DRAFT Performance Work Statement Cardstock and Logistical Support.pdf

PERFORMANCE WORK STATEMENT

CARDSTOCK BLANKET PURCHASE AGREEMENT

DEFENSE MANPOWER DATA CENTER

1.0. INTRODUCTION

The Defense Manpower Data Center (DMDC) requires cardstock, sleeves, middleware, middleware support, and logistical support to maintain the Department of Defense (DoD) credentialing solutions for the DoD and other Federal agencies that have adopted the DoD credentialing solutions.

2.0. BACKGROUND

DMDC is the proponent organization within the DoD for the implementation of smartcard technology and the DoD’s Department-wide Common Access Card (CAC) program, as originally directed by the

Deputy Secretary of Defense in Directive-Type Memorandum 08-006, “DoD Implementation of

Homeland Security Presidential Directive 12 (HSPD-12)” and currently directed under DoD

Instruction 1000.13. DMDC has a requirement for cardstock to deliver various Identity credentials and tokens (i.e. - CACs, NIPRNet Alternate Tokens (ALTs), SIPR Tokens (SSTs), and Uniformed

Services Identification (USID) cards), sleeves, middleware, middleware support, and logistical support necessary for program maintenance.

The DoD CAC solution includes approximately 3.6 million active cards in circulation at any given time, with approximately 225,000 issued monthly. The DoD USID card includes approximately 4.1 million active cards in circulation at any given time, with approximately 200,000 issued monthly. In order to successfully maintain the program for the Department, DMDC has a requirement to ensure that CAC and

USID cardstock is available and distributed to approximately 1,800 locations.

3.0. SCOPE

The scope of this acquisition is to provide the cardstock, NIPR/SIPR tokens, sleeves, middleware, middleware support, and logistical support to maintain the DoD credentialing solution. This includes providing products in the required quantities for normal inventory replenishment and emergency requests, and warehousing, distributing, processing, and storing associated cardstock and consumables.

4.0. REQUIREMENTS

4.1. CARDSTOCK

4.1.1. The contractor shall provide a minimum of 128K (or greater) usable electrically erasable programmable memory (EEPROM) Dual Interface (ISO 14443) Personal Identity Verification (PIV) cards. The products must be FIPS 140-2, level 2 certified (or higher) with DoD applets and prequalified with a proof of appropriate testing by an Independent Verification & Validation (IV&V) laboratory. The products must be from the FIPS 201 Approved Products List -https://www.idmanagement.gov/approved-products-list-piv/. The vendor must be able to provide all products on the FIPS 201 Approved Products List.

4.1.2. The contractor shall provide contactless USID cardstock.

https://www.idmanagement.gov/approved-products-list-piv/

4.1.3. The following Integrated Circuit Chip (ICC) and non-ICC specifications and layouts apply to cardstock provided herein:

Appendix 1, “DoD Smart Card Cardstock With ICC Specification”

Appendix 2, “DoD Cardstock with ICC Layout”

Appendix 3, “ALT Token”

Appendix 4, “SST Token”

Appendix 5, “DoD Smart Card Cardstock With No ICC Specification”

Appendix 6, “DoD Cardstock with No ICC Layout”

Appendix 7, “DoD PIR Part 1_Part 2”

4.1.4. Prior to award, the contractor shall provide the Government information regarding their suppliers and locations for all components used in the construction of the cardstock proposed for the

Common Access Card via a Suppliers and Locations Report. All cardstock vendors manufacturing facilities must be located within the continental United States (CONUS). The report includes card body layers, chip manufacturer, module supplier, etc.

4.1.5. The contractor shall provide a Cardstock Risk Mitigation Plan prior to BPA award for alleviating any potential risks that may affect performance. The plan shall, in addition to other risk mitigation actions, address:

a. Having only one card manufacturer for the program;

b. A card manufacturer’s inability to deliver the monthly quantity required;

c. A card manufacturer inability to obtain raw materials for the card;

d. Catastrophic loss of card manufacturer card production facilities;

e. A newer card product is marketed that performs better than what was previously available;

f. The DoD requirement for space or functionality of the card changes (new technology);

g. Future sunset date of current smart card certification such as FIPS 140-2 and FIPS 201; and

h. The plan to achieve FIPS 140-2 certification on uncertified or new products.

4.1.6. The contractor shall provide Card Vendor Status Reports on a weekly basis for any open orders.

For each card vendor, the report shall include the following: the card order status; shipping schedules;

inventory by Batch Order Description (BOD); inventory by Batch Delivery Description (quantity available in vault); planned/future activities; and any critical issues that may impact scope, cost, or schedule.

4.1.7. The contractor shall provide an Order Schedule Summary monthly for any open orders. For cardstock, the contractor shall provide a summary of all card orders, by vendor, to include: a list of batch order numbers; number of cards for each batch; estimated and vault delivery date for each batch; number of cards delivered to the vault for that batch; and the corresponding invoice number and date for each batch of cards. The contractor shall also provide a list of pending Shipping Order Descriptions (SOD) that cannot be processed due to missing data such as POC, phone, and shipping address.

4.1.8. The contractor shall provide the warranty information for all cardstock provided. Any defective cards identified by the government or third party shall be replaced within 30 days at no additional cost to the government.

4.2. MIDDLEWARE

4.2.1. All middleware products must be FIPS 201 certified and GSC-IS 2.1 compatible.

4.2.2. DoD requires middleware products that conform to the requirements outlined in Appendix 8, “DoD Smart Card Middleware Requirements”

4.2.3. The Contractor shall provide smartcard middleware to interface with the DoD CAC credentials and Alternate Logical Access tokens in support of PKI-based client authentication, digital signatures, and encryption which will require product licenses. Licenses shall be authorized for use by an individual at any workstation or location they need to conduct work associated with government activities. Each license shall include, at no additional cost, at least one year of maintenance and vendor support.

4.2.4. The Contractor shall provide upgrades of existing DoD middleware licenses to the most current version of the product licenses being offered with at least one (1) year of maintenance support.

Licenses shall be portable and based on a per person model.

4.2.5. The Contractor shall provide extended middleware maintenance and vendor support for current licenses.

4.2.6. The DoD has an existing installation base of middleware products that shall be maintained.

The contractor shall provide, as a minimum, product licenses to support DoD’s existing installed base and is encouraged to quote other available products that meet the identified requirements in Appendix

8, “DoD Smart Card Middleware Requirements”, are FIPS 201 certified, and GSC-IS 2.1 compatible.

4.2.7. The contractor shall provide a summary of active middleware orders in the monthly Order

Schedule Summary that includes the number of units ordered per batch; the required and estimated delivery dates; the vendor shipment date and the number of units shipped; the actual received date and number of units received; who the order is for; the period of performance of the middleware; and the corresponding invoice number and date for each shipment.

4.2.8. The contractor shall provide a Middleware Letter within 15 days of each order to the agency purchasing the license/renewal indicating the number of middleware licenses and period of performance for each order.

4.3. ELECTROMAGNETIC OPAQUE SLEEVES (EMS)

4.3.1. The contractor shall provide EMS - Wallet Sized that protect CACs from unattended and unauthorized interrogation in all foreseeable environments and specified distances from the CAC. The

Government will provide personnel EMS at the time of card issuance from the Real-Time Automated

Personnel Identification System (RAPIDS) or Alternate Tokens Issuance and Managements System

(ATIMS) sites.

4.3.2. The contractor shall provide EMS – Hardened Badge Holders that protect CACs from unattended and unauthorized interrogation in all foreseeable environments and specified distances from the CAC.

4.3.3. The following requirements apply to the electromagnetic opaque sleeves:

Appendix 9, “EMS Requirements (Form Factor A – Wallet-Sized)”

Appendix 10, “EMS Requirements (Hardened Badgeholder)”

4.3.4 The contractor shall provide the summary of active EMS orders, with estimated delivery dates, and corresponding invoice numbers in the monthly Order Schedule Summary.

4.4. CARDSTOCK PROGRAM LOGISTICAL SUPPORT

The contractor shall track and process all cardstock and consumables shipments. The contractor is responsible for procuring all necessary shipping materials. The DMDC will provide the contractor with shipping carrier(s) account information to utilize for creating shipping labels and paying for postage. The contractor is responsible for managing all tracking numbers, shipping method, site name, RAPIDS Site

ID, shipment contents, shipment date, and cost of shipment for all outgoing cardstock and/or consumables. The contactor shall comply with all local Customs requirements, particularly OCONUS, for shipping of cardstock, tokens and consumables. OCONUS shipments include APO, FPO, etc. The contractor shall provide the cumulative shipping data for the fiscal year electronically on a weekly basis.

The contractor shall use the weekly information to update the monthly tab in Appendix 11, “Shipping

Report”, along with the required consumables at the same time per government’s instructions. The contractor shall track all shipments through the Inventory Logistics System (ILS), which is an automated tool to track cardstock and consumables inventory and shipments. The contractor shall use Appendix 12, “CAC and Consumables Inventory Report” for the weekly report of the current inventory on hand and the weekly shipments of cardstock and consumables. The contractor personnel must be eligible to obtain a CAC. The CAC is required to access the ILS. The government will furnish the contractor with dual card readers (contact and contactless) readers to use with their own (contractor) computers to enter the information into the ILS. The contractor will be provided a dedicated email group that shall be monitored between the hours of 8:00AM and 5:00PM EST. The number of shipments per year is approximately

20,000.

4.4.1. Storage Facility

a. The contractor shall provide a storage facility that is ISO 9001-2015 certified. The estimated facility size to support this requirement is approximately 2000 - 2500 sq. feet in size. The facility must be located within the continental United States (CONUS).

b. Cardstock and consumables must be in a locked area and only available to cleared personnel.

c. The contractor shall utilize the First In, First Out (FIFO) distribution method in order to avoid shelf-life expiration unless otherwise requested by the Government. For planning purposes, the consumables and cardstock materials require well-ventilated storage areas to comply with Occupational Safety and Health

Administration (OSHA) standards. The contractor shall reimburse the government for any cardstock and consumables that are damaged or expired as a result of non-compliance with OSHA standards and

DMDC FIFO requirements.

4.4.2. Consumables

a. The government will provide the consumables used in card production to the contractor. Examples of printer consumables could be color ribbon, front and back laminate, retransfer film, test cardstock and cleaning kits.

b. The contractor shall coordinate with the Government to determine the minimum inventory required to maintain sufficient supply of daily orders.

c. The contractor shall notify the Government 30 days prior to when the minimum threshold is expected to be reached and order additional consumables to maintain sufficient supply to support the daily orders.

d. The contractor shall provide distribution and storage for consumables. Supply orders are submitted from the RAPIDS sites to the contractor.

e. The contractor shall log all boxes shipped using Appendix 11, “Shipping Report”.

f. The contractor shall propose a Returned Shipments Risk Mitigation Plan with their proposal and update during the period of performance in coordination with the Government. In the case that any consumables are returned to the contractor in error, the contractor shall follow the approved Returned Shipments Risk

Mitigation Plan.

4.4.3. Recurring and Emergency Order Shipments of Cardstock and Consumables

a. The government provides the contractor with directions for shipment releases. Refer to Appendix

13, “ILS User Guide”, sections 11.1 and 11.2. The contractor shall then package the individual site's re-supply of cardstock and/or consumables for shipment and capture the associated shipment tracking data. Cardstock is packaged in “stacks” of 100 cards each.

b. For recurring cardstock shipments, the Contractor shall process shipments of cardstock to

RAPIDS sites as directed by the government. Cardstock releases in support of DMDC’s cardstock program are routinely processed directly by the card manufacturers from their vaults.

Recurring automated cardstock orders are generated via the ILS and are to be delivered to the site within 10 business days from date of generation. The contractor shall email the order return files

(known as Shipping Delivery Descriptor or SDD) to DMDC within 24 hours of the order being shipped.

c. For recurring consumables shipments, consumable requests received before 2:00PM EST will be shipped the same day. Requests received after 2:00PM EST will be shipped the next business day. All consumable requests will be delivered within 3 business days.

d. Emergency requests for cardstock and/or consumables re-supply are received via e-mail and shall be shipped and delivered within 1 business day from date of request. Emergency requests received before 2:00PM EST will be shipped the same day. Requests received after 2:00PM EST will be shipped the next business day. The contractor shall confirm receipt of emergency requests to the customer within 30 minutes for all requests received before 3:00PM EST. Otherwise, confirmation of receipt shall be provided the next business day. The contractor shall track cardstock and token by card type, card vendor, and stack identification (ID) number via the ILS.

The contractor shall link the appropriate cardstock and/or consumables in the ILS NLT 10:00AM

EST the following business day.

4.4.4. Receiving Returned Cardstock

a. The contractor shall receive all returned cardstock. For all returned cardstock requests, the contractor shall provide the site a shipping label for the shipment to be returned. All sites are provided with instructions for card and token returns. Sponsors and dependents receiving USIDs via the GPO on-line USID service will receive instructions to mail their replaced card to the contractor. Consumable disposal is the sites responsibility in accordance with local procedures.

RAPIDS sites are instructed to return all CAC and USID cardstock that are used, expired, replaced or encountered production issues to the contractor’s location. The Government cannot provide a definitive number for pallets shipped. The contractor shall provide pallets, as needed, for the returned cards. The Government anticipates an average of 150,000 CAC cards are returned and processed each month. The volume of USID returns per month is anticipated to be

100,000, but is still unknown as this is a newly released card type. The Government anticipates an average of 6,000 ALT Tokens are to be returned and processed each month.

b. For all returned CAC/USID/ALT cardstock, the contractor shall:

i Provide the site requesting to return cards, a shipping label via email.

ii Capture tracking numbers, Site name, Site ID, Shipment Date, Receipt Date, and quantity received.

iii This information shall be provided in Appendix 11, “Shipping Report”. The contractor shall report any sites that are non-compliant with the required packaging to the COR immediately.

iv Inspect all returned boxes to determine whether they were double-packaged when mailed to DMDC, as required by the Privacy Act of 1974. The contractor shall notify the COR of any non-compliance with this requirement within 48 hours.

v Sort all returned smart cards based on failure reason/code.

vi Using a government furnished reader, the contractor shall scan all returned cards (hand-entering when damage prevents scanning) to record the Card Unique Identifier/Card

Identification Number (CUID/CIN) and the error code from the sorted cardstock. The contractor shall submit the scanned return files to the Government monthly.

vii Track and report the number of returned cards received and the number of returned cards processed each month using Appendix 11, “Shipping Report”, which is to be updated in the monthly report.

viii The contractor shall perform all requirements under Section 4.4.4 within 30 days of receipt of cardstock returns to the contractor.

4.4.5. Shipping of Returned Cardstock

a. The contractor shall ship all returned cardstock to the National Security Agency’s (NSA)

Classified Material Conversion (CMC). The contractor shall follow the provided procedures to return cardstock for proper destruction as required to adequately support the cardstock program and use shipping return process outlined in Appendix 14, “Cardstock Return Card Overview” and Appendix 15, “Cardstock Return Instructions”. The contractor shall not deviate from the

NSA instructions as that poses a significant risk to continuance of NSA’s cardstock destruction support. The Contractor shall ensure the first package includes a large envelope or box with a

Privacy Act Data Cover Sheet, which identifies the cardstock as containing Personally

Identifiable Information (PII) data. The second outer package shall be a box from a third-party courier or from your site that has the words “For Official Government Use Only” stated on it.

The first package shall be inserted into the second outer package for return shipment. Shipments to NSA are every month. However, certain error code cards will require a monthly shipment to the third-party vendor for further analysis per the Government’s instructions.

b. The contractor shall provide the crates, pallets, and supplies for shipping returned cardstock to NSA. The contractor shall follow the instructions for shipping returned cardstock for destruction as outlined in

Appendix 14, “Cardstock Return Card Overview” and Appendix 15, “Cardstock Return Instructions”.

c. In addition, the contractor shall procure basic shipping supplies to include mostly branded supplies such as boxes, label pouches, customs forms, etc.

d. The government will provide instructions for shipments to the contractor upon award. The contractor will send to designated third party for analysis or destruction. The Contractor shall ensure all required documents are included with shipping. All shipments must include a DD

Form 2923, Privacy Act Data Cover Sheet. Third party documentation requirements for shipping may vary. The Government will provide complete instructions/guidance. An example of a current requirement is that a document listing the contents must be included for each shipment of cards sent for destruction/analysis. In another example, the documentation requires the inclusion of a self-addressed envelope for validation of receipt.

e. The contractor shall inspect the outer box to ensure that it is in good condition and can be properly sealed and ensure that the box chosen for shipping can withstand the weight of the cardstock and will not break when in transit. If a box breaks or opens in transit, Privacy Act data contained on the returned ID cards is at risk of being exposed. The Contractor shall complete

Appendix 16, “CMC Procedures”, when processing each shipment of the returned cards to NSA.

The Contractor shall verify and complete Appendix 17, “CMC Destruction Receipt”, from NSA

Website https://www.nsa.gov/Portals/70/documents/news-features/initiatives/classified-materiel-conversion/cmc_receipt.pdf?ver=2018-08-07-110456-643 to ensure it is still a valid form, then complete the form for each shipment to NSA.

f. The Contractor shall complete the annual NSA Contractor Approval Form Appendix 18, “Destruction of Classified Material at NSA_CMC Facility”. The contractor shall forward the completed paperwork/form to the COR for review and signature. Once signed, the contractor shall submit the completed paperwork/form to NSA.

g. In addition to shipments to NSA, the Contractor shall ship returned cardstock to third party for analysis upon Government request.

h. The contractor shall not receive SSTs. If received, the contractor shall immediately notify the

Government, COR, and ALT Token Cardstock Manager for action.

4.5 BPA MANAGEMENT

4.5.1 The contractor shall plan, execute, and manage the work described in this PWS, employing DoD and

DMDC policies, procedures, standards, guidelines, and industry best practices for project and program management; to include standards and methodologies published by the Project Management Institute (PMI) or other equivalent industry practices.

4.5.2 The contractor shall provide a monthly Senior Management Review (SMR) Report using Appendix 19, “SMR Template”, for required content and format. The required content and format are subject to change.

Contractor shall participate in a monthly SMR meeting and may change to quarterly when requested by the government. The Contractor shall prepare an agenda and meeting summary in a clear, concise and orderly manner.

Briefing materials shall be made available to all attendees prior to time of briefing. There will be no travel required. The monthly SMR will be electronic. The purpose of the SMR is to provide monthly program review and any issues requiring government escalation. The SMR shall include General Observations and Process

Improvement Plans for any issues and/or concerns identified during performance.

4.5.3 The contractor shall be responsible for bringing to the attention of the COR any problems or potential problems in performing assigned tasks. Subsequent to verbal notification, a written Problem Notification Report

(PNR) shall be submitted to the COR, with a copy to the DMDC Program Manager (PM), within three (3) calendar days of the contractor encountering a problem or risk event that impacts the cost, schedule, or performance of the

BPA (or any deliverable or project under an order). All PNRs shall be tracked in the MSR and through in-progress reviews (IPRs) until the Government agrees they are resolved. The PNR shall include, but not be limited to, the following:

• Nature and sources of problem

• COR was verbally notified on: (date)

• Is action required by the Government? Yes or No

• If YES, describe Government action required and date required https://www.nsa.gov/Portals/70/documents/news-features/initiatives/classified-materiel-conversion/cmc_receipt.pdf?ver=2018-08-07-110456-643 https://www.nsa.gov/Portals/70/documents/news-features/initiatives/classified-materiel-conversion/cmc_receipt.pdf?ver=2018-08-07-110456-643

• Will problem impact delivery schedule? Yes or No

• If YES, identify what deliverables will be affected and extent of delay

• Can required delivery be brought back on schedule? Yes or No

• If NO, identify the effect on the schedule and recommend opportunities to reduce said impacts

• Describe corrective action needed to resolve problems

• When will corrective action be completed?

4.5.4 Conduct a Post-Award Conference. This meeting shall provide an introduction between the Contractor personnel and Government personnel who will be involved with the BPA. The meeting shall provide the opportunity to discuss technical, management and security issues. The Post Award Conference will aid both the

Government and Contractor in achieving a clear and mutual understanding of all requirements and identify and resolve any potential issues. The Contractor shall be prepared to discuss any items requiring clarification and gather information as necessary to support each deliverable. The Contractor shall provide a written summary of the Post-Award Conference.

4.6 TRANSITION IN

A smooth transition between the incumbent contractor(s) and the successor contractor(s) is necessary to ensure there is no disruption to vital Government business. The contractor shall cooperate fully in the transition. There will be a thirty (30) day transition period for a new contractor.

During this 30-day period, the awardee contractor will be responsible for:

• Attending kick-off meeting with Government POCs

• Ordering shipping supplies

• Obtaining necessary CAC for employees

• Outreach to NSA to obtain contract information in order to be prepared for shipments of returned cards for final disposition

• Preparing facility with inventory received from the Government

• Preparing annual NSA Contractor Approval Form for the Destruction of Classified Material at NSA/CMC facility (Attachment 16) for DMDC to review and sign for NSA returns

• Conduct services required to connect to Government network with contractor’s computer/s.

• Conduct inventory of all Government furnished equipment, supplies and consumables.

The government will be responsible for transferring all inventory and card readers, and supplying any inventory of packaging supplies to the contractor during this transition period.

A joint inventory will be agreed upon between the contractor and the government.

All transition activities can be coordinated with the COR and the COR will be responsible for providing any information needed by the contractor to have successful transition.

4.7 TRANSITION OUT

The contractor shall submit a transition plan within 60 days prior to end of final performance period, addressing the following, at a minimum:

• Transition of the DMDC initiatives to ensure a smooth transition from performance;

• Proposed sequence of transition tasks, which should be accomplished to progress from start of transition to successor contractor control of tasks, as specified in the PWS;

• Maintaining DMDC schedule, specifically transition of existing, on-going efforts and concurrently working with the successor contractor on existing efforts;

• Proposed process for GFE/GFP/GFI transfer to the government;

• Identification of associated risks and issues;

• Problems anticipated;

• Risk mitigation strategies to address any risk issues;

• Additional resources, if any, required for the transition;

• Plan as to how the transition will be implemented and managed;

• Past experiences in transitioning projects comparable in scope, size and complexity;

• Transition planning for order close-out; and

• Joint inventory.

5.0 DELIVERABLES

Reports, documents, and narrative type deliverables will be accepted when all discrepancies, errors, or other deficiencies identified in writing by the Government have been corrected. The contractor shall submit deliverables to the COR or his or her designee. The COR will serve as DMDC’s focal point for accepting the deliverables. The general quality measures, set forth below, will be applied to each deliverable received from the contractor.

• Accuracy – Deliverables shall be accurate in presentation, technical content, and adherence to accepted elements of style.

• Clarity – Deliverables shall be clear and concise; engineering terms shall be used, as appropriate. All diagrams shall be easy to understand, legible, and relevant to the supporting narrative. All acronyms shall be clearly and fully specified upon first use.

• Specifications Validity – All Deliverables must satisfy the requirements of the Government.

• File Editing – Where directed, all text and diagrammatic files shall be editable by the Government.

• Format – Deliverables shall follow DMDC guidance. Where none exists, the Contractor shall coordinate approval of format with the COTR.

• Timeliness – Deliverables shall be submitted on or before the due date specified.

The Government will provide written acceptance, comments and/or change requests, if any, within fifteen (15) work days from Government receipt of the draft deliverable. The work products and reports shall be delivered in accordance with dates listed in the following table:

Deliverable Reference Due date/Frequency

Post-Award Conference PWS 4.5.4 Within 5 days after BPA award

Suppliers and Locations Report

PWS 4.1.4

15 days after BPA award

Cardstock Risk Mitigation Plan PWS 4.1.5 30 days after BPA award

Card Vendor Status Report PWS 4.1.6 Weekly with active orders

Order Schedule Summary PWS 4.1.7, 4.2.6, 4.3.4 Monthly with active orders

Middleware Letter PWS 4.2.7 15 days after each order

Shipping Report PWS 4.4, 4.4.2.d, 4.4.4.b.iii, 4.4.4.b.vii

Weekly and Monthly

Returned Shipments Risk Mitigation Plan

PWS 4.4.2.e Draft due with proposal and updated as necessary

Scanned Return Files PWS 4.4.4.b.v Within 5 business days following the previous month

Senior Management Review (SMR) PWS 4.5.2 Within 5 business days following the previous month

SMR Minutes PWS 4.5.2 Within 5 business days following the SMR meeting

Problem Notification Report (PNR) PWS 4.5.3 3 days after identification of problem

Transition In Plan PWS 4.6 Within 30 days of transition announcement by the Government

Transition Out Plan PWS 4.7 Within 60 days of transition announcement by the Government

Quality Control Plan PWS 5.1 Draft submitted 15 days after award and final 30 days after award.

The plan can be updated as necessary during performance.

Non-Disclosure Agreements PWS 12.0 Prior to any contractor personnel reporting for work

CAC Status Report PWS 17.10.10 Monthly

5.1 QUALITY CONTROL PLAN (QCP)

5.1.1 Establish a quality element that ensures compliance with applicable Federal mandates, contractual performance standards, and industry best practices. Consider as part of its Quality Control Plan (QCP) a number of standard approaches toward quality such as the International Standards Organization (ISO) and Systems

Engineering Institute/Capability Maturity Model (SEI/CMM) processes.

5.1.2 Maintain a thorough quality control program with the aim of identifying and correcting deficiencies in the quality of services before performance becomes unacceptable. Develop a Quality Control Plan (QCP) that describes the Contractor’s procedures for monitoring performance. The COR will notify the Contractor, in writing, of deficiencies in the plan and allow 5 working days for a revision to be submitted.

5.1.2.1 Quality Status Reports (QSRs) shall be generated on a monthly basis. Details of audits and inspections accomplished, significant deficiencies noted, trend analysis of order performance and current status of all issues yet to be resolved. QSRs shall be distributed to the contractor's program management and Government representatives concurrently. At a minimum, the QSRs must include metrics, which verify whether the performance standards in the PWS have been met.

5.1.2.2 The quality control function shall ensure that timely and effective corrective action is obtained for all deficiencies identified by the Government.

5.1.2.3 The contractor may be required to conduct special inspections at the contracting officer's representative written request. Results of the inspection or audit shall be provided, in writing, in a timely manner as determined by the COR.

5.1.2.4 Develop the QCP based on accepted industry standards and detail the processes, procedures, and metrics for assuring quality. The QCP shall also include establishment of capable processes; monitoring and control of critical processes and product variation; establishment of mechanisms for feedback of field performance.

6.0 PERFORMANCE STANDARDS

The incentive for achieving the Acceptable Quality Levels (AQLs) listed in the table below is a positive past performance evaluation, it should be understood that failure to meet the performance metrics below will result in negative past performance evaluations. Past Performance Evaluations will be submitted to the Contractor

Performance Assessment Reporting System (CPARS) for all government agencies to review. Past Performance

Evaluations will contain detailed narratives explaining reasons for positive and negative assessments. The following are the specific performance standards for this PWS.

Performance Standard Acceptable Quality Level

(AQL)

Method of Surveillance

Delivery and shipment dates are met, or exceeded

99% are submitted on time 100% Inspection

Deliverables are complete and accurate 95% correct the first time submitted

100% Inspection

Notification of problems/issues (identified outside of periodic meetings with the Government)

Any problems or issues shall be submitted to the COR on a Problem Notification

Report within 3 business days of potential problem/issue identification

100% Inspection

Support Service Staffing:

Personnel possess necessary knowledge, skills, and abilities to perform tasks in accordance with the

PWS and the skill set of the labor category quoted and accepted at call order award

Satisfactory or higher

CPARS/COR

Observation/Customer assessments

Responsiveness

Responds to staff and acknowledges inquiry within one business day

99% of all inquiries are responded to within one business day

Direct Observation

7.0 QUALITY ASSURANCE

7.1 The Government reserves the right to perform inspections and surveillance to evaluate the

Contractor’s compliance to the contract terms and performance of the requirements in the PWS.

7.2 Contract Discrepancy Report (CDR). In the event of unsatisfactory contractor performance, the

COR or CO will issue a CDR that will explain the circumstances and findings concerning the incomplete or unsatisfactory service. The contractor shall acknowledge receipt of the CDR and respond in writing as to how he/she shall correct the unacceptable performance and avoid a recurrence.

The Government will review the contractor's corrective action response to determine acceptability and will use any completed CDR as part of an overall evaluation of Contractor performance when determining present or future contractual actions.

7.3 Customer Complaint Surveillance. This action is instituted when the COR receives a complaint from a stakeholder (stakeholder organizations include, but are not limited to, OUSD, P&R IM, DPRIS User

Agencies, Military Service Repository Owners, and DISA) regarding contractor service. The COR will obtain the complaint in writing and then conduct an investigation to determine its validity. If the complaint is deemed valid, the COR will immediately notify the Contracting Officer for action. The

COR will notify both the CO and the complainant of the Government’s response to their complaint.

8.0 INSPECTION AND ACCEPTANCE

8.1 All test cards will be inspected and accepted at locations designated by the COR.

8.2 All cards, other than test units, will be inspected and accepted at over 1800 locations worldwide designated by the COR. All products delivered will be insured by the supplier of the products and any products found to be defective or non-functional will be replaced (and delivered to designated locations) with an acceptable product within 30 days.

8.3 All EMS will be inspected and accepted at a central location to be identified by the COR. EMS may undergo extensive DoD testing to ensure compliance. On behalf of the Government, IV&V testing may be conducted by the government’s IV&V laboratory before Government acceptance.

8.4 All Middleware products may be tested for conformance to the DoD Middleware Requirements

Release 4.0. Any products determined to be non-conformant, deficient, or non-function will be replaced (and delivered to located designated) by an acceptable product within 15 days. DoD

Component POCs will receive and accept middleware products.

9.0 ORGANIZATIONAL CONFLICTS OF INTEREST (OCI)

Contractor and subcontractor personnel performing work under this contract may receive, have access to, or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.), or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in Federal Acquisition

Regulation (FAR) Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

10.0 DISCLOSURE OF INFORMATION

Information made available to the Contractor by the Government for the performance or administration of this effort shall be used only for those purposes and shall not be used in any other way without the written agreement of the Contracting Officer. The Contractor agrees to assume responsibility for protecting the confidentiality of

Government records, which are not public information. Each Contractor or employee of the Contractor to whom information may be made available or disclosed shall be notified in writing by the Contractor that such information may be disclosed only for a purpose and to the extent authorized herein.

11.0 CONTRACTOR INDENTIFICATION

All contract personnel working in situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. Electronic mail signature blocks shall identify contractor/company affiliation. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

All Contractor staff that have access to and use of the Government electronic mail (e-mail) shall identify themselves as contractors on all outgoing e-mail messages, including those that are sent in reply or are forwarded to another user. To best comply with this requirement, the contractor staff shall set up an e-mail signature

("AutoSignature") or an electronic business card ("V-card") on each contractor employee's computer system and/or

Personal Digital Assistant (PDA) that will automatically display "Contractor" in the signature area of all e-mails sent. All work performed shall be conducted using government provided email. Personal or company email shall not be used to perform government work.

12.0 NON-DISCLOSURE REQUIREMENTS

All contractor personnel (to include subcontractors, teaming partners, and consultants) who will be personally and substantially involved in the performance of the task order issued which requires the contractor to act on behalf of, or provide advice with respect to any phase of an agency procurement, as defined in FAR 3.104-4, shall execute and submit a “Contractor Non-Disclosure Agreement” Form. This is required prior to the commencement of any work on such task order and whenever replacement personnel are proposed under an ongoing task order. Any information obtained or provided in the performance of this contract is only to be used in the performance of the task order. The Contractor shall take the necessary steps in accordance with Government regulations to prevent disclosure of such information to any party outside the Government and to indoctrinate its personnel who have access to sensitive information and the relationship under which the Contractor has possession of or access to the information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information will be used for the profit of any party other than those furnishing the information. The Nondisclosure

Agreement for Contractor Employees shall be signed by all indoctrinated personnel and forwarded to the

Contracting Officer Representative (COR) for retention, prior to work commencing. The Contractor shall restrict access to sensitive/ proprietary information to the minimum number of employees necessary for contract/task

Order performance.

13.0 RECORDS/DATA

The Government will be sole owner of all technical data, software developed, and infrastructure designed under this project. The contractor shall deliver to DMDC all software, software licenses, data, form, fit and data first produced (including source code), written documents and reports to include, at a minimum, system change plans, various operations procedures and planning documents, meeting minutes, reports, manuals, training text, program management reviews, financial status reports, and any other documents created in support of this task order. All system documentation shall be updated to remain current with each software development activity/phase. The

Government will include the actual requirements, formats, delivery schedules and points of contact in each order.

DMDC will have unlimited rights as allocated under DFARS 252.227-7013 and DFARS 252.227-7014 in all data delivered under this BPA. The contractor shall submit deliverables to the COR or his or her designee. The COR will serve as DMDC’s focal point for accepting the deliverables unless an order provides for other procedures.

14.0 DATA RIGHTS

The Government requires unlimited rights in any material first produced in the performance of this task order, in accordance with the FAR clause at 52.217-14. In addition, for any material first produced in the performance of task order, the materials may be shared with other agencies or contractors during the period of performance of the task order, or after its termination. For any subcontractors or teaming partners, the Contractor shall ensure at proposal submission that the subcontractors and /or teaming partners are willing to provide the data rights required under the BPA.

15.0 LIMITED USE OF DATA

Performance of this effort may require the Contractor to access and use data and information proprietary to a

Government agency or Government Contractor which is of such a nature that its dissemination or use, other than in performance of this effort, would be adverse to the interests of the Government and/or others. Contractor and/or

Contractor personnel shall not divulge or release data or information developed or obtained in performance of this effort, until made public by the Government, except to authorize Government personnel or upon written approval of the CO. The Contractor shall not use, disclose, or reproduce proprietary data that bears a restrictive legend, other than as required in the performance of this effort. Nothing herein shall preclude the use of any data independently acquired by the Contractor without such limitations or prohibit an agreement at no cost to the

Government between the Contractor and the data owner which provides for greater rights to the Contractor.

16.0 ANNUAL SERVICE CONTRACT REPORTING (SCR)

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via SCR which has replaced the legacy Enterprise Contractor

Manpower Reporting Application (ECMRA). SCR is located in in the System for Award Management (SAM)

(https://sam.gov). Reporting inputs will be for the labor executed during the period of performance during each

Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, the reporting period for contractors in SAM is generally open from mid-October to mid-

December for reporting against the prior government fiscal year, all data shall be reported no later than October 31 of each calendar year, unless a later date is otherwise authorized by the Department of Defense.

17.0 SECURITY

Personnel performing on this PWS will not require access to classified information. This requirement is

Unclassified. The contractor shall provide personnel already vetted or able to undergo a background investigation

(BI) according to Department of Defense (DoD) regulations. The BI must meet or exceed the sensitivity designated by the Government.

17.1 Personnel Security. All Contractor personnel assigned to this contract are required to obtain and maintain the appropriate background investigation (BI) and adjudication or suitability determination in accordance with DODI 5200.02-DoD Personnel Security Program (PSP) and per individual’s job assignment that meets access requirements according to this BPA. This includes, but is not limed to those who, in order to perform the work specified under the contract, will require access to space, information, information technology systems, staff, or other assets of the Federal Government. Including, personnel requiring a DoD credential, also known as the Common Access Card (CAC) for physical and logical access to federally controlled facilities and or information systems (IS).

17.2 All personnel on this contract will be designated a Critical-Sensitive, or Non-Critical Sensitive position for

UNCLASSIFIED IT Level II or IT Level I access as determined by the Government per position responsibilities. The contractor shall assure that individuals assigned to the positions of this BPA, as determined by the Government, have completed the designated Tier BI or equivalent according to the

Defense Counterintelligence and Security Agency (DCSA) and The Office of Personnel Management

(OPM) investigative alignment.

17.2.1 Prior to requesting access to DHRA sponsored resources (e.g., DoD ID/CAC, Computer, Systems, email or facility), the appointed contractors will be expected to already have sufficient background that meets the contract requirements. At minimum the contractor shall obtain an interim eligibility from the Department of Defense (DoD) Consolidated Adjudications Facility (CAF) or interim IT-I/IT-II/IT-III Position of Trust eligibility sponsored by the DHRA-DEOC Security and approved by the Defense Logistics Agency (DLA)

Personnel Security (PERSEC). Eligible interim Position of Trust personnel expectations include, but are not limited to:

17.2.1.1 Contractor also known as the Applicant shall have completed all personnel security requirements as https://sam.gov/ specified by DHRA-DEOC Security and DLA PERSEC.

17.2.1.2 The interim sponsored contractors are expected to comply with all investigative and adjudicative requirements, which includes responsiveness to time-sensitive requests (e.g., interview(s), additional information or clarification) from the DLA PERSEC, investigator or the adjudicative agency (DoD

CAF).

17.2.1.3 Attained a favorable eligibility to the designated BI.

17.2.1.4 If at any time, any Contractor personnel are unable to obtain/maintain an adjudicated Tier BI, the

Contractor or Program Manager shall immediately notify the COR and coordinate removal of such a person from work under this contract.

17.2.2 Per Executive Order E.O 13488, Granting Reciprocity on Excepted Service and Federal Contractor

Employee Fitness and Reinvestigating Individuals in Positions of Public Trust. The DHRA-DEOC

Security and DLA PERSEC will use reciprocity to the extent possible and if necessary, will request re-adjudication by the DoD CAF to support the DoD standards. Reciprocity consideration includes verifying break in service longer than 24 months as a US Military, US Civilian or Contractor from the last favorable investigation.

17.2.3 The BI process for designated Contractor employees supporting this contract shall be initiated immediately after contract award and shall be completed prior to the end of the transition period. Submit a request and list of personnel for security investigation to the DoD Government Security Office point of contact(s) -to be provided by the COR- NLT five (5) business days after contract award.

17.2.4 Submit confirmation via contractor-generated email to the COR NLT five (5) business days after submission of the request and list of personnel to the Government Security Office.

17.2.5 It is the responsibility on the contractor to ensure their employees and sub-contractors (if applicable) comply with DHRA and DLA PERSEC Security requirements.

17.2.6 The contractor shall have personnel that are Citizens of the United Sates. All contractor/subcontractor personnel must be U.S Citizens. This includes personnel who bill the DoD Government for goods or services or that are assigned or working on the contract at any remote sites.

17.2.7 Contractor personnel with Tier background investigation who are assigned to perform work under this contract shall be suitable to obtain a DoD Credential, also known as the Common Access Card (CAC). The cost is borne by the Government. All CAC applicant must meet the minimum HSPD-12 security requirements with favorable FBI fingerprint check an open Tier BI, which meets job, functions or need-to-know for access.

17.2.8 Personnel assigned to perform work under this contract may require access to Government resources (e.g., websites requiring CAC, Public Key Infrastructure [PKI], local badges, Contractor CACs and facility specific identification badges). Personnel required to obtain a CAC may be issued GFE (e.g., computer/laptop, etc.).

17.2.9 Provide a list of all contractor personnel requiring entry to on-site staffed locations/installations to the

QAE and the COR NLT 60 calendar days prior to the service start date. List shall be submitted via contractor-generated email and include the…