DRAFT-FISMA_PWS.docx

PERFORMANCE WORK STATEMENT (PWS)

For

PACIFIC AIR FORCES (PACAF) ASSESSMENT AND AUTHORIZATION (A&A) FOR

FEDERAL INFORMATION SYSTEM MANAGEMENT ACT (FISMA) AND

CYBERSECURITY HARDENING

AT PACAF

JOINT BASE PEARL HARBOR-HICKAM (JBPHH), HAWAII

17 June 2025

Contract Number: ________________

TABLE OF CONTENTS

SECTION PAGE

ii

1 General Information

1.1 Contracting Officer’s Representative (COR)

Organization: HQ PACAF/A634 Department of Defense Activity Address Code (DODAAC): F2CFSQ Address: 25 E St, JBPHH, 96860 Phone Number: (808/315) 448-4982

1.2 Contract Title

PACAF Assessment and Authorization (A&A) for Federal Information System Management Act (FISMA) and Cybersecurity Hardening

1.3 Background

The HQ PACAF has approximately 45,000 military and civilian personnel primarily serving at ten Main Operating Bases (MOBs) at the following locations: Andersen AFB, Guam; Diego Garcia, British Indian Ocean Territory (BIOT) Geographically Separated Unit (GSU); Eielson AFB, Alaska; Joint Base Elmendorf-Fort Richardson (JBER), Alaska; Joint Base Pearl Harbor- Hickam (JBPHH), Hawaii; Kadena AB, Japan (Okinawa), Kunsan AB, South Korea; Misawa AB, Japan; Osan AB, South Korea; and Yokota AB, Japan.

PACAF's area of responsibility (AOR) extends from the West coast of the United States to the East coast of Africa and from the Arctic to the Antarctic, covering more than 100 million square miles. In addition to the ten MOBs, PACAF supports over 100 Geographically Separated Units (GSUs), Collocated Operating Bases (COBs), and Forward Operating Locations (FOLs). All GSUs, COBs, and FOLs are hereinafter referred to collectively as GSUs.

HQ PACAF has had contract cybersecurity support since May 2003. As a result, PACAF has consistently been the top USAF MAJCOM in compliance with FISMA requirements as well as Cyber Operations Readiness Assessments (CORA) and Command Cyber Operational Readiness Inspections (CCORI) conducted by United States Cyber Command (USCYBERCOM).

1.4 Objectives

The objectives of this contract are to:

1) Enhance and sustain PACAF’s cybersecurity posture by implementing congressional FISMA, Department of Defense (DoD), AF cybersecurity directives, while ensuring compliance with DoDI 8510.01, RMF for DoD Systems,

2) Prepare/mentor Numbered Air Force (NAF), Wing and cybersecurity forces through Cyberspace Readiness Review and Mentorship (CRR-M) program,

3) Assist/prepare PACAF Wings for USCYBERCOM CORAs & CCORIs ISO missions operating on PACAF Non-classified Internet Protocol Router Networks (NIPRNet), Secret Internet Protocol Router Networks (SIPRNet) and supported information systems, and

4) Support vulnerability management efforts.

This work shall be accomplished by four (4) individuals residing in Honolulu, Hawaii.

Four (4) contractors shall work for the HQ PACAF Cybersecurity Office and conduct security assessments, and provide security consultation to military and DOD civilian personnel within PACAF AOR. The contractors, at the Government’s request, shall augment as unit inspection preparation team providing required expertise in Vulnerability Management, Physical Security, Emission Security (EMSEC), Cross Domain Solutions (CDS), and network security consulting. The contractors will also support NAF/Wings to be “cyber ready” via scheduled CRR-M. CRR-M assessments will utilize USCYBERCOM and DISA criteria as it relates to CORA and the most recent effort involving CCORI.

The Cybersecurity SMEs contractors shall also assist in posturing PACAF MOBs and GSUs enclaves for successful maintenance of A&A/RMF. Additionally, these contractors shall:

1) Assist in providing up-dates through AF central FISMA database repository, Technology Investment Portfolio Suite (ITIPS).

2) Ensure A&A data is synchronized across AF and DISA repositories (Enterprise Mission Assurance Support Service (eMASS) and ITIPS), NIPRNet Systems/Network Approval Process (SNAP) and Global Information Grid Interconnection Approval Process (GIAP).

3) Provide monthly status reports.

Theater Vulnerability Manager SME shall also support the vulnerability management efforts by providing expertise to command wide engagements with PACAF vulnerability managers with the goal to enhance PACAF MOBs and GSUs cybersecurity posture.

1.5 Scope

Under the direction of HQ PACAF Cybersecurity Chief, the contractors shall assist and consult with maintaining regulatory requirements of Cybersecurity for PACAF MOBs SIPRNet and NIPRNet enclaves and give guidance/solutions with regards to cyber readiness (CORA & CCORI support). Contractors are to provide specialized expertise to Communications/Cyber Squadrons and Wings across the PACAF Area of Responsibility (AOR).

The contract positions are for assessment, training support, and products for A&A of all AF circuits/enclaves at the nine (9) PACAF MOBs and two (2) GSUs as identified below.

2 NIPRNet/2 SIPRNet - Diego Garcia

The required cybersecurity assessment, services, support, and products fall into these categories:

2 Description of Services The contractor shall acquire and maintain all required certifications, accounts, and documentation to accomplish the objectives within the scope of the contract.

2.1 Cybersecurity SME

This position works directly for the PACAF Defensive Cyber Operations and Mission Assurance Branch but works with various PACAF AOR personnel to execute the following duties and responsibilities.

2.1.1 Duties and Responsibilities

Cybersecurity SME Duties and Responsibilities are as follows:

· Connection Approval Process (CAP) for SNAP

· GIAP circuit management tools

· eMASS and ITIPS

· Continuous Monitoring Risk Scoring (CMRS) efforts

· System Security Plan

· Ports Protocol Services Matrix (enclave)

· Artifacts for control validation (STIG results, Policies, Scans, Charters, etc., unit provided)

· Plan of Actions and Milestones (POAMs)

· System Topology

2.1.2 Requirements

Cybersecurity SME Requirements are as follows:

Anyone (1) of the following:

· Advanced - CISM or CISSO or CPTE or CySA+ or FITSP-A or GCSA or CISA or CISSP or CISSP-ISSEP or GSLC or GSNA or DoD 8570.1-M certified at Information Assurance Technical (IAT) Level 3 - Anyone (1) of the following:

· CompTIA Advanced Security Practitioner Continuing Education (CASP+ CE)

· Certified Information Systems Auditor (CISA)

· Certified Information Systems Security Professional (CISSP) (or Associate - this means the individual has qualified for the certification except for the number of years’ experience)

· Certified Cloud Security Professional (CCSP)

-at a maximum up to 40% of the time.

· Level 1 Anti-Terrorist Training - within the past year https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=JS&course_number=-US007

· Level A Survival, Evasion, Resistance, and Escape (SERE) Training - within the past 1-2 years https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=J3T&course_number=A-US1329

· USFK Training - no time requirement (only required to be taken once) https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=USFK&course_number=-US171

· DoD Cyber Awareness Challenge - within the past year https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=DOD&course_number=-US1364-23

· Operations Security (OPSEC) Awareness - within the past year https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=PAC&course_number=-US017

· Derivative Classification IF103.16 - within the past year https://www.cdse.edu/Training/eLearning/IF103

· Force Protection - within the past year https://lms-jets.cce.af.mil/moodle/enrol/index.php?id=12739 COR will provide update website addresses to the above that may change.

2.1.3 Skills, Knowledge, & Abilities

Cybersecurity SME Skills, knowledge, and abilities are as follow:

· CAP for SNAP

· GIAP circuit management tools

· eMASS and ITIPS

· CMRS efforts

2.1.4 Deliverables

Cybersecurity SME Deliverables are as follow:

*Note: Presentation deliverables may be required to be presented to PACAF Director of Air and Cyberspace Operations and/or other stakeholders when there is potential of mission impact. Also, “Site Visit” refers to FISMA, RMF, CRR-M, CORA, or CCORI site visits.

and NLT 3 working days prior to any new replacement personnel’s start date

- Send to CO/PM and COR

and Other Cybersecurity Assistance Travel Schedule

- Update file & send email updates COR

& Email

- contains results from Technical Exchange Meeting

Office Call

compliance, CRR-M, CORA/CCORI support, travel schedule, and status of critical POAMs.

Scoring tool or equivalent

CRR Update Report

2.1.5 Positions

Number of Cybersecurity SME positions and their locations are as follow.

2.2 Theater Vulnerability Analyst

This position works directly for the PACAF Defensive Cyber Operations and Mission Assurance Branch but works with various PACAF AOR personnel to execute the following duties and responsibilities. The position shall provide expert support, analysis and research into exceptionally complex problems, and processes relating to PACAF Theater Vulnerability Management.

2.2.1 Duties and Responsibilities

Theater Vulnerability Analyst Duties and Responsibilities are as follows:

· Scan Assured Compliance Assessment Solution (ACAS),

· Mitigate (via MS System Center Configuration Management (SCCM)/MS Endpoint Configuration Manager (MECM)), and

· Maintain Host Based point products mandated by the DoD (End Point Security formerly known as HBSS).

· Identify patching issues/troubleshooting way ahead.

· Produce report to chain of command informing of patching status.

· Contract Personnel Roster

· Updates to contractor availability

· Contract Invoices & Funding Expenses

· Monthly Status Report (MSR)

· Contractor’s Non-Disclosure Agreements (NDA)

· Kick-Off Brief & Close-Out Brief

· Transition Brief

· Assistance with processing contractors travel requirements

· Labor/Events/Workload/Travel schedule & expenses

· Metrics of Program for Yearly Closeout

· Common access Card (CAC) ID processing and renewals

· Building Badge processing and renewals

· DD254

· TS/SCI processing and renewals

· Synchronized Pre-deployment and Operational Tracker (SPOT) processing.

· Financial preparation

· Letters of Identification

· Travel Estimates/Schedule

· Department of Defense Instruction 8500.01, Cybersecurity

· Department of Defense Instruction 8510.01, RMF for DoD Systems

· Committee on National Security Systems Instruction 1253, Security Categorization and Control Selection for National Security Systems

· National Institute of Standards and Technology Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations

· National Institute of Standards and Technology Special Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations: Building Effective Security Assessment Plans

· National Institute of Standards and Technology Special Publication 800-39, Managing Information Security Risk: Organization, Mission, and Information System View

· National Institute of Standards and Technology Special Publication 800-30, Guide for Conducting Risk Assessments

· All applicable DISA STIGs and Security Review Guides (SRGs)

· Air Force Instruction (AFI), 17-130 Cyber Security Program Management

· AFI 17-101, RMF for Air Force Information Technology (IT)

· AFI 17-110, Information Technology Portfolio Management and Capital Planning and Investment Control Where existing commercial or military standards allow for options or are undefined, the Contractor shall make written recommendations to the Government. Upon acceptance of the recommendation by the Government, it will be incorporated as a PACAF standard for implementation.

2.2.2 Requirements

Theater Vulnerability Analyst Requirements are as follows:

Anyone (1) of the following:

· Advanced - CISM or CISSO or CPTE or CySA+ or FITSP-A or GCSA or CISA or CISSP or CISSP-ISSEP or GSLC or GSNA or DoD 8570.1-M certified at IAT Level 3 - Anyone (1) of the following:

· CASP+ CE

· CISA

· CISSP (or Associate)

· CCSP

-at a maximum up to 40% of the time.

· Level 1 Anti-Terrorist Training - within the past year https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=JS&course_number=-US007

· Level A Survival, Evasion, Resistance, and Escape (SERE) Training - within the past 1-2 years https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=J3T&course_number=A-US1329

· USFK Training - no time requirement (only required to be taken once) https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=USFK&course_number=-US171

· DoD Cyber Awareness Challenge - within the past year https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=DOD&course_number=-US1364-23

· Operations Security (OPSEC) Awareness - within the past year https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=PAC&course_number=-US017

· Derivative Classification IF103.16 - within the past year https://www.cdse.edu/Training/eLearning/IF103

· Force Protection - within the past year https://lms-jets.cce.af.mil/moodle/enrol/index.php?id=12739 COR will provide update website addresses to the above that may change.

· 3-4 years of experience of DoD approved Scanning Tools (e.g., ACAS)

· 3-4 years of experience of Microsoft SCCM & MECM

· Familiarization of End Point Security Point Product requirements

· Ability to analyze and develop cyber vulnerability information into an understandable presentation.

· Proficiency in Microsoft Office Suite products and SharePoint collaborative tools to build trend analysis.

· In-depth experience with DISA STIGs and by-product analysis.

2.2.3 Skills, Knowledge, & Abilities

Theater Vulnerability Analyst Skills, knowledge, and abilities are as follow:

(MPTO) 00-33-1109A, USCYBERCOM Computer Network Defense (CND), Common Vulnerabilities and Exposures (CVE), Directives, Task Orders (TASKORDs), Operational Orders (OPORDs), and Information Assurance Vulnerability Management (IAVM) programs and a like.

· How to produce asset lists to identify devices capable of hosting an ESS agent.

· How to produce asset lists to identify devices not capable of hosting an ESS agent (whitelists).

· Ho to analyze client health status and courses of action to resolve discrepancies.

2.2.4 Deliverables

Theater Vulnerability Analyst Deliverables are as follow:

*Note: Presentation deliverables may be required to be presented to PACAF Director of Air and Cyberspace Operations and/or other stakeholders when there is potential of mission impact. Also, “Site Visit” refers to FISMA, RMF, CRR-M, CORA, or CCORI site visits.

and NLT 3 working days prior to any new replacement personnel’s start date

- Send to CO/PM and COR

health status

Vulnerability Status

2.2.5 Positions

Number of Theater Vulnerability Analyst positions and locations are as follow.

3 Services Summary Services summary is as follows:

Performance Objective

PWS

Paragraph Performance Threshold

The contractor shall assist/prepare PACAF Wings for USCYBERCOM CORAs & CCORIs ISO missions operating on PACAF NIPRNet, SIPRNet and supported information systems.

2.2.1.24.

2.2.1.25.

2.2.1.26.

2.2.1.27.

Performance occurs with no required re- performance or re-work at least 90% of the time.

4 Period of Performance

4.1 Duration

The Period of Performance is for a period of one (1) base year, plus four (4) option year periods.

4.1.1 Base Year (BY): 30 September 2025 to 29 September 2026

4.1.2 Option Period 1 (OY1): 30 September 2026 to 29 September 2027

4.1.3 Option Period 2 (OY2): 30 September 2027 to 29 September 2028

4.1.4 Option Period 3 (OY3): 30 September 2028 to 29 September 2029

4.1.5 Option Period 4 (OY4): 30 September 2029 to 29 September 2030

4.1.6 The inclusion of FAR Clause 52.217-8, Option to Extend Services, would allow for a contract extension up to six (6) additional months.

4.2 Performance Period

4.2.1 Performance period for this contract will begin on 30 September 2025.

4.2.2 Contractor shall have all qualified personnel on-site starting on 30 September 2025.

4.2.3 Prior to 30 September 2025, the Contractor will provide a copy of each personnel’s resume to the CO/PM and COR for qualification review.

4.3 Preplacement Personnel

4.3.1 The Contractor shall have hired a personnel replacement that meets the contract qualifications/standard no later than 30 calendar days after Contractor personnel leaving and on-site no later than 60 calendar days from Contractor personnel leaving, unless approved in writing or otherwise directed in advance by the CO. The Contractor will provide a copy of the replacement personnel resume to the CO/PM and COR for qualification review.

4.3.2 Contractor shall not charge the government for vacant positions after 60 calendar days from a position becoming vacant, if there is no on-site replacement.

4.4 Accountability

The contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

5 Place of Performance The primary place of performance is HQ PACAF (Bldg. 1102 Rm H210, JBPHH, Hawaii 96853). The Contractor shall have access to Government facility five days per week, Monday through Friday, eight hours a day, except when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings, unless otherwise approved.

6 Travel

6.1 Travel General

6.1.1 Travel in and around the place of performance is required throughout the period of performance.

6.1.2 Frequent temporary duty (TDY) travel to Government Facilities Outside the Continental United States (OCONUS) and the Continental United States (CONUS) is required. Duration of all other TDYs is dependent on the predetermined scope of work at the Government Facility. Some locations may require an additional trip per year for Cyber Readiness Reviews when required by CORA scheduled events.

6.1.3 A Government Letters of Identification (LOI) shall initiate all TDY NLT 30 days from travel. Only a Contracting Officer (CO) will approve travel through the LOI process. This LOI shall be used for identification purposes only.

6.1.4 Long distance travel shall occur via commercial transportation (except where military transportation is the only method of travel) utilizing the current rates in accordance with Federal Acquisition Regulation (FAR) Part 31 and the Joint Federal Travel Regulations (JFTR).

6.1.5 Travel to Diego Garcia (BIOT) will require travel to Singapore to connect with Diego Garcia MILAIR to and from Paya Lebar AMC terminal).

6.1.6 Contractors shall check the applicable country(ies) in the Foreign Clearance Guide (https://apacs.milcloud.mil/fcg/fcg.cfm) to determine credential requirements (i.e., CAC/orders, passport/visa, pre-travel training/documentation, theater/country clearance) and to find out if an Aircraft and Personnel Automated Clearance System (https://apacs.milcloud.mil/apacs/login.jsp) request submission is required.

6.1.7 All travel cost estimates will be approved by the CO prior to travel arrangements. Travel rates shall be negotiated prior to departure and fair and reasonable pricing shall be based on per diem expenses based on the Joint Travel Regulation (JTR) for an equivalent Government Service (GS) employee (GS-12).

6.1.8 Actual travel shall be authorized by the CO in writing prior to performance and will be paid IAW FAR Part 31.205-46.

6.1.9 The contractor shall provide a copy of travel receipts within 5 working days of completing travel to the COR.

6.1.10 All travel to Japan also requires an approved Letter of Authorization (LOA) through the Synchronized Predeployment and Operational Tracker (SPOT) found at https://spot.dmdc.mil/. The Contractor must have access to SPOT to initiate the LOA which will then be approved by the COR and CO. This LOA is in addition to the required LOI that supplies all details of the trip to be approved.

6.2 Air Transportation

Air transportation shall be made by the contractor. Travel arrangements SHALL NOT be made prior to approval of LOI. All travel shall be at coach/tourist (i.e., government category) accommodations unless otherwise approved by the CO. The contractor shall obtain airfare at competitive rates and submit a written rate comparison to the government when air travel is necessary.

6.3 Auto Rental

Automobile rental shall be approved on a case-by-case basis. Authorized rental must be justified and proposed by the contractor and approved by the CO. If approved, auto rental shall be reimbursed via the travel invoice.

6.4 Per Diem

While a contractor employee is in a government authorized travel status, the contractor shall be reimbursed a per diem allowance for subsistence and lodging in accordance with FAR 31.205-

46. Per Diem payments shall be made after receipt of proper travel invoice and supporting documentation and shall not exceed amounts allowable.

6.5 Billeting

Billeting arrangement must be withing the destination base's billeting rate that is consistent with JFTR.

6.6 Travel Confirmation

Contractor employees shall not commence overseas travel without prior approval and confirmation. It is the traveler's responsibility to make certain they are approved.

6.7 Travel Reimbursement

6.7.1 Travel shall be at the direction of the government and reimbursed in accordance with the contract’s funded Contract Line-Item Number (CLIN).

6.7.2 Approved travel shall be reimbursed to the contractor in accordance with the FAR Part 31.

6.7.3 Travel will be reimbursable only if traveling outside of a fifty (50) mile radius of their normal duty location.

6.7.4 When invoicing, contractors shall provide supporting receipts to be reimbursed for travel.

6.7.5 If LOI cost is exceeded, justification will need to be provided for the increased cost.

6.7.6 Travel and other direct cost will be reimbursed to the contractor in accordance with the JFTR on a cost-only basis. No profit, fee, or overhead will be paid to the contractor for travel expenses. The Government will accept the application of G&A NTE 5% of authorized travel costs for the Prime Company. The Government will NOT accept G&A of authorized travel costs for any Sub Companies under the Prime Company.

7 Security Clearance Requirements

7.1 Site Visit Coordination

The contractor shall coordinate site visits with site POCs at least 72 hours prior to requiring any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by Government personnel who are cleared. Contractor shall adhere to current installation security policies.

7.2 Clearance

7.2.1 The personnel assigned to the Cybersecurity SMEs and Theater Vulnerability Manager positions are required to have and maintain building access to the PACAF HQ building in addition to a TS/SCI security clearance. See Department of Defense Form 254, Contract Security Classification Specification, for security guidance and additional security requirements.

7.2.2 This section shall be considered a supplement to block 13 of the Government provided DD Form 254, Contract Classification Specification. The following security requirements shall apply to this effort.

References:

a. DISA Form 786, DISA Statement of Information System Use and Acknowledgement of User Responsibilities

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-36, Personnel Security

e. DISA Instruction 240-110-38, Industrial Security

f. DISA Instruction 240-110-43, Insider Threat Program

g. DISA Instruction 630-230-19, Cybersecurity

h. DoDM 5200.01, Vol 1-4 Information Security Program, 24 February 2012

i. DOD 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

j. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

k. DOD 5220.22-M, National Industrial Security Program Operating Manual, February 2006 Incorporating Change 02 May 2016

l. DoDM 5105.21 Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Information and Information Systems Security

7.2.3 The work to be performed under this contract is up to Top Secret level for Cybersecurity SMEs and Theater Vulnerability Manager positions. The work will require Sensitive Compartmented Information (SCI) access eligibility for the Cybersecurity SMEs and Theater Vulnerability Manager.

7.2.4 All personnel performing on or supporting contract in any way shall be U.S. citizens. The personnel security requirements for this contract cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance eligibility delineated in the table below when performance starts.

PWS

Task / Subtask

2.1 / 2.1.1 2.1.4

2.2 / 2.2.1 2.2.4

7.2.5 All personnel requiring TOP SECRET SCI access will abide with the following access requirements:

a. All SCI will be handled in accordance with special security requirements, which will be furnished by the HQ PACAF SSO.

b. SCI will not be released to contractor employees without specific release approval of the originator of the material as outlined in governing directives; based on prior approval and certification of "need-to-know" by the designated COR.

c. The Contractor Special Security Officer (CSSO) will submit names, social security numbers, duty positions, clearance level and date, investigation level and date, and contract for each individual contractor requiring SCI access to the COR for approval. COR will acknowledge receipt of official requests to the CSSO confirming member’s need-to-know. CSSO will submit a request for special background investigations in accordance with the NISPOM. Each member must submit the entire personnel security questionnaire package to the personnel security branch. The CSSO, and individual, as required, must follow the instructions provided.

d. Inquiries pertaining to classification guidance involving SCI will be directed to HQ PACAF SSO through the COR.

e. All SCI material and/or systems furnished in support of this contract will remain the property of the Department of Defense (DoD), department agency, or command originator. Upon completion or cancellation of the contract, all furnished SCI material and/or systems will be returned to the direct custody of the supporting COR/SSO or destroyed IAW instructions outlined by the COR/SSO.

f. SCI will be stored and maintained only in properly accredited facilities at the contract locations. Contractors will not reproduce any SCI without the permission of the COR. Any material that is reproduced will be classified, controlled, and accounted for in the same manner as the originals.

g. Contractors will not release SCI material to any activity, individual, or consultant organization not directly engaged in providing services under this contract without the consent of the sponsoring agency (which shall verify that a second contractor has a “need-to-know” and meets security clearance requirements).

h. Contractor will submit requests, through the contract monitor, for transmittal of SCI certification 10…