipment, materials and information provided by the Government to the Contractor or to which the Contractor has access in performance of this contract are the exclusive property of the Government.

4.1.6.2.2 Contractor personnel shall acquire and maintain Government-Issued Common Access Cards (CAC). Contractor employee access eligibility remains in force during employment under the contract for those employees who have a valid and recurring requirement for access to Army facilities or automation systems to perform those duties stipulated in the contract. The Contractor shall return CACs to the COR or his/her designated representative when the Contractor employee’s employment is terminated or upon expiration of the contract. The CACs expire upon the end of each Period of Performance (POP).

4.1.6.2.3 Any Government property or resources provided shall be used only for contract performance-related purposes. Reproduction, automation and facsimile equipment shall not be made available to contractor employees for any services not directly related to support of this contract. For example, the Contractor shall not use IT resources to access pornographic materials/web sites, conduct personal business, or play games per AR 25-2. The contracting officer must approve the use of Government Furnished Equipment (GFE) during non-duty hours. The contractor shall not install non- Government-owned computing systems or devices without the COR coordinating and obtaining proper authorization from the appropriate cyber security/IA office. The non- Government owned computing systems or devices include, but are not limited to personal or contractor-owned thumb drives (e.g., memory sticks, flash drives, Universal Serial Bus (UB) drives, jump drives, pen drives), removable external hard drives, Personal Digital Assistants (PDAs), MP3 players, cell phones, digital media, CD/DVD burners, optical recordings, photo flash cards, laptops or any devices that can store data.

4.1.9 Technical Deliverables:

https://jko.jten.mil/

4.1.9.1 In addition to those deliverables required by paragraph 3.0 inclusive, the Contractor shall provide the following deliverables to the COR by the date required:

Title PWS Task # Reference

Frequency Due Date Addressee

Provide software support for 1.0 million active perpetual

IASTAR

software licenses

3.1 As needed Upon contract

award

COR and Contracting Officer

Provide up to

135,000 IASTAR

licenses for annual issue per

3.1 As needed At end of

option years

COR and contracting officer

Transition Plan 4.1.8.1 Due with proposal submission.

Transition plan due w/proposal submission.

COR and contracting officer

Performance Metrics number of registered personnel

3.1 Monthly By the 5th

work day of each month

COR and contracting officer

Non-disclosure agreements

Due 7 days from award date

Due 7 days from award date

COR and contracting officer

Provide list of all changes and future updates to ATCTS or

3.1.3 As needed As need COR and

contracting officer

Maintain Exam Voucher management module

3.1.3 Weekly Weekly COR and

contracting officer

Maintain document management module

3.1.3 Weekly Weekly COR and

contracting officer

Maintain news content management

3.1.3 Weekly Weekly COR and

officer features in

ATCTS

Maintain mobile training course registration module

3.1.3 Weekly Weekly COR and

contracting officer

Maintain training and certification reports module

3.1.3 Weekly Weekly COR and

contracting officer

Provide project plan for ATCTS updates

3.1.3 Quarterly Quarterly COR and

contracting officer

Provide troubleshooting and help desk support

3.1.6 Daily Daily COR and

contracting officer

List of open tasks

4.1.8.6 4 days prior to contract end date

4 days prior to contract end date

COR and officer

4.1.8 Points of Contacts (POC) The COR will be determined at contract award.

4.1.8.1 Applicable Documents and Publications. The following publications form a part of this contract. The publications below with which the Contractor shall comply are “Mandatory.” The Contractor shall use current commercial practices and publications whenever possible. A significant number of Army regulations that govern the conduct of the required work are listed below. The PWS may set a higher standard of performance than an applicable Army regulation. The PWS will control over the regulations unless a particular PWS provision is in direct conflict with the applicable provision of the Army regulation. The publications can be accessed from internet site www.apd.army.mil. The Government will provide those publications not available on a web site. The Contactor shall comply with changes to publications. The Contractor shall notify, in writing, the Contracting Officer of any changes to a publication or document that impact the cost of the contract.

AR 25-2 Army Cybersecurity BBP 05-PR-M-0002 Information Assurance (IA) Training and Certification Program AR 25-50 Preparing and Managing Correspondence AR 25-55 Department of the Army Freedom of Information Act Program http://www.apd.army.mil/

AR 25-400-2 The Army Records Information Management System (ARIMS) Joint Travel Regulation (JTR) Volume 2

AR 380-5 Department of the Army Information Security Program AR 530-1 Operations Security DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM) DODI 8500.01 Cybersecurity DODI 8510.01 Risk Management Framework (RMF) for DOD IT DOD 8570.01 Information Assurance Workforce Improvement Program DODD 8140.01 Cyberspace Workforce Management FISMA Federal Information Security Management Act NICE Framework National Initiative for Cyber security Education (NICE) Framework

4.1.9 Contract Transition: Outgoing and Incoming Contractors:

At the conclusion of the contract period of performance, the outgoing contractor and incoming contractor shall perform transition activities:

4.1.9.1 Incoming Transition Planning:

• The contractor shall at a minimum familiarize itself with the agency procedures and processes, the architecture, environment and customer base

• The incoming contractor shall provide the Government with a transition plan that provides for receiving all open work and associated materials and assets in the possession of the Government, which may be related to ongoing work

• The contractor will review and correct any weaknesses identified by the Government in the contractor proposed Incoming Transition Plan. This plan will be revised within three (3) working days after Government identifies the need for a revision.

• The contractor shall ensure continuity of services while implementing its Transition Plan for all affected tasks to preclude any adverse impact on the mission

4.1.9.2 Sufficient Personnel: The incoming contractor shall provide a sufficient number of personnel to ensure effective transfer of all work in progress so as not to impact mission accomplishment.

4.1.9.3 Outgoing Contractor Transition: (This transition will be used at the end of the contract period of performance)

4.1.9.4 Outgoing Transition Planning: The contractor shall provide the Government with an outgoing transition plan that provides for conveying all open work and associated materials and assets in their possession to the Government.

4.1.9.5 Continuity of Service: The contractor shall ensure the continuity of service while implementing its outgoing transition plan for all affected activities to preclude any adverse impact on the mission.

4.1.9.6 Listing of Open Tasks: The Contactor shall provide the COR a complete listing of all open tasks indicating the status of completion and any performance issues associated with them. The report is due no later than 4 days prior to the contract scheduled end date.

4.1.9.7 Transfer of Materials: The contractor shall transfer to the Government all intellectual and real property belonging to the government which was generated, purchased on behalf of, or provided by the government for the performance of the work within this contract. At completion of the contract all data becomes the property of the Government.

4.1.9.8 Sufficient Personnel: The outgoing contractor shall provide a sufficient number of personnel to ensure effective transfer of all work in progress so as not to impact mission accomplishment.

4.1.9.9 Cooperate with Other Contractors and Government personnel: The contractor shall maintain a cooperative work environment with other Government contractors and personnel so as not to cause interference, disagreement or delays to work to be performed while not compromising health, safety or security. The contractor shall be responsible for adapting schedules and performance to accommodate additional support work. Conflicts or cause for delays shall be brought to the attention of the COR and the

PCO.

4.1.9.10 Contractor Manpower Reporting Application (CMRA)

The Contractor shall report ALL Contractor labor hours (including subcontractor labor hours) required for performance of services provided under the contract via a secure data collection site. The Contractor is required to completely fill in all required data fields using the following web address: https://www.ecmra.mil/, and then click on “Department of the Army CMRA” or the icon of the DoD organization that is receiving or benefiting from the contracted services.

5.0 Environmental Requirements.

5.1 Contractor shall comply with all applicable federal, state and local environmental laws, statutes, regulations, executive orders, permits. Any regulations (with supplements), as well as Major Subordinate Command (MSC) and installation regulation, policy, Host Tenant Agreement, Interagency Service Support Agreement, or Status-of-Forces Agreement. Contractor shall immediately report any conflicts between applicable federal, state, local environmental laws, statutes, executive orders, and provisions of Army Regulation 200-1, and any specifications within this contract to the Contracting Officer Representative (COR).

5.2 Contractor shall immediately notify the Designated Government Representative (DGR) and COR of the arrival on site of any Federal, State and/or DoD environmental regulator or enforcement agent and/or the receipt of any correspondence from a Federal of https://www.ecmra.mil/

State environmental agency.

5.3 Contractor shall submit to potential Federal, State, Army and installation work site environmental regulatory inspections and/or investigations into noncompliance and fully cooperate with such inspections/investigations by providing the appropriate records and documentation. Environmental regulatory agencies are authorized by law to inspect any work site for environmental compliance with regulatory requirements. If an inspection is conducted, it will not stop or disrupt ongoing contract activities. The inspection will only require the work site environmental officer, or supervisor/manager to answer questions and/or escort the inspector to specific work site areas with the potential to affect environmental quality.

5.4 Contractor shall immediately report any nonconformance and/or noncompliance with applicable Federal, State or Local environmental laws, Army and installation environmental regulations or policies to the COR and DGR.

5.5 Contractor shall obtain from the COR or DGR, a copy of AMC’s National Environmental Policy Act Policy and 32 CFR 651 which addresses actions to be taken by contractor. These document include but is not limited to the analysis-associated decision document of an Environmental Impact Statement and Record or Decision; Environmental Assessment and Finding of No Significant Impact or Notice to Proceed; or Record of Environmental Consideration on the proposed contract actions prior to commencement of such actions.

ACRONYMS

ANSI American National Standards Institute ARIMS Army Records Information Management System ATCTS Army Training and Certification Tracking System AT Anti Terrorism ATO Authority to Operate CAC Common Access Card CIO Chief Information Officer CONUS Continental United States COR Contracting Officer Representative DoD Department of Defense FISMA Federal Information Security Modernization Act FIPS PUB Federal Information Processing Standards Publication FOIA Freedom of Information Act FPCON Force Protection Condition GFE Government Furnished Equipment HQDA Headquarters Department of Army IA Information Assurance IT Information Technology JTR Joint Travel Regulation NICE National Initiative for Cybersecurity Education NISPOM National Industrial Security Program Operating Manual OCI Organizational Conflict of Interest OMB Office of Management and Budget OPSEC Operations Security PCO Procurement Contracting Officer PDAs Personal Digital Assistants POC Point of Contact POP Period of Performance PWS Performance Work Statement RMF Risk Management Framework SOP Standard Operating Procedure UB Universal Serial Bus