(Draft) Exhibit A - PWS.pdf

DRAFT

UNCLASSIFIED

PERFORMANCE WORK STATEMENT (PWS)

FOR

ENTERPRISE SECURITY AND

OPERATIONS

30 MAY 2025

2 | P a g e

Table of Contents

1. General Information

2. Background

3. Objectives

4. Scope

5. Performance Requirements

5.1 Mission Task Area 1: Program Management

5.2 Mission Task Area 2: Physical Security

5.3 Mission Task Area 3: Police

5.4 Mission Task Area 4: Information Security

5.5 Mission Task Area 5: Personnel Security

5.6. Mission Task Area 6: Insider Threat

6. IDIQ Personnel Qualifications/Experience

6.1 Junior Level

6.2 Mid-Level

6.3 Senior Level

6.4 Expert Level

6.5 Psychologist (specific to section 5.5.11)

7. Security Requirements

8. Travel

9. Place of Performance

10. Duty Hours

11. IDIQ Personnel Requirements – Key Personnel

12. Non-Disclosure Requirements (NDA)

13. Contract Data Requirements List (CDRL)

14. Contractor Information Security

15. Annual Training

16. Government Furnished Property, Equipment, and Services

17. Contractor Furnished Materials, Equipment, Training, Supplies, and Clothing

18. Quality Control

19. Deliverables

20. Definitions and Acronyms

3 | P a g e

1. General Information

This is a non-personal services IDIQ to provide Enterprise Security and Operations Support.

The Government shall not exercise any supervision or control over the service providers performing the services herein. Such service providers shall be accountable solely to the

Contractor who, in turn is responsible to the Government.

2. Background

The United States Government’s (USG) Defense Intelligence Agency (DIA) is required to provide Enterprise Security and Operations Support to prevent, detect, protect, and respond to threats to sensitive information from unauthorized access to information and/or data through

Physical Security, Information Security (InfoSec), Personnel Security, and Insider Threat.

3. Objectives

The objective of the Indefinite Delivery, Indefinite Quantity (IDIQ) is to acquire Enterprise

Security and Operations labor support to deliver multi-disciplined security solutions and mitigations to protect DIA and enterprise partners globally. The Contractor(s) shall provide skilled, experienced professional security specialists personnel to support service-related tasks across six (6) mission areas that include Program Management, Physical Security, Police, Information Security, Personnel Security, and Insider Threat for DIA. This effort will deliver to

DIA worldwide coverage for security enabling services.

4. Scope

The scope of this IDIQ includes the full range of geographic effort that includes any component of DIA where Contractor-provided security services are required. As a combat support organization, DIA’s mission involves direct support to operational or deployed forces. The capability to rapidly respond to requirements for on-site security activities worldwide forms a key part of this effort.

5. Performance Requirements

The work performed under this Contract and any awarded task order (TO) will provide various security services as defined within this PWS. Specific security services required at specific locations will be defined at the TO level. At a minimum, there are six (6) mission task areas to include Program Management (Mission Task Area #1), Physical Security (Mission Task Area

#2), Police (Mission Task Area #3), Information Security (Mission Task Area #4), Personnel

Security (Mission Task Area #5), and Insider Threat (Mission Task Area #6) that will require support from multiple labor categories based on TO requirements.

5.1 Mission Task Area 1: Program Management

Each TO under this IDIQ contract shall specify its own program management requirements. The

Contractor shall provide management direction, administration, and quality assurance for all work performed under each individual TO. This includes overseeing and managing all activities

4 | P a g e performed by Contractor personnel and subcontractors to meet the specific requirements outlined in the TO.

5.1.1 Project Manager

The Project Manager (PM) is considered Key Personnel and shall be assigned at the TO level.

The PM shall serve as the Government’s primary point of contact and provide overall leadership and guidance for all contractor personnel assigned to the TO. The PM shall have the authority to represent the contractor’s organization in response to Government issues, concerns, or problems.

The Government desires that Key Personnel be assigned for the duration of the TO.

5.1.2 Project Kick-Off Meeting

The Government shall organize and lead a Project Kick-Off Meeting at a Government approved location. This initial meeting will bring together the Contractor’s teams and Government representatives involved in the IDIQ contract for formal introductions. During this meeting, participants will have the opportunity to address critical project elements, including technical requirements, management approach, security considerations, travel authorization process, and reporting procedures.

5.2 Mission Task Area 2: Physical Security

Physical security focuses on protecting sensitive or classified information, personnel, facilities, and resources from threats including criminal activities, terrorism, and hostile intelligence operations. Security professionals in this field develop comprehensive policies while designing and evaluating protection systems to prevent compromise, sabotage, theft, or misuse of sensitive information and equipment. Their responsibilities include inspecting both existing and new security systems to identify vulnerabilities and recommend appropriate improvements. They conduct thorough evaluations of facility and information security measures to ensure optimal protection.

These specialists perform comprehensive security assessments to evaluate control systems and monitor the handling of sensitive materials. When they identify areas where security requirements aren't being met, they document their findings and recommend specific solutions.

Their work ensures that security measures remain effective and up-to-date. Key roles in this field include Sensitive Compartmented Information Facility (SCIF) Accreditation and Inspection

Specialist, SCIF Facility Security Design Specialist, TEMPTEST Technician, Physical Security

Specialist, Physical Security Information Technology (IT) Database Management Specialist, and

Anti-terrorism/Force Protection Specialist. These professionals work collaboratively to create and maintain secure environments for sensitive government operations.

5.2.1 SCIF Accreditation and Inspection Specialist: The Contractor shall provide the required personnel to assist in the SCIF accreditation processes including reviewing various SCIF security documents related to SCIF design, construction, and operations in accordance with Department of Defense/ Intelligence Community (DoD/IC) policy and where appropriate, make

5 | P a g e recommendations to the government accreditation officials to ensure accreditation milestones are achieved.

5.2.2 SCIF Facility Security Design Specialist: The Contractor shall provide the required personnel to integrate security considerations and systems as a function of the SCIF facility security design, construction, acquisition planning, and execution process to include identifying security vulnerabilities and implementing preventive measures to ensure the completion of the construction process or delivery of a system and/or product.

5.2.3 TEMPEST Technician: The contractor shall provide personnel who shall issue comprehensive guidance and instruction to a diverse customer base throughout DIA and the DoD in accordance with TEMPEST security policy, procedures and techniques. Conduct site security visits and provide technical advice & assistance; assist government personnel on site security inspections; conduct radio frequency testing and evaluations of facilities to reduce the probability of compromising emanations; review SCIF Fixed Facility Checklists; conduct TEMPEST countermeasure reviews; and review TEMPEST Addendums to the Fixed Facility Checklist –

Form B in preparation for government issued TEMPEST accreditations in support of the SCIF accreditation process.

5.2.4 Physical Security Specialist: The Contractor shall provide personnel to inspect, analyze, and evaluate new and existing security systems in order to determine whether or not the system is providing adequate protection; assess the adequacy of the security and management control systems; monitor the manner in which sensitive material is handled and used; recommend appropriate corrective action and adjustments where security requirements are not being observed; and document the findings and recommendations.

5.2.5 Physical Security IT Database Manager: The Contractor shall provide the required personnel to support to ongoing inspections through updating records within the security databases and the IC SCIF Repository with outcomes from recent inspections and official changes that are required, including the ability to identify technical information gaps within the records, and clearly articulate information shortfalls to customers.

5.2.6 Anti-Terrorism/Force Protection Specialist: The Contractor shall provide the required personnel to conduct inspections and assessments of all government facilities to ensure protection from loss, unauthorized disclosure, espionage, terrorism, sabotage, natural disaster, or compromise of information or material which is considered vital to national defense and security, as well as to the privacy of individuals and entities. In addition, the inspections and assessments conducted includes protection of the agency’s, personnel, and premises from intrusion, trespass, acts of violence, theft, or fire.

5.3 Mission Task Area 3: Police

The Police mission task area focuses on physical protection of sensitive or classified information, personnel, facilities, installations, or other sensitive materials, resources, or processes against criminal, terrorist, or hostile intelligence activities. At a minimum, labor categories within this mission area include Site Rover and Relief Guard, Guard Shift Supervisor, Access Control

6 | P a g e

Guard, Security Operations Controller, Access Control Specialist, Canine Explosive Specialist, Firearm Instructor, Threat Management Specialist, and Police Operations Specialist.

5.3.1 Site Rover and Relief (SRR) Guard: The Contractor shall provide the required personnel to maintain a mobile security presence to deter, prevent, and report all criminal activities and/or violations of DIA policies and regulations, respond to all Security Operations Controller (SOC) dispatch alerts for incidents and crisis response as well as provide first response and communicate the results of the assessment conducted back to the SOC along with any request for reinforcement or additional emergency services (fire, ambulance, hazmat, canine, EOD, etc.).

5.3.2 Guard Shift Supervisor (GSS): The Contractor shall provide the required personnel to support the day-to-day operational management of the Access Control Guards (ACG) including training, scheduling, access coordination, management of resources and reassignment of

Contractor personnel due to unexpected absence.

5.3.3 Access Control Guard (ACG): The Contractor shall provide the required personnel to support positive personnel identification and control through the verification of identification media. Additionally, scan all incoming correspondence for hazardous material to include the proper administrative control and operation of systems and equipment (screening devices, i.e., metal detectors, x-ray machines, sterilization equipment, radiation detection devices) designed for the management of property, deliveries, packages, and controlled/prohibited items and activities.

5.3.4 Security Operations Controller (SOC): The Contractor shall provide the required personnel to monitor security systems, including access control, video surveillance, and alarm systems at secure facilities. These personnel will alert appropriate security staff when potential threats are detected. Additionally, Contract personnel will manage daily security technology operations, which includes responding to security incidents and ensuring compliance with established security policies.

5.3.5 Access Control Specialist: The Contractor shall provide the required personnel to monitor and maintain control of all entry access points in and out of DIA facilities by ensuring personnel identification throughout the production, issuance, and verification of identification media through access control and related administrative processing support to include operating and maintaining manual and computer-based access control systems, databases, and equipment.

5.3.6 Canine Explosive Detection Team: The Contractor shall assemble a Canine Explosive

Detection Team, comprised of a highly trained canine dog with an experienced handler, to deter/detect illegal and potentially life-threatening activities directed against DIA employees, visitors, information, programs and property.

5.3.7 Firearms Instructor: The Contractor shall provide the required personnel to instruct DIA personnel on the use of firearms including handguns, rifle, less lethal shotguns, and all related authorized weapons.

7 | P a g e

5.3.8 Threat Management Specialist (TMS): The Contractor shall provide required personnel to support DIA Police operations. These personnel will monitor suspicious activities and persons that may threaten DIA personnel, property, or information. Support activities include conducting routine database queries, performing protective intelligence analysis, and developing threat assessments. All efforts are designed to ensure the safety and security of the DIA workforce.

5.3.9 Police Operations Specialist: The Contractor shall provide the required personnel to maintain 100% accountability for all inventoried police property. The Contractor will ensure full compliance with inventory requirements for firearms, radio communications equipment, and sensitive equipment. Additionally, they will maintain General Services Administration (GSA) fleet records for all assigned police vehicles. The Contractor shall coordinate with eight (8) geographically separated facility area commanders to schedule and track vehicle maintenance, ensure timely repairs of GSA fleet vehicles, and maintain accurate maintenance records.

5.4 Mission Task Area 4: Information Security

The Information Security mission encompasses a broad range of responsibilities focused on the classification, declassification, and protection of sensitive national defense information and other controlled data across Federal agencies. Specialists in this field are tasked with identifying information that requires protection and determining the appropriate level of security needed.

This sensitive information, which can include documents, materials, devices, industrial processes, and systems, is typically contained within various secure environments such as

Federal facilities, industrial sites, academic institutions, and other governmental organizations, including foreign governments, or other designated locations. The mission is carried out by several specialized roles, including Industrial Security Specialists, Program Security Specialists, Classification Management Specialists, and Security Awareness and Education Specialists.

These professionals work together to ensure the proper handling, storage, and protection of sensitive information critical to national security.

5.4.1 Industrial Security Specialist: The Contractor shall provide the required personnel to conduct security guidance, reviews and verification of the Department of Defense Contract

Security Specification form (DD-254). The DD-254 addresses classified information handling, facility security level changes, contract modification(s), and personnel changes including foreign ownership concerns for DIA contractors.

5.4.2 Program Security Specialist: The Contractor shall provide the required personnel to manage and implement all security policies and requirements for designated Special Access

Programs (SAPs), compartments, sub-compartments, and projects.

5.4.3 Classification Management Specialist: The Contractor shall provide the required personnel to perform detailed analysis of classification standards, regulations, policies and procedures including quick issue resolution by identifying and assessing associated sources for classification determinations.

8 | P a g e

5.4.4 Security Awareness and Education Specialist: The Contractor shall provide the required personnel to conduct security awareness training/education for the DIA workforce across all security disciplines.

5.5 Mission Task Area 5: Personnel Security

Personnel Security mission task area include a wide range of security disciplines to ensure the loyalty, reliability, suitability, and trustworthiness of applicants, employees, and others who work with or have access to sensitive or classified information and material. At a minimum, labor categories within this mission area include, Security Support Specialist, Personnel Security

Adjudicator, Security Specialist, Polygraph Specialist, Polygraph Scheduling Specialist, and

Personnel Security Analytical Support Specialist.

5.5.1 Security Support Specialist: The Contractor shall provide the required personnel to support the DIA workforce with personnel security functions for Sensitive Compartmented Information

(SCI) and SAPs. These functions include developing, maintaining, and managing personnel security programs in compliance with National Industrial Security Program Operating Manual

(NISPOM), Director of Central Intelligence Directives (DCIDs), Intelligence Community

Directives (ICDs), and other applicable government security directives. The Contractor's personnel will use the Defense Information Systems for Security (DISS) and related databases to track and maintain security clearances. Additionally, required personnel assists government personnel with SCIF visitor control functions, visit authorization requests (VARs), new employee security briefings, exit interviews and briefings, security violations and incident reports, DD Form 254, and SCIF self-inspections in preparation for security audits.

5.5.2 Personnel Security Adjudicator: The Contractor shall provide the required personnel to assist the Government in assessing, vetting and certifying the trustworthiness of DIA and designated DoD-affiliated personnel for access to sensitive compartmented information, through case management, adjudication and due process.

5.5.4 Security Specialist: The Contractor shall provide the required personnel to conduct personnel security screening and case management for a variety of DIA case types, including but not limited to civilian applicants, military assignees, employees, and affiliates, requiring security clearance determinations for access to sensitive government information or secure worksites. The functions for this position include, but are not limited to: accurately creating, maintaining, reviewing, and updating appropriate systems, case files, and databases; inter- and intra-agency coordination; reviewing and analyzing data to draft recommendations; and other related duties.

5.5.7 Personnel Security Analytical Support Specialist: The Contractor shall provide the required personnel with diverse skill sets and experience to perform in-depth security analysis functions including evaluating security risk, analyzing patterns in data, and developing security metrics and reports.

5.5.5 Polygraph Scheduling Specialist: The Contractor shall provide the required personnel to perform and schedule polygraph sessions in support of DIA's Personnel Security Program.

9 | P a g e

5.5.6 Lead Scheduler: The Contractor shall provide the required personnel to monitor and take any preventative or corrective measures necessary to maintain the productivity and quality of work of each Scheduler to ensure the overall performance of the contract is kept at a high standard of delivering professional results correctly, on time or ahead of schedule.

5.5.8 Polygraph Project Manager: The Contractor shall provide the required personnel to monitor and take any preventative or corrective measures necessary to maintain the productivity and quality of work of each Polygraph Examiner and each assigned Scheduler to ensure the overall performance of the contract is kept at a high standard of delivering professional results in support of DIA’s Personnel Security Program. Participate in project planning and status meetings with the COR or other government and contractor personnel.

5.5.9 Polygraph Deputy Project Manager: The Contractor shall provide the required personnel to serve as an alternate or support the Project Manager to monitor and take any preventative or corrective measures necessary to maintain the productivity and quality of work of each

Polygraph Examiner and each assigned Scheduler to ensure the overall performance of the contract is kept at a high standard of delivering professional results in support of DIA's

Personnel Security Program. Participate in project planning and status meetings with the COR or other government and contractor personnel.

5.5.10 Polygraph Specialists: The Contractor shall provide former federally trained and federally certified Polygraph Examiners to conduct polygraph sessions, maintaining the highest standards of professionalism and quality in support of DIA's Personnel Security Program. These specialists shall work under the supervision of the Polygraph Project Manager and Deputy Project Manager, adhering to all federal polygraph examination standards and protocols while maintaining accurate session records. They shall collaborate with Schedulers for efficient session management and participate in performance reviews and project meetings as required.

5.5.11 Psychologist: The Contractor shall provide the required personnel to conduct psychological assessments for determining individuals' suitability for security clearances or access to sensitive information. Assessments may include evaluations, record analysis, case review, and interviews to determine reliability, trustworthiness, and judgment

5.6. Mission Task Area 6: Insider Threat

The Insider Threat mission combines expertise from multiple disciplines, including Security, Counterintelligence, Law Enforcement, and Computer Network Defense, to identify and assess potential internal security risks. Professionals in this field use specialized host-based detection tools to analyze and correlate behavioral patterns that might indicate an insider threat. By developing comprehensive pictures of concerning events, these specialists can identify and respond to potential security risks before they materialize into actual threats. This critical work is carried out by a diverse team of experts, including Security Incidents Specialists, Insider Threat

Detection Analysts, Insider Threat Detection Senior Analysts, Case Coordination Support

Specialists, Insider Threat Risk Management Analysts, and Insider Threat Analytical Support

Specialists. Together, these professionals form a robust defense against internal security challenges, helping to maintain the integrity and security of sensitive operations.

10 | P a g e

5.6.1 Security Incident Specialist: The Contractor shall provide the required personnel to manage and resolve security incidents reported by DIA affiliates and personnel through various channels, including the DIA Counterintelligence and Security Incident Reporting Systems (CSIRS).

5.6.2 Insider Threat Detection (ITD) Analyst: The Contractor shall provide the required personnel to perform multi-disciplinary analysis and submit written reports based on findings in support of DIA's Insider Threat program. The analysis performed by the Contractor, shall include but not limited to, Insider Threat, Security, Counterintelligence (CI), Law Enforcement (LE), and

Computer Network Defense (CND).

5.6.3 Insider Threat Detection Senior Analyst: The Contractor shall provide the required personnel to perform the same position description as an Insider Threat Detection Analyst as well as the on-site program manager for ITD analyst IDIQ personnel. This includes, but not limited to, overseeing administrative matters, such as scheduling, timecard certification and submission, leave schedules (in consultation with the Government) and nomination packages for

IDIQ personnel as vacancies occur.

5.6.4 Case Coordination Support Specialist: The Contractor shall provide required personnel to manage all aspects of insider threat case coordination, records management, security, CI, LE and/or Office of the Inspector General (OIG) to assist in IT case coordination.

5.6.5 Insider Threat Risk Management Specialist: The Contractor shall provide personnel to support DIA’s personnel security program, specifically in the areas of Insider Threat detection and risk management analysis.

5.6.6 Insider Threat Analytical Support Specialist: The Contractor shall provide the required personnel with diverse skill sets and experience to perform in-depth security analysis functions including evaluating security risk, analyzing patterns in data, and developing security metrics and reports.

5.6.7 Data Scientist/Analyst: Employs a variety of languages and tools, including scripting languages, to clean and organize big data and perform prescriptive statistics and analysis, developing insights, building models, and solving modernization business needs. By leveraging large volumes of data from internal and external sources, including Physical Security, Information Security, and Personnel Security, as well as Insider Threat data, prepares the data for use in predictive and prescriptive modeling.

6. IDIQ Personnel Qualifications/Experience

6.1 Junior Level

Desired Experience Desired Education

Minimum 3 years of experience administering security functions relevant to the specific labor category, with at least a portion of the experience within the last 2 years.

Bachelor's degree in an area related to the labor category from a college or university accredited by an agency recognized by the

U.S. Department of Education. An additional

4 years of experience in the specific labor

11 | P a g e category, for a total of 7 years of experience in the specific labor category or certain technical certifications may be substituted for a Bachelor's degree.

6.2 Mid-Level

At least 8 years of experience administering security functions relevant to the specific labor category with at least a portion of the experience within the last 2 years.

Bachelor's degree in an area related to the labor category from a college or university accredited by an agency recognized by the

U.S. Department of Education.

6.3 Senior Level

Minimum 12 years of experience related to the specific labor category with at least a portion of the experience within the last 2 years.

Master's degree in an area related to the labor category from a college or university accredited by an agency recognized by the

U.S. Department of Education; or have

Bachelor's degree related to the labor category from a college or university accredited by an agency recognized by the U.S. Department of

Education and an additional 5 years of related senior experience, for a total of 17 years, as a substitute to the Master's degree.

6.4 Expert Level

Minimum 20 years of experience conducting analysis relevant to the specific labor category with at least a portion of the experience within the last 2 years.

Master's degree in an area related to the labor category from a college or university accredited by an agency recognized by the

U.S. Department of Education.

6.5 Psychologist (specific to section 5.5.11)

Minimum 10 years of experience conducting analysis relevant to the specific labor category with at least a portion of the experience within the last 2 years.

Doctor of Philosophy (Ph.D) or Doctor of

Psychology (Psy.D) in Clinical Psychology from an American Psychological Association accredited program.

7. Security Requirements

7.1 Facility Clearance Requirements: The Contractor shall possess and maintain a Top-Secret level facility clearance. Performance under the contract may require that the Contractor access

12 | P a g e data and information sensitive to another government agency, another government contractor, or of such nature that its dissemination or use other than as specified in this contract would be averse to the interests of the Government or others. Neither the Contractor, nor its contract employees, shall divulge or release any information developed or obtained in the course of contract performance, except upon written approval of the Contract Officer. The Contractor shall not use, disclose or reproduce any sensitive contract information that bears a restrictive legend, other than as specified in this contract.

Any question regarding information contained within the IDIQ, will be addressed to or reported to the Contract Officer. Notify the COR and DIA’s Industrial Security office in addition to

DCSA of any change in conditions affecting the Facility Clearance consisting of but not limited to:

7.1.1 Any change of ownership, including stock transfers that affect control of the company.

7.1.2 Action to terminate business or operations for any reason, imminent adjudication or reorganization in bankruptcy, or any change that might affect the validity of the FCL. Any information previously reported to DCSA concerning foreign ownership, control or influence

(FOCI).

7.1.3 Changes in Storage Capability. Any change in the storage capability that would raise or lower the level of classified information the facility is approved to safeguard.

7.1.4 Inability to Safeguard Classified Material. Invalidation of FCL received from DCSA and any emergency situation that renders the facility incapable of safeguarding classified material.

7.2 Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access

Program Information: All contract personnel providing support to the referenced IDIQ contract are required to adhere to all requirements identified in the acquisition document

(SOW/PWS/SOO), DD-254 and Security Continuation pages, applicable Federal, DOD, DIA directives, instructions and standard operating procedures, that includes the proper handling and safeguarding classified and unclassified information. Sponsor rules, regulations, direction, and requirements issued by COR or other authorized personnel for good order, administration, and security will apply to all IDIQ Contractor personnel who enter the Government’s facilities. The

Contractor shall comply with established security procedures for entering a facility and/or any special procedures that may be established for certain restricted areas. All persons granted access to premises in connection with the performance of this IDIQ contract will be subject to the provisions of criminal or other laws protecting classified or intelligence information, including provisions of the espionage laws (Title 18, United States Code, sections 793, 794 and 798), provisions of the intelligence Identities Protection Act of 1982 (P.L. 97-200, SO U.S.C., 601 et.

Seq.), and Title 32, Code of Federal Regulations (CFR), Section 1903. All persons performing work under this IDIQ contract shall protect and safeguard national security information in accordance with Executive Orders, IC, DOD and DIA directives, instructions, and procedures.

13 | P a g e

7.3 Individual DD Form 254 for Security Guidance including continuation pages will be issued at the TO level.

8. Travel

8.1 CONUS/OCONUS travel may be required in the performance of this IDIQ. All travel shall be approved in writing by the COR prior to making any reservations. Contractors shall consult the Defense Travel Management Office website (www.defensetravel.dod.mil) prior to traveling to obtain updated per diem rates for the locality to which they are traveling.

8.2 Travel costs will be allowed to the extent that they are reasonable and allocable and determined to be allowable under Federal Acquisition Regulation (FAR) 31.205-46. Travel by air will be reimbursed at the actual cost incurred and will not exceed the lowest customary standard coach, or equivalent fare offered during normal business hours.

8.3 As prescribed in FAR 31.205-46(a), travel costs for lodging, meals, and incidental expenses are limited to the maximum per diem rates in effect at the time of travel set forth in the Federal

Travel Regulation (FTR); the Joint Travel Regulations, Volume 2, DoD Civilian Personnel, Appendix A; or the Standardized Regulations (Government Civilians, Foreign Areas), Section

925, “Maximum Travel Per Diem Allowances for Foreign Areas.” IAW FAR 52.216-7, the

Contractor may submit to the COR, in such form and reasonable detail as the representative may require, an invoice or voucher supported by a statement of the claimed allowable cost for performing this IDIQ.

8.4 The per diem allowance will not be allowed when the period of official travel is ten (10) hours or less during the same calendar day. Travel by privately owned vehicle will be reimbursed at the current GSA approved mileage rate. Current travel policy and per diem rates may be obtained at the following Internet site: http://www.defensetravel.dod.mil/site/perdiem.cfm

8.5 Travel Reimbursement: Only those travel costs incurred by the Contractor for IDIQ personnel assigned and working under this PWS for the following expenses: 1) Contractor employee airline tickets, per diem, and miscellaneous incidental expenses. Such transportation costs incurred will be reimbursed at actual costs in accordance with the JTR. Per Diem is not authorized within the designated AOR unless prior written approval is granted by the COR. Per

Diem is authorized during pre-deployment training. Only per diem and travel costs shall be reimbursed; incidentals and miscellaneous expenses will not be reimbursed. Regardless of amount, all travel costs shall be documented via copies of the original travel receipts, to be provided with the invoice requesting payment, providing the following information: Traveler’s name, date and place (city, town, or other similar designation) of the expenses, purpose of the trip, and expense incurred.

8.6 Local travel, within 50 miles of duty location, will not be reimbursed.

9. Place of Performance

The primary place of performance is in the Washington, DC National Capital Region (NCR).

The NCR is defined as falling within the area contained by the legal borders of: The District of http://www.defensetravel.dod.mil/site/perdiem.cfm

14 | P a g e

Columbia; Arlington, Fairfax, Loudon, Prince William, and Stafford counties in Virginia

(including incorporated cities) and Prince George and Montgomery Counties in Maryland. Other places of performance may include Charlottesville, VA and Huntsville, AL. Support in other regions, both in the Continental United States (CONUS) and Outside the Continental United

States (OCONUS) may be required as mission dictates.

10. Duty Hours

10.1 All employees shall be required to work a 40-hour work week that may include shift work, weekends, holidays and/or 24/7/365 coverage to accommodate the Government’s needs on first, second and third shifts. Hours and shifts are subject to change due to the need to meet mission requirements. The Government reserves the right to adjust the work schedules as mission dictates by providing a 24-hour advanced notice. Specific duty hours by location will be defined at the

TO level.

10.2 Overtime Support: Overtime will be handled on a case-by-case basis, will be charged to the

XXX CLIN, and requires pre-approval from the COR or designated Government representative.

Work done outside the standard work week (Monday through Friday) may be considered overtime and paid at the over and above rates established in the Task Order.

11. IDIQ Personnel Requirements – Key Personnel

A Program Manager (PM) maybe required at the TO level with the possibility for additional

PM’s as a requirement for each Task Order.

12. Non-Disclosure Requirements (NDA)

All Contractor personnel are required to sign, prior to beginning performance, a non-disclosure agreement in accordance with DFARS 227.7103-7 and/or a DSS Non-Disclosure agreement. The

Contractor is bound by all NDAs signed by its employees. In the event a Contractor employee violates any of the terms and conditions of the NDA, the Contractor shall be considered in breach of the IDIQ. This could result in a termination for default.

13. Contract Data Requirements List (CDRL)

13.1 At a minimum the deliverables identified in table 1 below of this Performance Work

Statement shall be delivered by the Contractor in accordance with the terms and conditions of the awarded IDIQ.

13.2 All deliverables, shall be delivered at the task order level in accordance with their respective requirements.

13.3 The Contractor shall adhere submitting only those deliverables deemed accepted by the

Government. The Contractor shall provide electronic and hard copies of the pre-award and post award documentation for review, approval, and appropriate action. Electronic copies shall be delivered via email attachment to the CO and COR as appropriate. The electronic copies shall be compatible with Microsoft products or other applications as appropriate and mutually agreed to by both parties.

15 | P a g e

13.4 Once created, deliverables and work products are considered the property of the

Government.

13.5 All deliverables shall be deemed acceptable if the document adequately covers all required topics, meets general quality measures, and professionally prepared in term of accuracy, clarity, format, and timeliness. Quality measures, as set forth below, shall be applied to each work product received from the Contractor.

13.5.1 Accuracy: Documents shall be accurate in presentation, content, and style;

13.5.2 Clarity: Documents shall be clear and concise;

13.5.3 File Editing: Documents shall be editable by the government;

13.5.4 Format: Documents shall be transmitted via mutually agreed upon media, and

13.5.5 Timeliness: Documents shall be submitted on or before scheduled due date.

14. Contractor Information Security

Contractor Information Security Performance under the IDIQ may require that the Contractor access data and information sensitive to another government agency, another government

Contractor, or of such nature that its dissemination or use other than as specified in this IDIQ would be averse to the interests of the Government or others. Neither the Contractor, nor its

Contractor employees, shall divulge or release any information developed or obtained during

IDIQ performance, except to specifically authorized Government personnel or upon written approval of the Government Contractor Officer. The Contractor shall not use, disclose or reproduce any sensitive IDIQ information that bears a restrictive legend, other than as specified in this IDIQ. Any question on the release ability of information, or doubt regarding a person's authority requesting any information, shall be addressed to or reported to the Government

Contractor Officer. The Contractor shall direct to the Government Contractor Officer all inquiries, comments, or complaints arising from matters observed, experienced, or learned as a result of, or in connection with, its performance of this IDIQ, the resolution of which may require dissemination of official information. The Contractor shall not release any information

(including photographs, files, public announcements, statements, denials or confirmations) on any part of the subject matter of this IDIQ, on any phase of any Government program, or regarding any individuals, without the prior written approval of the Government Contractor

Officer.

15. Annual Training

Specific training requirements, beyond the basic requirements outlined in this Section, will be defined and established at the individual TO level based on the location, services

16 | P a g e to be provided, and threat level. In addition to self-training the Contractor may be required to provide training to partner nation forces or US Military forces as determined at the TO level.

15.1 Antiterrorism Level 1 (General): All Contractor employees, to include subcontractor employees, requiring access to Army installations, facilities, and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The Contractor shall submit certificates of completion for each affected Contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 14 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website:

http://jko.jten.mil

15.2 Antiterrorism Awareness Training for US Based Contractor Personnel Traveling

Overseas: US based Contractor employees and associated sub- Contractor employees to make available and to receive Government-provided area of responsibility (AOR) specific AT awareness training as directed by AR 525- 13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact.

15.3 DIA Annual OPSEC Awareness: Per DIA Directive 5800.100, the Contractor’s employees must complete DIA OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

15.4 DIA Continuity of Operations (COOP) Awareness is a federally mandated requirement for all government agencies. All personnel associated with DIA must complete annual training as mandated under DIA Instruction 3020.008. All DIA personnel must be aware of the processes that DIA has in place to execute its missions during a disruption of work caused by a natural or man-made all-hazards event.

15.5 Privacy and Civil Liberties Course: All DIA personnel (Civilians, Military, and

Contractors) are required to annually complete this course under DIA Instruction

5400.001. The course will introduce and emphasize your rights under the Privacy Act of 1974, clarify your civil liberties, and describe how to properly handle, safeguard, and protect Personal Identifying Information (PII).

15.6 DIA IC Whistleblowing Training: Introduces employees and contractors of DIA with access to classified information of their responsibilities to report allegations of wrongdoing, and the protections afforded them to do so. The training is mandated under Presidential Policy Directive (PPD) 19 and Intelligence Community Directive

(ICD) 120, “Intelligence Community Whistleblower Protection”, sections D(1)(a).

15.7 Cyber Awareness Challenge Course: This course (formerly known as Information

Assurance Awareness) provides an overview of DIA personnel’s information assurance http://jko.jten.mil/

17 | P a g e

(IA) responsibilities and duties while exercising their privileges on DIA’s networks and information systems.

15.8 Unauthorized Disclosure of Intelligence Information: This annual training is mandated under Intelligence Community Directive (ICD) 119 and DIA Instruction

(DIAI) 5410.003. This course explains problems surrounding unauthorized disclosures and provides security officers that tools to effectively respond to issues of unauthorized disclosures. You will be briefed on the laws and will gain insight into damage done by unauthorized disclosures.

15.9 Counterintelligence Awareness Reporting (CIAR): This course fulfills the annual training requirement for counterintelligence (CI) awareness and reporting as described in DoDD 5240.06, May 17, 2011.

15.10 DIA Intelligence Oversight: DIA Directive 5148.100, “Intelligence Oversight

(IO),” requires all DIA personnel conducting intelligence activities under DIA authority to complete IO training annually. IO seeks to balance the collection, retention, and dissemination of intelligence information with protecting the rights of U.S persons.

The intelligence oversight course is designed to provide the workforce with the training needed to comply with applicable U.S. law, execute order, presidential directives, and

Intelligence Community, DoD, and DIA policies during the conduct of intelligence activities. The training also addresses the responsibility to report questionable intelligence activities and significant or highly sensitive matters.

15.11 Derivative Classification: This course describes the responsibilities of the

Derivative Classifier. It also explains how to derivatively classify national security information from a classification management perspective.

16. Government Furnished Property, Equipment, and Services

All information for Government furnished items and services will be defined at the TO level as applicable.

17. Contractor Furnished Materials, Equipment, Training, Supplies, and Clothing

All information for Contractor furnished items and responsibilities will be determined at the TO level.

18. Quality Control

The Contractor shall be responsible for creating and maintaining a Quality Control Plan (QCP) at the TO level to ensure that the services provided are in line with the requirements identified in this IDIQ. The QCP is the means through which the Contractor assures that the work provided at the TO level meets the requirements of the IDIQ. The Government will evaluate the

Contractor’s performance under this IDIQ in accordance with the Quality Assurance

Surveillance Plan (QASP) at the TO level. This plan is primarily focused on what the

Government must do to ensure that the Contractor is and has performed IAW the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the acceptable quality levels (performance thresholds).

18 | P a g e

19. Deliverables

Timely submission of deliverables is essential to successful completion of this requirement. The

Contractor will be required to submit the deliverables set forth in Attachment 1. The deliverables described herein are minimum requirements only and additional deliverables or modifications to these deliverables may be required for specific task orders.

20. Definitions and Acronyms

20.1 Definitions

Although not inclusive of every term used within this PWS, the following list provides definitions used throughout this PWS and commonly used in the acquisition field.

Contracting Officer – A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the

Government. Note: The only individual who can legally bind the Government.

Contracting Officer's Representative (COR) – As defined in DFARS 202.101, means an individual designated and authorized in writing by the contracting officer to perform specific technical or administrative functions. DoD Instruction (DoDI) 5000.72, Part II

Definitions states the following when defining a COR: “Defined in subpart 202.101 of

Reference (f). Any individual delegated responsibilities under subpart 1.602-2 of

Reference (e), regardless of local terminology, must be certified by this instruction. For example, local terminology can be COR, contracting officer’s technical representative, technical point of contact, technical representative, alternate COR, administrative COR, assistant COR, line-item manager, TO manager, quality assurance personnel, quality assurance evaluator, or COR management.” In addition, Army Regulation 70-13, Chapter 2, paragraph 2-2g, states, in part, the following when providing other surveillance support personnel to assist the COR when needed, “…These other surveillance support personnel may serve as on-site representatives of the COR in performance of actual Contract surveillance if they meet all COR requirements and have been appointed by the contracting officer as alternate CORs.”

Contractor - Contractor and its sub-contractors at any tier.

Performance Work Statement - A statement of work for performance-based acquisitions that describes the required results in clear, specific, and objective terms with measurable outcomes.

Quality Assurance (QA) - Those actions taken by the Government to assure services meet the requirements of the Performance Work Statement.

Quality Assurance Surveillance Plan (QASP) - An organized, written document

19 | P a g e specifying the surveillance methodology to be used for surveillance of Contractor performance.

Quality Control - Those actions taken by a Contractor to control the performance of services so that they meet the requirements of the PWS.

Quality Control Plan (QCP) – A plan that defines the Contractor’s quality control program and through which the Contractor assures that its work complies with the requirements of the Contract.

20.2 Acronyms

Although not inclusive of every acronym used within this PWS, or that may be included in an acquisition, the following is a list of acronyms used in PWS.

ACRONYM TERM

ACG ACCESS CONTROL GUARDS

AOR AREA OF RESPONSIBILITY

AT ANTI-TERRORISM

ATO ANTI-TERRORISM OFFICER

CDRL CONTRACT DATA REQUIREMENTS LIST

CI COUNTERINTELLIGENCE

CIAR COUNTERINTELLIGENCE AWARENESS REPORTING

CND COMPUTER NETWORK DEFENSE

CO CONTRACTRACTING OFFICER

CONUS CONTINENTAL UNITED STATES

COOP CONTINUITY OF OPERATIONS

COR CONTRACTING OFFICER REPRESENTATIVE

DCID DIRECTOR OF CENTRAL INTELLIGENCE DIRECTIVES

DCSA DEFENSE COUNTERINTELLIGENCE AND SECURITY

AGENCY

DIA DEFENSE INTELLIGENCE AGENCY

DIAI DEFENSE INTELLIGENCE AGENCY INSTRUCTION

DISS DEFENSE INFORMATION SYSTEMS FO SECURITY

DOD DEPARTMENT OF DEFENSE

FAR FEDERAL ACQUISITION REGULATION

FCL FACILITY CLEARANCE LEVEL

FTR FEDERAL TRAVEL REGULATION

GSA GENERAL SERVICE AGENCY

IA INFORMATION ASSURANCE

IAW IN ACCORDANCE WITH

IC INTELLIGENCE COMMUNITY

ICD INTELLIGENCE COMMUNITY DIRECTIVES

20 | P a g e

ID IDENTIFICATION

IDIQ INDEFINITE DELIVERY - INDEFINITE QUALITY

INFOSEC INFORMATION SECURITY

IO INTELLIGENCE OVERSIGHT

IT INFORMATION TECHNOLOGY

ITD INSIDER THREAT DETECTION

LE LAW ENFORCEMENT

NISPOM NATIONAL INDUSTRIAL SECURITY PROGRAM

OPERATING MANUAL

OCONUS OUTSIDE THE CONTINENTAL UNITED STATES

OIG OFFICE OF…