Draft ISOSS_PWS Follow-On 2025 V5.pdf

PERFORMANCE WORK STATEMENT (PWS)

BASE

Information Systems Operations Service Support (ISOSS)

Part 1

General Information

1. GENERAL: This is a non-personal services contract and the Government shall not exercise any supervision or control over the contract service providers performing the services herein.

Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide Information Technology (IT) Management Support Services to maintain the Army’s Information System (IS) infrastructure throughout the White Sands Missile Range (WSMR), New Mexico, as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract. The WSMR Enterprise Services leverages information technology to provide its staff and customers with the tools needed to efficiently perform their duties and contribute to WSMR’s mission success. The link between Information Technology and people is clear and the success of the organization depends greatly on its ability to integrate these two resources. The Enterprise Services has a mission to provide network support to the White Sands Test Center, Garrison, various tenant commands, and future growth commands. To accomplish this mission, multiple IT disciplines are required to support the IT Infrastructure throughout WSMR.

1.1.1 Road Closures: Access roads to and within the boundaries for WSMR are subject to closing for live missile firings or other military operations. Roadblocks are normally one to two hours in duration. This does not relieve the contractor from performance of contractual responsibilities. Occasional rescheduling of work requirements may result due to missile firings or other military operations. It is the contractor’s responsibility to reschedule any and all work requirements due to roadblocks and evacuations. Roadblock information may be obtained by calling (575) 678-1178; information is recorded and subject to change without notice.

1.2 IT Background: One of the major missions of the WSMR Enterprise Services is to manage and maintain the IT infrastructure and manage the IT assets including but not limited to servers, workstations, notebook computers (including all peripherals), tablets, switches, routers, supporting software, Cloud Technology solutions, Printers (MFD and desktop), Virtual Private Networks (VPN), Communications Security (COMSEC), public facing and internal web services, Cybersecurity (CS) Operations, Intrusion Detection Systems (IDS), and a wide variety of other IT services.

1.3 Objectives: The objective of the WSMR IT program is to provide a reliable, secure, efficient, effective, and technologically current IT infrastructure in support of WSMR Test Center Directorates, WSMR Garrison and local tenants. WSMR desires a Contractor who brings a mission focus to this program that can continuously identify methods for applying information technology to improve WSMR’s mission capabilities. WSMR requires a Contractor at a maturity level that can bring not only the capability to install, operate, and maintain IT hardware and software components but also be able to do the following:

1.3.1 Provide under a performance-based, fixed-price engagement, secure, highly reliable, and available IT infrastructure services.

1.3.2 Army Regulation AR 25-1: Army Information Technology, Army Regulation AR 25-2: Army Cybersecurity, requires the continuous review, analyzing and the proactive measures taken to ensure that the WSMR IT infrastructure remains current with technological advances for achieving acceptable levels of security in engineering, implementation, operation and maintenance for Information Systems connecting to or crossing any US Army Managed network, while validating that infrastructure investments are aligned with the Army’s Strategic Plan and WSMR mission objectives.

1.3.3 Develop and provide innovative solutions.

1.3.4 Achieve and maintain compliance with DoD and Army’s IT management standards in accordance with Army Regulation (AR) 25-2 and the PWS requirements at all times. The list of publications are located in Section 6, of this PWS.

1.3.5 Provide an efficient Help Desk solution for tier I through IV support.

1.4 Scope: The Contractor shall provide all management, tools, material, equipment and labor necessary to provide non-personal services for IS operation and support services (ISOSS) to WSMR as defined in this Performance Work Statement (PWS).The technical scope of this PWS requires all technicians obtain and maintain commercial certification in accordance with Department of Defense Instruction (DoDM) 8140.01-.03: CYBERSPACE WORKFORCE QUALIFICATION AND MANAGEMENT PROGRAM, Cyberspace Workforce Management, latest edition including any follow-on revisions, at the level consistent with duties assigned by the contractor management and in accordance with their ATCTS Cyber Role. Any individual filling a position under this PWS shall be fully certified before assuming duties under this PWS.

The Information Systems Operations Service Support (ISOSS) PWS includes networks located on WSMR including:

1.4.1 Defense Research Evaluation Network (DREN)

1.4.2 Secret Internet Protocol Router Network (SIPRNET)

1.4.3 Non-Secure Internet Protocol Router Network (NIPRNET)

1.4.4 White Sands Internet Service Provider Resourse (WISPR)

1.4.5 Test Support Network (TSN Black & TSN Red)

1.4.6 Fast Burst Reactor Network (FBRNet)

1.5 Period of Performance: The total period of performance using a Multiple Year contract is 5 (five) years ordering periods. The contract will not include option periods but does include FAR 52.217-8, Option to Extend Services.

Year 1 TBD Year 2 TBD

Year 3 TBD Year 4 TBD Year 5 TBD 52.217-8, Option to Extend Services.

1.6 General Information

1.6.1 Quality Control: The ISOSS requirenment is commercial services and will be performed using FAR Part 12. The contractor’s existing quality assurance system shall be utilized in accordance with FAR 12.208. The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s quality control (QC) program is the means by which the contractor assures itself that their work complies with the requirement of the contract.

A comprehensive Quality Control Plan (QCP) supporting the PWS/SOWrequirements shall be required after award. The QCP shall be delivered to the COR for delivery to the Contracting Officer’s (KO) within 30 calendar days of contract award. The Government will review and either notify the Contractor in writing of acceptance of the plan or return their comments to the Contractor within 5 days. If the Government has provided comments, the Contractor shall then have 5 days to submit a Final QCP. After receipt of the Final QCP, the Contractor may receive the Contracting Officer’s acceptance in writing. Any proposed changes to the accepted QCP are required to be resubmitted for acceptance by the Contracting Officer no later than 10 days prior to the anticipated change and before implementation by the Contractor. The timeline noted above will apply for review and acceptance for proposed changes. At a minimum, the QCP must include and answer the following to be acceptable:

a. A chart showing the organizational structure and lines of authority, the names, qualifications, duties, responsibilities, and classification of each member of the Contractor's Quality Control Team.

b. How will the Contractor monitor work to ensure that performance complies with all deliverables (etc. timelines, deadlines, and goals)?

c. How will the Contractor monitor work to ensure that performance complies with all specifications and requirements of the contract, including clauses?

d. How will the Contractor monitor and ensure staff qualifications remain current and valid including DOCPER processes/approvals throughout contract performance?

e. How will the Contractor ensure all keys issued will remain controlled items (Paragraph

1.7 Key Control)?

f. How will the Contractor inventory and track maintenance of all Government Provided Equipment / Materials?

g. How will the Contractor identify, investigate, and correct any non-conforming performance and prevent similar deficiencies in the future?

h. How will the Contractor file and save all Quality Control related documents for the life of the contract plus 5 years?

1.6.2 Quality Assurance: The Government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan that is for Government personnel use only. This plan is focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays: The contractor is not required to perform services on these holidays unless specifically stated in assigned Task Orders (TO).

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Junetenth Christmas Day

1.6.4 Hours of Operation: The Contractor is responsible for conducting business between the hours, 0700 – 1700 (Monday –Friday), except Federal holidays or when the Government facility closes due to local or national emergencies, administrative closings, or similar Government directed facility closings, or as specified in section 5 of the PWS. The majority of the WSMR workforce (both Civilian and Contractor) operate under a compressed work schedule consisting of four 9-hour days with core hours between 0700 – 1630 Monday thru Thursday and one 8 hour day on either the first or second Friday of the pay period with the alternate Friday as a non-work day. Outside the core working hours noted herein, some facilities may not be accessible and reduced Government oversight may limit Contractor access. Exceptions shall be worked through the COR and where necessary the KO. Contractor employees shall not work more than nine hours per day without written authorization for Overtime from the COR/KO. Personnel providing direct test support shall work a variable tour of duty as identified by Range Mission requirements that will be communicated to the contractor by the issuance of subsequent task order.

1.6.4.1 After Hours Support: The contractor shall be responsible to correct issues to include but not limited to spillages, service interruptions, inspections and hardware/software failures on the systems that the contractor is supporting. All after hours support shall be coordinated with the Contracting Officer’s Representative prior to commencing.

1.6.5 Place of Performance: The primary location for the performance of this contract will be the cantonment area at White Sands Missile Range, NM. However, responsibility for support under this PWS covers the entire WSMR area.

1.6.6 Type of Contract: The government will award an Indefinite Delivery Indefinite Quantity (IDIQ) with five ordering periods.

1.6.7. Security Requirements: Contractor personnel shall obtain an appropriate security clearance, depending on assigned positions, prior to assignment and maintain eligibility for the designated clearance level throughout their tenure. Systems Administrator and other personnel for CyberSecurity Technical Level Access (Table 1); Privileged and Limited Privileged Access Table 2 and Table 3, respectively, must possess a minimum Secret Clearance. These tables are located in paragraphs 1.6.7.17.2 a through m. Army Regulation (AR) 25-2, Information Assurance shall be followed for compliance. All Contract Security requirements are to be performed in accordance with (IAW) the DoD Contract Security Requirements Specification DD Form 254. The DD Form 254 is located at the end of the Performance Work Statement (PWS)

1.6.7.1. Classified Information: Questions regarding CLASSIFIED information shall be handled through the White Sands Test Center Security (WSTC) Office. Specifically, any entity wanting to ask a question regarding CLASSIFIED information shall send an email to the WSTC Security Office, the Technical POC and the Business POC stating that the entity would like to ask a question regarding CLASSIFIED information. DO NOT EMAIL ANY QUESTIONS THAT MAY CONTAIN CLASSIFIED INFORMATION. The WSTC Security Officer will coordinate through the COR to make contact with the entity and arrange for the question pertaining to CLASSIFIED information be asked through a secure method of communication.

1.6.7.2 Installation Access: Access to U.S. installations, buildings and controlled areas is limited to personnel who meet security criteria and are authorized. Failure to submit required information/data and obtain required documentation or clearances will be grounds for denying access to U.S. installations, buildings and controlled areas. The Contractor shall ensure that any subcontractors used in performance of this contract complies with these requirements and that all employees, of both the Contractor and any subcontractor utilized by the Contractor, are made aware of and comply with these requirements.

The Contractor shall be aware of and comply with the requirements associated with Installation Access Control. The Government is not liable for any costs associated with performance delays due solely to a firm’s failure to comply with Installation Access Control System (IACS) processing requirements.

1.6.7.3. AT Level I Training (general: All Contractor employees, to include subContractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The Contractor shall submit certificates of completion for each affected Contractor employee and subContractor employee, to the COR or to the contracting officer (if a COR is not assigned), within 30 calendar days after completion of training by all employees and subContractor personnel. AT level I awareness training is available at the following website: http://jko.jten.mil

1.6.7.3.1. AT Awareness Training for Contractor Personnel Traveling Overseas: Reserved

1.6.7.4. Access and general protection/security policy and procedures: Contractor and all associated sub-contractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

a. Installation Exercises and Scheduling: The Contractor shall work closely with the KO and/or the COR who has access to the Installation training schedule. The Contractor shall schedule work/deliveries accordingly. Contractors shall as part of the exercise be required to provide an accountability of personnel to the KO and/or the COR of numbers of employees on hand and locations.

b. Unauthorized weapons/firearms: No Contractor, sub-Contractor, or affiliate shall bring Privately Owned Weapons/Firearms on the Installation.

http://jko.jten.mil/

c. Search and Seizure: Contractor personnel and property shall be subject to search and seizure in areas the Contractor is providing official support duties and upon entering, while on, or upon leaving the confines of WSMR.

d. Operational Delays Because of Threat, Disaster, Weather, or Operational Testing: The Senior Mission or Garrison Commander because of an increase in threat, disaster, inclement weather or operational testing may require the installation curtail operations, limiting access to essential Government employees only, block/restrict movement on major roads on or leading to WSMR, or close the installation. The Contractor cannot hold the US Government or the Command at the installation responsible for cost overruns because of these operational decisions.

1.6.7.5. Issuing New Common Access Card (CAC): Before CAC issuance, the Contractor employee requires, at a minimum, a favorably adjudicated Tier 1 (T1) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The Government will issue a Contractor a CAC only if duties involve one of the following:

a. Both physical access to a DoD facility and access, via logon, to DOD networks on-site or remotely

b. Remote access, via logon, to a DOD network using DOD-approved remote access procedures

c. Physical access to multiple DOD facilities or multiple non-DOD federally controlled facilities on behalf of the DOD on a recurring basis for a period of 6 months or more.

At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled T1 investigation at the Office of Personnel Management.

1.6.7.5.1. CAC Issuance: The Contractor, through their human resources or personnel office, will send the Government COR a request for a CAC if required. The application for the CAC is normally obtained through the Trusted Associate Sponsorship System (TASS) website. The on-line application will be submitted in the TASS by the Contractor to the COR. Contractor CAC and WSMR Network access require an NACI (National Agency Check with Written Inquiries) Investigation using the SF 85P form. The COR will approve the application and process for issuance. In order to acquire the CAC the Contractor employee shall present a current Federal or State photo identification (such as a driver’s license) and proper identification with their social security number. The Contractor is responsible for accountability of the CAC card and shall return it to the COR upon request or when the employment for an individual ends. Lost CAC cards shall be reported to the COR with an account of the circumstances and explanation of actions to prevent reoccurrence prior to issuance of a replacement card.

1.6.7.5.2. Access Without a CAC: For Contractors that do not require a CAC, but require access to a DOD facility or installation, the Contractor and all associated sub-Contractor employees shall comply with adjudication standards and procedures:

a. National Crime Information Center Interstate Identification Index (NCIC-III)

b. Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13)

c. Applicable Installation, facility and area commander installation/facility access

d. WSMR security policies and procedures

e. Status of forces agreements and other theater regulations while in OCONUS locations

1.6.7.5.3. Alternate Credential Issuance: All Contractor employees that will not require CAC shall be required to possess an alternate form of installation access ID credential. The specific list of approved credentials and procedures for obtaining them are identified in Memorandum for See Distribution, Subject White Sands Missile Range Visitor Control Program and attached annexes, Dated 29 January 2015 or subsequent updates.

1.6.7.5.4. Departing Employees: The Contractor shall ensure all permanently (and temporarily when in excess of 30 days) departing Contractor or subContractor employees return security photographic identification cards, permits, CAC’s, Government property, keys, photo passes, and range passes. The Contractor shall request cancellation of Local Area Network (LAN) email access for departing personnel at the completion of their employment. The Contractor shall utilize a company / Installation clearance (out-processing) form to include a signature block for the COR to certify that an employee has returned all required badges, CACs, keys, and other accountable items. The Contractor shall return keys to the issuing key custodian prior to the employee departing. Depending on the position, information access, and clearance level, a Contractor may require a security debriefing prior to departure.

1.6.7.6 Key Control (If applicable). The Contractor shall establish and implement methods of making sure all keys, remotes, and key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. (NOTE: All references to keys also includes vehicle remotes, and key cards.) No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer.

1.6.7.6.1. In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying.

When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.6.7.6.2. The Contractor shall prohibit the use of Government issued keys by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

1.6.7.6.3. Lock Combinations (If applicable): The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s Quality Control Plan.

1.6.7.7. Initial, Annual, and Program Specific Security Training: Government furnished and required security training includes Initial (New Hire) and Annual Cybersecurity Awareness Training, iWATCH, Antiterrorism, OPSEC, Threat Awareness and Reporting Program (TARP) Training, and any other command mandated training.

Contractors shall complete the following Security training within 30 calendar days of contract award and within 15 calendar days of new employees commencing performance with the results reported to the COR NLT 45 calendar days after contract award.

iWATCH Program

AT Level 1 annual training

OPSEC Awareness annual training

These trainings shall be tracked or documented using either hard copy sign in sheets, online-automated tracking programs, or Common Access Card (CAC) Verification. The method of tracking will be identified to the Contractor through the COR prior to start of the training activity. There are program specific trainings in the area of AA&E, INFOSEC, COMSEC and other security disciplines that shall be identified and tracked by the Program/Project Manager.

a. Part and Full Time Permanent Employee Security Training Tracking: Part and full time permanent employees requiring either WSMR Network access, installation access in excess of six months or both shall be required to complete all security-mandated trainings assigned and tracked through the ATEC Training Tracker Module (ATTM). The COR and the Government Training Coordinator log Contractor personnel and training requirements.

b. Other Category Employees Security Training Tracking: Casual, temporary, and those employees that do not have WSMR Network access shall be required to complete all assigned security trainings assigned through the ATTM to those employees identified above. The FSO and the G-2 Industrial Security Officer (ISO) shall coordinate the delivery and tracking method. Annually (last week of August) a report of all such employees, identifying the completion date of each training event by each employee shall be provided to the WSTC ISO.

c. New Employee Orientation: New Contractor employees require security training within thirty (30) days of start date. For the purposes of security training events, a new hire shall be defined as an employee that is newly hired to the Contractor or is returning after a break in employment in excess of one year. If an employee was previously a service member, civil servant, or employed with another Contractor assigned to or contracted by the WSMR/ATEC Command and did not have a break in service in excess of one year they shall not be considered a new hire. The Contractor, the Government Training Coordinator, the COR, the FSO, and the ISO track Contractor security requirements.

d. AT Awareness Training for Contractor Personnel Traveling Overseas: Reserved

1.6.7.7.1. iWATCH TRAINING: The Contractor and all associated sub-Contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the appropriate personnel. This training shall be completed within 30 calendar days of contract award and within 15 calendar days of new employees commencing performance with the results reported to the COR NLT 45 calendar days after contract award.

1.6.7.8. The Contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected.

The Contractor shall implement OPSEC measures as ordered by the commander. In addition, the Contractor shall have an identified certified Level II OPSEC coordinator per AR 530-1.

1.6.7.8.1 OPSEC Requirements: The Contractor shall comply with the Operations Security (OPSEC) requirements IAW:

a. AR 530-1, Operations Security

b. US ATEC Policy Bulletin 14-12

c. WSMR OPSEC Standard Operating Procedure

d. WSMR OPSEC Plan,

e. OPSEC review and approval of Government / Research, Development, Test and Evaluation (RDT&E) information prior to its public release.

1.6.7.8.2. OPSEC Training: Per AR 530-1 Operations Security, the Contractor employees shall complete Level I OPSEC Awareness training. New employees shall be trained within 30 calendar days of their reporting for duty and annually thereafter.

1.6.7.9. Performance or Delivery in a Foreign Country: Reserved

1.6.7.10. Facility Clearance: The approved Contract Security Classification Specification, DD Form 254 governs on-site activities performed under the organization's facility clearance. The DD Form 254 issued to the Contractor with this PWS provides instructions for the safeguarding of classified information. The Contractor shall comply with FAR 52.204‐2, Security Requirements. This clause involves access to information classified “Confidential”, “Secret”, or “Top Secret” and requires Contractors to comply with:

a. The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22‐M); any revisions to DoD 5220.22‐M, notice of which has been furnished to the Contractor.

b. The Contract Security Classification Specification (DD Form 254).

c. DoD 5200.1, Volumes 1-4. DoD Information Security Program

d. AR 380-5, Department of the Army Information Security Program

1.6.7.11. Personnel Security Clearance: The Contractor shall be able to acquire a Facility Clearance Level of at least Top Secret level in the Joint Personnel Adjudication System (JPAS) at time of the proposal submission and must maintain the level of security required for the life of the contract. The security requirements are IAW the Department of Defense Contract Security Classification Specification DD Form 254. Offeror must provide a current and complete DD Form 441, Department of Defense Security Agreement and meet all requirements. If a current and complete DD Form 441 cannot be submitted then the Contractor shall put a plan and process in place to obtain a Facility Clearance. The approved Contract Security Classification Specification, DD Form 254 governs on-site activities performed under the organization's facility clearance. The DD Form 254 issued to the Contractor with this PWS provides instructions for the safeguarding of classified information. The Contractor shall comply with FAR 52.204‐2, Security Requirements. This clause involves access to information classified “Confidential”, “Secret”, or “Top Secret” and requires Contractors to comply with:

a. Be granted access to classified information

b. Be allowed to perform classified work

c. Be granted access to restricted areas, unless escorted by a person having proper clearance and authorization

d. Handle Arms, Ammunition, and Explosives (AA&E) material, keys, or data

1.6.7.11.1 OWNING/SERVICING RELATIONSHIPS The FSO shall provide the WSMR Personnel Security Manager (PSM) with a list of all personnel, "Owned" or "Serviced" through the Joint Personnel Adjudication System (JPAS) and assigned to this contract within ten (10) workdays after contract award. The Contractor shall provide a monthly update to the COR and PSM by the first Wednesday of each month. The FSO will maintain an "Owning" relationship with all personnel employed by the prime Contractor and a "Servicing" relationship with all sub- Contractor personnel. The Government maintains these relationships for personnel in possession of a security clearance and those with a NACI T1 background check investigation for the purposes of CAC issuance.

1.6.7.11.1. The FSO shall provide the WSMR Personnel Security Manager (PSM) with a list of all personnel, "Owned" or "Serviced" through the Joint Personnel Adjudication System (JPAS) and assigned to this contract within ten (10) workdays after contract award. The Contractor shall provide a monthly update to the COR and PSM by the first Wednesday of each month.

The FSO will maintain an "Owning" relationship with all personnel employed by the prime contractor and a "Servicing" relationship with all sub-contractor personnel. The Government maintains these relationships for personnel in possession of a security clearance and those with a NACI T1 background check investigation for the purposes of CAC issuance.

1.6.7.12 Facility Security Officer: The resident Facility Security Officer (FSO) shall have at least 2 years industrial security experience, hold a minimum of a Secret security clearance, and meet training qualifications in accordance with the Defense Security Service (DSS).

1.6.7.13. Threat Awareness Reporting Program: Per AR 381-12 Threat Awareness and Reporting Program (TARP), Contractor employees shall receive annual TARP training by a CI agent or other trainer as specified in 2-4b of AR 381-12.

1.6.7.14. Antiterrorism Requirements: The Contractor shall comply with Antiterrorism/Force Protection (AT/FP) requirements IAW:

a. AR 525-13, Antiterrorism

b. WSMR Installation AT Plan,

c. OCONUS Travel Briefs

d. Preparation of the Contractor’s Organizational Consolidated Force Protection, Security, and Evacuation Plans

e. Conduct of the WSMR Random Antiterrorism Measure Program

1.6.7.15. Foreign Interaction and/or Disclosure: The Contractor shall comply with:

a. AR 380-10, Foreign Disclosure and Contacts with Foreign Representatives

b. DOD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations

c. DOD 5230.20, Visits, Assignments, and Exchanges of Foreign Nationals

d. WSMR Standard Operating Procedures, Foreign National Personnel Visits/Foreign Disclosure

Under no circumstances shall the Contractor disclose data or information gathered in the execution of this contract without express written direction or permission from the Government.

1.6.7.16. Physical Protection of Government Assets: The Contractor shall comply with conventional key and lock requirements under AR 190-51, Security of Unclassified Army Property (Sensitive and Non-sensitive) and WSMR Reg. 190-6 for those facilities, areas, and equipment not governed by AA&E or NISPOM guidance (e.g., office space that does not process or store classified or AA&E material).

1.6.7.17. Arms, Ammunition, and Explosives (AA&E) Material: When handling, processing, and/or storing AA&E the Contractor shall comply with:

a. AR 190-11, Physical Security of Arms, Ammunition, and Explosives

b. AR 190-13, The Army Physical Security Program

c. DA Pam 190-51, Risk Analysis for Army Property

d. DESR 6055.09 Defense Explosives Safety Regulation

e. DA PAM 385-64 Ammunition and Explosives Safety Standards

1.6.7.18. Requirements for Unclassified Handling Instructions. (If not present on a DD Form 254) / Shall comply with CUI IAW Directives and Categories Located at National Archives https://www.archives.gov/cui/registry/category-list.

1.6.7.18.1 (Use if access to classified. Do not use outside the US or under SAT): The contractor shall follow DOD Federal Acquisition Regulation Supplement (DFARS) clause 252.223-7004, Drug-free Work Force. The contractor shall conduct drug tests, ensuring all Top Secret cleared contractor employees are tested at least once per year, each year of the contract, as well as when there is a reasonable suspicion that an employee uses illegal drugs.

The drug testing shall be at the contractor’s expense. Positive drug test results shall be made available to both the KO and COR within 24 hours of known test results. Records of drug testing shall be made available to the COR.

1.6.7.19. CyberSecurity Training / Certification:

1.6.7.20. Performance or Delivery in a Foreign Country: Reserved

1.6.7.21 Cybersecurity (CS) Training / Certification (Technical Level Access):

a. All Contractor personnel with access to Government information systems and networks shall successfully complete all required CS awareness training as specified in AR 25-2 and as specified by the Government requiring activity. Training is available at https://cs.signal.army.mil.

b. Contractor employees and subContractor employees performing work under this contract who have access to Government information systems and networks shall create a user account and profile in the Army Training and Certification Tracking System website (ATCTS) at https://atc.us.army.mil, in the unit container managed by the COR. A certificate of successful completion of CS training (DoD Cyber Awareness Challenge Training), Acceptable Use Policy (AUP), DD Form 2875 – System Authorization Access Request https://www.archives.gov/cui/registry/category-list

(SAAR)s, Privileged Access Agreement (PAA), Appointment Orders, applicable baseline and computing environment certifications, and continuing professional education credits, as required by DoD 8570.01-M, shall be uploaded to the ATCTS and provided to the COR for continuous compliance monitoring and reporting.

c. The Contractor shall ensure that all Contractor employees and subContractor employees requiring CS awareness training complete the training at the start of work performance on this contract and annually thereafter for the duration of this contract and require employees to maintain their information in a ‘current’ status at the ATCTS website.

d. The Contractor shall ensure that all Contractor employees and subContractor employees performing work under this contract who have elevated access to Government information systems and networks, upon having completed the above referenced requirements for Technical Level Access, have been issued common access cards (CAC) and / or SIPR tokens for user authentication and secondary authentication tokens tied to their technical level permissions. Violations of the use of the issued and authorized means of authentication will be treated as a security violation and may terminate the contract.

e. DFARS clause 252.239-7001 (Information Assurance Contractor Training and Certification) applies to this contract. This contract is subject to the mandates of DoD 8570.01-M, which establishes baseline technical and management CS training and certification requirements for personnel performing CS functions within DoD. Functions spanning multiple levels require certification of the highest-level functions. Contractor personnel performing functions in multiple categories or specialties shall hold certifications appropriate to the functions performed in each category or specialty.

f. The Contractor shall ensure its IT (CS) workforce members have the baseline certifications corresponding to their IT (CS) functions, as defined by DODD 8140.01 and Chapters 3, 4, 5, 10, and 11, and Appendix 3 of DoD 8570.01-M at work performance start date. Contractors will obtain all required Computing Environment (CE) certificates prior to being engaged. The IAT Level I baseline certification is the minimum requirement for unsupervised privileged access. The Contractor shall ensure that all employee certifications remain active and are renewed prior to expiration.

g. The Contractor shall ensure that all employees CS certifications are released to the Department of Defense through the Defense Workforce Certification Application at https://www.dmdc.osd.mil/appj/dwc/index.jsp.

h. Table 1 reflects the Personnel Security (IT Level) and CS Workforce Specialty requirements, aligning the CS functional responsibilities and access levels to the contract tasks, in accordance with DoDD 8140.

Table 1. Cybersecurity Workforce Role (Cybersecurity (CS) Certification Requirements.

Workforce Role

Basic

IAT1

Intermediate

IAT2

Advanced

IAT3

BS

Engineering/Computer Science/ Information Technology Option

OPM: 451

System Administrator

A+ or CND or

Network+ or

Security+

Cloud+ or GICSP or GSEC or

SSCP

CASP+ or

CCNP

Security or

CCSP

YES

OPM: 421

Database Administrator

GSEC or Security +

Cloud+ or

SSCP

CASP+ or

CCNP

Security or CISA or

CISSP or

CISSP-

ISSAP or

CISSP-

ISSEP

YES

OPM: 411

Technical Support Specialist

A+ or Network+ or Security+

CND or

GICSP

CASP+ or

CCNP

Security or CISA or

SSCP

YES

OPM: 651

Enterprise Architect

CND or

GSEC

CASP+ or CCSP or Cloud+ or

CSSLP

CISSP-

ISSAP or

CISSP-

ISSEP

YES

OPM: 431

Knowledge Manager

Security+ SSCP N/A YES

i. All personnel responsible for implementing the IAVM process will subscribe at https://iavm.csd.disa.mil current notification group to receive vulnerability and patching messages.

j. The interim assignment of Contractor personnel fulfilling IT positions will be restricted and implemented only upon documentation in the Risk Management Framework (RMF) Security Authorization Package (SAP) and acceptance of the Authorizing Official (AO) and the Contracting Officer evaluations on a case‐by‐case basis.

k. Contractor personnel occupying an IT position will be subject to a periodic reinvestigation according to existing contract, labor relations, or personnel security policy.

l. Contractors supporting CyberSecurity (CS) functions will meet the background investigation requirements in accordance with DoDM 5200.02.

m. Contractor personnel supporting CyberSecurity (CS) functions in accordance with DoDM 8140 shall provide verification to the Defense Eligibility Enrollment System (DEERS). In addition, all contractor positions supporting CS functions will be assigned a CS workforce Category, Specialty and IT Level code in the contract. These codes must be identified by the contractor to Defense Manpower Data Center (DMDC). Contractor personnel must also have their CS certification and function level documented in DMDC supported applications. They will also register for an ATCTS account in accordance with current guidelines.

1.6.7.22. Non-Government-owned Computing Systems or Devices:

The Contractor shall comply with current versions of AR 25-1 Army Information Technology and AR 25-2 Army Information Assurance found at the Army Publishing Directorate (APD) website https://armypubs.army.mil/ProductMaps/PubForm/ActiveSearchFull.aspx The Contractor shall not install or connect non-Government-owned computing systems or devices to Government networks without the COR's coordinating and obtaining proper authorization from the appropriate Command or Local level Information Systems Security Manager (ISSM), ensuring that all software has undergone the Assess Only process and approved through Enterprise Configuration Control Board (E-CCB). The non-Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned thumb drives (e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives), removable or external hard drives, Personal Digital Assistants (PDA), PC Cards / Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD) / digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, cameras or any devices that can store data.

1.6.7.23. Protection of Sensitive Unclassified Data / Personally Identifiable Information (PII): The Contractor shall ensure any sensitive information, including, but not limited to, Personally Identifiable Information (PII) and Controlled Unclassified Information (CUI), proprietary, and Law Enforcement (LE) Sensitive information residing on Mobile Computing Devices (MCD) or other external media, is protected in accordance with current Data at Rest (DAR) guidelines and requirements. The Contractor shall use an authorized, approved, and prescribed DAR solution. The MCDs include, but are not limited to, laptop, netbook, notebook, or tablet computers, and Blackberry or equivalent devices. External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives) (when authorization to use them is restored), floppy disks, and other portable digital storage devices.

Guidance for protecting DAR information appears in DoD Policy Memorandum, 3 Jul 07, subject: Encryption of Sensitive Unclassified Data-at-Rest on Mobile Computing Devices and Removable Media and in DoD Component implementing instructions.

1.6.7.24. Appropriate Appearance/Conduct: Contractor personnel shall conform to standards of conduct and code of ethics, which are consistent with those applicable to Government employees as provided in the Joint Ethics Regulation 5500.7.R. Contractor personnel shall present a neat professional appearance and be easily identified. This shall be accomplished by wearing distinctive clothing bearing the company name or by wearing appropriate badges that contain the company name and employee’s name.

1.6.7.25. Conduct of Personnel: The Contractor and their employees, to include subContractors, shall observe and support all policies, rules and regulations issued by the local installation commander pertaining to safety, fire prevention, sanitation, severe weather, use of tobacco, admission to the installation, and conduct of operations. The Government may require the Contractor to remove any employees from the work site based on misconduct, security violations, use of incapacitating agents, or any other reason determined to be in the https://armypubs.army.mil/ProductMaps/PubForm/ActiveSearchFull.aspx

Government’s best interest. The installation commander has the authority under 18 U.S.C. § 1382: US Code - Section 1382: Entering military, naval, or Coast Guard Property, to bar individuals from the installation.

1.6.7.26. Reserved

1.6.8. Special Qualifications:

1.6.8.1. Cyber Security/Information Assurance Contractor Training and Certification: The Contractor shall ensure upon contract award that personnel accessing information systems have the proper and current information assurance certification associated with basic, intermediate, or advanced to perform information assurance functions in accordance with DoDD 8140, Cyberspace Workforce Management. The Contractor shall meet the applicable cyber security certification requirements including:

a. DoD-approved CS/ IA workforce certifications appropriate for each category and level as listed in the current version of DoDD 8140; and

b. Appropriate operating system certification for information assurance technical positions as required by DoDD 8140.

c. Upon request by the Government, the Contractor shall provide documentation supporting the CS / IA certification status of personnel performing information assurance functions.

Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions

1.6.8.2. Personnel Security Standards (AR 25-2): The following standards designate positions requiring access to IT and for processing information within IT systems.

These security designations are required to distinguish potential adverse effects on Army functions and operations and, therefore, the relative sensitivity of functions performed by individuals having certain privileges. These positions are referred to as IT and IT-related positions. The requirements of this section will be applied to all IT and IT-related positions, whether occupied by DA civilian employees, military personnel, consultants, contractor personnel, or others affiliated with the DOD (for example, volunteers). Additional guidance is available in DOD 5200.2-R.

1.6.8.2.1. Basic Requirements: Personnel requiring access to ISs to fulfill their duties must possess the required favorable security investigation, security clearance, or formal access approvals, and fulfill any need-to-know requirements.

1.6.8.2.2. IT-I:

Defined as:

a. Personnel in CS positions (for example, SAs/NAs for infrastructure devices, IDSs, VPNs, routers; SAs/NAs for classified systems and devices) with privileged-level access to control, manage, or configure CS tools or devices, individual and networked IS and devices, and enclaves.

b. Favorable completion of a National Agency Check (NAC) (current within 180 calendar days).

c. Initiation of a Single Scope Background Investigation (SSBI) and favorable review of SF 85P - Questionnaire for Public Trust Positions, SF 86 - Questionnaire for National Security Positions, and Supplemental Questionnaire.

1.6.8.2.3 IT-II:

a. Personnel in CS positions (for example, operating system administration of common network applications or enclaves, back-up operators) with limited privileged-level access to control, manage, or configure ISs and devices, with very limited (single device) or no IA device access or management.

b. A favorable review of local personnel, base/military, medical, and other security records as appropriate.

c. Initiation of a National Agency Check with Credit Check and Written Inquiries (NACIC) (for civilians) or a National Agency Check with Local Agency and Credit Checks (NACLC) (for military and contractors), as appropriate or favorable review of SF 85P and Supplemental Questionnaire.

1.6.8.2.4. IT-III:

a. Personnel in CS A positions, for example, power users or a SA on individual systems for configuration or management with limited privileged-level access to that IS(s) or device(s).

This is a position of higher trust.

Personnel with roles, responsibilities, and access authorization of normal users with non-privileged level access to the IS or device.

Personnel with non-privileged level access authorization in the role of official or statutory volunteers. The provisions for statutory volunteers are covered in AR 608–1.

b. A favorable review of local personnel, base and military, medical, and other security records, as appropriate.

c. Initiation of a NACIC (for civilians) or national agency check (NAC) (for military and contractors), as appropriate and favorable review of SF 85P and Supplemental Questionnaire.

1.6.8.3. Reserved

1.6.9 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The KO, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the KO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Minutes of all meetings shall be prepared with copies being maintained in the COR file/CORT tool and shall document the appropriate action taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.10 Contracting Officer Representative (COR): The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections…