Draft Performance Work Statement.pdf

Performance Work Statement Access Control System (ACS), Intrusion Detection System (IDS) Camera Maintenance

FOR

Defense Finance and Accounting Service Indianapolis, IN (DFAS-IN)

1 | P a g e

1.0 Introduction

This contract provides for maintenance and on-call service support for Closed-Circuit Television (CCTV), Intrusion Detection System (IDS), and Access Control System (ACS) at the Defense Finance and Accounting Service-Indianapolis, IN (DFAS-IN). Services include routine maintenance, troubleshooting, repair, system administration, and installation and /or removal of equipment as directed by the Government.

2.0 Scope

The Contractor shall furnish all labor, supervision, tools, materials, equipment, hardware, software, and field devices necessary to ensure a DFAS-IN Access Control System (ACS) and Intrusion Detection System (IDS) remain fully operational and properly installed.

2.1 Access Control System (ACS)

The ACS includes:

• LENEL System Administration

• Alarm Monitoring

• Video viewer support

• Automatic door openers.

2.2 Intrusion Detection System (IDS)

The IDS includes DMP and Bosch system panels and associated components.

The IDS Protected Areas:

1. Client Systems 1 Alarm: UL Required

2. Client Systems 2 Alarm: UL Required

3. Agency Force Protection: No UL

4. Force Protection Operations Center: No UL

5. The Office of Preparedness: No UL

6. Client Systems 2 Server Room: No UL

7. Disbursing Vault: No UL

8. Room 139V: No UL

2.3 System Components and Estimated Quantities: The IDS and ACS currently include the following approximate quantities and equipment that may require maintenance under this contract:

• 140-180 card readers (including anticipated expansion for future construction areas)

• 114-150 IP cameras (including parapet cameras and potential future installations)

• Axis camera models including: P3354, P3719, P3364, P3367-5MP, Q3819-PVE, M3045, P5624-

E

• Bosch and DMP panels and expansion modules

• Power supplies

• Door contacts (standard and high security),

• Motion detectors

• Cabinet tamper switches

2 | P a g e

• Phone line modules

• Internet modules

Quantities are estimates and may fluctuate based on operational needs and facility expansion.

3.0 Place of Performance

Defense Finance and Accounting Service-Indianapolis 8899 East 56th Street Indianapolis, IN 46249.

The Contractor shall perform work only in areas designated and approved by the Contracting Officer Representative (COR).

Smoking and tobacco use is prohibited in all Federal facilities and government owned vehicles. Tobacco products include cigarettes, cigars, cigarillos, smokeless tobacco, electronic cigarettes, inhaled tobacco, all new and emergent tobacco products, as well as all other tobacco products designed for human consumption. Smoking and tobacco use is only permitted in designated smoking areas which are clearly marked.

4.0 Period of Performance

The contract shall consist of a one (1) year base period beginning on the date of award and four (4) one-year option periods. The total period of performance, including all option periods, shall not exceed five

(5) years.

5.0 Hours of Operation and Recognized Holidays

Days and Hours of Operation: Normal hours of operation at DFAS-IN are Monday through Friday, 7:00 am to 5:00 pm. There may be occasions requiring extended work hours for contractor personnel. Any extended work hours must be coordinated with and approved by the COR.

DFAS-IN shall close when the Federal Government announces closure over local radio and television stations due to unusually severe weather or other unforeseen conditions. When unforeseen closure of the facility occurs on a regularly scheduled day of work, the contractor personnel shall reschedule the work on any day satisfactory to both parties.

No work shall be performed on all Federal holidays observed at DFAS-IN. A full list of Federal Holidays can be viewed at: https://www.opm.gov/policy-data-oversight/pay-leave/federal

6.0 Contractor Requirements

6.1 Telephone Consultation: DFAS-IN will initiate all requests for repair and technical assistance. The Contractor shall respond to all service calls within four (4) hours of notification, 24 hours per day, seven

(7) days per week, 365 days a year. If the issue cannot be resolved through telephone consultation, the COR will determine whether the situation constitutes an Emergency.

https://www.opm.gov/policy-data-oversight/pay-leave/federal

3 | P a g e

6.2 In-Person Emergency Repair/Service

6.2.1 Emergency Response: The Contractor shall provide a qualified technician trained to repair the DFAS-IN ACS and IDS within four (4) hours for critical assets and within 24 hours of DFAS Notification for non-critical assets; 24 hours per day, seven (7) days per week, including federal holidays, when the COR determines the situation to be an Emergency.

DFAS Notification is defined as any condition requiring immediate corrective action to:

• Eliminate risk of injury or threat to personnel

• Prevent damage to Government property

• Maintain the security and integrity of DFAS-IN assets

The COR will determine whether a condition qualifies as an Emergency and will notify the Contractor accordingly.

6.2.2 Personnel and Equipment: the Contractor shall provide, at no additional cost to the Government, all personnel, supervision, parts, materials, tools, equipment s and services necessary to perform required repairs and maintenance of the DFAS-IN ACS and IDS.

All required support, including outside services (e.g., electrician, lift equipment, specialty equipment), shall be provided at the Contractor’s expense unless otherwise authorized by the Contracting Officer. The Contractor shall provide sufficient advance notice to DFAS if coordination of facility support is required prior to dispatching a technician.

6.2.3 Completion Timeline: emergency repairs shall be completed within twenty-four (24) hours of being reported having the assets to do the repairs for critical assets, and within 48 hours for non-critical assets, including weekends and federal holidays, unless otherwise authorized by the COR.

6.2.4 Testing and Verification: upon completion of repairs, the Contractor shall test the affected system to ensure full operational capability prior to considering the repair complete. Testing shall be conducted in the presence of DFAS-IN Security Officials. A DFAS-IN Security Official will verify and validate system functionality.

6.2.5 Work Authorization and Documentation: the COR will issue a work request for service. The Contractor shall ensure the assigned work order number is referenced on all documentation, reports, and invoices associated with the completed work.

6.3 In-Person Non-Emergency Repair/Service

6.3.1 Response Time: the Contractor shall provide a qualified technician trained to service the DFAS-IN ACS and IDS within twenty-four (24) hours of DFAS Notification for non-emergency repairs, this is provided a certified technician is available.

DFAS Notification is defined as the original call placed for a telephone consultation. Non-emergency repairs shall be performed during normal business hours, as indicated in paragraph 5.0. If the 24-hour response period falls on a Saturday, Sunday, or Federal holiday, the Contractor shall report on the next business day following the initial Government notification.

4 | P a g e

6.3.2 Personnel and Equipment: the Contractor shall provide, at no additional cost to the Government, all personnel, supervision, parts, materials, tools, equipment, and services necessary to perform required repairs and maintenance of the DFAS-IN ACS and IDS.

All required support, including outside services (e.g., electrician, lift equipment, specialty equipment), shall be provided at the Contractor’s experience unless otherwise authorized by the Contracting Officer.

The Contractor shall provide sufficient advance notice to DFAS if coordination of facility support is required prior to dispatching a technician.

6.3.3 Completion Timeline: Non-Emergency Repairs shall be completed within five (5) business days of being reported, unless otherwise approved by the COR.

6.3.4 Testing and Verification: Upon completion of repairs, the Contractor shall test the affected system to ensure full operational capability prior to considering the repair complete. Testing shall be conducted in the presence of DFAS-IN Security Officials. A DFAS-IN Security Official will verify and validate system functionality.

6.3.5 Work Authorization and Documentation: The COR will issue a work request for service. The Contractor shall ensure the assigned work order number is referenced on all documentation, reports, and invoices associated with the completed work.

6.4 Equipment Installation/Removal Service

6.4.1 Installation and Removal: the Government may require installation and/or removal of equipment identified in Section 2.0. of this PWS. Requests may be initiated via telephone or written communication from the COR.

The Contractor shall install or remove the specified equipment within thirty (30) calendar days of Government notification, unless otherwise approved by the COR.

If required parts are not Government furnished, the Contractor shall submit a written quote within five (5) business days of notification. The quote shall include:

• Itemized parts pricing

• Estimated delivery date

• Estimated installation timeframe

Installation shall occur within thirty (30) calendar days of receipt of required parts.

6.4.2 Parts Responsibility and Cost Allocation: in accordance with Section 2.0, the Contactor is responsible for providing labor and associated hardware, software, field devices, and equipment necessary to maintain the DFAS-IN ACS and IDS in a fully operational condition.

Replacement parts required for routine maintenance and repair shall be provided by the Contactor. If the cost of replacement parts exceeds $5,000 in a single month, the Contractor shall submit a written quote within five (5) business days to the COR. The COR shall forward the request to the Contracting Officer for a scope determination. The Contractor shall not proceed with procurement or installation of such parts

5 | P a g e until written authorization is provided by the Contracting Officer. Any required contract modification will be executed in accordance with FAR 43.103.

6.4.3 Limitations on Scope System Expansions: this contract covers maintenance, repair, and replacement-in-kind of existing DFAS-IN ACS and IDS components. New system installations, capacity increases, or expansions of existing systems beyond replacement-in-kind are outside the scope of this contract and shall require separate procurement action or a contract modification issued by the Contracting Officer following a scope determination.

The Contractor shall not perform new installations, system expansions, or non-replacement upgrades without prior written authorization from the Contracting Officer.

6.4.4 Fiber Replacement: replacement of fiber modules, cabling, and similar components required to restore existing system functionality shall be considered replacement-in-kind. If replacement costs exceed $5,000 in a single month, the Contractor shall submit a quote to the COR for Contracting Officer review and scope determination and approval prior to procurement.

6.4.5 Network Video Recorders (NVRs): NVRs are not considered routine replacement parts. If NVR replacement is required, the Contractor shall submit a quote to the COR for Contracting Officer review and scope determination and approval prior to procurement.

7.0 Submittals

The Contractor shall submit the following reports and records to the contracts COR:

7.1 Test Reports: The Contractor shall submit written test reports documenting procedures performed and results obtained for all required field testing and inspections. Test reports shall be submitted within three (3) business days following completion of testing.

7.2 Manufacturer’s Field Reports: The Contractor shall submit Manufacturer’s Field Reports detailing:

• On-site activities performed

• Deficiencies identified

• Corrective actions taken

• Recommendations for follow-on action

Reports shall be submitted within three (3) business days following completion of service.

7.3 Service Records: The Contactor shall maintain service records in an automated database. Records shall be available for COR review during normal business hours. Upon request, the Contactor shall provide copies of all service actions, mark-ups, test documentation, and service reports withing three (3) business days.

All records generated under this contract are Government property and shall be turned over upon request or at contract completion.

6 | P a g e

8.0 System Equipment Requirements

8.1 ACS: The Contractor shall provide all labor, supervision, hardware, software, and equipment necessary to maintain the DFAS-IN ACS. The ACS includes, but is not limited to:

• Lenel OnGuard System Administration

• Alarm Monitoring

• Video Viewer

• Approximately 98 automatic door openers

• System hardware including:

o 7 CPUs o 1 Server o 1 badge printer o Approximately 120-180 card readers o Door hardware (electrified mortise cylinders, panic devices, strikes) o Power supplies o Electric power transfer devices o Door contracts and sensors o 3-8 Network Video Recorders (NVRs) o 114-150 IP Cameras (including parapet cameras) o Associated wiring and related video equipment.

The Contractor shall maintain all wiring associated with the ACS.

8.2 IDS: The Contractor shall provide all labor, supervision, hardware, software, and equipment necessary to maintain the DFAS-IN IDS. The IDS includes, but are not limited to:

• Bosch and DMP panels

• Expansion modules

• Power supplies

• Standard and high-security door contacts

• Motion detectors

• Cabinet tamper switches

• Phone line modules

• Associated wiring and related hardware

The Contractor shall maintain all wiring associated with the IDS.

8.3 Quality Assurance and Surveillance Plan (QASP): The Government will monitor Contractor performance in accordance with the QASP. Performance standards and acceptable quality levels (AQLs) are defined in the Performance Requirements Summary (PRS), located in Section 9.5 of this PWS.

8.4 Monthly Up-time Report: The Contractor shall submit a Monthly Uptime Report for each standalone system. The report shall calculate system availability based on:

• Total minutes the system was expected to operational during the reporting month

• Total minutes the system was actually operational

Allowable repair time per incident shall be deducted as follows:

• Emergency Repair: 24 hours per incident

7 | P a g e

• In-Person Non-Emergency Repair: 50 hours per incident (5 business days at 10 hours per day) The lesser of the allowable repair time or actual repair time shall be applied in the calculation.

9.0 Qualifications

9.1 Technical Knowledge: the Contactor shall possess demonstrated working knowledge of Lenel OnGuard software applications.

9.2 Certifications: The Contractor shall maintain and submit annual proof of LENEL/On-Guard Certifications for personnel supporting this contract.

9.3 Authorized Reseller Status: the contractor shall maintain status as a LENEL Value Added Reseller (VAR) and shall submit annual proof of current VAR authorization.

9.4 Bosch and DMP System Qualifications: the Contractor shall possess and demonstrate a working knowledge of the Bosch and DMP IDS panels and associated devices to support full system operation as DFAS-IN. The Contractor shall maintain authorized reseller status for both Bosch and DMP products.

Annual proof of current reseller authorization shall be submitted to the COR.

The Contractor shall:

1. Maintain current authorized reseller status for Bosch and DMP products.

2. Employ technicians assigned to this contract who hold current manufacturer certifications specific to Bosch and DMP IDS panels and associated system components.

3. Ensure technicians have a minimum of three (3) years of documented experience servicing commercial or Government intrusion detection systems of similar size and complexity.

Annual proof of current reseller authorization and technician certifications shall be submitted to the COR.

Updated documentation shall be provided within five (5) business days of any certification expiration or personnel change.

Failure to maintain required reseller status or technician certifications may result in removal of affected personnel from contact performance and may constitute grounds for contract remedies in accordance with the applicable contract clauses.

9.5 Performance Requirements Summary Standards:

Performance Objective Performance Standard

Acceptable Quality Level (AQL)

Surveillance Method

Telephone Response Respond within 2 hours of DFAS Notification, 24/7/365

100% COR review of call logs

Emergency On-Site Response

Technician onsite within 4 hours of Emergency determination

100% COR verification of dispatch records

Emergency Repair Completion

Completed within 24 hours of report

95% monthly COR review of work orders

8 | P a g e

Non-Emergency On-Site Response

Onsite within 24 hours (next business day if applicable)

95% monthly COR review of service logs

Non-Emergency Repair Completion

Completed within 5 business days

95% monthly COR review of work orders

System Testing & Verification

Systems tested and verified prior to closeout

100% COR witnessing or documentation review

Service Documentation Submission

Reports submitted within 3 business days

95% monthly COR tracking log

Service Record Maintenance

Records provided within 3 business days of request

100% COR review

Monthly Uptime Report Submitted by 5th business day of following month

100% COR review

System Availability (Uptime)

Maintain ≥ 98% monthly uptime per standalone system

98% minimum Government calculation using submitted data

Lenel Certification Compliance

Annual proof of certification submitted and current

100% COR document review

VAR Status Compliance Maintain current Lenel VAR status annually

100% COR verification

Bosch & DMP Reseller Status

Maintain current authorized Bosch and DMP reseller status throughout contract performance

100% Annual documentation review by COR

Bosch & DMP Technician Certification

All technicians assigned to IDS work maintain current manufacturer certifications

100% COR review of certification documentation prior to performance and annually

Bosch & DMP Experience Requirement

Assigned technicians possess minimum three (3) years of documented IDS experience

100% Resume and qualification review by COR at onboarding

Certification Maintenance & Updates

Updated certification documentation submitted within 5 business days of expiration or personnel change

100% COR tracking log

9 | P a g e

9.6 Invoice Submissions: Contractors shall comply with the Wide Area Workflow (WAWF) electronic invoice system when submitting invoices for payment. All invoices and receiving reports must be submitted electronically through the WAWF in accordance with the DFARS 252.232-7006, WAWF Payment Instructions. The Contractor shall ensure that all required data fields are completed accurately, and that appropriate supporting document is attached. Failure to comply with WAWF submission requirements may result in payment delays. Specific WAWF instructions, including document types and routing codes, will be provided by the CO or designated representative at the time of the award.

9.6.1 Inspection/Acceptance: The COR is designated as the Governments representative for final inspection and acceptance of services performed under this contract. All services are subject to inspection to ensure compliance with contract requirements prior to acceptance.

9.7 Contracting Officer Representative (COR): A COR will be appointed in writing by the Contracting Officer to provide technical oversight and contact administration support. The written designation letter will define the scope of the CORs authority and any limitations. The COR is authorized to provide technical directions to the Contactor, provided such direction:

• Is within the scope of the contract.

• Does not constitute a change to the contract terms and conditions.

• Does not result in any funding obligation or modification.

The COR is not authorized to make changes to the contact’s terms, conditions, scope, price, or period of performance. Only the Contacting Officer has authority to modify the contract. Any proposed changes or requests for modification shall be submitted to the Contracting Officer for review and written approval.

Upon contract award, a formal letter of designation will be issued to the COR and provided to the Contactor.

10.0 Security Requirements for Unclassified Information

General Requirements. Contractor personnel must meet the following conditions of employment:

1. Must be a U.S Citizen or National.

2. Registered for Selective Service (males born after 12-31-1959). A Status Information Letter is required for any male born after 12-31-1959 that is not registered with Selective Service.

3. This is a national security position which requires favorable fitness review and background investigation as a condition of employment. Failure to maintain security eligibility may result in termination.

Personnel Security Investigation (PSI) Requirements

10 | P a g e

Contractor personnel performing work under this contract must possess a favorably adjudicated Tier 3 investigation, or equivalent Noncritical-Sensitive (formerly IT-II) investigation, or a higher-level investigation granting National Security eligibility. At a minimum, Contractor personnel must have a favorably adjudicated Tier 1 investigation.

Contractor personnel must also have current enrollment (within 5 years) in the Continuous Vetting program, in accordance with Trusted Workforce 2.0 standards. No access to classified information is required. In accordance with standard DFAS Personnel Security policy, ALL incoming contractors must submit a new set of fingerprints (taken within the last 30 days) *.

Contractor personnel must apply for a fingerprint appointment immediately (the next business day) upon award date.

Contractor personnel shall submit the Contractor Request for Investigation (CRI) (DFAS Form 9035) immediately (the next business day after providing fingerprints) to the Contracting Officer Representative (COR). The information needed in the Declaration for Federal Employment (OF-

306) shall also be submitted to the COR by contractor personnel.

The COR will submit the OF-306, DFAS Form 9035, and proof of fingerprints to DFAS Personnel Security all at once. Under no circumstances should this documentation be submitted less than fifteen (15) calendar days prior to the intended performance start date. DFAS Personnel Security will review all submitted documentation to validate whether contractor personnel meet personnel security requirements to perform work on the contract or if a new background investigation is required.

Contractors obtaining favorable security evaluations and DoD CACs for required contractor employees performing on this contract are a prerequisite for contractor performance and invoicing. Also, the failure of a contractor to provide employees who can obtain a favorable security adjudication and a DoD CAC in a timely manner may be considered negatively when assessing contractor performance, termination, or other.

*New fingerprints are not required if any of the following apply:

1. The person has been fingerprinted for the Defense Counterintelligence and Security Agency (DCSA) within the past 30 days.

2. The person is currently undergoing a background investigation, or reinvestigation, by DCSA or any other Federal agency.

3. The person has a background investigation currently being adjudicated by the DCSA Adjudication and Vetting Services (DCSA TD(a) or another TD(a).

4. The person has been favorably adjudicated within the past 30 days by the DCSA TD(A) or a TD(a) from any other Federal agency: or

11 | P a g e

5. The person comes directly from another DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

6. The DFAS Personnel Security Office otherwise determines that no new fingerprints are required.

Regulatory Requirements

Contractor personnel shall follow the security and training requirements in DoDM 5220.23, “Industrial Security Procedures For Government Activities,” DoDM 5200.01, Volumes 1-3, “DoD Information Security Program,” DoDI, 5200.48, “Controlled Unclassified Information,” DFAS 2000.1-I, “Force Protection Mission,” DFAS 5200.1-I, “Information Security Program,” DFAS 5200.8-I, “Physical Security Program,” and DFAS 5200.10-I, “Counter Insider Threat Program.”

Contractor personnel shall follow all host security requirements in accordance with Part 117 of Title 32, Code of Federal Regulations; paragraph 117.16. Ensure that all contracting officers include applicable clauses in all contracts that require work to be performed for a DFAS location.

The contractor shall immediately report any occurrences of violation of stated regulations to the DFAS Manager of the area to which they are assigned, Contracting Officer (CO), COR, Director, Force Protection, and the DFAS Personnel Security Office. DoD Issuances can be located at the following web link:

https://www.esd.whs.mil/dd/dod-issuances/

DFAS Instructions can be located at the following agency portal web link:

Official Forms and Pubs - All Documents

DFAS Personnel Security Incident Reporting Requirements, the National Industrial Security Program and Due Process as it Relates to DFAS Contractor Personnel

The National Industrial Security Program (NISP) is a partnership between the federal government and private industry to safeguard classified information and CUI.

Executive Order 12829, as amended, "National Industrial Security Program," further amended by Section 6 of E.O. 13691, was established to achieve cost savings and to ensure that industry safeguards the classified information with which it is entrusted while performing work on contracts, programs, bids, or research and development efforts while working for the United States Government.

It is important to note that personnel employed as contractors for DFAS are not covered under the National Industrial Security Program (NISP) and are exempt from the provisions of 5 C.F.R.

https://www.esd.whs.mil/dd/dod-issuances/ https://dfasportal.dfas.mil/docs/Documents/Forms/AllItems.aspx?RootFolder=%2fdocs%2fDocuments%2fOfficial%20Forms%20and%20Pubs&FolderCTID=0x012000C5AD4BBE89E91A47852CADC95291E394

12 | P a g e

731. This means that DFAS contractor personnel involved in an incident that potentially violates one or more of the National Security Adjudicative Guidelines found at https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines- U.pdf , are not entitled to Due Process rights normally afforded to federal civilian employees and those personnel covered under NISP; more specifically, DFAS Personnel Security may suspend or revoke contractor personnel access to DFAS IT systems, sensitive information and/or DFAS facilities.

Incident Reporting Requirements

In all cases, whenever a DFAS contractor displays conduct, or is involved in any incident, which is in violation of any of the thirteen National Security Adjudicative Guidelines*, the contractor must immediately report the incident to the contractor company Security Office/Facility Security Officer, the DFAS Manager of the area to which they are assigned, the CO, the COR, the Director, Force Protection, and the DFAS Personnel Security Office. Reporting to DFAS Personnel Security may be made by phone to (317) 212-7888, by email to dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil, or, in the case of personnel physically located at DFAS Indianapolis Center, in person to the DFAS Personnel Security Office located on the third floor center hallway at Column 320T.

All incidents will be investigated by DFAS Personnel Security and, depending on the date of the subject’s most recent investigation, may need to have an updated background investigation initiated. Those that do not require a new investigation will have all relevant information regarding the incident forwarded to the DCSA TD(a) for review and re-adjudication.

*The thirteen National Security Adjudicative Guidelines are:

1. GUIDELINE A: Allegiance to the United States

2. GUIDELINE B: Foreign Influence

3. GUIDELINE C: Foreign Preference

4. GUIDELINE D: Sexual Behavior

5. GUIDELINE E: Personal Conduct

6. GUIDELINE F: Financial Considerations

7. GUIDELINE G: Alcohol Consumption

8. GUIDELINE H: Drug Involvement and Substance Misuse

9. GUIDELINE I: Psychological Conditions

10. GUIDELINE J: Criminal Conduct

11. GUIDELINE K: Handling Protected Information

12. GUIDELINE L: Outside Activities

13. GUIDELINE M: Use of Information Technology

Some Examples of Incidents That Require Reporting to DFAS Personnel Security:

https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil

13 | P a g e

a) An arrest for any criminal offense, not including minor traffic violations, by any law enforcement agency. This DOES include the traffic offenses of Driving Under the Influence of Alcohol or Drugs, and Reckless Driving.

b) Violation of any court order.

c) Civil judgements.

d) Delinquencies on any debt for 180 days or longer.

e) Federal, State or Local tax issues or delinquencies.

f) Delinquencies on any Federal debt (including Federal Student Loans and Federally backed home mortgage loans).

g) Child Support delinquencies.

h) Filing for Chapter 7 or Chapter 13 bankruptcy in any Federal Bankruptcy Court.

i) Foreign Travel.

j) Marriage or Cohabitation with a Foreign National (person from a foreign country).

k) Having a close personal friendship with a Foreign National with regularly occurring contact.

l) Ownership of property or financial accounts in a foreign country; and

m) Being approached by a person know to be, or suspected to be, working as an agent of a foreign government or terrorist organization, or any other person, who seeks any information about DFAS, the Department of Defense, or the U.S. Government, especially if the person offers money or something of value to the contractor employee.

It should be noted that a person’s delinquency on Federal debt of any kind may not obtain or maintain favorable personnel security adjudication or be considered for a contractor position with DFAS unless they can provide documentary proof that a payment plan has been established with the Government agency to whom the debt is owed, and that regularly recurring payments are being made. Contractor personnel who cannot obtain and maintain a favorable personnel security adjudication may not have access to government data, facilities, and/or equipment required under the contract.

NOTE: This list does not cover every potential incident or offense; any incident in which a contractor is involved, and a question exists as to whether it should be reported, should report the incident to DFAS Personnel Security, who will then determine if further action is warranted.

Failure to report an incident is, in and of itself, an incident involving personal conduct, and may, in some cases, be more serious than the original incident.

14 | P a g e

Foreign Travel by DFAS Contractor Personnel

Official and Unofficial (Personal) Travel: Official U.S. Government Business: persons employed as contractor employees with DFAS, to include those with Noncritical Sensitive (formerly IT-II) access, Critical Sensitive (formerly IT-I) access, access to critical program information (related to Research, Development, Test, and Evaluation), sensitive compartmented information, and/or special access program information, in accordance with DoD Directive 5240.06, are required to complete a DFAS Form 9133, Notification of Foreign Travel, not less than 30 calendar days prior to the scheduled travel.

One copy shall be sent the DFAS Personnel Security group box at dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil and one copy shall be turned into the Site Force Protection Office of the DFAS site where they are stationed. Site Force Protection POC information:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServi ces.aspx

Upon receipt of the completed Form 9133, the Site Force Protection Office will contact the contractor employee to validate training, complete the country/theater clearance package, as required, and schedule a Foreign Travel briefing. Immediately prior to travel, contractor employees will check with the State Department at https://travel.state.gov/en/international-travel/travel-advisories.html/ for any travel advisories for the country or region being traveled to and take the appropriate steps to ensure their safety for any location covered by a travel advisory or warning.

Security Education and Training

Contractor personnel shall receive initial, continuous and refresher security education training in accordance with DoDM 5200.01, Volume 3, “DoD Information Security Program – Protection of Classified Information,” DoDI 5200.48, DFAS 2000.1-I, DFAS 5200.1-I, DFAS 5200.8-I, and DFAS 5200.10-I. Contractor personnel shall also complete all required contractor training requirements identified in this PWS.

Access To, Accountability For, and Safeguarding of Controlled Unclassified Information

(CUI)

The DFAS manager of the requiring office will determine what CUI contractor personnel are given access to. CUI may not be disclosed to contractor personnel unless required for contract performance. Contractor personnel shall safeguard CUI in accordance with DoDI 5200.48 and DFAS 5200.1-I. The sponsoring DFAS activity will provide storage capability for all CUI required for contract performance. Contractor personnel must monitor CUI for aggregation and compilation based on the potential to generate classified information. Contractor personnel must report the potential classification of aggregated or compiled CUI to the DFAS Manager of the area to which they are assigned, the CO, the COR, and the Director, Force Protection.

mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx https://travel.state.gov/en/international-travel/travel-advisories.html/ https://travel.state.gov/en/international-travel/travel-advisories.html/

15 | P a g e

Installation Entry and Common Access Card (CAC) Requirements

The Contractor shall comply with established security procedures for entering government installations and facilities. Contractor employees shall be required to obtain and wear identification (ID) badges that will permit access into the facility.

Contractors shall work with the assigned DFAS COR/Mission Partner Account Sponsor (MPAS) to obtain a CAC using Mission Partner Identity Credential Account Management (MP ICAM). Under no circumstances will a CAC be issued to any person unless that person has been cleared by the DFAS Personnel Security Office to work on the contract.

All CACs and badges issued to Contractor personnel are government property and must be returned to the assigned DFAS COR/MPAS upon departure from the program or at the conclusion of the contract, whichever comes first. CACs can also be mailed in or turned into RAPIDS locations. Contractors whose CAC is lost or stolen must report the loss as soon as possible to the assigned DFAS COR/MPAS and present documentation that the CAC is missing and describe the circumstances under which the loss occurred. The assigned DFAS COR/MPAS will follow agency CAC procedures to issue a new CAC.

Contractors must not share their CACs and passwords with any other staff members. The assigned DFAS COR/MPAS will report any violation or suspected violation to the Contracting Officer and DFAS MP ICAM Account Security Manager (MPASM). Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from another agency, that CAC must be revoked and returned before issuance of a new CAC.

Training

DoD Mandatory Contractor Personnel Training Requirements: The contractor shall direct that its employees performing under this contract complete the annual mandatory training in accordance with the DoD mandate identified for each training module.

Contractor personnel working at a DFAS site who require a CAC, or contractor personnel working remote via VPN, need to complete the following training modules within 30 days after receipt of CAC, (note for Cyber Awareness Challenge Module 003, completion of this module is required prior to requesting a new DFAS network or VPN account), as a precondition for continued attendance and/or network access.

In addition, these modules shall be completed annually to retain accessibility. Noncompliance will negatively impact contract performance and lead to the loss of CAC and/or network access for contractor personnel.

16 | P a g e

Continuity of Operations and Crisis Management Organization

Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

Cyber Awareness Challenge

Completion of this module is required prior to requesting a new DFAS network or VPN account.

For contractor personnel unable to access the DFAS Portal, the same training is available at:

Cyber Awareness Challenge

Upon completion of the training Contractor personnel shall maintain a copy of the training certificate in PDF, submit a copy to the COR, attached to the request for network access as proof of completion.

Keeping DFAS Safe: Physical Security, Information Security, Personnel Security, CBRNE, Counterintelligence and Operations Security

Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Level I Antiterrorism Awareness Training

All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

Level I Antiterrorism Awareness Training

All other contractor personnel shall take the training through the DFAS Portal upon receipt of network access.

Privacy Act (PA) and Personally Identifiable Information (PII)

Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Records Management

Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

https://usg01.safelinks.protection.office365.us/?url=https%3A%2F%2Fwww.cyber.mil%2Fcyber-awareness-challenge&data=05%7C02%7Ckaren.l.ault.civ%40mail.mil%7Ceb3f4a7fb9ec43594c3108de01b9ce1b%7C102d0191eeae4761b1cb1a83e86ef445%7C0%7C0%7C638950094712890442%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=EUR7F2s47NvdCJN5HXRgI0sS8otbbHGjP3RTi5pGADA%3D&reserved=0 https://usg01.safelinks.protection.office365.us/?url=https%3A%2F%2Fjko.jten.mil%2Fcourses%2FAT-level1%2Flaunch.html&data=05%7C02%7Ckaren.l.ault.civ%40mail.mil%7Ceb3f4a7fb9ec43594c3108de01b9ce1b%7C102d0191eeae4761b1cb1a83e86ef445%7C0%7C0%7C638950094712922744%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=UMsAJtnZEt0R5ZX%2BVTTsNtnIJzEcFq%2BPpBQY3dvEkEU%3D&reserved=0

17 | P a g e

Insider Threat (InT) Awareness Training

Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

DoD Mandatory Controlled Unclassified Information (CUI) Training

All contractor personnel shall take this CUI training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

DoD Mandatory Controlled Unclassified Information (CUI) Training

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

Unauthorized Disclosure of Classified Information and CUI

All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

Unauthorized Disclosure of Classified Information and Controlled Unclassified Information

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

NOTE: This list of training requirements is subject to change.

Training Time

The average estimated time for completion of each training module is approximately one hour or less. Keeping DFAS Safe: Physical Security, Information Security, and Personnel Security training module will take approximately 90 minutes to complete.

Training Methods

Network Training: Network training through the DFAS Portal is the required method for those Contractor personnel who have an existing DFAS network account.

https://usg01.safelinks.protection.office365.us/?url=https%3A%2F%2Fsecurityawareness.dcsa.mil%2Fcui%2Findex.html&data=05%7C02%7Ckaren.l.ault.civ%40mail.mil%7Ceb3f4a7fb9ec43594c3108de01b9ce1b%7C102d0191eeae4761b1cb1a83e86ef445%7C0%7C0%7C638950094712942520%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=hKaM21diAU2Rwa24sjm5NDdqk1h7KWSLP2HYjt1k6n0%3D&reserved=0 https://usg01.safelinks.protection.office365.us/?url=https%3A%2F%2Fsecurityawareness.dcsa.mil%2Fdisclosure%2Findex.html&data=05%7C02%7Ckaren.l.ault.civ%40mail.mil%7Ceb3f4a7fb9ec43594c3108de01b9ce1b%7C102d0191eeae4761b1cb1a83e86ef445%7C0%7C0%7C638950094712958991%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=3zxgscj6HL1CPoi6yFIP2KSgRT0c5jXKIMn2CvwTD%2BA%3D&reserved=0 https://usg01.safelinks.protection.office365.us/?url=https%3A%2F%2Fsecurityawareness.dcsa.mil%2Fdisclosure%2Findex.html&data=05%7C02%7Ckaren.l.ault.civ%40mail.mil%7Ceb3f4a7fb9ec43594c3108de01b9ce1b%7C102d0191eeae4761b1cb1a83e86ef445%7C0%7C0%7C638950094712958991%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=3zxgscj6HL1CPoi6yFIP2KSgRT0c5jXKIMn2CvwTD%2BA%3D&reserved=0

18 | P a g e

Web-based Training: All contractor personnel are required to take the following web-based training: Cyber Awareness Challenge (When system/network access is required), Level I Antiterrorism Awareness Training, DoD Mandatory Controlled Unclassified Information Training, and Unauthorized Disclosure of Classified Information and CUI. If an individual does not have network access through the DFAS Portal, they can complete the training through a DoD authorized Web source.

All other contractor personnel shall take the training through the DFAS Portal upon receipt of DFAS network access. The contractor personnel shall retain a PDF copy of the “Certificate of Completion” or a “screen shot” with the date of the completion of the training. The COR will maintain a file for proof of completion.

Contractor personnel who do not require network access but require unescorted access into a DFAS facility shall receive applicable security training through the site Force Protection Office.

To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection Portal Page:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServi ces.aspx

The prime contractor official representative shall provide the COR with a group list of its personnel requiring completion of the training. The COR will submit the ‘group list’ to the Site Force Protection Officer to schedule training. As a reminder, the prime contractor official representative shall submit this group list of names within 30 days after contract award.

Requests for individual training shall be justified in writing and submitted to the COR for evaluation. Special arrangements will be determined by the Site Force Protection Officer, other training Module POCs and the COR.

Interaction with Contractor Personnel. The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

The prime contractor official representative shall coordinate with the COR a training schedule without causing undue delays to contract performance.

The prime contractor official representative (including subcontractor’s personnel when applicable) shall provide the COR, within 30 days after contract award/exercise of an option, a written report identifying:

- Contractor employees required to take the training

- Contractor employees who have completed the training

- Contractor employees who are delinquent https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx

19 | P a g e

Contractor personnel shall direct their training questions or concerns to their contractor management chain and/or company representative.

Monthly Training Status Reports. The prime contractor official representative shall submit a monthly status update to the COR, identifying the initial and annual training status of all contractor personnel.

Training Point of Contact (POC). The COR is the POC for the Contractor. The Contractor shall provide regular training updates to the COR and keep an updated registry to assure employees who come on board at any time in the contract life have completed all required training.

11. Data Protection

The Contractor shall comply with Cybersecurity Maturity Model Certification (CMMC) Level 1 requirements for the protection of Federal Contract Information (FCI), as applicable to this contract. This requirement is limited to safeguarding FCI that may be provided to or generated by the Contractor in performance of HVAC maintenance and repair services under this contract. This requirement does not involve the processing, storage, or transmission of Controlled Unclassified Information (CUI).

11.1. The Contractor shall implement and maintain, at a minimum, the safeguarding requirements prescribed in FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems. FCI under this contract may include but is not limited to work schedules; maintenance logs and service reports;

equipment inventories; technical manuals or drawings provided for maintenance purposes; and contract administration documentation.

11.2. The Contractor shall ensure that any information system used to process, store, or transmit FCI in performance of this contract meets CMMC Level 1 safeguarding requirements and maintains compliance throughout the period of performance.

11.3. The Contractor shall flow down the substance of applicable CMMC Level 1 and FAR 52.204-21 requirements to subcontractors that may process, store, or transmit FCI in support of this contract.

10.0 Security Requirements for Unclassified Information